All pathsEngineers · RA · QA · 11 terms

FDA Cybersecurity 101

Name: FDA Cybersecurity 101
Availability: InStock

The premarket cybersecurity vocabulary every MedTech engineer and RA professional now needs.

Your progress

0 of 11 lessons complete · up next: Section 524B of the FD&C Act

Start path

1

Cybersecurity

Section 524B of the FD&C Act(524B)

The federal statute that gives FDA explicit premarket authority over cybersecurity for cyber devices.

Why this term here: Start here: this is the statutory hook that makes cybersecurity a premarket requirement, not a nice-to-have. Focus on which devices are in scope.
2

Cybersecurity

Premarket Cybersecurity Submission

The bundle of cybersecurity artifacts a sponsor includes in a 510(k), De Novo, PMA, or HDE submission for a cyber device.

Why this term here: The umbrella FDA guidance. Focus on the specific artifacts FDA expects in the submission (SBOM, threat model, plan, labeling).
3

Cybersecurity

Secure Product Development Framework(SPDF)

A documented, risk-based set of processes that build cybersecurity into a medical device across its full lifecycle.

Why this term here: The lifecycle framework that ties the artifacts together. Focus on how SPDF maps into your existing design controls.
4

Cybersecurity

Threat Modeling

A structured analysis that identifies how an attacker could compromise a medical device and what controls mitigate each threat.

Why this term here: The single artifact reviewers read most closely. Focus on scope, assumptions, and how findings trace to controls.
5

Cybersecurity

STRIDE Threat Model(STRIDE)

A six-category framework for enumerating threats: Spoofing, Tampering, Repudiation, Information disclosure, Denial of service, Elevation of privilege.

Why this term here: One accepted method to structure a threat model. Focus on when STRIDE fits and when data-flow or attack-tree approaches are better.
6

Cybersecurity

Software Bill of Materials(SBOM)

A machine-readable inventory of all software components, including open-source and third-party libraries, used to build a medical device.

Why this term here: Now explicitly required. Focus on format (SPDX vs CycloneDX), depth, and how it stays current post-market.
7

Cybersecurity

CycloneDX

A lightweight, OWASP-maintained SBOM format designed for application security and supply-chain use cases.

Why this term here: One of the two SBOM formats FDA accepts. Focus on what fields matter for vulnerability triage.
8

Cybersecurity

Vulnerability Exploitability eXchange(VEX)

A machine-readable statement that explains whether a known vulnerability is actually exploitable in a specific product.

Why this term here: How you communicate that a listed component vulnerability does not affect your product. Focus on writing defensible VEX statements.
9

Cybersecurity

Common Vulnerabilities and Exposures(CVE)

A globally unique identifier for a publicly disclosed cybersecurity vulnerability.

Why this term here: The vocabulary you will use to describe vulnerabilities in the SBOM and post-market monitoring. Focus on scoring and disclosure timing.
10

Cybersecurity

Common Vulnerability Scoring System(CVSS)

An industry-standard 0–10 score that quantifies the severity of a software vulnerability.

Why this term here: How severity is quantified. Focus on the difference between base, temporal, and environmental scores when you triage.
11

Regulatory

Refuse to Accept(RTA)

FDA administrative decision that a submission is incomplete and won't be substantively reviewed.

Why this term here: The gate before substantive review. Focus on cybersecurity items that commonly cause an RTA hold.

Finished the path? Test yourself with a quiz tailored to these 11 terms.

Take the FDA Cybersecurity 101 quiz

FDA Cybersecurity 101

Section 524B of the FD&C Act(524B)

Premarket Cybersecurity Submission

Secure Product Development Framework(SPDF)

Threat Modeling

STRIDE Threat Model(STRIDE)

Software Bill of Materials(SBOM)

CycloneDX

Vulnerability Exploitability eXchange(VEX)

Common Vulnerabilities and Exposures(CVE)

Common Vulnerability Scoring System(CVSS)

Refuse to Accept(RTA)