What changed in 2026
The final guidance hardened expectations that were already implicit in the 2023 draft. Three things moved from "recommended" to "reviewers will reject without it":
- A Secure Product Development Framework (SPDF) that produces, not just claims, design controls for cybersecurity.
- A threat model with trust boundaries, entry points, and STRIDE-style threat scenarios that map back to mitigations in the architecture.
- A cybersecurity management plan that covers postmarket monitoring, coordinated disclosure, and patching for the full supported life of the device.
If you are working off a checklist from 2022, you are already behind.
The threat model is the load-bearing wall
When we help a MedTech team at Blue Goat Cyber, the threat model is where 80% of the submission risk lives. Not because reviewers grade it like a thesis — they grade it for consistency. Your global system view, your multi-patient harm view, your updateability/patchability view, and your interface views all need to tell the same story. If your threat model says the Bluetooth interface is in scope but your interface view does not show how it is hardened, that's a finding.
The pattern that works:
- Build the architecture views first. Get them right at the level a reviewer would draw on a whiteboard.
- Do STRIDE on each trust boundary in those views. Spoofing, Tampering, Repudiation, Information disclosure, Denial of service, Elevation of privilege — every boundary, every time.
- Tie each identified threat to a specific mitigation, and tie each mitigation back to a design control. No floating mitigations, no hand-waving.
Reviewers do not need you to enumerate every CVE. They need to see that you have a system for catching them.
SBOMs are not a list
The SBOM requirement is one of the most misunderstood pieces of the guidance. A flat CSV of components does not satisfy it. What FDA expects is closer to a living inventory:
- Every component with a name, version, and supplier.
- A documented method for monitoring vulnerabilities against that inventory (NVD plus paid feeds, typically).
- A documented response process when a known vulnerability is found in a component you are shipping.
- Evidence that the SBOM is regenerated when the build changes.
The SBOM is not a deliverable. It is the input to your postmarket vulnerability management program. Reviewers want to see both ends of that pipe.
SPDF: design controls that produce security, not paperwork
The Secure Product Development Framework is the bridge between your QMS and your cybersecurity claims. If your design control records do not contain cybersecurity activities — design inputs, design outputs, verifications, validations — your submission is asking the reviewer to believe security was bolted on. It almost always was. The fix is not to fake it. The fix is to integrate cybersecurity into the design history file from the first input forward.
The submission gets dramatically simpler when the artifacts already exist because the development process created them.
The cybersecurity management plan is the postmarket promise
This is the document where companies most often get caught making commitments they cannot keep. The CMP says you will monitor, triage, fix, communicate, and patch over the supported life of the device. Reviewers read it carefully because it sets expectations FDA can later enforce.
Make it real, not aspirational. Name the team. Name the cadence. Name the channels for coordinated disclosure. Name the SLA tiers for severity classes. If you cannot operationalize what you wrote, edit what you wrote.
Labeling is for the clinician, not the security engineer
The security section of your labeling has to translate your model into something a hospital network admin and a clinical user can act on. Network requirements, default credentials handling, update mechanisms, end-of-life dates, and incident contact paths — written in plain English. This is where the difference between a usable device and a shelved one shows up after deployment.
What this looks like done right
The submissions that clear cyber on the first pass share three things:
- One coherent story across architecture views, threat model, SBOM, testing, and labeling. No internal contradictions.
- A lifecycle posture, not a snapshot. The CMP, the SBOM monitoring, and the patch program are real.
- An owner. There is a named person inside the company whose performance is measured on cybersecurity quality, not a contractor whose memo lives in a folder.
Get those three right and FDA's guidance stops feeling like a wall and starts feeling like what it actually is — a structured way to ship safe, connected devices.