Medical-device cybersecurity: scope the device, SBOM and evidence traceability
FDA’s February 2026 final guidance distinguishes the statutory cyber-device criteria from its wider cybersecurity recommendations. The evidence project should connect the actual system and software versions to the threat model, component inventory, risk assessment and test findings. An SBOM or a matching CVE name alone cannot establish that a device is vulnerable.
Evidence retrieved 2026-10-07. Source versions and topic-specific limits are listed below.
Sourced criteria · US
What changes the service scope?
Decision or task
What the source describes
What to prepare
Which cyber-device criteria need factual assessment?
The guidance quotes all three section 524B(c) criteria and explains internet-connectivity context; its section 524B(a) discussion also distinguishes submission pathways. [1]
Record installed/authorized software, connectivity including related systems, actual technological characteristics and submission context; have the applicability rationale reviewed.
Can the risk report be traced to the device and its components?
FDA recommends security risk management documentation linking threat modeling, risk assessment, SBOM, support information, vulnerability assessment and testing. [2]
Build a versioned evidence map with owners and unresolved findings; distinguish the guidance recommendations from applicable statutory requirements.
Which SBOM entries need investigation?
The guidance distinguishes the cyber-device SBOM requirement from its recommendations and describes component support/end-of-support information and known-vulnerability assessments. [3]
Match actual component versions and applicability conditions before assessing a vulnerability; document uncertain identifiers and supplier support.
What does usable testing and lifecycle evidence contain?
FDA discusses test scope, methods, results, tester independence/expertise and assessment of findings; it also discusses differing risk profiles among fielded software configurations. [4][5]
Agree a justified device-specific test scope, original reports, finding dispositions and lifecycle ownership for every relevant fielded configuration.
The actual device, submission, component versions, exploitability, clinical impact and statutory applicability are unresolved. This is dated final guidance, not a device vulnerability finding, universal patch deadline, certification or proof that all recommendations are mandatory.
A scoped evidence and handoff plan
Use this checklist to gather your business or product details before speaking with a specialist. The items below explain what to record and suggest useful supporting documents. You can add your own answers in the editable project brief.
Which cyber-device criteria need factual assessment?
Record installed/authorized software, connectivity including related systems, actual technological characteristics and submission context; have the applicability rationale reviewed.
Useful evidence: System architecture, connectivity/attack-surface description and submission/applicability rationale.
Can the risk report be traced to the device and its components?
Build a versioned evidence map with owners and unresolved findings; distinguish the guidance recommendations from applicable statutory requirements.
Useful evidence: Threat model, risk report, versioned SBOM and a risk-to-control-to-test matrix.
Which SBOM entries need investigation?
Match actual component versions and applicability conditions before assessing a vulnerability; document uncertain identifiers and supplier support.
Useful evidence: Machine-readable component/version inventory, support evidence and applicability/risk assessment records.
What does usable testing and lifecycle evidence contain?
Agree a justified device-specific test scope, original reports, finding dispositions and lifecycle ownership for every relevant fielded configuration.
Useful evidence: Test scope/configurations, original reports, residual-risk decisions and fielded-version/update plan.
Work packages and dependencies
Conditional: System, SBOM, risk and testing evidence assessment — For this work package, agree the supported criteria, evidence access, covered entities/products and unresolved facts in the table above. Additional services require their own justified scope.
Optional: Separate submission strategy when a 510(k) route is justified — For this work package, agree the supported criteria, evidence access, covered entities/products and unresolved facts in the table above. Additional services require their own justified scope.
Questions for providers
Which exact actor, product or processing facts support the quoted scope, and what is still unresolved?
How will the listed records reach the responsible people, and who owns each change or authority request?
Which tasks and entities are excluded from the agreement, and which additional services need a separate assessment?
Sources and data dates
Read the official document in context. The audit details identify the precise locators and preserved versions used for this page.
