FDA Cybersecurity Guidance: What Changed in 2026 and What Is Law

The current FDA premarket cybersecurity guidance for medical devices was issued February 3, 2026. It runs 64 pages and replaces June 2025. About 3% of the 2026 wording was flagged as new or changed by The PenTest Index's comparison in October 2026. Most flagged words concern FDA's new quality rule. Here's what moved, and what's law.

Full comparison · Download the CSV tables

Key FDA cybersecurity guidance statistics

1. About 3% of the wording in FDA's February 3, 2026 premarket cybersecurity guidance is flagged as new or changed from June 27, 2025: 780 of 25,498 words (3.1%). All 16 comparison runs landed between 2.8% and 4.0% (The PenTest Index comparison, October 2026). Our finding.
2. About 7 in 10 of the words flagged as new or changed in FDA's February 2026 guidance are in passages about its new quality rule: 539 of 780 words (69%). Mentions of "QMSR" went from 0 to 29, and "ISO 13485" from 1 to 28 since June 2025 (The PenTest Index comparison, October 2026). Our finding.
3. All 4 kinds of security testing FDA names, and all 5 listed penetration-test report elements, appear as the same list in both the June 2025 and February 2026 editions, with one standard reference reworded (The PenTest Index comparison of Section V.C, October 2026). Our finding.
4. February 3, 2026: FDA issued the current premarket cybersecurity guidance, "Cybersecurity in Medical Devices: Quality Management System Considerations and Content of Premarket Submissions." It is 64 pages (FDA, checked October 8, 2026).
5. 3 final editions in 860 days: FDA issued final premarket cybersecurity guidance on September 27, 2023, June 27, 2025 and February 3, 2026. The edition before them stood for 3,282 days (The PenTest Index count from FDA covers, checked October 8, 2026). Our finding.
6. 9 pages to 64: FDA's premarket cybersecurity guidance grew to about 7 times as many pages between its first final edition (October 2, 2014) and February 3, 2026 (The PenTest Index page counts, checked October 8, 2026). Our finding.
7. 3 named duties are law: For covered cyber-device submissions from March 29, 2023, section 524B requires a postmarket vulnerability plan, secure processes with updates and patches, and a software bill of materials. This covers the five submission pathways listed below (21 U.S.C. 360n-2).
8. "Should" 175 times: FDA's 2026 cybersecurity guidance uses "should" 175 times (The PenTest Index count, checked October 8, 2026). FDA says "should" in its guidance "means that something is suggested or recommended, but not required" (FDA guidance, Section I).
9. 14 lines: FDA's February 2026 summary table has 6 top-level entries and 8 nested entries, the same 14 lines as in September 2023 and June 2025 (FDA guidance, Appendix 4).
10. "(e.g., annually)": FDA says cybersecurity testing after a device's release "should be performed at regular intervals commensurate with the risk (e.g., annually)" (FDA guidance, Section V.C).
11. 16 recall events: FDA's enforcement database lists 16 medical device recall events, covering 59 product records, whose stated reason uses the word "cybersecurity," from February 2019 to June 2026. Two are Class I, and both began in 2025 (The PenTest Index count from openFDA, data updated September 30, 2026). Our finding.
12. 18 safety-list entries: FDA's cybersecurity safety communications and alerts table has 18 entries dated June 13, 2013 to January 30, 2025. For those, FDA says it "is not aware of any patient injuries or deaths associated with cybersecurity incidents" (FDA Cybersecurity page, checked October 8, 2026).
13. 30 and 60 days: FDA's postmarket cybersecurity guidance, dated December 28, 2016, calls for action as soon as possible, with 30 days for communication and planning and 60 days for a validated, deployable fix, as two of four conditions for not enforcing Part 806 reporting. Both clocks start when the maker learns of the vulnerability; they are not general patch deadlines (FDA postmarket guidance, Section VII.B).
14. 0 mentions: VEX, CycloneDX, SPDX, PCCP, STRIDE and eSTAR each appear zero times in FDA's February 2026 cybersecurity guidance (The PenTest Index text search, October 2026). Our finding.

Which FDA cybersecurity guidance is current?

The two core FDA references here are the premarket and postmarket cybersecurity guidances. The premarket one, issued February 3, 2026, is 64 pages and covers what to send FDA in a premarket submission. The postmarket one, issued December 28, 2016, covers devices already on the market.

