Free tool, self-assessment
FDA 524B submission readiness checklist
Five questions against what 524B actually requires: the SBOM, the threat model, secure development evidence, the postmarket plan, and testing. Scored transparently from your own answers.
This is a self-assessment heuristic to focus preparation, not a regulatory determination — only FDA decides whether a submission satisfies 524B. Runs in your browser, nothing stored.
Do you have a software bill of materials (SBOM) for the device?
Have you produced a threat model and security risk assessment for this device?
How mature is your secure product development lifecycle evidence?
0 of 5 answered. Runs in your browser, nothing stored.
Where the checklist comes from
The five questions map to section 524B of the FD&C Act — the cybersecurity plan, the SBOM, secure development evidence, and postmarket monitoring — plus FDA's June 2023 guidance, "Cybersecurity in Medical Devices: Quality System Considerations and Content of Premarket Submissions," which describes the threat model, architecture views, and testing FDA expects to see. The standards named in the options (IEC 62304, IEC 81001-5-1, AAMI TIR57, UL 2900-2-2, NTIA minimum elements) are the common alignment points, not legal requirements. The FDA 524B explainer walks each requirement in depth.
Frequently asked questions
What does FDA 524B actually require?
For devices that qualify as cyber devices, section 524B of the Federal Food, Drug, and Cosmetic Act requires the sponsor to submit: a plan for reasonable assurance of cybersecurity across the device lifecycle; a software bill of materials including commercial, open-source, and off-the-shelf components; evidence the device was designed and developed following processes providing reasonable assurance; and a plan to monitor and address postmarket vulnerabilities, including making updates and patches available on a reasonably justified regular cycle and out-of-cycle for critical vulnerabilities. FDA's June 2023 guidance describes what that content looks like in a submission.
Is a high score a prediction that FDA will accept the submission?
No. The score is a self-assessment heuristic derived entirely from your own answers — it names which of 524B's elements your answers say are missing or partial. Only FDA decides whether a submission satisfies the statute, and acceptance depends on the evidence, not the checkbox. The tool exists to focus preparation, not to substitute for review.
Why does the checklist reference IEC 62304, AAMI TIR57, and UL 2900-2-2?
Because those are the common alignment points for the evidence 524B asks for, and the same vocabulary the directory uses: IEC 62304 and IEC 81001-5-1 for the secure development lifecycle, AAMI TIR57 for security risk management, UL 2900-2-2 for device-level security testing, and the NTIA minimum elements for the SBOM. Alignment is not a legal requirement — it is how teams usually demonstrate the work.
Does this cover the EU MDR or the UK's requirements?
No. This checklist maps the US requirement — FD&C Act 524B and FDA's premarket cybersecurity guidance. Other jurisdictions have their own frameworks, and their requirements do not line up one-to-one with this one.
Is anything I enter stored or shared?
No. The checklist runs entirely in your browser, the answers never leave your device, there is no account, no log, and nothing retained.