Buying FDA 524B Compliance Help: What to Check Before You Pay

Key takeaways

• The statute is short and you can read it. Section 524B, codified at 21 U.S.C. 360n-2, effective for covered submissions on March 29, 2023, defines a cyber device with three criteria and obligates the sponsor in four ways: submit a plan to monitor, identify, and address postmarket vulnerabilities and exploits, including coordinated vulnerability disclosure; design and maintain processes and procedures providing a reasonable assurance of cybersecurity, with updates and patches on a regular cycle and out of cycle for critical vulnerabilities; provide an SBOM covering commercial, open-source, and off-the-shelf software components; and comply with any further requirements FDA sets by regulation. Every legitimate deliverable traces back to those lines.
• Acceptance is FDA's decision, which makes guarantees tells. FDA announced a Refuse to Accept policy for cyber devices under section 524B in March 2023, stating it would generally work missing 524B information through interactive review before October 1, 2023 rather than refuse submissions outright. The agency holds the door; nobody selling you a package does. A guarantee of an FDA outcome describes an authority the seller does not have.
• Invented regulatory categories are the loudest tell. The statute contains one exemption mechanism: the Secretary may identify exempt devices or categories and must publish the list in the Federal Register. There is no "524B-lite," no small-device tier, no size-based carve-out in the statute or the guidance. Search any claimed category name against the statute text and FDA's current guidance before paying for the relief it promises.
• Legitimate help is format-real and guidance-aware. FDA's guidance recommends machine-readable SBOMs consistent with NTIA's minimum elements, and the standard SBOM formats ship open-source validators, so the work can be checked rather than trusted. The guidance has been revised twice since it was first finalized in 2023, with a draft in between; a proposal that cannot name the edition it is written against is stale on arrival.
• FDA endorses nothing in this market. The guidance is labeled nonbinding recommendations and states it does not establish rights for any person. FDA's website policies state that references to commercial products, services, manufacturers, or companies do not constitute endorsement by the U.S. government, HHS, or FDA. The source of truth is the statute, the current guidance, and the Federal Register, all free.

What section 524B actually requires

The Food and Drug Omnibus Reform Act of 2022 added section 524B to the FD&C Act on December 29, 2022, with the requirements effective for covered submissions on March 29, 2023. The statute applies to a "cyber device": a device that includes software validated, installed, or authorized by the sponsor as a device or in a device, has the ability to connect to the internet, and contains technological characteristics that could be vulnerable to cybersecurity threats. FDA's guidance reads that broadly: software includes firmware and programmable logic, and the ability to connect to the internet includes unintentional connectivity, so a device serviced through a USB port counts as connected.

If your device meets that definition and your submission is a 510(k), PMA, PDP, De Novo, or HDE, including for modifications, the statute obligates you, the sponsor, to submit a plan to monitor, identify, and address postmarket cybersecurity vulnerabilities and exploits in a reasonable time, including coordinated vulnerability disclosure and related procedures; to design, develop, and maintain processes and procedures that provide a reasonable assurance that the device and related systems are cybersecure, and to make available updates and patches, on a reasonably justified regular cycle for known unacceptable vulnerabilities and as soon as possible out of cycle for critical vulnerabilities that could cause uncontrolled risks; to provide a software bill of materials including commercial, open-source, and off-the-shelf software components; and to comply with any additional requirements FDA sets through regulation. The only exemption path is the one the Secretary publishes in the Federal Register.

FDA's current final guidance, "Cybersecurity in Medical Devices: Quality Management System Considerations and Content of Premarket Submissions," issued February 3, 2026, turns those statutory lines into recommended documentation. It supersedes the "Quality System Considerations" edition issued June 27, 2025, which updated the September 27, 2023 edition and finalized the March 13, 2024 draft "Select Updates for the Premarket Cybersecurity Guidance: Section 524B." You do not need anyone's permission to read any of it: FDA's medical device cybersecurity page is www.fda.gov/medical-devices/digital-health-center-excellence/cybersecurity, the current guidance page is www.fda.gov/regulatory-information/search-fda-guidance-documents/cybersecurity-medical-devices-quality-management-system-considerations-and-content-premarket, and the statute text is at www.law.cornell.edu/uscode/text/21/360n-2. This site's FDA 524B framework overview walks the same requirements with the sources attached. That is the context. The rest of this post is about the market that has formed around it.

What legitimate compliance help looks like

Legitimate help exists and is worth paying for, because the statute is short and your submission is not. The markers of the real thing are consistent.

SBOMs that survive contact with tooling. FDA's guidance recommends machine-readable SBOMs consistent with the minimum elements from NTIA's Software Component Transparency work, plus two additions per component: the software level of support and the end-of-support date. NTIA's minimum elements document, published July 12, 2021 under Executive Order 14028 (www.ntia.gov/SBOM), defines the data fields, Supplier, Component Name, Version of the Component, Other Unique Identifiers, Dependency Relationship, Author of SBOM Data, and Timestamp, and recognizes SPDX, CycloneDX, and SWID tags as machine-readable formats. NTIA publishes no official validator, but the formats themselves ship open-source tooling: SPDX's tools validate documents against the v2.2 and v2.3 specification, and the CycloneDX CLI has a validate command. A legitimate provider names the format, runs the validator, and hands you the output with the SBOM, covering commercial, open-source, and off-the-shelf components because the statute lists all three.