A "guidance" is FDA's written advice. It explains how FDA reads the law, but it is not the law itself. More on that below.

One snag: when we checked on October 8, 2026, FDA's main Cybersecurity page (last updated July 6, 2026) still listed the June 27, 2025 edition. The PDF's own cover says "Document issued on February 3, 2026." Trust the cover.

Which source answers which question

Source: The PenTest Index, links checked October 8, 2026.

Source: The PenTest Index, links checked October 8, 2026.

FDA device cybersecurity guidance tracker, 2005–2026

This tracker covers 12 FDA device cybersecurity guidance documents and drafts from 2005–2026: 7 final and 5 drafts. Four of the finals are editions of the same premarket guidance. The current premarket edition and the 2016 postmarket guidance are the two core references used on this page.

The PenTest Index FDA Cybersecurity Guidance Tracker

Source: The PenTest Index, from FDA PDF covers, page counts and Federal Register notices (fda.gov, the HHS guidance portal, and Internet Archive copies of fda.gov files). Checked October 8, 2026. Row 2's date is verified from the 2014 final cover and official notice; its draft PDF was not retrieved. Row 8's PDF cover says March 30, 2023, while FDA's announcement is dated March 29; both dates are in the dataset. The 2016 postmarket PDF's first page is a notice FDA added later about the quality rule; the guidance text itself was not reissued. Full links in the dataset.

Source: The PenTest Index, from FDA PDF covers, page counts and Federal Register notices (fda.gov, the HHS guidance portal, and Internet Archive copies of fda.gov files). Checked October 8, 2026. Row 2's date is verified from the 2014 final cover and official notice; its draft PDF was not retrieved. Row 8's PDF cover says March 30, 2023, while FDA's announcement is dated March 29; both dates are in the dataset. The 2016 postmarket PDF's first page is a notice FDA added later about the quality rule; the guidance text itself was not reissued. Full links in the dataset.

Find the edition that was current on a date

Writing about a 2024 submission? An FDA letter from last summer? Type a date and see which final premarket edition was the current one that day. Dates through October 8, 2026 have been checked.

FDA Premarket Cybersecurity Guidance Edition Finder

Enter a date to see which final edition was current on that date.

Date

Verified through October 8, 2026. Your date is checked in this page's memory only; it is not stored, added to the URL, or sent in an analytics event or session recording.

That date has not been checked. The latest verified edition is February 3, 2026, checked October 8, 2026.

• February 3, 2026 edition PDF
• FDA's Cybersecurity page

What changed in the February 2026 FDA cybersecurity guidance?

About 3% of the wording in the February 3, 2026 edition is flagged as new or changed from the June 27, 2025 edition, by The PenTest Index's comparison: 780 of 25,498 words (3.1%). Most flagged words are in passages about the new quality rule. The page count, the seven main sections and FDA's 14-line document table stay the same.

Picture a 64-page guide that keeps most of its wording but updates many references to a changed quality rule. It also adds four glossary terms and keeps the same testing lists. That's the pattern here. A small share of changed wording does not tell you how much work a device needs.

FDA's history table describes the purpose of the revision: "Revisions issued under Level 2 guidance procedures (21 CFR 10.115(g)(4)), including revisions to align with the amendments to 21 CFR 820 (the Quality Management System Regulation (QMSR))." Level 2 covers existing practices or minor policy changes under FDA's guidance rule. FDA does not state our 3% figure; it comes from our text comparison.

The last three final editions, measured

Source: The PenTest Index counts from the text of each FDA PDF (2023, 2025, 2026). Checked October 8, 2026. These are exact counts under the published extraction method; other methods can give different counts.

Source: The PenTest Index counts from the text of each FDA PDF (2023, 2025, 2026). Checked October 8, 2026. These are exact counts under the published extraction method; other methods can give different counts.

What the new wording is about

We sorted every passage flagged as new or changed by its main topic. About 7 in 10 of the flagged words are in passages about the new quality rule. Glossary terms, definitions and source notes are the next biggest piece; these include the four new terms.

Source: The PenTest Index topic sort of all 115 unmatched passages in the central 2026 vs 2025 comparison (PyMuPDF text, 6-word runs, reusable matches: 780 of 25,498 words, or 3.1%). Each whole passage is assigned to its main topic, so the counts can include nearby unchanged words. The 115 passages and their page numbers are in the download. Checked October 8, 2026.

