FDA Section 524B Explained: What Device Makers Must Submit in 2026

Quick Summary: What Does FDA Section 524B Require?

FDA Section 524B of the Federal Food, Drug, and Cosmetic Act requires sponsors of covered cyber devices to include specific cybersecurity information in applicable premarket submissions. The law applies to 510(k), De Novo, PMA, PDP, and HDE submissions for devices meeting the statutory definition of a cyber device, including certain supplements and modifications that require FDA review.

A cyber device is a medical device that includes sponsor-validated, installed, or authorized software, can connect to the internet, and contains technological characteristics that could be vulnerable to cybersecurity threats.

For covered devices, sponsors must submit three core categories of information: a postmarket cybersecurity vulnerability management plan, processes and procedures that provide reasonable assurance of cybersecurity, including updates and patches, and a Software Bill of Materials covering commercial, open-source, and off-the-shelf software components.

Section 524B took effect on March 29, 2023. FDA’s February 2026 premarket cybersecurity guidance explains how manufacturers can address these statutory obligations and broader cybersecurity expectations.

What Is FDA Section 524B?

Section 524B, titled “Ensuring Cybersecurity of Devices,” was added to the FD&C Act through federal legislation in 2022. It gives FDA explicit authority to require cybersecurity information for covered medical devices before marketing authorization.

The requirement reflects a fundamental shift in medical device regulation: cybersecurity is not treated only as an IT issue. It is part of device safety, effectiveness, quality, and lifecycle risk management.

Which Medical Devices Are Considered Cyber Devices?

FDA Section 524B defines a cyber device using three criteria.

A device is a cyber device when it:

1. Includes software validated, installed, or authorized by the sponsor as a device or within a device.
2. Has the ability to connect to the internet.
3. Contains technological characteristics validated, installed, or authorized by the sponsor that could be vulnerable to cybersecurity threats.

Examples can include connected patient monitors, wireless infusion systems, networked imaging equipment, mobile-connected devices, cloud-supported Software as a Medical Device, and other products with internet-capable functionality.

A device does not have to maintain a continuous internet connection to create cybersecurity risk. Manufacturers should evaluate the actual architecture, intended connectivity, supporting services, and authorized software.

If applicability is uncertain, FDA states that manufacturers may contact the agency.

Which Premarket Submissions Does Section 524B Apply To?

Section 524B applies to sponsors submitting covered cyber devices through several major FDA pathways.

These include:

• Premarket Notification, or 510(k), including Traditional, Special, and Abbreviated submissions.
• Premarket Approval applications.
• PMA supplements.
• Product Development Protocol applications.
• De Novo requests.
• Humanitarian Device Exemptions.
• Certain HDE supplements.

The requirements apply to relevant submissions made on or after March 29, 2023.

A previously authorized device is not automatically subject to retroactive resubmission simply because Section 524B exists. However, if the manufacturer later makes a change requiring a new premarket submission, Section 524B can apply to that submission when the product meets the cyber device definition.

What Must Device Makers Submit Under Section 524B?

Section 524B(b) establishes three central cybersecurity submission requirements.

1. A Postmarket Cybersecurity Vulnerability Management Plan

Manufacturers must submit a plan to monitor, identify, and address postmarket cybersecurity vulnerabilities and exploits as appropriate within a reasonable time.

The plan must include coordinated vulnerability disclosure and related procedures.

This means manufacturers should define how they will receive vulnerability reports, monitor relevant threats, evaluate exploitability, determine patient-safety impact, prioritize remediation, communicate with customers, and document decisions.

A plan should establish clear responsibilities instead of relying on ad hoc responses after a vulnerability becomes public.

2. Processes and Procedures to Maintain Cybersecurity

Manufacturers must design, develop, and maintain processes and procedures that provide reasonable assurance that the device and related systems are cybersecure.

These processes must also support the availability of postmarket updates and patches.

Examples include secure development practices, vulnerability management, secure update mechanisms, authentication controls, logging, threat monitoring, testing, and remediation verification.

3. A Software Bill of Materials

Sponsors must provide an SBOM covering commercial, open-source, and off-the-shelf software components.

The SBOM should reflect the software actually used in the submitted device configuration. A generic development inventory that does not match the commercial release creates weak regulatory evidence.

Is the SBOM Alone Enough for Section 524B Compliance?

No. An SBOM is one statutory requirement, but it does not demonstrate complete compliance with Section 524B.

A manufacturer can have an accurate software inventory and still lack effective threat modeling, secure update processes, vulnerability monitoring, penetration testing, risk assessment, or remediation procedures.

The SBOM supports vulnerability management by answering “What software do we use?” Manufacturers must still answer additional questions such as “Is the vulnerability exploitable in our configuration?”, “Could exploitation affect patient safety?”, and “How quickly can we provide a safe correction?”

This is why FDA treats cybersecurity as a lifecycle discipline rather than a single document.

What Supporting Cybersecurity Evidence Does FDA Expect?

Section 524B establishes statutory requirements, while FDA’s February 2026 guidance recommends additional documentation to demonstrate cybersecurity risk management for devices with cybersecurity risk.

Depending on the product, manufacturers may need evidence such as:

• Security architecture documentation.
• Threat modeling.
• Cybersecurity risk assessments.
• Software support and end-of-support information.
• Cybersecurity controls documentation.
• Security assessment of unresolved anomalies.
• Cybersecurity testing and penetration testing.
• Remediation and retesting evidence.
• Cybersecurity labeling.
• Cybersecurity metrics.
• Cybersecurity risk management reports.
• Cybersecurity risk management plans.

For example, a threat identified in the threat model should connect to a cybersecurity requirement, implemented control, verification activity, test result, and residual risk decision.

