FDA's February 2026 Cybersecurity Guidance: What Changed Under QMSR, and What Didn't

FDA reissued its premarket cybersecurity guidance on 3 February 2026, the day after the Quality Management System Regulation (QMSR) took effect. The new version, "Cybersecurity in Medical Devices: Quality Management System Considerations and Content of Premarket Submissions", supersedes the June 2025 guidance. It's easy to miss: we found no Federal Register notice for it, and the docket entry went up on 4 February.

We compared the two versions. The cybersecurity expectations didn't change. The regulatory scaffolding underneath them did. Every citation to the old Quality System regulation is now a QMSR or ISO 13485:2016 reference, and the records FDA points you to have new names. This explainer is for medical device manufacturers and their software teams preparing 510(k), De Novo or PMA submissions. It covers what changed, what stayed the same, a crosswalk of the citations, and a script that finds the old references in your own cybersecurity documentation.

The short answer

FDA's February 2026 premarket cybersecurity guidance is a conforming update for the QMSR, which took effect on 2 February 2026 and incorporates ISO 13485:2016 by reference. The section 524B cyber device expectations, SBOM, threat modeling, security architecture views and testing recommendations are the same as in the June 2025 version. What changed is that design controls under 21 CFR 820.30 became ISO 13485 clause 7.3, CAPA under 820.100 became clauses 8.4 and 8.5, supplier controls under 820.50 became clause 7.4, and the Design History File and Device Master Record became the Design and Development File and Medical Device File. Update the citations and record names in your cybersecurity plans and submission templates.

Why there's a new version

FDA's QMSR final rule, published on 2 February 2024 (89 FR 7496), amended 21 CFR Part 820 to align with ISO 13485:2016 and gave manufacturers two years. It took effect on 2 February 2026. The June 2025 cybersecurity guidance was written against the old Quality System regulation. Its first general principle was titled "Cybersecurity is Part of Device Safety and the Quality System Regulation", and it cited 21 CFR 820 sections throughout.

The February 2026 guidance says plainly that it supersedes the June 2025 document, keeps the same docket (FDA-2021-D-1158), and adds a footnote that its clause references are to ISO 13485:2016 unless it says otherwise. The new first principle is "Cybersecurity is Part of Device Safety and the Quality Management System Regulation (QMSR)", and the Secure Product Development Framework section now says an SPDF "may be one way to satisfy the QMSR".

What stayed the same

We extracted the text of both documents and compared them. They're almost the same length, about 26,100 words each. Counts of the core terms are identical:

So the substance teams have been building to since 2023 carries over: an SPDF, a threat model, a cybersecurity risk assessment, an SBOM in machine-readable form, security architecture views, testing evidence, a plan to monitor and address postmarket vulnerabilities, and labeling. If your last submission met the June 2025 guidance, the engineering work still holds.

What changed: the citation crosswalk

The changes sit in the sentences that tie cybersecurity activities to quality system requirements. Matching the same passages in both documents gives this crosswalk:

Two changes matter beyond relabeling. Risk management now has its own clause, 7.1, instead of being folded into design validation under 820.30(g), and FDA's guidance points to ISO 13485 building risk management into its requirements throughout. And CAPA is now framed as analysis of data and improvement under clauses 8.4 and 8.5. The guidance uses those clauses for postmarket vulnerability handling: the plan to identify and communicate vulnerabilities found after release is to follow 8.4 and 8.5, along with 21 CFR Part 806 where it applies.

Find the old references in your documents

Most manufacturers have a cybersecurity management plan, SPDF procedures, threat model templates and submission boilerplate that cite the June 2025 structure. This script scans text, Markdown and other text exports for pre-QMSR citations and prints the reference the February 2026 guidance uses for the same activity. It reads files only and uses the Python standard library:

#!/usr/bin/env python3
"""Find pre-QMSR citations in cybersecurity documentation.