Source: The PenTest Index topic sort of all 115 unmatched passages in the central 2026 vs 2025 comparison (PyMuPDF text, 6-word runs, reusable matches: 780 of 25,498 words, or 3.1%). Each whole passage is assigned to its main topic, so the counts can include nearby unchanged words. The 115 passages and their page numbers are in the download. Checked October 8, 2026.

The "new quality rule" is FDA's Quality Management System Regulation, or QMSR. It took effect February 2, 2026, the day before the new guidance came out. It rewrote FDA's old device quality rule (21 CFR Part 820) to pull in an international standard, ISO 13485:2016, by reference (FDA).

The exact changes in the testing section

Here are the selected reference and wording changes in Section V.C, the part about security testing. The title change is shown for context. The other rows cover Section V.C. These selected edits do not add a named testing category.

Source: The PenTest Index line-by-line comparison of Section V.C in the June 2025 and February 2026 editions. Checked October 8, 2026.

Source: The PenTest Index line-by-line comparison of Section V.C in the June 2025 and February 2026 editions. Checked October 8, 2026.

The dropped sentence doesn't mean software validation stopped mattering. The 2026 text points to Subclause 7.3.7 and says design and development validation "includes validation of device software" in another section.

What changed in June 2025

The June 27, 2025 edition was the big one. It added Section VII, "Cyber Devices," which ties the guidance to the law that took effect in 2023. The document grew from 57 to 64 pages and about 15% in words. The comparison flagged 3,635 words, or 14.3%, as new or changed. Mentions of "524B" jumped from 14 to 74.

What has stayed the same since 2023

FDA's document table lists the same 14 lines in the September 2023, June 2025 and February 2026 editions. "SBOM" and "SBOMs" appear 34 times in total in both 2025 and 2026, and "penetration" 3 times in all three. Those lists are stable. They do not, on their own, show whether a submission meets the current recommendations and legal duties.

Is FDA cybersecurity guidance mandatory?

The guidance itself is not law. Its pages carry the banner "Contains Nonbinding Recommendations," and it uses "should" 175 times. But section 524B of the Federal Food, Drug, and Cosmetic Act (FD&C Act) is law. For covered cyber-device submissions from March 29, 2023, it requires three named duties: a plan to find and fix security holes after sale, secure processes with updates and patches, and a software bill of materials. The covered pathways are 510(k), De Novo, PMA, PDP and HDE, including relevant supplements.

The guidance gives advice; the laws and rules it cites still apply. Think of it like a driving manual and the traffic code. The manual gives advice on how to drive well. The code is what gets you a ticket. FDA's guidance is the manual, and it tells you which parts of the code it is explaining.

FDA spells it out: "The use of the word should in Agency guidance means that something is suggested or recommended, but not required." You can use another approach if it meets the law and the rules.

What is law, and what is advice

Source: 21 U.S.C. 360n-2; FDA guidance, Feb 3, 2026; FDA QMSR page. Checked October 8, 2026.

Source: 21 U.S.C. 360n-2; FDA guidance, Feb 3, 2026; FDA QMSR page. Checked October 8, 2026.

What is a "cyber device"?

A cyber device meets all three tests at once: sponsor-validated, installed or authorized software; the ability to connect to the internet; and sponsor-validated, installed or authorized features that could be open to cyber threats. The sponsor is the person or company making the FDA submission.

Source: Section 524B(c), 21 U.S.C. 360n-2(c). Checked October 8, 2026.

Source: Section 524B(c), 21 U.S.C. 360n-2(c). Checked October 8, 2026.

FDA reads test 2 broadly. Wi-Fi, cellular, Bluetooth, network and cloud links, magnetic links to implants, and ports like USB, ethernet or serial can all count. One footnote says a device serviced through a USB connection "is therefore considered to have the ability to connect to the internet," even if the link is brief (Section VII.B, footnote 61).

The guidance reaches beyond section 524B's cyber-device scope. It covers devices "with cybersecurity considerations," including ones that are not network-enabled at all.

Which date is the deadline?

Not every date in this story is a deadline. Here is what each one means.

Source: 21 U.S.C. 360n-2 and notes; FDA Cybersecurity FAQs, Q3 and Q5; FDA QMSR page; FDA guidance cover. Checked October 8, 2026.

Source: 21 U.S.C. 360n-2 and notes; FDA Cybersecurity FAQs, Q3 and Q5; FDA QMSR page; FDA guidance cover. Checked October 8, 2026.

