FDA 524B Premarket Cybersecurity, Explained
Section 524B of the Federal Food, Drug, and Cosmetic Act applies to cyber devices, any device containing software authorized for device functions or capable of internet connectivity. It does not care how you classify your risk; it cares whether your submission demonstrates a lifecycle security process.
This page maps every requirement to the deliverable reviewers expect and the directory filter that finds firms who produce it.
What renders on this page
- ▸Requirement-to-deliverable map with directory filter references
- ▸Verified firm matrix filtered by 524B deliverable
- ▸NTIA-compliant SBOM tool checkmarks
- ▸"Request Secure RFP" form pre-wired to the FDA 524B RFP template
The premarket package
Reviewers expect a Security Risk Management Plan tied to your ISO 14971 file, a threat model with the four required security architecture views, a machine-readable SBOM (CycloneDX 1.5+ or SPDX 2.3+), a known-vulnerability assessment against CVEs and the CISA KEV catalog, a Security Risk Management Report, and cybersecurity labeling. Packages where threat modeling and risk management read as separate documents written by separate teams draw questions.
Standards reviewers expect to see
AAMI TIR57 for security risk management under ISO 14971, IEC 62304 for software lifecycle, IEC 81001-5-1 for health software systems, and UL 2900-2-1 for testing rigor. Alignment is demonstrated by integration, not citation, TIR57 threat models that trace into the risk file, 62304 SOUP assessments that connect to the SBOM.
Postmarket obligations
The premarket package promises a monitoring plan, coordinated vulnerability disclosure, and update timelines. 524B made those enforceable. Firms that build these into your quality system (CAPA, design control) prevent the inspection finding that kills an otherwise clean submission history.
Find 524B-capable firms
The directory filters consultancies by deliverable, submission type (510(k), PMA, De Novo), and postmarket scope. Start at the medtech vertical page or go straight to documented FDA 524B premarket cybersecurity consultancies.
Frequently asked questions
Is 524B guidance or law?
Law, a statutory section of the FD&C Act, effective March 2023, with FDA premarket cybersecurity guidance describing how the agency expects it satisfied. Guidance is the how; 524B is the what and the why.
Does 524B apply to Class II devices?
Yes, whenever the device is a cyber device, software with device functions or connectivity. Classification changes the review pathway, not the 524B trigger.
What is an NTIA-compliant SBOM?
A software bill of materials covering the NTIA minimum elements: supplier, component name, version, unique identifiers, dependency relationships, and author with timestamp. FDA prefers CycloneDX 1.5+ or SPDX 2.3+ machine-readable formats. Directory checkmarks indicate firms generating these automatically in CI/CD.
How long does a 524B package take?
For a Class II device with a cooperative regulatory team, six to twelve weeks with a verified consultancy is realistic. Class III programs with prior submissions run longer. The RFP template captures device class, submission type, and timeline so firms quote real schedules.