Cybersecurity & Data Protection Laws
Required cybersecurity documents in eSTAR submissions
FD&C Act section making cybersecurity legally mandatory
Potential revenue loss from refused or delayed submissions
Regulation Overview
https://www.fda.gov/medical-devices/digital-health-center-excellence/cybersecurity
FDA medical device cybersecurity guidance is the primary regulatory framework governing cybersecurity requirements for medical devices sold in the United States. Section 524B of the FD&C Act, enacted through FDORA in December 2022, makes cybersecurity a mandatory component of every premarket submission for cyber devices. The June 2025 final guidance supersedes all prior versions and consolidates FDA's expectations into a single document. FDA now defines a cyber device as any device that contains software or is itself software—regardless of network connectivity. Manufacturers must demonstrate reasonable assurance of cybersecurity through SBOMs, vulnerability management plans, threat models, security testing results, and coordinated vulnerability disclosure policies. FDA medical device cybersecurity compliance requires component-level software transparency from every supplier in the device's software supply chain. The eSTAR submission template requires 12 specific cybersecurity documents. Submissions lacking cybersecurity documentation are subject to Refuse to Accept decisions.
Key Components / Sub-Frameworks
Manufacturers of medical devices containing software sold in the U.S. market\nImporters and distributors placing cyber devices on the U.S. market\nContract manufacturers producing software-enabled medical devices for U.S. sponsors\nNon-U.S. companies seeking FDA clearance or approval for cyber devices\nCompanies modifying previously authorized devices requiring new premarket submissions\nSoftware suppliers providing components integrated into FDA-regulated cyber devices
Key Thresholds
FDA requires a complete SBOM covering every commercial, open-source, and off-the-shelf component. Your device runs on software from 30 suppliers. Eight provide no SBOM data. Five use proprietary formats. Three haven't disclosed component versions. You cannot submit without full supply chain transparency—and the eSTAR template will not let you proceed.
Since October 2023, FDA cybersecurity deficiency letters have increased 700%. Submissions missing cybersecurity documentation trigger Refuse to Accept decisions—meaning your device never enters substantive review. Each rejection cycle costs months and delays market authorization while competitors clear.
Section 524B requires a postmarket vulnerability management plan covering coordinated disclosure, patch timelines, and customer notification. Your device contains 200 software components from 15 suppliers. A critical CVE is published. You need to know which devices are affected, which suppliers own the component, and whether a patch exists—within hours, not weeks.
Your device ships to the U.S. and EU. FDA requires SBOM, vulnerability plan, and SPDF documentation. The EU Cyber Resilience Act requires separate conformity evidence with its own SBOM requirements. EU MDR requires additional cybersecurity risk documentation. Without a centralized compliance evidence management platform, your team maintains three parallel documentation systems for every product.
Certivo In Action
Certivo in Action — FDA Cybersecurity Workflow
From Manual SBOM Assembly to Automated Evidence Packages
CORA collects, parses, and validates supplier SBOM data automatically. Your team focuses on security architecture decisions—not chasing suppliers for component inventories.
Premarket Submission Acceleration
Generate complete, audit-ready FDA cybersecurity documentation packages in hours—not the 3-6 months of manual compilation across suppliers and engineering teams.
Proactive Postmarket Compliance Assurance
When new CVEs are published, Certivo identifies affected devices and components instantly. Maintain continuous audit-ready documentation for FDA postmarket inspections—without reactive fire drills.
Key Statistics
Frequently Asked Questions
What medical devices are subject to FDA cybersecurity requirements under Section 524B?
Section 524B applies to all cyber devices—defined as any medical device that contains software or is itself software. The June 2025 final guidance clarifies that this includes devices regardless of whether they are network-enabled. If a device contains sponsor-validated software and has any capability that could enable connectivity (including USB ports), it is likely a cyber device. This covers 510(k), PMA, De Novo, PDP, and HDE submissions.
What happens if a premarket submission lacks cybersecurity documentation?
FDA applies a Refuse to Accept policy for cyber device submissions missing required cybersecurity documentation. Since October 2023, cybersecurity deficiency letters have increased approximately 700%. A refused submission never enters substantive review—delaying market authorization by months. Each resubmission cycle compounds the delay and cost. Certivo's eSTAR readiness scoring identifies documentation gaps before you file.
What SBOM format does FDA require for premarket submissions?
FDA requires a machine-readable SBOM listing all commercial, open-source, and off-the-shelf software components. SPDX and CycloneDX are the preferred formats. The SBOM must include component names, versions, supplier information, and must align with NTIA minimum SBOM requirements. CORA collects supplier SBOMs in any format and normalizes them into FDA-compliant machine-readable exports.
How does Certivo help with FDA cybersecurity premarket submissions?
Certivo collects supplier SBOMs and security attestations at scale, extracts component metadata to version level, validates against vulnerability databases, and generates all 12 eSTAR cybersecurity documentation items. CORA maps collected evidence against Section 524B requirements, identifies gaps, and produces submission-ready packages in hours. Postmarket vulnerability monitoring maintains continuous compliance evidence for FDA inspections.
How does FDA cybersecurity compliance relate to EU CRA and EU MDR requirements?
FDA Section 524B, the EU Cyber Resilience Act, and EU MDR all require cybersecurity evidence for medical devices—but with different documentation structures and submission formats. Certivo validates one supplier SBOM submission against all three frameworks simultaneously, generating FDA eSTAR packages, CRA conformity documentation, and MDR cybersecurity risk files from a single evidence collection campaign.