What happens if the cybersecurity information is missing?

FDA's temporary refuse-to-accept policy ended October 1, 2023, 186 days after the law took effect. During that policy, FDA generally did not intend to refuse a covered submission based solely on section 524B information; the law still applied. Since then, FDA says, "An eSTAR submission will be put on a Technical Screening hold if it does not contain accurate responses and relevant attachments in the Cybersecurity section of eSTAR." (eSTAR is FDA's electronic submission template.)

Does section 524B reach devices already on the market?

Section 524B does not apply to a submission sent before March 29, 2023, FDA says. But if a maker changes an older cyber device in a way that needs a new FDA review, "the law applies to the new premarket submission" (FDA FAQ, Q3). Other FDA duties can still apply to older devices.

What does FDA want in a premarket cybersecurity submission?

FDA's Table 1 has 14 lines: six top-level entries and eight nested entries. They are a risk management report with six parts, measures and metrics, architecture views with two parts, testing, labeling, and cybersecurity management plans. Two entries directly match documents named in section 524B: the SBOM and the postmarket vulnerability plan. Other entries can support the broader duty to provide reasonable assurance of cybersecurity. This is not a list of 14 separate statutory documents.

FDA's Table 1: recommended cybersecurity documents (Appendix 4)

Source: FDA guidance, Feb 3, 2026, Appendix 4, printed pages 51–53. Same 14 lines in the 2023 and 2025 editions. Blank cells mean the document is not named separately in section 524B; they do not mean no legal duty applies. The dataset shows the six top-level and eight nested entries. Checked October 8, 2026.

Source: FDA guidance, Feb 3, 2026, Appendix 4, printed pages 51–53. Same 14 lines in the 2023 and 2025 editions. Blank cells mean the document is not named separately in section 524B; they do not mean no legal duty applies. The dataset shows the six top-level and eight nested entries. Checked October 8, 2026.

FDA adds a warning right next to the table: "This table is not intended to serve as merely a deliverable checklist." In plain words, the documents should come out of real work, not be written to fill boxes.

The SBOM

An SBOM, or software bill of materials, is an ingredient list for software: every software part inside a device. Section 524B requires one for covered cyber-device submissions. FDA asks for it to be machine-readable and to follow the minimum elements set by NTIA (the National Telecommunications and Information Administration) in October 2021. For each part, FDA also wants its support level and its end-of-support date.

The guidance names no file format. It says only, "Industry-accepted formats of SBOMs are encouraged."

The threat model and the four architecture views

A threat model is a map of how someone could attack the device. FDA asks for four types of "architecture views" that show it from different angles: the global system view, the multi-patient harm view, the updatability and patchability view, and security use case views. A type may need more than one view. FDA allows views to be combined, or an explanation when a type does not fit the system.

The eight security control categories (Appendix 1)

Appendix 1 lists eight groups of security controls FDA recommends: authentication, authorization, cryptography, code/data/execution integrity, confidentiality, event detection and logging, resiliency and recovery, and firmware and software updates. FDA says the controls should be built into the design and chosen for the device's risks. Comparable controls can be used with supporting evidence.

Which submissions it covers

For devices with cybersecurity considerations, the guidance lists 8 submission types sent to FDA's device or biologics centers: the Center for Devices and Radiological Health (CDRH) or the Center for Biologics Evaluation and Research (CBER). Section 524B's cyber-device duties attach to 5 pathways: 510(k), De Novo, PMA, PDP and HDE, including relevant supplements.

The eight types are Premarket Notification (510(k)); De Novo requests; Premarket Approval Applications (PMA, including supplements); Product Development Protocols (PDP); Investigational Device Exemption (IDE); Humanitarian Device Exemption (HDE); Biologics License Application (BLA); and Investigational New Drug (IND). The guidance's recommendations can also apply to devices that do not need a premarket submission.

A 510(k) shows that a device is substantially equivalent to a legally marketed device: as safe and effective, with the same intended use. The source explains the tests for different technology. These pathway names come from Section II of the guidance.

Does FDA require penetration testing for medical devices?

FDA recommends it, and section 524B does not name it. The February 2026 guidance lists penetration testing as one of four kinds of security testing and says "Penetration test reports should be provided." The word "penetration" appears three times in the 64 pages.

A penetration test is an authorized, planned attempt to find and use security weaknesses. Testers try to break in the way a real attacker would, then write up what they found.

