FDA premarket cybersecurity for medical devices: Section 524B explained

Since 29 March 2023, a premarket submission for a US medical device that counts as a "cyber device" must come with cybersecurity information that was never required before: a vulnerability-monitoring plan, evidence of a secure development and patching process, and a software bill of materials (SBOM). This duty comes directly from statute, Section 524B of the Federal Food, Drug, and Cosmetic (FD&C) Act, not just from guidance, and FDA can refuse to even accept a submission that leaves it out.

Where the duty comes from

Section 524B, "Ensuring Cybersecurity of Devices," was added to the FD&C Act by the Consolidated Appropriations Act, 2023 (Public Law 117-328, Division FF, Title III, Section 3305), enacted 29 December 2022. The amendment took effect 90 days after enactment, on 29 March 2023; submissions made before that date are not subject to it. It is codified at 21 U.S.C. § 360n-2.

What counts as a "cyber device"

Section 524B(c) defines a cyber device as a device that:

1. includes software validated, installed, or authorized by the sponsor as a device or in a device;
2. has the ability to connect to the internet; and
3. contains technological characteristics validated, installed, or authorized by the sponsor that could be vulnerable to cybersecurity threats.

All three conditions apply together. A device with embedded software but no network connectivity at all falls outside the definition; FDA's own FAQ page uses this same three-part description.

What a cyber device submission must include

FDA's plain-language summary of the Section 524B(b) duties groups them as:

Duty	What it means in practice
Vulnerability-monitoring plan	A plan to monitor, identify, and address, in a reasonable time, postmarket cybersecurity vulnerabilities and exploits, including coordinated vulnerability disclosure and related procedures
Security assurance and updates	Processes and procedures giving reasonable assurance that the device and related systems are cybersecure, and a way to make postmarket patches and updates available
Software bill of materials	An SBOM covering commercial, open-source, and off-the-shelf software components used in the device

See vulnerability disclosure policy template for a starting point on the coordinated disclosure piece, and firmware SBOM for building the SBOM itself when source code is incomplete.

FDA's premarket guidance, and why its title keeps changing

FDA has reissued and retitled its main premarket cybersecurity guidance more than once as it folds in statutory and quality-system changes: a 2014 original, a 27 September 2023 final version titled "Cybersecurity in Medical Devices: Quality System Considerations and Content of Premarket Submissions," a 27 June 2025 update adding a section specifically on Section 524B cyber devices, and a further retitling to "...Quality Management System Considerations..." to align with FDA's new Quality Management System Regulation (21 CFR Part 820). Always check FDA's live guidance page for the current version and date before citing a specific title or date, since this document has already been superseded multiple times.

SBOM format: machine-readable, not a mandated schema

The guidance does not mandate CycloneDX or SPDX by name. It asks for a machine-readable SBOM consistent with the minimum elements identified in NTIA's October 2021 "Framing Software Component Transparency" document, and states that industry-accepted SBOM formats are encouraged. In practice, CycloneDX and SPDX are the two formats most device makers already use to meet that machine-readable expectation; see firmware SBOM for how each compares for embedded devices.

Refuse-to-accept: the enforcement teeth

FDA backed Section 524B with a specific refuse-to-accept (RTA) policy, published as a Federal Register notice on 30 March 2023 (88 FR 19148, Docket FDA-2023-D-1030). FDA described a transition period during which it generally did not issue RTA decisions for premarket submissions based solely on missing Section 524B information, instead working with sponsors through the interactive or deficiency-review process, before full RTA enforcement began on 1 October 2023. From that date, a cyber device submission that lacks the required cybersecurity information can be refused before FDA even begins substantive review, which is a harder stop than a deficiency letter during review.

Postmarket duties do not stop at clearance

Section 524B's premarket duties sit alongside FDA's older "Postmarket Management of Cybersecurity in Medical Devices" guidance (final, December 2016), which covers how manufacturers should manage cybersecurity risk after a device is marketed and distributed: monitoring, risk assessment, and timely patching across the product's life. A cyber device's premarket vulnerability-monitoring plan is, in effect, the forward-looking commitment that the 2016 postmarket guidance expects manufacturers to execute on.

Why this looks familiar if you already build for the EU

The shape of Section 524B — an SBOM, a vulnerability-handling and disclosure process, and a patching duty — closely parallels the EU Cyber Resilience Act's Annex I Part II requirements (SBOM, coordinated vulnerability disclosure, fixing without delay); see CRA Annex I explained. Medical devices are explicitly excluded from the EU's RED cybersecurity delegated act and EN 18031 (Regulation (EU) 2017/745 and 2017/746 devices are carved out of Delegated Regulation (EU) 2022/30); see EN 18031 explained for firmware teams for that exclusion. In other words, a connected medical device maker selling into both the US and EU needs the FDA 524B package and a separate, CRA-aligned package — the underlying engineering work (SBOM, disclosure process, patch pipeline) overlaps heavily, but the legal submissions do not substitute for each other.

A workable starting process

1. Classify each product against the three-part cyber device definition before you scope a submission; connectivity plus vulnerable software characteristics is the trigger, not just "has software."
2. Build the SBOM early, from source where you have it and from binary analysis of the firmware image where you do not; see firmware SBOM.
3. Write the vulnerability-monitoring plan and coordinated disclosure policy before submission, not after; FDA expects these as submission content, not a post-clearance promise.
4. Confirm the current guidance title and date on FDA's own guidance page before citing it in a submission narrative, since it has changed more than once since 2023.
5. Keep the postmarket process running after clearance; Section 524B's premarket plan is only credible if the 2016 postmarket guidance's monitoring and patching expectations are actually followed.

SoftWSP builds SBOMs from device firmware, matches components against known vulnerabilities, and helps structure the vulnerability-monitoring and disclosure processes a cyber device submission needs: see device firmware security and PSIRT as a service.

This guide is general information, not legal advice. It does not constitute FDA regulatory or legal counsel; confirm current guidance documents and submission requirements directly with FDA before relying on them.