Navigating FDA Premarket & Postmarket Cybersecurity Requirements

FDA premarket cybersecurity requirements determine how medical device manufacturers address security risks and document their controls before marketing authorization. Postmarket requirements concern how those risks are monitored and managed after release. The FDA's February 3, 2026, final cybersecurity guidance explains its current recommendations, while Section 524B of the Federal Food, Drug, and Cosmetic Act establishes specific legal obligations for qualifying cyber devices. Understanding both stages helps manufacturers prepare submissions, maintain software security, and manage vulnerabilities that emerge during a device's service life.

What Do Premarket and Postmarket Cybersecurity Mean?

In the medical device security management lifecycle, there are two phases: Premarket Cybersecurity and Postmarket Cybersecurity. The two are based on different principles: the first one is about assessing a device prior to marketing authorisation; the second one is security after marketing authorisation.

What is premarket cybersecurity?

Premarket cybersecurity refers to any action taken to secure medical devices during the design, development, verification, validation and preparation for the regulatory submission process. Before the product is released to the market, manufacturers evaluate the product's architecture, interfaces, software requirements, threats and security measures.

The goal is to establish pertinent hazards, put in place the suitable protection measures, and gather proof of the device's cyber security assessment.

What is Postmarket Cybersecurity?

Post market cyber security refers to the processes that need to be undertaken to manage and monitor cyber security threats once the product has been put onto the market. Software flaws may arise following the release, third-party software components may become unsupported, and new research might expose new attack vectors.

Manufacturers should have procedures in place to investigate these developments, assess whether any products are impacted by the developments, evaluate the risks to the product, and then take appropriate action for remediation.

The two stages should operate as a continuous process. A vulnerability discovered after release may require reassessing an existing risk, changing a security control, updating software, and revising the documentation supporting the device.

Which Medical Devices are Subject to Section 524B?

The new Section 524B covers cyber devices that are defined under the statute. According to the FDA, there are three criteria:

• Software validated, installed, or authorized by the sponsor as a device or in a device.
• The device is Internet enabled.
• The device has technological features that may be susceptible to cybersecurity attacks.

Some examples of such devices are patient monitors, infusion pumps, imaging devices and some software-based medical devices. The final specification is dependent on the product's features, application software and connectivity.

Statutory requirements are applicable to premarket submissions such as 510(k), Premarket Approval (PMA), De Novo, Product Development Protocol (PDP) and Humanitarian Device Exemption (HDE) submissions, including applicable supplements.

Submission prior to March 29, 2023 will not be subject to Section 524B. If there is a modification to a previously authorized cyber device, and the change necessitates a new premarket submission, the manufacturer must evaluate the requirements of Section 524B that apply to the change.

What documentation do manufacturers need for FDA premarket cybersecurity?

A pre-market cyber security package should link the device's architecture, threats identified, risk assessments, security controls, security testing evidence, and post-market plans. The papers should include a description of the things that were measured, reasons for choosing the controls and how the manufacturer will address the controls that remain.

The following 14 documentation categories offer a practical way for organizing the evidence. They are not a universal FDA-mandated set of 14 separate files. The actual content submitted varies from device to relevant requirements.

1. Security Architecture

Security architecture documentation includes details about the components, interfaces, data flows, trust boundaries, external connections, and security controls that have been put in place on the device. Should demonstrate how the device communicates with other systems that are connected to it, including hospital networks, cloud platforms, external programmers, and mobile applications (where applicable).

2. Threat Modeling Report

A threat modeling report lists possible threats, attack paths, affected assets and potential consequences to device safety and effectiveness. It should summarize the assumptions regarding the operating environment, the mitigations chosen and the risks that are still present following these mitigations.

3. Software Bill of Materials (SBOM)

An SBOM includes software components that are included in the device, such as commercial, open-source, and off-the-shelf software. SBOMs are required for cyber devices that meet the requirements of Section 524B. Manufacturers should keep readily available component and version details, which they can use to identify products that are vulnerable when information about a vulnerability becomes available.