FDA's whole bullet on penetration testing is 55 words long. Short, but specific about what the report should hold.

The four kinds of security testing FDA names

Source: FDA guidance, Feb 3, 2026, Section V.C and the June 27, 2025 edition. Checked October 8, 2026.

Source: FDA guidance, Feb 3, 2026, Section V.C and the June 27, 2025 edition. Checked October 8, 2026.

The six kinds of vulnerability testing FDA lists are: abuse or misuse cases and malformed inputs (including robustness and fuzz testing); attack surface analysis; vulnerability chaining; closed box testing of known vulnerability scanning; software composition analysis of binary executable files; and static and dynamic code analysis, including tests for credentials that are hardcoded, default, easily guessed or easily compromised.

A vulnerability scan and a penetration test are different things here. A scan checks for known holes. A penetration test tries to use them.

What a penetration test report should include

Source: FDA guidance, Feb 3, 2026, Section V.C and the June 27, 2025 edition. Checked October 8, 2026.

Source: FDA guidance, Feb 3, 2026, Section V.C and the June 27, 2025 edition. Checked October 8, 2026.

FDA also recommends the manufacturer's assessment of the findings, including reasons for leaving a finding unresolved or putting a fix into a later release. If a fix is deferred because the current risk is considered acceptable, the submission should describe the planned release, its timing, which devices will get the update, and how long delivery will take.

These are five things inside one report, not five separate tests. If you are comparing offers, they make a handy yardstick. The site's web application and API provider comparison shows how firms describe scope, reports and retests; it does not list medical-device testing matches.

Who can do the testing, and how often

The guidance does not say an outside firm must do the work. It asks makers to say "by whom the testing was performed (e.g., independent internal testers, external testers)" and how independent they are from the people who built the device. It adds: "In some cases, it may be necessary to use third parties to ensure an appropriate level of independence." If a third party did test, FDA wants the original report.

On timing, FDA says testing should run through development, and after release "at regular intervals commensurate with the risk (e.g., annually)." Annual is FDA's example, not a fixed rule. These lines cover all security testing, not only penetration tests.

FDA's Cybersecurity page also lists a June 29, 2026 white paper from MDIC, the Medical Device Innovation Consortium, on penetration testing best practices.

No test report, from any tester, guarantees that FDA will accept a submission.

If an FDA submission is why you are buying a test, the free Find My PenTest Match checklist can help you write down the scope of the test and the questions your report reader will ask. It is a general scoping aid and asks for no contact details.

How long is FDA's cybersecurity guidance, and how fast has it grown?

FDA's premarket cybersecurity guidance was 9 pages when it was first finalized on October 2, 2014. The current edition is 64 pages, about 7 times as many pages. The 2014 edition listed 5 documentation items; today's table has 14 lines, including headings and nested entries. Those two counts use different structures.

The pace picked up, too. The 2014 edition stood for 3,282 days, about nine years. Then FDA issued three final editions in 860 days.

A longer document isn't automatically a stricter one. The longer document includes explanation, examples and a glossary.

What do FDA's 30-day and 60-day figures mean?

These figures come from FDA's 2016 postmarket guidance. For specified vulnerabilities with uncontrolled risk, FDA says it does not intend to enforce Part 806 reporting when all four conditions are met. Action must be taken as soon as possible: communication and planning no later than 30 days after learning of the vulnerability, and a validated, deployable fix no later than 60 days.

The four conditions, summarized

Source: FDA, Postmarket Management of Cybersecurity in Medical Devices, Dec 28, 2016, Section VII.B, printed pages 22–23. Checked October 8, 2026.

Source: FDA, Postmarket Management of Cybersecurity in Medical Devices, Dec 28, 2016, Section VII.B, printed pages 22–23. Checked October 8, 2026.

Interim controls are steps that reduce risk while a fix is being prepared. FDA also calls for a reason for the timeline, a customer notice explaining the risk and planned response, and controls that do not create a greater safety risk. A compensating control can sometimes be a long-term solution if the remaining risk is acceptable. Follow-up with users may continue beyond 60 days. The four-condition dataset preserves these details.

Section 524B sets no fixed number of days for those patches. It says "as soon as possible out of cycle" for critical vulnerabilities that could cause uncontrolled risks.

How many medical devices have been recalled for cybersecurity?

