How the 2025 and 2026 revisions changed the cybersecurity ask

How-to guide · MedDevice Startups Staff · Updated Sep 6, 2026 · 7 min read

The June 2025 revision clarified scope, SBOM format and the risk model. The February 2026 revision realigned the whole document to the QMSR. Neither handed you new duties. Both closed the escape hatches.

FDA published its first revision of the 2023 premarket cybersecurity guidance on June 27, 2025, then revised it again on February 3, 2026. The 2025 redline ran to more than 1,300 tracked changes. The substance was calmer than the count. The 2025 revision clarified how to meet obligations manufacturers already had. The 2026 revision changed the citations, not the duties, so the document now speaks the language of the QMSR and ISO 13485.

Scope: if the device runs code, it is covered

The 2025 revision added a section that formally defines a cyber device under Section 524B and settled the connectivity argument. A cyber device includes software the sponsor validated, installed or authorized, has the ability to connect to the internet, and contains technological characteristics that could be vulnerable. FDA reads "ability to connect" broadly: intentionally or unintentionally, through any means. Firmware counts. Programmable logic counts, FPGAs included. A USB port used once for servicing counts, because the ability to connect is present.

The "our device is air-gapped, so this does not apply" position is now formally dead. If your device runs code and has any port or radio, plan on this guidance applying to it.

Sharper SBOM, different risk model

SBOM expectations got more precise. The guidance asks for machine-readable SBOMs consistent with the NTIA minimum elements, covering third-party, open-source and proprietary components plus their upstream dependencies, and for each component the level of support (actively maintained, no longer maintained, abandoned) and the end-of-support date. A PDF export of a dependency scan does not clear that bar. Labeling should make the SBOM available to users on a continuous basis in machine-readable form.

The deeper change is the risk model. The guidance reaffirms that security risk is not safety risk and directs manufacturers toward a non-probabilistic assessment built on exploitability, not severity times likelihood. FMEA on its own no longer carries a security argument. Of everything in the revision, this is the clarification most likely to retire a process a quality system has run for years.

Named standards, real attacks, full lifecycle

To make implementation concrete, FDA now cites ANSI/AAMI SW96 alongside AAMI TIR57 for the security risk management plan and report. If you have been working from TIR57 alone, SW96 is the document that turns principles into lifecycle activities, and reviewers now have a named reference to hold submissions against.

Threat modeling, testing and risk assessment read as lifecycle activities, not premarket milestones. A previously cleared device that returns with a modification gets measured against the current bar, not the bar it originally cleared. Manufacturers are expected to maintain a clear, auditable process for postmarket vulnerability management covering SBOM monitoring, vulnerability triage, patch timelines and coordinated disclosure.

Writing that procedure takes a week. Running it with evidence, across every product and every release, is a program.

What February 2026 changed

The 2026 revision realigns the guidance to the Quality Management System Regulation, which took effect on February 2, 2026 and incorporates ISO 13485 by reference. Where the 2025 text cited 21 CFR 820.30 design control paragraphs, the 2026 text cites the corresponding ISO 13485 subclauses: 7.1 for risk management, 7.3 for design and development, 7.4 for purchasing, 8.4 and 8.5 for analysis of data and improvement. The documentation FDA wants in the submission did not change. The regulatory hooks it hangs from did.

What it means in practice

Manufacturers who treated the 2023 guidance as a documentation exercise will experience the clarifications as new requirements, because the ambiguity they were living in is gone. Teams that built continuous processes will read the redlines and shrug. The distance between those two reactions is the whole story of these revisions.

Questions & Answers

What changed in the FDA's June 2025 premarket cybersecurity guidance?

FDA published the revision on June 27, 2025, the first since 2023. More than 1,300 tracked changes look dramatic, but the substance clarifies rather than expands: a formal cyber device definition, sharper SBOM expectations, an exploitability-based risk model, and SW96 named alongside TIR57.

Does FDA cybersecurity guidance apply to devices that never connect to a network?

Almost always. The definition turns on the ability to connect, whether or not connectivity was intended, and FDA lists USB, ethernet and serial ports alongside Wi-Fi, Bluetooth and cellular as features that confer that ability. Firmware and programmable logic count as software.

What did the February 2026 revision change?

Citations, not duties. The 2026 text aligns with the QMSR and cites ISO 13485 subclauses instead of 21 CFR 820.30 paragraphs. The recommended submission content is the same.

Can you use FMEA for cybersecurity risk assessment?

Not on its own. The guidance directs manufacturers to assess security risk on exploitability rather than likelihood, and to run a separate security risk assessment that feeds the safety risk file rather than living inside it.

← All how-to guides