4. Software Level of Support and End of Support

This documentation indicates whether software components are actively supported, supported in a limited way, or end of supported. It can assist manufacturers in assessing whether unsupported components increase risk and whether the component should be updated, replaced, or otherwise mitigated.

5. Penetration Testing Report

A penetration testing report contains details of the scope of the assessment, length of time taken, methods used, expertise and independence of the tester, findings, and observations made. It ought to describe how the manufacturer has considered the identified vulnerabilities and record the reasons for any vulnerability that is deferred or not resolved.

6. Retesting Report

A retesting report documents verification performed after remediation. It links identified findings to corrective actions, describes the retesting method and results, and indicates whether the vulnerability has been addressed or needs further work. It can also record relevant regression testing to help establish that a fix has not introduced additional security or functional problems.

7. Security Assessment of Unresolved Anomalies

This analysis measures un-resolved software anomalies which may have a detrimental influence on cyber security and/or device security. It should include a description of the anomaly, how it can be exploited, what the impact is, what controls (or mitigations) can be taken to limit the impact, and why it is not being addressed or why it is being postponed.

8. Cybersecurity Risk Assessment

A cyber security risk assessment measures known threats and vulnerabilities based on the architecture of the device and its intended operating environment. It should record the relevant risk assessment approach, chosen mitigations and conclusions about the remaining risks, including links to the threat assessment and testing evidence.

9. Safety and Security Risk Assessment of Vulnerabilities

This evaluation reviews identified vulnerabilities and how they can impact patient safety, patient effectiveness, and device function. It should explain how each of the vulnerabilities that will be considered is being evaluated, what mitigating controls apply, and why the risk assessment will be consistent with the chosen response.

10. Cybersecurity Controls

Cybersecurity control documentation comprises documentation that documents the security controls chosen to mitigate the identified risks. These can include evidence of verification of relevant controls as well as authentication, authorization, encryption, data integrity, secure update mechanisms, access restrictions, event logging and recovery, among others, depending on the device.

11. Cybersecurity Risk Management Report

The report is a summary of the cybersecurity risk management activities, findings, decisions about how to mitigate threats, results of testing, and conclusions about the remaining risk. It should reference the risk assessments with supporting evidence and controls that were put in place, to enable the reader reviewing the risk assessment to understand how the manufacturer came to the conclusions.

12. Cybersecurity Labeling

Cybersecurity Labeling offers users information to install, configure, operate, and secure the device. It can include network requirements, the configuration supported, access controls, software updates, known security issues, and information necessary to maintain the device throughout its service life, depending on the product.

13. Cybersecurity Metrics

Cybersecurity metrics can be used to see if the manufacturer's security practices are effective. These include the time required to analyze vulnerabilities, publish vulnerabilities and wait for patches, and push available patches to the field. The chosen metrics should be used to inform decisions on remediation and lifecycle management.

14. Cybersecurity Risk Management Plan

The cybersecurity risk management plan outlines the ways the manufacturer will track, detect, assess, and mitigate cybersecurity risks throughout the device lifecycle. If a cyber device is subject to planning or procedures, then these should cover the requirements of Section 524B, such as postmarket vulnerability management, coordinated vulnerability disclosure, and security updates and patches.

How should these 14 documents work together?

The value of the documentation depends on traceability, not merely on the number of files. For example, if a third-party software component has a newly disclosed vulnerability, the manufacturer should be able to identify the affected component in the SBOM, evaluate the vulnerability's relevance, assess its effect on the device, document the mitigation, verify the fix, and update relevant postmarket records.

This connection between software inventory, risk assessment, testing, remediation, and maintenance makes the evidence more useful to reviewers and to the engineering team responsible for the product.

The FDA's February 2026 guidance provides guidance regarding cybersecurity documentation and supporting evidence.