FDA's enforcement database lists 16 device recall events, covering 59 product records, whose stated reason uses the word "cybersecurity." The first began February 8, 2019, and the latest June 9, 2026. Two are Class I, the class FDA uses when there is a reasonable chance of serious harm or death, and both began in 2025.

There's no steady climb here. Counts in this result bounce from 0 to 4 a year. This is a keyword-defined subset: a recall that describes a security flaw in other words, like "unauthorized access," doesn't show up in a search for "cybersecurity." The 2026 count is a partial-year snapshot.

Device recall events whose reason cites "cybersecurity"

Source: The PenTest Index, from openFDA device enforcement reports, records grouped by recall event; data updated September 30, 2026; checked October 8, 2026. openFDA says to "assume all results are unvalidated." Class I definition: FDA.

Source: The PenTest Index, from openFDA device enforcement reports, records grouped by recall event; data updated September 30, 2026; checked October 8, 2026. openFDA says to "assume all results are unvalidated." Class I definition: FDA.

Note the Baxter line. The flaw behind one of the two Class I events in this keyword result was found through internal testing. The source does not identify that testing as a penetration test.

FDA's cybersecurity safety communications

FDA's cybersecurity safety communications and alerts table contains 18 entries, dated June 13, 2013 to January 30, 2025. FDA says that for these, it "is not aware of any patient injuries or deaths associated with cybersecurity incidents." By year: 2013: 1 · 2015: 1 · 2017: 2 · 2018: 2 · 2019: 3 · 2020: 2 · 2021: 3 · 2022: 3 · 2025: 1.

Which terms are not in FDA's cybersecurity guidance?

Some advice about FDA submissions uses words the guidance itself never uses. VEX, CycloneDX, SPDX, PCCP, STRIDE, "attack tree," AAMI TIR97, eSTAR, "zero trust" and "refuse to accept" each appear zero times in the February 2026 text.

That doesn't make the advice wrong. Those can be good practice, and some come from other FDA pages (eSTAR is covered on FDA's FAQ page). It means those exact terms do not appear in this document; a related idea may use other words. If a vendor tells you "the FDA guidance requires CycloneDX," you now know to ask where.

Source: The PenTest Index text search of the February 3, 2026 guidance. Checked October 8, 2026.

Source: The PenTest Index text search of the February 3, 2026 guidance. Checked October 8, 2026.

Why does this matter now?

• The quality rule changed on February 2, 2026, and FDA reissued its cybersecurity guidance the next day. Files that cite "21 CFR 820.30" now point to a rule that has been rewritten.
• FDA's own main cybersecurity page still listed the June 2025 edition when we checked on October 8, 2026. The old label can make the current edition hard to spot.
• FDA has issued three final editions in 860 days, and Congress told FDA to review the guidance "periodically thereafter as appropriate." This tracker will log later editions as they are checked.
• Both Class I events in this keyword result began in 2025.

How we built this

We tracked 12 FDA device cybersecurity guidance documents and drafts from FDA's site, the HHS guidance portal and Internet Archive copies of FDA's files. We retrieved 11 PDFs, read their covers and counted their pages. For the 2013 draft, we verified the issue date from the 2014 final cover and official notice; its draft PDF was not retrieved. All checks were made October 8, 2026, in America/Denver (October 9 in UTC).

The edition comparison. We turned each PDF into plain text, removed repeated page banners, and left out number-only tokens. A token is a word-shaped piece of text; the full counting rule is in the notes supplied with the download. The count includes the cover, contents, headings, footnotes, glossary and guidance history.

A word counts as "carried over" if it sits inside an exact run of words that appears anywhere in the earlier edition. Words not covered by a matching run are flagged as "new or changed." This is a text-comparison measure, not a legal redline. It can count a nearby unchanged word as part of a changed passage, miss a numbers-only edit, or match wording that moved.

We tried runs of 5, 6, 8 and 10 words, counted two ways: an earlier phrase may match repeatedly, or each earlier phrase occurrence may be used once. The latter still allows overlapping phrases; it is not a one-to-one word match. We read the PDFs with two tools, PyMuPDF 1.26.6 and Poppler 24.02.0. That gives 16 runs for each comparison. The central figure uses PyMuPDF, six-word runs and reusable matches.

Source: The PenTest Index comparison of the three FDA PDFs listed below. Checked October 8, 2026.

Source: The PenTest Index comparison of the three FDA PDFs listed below. Checked October 8, 2026.

