--- title: "FDA Cybersecurity 101 - Learning Path - MedTech Terms" description: "The premarket cybersecurity vocabulary every MedTech engineer and RA professional now needs." lang: en json-ld: | { "@context": "https://schema.org", "@graph": [ { "@type": [ "Course", "LearningResource" ], "@id": "https://medtechterms.com/paths/fda-cybersecurity-101#course", "name": "FDA Cybersecurity 101", "description": "The premarket cybersecurity vocabulary every MedTech engineer and RA professional now needs.", "url": "https://medtechterms.com/paths/fda-cybersecurity-101", "courseCode": "fda-cybersecurity-101", "educationalLevel": "Professional", "learningResourceType": "Curriculum", "inLanguage": "en", "teaches": [ "Section 524B of the FD&C Act", "Premarket Cybersecurity Submission", "Secure Product Development Framework", "Threat Modeling", "STRIDE Threat Model", "Software Bill of Materials", "CycloneDX", "Vulnerability Exploitability eXchange", "Common Vulnerabilities and Exposures", "Common Vulnerability Scoring System", "Refuse to Accept" ], "about": [ { "@type": "DefinedTerm", "@id": "https://medtechterms.com/terms/section-524b#term", "name": "Section 524B of the FD&C Act", "alternateName": "524B", "url": "https://medtechterms.com/terms/section-524b" }, { "@type": "DefinedTerm", "@id": "https://medtechterms.com/terms/premarket-cybersecurity#term", "name": "Premarket Cybersecurity Submission", "url": "https://medtechterms.com/terms/premarket-cybersecurity" }, { "@type": "DefinedTerm", "@id": "https://medtechterms.com/terms/spdf#term", "name": "Secure Product Development Framework", "alternateName": "SPDF", "url": "https://medtechterms.com/terms/spdf" }, { "@type": "DefinedTerm", "@id": "https://medtechterms.com/terms/threat-modeling#term", "name": "Threat Modeling", "url": "https://medtechterms.com/terms/threat-modeling" }, { "@type": "DefinedTerm", "@id": "https://medtechterms.com/terms/stride#term", "name": "STRIDE Threat Model", "alternateName": "STRIDE", "url": "https://medtechterms.com/terms/stride" }, { "@type": "DefinedTerm", "@id": "https://medtechterms.com/terms/sbom#term", "name": "Software Bill of Materials", "alternateName": "SBOM", "url": "https://medtechterms.com/terms/sbom" }, { "@type": "DefinedTerm", "@id": "https://medtechterms.com/terms/cyclonedx#term", "name": "CycloneDX", "url": "https://medtechterms.com/terms/cyclonedx" }, { "@type": "DefinedTerm", "@id": "https://medtechterms.com/terms/vex#term", "name": "Vulnerability Exploitability eXchange", "alternateName": "VEX", "url": "https://medtechterms.com/terms/vex" }, { "@type": "DefinedTerm", "@id": "https://medtechterms.com/terms/cve#term", "name": "Common Vulnerabilities and Exposures", "alternateName": "CVE", "url": "https://medtechterms.com/terms/cve" }, { "@type": "DefinedTerm", "@id": "https://medtechterms.com/terms/cvss#term", "name": "Common Vulnerability Scoring System", "alternateName": "CVSS", "url": "https://medtechterms.com/terms/cvss" }, { "@type": "DefinedTerm", "@id": "https://medtechterms.com/terms/rta#term", "name": "Refuse to Accept", "alternateName": "RTA", "url": "https://medtechterms.com/terms/rta" } ], "audience": { "@type": "EducationalAudience", "educationalRole": "Engineers · RA · QA" }, "provider": { "@type": "Organization", "name": "MedTech Terms", "url": "https://medtechterms.com", "sameAs": [ "https://bluegoatcyber.com" ] }, "offers": { "@type": "Offer", "price": "0", "priceCurrency": "USD", "category": "Free", "availability": "https://schema.org/InStock" }, "hasCourseInstance": { "@type": "CourseInstance", "@id": "https://medtechterms.com/paths/fda-cybersecurity-101#instance", "courseMode": "Online", "courseWorkload": "PT55M", "inLanguage": "en", "instructor": { "@type": "Person", "name": "Christian Espinosa", "jobTitle": "Founder, Blue Goat Cyber", "url": "https://medtechterms.com/authors/christian-espinosa" } }, "hasPart": [ { "@type": "LearningResource", "@id": "https://medtechterms.com/terms/section-524b#lesson-fda-cybersecurity-101", "name": "Section 524B of the FD&C