The FDA questions everything legacy testing skips
A point-in-time pentest hands you a PDF of findings and high-level advice. FDA reviewers want the opposite: test cases mapped to threats, prescriptive fixes, proof each mitigation was tested, and evidence of prior results. And increasingly, they ask not just what you tested, but how you will keep testing.
Across premarket (Section 524B) and postmarket review, the same gaps recur. Legacy, point-in-time testing produces failure modes that trigger FDA deficiencies:
- No test-case testing for threat mitigations. Reviewers ask for interface-by-interface verification, not a summary.
- Vendor recommendations that are not actionable. Pentest advice is high-level, and the FDA treats it as the fix criteria, which is often incomplete.
- No proof of threat-mitigation testing. A claimed control without an executed test case does not close the finding.
- No evidence of prior testing results, or a plan to keep testing. Historical results, a vulnerability management plan, and recurring testing are expected, not asserted.
ELTON closes all of it from a single digital twin, in one service on one platform. The pages that follow walk the exact deficiencies we see, and how each is resolved.
“Deferred” is not an accepted answer
The most common deficiency we see: a third-party penetration test report with findings marked “deferred.” The FDA rejects the deferral outright.
What the FDA writes
You provided the third-party penetration test report which identifies multiple security findings. You state that these findings are “deferred.” However, these findings pose a security risk that should be mitigated to ensure patient safety from device tampering. Adequate authentication, authorization, and code, data, and execution integrity controls are required under Section 524B(b)(2) of the FD&C Act. Please revise these controls based on the concerns in the tables below.
Read plainly: the FDA will not accept a justification for leaving pentest findings unfixed. A risk assessment that defers them is not enough.
And then, on the fix
The Agency concurs with ELTON’s feedback to remediate the issue. In your future 510(k) submission, please address this vulnerability as recommended in the penetration test report.
The trap: the FDA points to the pentest vendor’s recommendation as the fix criteria. Those recommendations are high-level and not always complete, so “fixed per the report” can still be wrong. ELTON generates prescriptive remediation from its own test cases, down to the code fix and outside the pentest report, so the mitigation actually holds.
Interface-by-interface test cases, or a justification
The second most common deficiency: verification and validation that does not cover the electronic interfaces, mechanism by mechanism.
What the FDA writes
The verification and validation testing for the electronic interfaces on the device has not been adequately addressed. For example, you did not provide complete V&V test results for interface-specific security mechanisms, including: (a) USB-C: malware protection, unauthorized device rejection, and data-integrity verification during transfer; (c) Wi-Fi/Bluetooth: verification that wireless capabilities cannot be reactivated through firmware exploitation or physical access. Please provide adequate V&V for the electronic interfaces, or an acceptable justification for the omission.
Per the Verification and Validation sections of FDA’s guidance on interoperable medical devices, every interface needs evidenced test results, scaled to its risk.
ELTON’s response (since January 2026): ELTON derives interface-specific test cases from the device’s digital twin, executes them at the deepest available tier, and records pass or fail with evidence for each mechanism, so the interface V&V the FDA asks for is produced, not summarized.
A postmarket vulnerability management plan, or a deficiency
The FDA increasingly asks not just what you tested, but how you will keep monitoring the product after it ships. A vulnerability management plan is required under Section 524B.
What the FDA writes
You provided cybersecurity documentation for the product, but you did not elaborate on how you intend to continuously monitor the product’s cybersecurity in the postmarket phase, nor did you provide a vulnerability management plan. A vulnerability management plan is required under Section 524B of the FD&C Act. As referenced in the premarket guidance under Total Product Lifecycle Management (TPLM), the manufacturer is expected to describe how vulnerabilities will be identified, assessed, and remediated across the device’s supported lifetime, including monitoring of the SBOM against newly disclosed vulnerabilities and periodic security testing. Please provide a vulnerability management plan and describe your continuous monitoring and disclosure processes.
What the reviewer is really after: evidence that the security program does not end at clearance. They want a named function, a cadence, and a paper trail that shows monitoring and remediation continuing through the device’s supported life.
The fix: establish a vulnerability management function that includes monitoring of the SBOM and annual penetration testing, per FDA guidance.
