FDA Medical Device Cybersecurity and Section 524B: A Guide for Connected Wearables and SaMD

Facts checked October 27, 2026.

What is the current FDA guidance?

The current guidance is "Cybersecurity in Medical Devices: Quality Management System Considerations and Content of Premarket Submissions" (February 2026), docket FDA-2021-D-1158. It supersedes the June 27, 2025 final guidance, which had in turn updated the September 2023 version and finalized the March 2024 section 524B draft [1][4]. The title now says "Quality Management System" instead of "Quality System," in line with FDA's Quality Management System Regulation (QMSR). The QMSR amends 21 CFR Part 820 to incorporate ISO 13485:2016 by reference. It took effect February 2, 2026; the final rule was published February 2, 2024 (FR Doc. 2024-01709) [6][7].

What is a "cyber device"?

Under section 524B(c), a cyber device is a device that:

1. includes software validated, installed, or authorized by the sponsor as a device or in a device;
2. has the ability to connect to the internet; and
3. contains any such technological characteristics that could be vulnerable to cybersecurity threats [2][3].

Most connected wearables, companion-app systems and cloud SaMD will meet this definition. FDA's guidance discusses edge cases [2].

What does section 524B require?

Sponsors of a 510(k), PMA, PDP, De Novo or HDE for a cyber device must:

1. submit a plan to monitor, identify and address postmarket vulnerabilities and exploits, including coordinated vulnerability disclosure;
2. design, develop and maintain processes giving reasonable assurance that the device and related systems are cybersecure, and make postmarket updates and patches available; and
3. provide a software bill of materials (SBOM) covering commercial, open-source and off-the-shelf components [3].

This applies to Special and Abbreviated 510(k)s and to PMA/HDE supplements too [3].

When did it take effect?

• The submission requirement started March 29, 2023 [3].
• FDA's refuse-to-accept transition policy ended October 1, 2023 [3].
• 510(k)s must be submitted through eSTAR. A submission with a deficient cybersecurity section can be placed on a technical screening hold [3].

What does FDA expect in a premarket submission?

Per the guidance [1][2]; confirm section numbers against the February 2026 PDF:

• A secure product development framework (SPDF) integrated with the quality system
• A security risk management report and a threat model
• A cybersecurity risk assessment (separate from the safety risk assessment)
• An SBOM, with support status and known vulnerabilities for each component
• A security architecture with views covering the whole system (device, app, cloud, update path)
• Security controls (authentication, authorization, cryptography, integrity, logging, updatability)
• Testing: vulnerability scanning, penetration testing, fuzzing, and traceability to controls
• Labeling: security information for users, the SBOM, and end-of-support information
• The postmarket vulnerability management plan

Checklist for wearable and SaMD startups

• Decide whether the product is a device at all (general wellness vs device), and whether it is a cyber device.
• Inventory every component: firmware, mobile app, BLE stack, cloud APIs, and third-party SDKs. Generate an SBOM in your CI.
• Threat-model the whole system, not just the sensor. Include the phone, the cloud and the update channel.
• Map security controls to the guidance's control categories and keep a traceability matrix.
• Budget for independent penetration testing before you submit.
• Publish a coordinated vulnerability disclosure policy and set up a monitoring process.
• Plan secure over-the-air updates and the support lifetime.
• Complete the cybersecurity section of eSTAR. Don't leave it for the end.

How PAHL helps

Palo Alto Health Labs helps teams design system architecture and security for connected health products:

• threat models,
• SBOM pipelines,
• update architecture, and
• turning engineering artifacts into submission-ready documentation alongside your regulatory lead.

We are not a notified body or a penetration-testing lab, and we don't guarantee clearance. Book a 30-minute scoping call.

Sources (accessed October 27, 2026)

1. FDA, Cybersecurity in Medical Devices: Quality Management System Considerations and Content of Premarket Submissions (February 2026): https://www.fda.gov/regulatory-information/search-fda-guidance-documents/cybersecurity-medical-devices-quality-management-system-considerations-and-content-premarket
2. FDA, guidance PDF: https://www.fda.gov/media/119933/download
3. FDA, Cybersecurity in Medical Devices Frequently Asked Questions (section 524B): https://www.fda.gov/medical-devices/digital-health-center-excellence/cybersecurity-medical-devices-frequently-asked-questions-faqs
4. Federal Register, notice of availability of the June 27, 2025 guidance (background on section 524B and FDORA section 3305): https://www.federalregister.gov/documents/2025/06/27/2025-11669/cybersecurity-in-medical-devices-quality-system-considerations-and-content-of-premarket-submissions
5. Statute: FD&C Act section 524B, 21 U.S.C. 360n-2, "Ensuring cybersecurity of devices" (U.S. Code, 2024 edition, GovInfo): https://www.govinfo.gov/content/pkg/USCODE-2024-title21/html/USCODE-2024-title21-chap9-subchapV-partA-sec360n-2.htm
6. Federal Register, "Medical Devices; Quality System Regulation Amendments," final rule (published February 2, 2024; effective February 2, 2026): https://www.federalregister.gov/documents/2024/02/02/2024-01709/medical-devices-quality-system-regulation-amendments
7. FDA, Quality Management System Regulation (QMSR): https://www.fda.gov/medical-devices/postmarket-requirements-devices/quality-management-system-regulation-qmsr

Related

• Healthcare Software Architecture →
• SaMD Planning & Consulting →