What impact does Section 524B have on FDA Premarket Submissions?

Sponsors submitting cyber devices that meet the requirements of the statute must submit information proving compliance with the statutory cybersecurity requirements in Section 524B.

Three main commitments are made in the center.

• Vulnerability management: The manufacturer shall provide a plan for coordinating vulnerability disclosure, identifying and addressing postmarket vulnerabilities and exploits within a reasonable time.
• Cybersecurity processes and updates: The manufacturer shall design, develop and maintain processes and procedures that have reasonable assurance of cybersecurity of the device and related systems. It should also provide available post market security patches and updates.
• Software bill of materials: The manufacturer needs to provide an SBOM for commercial, open-source, and off-the-shelf software.

These requirements must be supplemented by those recommended by the FDA for documenting architecture, threat modeling, controls, testing, labeling and lifecycle management.

The FDA is also recommending use of its electronic submission template (eSTAR) for 510(k) submissions, unless an exemption is applicable. The agency's cybersecurity FAQ explains that a cybersecurity section of the response that does not contain relevant attachments or does not have accurate responses may lead to a technical screening hold.

Manufacturers should thus evaluate the submission in the light of the current guidance and make sure that all of the responses are backed up by the relevant documents.

What Are the FDA's Postmarket Cybersecurity Requirements?

Postmarket cybersecurity starts before the launch of the device. There should be processes in place for manufacturers to manage new vulnerabilities, to investigate the reports, assess the risks, develop a fix, and communicate with their customers.

The FDA's Postmarket Management of Cybersecurity in Medical Devices guidance offers recommendations on how to manage vulnerabilities of marketed and distributed devices.

• Vulnerability monitoring and risk assessment

Keep track of relevant vulnerability databases, supplier advisories, security research and customer/end-user/Researcher reports. If the vulnerability is published, specify the component and version involved, provide information on the vulnerability exposure and the potential impact on the device's safety and operation.

The main factors to consider in prioritizing threats are not just a generic severity score, but also the ability to exploit the device, exploitation history, mitigations available, device functionality, and clinical consequences.

• Coordinated vulnerability disclosure

Manufacturers should have a clear vulnerability reporting process in place for receiving and acknowledging reports, investigate whether the found vulnerabilities are relevant, coordinate the remediation process and communicate with relevant parties.

The process should include assigning responsibility for triage, risk assessment, remediation decision, and communication with the customer. It should also consider the time required to develop and validate a fix.

• Security patches and updates

Changes should fix vulnerabilities without causing any unacceptably high risk of harm or compromise to device safety and/or performance. Manufacturers need to test remediation, evaluate compatible issues and give instructions for deployment.

There are two categories of vulnerability under Section 524B:

• Acceptable vulnerabilities: Updates and patches need to be provided on a reasonably-justified regular schedule.
• Critical vulnerabilities that could cause uncontrolled risks: Updates and patches must be made available as soon as possible, outside that regular cycle.

There isn't a single patch date for everyone, as the law makes no such provisions. Such a decision from the manufacturer should be based on the requirements and the risks associated with the vulnerability.

• Customer communication and incident handling

Manufacturers must notify consumers about the affected products and the significance of the vulnerability, and tell them if there are interim mitigations available, and inform them how to get remediation.

They should also maintain documentation for vulnerability assessments, decisions, changes, and pertinent testing. If an incident could impact safety or effectiveness, manufacturers should evaluate any FDA reporting requirements on their own.

How Should Manufacturers Connect Premarket and Postmarket Evidence?

Premarket documentation should provide the foundation for postmarket decisions. If the manufacturer cannot connect a new vulnerability to the device's software inventory, architecture, risk assessment, and previous testing, determining its impact can take longer.

The following example illustrates how the evidence should connect.

This is a real-life approach to evidence management; it is not the six-step process required by FDA. It shows how a manufacturer can make their cyber decision-making process auditable from identification to resolution.