Vulnerability disclosure that connects to something. The statute requires a plan to monitor, identify, and address postmarket vulnerabilities and exploits, including coordinated vulnerability disclosure. FDA's guidance says what it looks for in that plan: personnel responsible; sources, methods, and frequency for monitoring, including researchers, the NIST National Vulnerability Database, and third-party software manufacturers; identifying and addressing vulnerabilities in CISA's Known Exploited Vulnerabilities Catalog; periodic security testing; timelines to develop and release patches; patching capability; a described coordinated vulnerability disclosure process; and a described process for communicating remediations to customers. Because third-party suppliers sit in the middle of this risk, the public reference for supply chain practices is NIST SP 800-161r1, Cybersecurity Supply Chain Risk Management Practices for Systems and Organizations, published May 2022 (csrc.nist.gov/pubs/sp/800/161/r1/final). FDA's guidance does not cite it, but a provider fluent in supply chain risk management will know it, and a provider with only a disclosure template will not. Additional coordinated disclosure recommendations live in FDA's Postmarket Cybersecurity Guidance from 2016, which the current guidance still points to.

A response file wired to a response capability. In this market a "response file" is the document set: the monitoring plan, the disclosure procedures, the patch process, the communication plan. Those are real artifacts and FDA expects to see them. What separates help from paperwork is whether they connect to anything that acts. When an external researcher reports a vulnerability, who triages it? When a patch has to ship out of cycle because the statute's "as soon as possible" clause is live, who decides and how fast? When customers and hospitals need notification, who sends it? Those questions live in your incident response plan template, and the 524B artifacts should feed it: disclosure procedures roll into vulnerability handling, patch timelines roll into remediation, and the named contacts roll into the call tree the breach response checklist assumes exists at 2 a.m. A provider who cannot tell you how their response file connects to your incident response plan is selling a binder with a regulator's name on it.

Advice that moves when FDA moves. The statute ordered FDA to review and update its device cybersecurity guidance within two years of enactment, in consultation with CISA, and periodically thereafter, and the agency has complied: a final in September 2023, a draft with select 524B updates in March 2024, a revised final in June 2025, and the current final on February 3, 2026, renamed for the Quality Management System Regulation now found at 21 CFR Part 820. Advice that was competent against the 2023 edition can be quietly wrong against the 2026 one. A legitimate provider cites the edition it works from in the proposal and tells you what happens when the next revision lands: whether updating is included, until when, at what price.

The red flags

None of these point at any company, because the patterns, not the names, are the content. Every red flag has the same shape: the tell is what the claim does, and the verification is something you can check in minutes against a primary source.

1. Guaranteed outcomes. The tell is a guarantee attached to an FDA decision: guaranteed acceptance, a money-back promise keyed to the submission outcome, a claimed perfect pass rate. Verify by asking what exactly is guaranteed. The honest version is deliverables: a plan, an SBOM, procedures, by dates, in defined formats. The dishonest version attaches the guarantee to FDA's decision, which no seller controls. The agency's own Refuse to Accept policy for cyber devices, announced March 30, 2023, shows where that power sits, and it is not with the vendor. A seller comfortable describing FDA's decision as part of its product is telling you how it will describe everything else.

2. Invented regulatory categories. The tell is a package named for a category that appears nowhere in the law: a "524B-small" tier, a "low-connectivity pathway," a "lite" classification at a discount. Verify by opening the statute. Section 524B(d) contains one exemption mechanism, a list the Secretary may publish and update in the Federal Register, and no size-based tier exists in the statute or the guidance; a Federal Register search turns up no cyber device exemption list as of this writing. The scope question is real, but it runs through the cyber device definition, all three criteria or none, and FDA reads even a USB service connection as the ability to connect to the internet. A category invented for the sales deck does not do that analysis; it skips it. Search the claimed category name against the statute text and the current guidance, and if it appears in neither, you are looking at a product name, not a regulatory status.

3. Trust seals and scores that measure membership. The tell is a badge, a percentage, or a rank presented as third-party assurance with no verifier named. Verify by asking two questions: who performs the verification, and what is the score computed from? If the answers are membership dues and a self-attested form, the seal measures the invoice, not the work. FDA's website policies state that references to commercial products, services, manufacturers, or companies do not constitute endorsement by the U.S. government, HHS, or FDA, and FDA publishes no register of approved 524B consultants. Any badge implying FDA recognition is borrowing an authority that does not exist. A real verification names its verifier, its method, and its evidence, and lets you sample it.