These artifacts should form one traceable evidence set rather than disconnected files.

Why Does Penetration Testing Matter for Section 524B Readiness?

Penetration testing helps demonstrate whether implemented cybersecurity controls withstand realistic attack techniques.

Testing may cover device interfaces, firmware, network services, authentication, authorization, APIs, cloud infrastructure, mobile applications, update mechanisms, wireless communication, and other relevant attack surfaces.

A useful penetration testing report should document scope, configuration, methodology, findings, evidence, risk implications, remediation, and retesting status.

For submission readiness, manufacturers should avoid treating penetration testing as a final checkbox. Late testing can reveal design weaknesses that require software changes, updated risk analysis, revised labeling, and repeat verification.

Medysec’s Medical Device Penetration Testing supports manufacturers that need device-specific security evidence before FDA submission.

How Should Manufacturers Handle Vulnerabilities Found Before Submission?

Manufacturers should assess discovered vulnerabilities based on exploitability, affected functions, clinical consequences, existing controls, and residual risk.

A defensible process typically includes confirming the vulnerability, analyzing its attack path, evaluating potential patient-safety impact, implementing remediation or compensating controls, retesting the corrected build, and updating related documentation.

If an anomaly remains unresolved, manufacturers should document why it remains, what cybersecurity impact it creates, what controls reduce the risk, and why the residual risk is acceptable.

What Does “Reasonable Assurance of Cybersecurity” Mean?

Section 524B requires information demonstrating reasonable assurance that the device and related systems are cybersecure.

This does not mean manufacturers must prove that a device can never be hacked.

Instead, manufacturers should demonstrate a systematic, risk-based security program covering secure design, threat identification, controls, verification, vulnerability management, updates, and postmarket monitoring.

Cybersecurity evidence should be appropriate to the device’s architecture and risks.

A simple offline software tool may require different evidence from an internet-connected therapy platform with cloud APIs, mobile applications, remote administration, and hospital integrations.

How Should Section 524B Connect With Quality Management?

Cybersecurity should be integrated into the manufacturer’s quality management processes.

FDA’s Quality Management System Regulation became effective on February 2, 2026 and incorporates ISO 13485:2016 by reference into the revised Part 820 framework.

For cybersecurity teams, this means design changes, remediation, software updates, verification results, risk decisions, and controlled records should connect with established quality processes.

Cybersecurity cannot be isolated in a penetration testing report maintained outside design and risk documentation.

What Common Section 524B Gaps Lead to FDA Questions?

Common readiness gaps include incomplete SBOMs, unclear software support status, generic threat models, missing architecture views, weak traceability between controls and testing, penetration reports without remediation evidence, unsupported claims that vulnerabilities are “low risk,” incomplete postmarket procedures, and labeling that does not match actual deployment assumptions.

If one document says the device connects directly to the internet while another describes an isolated architecture, reviewers may question whether risk assessment and testing covered the real commercial configuration.

A structured readiness review can identify these conflicts before submission.

Does Section 524B Apply Only to New Devices?

No. The requirements do not apply retroactively to premarket submissions made before March 29, 2023. However, a previously authorized cyber device can become subject to Section 524B when the manufacturer submits a later change requiring FDA premarket review.

Manufacturers should therefore maintain cybersecurity documentation throughout the product lifecycle rather than rebuilding the evidence package whenever a new submission becomes necessary.

How Can Medysec Help With Section 524B Readiness?

Medysec is the dedicated MedTech cybersecurity division of Qualysec Technologies. We help manufacturers translate device architecture and cybersecurity testing into evidence that can support FDA premarket review.

Support can include security architecture review, threat modeling, cybersecurity risk assessment, SBOM vulnerability analysis, penetration testing, remediation validation, retesting, cybersecurity documentation review, and deficiency-response support.

Manufacturers preparing a cyber device can use Medysec’s FDA Premarket Cybersecurity services to identify evidence gaps before submission.

Is Your Medical Device Secure?

Check your medical device security risks and find the right steps to protect patient data and meet cybersecurity requirements.

Speak with Our Experts →

Conclusion: Treat Section 524B as a Lifecycle Requirement

Section 524B is not an SBOM rule alone. It requires manufacturers of covered cyber devices to establish a defensible cybersecurity lifecycle that begins before submission and continues after commercialization.

The strongest submission connects architecture, threats, software components, cybersecurity controls, testing, remediation, labeling, and postmarket vulnerability management into one traceable evidence story.

Manufacturers that wait until submission assembly to address these requirements risk discovering evidence gaps when timelines are already tight.

Medysec helps MedTech teams identify those gaps, validate cybersecurity controls, and strengthen technical evidence before FDA review.

Talk to a Medysec expert to assess whether your device and documentation are ready for Section 524B review.

Frequently Asked Questions About FDA Section 524B

1. When did Section 524B become effective?

The cybersecurity submission requirements became effective on March 29, 2023.

2. Is every software medical device a cyber device?

No. The statutory definition requires software, internet-connectivity capability, and technological characteristics that could be vulnerable to cybersecurity threats.

3. Is an SBOM mandatory for a cyber device?

Yes. Section 524B requires an SBOM that includes commercial, open-source, and off-the-shelf software components for covered cyber device premarket submissions.

4. Does Section 524B require penetration testing?

Section 524B does not name penetration testing as one of its three statutory submission categories. FDA’s cybersecurity guidance, however, recommends appropriate cybersecurity testing, including penetration testing, as part of broader premarket evidence.

Can FDA request more cybersecurity information?

Yes. FDA can request additional information when the submission does not provide sufficient evidence to complete its review or demonstrate applicable cybersecurity requirements.