Act", "url": "https://medtechterms.com/terms/section-524b", "learningResourceType": "Lesson", "inLanguage": "en", "description": "Start here: this is the statutory hook that makes cybersecurity a premarket requirement, not a nice-to-have. Focus on which devices are in scope.", "about": { "@type": "DefinedTerm", "@id": "https://medtechterms.com/terms/section-524b#term", "name": "Section 524B of the FD&C Act", "alternateName": "524B", "url": "https://medtechterms.com/terms/section-524b" }, "isPartOf": { "@id": "https://medtechterms.com/paths/fda-cybersecurity-101#course" } }, { "@type": "LearningResource", "@id": "https://medtechterms.com/terms/premarket-cybersecurity#lesson-fda-cybersecurity-101", "name": "Premarket Cybersecurity Submission", "url": "https://medtechterms.com/terms/premarket-cybersecurity", "learningResourceType": "Lesson", "inLanguage": "en", "description": "The umbrella FDA guidance. Focus on the specific artifacts FDA expects in the submission (SBOM, threat model, plan, labeling).", "about": { "@type": "DefinedTerm", "@id": "https://medtechterms.com/terms/premarket-cybersecurity#term", "name": "Premarket Cybersecurity Submission", "url": "https://medtechterms.com/terms/premarket-cybersecurity" }, "isPartOf": { "@id": "https://medtechterms.com/paths/fda-cybersecurity-101#course" } }, { "@type": "LearningResource", "@id": "https://medtechterms.com/terms/spdf#lesson-fda-cybersecurity-101", "name": "Secure Product Development Framework", "url": "https://medtechterms.com/terms/spdf", "learningResourceType": "Lesson", "inLanguage": "en", "description": "The lifecycle framework that ties the artifacts together. Focus on how SPDF maps into your existing design controls.", "about": { "@type": "DefinedTerm", "@id": "https://medtechterms.com/terms/spdf#term", "name": "Secure Product Development Framework", "alternateName": "SPDF", "url": "https://medtechterms.com/terms/spdf" }, "isPartOf": { "@id": "https://medtechterms.com/paths/fda-cybersecurity-101#course" } }, { "@type": "LearningResource", "@id": "https://medtechterms.com/terms/threat-modeling#lesson-fda-cybersecurity-101", "name": "Threat Modeling", "url": "https://medtechterms.com/terms/threat-modeling", "learningResourceType": "Lesson", "inLanguage": "en", "description": "The single artifact reviewers read most closely. Focus on scope, assumptions, and how findings trace to controls.", "about": { "@type": "DefinedTerm", "@id": "https://medtechterms.com/terms/threat-modeling#term", "name": "Threat Modeling", "url": "https://medtechterms.com/terms/threat-modeling" }, "isPartOf": { "@id": "https://medtechterms.com/paths/fda-cybersecurity-101#course" } }, { "@type": "LearningResource", "@id": "https://medtechterms.com/terms/stride#lesson-fda-cybersecurity-101", "name": "STRIDE Threat Model", "url": "https://medtechterms.com/terms/stride", "learningResourceType": "Lesson", "inLanguage": "en", "description": "One accepted method to structure a threat model. Focus on when STRIDE fits and when data-flow or attack-tree approaches are better.", "about": { "@type": "DefinedTerm", "@id": "https://medtechterms.com/terms/stride#term", "name": "STRIDE Threat Model", "alternateName": "STRIDE", "url": "https://medtechterms.com/terms/stride" }, "isPartOf": { "@id": "https://medtechterms.com/paths/fda-cybersecurity-101#course" } }, { "@type": "LearningResource", "@id": "https://medtechterms.com/terms/sbom#lesson-fda-cybersecurity-101", "name": "Software Bill of Materials", "url": "https://medtechterms.com/terms/sbom", "learningResourceType": "Lesson", "inLanguage": "en", "description": "Now explicitly required. Focus on format (SPDX vs CycloneDX), depth, and how it stays current post-market.", "about": { "@type": "DefinedTerm", "@id": "https://medtechterms.com/terms/sbom#term", "name": "Software Bill of Materials", "alternateName": "SBOM", "url": "https://medtechterms.com/terms/sbom" }, "isPartOf": { "@id": "https://medtechterms.com/paths/fda-cybersecurity-101#course" } }, { "@type": "LearningResource", "@id": "https://medtechterms.com/terms/cyclonedx#lesson-fda-cybersecurity-101", "name": "CycloneDX", "url": "https://medtechterms.com/terms/cyclonedx", "learningResourceType": "Lesson", "inLanguage": "en", "description": "One