All terms
Section 524B of the FD&C Act
The federal statute that gives FDA explicit premarket authority over cybersecurity for cyber devices.
Reviewed by Christian Espinosa, Founder, Blue Goat CyberLast reviewed May 5, 2026
Definition
Section 524B of the Federal Food, Drug, and Cosmetic Act, added by section 3305 of the Consolidated Appropriations Act of 2023, requires sponsors of "cyber devices" to submit a cybersecurity package as part of any premarket submission (510(k), De Novo, PMA, HDE). A cyber device is defined as one that (1) includes software validated, installed, or authorized by the sponsor; (2) has the ability to connect to the internet; and (3) contains technological characteristics that could be vulnerable to cybersecurity threats. 524B took effect for submissions on or after March 29, 2023, and FDA began Refuse-to-Accept (RTA) enforcement on October 1, 2023. What the regulation says
524B requires four things in a cyber-device submission: (1) a plan to monitor, identify, and address postmarket cybersecurity vulnerabilities and exploits; (2) processes and procedures providing reasonable assurance that the device and connected systems are cybersecure, including coordinated vulnerability disclosure and timely patch release; (3) a Software Bill of Materials including commercial, open-source, and off-the-shelf components; and (4) any other information FDA may require to demonstrate reasonable assurance of safety and effectiveness. FDA's September 2023 final guidance translates these statutory requirements into reviewable artifacts - threat model, risk assessment, security architecture views, SBOM, vulnerability management plan, and end-user labeling.What this means in practice
Before 524B, cybersecurity expectations were guidance-level and inconsistently enforced. Today, missing 524B content is a Refuse-to-Accept basis - the submission never reaches substantive review. Most MedTech teams now treat 524B as the spine of their premarket cybersecurity package and align internal design controls (ISO 13485 / 21 CFR 820.30) and risk management (ISO 14971, AAMI TIR57) to produce the required artifacts as a natural output of the development lifecycle. Common pitfalls
- •Assuming legacy 510(k) predicates exempt the new submission from 524B - they do not.
- •Submitting a generic 'cybersecurity plan' without the underlying threat model, SBOM, and architecture views.
- •Treating the postmarket vulnerability monitoring plan as boilerplate; FDA expects a real, resourced process.
- •Ignoring labeling - 524B requires end-user-facing security information (e.g., MDS2-style disclosures).
Frequently asked questions
A device that (1) contains software validated, installed, or authorized by the sponsor, (2) has the ability to connect to the internet, and (3) contains technological characteristics vulnerable to cybersecurity threats. The 'ability to connect' is interpreted broadly - Wi-Fi, Bluetooth, cellular, even USB pathways into clinical networks can qualify.
Cross-references
Related terms
Shared paths + categoryCybersecurity
Secure Product Development Framework(SPDF)
A documented, risk-based set of processes that build cybersecurity into a medical device across its full lifecycle.
FDA Cybersecurity 101 · adjacentSoftware Team Onboarding · adjacent
Cybersecurity
Software Bill of Materials(SBOM)
A machine-readable inventory of all software components, including open-source and third-party libraries, used to build a medical device.
FDA Cybersecurity 101Software Team Onboarding
Cybersecurity
Threat Modeling
A structured analysis that identifies how an attacker could compromise a medical device and what controls mitigate each threat.
FDA Cybersecurity 101Software Team Onboarding
Cybersecurity
Premarket Cybersecurity Submission
The bundle of cybersecurity artifacts a sponsor includes in a 510(k), De Novo, PMA, or HDE submission for a cyber device.
FDA Cybersecurity 101 · adjacent
Cybersecurity
Coordinated Vulnerability Disclosure(CVD)
A documented process for receiving, triaging, and responsibly disclosing security vulnerabilities reported by external researchers.
Same category
Cybersecurity
Refuse to Accept (Cybersecurity)(RTA (cyber))
FDA's authority to reject a premarket submission outright when required cybersecurity content is missing.
Same category
Latest in MedTech
Primary references
3 sourcesLink health: 3 verified· last checked 2026-06-20
FDA·2U.S. Congress·1
- 1Section 524B of the FD&C Act - FDA overviewVerifiedFDAfda.gov
- 2Cybersecurity in Medical Devices: Quality System Considerations and Content of Premarket Submissions (Sept 2023)VerifiedFDAfda.gov
- 3Consolidated Appropriations Act of 2023, Section 3305VerifiedU.S. Congresscongress.gov
Inline markers like [1] jump to the matching reference above.