The approach also can be used to address FDA questions, address security incidents and determine if a change to an existing device impacts previously submitted evidence.

How Does QMSR Affect FDA Cybersecurity Compliance in 2026?

The FDA's two new Regulations, Quality Methods and Quality Management System (QMSR), took effect on February 2, 2026. It revised 21 CFR Part 820 and added the reference to ISO 13485:2016.

Medical device manufacturers should embed cybersecurity into the applicable quality processes, such as design and development, risk management, verification & validation, supplier control, change control, and corrective action.

For instance, if there is a change in security authentication, this will impact the threat model, controls in place, testing scope and current risk assessment. The manufacturer is responsible for deciding which records should be revised and whether or not a new FDA submission is needed pursuant to the Rules.

FDA Premarket and Postmarket Cybersecurity Updates in 2026

There are a few developments that are pertinent to manufacturers who need to submit to cybersecurity and keep their connected medical devices. Not all of these have the same regulatory significance; it is important to differentiate FDA requirements from technical guidance and resources from the industry.

• February 3, 2026: FDA issues updated final cybersecurity guidance

The FDA issued the current final Cybersecurity in Medical Devices: Quality Management System Considerations and Content of Premarket Submissions guidance, superseding its June 2025 edition. Manufacturers should use the February 2026 document when reviewing submission evidence and cybersecurity processes.

The FDA's recognized consensus standards database was updated on September 28, 2026, and identifies the February 2026 cybersecurity guidance among the relevant references. This is a useful current-status check, not a separate cybersecurity regulation.

• April 2026: NIST updates guidance for IoT manufacturers

In April 2026, NISTIR 8259 Revision 1 was published. It outlines basic activities to undertake when manufacturing and supporting connected products, such as offering customers security capabilities and information on maintenance and end-of-life support.

While it's not a medical device regulation, it provides relevant guidance for connected medical technology teams as they consider product support, customer communication and lifecycle security.

• April 22, 2026: MITRE publishes new medical device risk and SBOM resources

MITRE released Cybersecurity Risk Analysis for Medical Devices in the Era of Evolving Technologies covering security issues related to cloud, AI/ML, and post-quantum cryptography.

On the same day, MITRE released Considerations for Managing Challenges in SBOM Data Normalization. The paper explores the challenges of handling inconsistencies in component ID and records, for example in processing SBOMs and for vulnerability management.

The lesson for manufacturers is to ensure that their parts stock is reliable and to evaluate new technologies against the specific device. These documents are technical documents and not new FDA requirements.

• July 22, 2026: ENISA publishes healthcare procurement guidelines

To assist healthcare organizations in incorporating security into the procurement process, ENISA released a new set of guidelines entitled: Procurement Guidelines for the Cybersecurity of Hospitals and Healthcare Providers.

The guidance is applicable to manufacturers who provide connected medical technology, since customers are likely to ask more and more about the software support, security updates, vulnerabilities and obligations of the supplier. It is a resource for EU healthcare procurement, not a rule of FDA.

• October 9, 2026: HHS updates its healthcare cybersecurity resources

On October 9, 2026, HHS ASPR TRACIE updated its Cybersecurity Topic Collection. The collection focuses on incident response, downtime and continuity of patient care.

This is especially important for healthcare devices in a clinical setting. Manufacturers should think about what they would need to do to enable users to operate safely if the device or supporting system is unavailable, and healthcare organizations should have realistic response and recovery plans.

How Medysec Approaches Premarket and Postmarket Cybersecurity

Medysec published service description for the following activities:

• Premarket assessment: Examine scope of devices, regulatory path, architecture, interfaces, data flows and attack surface.
• Documentation and testing: Understand and support threat modelling, cyber security risk assessment, SBOM production, pen testing, and submission documentation.
• Premarket review: Assess supporting evidence against the relevant FDA cybersecurity guidance prior to transfer to the manufacturer's regulatory team.
• Postmarket monitoring: Monitor relevant vulnerability information, CVEs, NVD, CISA's Known Exploited Vulnerabilities Catalog, supplier advisories, vulnerability disclosures etc.
• Vulnerability response: Triage results, device and patient safety impact, investigation of vulnerable components, remediation and patch planning.
• Record maintenance: Keep up to date with SBOM, VEX, risk assessments and other cybersecurity records.