The two text reads differ because PDF text isn't clean. Footnote numbers can stick to words, and table cells can come out in different orders. The range shows how the result changes with the reading and matching rules. It is not a margin of error or an estimate of the share of rules that changed.

The topic sort uses the same 780-word central result as the headline. We assigned each of its 115 unmatched passages to its main topic and checked the quality-rule passages against the PDFs. Counts include the whole passage, including nearby unchanged words. The download gives each passage, its page number, its category and the words on either side. The math is 539 + 138 + 33 + 70 = 780; each share divides that category's words by 780.

Term counts use separate searches that keep numbers. Searches are case-insensitive except for named acronyms; the dataset gives the exact pattern, case rule and page locations for each term. Counts include the whole PDF. We checked the visible 2026 footnote 41: it says "might not be available," not "must." The correct whole-word "must" count is 19. The glossary count uses definition headings in Appendix 5.

Recalls come from the complete response to this openFDA device-enforcement query. We counted 59 distinct recall numbers and grouped them by 16 distinct event IDs. We then queried each event ID without the keyword; every full-event count matched its count in the keyword result. Years use the date the recall began, not the report date or recall-number suffix. We did not add product quantities, which have different units. openFDA data was last updated September 30, 2026. Status values are kept as listed; FDA says it does not update recall status after publication in these reports.

The safety list is the 18 entries in the named table on FDA's cybersecurity page, not a census of every FDA safety notice. The MDIC resource title and displayed date were checked on its landing page; the full paper requires a form and was not used as evidence for any finding here.

The downloads contain all 32 comparison runs, all 115 unmatched passages and a source-file manifest. The full package also includes the exact PDFs and normalized text used for the comparison. The notes give the counting recipe so someone can repeat it. For the site's general source and check-date approach, see How The PenTest Index works.

What this data does and doesn't show

• It measures wording, not workload. A 3% change could still matter for your file if one of those changes touches your device.
• These are exact counts under the published extraction method; other methods can give different counts.
• The recall count is a keyword-defined subset. It finds only recall reasons that use "cybersecurity." It does not count all vulnerabilities, attacks, affected devices, patients or injuries.
• Page counts don't measure strictness.
• We compared FDA's documents. We did not test any device, and we don't know how FDA reviewers apply the guidance case by case.
• This page is not legal or regulatory advice.

How to cite this page

Cite The PenTest Index for the comparison and counts, and FDA for the guidance itself.

The PenTest Index. "FDA Cybersecurity Guidance: What Changed in 2026 and What Is Law." Updated October 2026. https://thepentestindex.com/research/fda-cybersecurity-guidance/

Each key statistic and table has its own anchor, such as #stat-1, #table-edition-comparison or #recalls, so a citation can identify the exact finding.

You may reuse our original analysis, table arrangements and charts with credit to The PenTest Index. Underlying FDA documents and openFDA data keep their source attribution and terms (openFDA terms).

Download the data

All 17 table files below are free CSVs, with no sign-up. Every row carries its source and the date we checked it. Download the full package for the tables, charts and comparison source files.

Source: The PenTest Index. Every row carries its source and the date we checked it.

Frequently asked questions

What is FDA's cybersecurity guidance for medical devices in 2026?

The current premarket guidance is "Cybersecurity in Medical Devices: Quality Management System Considerations and Content of Premarket Submissions," issued February 3, 2026. It is 64 pages. A second guidance, from December 28, 2016, covers devices already on the market.

Is the June 2025 FDA cybersecurity guidance still valid?

No. The February 3, 2026 edition says it supersedes the June 27, 2025 edition. Our comparison flags about 3% of the 2026 wording as new or changed, mostly in passages about FDA's new quality rule. Use the current edition; wording overlap does not establish that a submission is ready.

What are FDA's new rules for 2026?

The Quality Management System Regulation took effect February 2, 2026. It rewrote FDA's device quality rule, 21 CFR Part 820, to pull in ISO 13485:2016. FDA reissued its cybersecurity guidance the next day.

What happened to 21 CFR 820.30?

It was the design controls section of FDA's old quality rule. In the testing section, the June 2025 guidance cited 21 CFR 820.30(f) and (g). The February 2026 edition cites ISO 13485 Subclauses 7.3.6 and 7.3.7 instead.

Is FDA cybersecurity guidance mandatory?

The guidance is not. It is marked "Contains Nonbinding Recommendations." Section 524B of the FD&C Act is law and has applied to covered cyber-device submissions since March 29, 2023: 510(k), De Novo, PMA, PDP and HDE, including relevant supplements.