of the two SBOM formats FDA accepts. Focus on what fields matter for vulnerability triage.", "about": { "@type": "DefinedTerm", "@id": "https://medtechterms.com/terms/cyclonedx#term", "name": "CycloneDX", "url": "https://medtechterms.com/terms/cyclonedx" }, "isPartOf": { "@id": "https://medtechterms.com/paths/fda-cybersecurity-101#course" } }, { "@type": "LearningResource", "@id": "https://medtechterms.com/terms/vex#lesson-fda-cybersecurity-101", "name": "Vulnerability Exploitability eXchange", "url": "https://medtechterms.com/terms/vex", "learningResourceType": "Lesson", "inLanguage": "en", "description": "How you communicate that a listed component vulnerability does not affect your product. Focus on writing defensible VEX statements.", "about": { "@type": "DefinedTerm", "@id": "https://medtechterms.com/terms/vex#term", "name": "Vulnerability Exploitability eXchange", "alternateName": "VEX", "url": "https://medtechterms.com/terms/vex" }, "isPartOf": { "@id": "https://medtechterms.com/paths/fda-cybersecurity-101#course" } }, { "@type": "LearningResource", "@id": "https://medtechterms.com/terms/cve#lesson-fda-cybersecurity-101", "name": "Common Vulnerabilities and Exposures", "url": "https://medtechterms.com/terms/cve", "learningResourceType": "Lesson", "inLanguage": "en", "description": "The vocabulary you will use to describe vulnerabilities in the SBOM and post-market monitoring. Focus on scoring and disclosure timing.", "about": { "@type": "DefinedTerm", "@id": "https://medtechterms.com/terms/cve#term", "name": "Common Vulnerabilities and Exposures", "alternateName": "CVE", "url": "https://medtechterms.com/terms/cve" }, "isPartOf": { "@id": "https://medtechterms.com/paths/fda-cybersecurity-101#course" } }, { "@type": "LearningResource", "@id": "https://medtechterms.com/terms/cvss#lesson-fda-cybersecurity-101", "name": "Common Vulnerability Scoring System", "url": "https://medtechterms.com/terms/cvss", "learningResourceType": "Lesson", "inLanguage": "en", "description": "How severity is quantified. Focus on the difference between base, temporal, and environmental scores when you triage.", "about": { "@type": "DefinedTerm", "@id": "https://medtechterms.com/terms/cvss#term", "name": "Common Vulnerability Scoring System", "alternateName": "CVSS", "url": "https://medtechterms.com/terms/cvss" }, "isPartOf": { "@id": "https://medtechterms.com/paths/fda-cybersecurity-101#course" } }, { "@type": "LearningResource", "@id": "https://medtechterms.com/terms/rta#lesson-fda-cybersecurity-101", "name": "Refuse to Accept", "url": "https://medtechterms.com/terms/rta", "learningResourceType": "Lesson", "inLanguage": "en", "description": "The gate before substantive review. Focus on cybersecurity items that commonly cause an RTA hold.", "about": { "@type": "DefinedTerm", "@id": "https://medtechterms.com/terms/rta#term", "name": "Refuse to Accept", "alternateName": "RTA", "url": "https://medtechterms.com/terms/rta" }, "isPartOf": { "@id": "https://medtechterms.com/paths/fda-cybersecurity-101#course" } } ] }, { "@type": "ItemList", "@id": "https://medtechterms.com/paths/fda-cybersecurity-101#itemlist", "name": "FDA Cybersecurity 101", "itemListOrder": "https://schema.org/ItemListOrderAscending", "numberOfItems": 11, "itemListElement": [ { "@type": "ListItem", "position": 1, "url": "https://medtechterms.com/terms/section-524b", "name": "Section 524B of the FD&C Act", "description": "Start here: this is the statutory hook that makes cybersecurity a premarket requirement, not a nice-to-have. Focus on which devices are in scope." }, { "@type": "ListItem", "position": 2, "url": "https://medtechterms.com/terms/premarket-cybersecurity", "name": "Premarket Cybersecurity Submission", "description": "The umbrella FDA guidance. Focus on the specific artifacts FDA expects in the submission (SBOM, threat