The February 3, 2026 guidance encourages an SPDF but permits other QMSR approaches. These company checklist scores are not FDA compliance or review outcomes; AI lifecycle draft proposals are not mandatory.
Reviewed by
Christian Espinosa
Founder & CEO, Blue Goat Cyber
Security Risk Management Governance
Security risk integrated into the QMS, with accountable roles and policy approvals.
Documented product cybersecurity policy approved by senior management
Sets scope, roles, escalation, and review cadence.
Named product security owner per product line
A single accountable person, not a committee.
Cyber requirements traceable in design inputs / design outputs
QMSR incorporates ISO 13485, including applicable design and development controls in §7.3; former §820.30 is not a current QMSR section.
Annual secure-development training for engineering
Recorded, role-specific.
Secure Design & Architecture
Cyber controls baked in, not bolted on.
Living threat model (STRIDE / SW96) linked to architecture
Updated on architecture change.
Documented trust boundaries and data-flow diagram
Provide diagrams and explanatory text; DFDs, state diagrams, swim-lane diagrams, and call-flow diagrams are valid options.
Secure-by-default configuration baseline
No default credentials, services off by default.
Cryptography per FIPS 140-3 / NIST SP 800-131A
Approved algorithms, validated modules where applicable.
Identity, authentication, and least-privilege model
Per IEC 81001-5-1 §5.
Secure Implementation
Build the thing the design called for, with controls reviewers can verify.
SAST + secrets scanning in CI on every PR
Blocking, not informational.
SBOM generated each build (SPDX or CycloneDX)
Build-traceable, not periodic.
SCA + CVE / KEV correlation against SBOM
Daily or per-build.
Code-signing and verified / measured boot
Where the hardware supports it.
AI-generated code tracked, reviewed, and provenance-logged
Company supply-chain practice; the February 2026 guidance does not prescribe AI-origin tags or a provenance format.
Verification & Validation
Security testing tied back to threat-model items.
Independent penetration test scoped from the threat model
Not a one-off scan.
Protocol / interface fuzzing on exposed surfaces
Wi-Fi, BLE, USB, vendor APIs.
Test → threat → control → requirement traceability
Reviewers will look for it.
Security regression tests in CI
Re-run on every release.
Postmarket Vulnerability Management
For covered cyber-device submissions, Section 524B requires a vulnerability plan, coordinated disclosure, and cybersecurity processes and patches. The checklist's monitoring and management cadences are company practices, not universal FDA deadlines.
Published CVD policy with SLAs
ISO/IEC 29147-aligned.
Continuous SBOM monitoring + triage workflow
Documented intake → triage → fix.
Patch / OTA mechanism validated for the device
Signed, rollback-safe, integrity-checked.
21 CFR 806 / FDA postmarket reporting playbook
Assess applicable reporting triggers separately. The 2016 guidance's 30/60-day policy is conditional reporting-enforcement discretion, not a universal patch deadline. Section 524B requires critical vulnerabilities that could cause uncontrolled risks to be addressed as soon as possible out of cycle.
Postmarket security metrics reviewed quarterly with management
MTTR, KEV exposure, patch coverage.
Supply Chain & Component Risk
What enters the build is as important as what you write.
Vendor / component security questionnaire on critical dependencies
Including AI training-data provenance.
Build provenance (SLSA L2+ or equivalent)
Company supply-chain practice; no SLSA level or named attestation format is prescribed by the February 2026 guidance.
Dependency-confusion + typosquat defenses
Private registry pinning.
End-of-support roadmap for OS / chipsets
Pre-EoL replacement plan exists.
What you'll see after you submit
Common misconceptions
Myth: SPDF is a single document we write before submission.
Reality: The FDA recommends an SPDF as one way to meet QMSR design-control expectations across the TPLC. If you use one, it operates across engineering, not as a single submission document.
Myth: IEC 62304 lifecycle = SPDF.
Reality: 62304 governs software lifecycle activities; SPDF adds security risk management, threat modeling, postmarket vulnerability handling, and supply-chain controls on top.
Myth: If we're 81001-5-1 conformant, the SPDF is done.
Reality: 81001-5-1 is the strongest single anchor, but the FDA expects integration with QMSR (21 CFR 820), 14971, and the premarket cyber guidance - not 81001-5-1 alone.
References & further reading
Tracked signals that change what reviewers expect. Items move on as new ones land.
Living STRIDE register that drives V&V scope.
Read Threat Model StarterScore the supply-chain leg of the framework.
Read SBOM Readiness CheckerPostmarket disclosure SLA your SPDF references.
Read CVD Policy GeneratorWe stand up the missing pieces with your team.
Read FDA premarket cybersecurity services