Refuse to Accept (Cybersecurity)
FDA's authority to reject a premarket submission outright when required cybersecurity content is missing.
Definition
Refuse to Accept (RTA) is FDA's authority to reject a premarket submission before substantive review when administrative or content requirements are not met. Under section 524B, FDA began RTA enforcement on October 1, 2023 for any cyber-device submission missing the statutory cybersecurity content (vulnerability monitoring plan, secure-by-design processes, SBOM, and any other required information). An RTA stops the review clock; the sponsor must resubmit with complete content.What this means in practice
RTA on cybersecurity content is fast and unforgiving. Most MedTech teams that have hit it underestimated the scope of what FDA expects in the SBOM, threat model, and vulnerability management plan, or treated the section 524B requirements as guidance rather than statute. Build the cybersecurity package alongside the rest of the submission and pre-flight it against the RTA checklist.Examples
- A manufacturer submitted a premarket application for a new infusion pump but failed to include a comprehensive software bill of materials (SBOM) detailing all commercial, open-source, and off-the-shelf components, leading to an RTA.
- A submission for an imaging device was refused due to an inadequate vulnerability management plan that did not clearly outline post-market processes for identifying, assessing, and remediating cybersecurity vulnerabilities.
- The FDA issued an RTA for a connected diagnostic system because the submission lacked sufficient documentation demonstrating that secure-by-design principles were integrated throughout the product development lifecycle.
- •Submitting an SBOM that lacks the CISA minimum elements or end-of-support information.
- •Including a generic vulnerability management plan with no resourcing detail.
- •Missing the cybersecurity labeling content required under 524B.
Frequently asked questions
Related terms
Grouped by themeEditor's picks
· Hand-selected related conceptsThe bundle of cybersecurity artifacts a sponsor includes in a 510(k), De Novo, PMA, or HDE submission for a cyber device.
The federal statute that gives FDA explicit premarket authority over cybersecurity for cyber devices.
A machine-readable inventory of all software components, including open-source and third-party libraries, used to build a medical device.
FDA administrative decision that a submission is incomplete and won't be substantively reviewed.
More in Cybersecurity
· Same categoryAAMI/ANSI standard establishing requirements for medical-device cybersecurity activities throughout the lifecycle.
AAMI Technical Information Report providing MedTech-specific guidance on cybersecurity risk management.
AAMI Technical Information Report on post-market security risk management for medical device manufacturers, the operational companion to TIR57.
Unauthorized remote control of an implanted neurostimulator (e.g., DBS) to alter stimulation parameters and harm a patient.
Where this term appears across MedTech Terms.
Latest in MedTech
Sources
3 sourcesEvery citation below opens the original document. Each is graded against our source-tier hierarchy so you can see what rests on binding law versus commentary.
- 1Refuse to Accept Policy for 510(k)sTier 2 VerifiedFDAfda.gov
- 2FDA Cybersecurity Guidance (Sept 2023)Tier 2 VerifiedFDAfda.gov
- 3CISA - Healthcare and Public Health SectorTier 2 VerifiedCISAcisa.gov
Inline markers like [1] jump to the matching reference above.