Blue Goat Cyber

What does the FDA actually require for medical device cybersecurity?

Every premarket submission for a cyber device (510(k), De Novo, PMA) must include a documented Secure Product Development Framework (SPDF), a threat model traced to your ISO 14971 risk file, a cybersecurity risk assessment with exploitability scoring, a machine-readable SBOM with vulnerability and VEX analysis, security architecture views (global system, multi-patient harm, updateability, security use cases), evidence of security testing including independent third-party penetration testing with a Letter of Attestation, and cybersecurity labeling under Section 502(f). All of this is anchored i

Which devices count as 'cyber devices' under Section 524B?

Section 524B defines a cyber device by three conditions, all of which must be met: (1) it includes software validated, installed, or authorized by the sponsor, (2) it has the ability to connect to the internet, and (3) it contains technological characteristics that could be vulnerable to cybersecurity threats. In practice this captures nearly every modern connected, software-driven, or wireless-enabled device, including BLE-paired wearables, USB-charged hearing aids, cloud-connected infusion pumps, and most SaMD. Risk class is irrelevant. If your device meets the three conditions, the full cyb

Do I need a SBOM, and what format does the FDA expect?

Yes. Section 524B(b)(3) makes an SBOM a statutory requirement for every cyber device submission. The FDA expects a machine-readable SBOM in CycloneDX 1.4+ or SPDX 2.3+, covering all commercial, open-source, and off-the-shelf components, including transitive dependencies. Each component needs supplier, version, unique identifier, dependency relationships, and known-vulnerability mapping (CVE status). We deliver CycloneDX 1.5 with VEX statements so reviewers see which CVEs are actually exploitable in your device's context, plus a documented postmarket monitoring source list (NVD, CISA KEV, vendo

How long does premarket cybersecurity work usually take?

For a typical Class II connected device, our submission-ready package, threat model, security risk assessment per AAMI SW96, CycloneDX SBOM with VEX, security architecture views, manual penetration test against every interface, and eSTAR-formatted documentation, runs 4 to 6 weeks once we have device artifacts. Simpler devices close in 2 to 3 weeks. Complex platforms, AI/ML devices under a PCCP, or PMA-class implantables can run 8 to 12 weeks. We can kick off this week, no 4 to 8 week onboarding queue, and we deliver a fixed-fee scope within 24 hours of your discovery call.

What happens if the FDA issues a cybersecurity deficiency letter?

You have 180 days to respond before the submission goes on hold. We deliver a written gap analysis within 24 hours, mapping each finding to the relevant 524B subsection ((b)(1) postmarket, (b)(2) SPDF, (b)(3) SBOM) and the underlying guidance section. Most deficiencies fall into predictable buckets: incomplete threat model, weak SBOM or VEX analysis, insufficient pen test depth, missing architecture views, or unclear update strategy. We rebuild the affected sections, retest where required, and deliver a reviewer-ready point-by-point response, without losing your place in the FDA review queue.

Is penetration testing required, and is automated scanning enough?

Manual third-party penetration testing is required, and 'insufficient third-party penetration testing' is one of the top 5 reasons the FDA issues AI letters on cyber. Automated scans and SAST reports alone are explicitly not sufficient. FDA's February 2026 guidance expects exploit-driven testing against every interface the device exposes (wireless, BLE, USB, cellular, cloud APIs, companion apps, service ports, OTA update path), executed under availability constraints by independent qualified testers, with findings traced back to your threat model. The deliverable is a signed Letter of Attestat

What about postmarket cybersecurity obligations?

Section 524B(b)(1) does not end at clearance. Manufacturers must run a documented postmarket program for the life of the device: monthly CVE triage against the SBOM, a coordinated vulnerability disclosure (CVD) program aligned with ISO/IEC 29147 and 30111, change-controlled patch delivery under 21 CFR Part 820, MedWatch-reportable incident decision logic, and KPI reporting to executive leadership. The FDA can issue 483 observations, Warning Letters, or recall actions if this program is missing or unevidenced at inspection. We run the program on your behalf, monitoring, triage, CVD intake, patc

We haven't filed our premarket submission yet. When should we engage?

As early as design inputs. The Secure Product Development Framework cannot be retrofitted: SPDF requires unbroken traceability from architecture decisions through threat model, security requirements, test evidence, and unresolved-anomaly disposition. Reviewers can tell when that chain was assembled after design freeze, dates do not line up, threat model assumptions contradict the as-built design, and the design history file has no security entries before V&V. The result is a Major Deficiency on SPDF and a request to redo design controls. We routinely help teams weeks from filing and teams resp