ELTON helps: ELTON operates that function as a managed service. It continuously monitors the device’s SBOM against new CVEs, re-analyzes exploitability on the current release twin, runs annual penetration testing, and produces the plan itself along with the ongoing evidence that it is being followed, mapped to scope and controls.
Evidence of testing across the whole product, not a subset
A pentest that covers only part of the device does not satisfy the Secure Product Development Framework. The FDA wants complete, historical evidence of how the product was tested and managed during development.
What the FDA writes
You provided a penetration testing report that contains a subset of findings. Please provide evidence of testing for all in-scope components and any historical testing performed during development, as well as how those vulnerabilities were managed.
The fix: the Agency requests that you provide all historical testing reports that substantiate comprehensive and complete testing during development.
ELTON helps: ELTON tests every in-scope component from the digital twin and retains the full history, each test case, result, and disposition across releases, so the complete and historical evidence the SPDF requires is already assembled and traceable, not reconstructed under a deadline.
Regular penetration testing, not a one-time report
A postmarket plan without recurring testing draws a deficiency. The FDA expects testing that keeps pace with the threat landscape.
What the FDA writes
You provided a postmarket vulnerability management plan that does not include regular penetration testing. Regular third-party penetration testing is recommended to keep pace with evolving threats and to identify new vulnerabilities, alongside validation of reported and SBOM-related issues.
The fix: the Agency requires regular penetration testing as part of a postmarket vulnerability management plan.
ELTON helps: ELTON runs penetration testing on every release and at least annually as part of the subscription, validating reported findings and SBOM-derived issues on the real device, so the recurring testing the FDA requires is continuous, not a scramble before the next submission.
The controls FDA expects you to prove
Beyond the ones above, a long list of documentation deficiencies recur. Each pairs an FDA request with what ELTON produces from the same digital twin.
Threat modeling
FDA asks: Your device is a cyber device under 524B(c) but you did not provide threat modeling. Provide a model assessing assets, threats, vulnerabilities, and controls, with a justified methodology (STRIDE, attack trees, kill chain), all end-to-end elements, and architecture or sequence diagrams.
ELTON: Builds a digital twin from SBOM, vulnerabilities, and architecture, then layers threat modeling on it, producing exploitable-path analysis, vulnerability chaining, and mitigations with traceability across assets and controls.
Authorization controls
FDA asks: You reference privilege levels but do not describe them or how permissions are granted and controlled. Define each role’s privileges and the authentication tied to each level.
ELTON: Testing identifies weaknesses in privilege boundaries and links findings back to roles and controls, creating traceable evidence of compliance.
Confidentiality controls
FDA asks: You reference TLS/SSH and asymmetric encryption but do not detail them or where they are implemented; some TLS/SSH versions are insecure. Describe the controls and justify the algorithms.
ELTON: Flags outdated cryptographic libraries and configurations, confirms implementation by testing, and ties results back to scope and confidentiality controls.
Integrity controls
FDA asks: You reference TLS, SSH, and checksums but do not describe how integrity is enforced; non-cryptographic checksums are not integrity controls. Describe and justify the integrity controls.
ELTON: Confirms whether integrity protection is cryptographic and effective, documenting findings linked directly to the integrity controls in scope.
Device hardening
FDA asks: USB and external ports are enabled but you did not describe default hardening. Remove default passwords, disable unused services, restrict interfaces, and provide hardening measures and testing.
ELTON: Tests exposed interfaces, default accounts, and unused functionality, linking results to system architecture and controls for FDA-ready traceability.
Event detection & incident response
FDA asks: Your device relies on networking but you did not provide detection, response, and recovery. Describe the incident response plan and provide testing of its effectiveness.
ELTON: Acts as a managed product security operations center: when a vulnerability hits a release, the manufacturer is alerted to act and notify affected customers, enabling detection, response, and recovery.
Antivirus & malware protection
FDA asks: Your OS supports antivirus and anti-malware. Detail the protections implemented, or justify why they are unnecessary.
ELTON: Highlights unsupported or unprotected OS components; test results confirm mitigation and link back to system-level controls.
Testing evidence and lifecycle traceability
The remaining deficiencies concern testing rigor, the SBOM, and the full device lifecycle. ELTON produces each as a traceable artifact.
