Five questions show whether FDA’s cybersecurity rules cover your device and what to submit.
- Yes, no or unclearWhether your device likely counts as a cyber device, and why.
- What to submitA vulnerability plan, an update and patch process, and a software parts list (SBOM).
- Three next stepsWhat to do next, with the FDA sections behind the answer.
The short answer
Under section 524B of the FD&C Act, a device is a cyber device if it includes software or firmware, can connect to the internet and could be vulnerable to cybersecurity threats. Since March 29, 2023, its premarket submission (510(k), De Novo, PMA, PDP or HDE) must include a vulnerability plan, a process for updates and patches, and a software bill of materials (SBOM).
How it works
- Answer five questionsSoftware, internet access, the connections it has, field updates and the FDA submission you plan.
- We apply section 524BAll three conditions in section 524B(c) must be met, and software that can connect counts as possibly vulnerable.
- You get your resultLikely a cyber device, likely not or unclear, with the reason; section references sit under “Details and references”.
Which connections count for section 524B
FDA reads “connect” broadly: Bluetooth, USB and a link through a phone app all count, intended or not. Its list is “illustrative, not exhaustive”, so a link it does not name, such as NFC, shows as unclear in the check.
| Connection or feature | Does FDA count it? | What FDA’s guidance says |
|---|---|---|
| Wi-Fi or cellular | Yes, named | Radio-frequency communications, Section VII.B |
| Bluetooth or Bluetooth Low Energy, even to a phone app only | Yes, named | Named; a link “through any means” counts, Section VII.B |
| Network, server or cloud connection | Yes, named | Named, Section VII.B |
| USB port, including a service port | Yes, named | A brief connection counts, footnote 61 to Section VII.B |
| Ethernet or serial port | Yes, named | Hardware connectors, Section VII.B |
| Magnetic inductive link (implant and programmer) | Yes, named | Named, Section VII.B and footnote 60 |
| Over-the-air updates | Yes, through the update link | Update servers are “related systems”, Section VII.C.2 |
| NFC | Unclear, leaning yes | Not named; the list is “not exhaustive”, Section VII.B |
| SD card used only for updates | Unclear | Not named; portable media listed as a risk, Introduction |
| USB wired for power only | Unclear | Not addressed; the test is a connector “capable of connecting”, Section VII.B |
| Internal test or debug port (JTAG, UART) | Not named in the scope list | Disable or restrict before delivery, Appendix 1 |
| No radio, no port, no update path | No | Section 524B(c)(2) not met; document the threat surface, Section VII.B |
The check is not an FDA decision; if you are unsure, FDA says you may contact it. It leaves out clinical studies under an investigational device exemption (IDE), section 524B(d) exemptions, HIPAA patient data privacy, rules in other markets such as the EU, and postmarket handling of vulnerabilities, including when a new submission or a 21 CFR Part 806 report is needed. OVA designs security controls such as secure boot, signed firmware updates and encrypted wireless links into the electronics and firmware; the penetration test and the submission stay with your test provider and regulatory team.
What OVA does here, and where our responsibility ends
We design the electronics, firmware and mechanics of medical devices and take them from concept to design for manufacturing. We are not a regulatory consultancy and not a contract manufacturer: the regulatory strategy and the submission stay with you or your regulatory consultant.
The result is an orientation, not a regulatory opinion and not an FDA determination. Confirm whether your device is a cyber device and what your submission needs with a regulatory specialist or through a Pre-Submission (Q-Sub) with FDA. The tool runs in your browser. Your answers are not sent to us; with your cookie consent, Google Analytics records only that the tool was used and the category of the result.
Questions
Is a Bluetooth Low Energy device a cyber device?
Most likely yes, as long as it runs software or firmware. FDA names Bluetooth Low Energy outright and counts a link that only goes to a phone app. It will also want you to assess whether you need added security controls beneath BLE, in case vulnerabilities in the protocol are discovered.
Does a USB port make my device a cyber device?
Likely yes, if the device runs software or firmware. FDA names USB, and even a service port counts, because “while the connection may be brief, the ability to connect is present”. A port wired only for power, with no data lines, is not addressed.
What must a 524B submission include?
Three things: a postmarket vulnerability plan with coordinated vulnerability disclosure, processes for regular and out-of-cycle updates and patches, and an SBOM that lists commercial, open-source and off-the-shelf components. FDA wants that SBOM machine-readable, with the NTIA minimum elements, each component’s level of support and end-of-support date, and known vulnerabilities, including CISA’s Known Exploited Vulnerabilities Catalog.
When did section 524B take effect, and can FDA refuse my submission?
It applies to submissions sent on or after March 29, 2023. Since October 1, 2023, FDA may refuse to accept a submission that lacks the 524B information. And an eSTAR, FDA’s electronic submission template, whose Cybersecurity section lacks accurate responses and attachments goes on a Technical Screening hold.
Does section 524B apply to a change to a device already on the market?
Yes, if the change needs a new premarket submission. FDA lists changes to authentication or encryption algorithms, new connectivity features and changes to the software update process as changes that may impact cybersecurity.
Are any devices exempt, and what about an IDE study?
FDA may publish a list of devices exempt under section 524B(d), but a search on October 22, 2026 found none. Section 524B does not name the IDE at all; Appendix 3 of FDA’s guidance is where that is covered.
Related pages
Sources
- United States Code: 21 U.S.C. 360n-2, FD&C Act section 524B “Ensuring cybersecurity of devices”, 2023 edition (govinfo), checked on October 22, 2026
- FDA guidance: Cybersecurity in Medical Devices: Quality Management System Considerations and Content of Premarket Submissions, issued February 3, 2026, which supersedes the June 27, 2025 version, checked on October 22, 2026
- FDA: Cybersecurity in Medical Devices Frequently Asked Questions, content current as of June 26, 2025
- Federal Register: Cybersecurity in Medical Devices: Refuse To Accept Policy for Cyber Devices and Related Systems Under Section 524B of the FD&C Act, notice of availability, 88 FR 19148, March 30, 2023
- Federal Register: notice of the updated premarket cybersecurity guidance, 90 FR 27634, June 27, 2025
Data as of October 22, 2026. By Lisa Voronkova, CEO of OVA Solutions. Updated on October 22, 2026.