FDA Section 524B Penetration Testing and Documentation Services for Medical Device

[oli]

A submission can begin to unravel with one simple reviewer question: what exactly did you test? Vulnerability tables and severity scores may appear complete, yet they can leave the product scope, attack paths, and remediation trail unclear. FDA guidance expects cybersecurity evidence to connect testing with identified risks, controls, and resulting findings. Submission duties under FDA Section 524B began on March 29, 2023.
FDA initially allowed a transition period under its Refuse to Accept policy, which expired on October 1, 2023. The current premarket cybersecurity guidance, issued on February 3, 2026, explains how manufacturers should connect threat models, risk assessments, software components, controls, and testing records.
For manufacturers, the harder task begins after the assessment. Your evidence must make every testing decision easy for reviewers to trace, understand, and evaluate.
Key Takeaways

• Penetration testing should be planned as part of the submission evidence process, not treated as a separate technical exercise completed at the end.
  
• The assessment scope should follow trust boundaries and attack paths across the entire medical device system, including supporting applications and infrastructure where relevant.
  
• Every report must identify the exact hardware, firmware and software build tested. Evidence from a different product version can weaken traceability during review.
  
• Technical severity alone does not define medical device risk. Findings must also be assessed for their effect on clinical workflows, essential performance and patient safety.
  

source: https://qualysec.com/fda-section-524b/