Cybersecurity testing
FDA asks: Your testing documentation is inadequate: a summary rather than a full report. Provide tester independence and expertise, scope, duration, methods, and results, findings, and observations.
ELTON: Runs penetration testing, fuzzing, and static and dynamic analysis in both premarket and annual evaluations, documenting methodology, scope, and results, with each finding traceable to risks and controls.
Cybersecurity controls documentation
FDA asks: Your risk-to-control traceability table lacked control details. Provide documentation on the controls implemented.
ELTON: Substantiates controls by linking vulnerabilities and test results to control objectives, with test cases mapped, for full traceability.
End-of-life software components
FDA asks: Your SBOM lists components past their end-of-support date. Provide assurance of continued maintenance or upgrade to supported versions.
ELTON: Continuously monitors SBOM components against lifecycle data, flags end-of-life vulnerabilities, and shows risk impacts tied to scope.
Updateability & patchability
FDA asks: You marked updateability and patchability inapplicable with only a high-level justification. Provide a detailed justification or the views.
ELTON: Outputs patchability findings tied to vulnerabilities and controls, mapped to scope, to support the required documentation.
Expanded threat model detail
FDA asks: Your threat model did not identify device risks and mitigations, hostile-network assumptions, supply-chain or interoperability risks, or all end-to-end elements.
ELTON: Expands the twin’s outputs to include hostile assumptions, supply-chain risks, and interoperability findings, each mapped to scope and controls.
SBOM format
FDA asks: Your SBOM could not be opened or was not machine-readable. Provide CycloneDX consistent with the NTIA minimum elements.
ELTON: Ingests software and hardware materials into a living, validated CycloneDX SBOM, with findings traceable to SBOM entries, vulnerabilities, and scope.
Cybersecurity risk management report
FDA asks: Your report lacked a separate security risk assessment and outcomes from threat modeling, SBOM, vulnerability, and anomaly reviews, with no cross-document traceability.
ELTON: Integrates findings into a Cybersecurity FMEA, summarizing vulnerabilities, risks, and mitigations with full traceability to scope and controls.
Software description
FDA asks: You did not provide a comprehensive software or firmware description.
ELTON: Aligns SBOM-based findings with the software description, maintaining traceability back to testing and scope.
Software bug & patch
FDA asks: You identified a bug and proposed a patch but omitted documentation of the bug, patch, and regression testing.
ELTON: Captures remediation and regression evidence, new test results evidencing closure, linked to scope and controls.
Continued support
FDA asks: You did not detail how you will monitor and address vulnerabilities post-deployment, including end-of-life planning.
ELTON: Monitors SBOMs for new vulnerabilities and produces traceable outputs showing the evolving risk posture.
Coordinated vulnerability disclosure
FDA asks: You did not provide adequate CVD information or how users are notified of critical vulnerabilities.
ELTON: Outputs vulnerability findings traceable to disclosure workflows, so the FDA can see how risks are identified and communicated.
Patch release timelines
FDA asks: You did not provide patch release timelines, including for critical updates. Justify patch cycles and critical handling.
ELTON: Prioritizes vulnerabilities by exploitability and severity, linking findings to patchability controls to justify timelines.
Labeling
FDA asks: You did not provide cybersecurity labeling: interfaces, update instructions, antivirus requirements, incident-response guidance, SBOM information, and infrastructure dependencies.
ELTON: Automates the activities that inform customers of product impact, transitioning appropriate responsibilities from manufacturer to customer.
One service. One platform. Every deficiency.
Every deficiency traces back to the same root: legacy testing produces findings and advice, not evidence, and it stops at clearance. ELTON produces the evidence, and keeps producing it.
From a single digital twin, ELTON derives interface-by-interface test cases, executes them at the deepest available tier, generates prescriptive remediation down to the code fix, and layers the threat model, SBOM, and risk report on top, all with traceability from CVE to determination that FDA and EU reviewers can follow.
It runs as a continuous, managed program: the pentest, the test cases, the threat model, the SBOM, the remediation, and the annual and per-release testing that keep them current, so the deficiencies legacy testing leaves open never open in the first place.