Yes. FDA's premarket cybersecurity guidance says it applies to devices with cybersecurity considerations, including any device that contains software, firmware or programmable logic. It states plainly that the guidance is not limited to network-enabled devices, and it also reaches devices that need no premarket submission.
What the scope section says
The February 2026 guidance applies to devices that include a device software function, or that contain software (including firmware) or programmable logic. The scope text adds that the guidance is not limited to devices that are network-enabled or have other connected capabilities.
It covers these premarket submission types when sent to CDRH or CBER: 510(k), De Novo, PMA and PMA supplements, PDP, IDE, HDE, BLA and IND. It also applies to devices within section 201(h) of the FD&C Act whether or not a premarket submission is required, which includes 510(k) exempt devices.
For combination products, the recommendations generally apply to the device constituent part when it presents cybersecurity considerations.
Guidance is not law, and cyber device is a subset
Two separate ideas get mixed up here.
The guidance itself is nonbinding. It describes FDA's current thinking, and the word "should" means recommended. Sponsors may use an alternative approach if it satisfies the statutes and regulations.
Section 524B is binding law, but it applies only to cyber devices, which are a defined subset of devices. The guidance says it also applies to cyber devices, so a cyber device gets both the statutory requirements and the broader recommendations.
So an offline, firmware only device may not be a cyber device, yet FDA still expects its submission to address cybersecurity risk in proportion to that risk.
Documentation scales with risk
The guidance says cybersecurity information should be included based on cybersecurity risk, not on the software documentation level from another FDA guidance. A device with high software risk might have little cybersecurity risk because of how it is built, and the reverse can also be true.
The guidance gives a thermometer example. An isolated thermometer carries less cybersecurity risk. If it is used in a safety critical control loop, or connected to networks or other devices, the risk is greater and more design and development activity is expected.
What an offline device team should still do
Even without a network interface, a sensible minimum is to:
- Document the software and firmware components, including third party and open source code.
- Run a threat model that covers physical access, removable media and service ports.
- Decide how updates reach the device and how they are authenticated.
- Write labeling that tells users what to do about security.
- Test the controls you claim to have.
Test and debug ports such as JTAG and UART are called out in the guidance as ports to disable or restrict before delivery.
Quick check
Is the guidance mandatory?
No. It is nonbinding. Section 524B, which applies to cyber devices, is statutory. The guidance explains how FDA evaluates the information and how to demonstrate it.
Do I need a full threat model for a simple device?
FDA expects documentation to scale with cybersecurity risk. A low risk device should need less, but the guidance still recommends threat modeling to support the risk analysis.
Sources
- FDA guidance, Cybersecurity in Medical Devices: Quality Management System Considerations and Content of Premarket Submissions (February 3, 2026)
- FDA guidance page for the same document
Last reviewed: 19 October 2026.