4. Borrowed authority. The tell is a comparison that lends credibility without lending evidence: "we secure devices the way the biggest cloud platforms secure theirs," standards body logos arranged to imply partnership, "trusted by regulated industries" without a verifiable artifact. Verify by tracing each borrowed authority to its source. The standards FDA's guidance actually references, ISO 13485 through the Quality Management System Regulation, ISO 14971 for the risk management framework, IEC 81001-5-1, AAMI TIR57, describe what your quality system and risk processes should look like, not who may sell you help. A logo is not a delegation, and a comparison is not a case study. The artifact that carries authority in this market is a redacted documentation set from a submission that passed review, and a provider with one will show it.

5. Evidence lockers pitched as litigation protection. The tell is a claim that a storage product protects you from shareholder lawsuits. That converts a legal conclusion, which depends on facts, filings, and the decisions of courts and regulators, into a feature. Verify by asking what the locker does during a live event: when a researcher's email arrives, when FDA sends a deficiency letter, when a hospital asks what your SBOM says about a component in the news. The artifact that matters then is the response, triage, decision, patch, notification, executed by people you can name. Storage with no response capability behind it protects the invoice, not the company, and the litigation answer belongs to your counsel, not your compliance vendor.

The questions to ask before paying

Use these with anyone, from a two-person consultancy to the biggest brand in the MedTech FDA 524B directory; the real ones answer faster than the confident ones.

1. Who performs the technical work: which named individuals, doing what (SBOM generation, threat modeling, disclosure procedures), and what is subcontracted?
2. Which edition of FDA's cybersecurity guidance is this proposal written against, and what happens when FDA revises it: is updating included, until when, at what price?
3. Can you show a redacted documentation set from a submission that passed review, for a device with connectivity like mine, recent enough to reflect the current guidance?
4. Does the SBOM validate: which format, which validator, will you hand over the validation output, and does it cover commercial, open-source, and off-the-shelf components with level of support and end-of-support dates?
5. Does the response file connect to an actual response capability: who triages an external report, who decides an out-of-cycle patch, who notifies customers, and how does it feed our incident response plan?
6. What exactly is guaranteed, in writing: deliverables and dates, or FDA's decision?

Log every answer with its date, the way you log anything you may need to defend later. Sellers confident in their work answer these quickly and specifically. Sellers whose product is confidence answer with qualifications, slide decks, and a badge.

What FDA actually endorses

Nothing in this market. The current guidance's preamble states that it represents FDA's current thinking, does not establish any rights for any person, and is not binding on FDA or the public, and FDA notes generally that its guidances do not establish legally enforceable responsibilities, with "should" meaning suggested or recommended. The statute runs on "the sponsor shall," your obligations, not a licensed class of helpers. FDA's website policies state plainly that references to commercial products, services, manufacturers, or companies do not constitute endorsement by the U.S. government, HHS, or FDA. What FDA publishes is statutes, regulations, guidance, and the Federal Register, and that is the entire universe of authority a 524B vendor can legitimately point to. So end the sales call with one move: ask the seller to point to the FDA page that says what they claim. If the claim is real, the page exists. If the answer is a trust seal, a guarantee, or a category you cannot find in the statute, you have your answer, and you have it before paying.

Frequently asked questions

Does every connected medical device need an SBOM under section 524B? Only devices meeting the statute's definition of a cyber device: software validated, installed, or authorized by the sponsor as a device or in a device, the ability to connect to the internet, and technological characteristics that could be vulnerable to cybersecurity threats, submitted under a 510(k), PMA, PDP, De Novo, or HDE, with the requirements effective March 29, 2023. For those devices the SBOM is a statutory requirement covering commercial, open-source, and off-the-shelf components. The exemption mechanism is a list the Secretary publishes in the Federal Register, not a category a seller can assign to your device.

Can a consultant guarantee my submission is accepted? No. Acceptance is FDA's decision under review policies FDA controls, and the agency's Refuse to Accept policy for cyber devices is the published reminder of who holds that door. What a provider can commit to is its own work: defined deliverables, in the formats the guidance recommends, by dates, with the evidence behind them. A guarantee that names an FDA outcome is a marketing sentence, and it is also the fastest red flag to spot in a pitch.

Is there a single SBOM format FDA requires? No. FDA recommends machine-readable SBOMs consistent with NTIA's minimum elements and encourages industry-accepted formats; NTIA's format work recognizes SPDX, CycloneDX, and SWID tags, and both SPDX and CycloneDX publish open-source validators. The practical test of a provider's SBOM work is not the logo on the tool but whether the document passes the validator for the format it claims to be in, with commercial, open-source, and off-the-shelf components included and the support and end-of-support fields FDA recommends attached.

How do I check a claimed exemption or special category? Three sources settle it: the statute text at 21 U.S.C. 360n-2, FDA's current guidance, and the Federal Register, where the statute requires any exemption list to be published. If the claimed category appears in none of them, it is a product name. The check takes minutes, it requires no lawyer, and it is the single most reliable way to separate compliance help from confident paperwork in this market.

Free download: the response file's bigger sibling, ready to adapt: Incident Response Plan template (DOCX) →