model, plan, labeling)." }, { "@type": "ListItem", "position": 3, "url": "https://medtechterms.com/terms/spdf", "name": "Secure Product Development Framework", "description": "The lifecycle framework that ties the artifacts together. Focus on how SPDF maps into your existing design controls." }, { "@type": "ListItem", "position": 4, "url": "https://medtechterms.com/terms/threat-modeling", "name": "Threat Modeling", "description": "The single artifact reviewers read most closely. Focus on scope, assumptions, and how findings trace to controls." }, { "@type": "ListItem", "position": 5, "url": "https://medtechterms.com/terms/stride", "name": "STRIDE Threat Model", "description": "One accepted method to structure a threat model. Focus on when STRIDE fits and when data-flow or attack-tree approaches are better." }, { "@type": "ListItem", "position": 6, "url": "https://medtechterms.com/terms/sbom", "name": "Software Bill of Materials", "description": "Now explicitly required. Focus on format (SPDX vs CycloneDX), depth, and how it stays current post-market." }, { "@type": "ListItem", "position": 7, "url": "https://medtechterms.com/terms/cyclonedx", "name": "CycloneDX", "description": "One of the two SBOM formats FDA accepts. Focus on what fields matter for vulnerability triage." }, { "@type": "ListItem", "position": 8, "url": "https://medtechterms.com/terms/vex", "name": "Vulnerability Exploitability eXchange", "description": "How you communicate that a listed component vulnerability does not affect your product. Focus on writing defensible VEX statements." }, { "@type": "ListItem", "position": 9, "url": "https://medtechterms.com/terms/cve", "name": "Common Vulnerabilities and Exposures", "description": "The vocabulary you will use to describe vulnerabilities in the SBOM and post-market monitoring. Focus on scoring and disclosure timing." }, { "@type": "ListItem", "position": 10, "url": "https://medtechterms.com/terms/cvss", "name": "Common Vulnerability Scoring System", "description": "How severity is quantified. Focus on the difference between base, temporal, and environmental scores when you triage." }, { "@type": "ListItem", "position": 11, "url": "https://medtechterms.com/terms/rta", "name": "Refuse to Accept", "description": "The gate before substantive review. Focus on cybersecurity items that commonly cause an RTA hold." } ] }, { "@type": "BreadcrumbList", "itemListElement": [ { "@type": "ListItem", "position": 1, "name": "Home", "item": "https://medtechterms.com/" }, { "@type": "ListItem", "position": 2, "name": "Learning Paths", "item": "https://medtechterms.com/paths" }, { "@type": "ListItem", "position": 3, "name": "FDA Cybersecurity 101", "item": "https://medtechterms.com/paths/fda-cybersecurity-101" } ] } ] } --- [ MedTech Terms The authoritative reference ](/) Browse Learn [Latest](/latest) About [All paths](/paths)Engineers · RA · QA · 11 terms # FDA Cybersecurity 101 The premarket cybersecurity vocabulary every MedTech engineer and RA professional now needs. Your progress 0 of 11 lessons complete · up next: Section 524B of the FD&C Act [Start path](/terms/section-524b?from=fda-cybersecurity-101) 1. 1 [ Cybersecurity ## Section 524B of the FD&C Act(524B) The federal statute that gives FDA explicit premarket authority over cybersecurity for cyber devices. Why this term here: Start here: this is the statutory hook that makes cybersecurity a premarket requirement, not a nice-to-have. Focus on which devices are in scope. ](/terms/section-524b?from=fda-cybersecurity-101)Mark done 2. 2 [ Cybersecurity ## Premarket Cybersecurity Submission The bundle of cybersecurity artifacts a sponsor includes in a 510(k), De Novo, PMA, or HDE submission for a cyber device. Why this term here: The umbrella FDA guidance. Focus on the specific artifacts FDA expects in the submission (SBOM, threat model, plan, labeling). ](/terms/premarket-cybersecurity?from=fda-cybersecurity-101)Mark done 3. 