Does FDA require a penetration test?

FDA recommends penetration testing as one of four kinds of security testing and says "Penetration test reports should be provided." Section 524B does not name penetration testing.

What should an FDA penetration test report include?

Five listed elements: the independence and technical expertise of the testers, the scope, the duration, the methods, and the results, findings and observations. The same five were in the June 2025 edition. FDA also recommends the manufacturer's assessment and plans for findings left unresolved or deferred to later releases.

Does FDA require an outside firm to do the testing?

Not in every case. The guidance asks who did the testing and how independent they were, and says third parties may be necessary "in some cases."

What is a cyber device?

A device with software validated, installed or authorized by its sponsor, the ability to connect to the internet, and sponsor-validated, installed or authorized features that could be open to cyber threats. All three must be true.

What SBOM format does FDA require?

The guidance names none. It asks for a machine-readable SBOM that follows NTIA's minimum elements and says "Industry-accepted formats of SBOMs are encouraged."

How fast must a maker patch a vulnerability?

Section 524B gives no fixed number of days for those patches. It says "as soon as possible out of cycle" for critical vulnerabilities that could cause uncontrolled risks. FDA's 2016 postmarket guidance calls for action as soon as possible, with 30 days for communication and planning and 60 days for a validated, deployable fix, as two of four conditions for not enforcing Part 806 reporting. Both clocks start when the maker learns of the vulnerability.

What is in Appendix 1?

Eight categories of security controls: authentication, authorization, cryptography, code/data/execution integrity, confidentiality, event detection and logging, resiliency and recovery, and firmware and software updates.

Where is the FDA cybersecurity guidance PDF?

On FDA's site at fda.gov/media/119933/download. The cover should read "Document issued on February 3, 2026."

Sources

1. FDA. Cybersecurity in Medical Devices: Quality Management System Considerations and Content of Premarket Submissions (PDF). Issued February 3, 2026. Checked October 8, 2026.

2. FDA. Same document on the HHS guidance portal (PDF). Checked October 8, 2026.

3. FDA. June 27, 2025 edition, HHS guidance portal (PDF). Checked October 8, 2026.

4. FDA. September 27, 2023 edition, Internet Archive copy of fda.gov (PDF). Checked October 8, 2026.

5. FDA. Guidance page for the current edition. Checked October 8, 2026.

6. FDA. Cybersecurity (Digital Health Center of Excellence). Content current as of July 6, 2026. Checked October 8, 2026.

7. FDA. Cybersecurity in Medical Devices Frequently Asked Questions. Checked October 8, 2026.

8. U.S. Code. 21 U.S.C. 360n-2, Ensuring cybersecurity of devices (GovInfo). Checked October 8, 2026.

9. FDA. Postmarket Management of Cybersecurity in Medical Devices (PDF). Issued December 28, 2016. Checked October 8, 2026.

10. FDA. Quality Management System Regulation (QMSR). Checked October 8, 2026.

11. Federal Register. Notices of availability: 2013 draft, 2014 final, 2016 postmarket draft, 2016 postmarket final, 2018 draft, 2022 draft, 2023 refuse-to-accept policy, 2023 final, 2024 draft, 2025 final. Checked October 8, 2026.

12. FDA. Earlier guidance PDFs, Internet Archive copies of fda.gov files: 2005 OTS guidance, 2014 final, 2016 postmarket draft, 2018 draft, 2022 draft, 2024 draft. Checked October 8, 2026.

13. openFDA. Device enforcement reports, reason_for_recall: cybersecurity. Data updated September 30, 2026. Checked October 8, 2026.

14. FDA. Recalls Background and Definitions. Checked October 8, 2026.

15. MDIC. Validating Medical Device Cybersecurity Through Penetration Testing. Listed on FDA's Cybersecurity page June 29, 2026. Checked October 8, 2026.

16. FDA. March 29, 2023 announcement of the refuse-to-accept guidance, and the archived PDF with a March 30, 2023 cover date. The dates differ and are recorded separately. Checked October 8, 2026.

17. eCFR. 21 CFR 10.115, Good guidance practices. Checked October 8, 2026.

18. openFDA. Device enforcement reports documentation. Checked October 8, 2026.

19. FDA. Premarket Notification 510(k). Checked October 8, 2026.

The PenTest Index Research is the research and reference section of thepentestindex.com.