MedTech Terms
    The authoritative reference
    All pathsEngineers · RA · QA · 11 terms

    FDA Cybersecurity 101

    The premarket cybersecurity vocabulary every MedTech engineer and RA professional now needs.

    Your progress
    0 of 11 lessons complete · up next: Section 524B of the FD&C Act
    Start path
    1. 1
      Cybersecurity

      Section 524B of the FD&C Act(524B)

      The federal statute that gives FDA explicit premarket authority over cybersecurity for cyber devices.

      Why this term here: Start here: this is the statutory hook that makes cybersecurity a premarket requirement, not a nice-to-have. Focus on which devices are in scope.

    2. 2
      Cybersecurity

      Premarket Cybersecurity Submission

      The bundle of cybersecurity artifacts a sponsor includes in a 510(k), De Novo, PMA, or HDE submission for a cyber device.

      Why this term here: The umbrella FDA guidance. Focus on the specific artifacts FDA expects in the submission (SBOM, threat model, plan, labeling).

    3. 3
      Cybersecurity

      Secure Product Development Framework(SPDF)

      A documented, risk-based set of processes that build cybersecurity into a medical device across its full lifecycle.

      Why this term here: The lifecycle framework that ties the artifacts together. Focus on how SPDF maps into your existing design controls.

    4. 4
      Cybersecurity

      Threat Modeling

      A structured analysis that identifies how an attacker could compromise a medical device and what controls mitigate each threat.

      Why this term here: The single artifact reviewers read most closely. Focus on scope, assumptions, and how findings trace to controls.

    5. 5
      Cybersecurity

      STRIDE Threat Model(STRIDE)

      A six-category framework for enumerating threats: Spoofing, Tampering, Repudiation, Information disclosure, Denial of service, Elevation of privilege.

      Why this term here: One accepted method to structure a threat model. Focus on when STRIDE fits and when data-flow or attack-tree approaches are better.

    6. 6
      Cybersecurity

      Software Bill of Materials(SBOM)

      An inventory of software components and dependencies used in a device, supporting vulnerability management and supply-chain transparency.

      Why this term here: Now explicitly required. Focus on format (SPDX vs CycloneDX), depth, and how it stays current post-market.

    7. 7
      Cybersecurity

      CycloneDX

      A lightweight, OWASP-maintained SBOM format designed for application security and supply-chain use cases.

      Why this term here: One of the two SBOM formats FDA accepts. Focus on what fields matter for vulnerability triage.

    8. 8
      Cybersecurity

      Vulnerability Exploitability eXchange(VEX)

      A machine-readable statement that explains whether a known vulnerability is actually exploitable in a specific product.

      Why this term here: How you communicate that a listed component vulnerability does not affect your product. Focus on writing defensible VEX statements.

    9. 9
      Cybersecurity

      Common Vulnerabilities and Exposures(CVE)

      A globally unique identifier for a publicly disclosed cybersecurity vulnerability.

      Why this term here: The vocabulary you will use to describe vulnerabilities in the SBOM and post-market monitoring. Focus on scoring and disclosure timing.

    10. 10
      Cybersecurity

      Common Vulnerability Scoring System(CVSS)

      An industry-standard 0–10 score that quantifies the severity of a software vulnerability.

      Why this term here: How severity is quantified. Focus on the difference between base, temporal, and environmental scores when you triage.

    11. 11
      Regulatory

      Refuse to Accept(RTA)

      FDA administrative decision that a submission is incomplete and won't be substantively reviewed.

      Why this term here: The gate before substantive review. Focus on cybersecurity items that commonly cause an RTA hold.

    Finished the path? Test yourself with a quiz tailored to these 11 terms.

    Take the FDA Cybersecurity 101 quiz