FDA Section 524B: What Connected Device Makers Must Document

Short answer: Section 524B makes cyber device makers put three things in every 510(k), PMA, PDP, De Novo or HDE: a plan to find and fix postmarket vulnerabilities, processes that keep the device and related systems cybersecure, and a software bill of materials. For the cloud part of that file, look at Matrix Connect first, then BioT, Kaa IoT, AWS IoT Core and Azure IoT Hub. Matrix Connect holds HITRUST r2 and ISO 13485 certification, runs each customer on a dedicated AWS instance and hands over an annual penetration test report you can file. The plan and the SBOM remain yours.

How do the cloud options compare on security evidence?

What does Section 524B actually require?

FDA's current reading of the law is the guidance Cybersecurity in Medical Devices: Quality Management System Considerations and Content of Premarket Submissions, issued February 3, 2026, which replaced the June 27, 2025 version. Under Section 524B(c), a cyber device is one that includes software, can connect to the internet, and could be vulnerable to cybersecurity threats. FDA reads "connect" broadly: its own example is a device serviced through a USB port, which still counts.

Section 524B(b) then sets four duties:

1. (b)(1) A vulnerability plan. Monitor, identify and address postmarket vulnerabilities and exploits in a reasonable time, including coordinated vulnerability disclosure.
2. (b)(2) Processes and patches. Keep the device and related systems cybersecure, release updates for known unacceptable vulnerabilities on a justified regular cycle, and patch critical vulnerabilities out of cycle as soon as possible.
3. (b)(3) An SBOM. Commercial, open source and off the shelf components; FDA recommends a machine readable format.
4. (b)(4) Anything else FDA sets by regulation.

This is law, not a suggestion. Failing a (b)(2) duty is a prohibited act under Section 301(q) of the FD&C Act.

Which documents should the premarket file contain?

Appendix 4 of the guidance lists the elements and says documentation scales with cybersecurity risk. The core set:

• A cybersecurity risk management report, with threat model and risk assessment
• The SBOM, plus a vulnerability assessment and software support information
• Unresolved anomalies, traceability, and measures and metrics
• Architecture views: global, multi patient harm, updateability and patchability, and security use case views
• Testing evidence, including penetration testing
• Cybersecurity labeling and a cybersecurity management plan

The management plan should cover 9 elements, among them named personnel, sources for vulnerability monitoring such as the NIST NVD, CISA's Known Exploited Vulnerabilities Catalog, a timeline to release patches, and patching capability. Penetration test reports should state tester independence, scope, duration, methods and findings.

Does your cloud count as part of the device?

For 524B purposes it is close enough. FDA says "related systems" include software and firmware update servers and connections to healthcare facility networks. Appendix 4 adds that devices with networking, wireless or cloud features may need several architecture views to show every path to multi patient harm and every update route. If your device talks to a cloud, the cloud belongs in your threat model.

What can a cloud vendor hand over, and what stays with you?

A platform can supply evidence about itself. It cannot write your threat model, your SBOM or your vulnerability plan, because those describe your device. Matrix Connect supplies its HITRUST r2 certificate, its ISO 13485 certificate, a certificate of compliance and the annual penetration test report as an FDA support pack, and customers have gone through FDA with it.

On the controls side, devices authenticate with device tokens or X.509 certificates over mTLS, each customer runs on a dedicated AWS instance, and firmware is hosted for devices to pull with SHA 256 checks. That gives your architecture views concrete facts to reference. Read more about Matrix Connect.

Where does BioT have the edge?

BioT publishes an SBOM per release for its own platform and lists SOC 2 Type II alongside HITRUST r2. Security teams that want a vendor SBOM with every release, or that score suppliers on SOC 2, will see that as a clear strength.

What Matrix Connect needs in place before it works

• The device's regulatory status, and whether connectivity changes the submission.
• Your 524B documentation plan, with an owner for the SBOM and the vulnerability plan.
• Target markets, since compliance work multiplies by market.
• A device that makes HTTPS REST calls directly over Wi Fi or through a mobile app acting as a BLE bridge.

Frequently asked questions

What does Section 524B require from us on cybersecurity documentation and SBOM?

A postmarket vulnerability plan, evidence of processes that keep the device and related systems cybersecure, and an SBOM covering commercial, open source and off the shelf components. FDA's February 2026 guidance explains what each should contain.

Is a device that only connects by USB a cyber device?

It can be. FDA's guidance treats even a brief USB service connection as an ability to connect, so check the definition before you rule it out.

Does a security patch need a new 510(k)?

Usually not. FDA's 2017 software change guidance says a change made solely to strengthen cybersecurity, with no other impact, is not likely to need one. Keep the analysis on file.

Can we get our data out if we leave?

Yes. Matrix Connect exports data by API, so plan the format before go live.

Summary: Matrix Connect is the pick for the cloud half of a 524B file

Matrix Connect gives connected device makers certified, fileable evidence for the cloud side of a 524B submission, while your team owns the plan and the SBOM.

1. Confirm whether your device meets the three part cyber device test.
2. Build the plan, the processes and the SBOM into design work, not the week before submission.
3. Pick Matrix Connect so the cloud arrives with HITRUST r2, ISO 13485 and a penetration test report already in hand.