Connected medical devices, from remote monitors to wireless drug delivery systems and cloud-connected diagnostics, bring cybersecurity into regulatory review. Since the Consolidated Appropriations Act, 2023, added section 524B to the Federal Food, Drug, and Cosmetic Act, cybersecurity documentation for “cyber devices” has been a statutory part of premarket submissions, with direct implications for FDA review, postmarket obligations and diligence.
This article summarizes what the law and FDA's guidance ask for, what past FDA actions show about postmarket exposure, and the questions an investor or acquirer should ask.
Section 524B: Cybersecurity Becomes Statutory
Section 524B was enacted on December 29, 2022, as part of the Consolidated Appropriations Act, 2023, and took effect on March 29, 2023. It requires a premarket submission for a cyber device to include:
- A plan to monitor, identify and address postmarket cybersecurity vulnerabilities and exploits, including coordinated vulnerability disclosure
- Processes and procedures that provide reasonable assurance the device and related systems are cybersecure, including postmarket updates and patches
- A software bill of materials (SBOM), including commercial, open-source and off-the-shelf software components
A cyber device is one that includes software validated, installed or authorized by the sponsor, has the ability to connect to the internet, and has technological characteristics that could be vulnerable to cybersecurity threats. FDA's transition period ended on October 1, 2023; since then it can refuse to accept a premarket submission for a cyber device that lacks the section 524B information.
Key Point: Cybersecurity Is Part of the Submission
For a cyber device, the SBOM, the postmarket vulnerability plan and the cybersecurity processes are required content of the premarket submission, not optional engineering documentation. A submission without them can be refused before substantive review begins.
What FDA's Premarket Guidance Covers
FDA's final guidance, “Cybersecurity in Medical Devices: Quality Management System Considerations and Content of Premarket Submissions,” was issued on February 3, 2026, superseding the June 27, 2025 version. It describes how cybersecurity should be built into device design under the quality system and what a submission should document. Five areas stand out.
1. Threat Modeling and Cybersecurity Risk Assessment
The guidance asks manufacturers to model the threats to the device and the system it operates in, assess the resulting cybersecurity risk, and trace mitigations through the threat model, the risk assessment and the SBOM. For a wireless insulin pump, for example, threats would include unauthorized commands sent over the wireless link and modified firmware, and the potential harm is incorrect insulin delivery.
Diligence question: does the threat model document mitigations and residual risk for each threat, or only list threats?
2. Software Bill of Materials
Every connected device runs software, whether firmware, a cloud backend, a mobile app or all three. The SBOM identifies the commercial, open-source and off-the-shelf components in it, which is what lets a manufacturer tell quickly whether a newly disclosed vulnerability in a third-party component, such as the 2021 Log4j vulnerability, affects its product.
Diligence question: does the SBOM match the software actually shipped, and are known vulnerabilities in listed components tracked and assessed?
3. Security Architecture and Controls
The guidance lists security objectives: authenticity, which includes integrity; authorization; availability; confidentiality; and secure and timely updatability and patchability. It asks manufacturers to show, through security architecture views, how the design meets them. Hardcoded credentials, default passwords and unprotected wireless communication are the kinds of weaknesses those views should rule out.
4. Cybersecurity Testing
Submissions are expected to show that the controls work, not just describe them. The guidance calls for cybersecurity testing, including penetration test reports.
5. Postmarket Vulnerability Management
Section 524B requires a plan to monitor, identify and address postmarket vulnerabilities, including coordinated vulnerability disclosure, and FDA's separate 2016 guidance on postmarket management of cybersecurity describes how manufacturers should assess and respond to vulnerabilities in marketed devices. That makes cybersecurity an ongoing operating cost: monitoring third-party components, triaging reports, developing and validating patches, and communicating with customers for as long as the device is supported.
What Past FDA Actions Show
Abbott (formerly St. Jude Medical) Cardiac Devices, 2017
In an April 12, 2017 warning letter to Abbott, FDA cited, among other issues, cybersecurity risk assessments for St. Jude Medical implantable defibrillators and the Merlin@home monitoring system that did not adequately incorporate a third-party report's findings. In August 2017, FDA approved a firmware update for certain St. Jude pacemakers to reduce the risk of exploitation of cybersecurity vulnerabilities; applying it required an in-person visit with a health care provider.
In June 2019, FDA warned that certain Medtronic MiniMed insulin pumps (the MiniMed 508 and Paradigm series) had cybersecurity vulnerabilities that could let an unauthorized person change pump settings wirelessly. Because the pumps could not be updated to address the vulnerability, they were recalled and patients were advised to switch to other models; FDA said it was not aware of confirmed reports of patient harm.
Both cases show the postmarket exposure: vulnerabilities found after launch can lead to warning letters, recalls, field corrections and device replacement, and a device that cannot be updated has fewer options when a vulnerability is found.
Questions for Investors and Acquirers
- Is the product a cyber device under section 524B, and did its premarket submission include the SBOM, the postmarket vulnerability plan and the required processes?
- Is there a threat model with documented mitigations and residual risk?
- Does the SBOM match the shipped software, and how are known vulnerabilities in its components tracked?
- What cybersecurity testing, including penetration testing, has been done, and what did it find?
- Is there a public coordinated vulnerability disclosure process, and how have past reports been handled?
- Can the device be updated in the field, and for how long will security updates be supported?
- Is postmarket cybersecurity work budgeted as an ongoing cost?
High-Risk Cybersecurity Profile
A cloud-connected monitoring device with no documented threat model, software components that are not fully identified, unprotected wireless data transmission, no vulnerability disclosure process and no way to patch devices in the field.
The Bottom Line
For connected medical devices, cybersecurity is a statutory part of the premarket submission and an ongoing postmarket obligation. Diligence that treats it as an IT checklist can miss both a regulatory dependency and a recurring cost, and it is easier to build cybersecurity into device design than to retrofit it after FDA raises questions.
References
- FDA. "Cybersecurity in Medical Devices: Quality Management System Considerations and Content of Premarket Submissions." Final guidance, February 3, 2026. fda.gov
- FDA. "Cybersecurity." Digital Health Center of Excellence. fda.gov
- FDA. "Cybersecurity in Medical Devices Frequently Asked Questions (FAQs)." fda.gov
- FDA. "Postmarket Management of Cybersecurity in Medical Devices." Final guidance, December 2016. fda.gov
- FDA. Warning letter to Abbott (St Jude Medical Inc.), 519686, April 12, 2017. fda.gov
- American Society of Anesthesiologists. "Implantable Cardiac Pacemakers by Abbott (formerly St. Jude Medical): Safety Communication - Firmware Update to Address Cybersecurity Vulnerabilities." August 2017. asahq.org
- AHA News. "FDA: Certain Medtronic insulin pumps recalled due to cybersecurity risk." June 28, 2019. aha.org
Need a Custom Analysis?
Vantage full reports assemble the public record on a company, cite factual claims to their sources, and are reviewed by Arvind Ravinutala, MD, and Aswini Ravinutala, BME. Start with a free 20-minute call.