The manufacturer is responsible for the device, the accuracy of the device's regulatory submission and compliance with applicable regulatory requirements. Third party cybersecurity support is not an FDA authorization or clearance.

FDA Premarket and Postmarket Cybersecurity Checklist

Prior to submission manufacturers should ensure that they have:

1. Determine whether Section 524B applies.
2. Documented the device architecture, threat model, and cybersecurity risk assessments.
3. Prepared the applicable SBOM and assessed known vulnerabilities.
4. Tested relevant security controls and documented findings and remediation decisions.
5. Prepared the applicable cybersecurity labeling and risk management plan.
6. Linked supporting evidence so risks can be traced to controls, tests, and conclusions.
7. Checked the current FDA guidance and the requirements of the relevant submission pathway.
8. Integrated applicable cybersecurity activities into the quality management system.

Once released, manufacturers should continue vulnerability monitoring, coordinated disclosure processes, risk-based remediation, patch validation, communication with customers and update of documentation.

This checklist is intended as a guide and is not a substitute for a regulatory assessment of that device.

Is Your Medical Device Secure?

Check your medical device security risks and find the right steps to protect patient data and meet cybersecurity requirements.

Speak with Our Experts →

Conclusion

For FDA premarket cybersecurity, the FDA requires manufacturers to provide evidence that they have identified, assessed, and addressed relevant risks. On the other hand, postmarket security requires manufacturers to continue providing this protection as they discover new vulnerabilities, software updates, and threats.

The most beneficial submission evidence links the device architecture, threat model, software inventory, risk assessment, controls, testing results and postmarket plans. Section 524B introduces new legal requirements for cyber-enabled devices, and FDA's existing guidance covers the FDA's recommendations for cybersecurity documentation and risk management.

To be ready for FDA review, manufacturers need to evaluate the current evidence base, determine gaps, and develop a workflow to bridge the gap between premarket preparation and postmarket vulnerability management. 

Frequently Asked Questions

1. What is the difference between FDA premarket and postmarket cybersecurity?

Premarket cybersecurity focuses on design, threat modeling, risk assessment, controls, testing, labeling, and submission documentation. Postmarket cybersecurity focuses on identifying and assessing new vulnerabilities, developing updates, coordinating disclosure, and maintaining security after release.

2. Does every medical device need all 14 cybersecurity documents?

No. The 14 categories offer a practical way to organise cybersecurity evidence. The FDA does not mandate exactly 14 standalone files for every product. The applicable submission requirements and level of detail depend on the device, its risks, and the regulatory pathway.

3. What does Section 524B require?

For qualifying cyber devices, Section 524B requires a plan to monitor, identify, and address postmarket vulnerabilities, processes and procedures to provide reasonable assurance of cybersecurity and support security updates and patches, and an SBOM covering commercial, open-source, and off-the-shelf components.

4. What changed in FDA medical device cybersecurity in 2026?

The FDA issued updated final cybersecurity guidance on February 3, 2026, and the QMSR became effective on February 2, 2026. Additional technical resources released in 2026 by NIST and MITRE, as well as ENISA's healthcare procurement guidelines, provide useful context for product security and lifecycle management. These resources do not all create new FDA requirements.

5. How often should a medical device manufacturer update its cybersecurity documentation?

Reviewers should review documentation when changes to the device, its software, its connectivity, newly discovered vulnerabilities, or remediation activities affect the existing security assessment. Manufacturers should also maintain their postmarket plans and supporting records as new information becomes available.