FDA eSTAR: what the cybersecurity section of the submission template requires

FDA's eSTAR Program page describes the tool directly: eSTAR is "an interactive PDF form that guides applicants through the process of preparing a comprehensive medical device submission." It is not a static form a sponsor fills in once — fields unlock or close based on earlier answers, so declaring a device has software, connectivity, or cybersecurity risk opens the sections that content requires. As of FDA's most recent eSTAR Program page update, three templates are current: the Non-In Vitro Diagnostic (nIVD) eSTAR, the In Vitro Diagnostic (IVD) eSTAR, and the Early Submission Requests eSTAR (PreSTAR) for Q-Submissions, IDEs, and 513(g) requests. FDA updates each template periodically, so a sponsor should always download the current version from FDA's own eSTAR Program page rather than reuse a saved copy from an earlier submission cycle.

eSTAR's mandatory-use dates arrived separately for each submission type, through separate final guidance documents:

A sponsor preparing a PMA today is not required to use eSTAR, but FDA has already moved two submission types from voluntary to mandatory eSTAR use on its own timetable — 510(k) in 2023, De Novo two years later — so a PMA sponsor should not assume voluntary status is permanent.

FDA's premarket cybersecurity duties for a cyber device come from Section 524B of the FD&C Act, and FDA backed that statute with a dedicated refuse-to-accept (RTA) policy (Federal Register notice 88 FR 19148, Docket FDA-2023-D-1030) that lets FDA refuse to even accept a submission missing the required cybersecurity information — see FDA premarket cybersecurity for medical devices for how that statutory RTA policy works. eSTAR adds a second, separate completeness gate on top of it. FDA's eSTAR Program page is explicit that "eSTAR submissions are not anticipated to undergo a Refuse to Accept (RTA) process" at all, because the template's own logic is supposed to make an incomplete submission structurally impossible to finish. Instead, FDA runs a technical screening process: if an eSTAR submission is incomplete, FDA notifies the submitter by email identifying what's missing, and the submission is placed — and remains — on hold for up to 180 days, or until a complete replacement eSTAR arrives.

For a sponsor, the practical effect is close to identical either way: a cybersecurity section left thin or blank stops the clock before substantive review starts, whether FDA calls it an RTA refusal under Section 524B or a technical-screening hold under eSTAR's own process. The difference is where the block happens — eSTAR's own required fields, rather than a human reviewer's judgment call on the merits of what was submitted.

eSTAR's software and cybersecurity area is structured to collect the documentation set FDA's current premarket cybersecurity guidance, "Cybersecurity in Medical Devices: Quality Management System Considerations and Content of Premarket Submissions" (Docket FDA-2021-D-1158, reissued February 2026), describes as necessary for a device with cybersecurity risk. That guidance has been reissued and retitled more than once since its 2014 original — a 2023 final version, a mid-2025 update folding in Section 524B specifically, and the February 2026 reissue aligning its title with FDA's Quality Management System Regulation — so the exact field list and required attachments inside eSTAR move when the underlying guidance moves. At a level this guide can state confidently without quoting specific eSTAR field names (which change across template versions): a connected device's submission needs to document its software bill of materials (the Section 524B duty covered in FDA premarket cybersecurity for medical devices and in IMDRF N73's SBOM principles), a threat model and risk assessment, justification for the security controls implemented, evidence of cybersecurity testing, and a postmarket vulnerability-monitoring plan. Confirm the current template's exact section names, field order, and attachment requirements directly against the live eSTAR PDF downloaded from FDA's eSTAR Program page before building a submission around any specific field label — FDA updates the template on its own schedule, independent of this guide.

eSTAR's cybersecurity content sits downstream of the same quality system obligations FDA's QMSR (21 CFR Part 820) governs — a cybersecurity risk assessment and a threat model are, in substance, design-control and risk-management records under the quality system a device manufacturer already has to run under Part 820. A sponsor whose quality system doesn't reliably produce current SBOMs, threat models, and test evidence as a matter of course will find eSTAR's cybersecurity fields harder to complete at submission time than one whose quality system already generates those artifacts during development.