FDA Medical Device Cybersecurity in 2026: SBOMs, Threat Modeling and Submission Evidence

Overview

A medical device manufacturer may have a software bill of materials, a completed threat model, and penetration testing reports, yet still face difficult questions during FDA review. An SBOM that fails to reflect the device's actual software configuration, security controls without adequate testing evidence, or unresolved vulnerabilities lacking proper justification can leave significant gaps in a cybersecurity submission. Identifying these weaknesses late in submission preparation can create additional work, including further analysis, testing, remediation, and potential submission delays.

FDA's February 2026 final guidance, Cybersecurity in Medical Devices: Quality Management System Considerations and Content of Premarket Submissions, addresses cybersecurity risk management and the evidence recommended for premarket submissions. For applicable submissions involving devices that meet the statutory definition of a "cyber device," Section 524B of the Federal Food, Drug, and Cosmetic Act also establishes requirements involving software bills of materials, postmarket vulnerability management, and processes for maintaining cybersecurity and making updates and patches available. Manufacturers must understand how these statutory requirements differ from FDA's broader recommendations and how identified threats, software vulnerabilities, security controls, testing results, and risk conclusions should connect within the supporting documentation.

The challenge extends beyond preparing individual documents. A vulnerability in a third-party software component may require further evaluation to determine its impact on device safety and security. Penetration testing may reveal weaknesses that need remediation, additional testing, or documented justification. Changes to software, connectivity, cloud infrastructure, or external interfaces can also affect previously completed assessments. Manufacturers must be able to evaluate these findings, explain their decisions, and ensure that the supporting evidence remains consistent with the finished device.

This webinar will examine FDA's current medical device cybersecurity expectations and their practical application to premarket submissions. Participants will learn what to examine when reviewing SBOMs and threat models, how to assess the reasoning behind cybersecurity risk decisions, and how to evaluate whether vulnerability and penetration testing provide appropriate supporting evidence. The session will also address third-party software risks, unresolved security findings, postmarket vulnerability management, software updates, cybersecurity labeling, and the organization of supporting documentation in eSTAR.

Using examples involving connected medical devices, software vulnerabilities, cybersecurity testing, and submission documentation, the program will examine common weaknesses that can lead to FDA requests for additional information. Attendees will learn how to identify inconsistencies across cybersecurity records, evaluate supplier and testing-provider reports, and establish traceability between identified threats, implemented controls, and verification evidence. The session will provide practical approaches for addressing documentation gaps, supporting risk management decisions, and preparing a more complete and defensible cybersecurity submission.

Areas Covered During the Session

• FDA’s Current Cybersecurity Guidance and Section 524B Applicability
• Cybersecurity Evidence for New and Modified Medical Device Submissions
• Defining Device System Boundaries, Interfaces, and Security Architecture
• Developing and Reviewing Threat Models for Medical Device Systems
• Connecting Cybersecurity Risks, Patient Safety, and Security Controls
• Preparing and Reviewing Machine-Readable Software Bills of Materials
• Evaluating Third-Party Software, Dependencies, and Component Support
• Assessing Known Vulnerabilities and Supporting Risk Decisions
• Security Requirements, Vulnerability Testing, and Penetration Testing
• Reviewing Testing Scope, Independence, Findings, and Supporting Evidence
• Addressing Unresolved Vulnerabilities, Software Anomalies, and Remediation
• Tracing Identified Threats to Controls, Test Results, and Risk Conclusions
• Postmarket Monitoring, Coordinated Vulnerability Disclosure, and Patching Plans
• Cybersecurity Labeling, Secure Configuration, and User Communication
• Organizing eSTAR Documentation and Checking Submission Consistency

Why Should You Attend?

Before approving a cybersecurity testing proposal or accepting a completed report, you need to understand what the work will demonstrate and what it leaves unanswered. This webinar will help you evaluate testing scope, clarify expected deliverables, and identify questions to raise with software suppliers and testing providers before finalizing the supporting documentation.

You will gain practical insight into assessing the relevance of reported vulnerabilities, reviewing the rationale for unresolved findings, and determining where further analysis, testing, or remediation may be needed. Worked examples will help you distinguish a supported risk decision from a conclusion that still needs technical explanation or evidence.

The session will also help you bring greater structure to the final submission review. You will learn how to check whether the software inventory, threat model, security controls, and testing results support consistent conclusions, and how to communicate specific documentation gaps to the teams responsible for resolving them.

Who Will Benefit?

This webinar is designed for medical device professionals responsible for cybersecurity risk management, software security, technical documentation, and regulatory submissions. It is particularly relevant to those involved in preparing, reviewing, or approving cybersecurity evidence for FDA submissions, including:

• Regulatory Affairs Directors and Managers
• Regulatory Affairs Specialists
• Regulatory Submission Specialists
• Medical Device Cybersecurity Managers
• Product Security Managers and Engineers
• Medical Device Software Engineers
• Software Development Managers
• Software Quality Assurance Managers and Engineers
• Design Assurance Engineers
• Cybersecurity Risk Management Specialists
• Medical Device Risk Management Engineers
• Threat Modeling and Security Assessment Specialists
• Vulnerability Management Specialists
• Software Verification and Validation Engineers
• Penetration Testing and Security Testing Engineers
• Software Bill of Materials (SBOM) Specialists
• Medical Device Quality Assurance Managers
• Medical Device Systems Engineers