PMA Cybersecurity
Class III devices going through the PMA pathway face the deepest cybersecurity scrutiny the FDA applies. Reviewers expect the full seven-section eSTAR package, end-to-end SPDF traceability, a defended threat model, an SBOM with vulnerability mapping and VEX, penetration testing scoped to safety-critical attack surfaces, and a postmarket plan that survives audit. This hub aggregates our PMA-focused services, deficiency-response work, and the guides and posts that explain how PMA cybersecurity differs from a 510(k) - including when a PMA supplement is the right vehicle for a security change versus a Letter-to-File.
The short answer
PMA cybersecurity is the same Section 524B content set as any other pathway, applied at greater depth because Class III devices are life-sustaining or life-supporting. Reviewers expect the security risk assessment to connect explicitly to the clinical safety and effectiveness case, a threat model whose severity ratings reflect the device's clinical role, penetration testing that reaches safety-critical firmware paths, and a postmarket plan that covers the full device lifetime. After approval, any security change that affects safety or effectiveness generally needs a PMA supplement rather than a Letter-to-File.
Services
- FDA Premarket Cybersecurity Package
Full-service: we produce the full cybersecurity documentation set for 510(k), De Novo, PMA, PDP, and HDE submissions under §524B, plus IDE applications under 21 CFR 812 and the FDA's February 3, 2026 premarket guidance - traceable, complete, and current.
- FDA Deficiency Response
Cybersecurity gap analysis, evidence updates, and point-by-point responses for manufacturer review across 510(k), De Novo, PMA, and HDE.
- Medical Device Threat Modeling
Comprehensive threat modeling per FDA Section V.A.1 - covering supply chain, deployment, environment of use, and decommission risks for the full device system.
- Medical Device SBOM Services
Medical device SBOM services with source, build, and binary evidence reconciliation, component vulnerability assessment, and support-status verification. SPDX by default; fixed fee after scoping.
- Medical Device Penetration Testing Services
Medical device penetration testing services across agreed hardware, firmware, wireless, app, and cloud attack paths. Threat-traced Test Plan, Test Cases, and Test Report for FDA submission documentation.
In-depth guides
- FDA PMA Cybersecurity Requirements: Expert Guide (2024)Master FDA PMA cybersecurity requirements. Learn the technical documentation, risk management, and SPDF requirements needed for a successful Class III submissio
- FDA Pathway Cybersecurity Differences: 510(k) to PMAHow cybersecurity expectations differ across FDA pathways - 510(k), De Novo, PMA, HDE, IDE, Q-Sub, and PDP - under Section 524B and the February 2026 final guidance.
- 12 Reasons the FDA Rejects Cybersecurity SubmissionsThe most common cybersecurity deficiencies in 510(k), De Novo, and PMA submissions, what triggers each one and how to fix it before you file. Aligned to the FDA February 2026 final guidance and Section 524B.
- The SPDF Playbook: Secure Product Development FrameworkA practical, ungated guide to building a Secure Product Development Framework (SPDF) that FDA accepts, the eight pillars, the artifacts each one produces, and a pre-submission readiness checklist you can score yourself against.
- FDA Cybersecurity Deficiency Response ChecklistA step-by-step, 11-stage checklist for organizing and resolving FDA cybersecurity deficiency letters across 510(k), PMA, De Novo, and HDE submissions. Aligned to the FDA February 2026 final guidance and Section 524B.
- Postmarket Cybersecurity Readiness PlanA three-phase plan, Premarket → Launch → Operate, for the cybersecurity work that starts before your 510(k) is filed, lights up before your first device ships, and runs for the life of the product. Aligned to the FDA February 2026 final guidance.
- ISO 14971 vs AAMI TIR57: Hazard Analysis Meets Cybersecurity RiskHow safety hazard analysis and security risk analysis run in parallel and converge at the patient-harm column, with a side-by-side mapping table.
- Full-Service Cybersecurity for PMA SubmissionsWhat a Class III PMA cybersecurity package needs, and how one integrated team delivers threat modeling, SBOM, pen testing, and the postmarket plan.
Standards & guidance
Defined entries from our MedTech Cybersecurity Standards Glossary.
