Plain-language guides to the cybersecurity expectations medical device manufacturers actually face, written by a team that has taken 1,000+ FDA submissions through review.
Section 524B, eSTAR, postmarket guidance, QMSR, and the metrics that follow you after clearance.
What the statute requires of cyber devices, premarket and postmarket, and how ELTON discharges the vulnerability testing and management portion.
The nine cybersecurity deliverables a cyber device submission carries, and why consistency across them decides the outcome.
What changed in the June 27, 2025 revision, and what stayed the same.
Where vulnerability testing and management sit inside the SPDF the FDA expects.
The metrics your Vulnerability Management Plan committed you to, and how to keep them defensible.
Interpreting the 2016 postmarket guidance: most SBOM findings do not require a patch, if you can evidence why.
What happens after the flag, and how to respond without losing your review clock.
What the quality system transition means for cybersecurity obligations.
Whether devices cleared before 2023 still carry monitoring and testing duties. They do.
Product regulation, entity regulation, and certificate renewal, each with its own clock.
Vulnerability handling and reporting duties, mapped to a continuous evidence model.
Articles 21 and 23 for health-sector entities, and the timelines they impose.
What MDCG expects on cybersecurity when legacy certificates come up for renewal.
Harmonization means the same evidence, asked for in different accents.
The rating is what reviewers argue with. Make it rules-based.
FDA recognized CVSSv4. What changes, and how to re-rate a portfolio defensibly.
Why rubric-based rating beats SME opinion in front of a reviewer.
From qualified methodology to living scores with rationale metadata.
Tell us which jurisdictions you sell into and we will show you the single evidence model that satisfies all of them.
One issue a month on AI, exploitability, and FDA cybersecurity review. No spam, unsubscribe anytime.
Three regions. The United States: FDA Section 524B, eSTAR, postmarket guidance, QMSR and the metrics that follow clearance. The European Union: the Cyber Resilience Act, NIS2 and MDR recertification. Global: IMDRF N60 and N73, Japan's adopted standards, and what NMPA registration expects under China's CSL.
No. Harmonization means the same evidence asked for in different accents. The IMDRF N60 and N73 guide sets out one evidence model reused across FDA, EU, Japan, Australia and the UK, so the underlying work is done once and presented in the form each regulator expects.
Yes. The legacy device guide answers it plainly: devices cleared before 2023 still carry monitoring and testing duties. A companion guide on the 2016 postmarket guidance explains that most SBOM findings do not require a patch, if you can evidence why, which is the part older programs usually cannot produce.
Product regulation, entity regulation and certificate renewal, each with its own clock. The Cyber Resilience Act guide covers vulnerability handling and reporting duties. The NIS2 guide covers Articles 21 and 23 for health sector entities and the timelines they impose. The MDR guide covers what MDCG expects on cybersecurity when legacy certificates come up for renewal.
With a rules based rubric rather than expert opinion, because the rating is what reviewers argue with. The scoring guides cover the CVSSv4 migration now that FDA has recognized CVSSv4, why the FDA qualified MDDT rubric holds up in front of a reviewer, and how to operationalize the MITRE rubric with rationale metadata.