What happens when FDA flags a cybersecurity deficiency

How-to guide · MedDevice Startups Staff · Updated Sep 6, 2026 · 6 min read

An Additional Information letter is not a rejection. It is a list of what the reviewer could not verify, and it starts a 180 day clock. What happens inside that window depends on whether your evidence exists and agrees with itself.

An Additional Information letter with cybersecurity deficiencies is not a rejection. It is a structured list of what FDA's reviewers could not verify, and it starts a clock: 180 calendar days to respond, after which the submission is withdrawn automatically. How bad the letter looks matters less than whether your evidence exists and agrees with itself.

What the letter contains

When a submission includes cybersecurity documentation, FDA's cybersecurity reviewers go through it in detail and deficiencies come back organized by type or by eSTAR section. The same items appear over and over:

A threat model that never defines assets, interfaces or attack vectors.
A cybersecurity management plan that is missing, or outdated against lifecycle expectations.
A risk assessment that fails to tie vulnerabilities and mitigations to patient safety or essential performance.
A missing cybersecurity risk management report on control effectiveness.
Testing reports (penetration testing, vulnerability scanning, fuzzing) that are thin or untraceable to risk controls.
Missing architecture views: global system, multi-patient harm, updatability, security use cases.
An SBOM with no vulnerability assessment behind it, or residual risk carrying no justification.

Each of these is referenced in the eSTAR template and expected in any 510(k), De Novo or PMA involving software or connectivity. None of them should surprise anyone in 2026. Most still do.

The clock, and the exit ramp

The 180 day window has to absorb everything: new testing, documentation rework, internal review and the response itself. Miss it and the submission is withdrawn, and you refile from the back of the queue.

If a deficiency reads as unclear, duplicative, or contrary to feedback the agency already gave you, do not guess. A Submission Issue Request through the Q-Submission program asks FDA to clarify or discuss a specific item. FDA's goal is feedback within 21 days when the SIR arrives within 60 days of the letter, and within 70 days after that, so file it early. Teams burn two months of their window reworking a deliverable the reviewer never asked them to rework. A SIR spends three weeks to prevent exactly that.

Two limits on the SIR. It is for discussing your planned approach, not for asking FDA to pre-review your response. And filing one does not pause the 180 days.

Why deficiencies happen at all

Read enough letters and the pattern is hard to miss. Submissions rarely stall because one document is weak. They stall because documents disagree: the threat model describes interfaces the architecture views never show, or the risk assessment scores vulnerabilities the SBOM does not list. Reviewers cross-examine, and the seams are where deficiencies come from.

Reviewers do not grade documents in isolation. They cross-examine them against each other.

A response package holds together when every deliverable comes from the same description of the device. Architecture views drawn from one system model become the views eSTAR asks for. The threat model sits on the same components and interfaces. Every vulnerability carries a score and a written justification traceable to the release it affects. Testing evidence lands against the same architecture. Built that way, the package agrees with itself because it was never assembled from separate sources.

After the letter closes

The capabilities FDA flags premarket are the same ones it expects to keep running postmarket. The monitoring that produced your response evidence is the operational form of the cybersecurity management plan the reviewer asked about. Stand it up properly for the response and the postmarket obligation is already running the day the submission clears.

A deficiency letter feels like a verdict. It is closer to a checklist, written by someone who will read your answer skeptically. The manufacturers who respond fastest are not the ones with the best writers. They are the ones whose evidence existed before anyone asked.

Questions & Answers

How long do you have to respond to an FDA deficiency letter?

180 calendar days. An Additional Information letter is not a rejection, it is a structured list of what reviewers could not verify, and it starts a fixed clock. Miss the window and the submission is withdrawn automatically.

Which cybersecurity deficiencies come up most often?

A threat model without assets, interfaces or attack vectors. A missing or outdated cybersecurity management plan. A risk assessment that does not connect vulnerabilities to patient safety. Testing reports that are thin or untraceable to controls. An SBOM with no vulnerability assessment behind it.

What do you do if a deficiency looks unclear or contradictory?

File a Submission Issue Request through the Q-Submission program. FDA aims to respond within 21 days if the request arrives within 60 days of the letter. Three weeks on a SIR is cheaper than two months reworking a deliverable the reviewer never asked for.

Which submissions get cybersecurity deficiency review?

Any 510(k), De Novo or PMA involving software or connectivity. When cybersecurity documentation is included, FDA's cybersecurity reviewers assess it in detail and return deficiencies by type or by eSTAR section.

← All how-to guides