3 [ Cybersecurity ## Secure Product Development Framework(SPDF) A documented, risk-based set of processes that build cybersecurity into a medical device across its full lifecycle. Why this term here: The lifecycle framework that ties the artifacts together. Focus on how SPDF maps into your existing design controls. ](/terms/spdf?from=fda-cybersecurity-101)Mark done 4. 4 [ Cybersecurity ## Threat Modeling A structured analysis that identifies how an attacker could compromise a medical device and what controls mitigate each threat. Why this term here: The single artifact reviewers read most closely. Focus on scope, assumptions, and how findings trace to controls. ](/terms/threat-modeling?from=fda-cybersecurity-101)Mark done 5. 5 [ Cybersecurity ## STRIDE Threat Model(STRIDE) A six-category framework for enumerating threats: Spoofing, Tampering, Repudiation, Information disclosure, Denial of service, Elevation of privilege. Why this term here: One accepted method to structure a threat model. Focus on when STRIDE fits and when data-flow or attack-tree approaches are better. ](/terms/stride?from=fda-cybersecurity-101)Mark done 6. 6 [ Cybersecurity ## Software Bill of Materials(SBOM) A machine-readable inventory of all software components, including open-source and third-party libraries, used to build a medical device. Why this term here: Now explicitly required. Focus on format (SPDX vs CycloneDX), depth, and how it stays current post-market. ](/terms/sbom?from=fda-cybersecurity-101)Mark done 7. 7 [ Cybersecurity ## CycloneDX A lightweight, OWASP-maintained SBOM format designed for application security and supply-chain use cases. Why this term here: One of the two SBOM formats FDA accepts. Focus on what fields matter for vulnerability triage. ](/terms/cyclonedx?from=fda-cybersecurity-101)Mark done 8. 8 [ Cybersecurity ## Vulnerability Exploitability eXchange(VEX) A machine-readable statement that explains whether a known vulnerability is actually exploitable in a specific product. Why this term here: How you communicate that a listed component vulnerability does not affect your product. Focus on writing defensible VEX statements. ](/terms/vex?from=fda-cybersecurity-101)Mark done 9. 9 [ Cybersecurity ## Common Vulnerabilities and Exposures(CVE) A globally unique identifier for a publicly disclosed cybersecurity vulnerability. Why this term here: The vocabulary you will use to describe vulnerabilities in the SBOM and post-market monitoring. Focus on scoring and disclosure timing. ](/terms/cve?from=fda-cybersecurity-101)Mark done 10. 10 [ Cybersecurity ## Common Vulnerability Scoring System(CVSS) An industry-standard 0–10 score that quantifies the severity of a software vulnerability. Why this term here: How severity is quantified. Focus on the difference between base, temporal, and environmental scores when you triage. ](/terms/cvss?from=fda-cybersecurity-101)Mark done 11. 11 [ Regulatory ## Refuse to Accept(RTA) FDA administrative decision that a submission is incomplete and won't be substantively reviewed. Why this term here: The gate before substantive review. Focus on cybersecurity items that commonly cause an RTA hold. ](/terms/rta?from=fda-cybersecurity-101)Mark done Finished the path? Test yourself with a quiz tailored to these 11 terms. [Take the FDA Cybersecurity 101 quiz](/quiz?path=fda-cybersecurity-101) MedTech Terms An authoritative, plain-language reference for the regulatory, quality, cybersecurity, and software terms that shape modern medical devices. Browse - [All terms](/terms) - [A–Z index](/a-z) - [Categories](/categories) - [Ecosystems](/ecosystems) - [Learning paths](/paths) - [Compare terms](/compare) - [Quiz](/quiz) Resources - [FDA Medical Devices](https://www.fda.gov/medical-devices) - [EU MDR](https://eur-lex.europa.eu/eli/reg/2017/745/oj) - [IMDRF](https://www.imdrf.org/) - [Methodology](/methodology) - [Changelog](/changelog) - [Editor: Christian Espinosa](/authors/christian-espinosa) - [About this site](/about) © 2026 MedTech Terms. Reference content for educational purposes - not regulatory advice. A community resource sponsored by [Blue Goat Cyber](https://bluegoatcyber.com)