- FDA 2026 GuidanceFDA Premarket Cybersecurity Guidance (Feb 3, 2026)The FDA's final premarket cybersecurity guidance, issued February 3, 2026. Provides nonbinding recommendations for cybersecurity documentation and explains Section 524B obligations. It directly supersedes the June 27, 2025 guidance; September 2023 was a final guidance, not a draft.
- Section 524BFD&C Act Cyber Device RequirementsSection 524B of the FD&C Act (the statutory partner to 21 CFR 807.81) was added by the Consolidated Appropriations Act, 2023. It gives the FDA explicit authority to require a complete cybersecurity package in every premarket submission for a cyber device, and to refuse submissions that lack one. It works alongside 21 CFR 807.81, which sets the 90-day 510(k) filing floor.
- eSTARElectronic Submission TemplateFDA's mandatory interactive submission template with structured upload slots for each cybersecurity artifact.
- SPDFSecure Product Development FrameworkA documented framework that shows security activities are integrated across the device lifecycle - not bolted on at the end. Includes secure requirements, threat modeling, secure coding, V&V, vulnerability management, and post-market response.
- ANSI/AAMI SW96Medical Device Security Risk ManagementThe consensus standard for medical device security risk management, asset, threat, vulnerability, likelihood, severity, and residual risk acceptability.
- ISO 14971Medical Device Risk ManagementThe umbrella risk-management standard for medical devices. Defines hazard identification, risk estimation, risk evaluation, risk control, and residual risk evaluation. Cybersecurity risks must be reconciled here so a security control never silently introduces a safety hazard.
From the blog
- PMA Supplement Cybersecurity ChangesWhich PMA submission type a cybersecurity change requires - 180-day supplement, Real-Time, Special, 30-day notice, or annual report - and the decision.
- Letter to File vs New 510(k)When a cybersecurity change to a cleared device stays as a letter to file in the DHF, and when it forces a new 510(k). Decision framework and examples.
- Implantable Device Cybersecurity: Risks, Controls, EvidenceImplantable device cybersecurity has constraints no other device shares: no patch window, limited power, and harm measured in physiology. Here is what to do.
- Modular PMA Submission: What MedTech Teams Need to Know (2026)Modular PMA Submission explained for medical device manufacturers, definition, FDA context, and what teams must document for 2026 submissions.
- FDA 510(k) & PMA Cybersecurity GuideSearch the FDA 510(k), De Novo, and PMA databases for cybersecurity precedent, product codes, and predicate devices before a Section 524B premarket filing.
- 510(k) Cost in 2026: FDA Fees, Testing and Consultant SpendWhat a 510(k) really costs: FDA user fees, small business discounts, testing, cybersecurity work and consultant spend, plus how De Novo and PMA costs compare.
Interactive tools
- Pathway crosswalk
See how PMA cybersecurity evidence expectations differ from 510(k), De Novo, and IDE, side by side.
- eSTAR cybersecurity checklist
Walk the cybersecurity sections your PMA package has to fill before the acceptance screen.
- Deficiency letter triage
Classify a PMA cybersecurity deficiency and get the artifact that closes it.
Related FDA deficiencies
The deficiency letters reviewers most often write on submissions in this topic area. Each links to the full response playbook.
- Incomplete Threat Model
Reviewers say your STRIDE/attack-tree analysis misses interfaces, trust boundaries, or post-market threat surfaces.
Response playbook - Insufficient Penetration Testing Evidence
Reviewers find your penetration test scope too narrow, methodology unclear, or testers insufficiently independent.
Response playbook - Inadequate Vulnerability Management Plan
Your VM plan lacks defined triage timelines, a coordinated vulnerability disclosure path, or a documented patch-deploy mechanism.
Response playbook - Missing SPDF Documentation
Reviewers cannot find evidence that your QMS implements a Secure Product Development Framework integrated with design controls.
Response playbook
PMA Cybersecurity - frequently asked questions
Secure your device before it reaches patients.
30-minute strategy session. No cost, no commitment - just answers from people who've supported 275+ FDA submissions, with zero cybersecurity rejections.