FDA's February 2026 premarket cybersecurity guidance replaced its Quality
System (QS) regulation citations with QMSR / ISO 13485:2016 references. This
script scans text, Markdown or exported documents for the old citations and
prints the reference the 2026 guidance uses in the same passage.
Usage: qsr_refs_check.py FILE_OR_DIR...
"""
import re
import sys
from pathlib import Path

# Old reference -> what the February 2026 guidance cites in its place.
CROSSWALK = [
    (r"820\.30\(a\)", "21 CFR 820.10(c) and ISO 13485 clause 7.3 (design and development)"),
    (r"820\.30\(b\)", "ISO 13485 7.3.2 (design and development planning)"),
    (r"820\.30\(c\)", "ISO 13485 7.3.3 (design and development inputs)"),
    (r"820\.30\(d\)", "ISO 13485 7.3.4 (design and development outputs)"),
    (r"820\.30\(f\)", "ISO 13485 7.3.6 (design and development verification)"),
    (r"820\.30\(g\)", "ISO 13485 7.3.7 (validation, including software) and 7.1 (risk management)"),
    (r"820\.30\(j\)", "ISO 13485 7.3.10 (Design and Development File)"),
    (r"820\.30(?!\()", "ISO 13485 clause 7.3 (design and development)"),
    (r"820\.50", "ISO 13485 7.4 (purchasing / supplier controls)"),
    (r"820\.70", "ISO 13485 7.5 (production processes)"),
    (r"820\.100", "ISO 13485 8.4 and 8.5 (analysis of data, improvement, CAPA)"),
    (r"820\.181", "ISO 13485 4.2.3 (Medical Device File)"),
    (r"820\.198", "ISO 13485 8.2.2 and 21 CFR 820.35(a) (complaint handling)"),
    (r"820\.200", "ISO 13485 7.5.4 and 21 CFR 820.35(b) (servicing)"),
    (r"820\.22", "ISO 13485 8.2.4 (internal audit)"),
    (r"\bDesign History File\b|\bDHF\b", "Design and Development File (ISO 13485 7.3.10)"),
    (r"\bDevice Master Record\b|\bDMR\b", "Medical Device File (ISO 13485 4.2.3)"),
    (r"\bQuality System Regulation\b|\bQS regulation\b|\bQSR\b", "Quality Management System Regulation (QMSR)"),
    (r"Quality System Considerations and Content of Premarket Submissions",
     "the February 2026 title: Quality Management System Considerations and Content of Premarket Submissions"),
]
PATTERNS = [(re.compile(p), new) for p, new in CROSSWALK]
SUFFIXES = {".txt", ".md", ".adoc", ".rst", ".csv", ".html", ".xml", ".json", ".yaml", ".yml"}


def scan(path):
    hits = []
    for n, line in enumerate(path.read_text(errors="ignore").splitlines(), 1):
        for rx, new in PATTERNS:
            for m in rx.finditer(line):
                hits.append((n, m.group(0), new))
                break
    return hits


def main(args):
    files = []
    for a in map(Path, args):
        files += [p for p in a.rglob("*") if p.suffix.lower() in SUFFIXES] if a.is_dir() else [a]
    total = 0
    for f in sorted(files):
        hits = scan(f)
        total += len(hits)
        for n, old, new in hits:
            print(f"{f}:{n}: '{old}' -> {new}")
    print(f"{total} pre-QMSR reference(s) in {len(files)} file(s)")
    return 1 if total else 0


if __name__ == "__main__":
    sys.exit(main(sys.argv[1:] or ["."]))

On a sample cybersecurity management plan written against the 2025 guidance:

$ cat cybersecurity-management-plan.md
# Cybersecurity Management Plan, Infusion Pump Controller v4

## 1. Scope
This plan follows FDA's "Cybersecurity in Medical Devices: Quality System Considerations and Content of Premarket Submissions" (June 2025).

## 2. Design controls
Security requirements are design inputs under 21 CFR 820.30(c) and are traced to outputs (21 CFR 820.30(d)).
Penetration testing is part of design verification per 21 CFR 820.30(f).
The threat model and security risk assessment are maintained as part of software validation and risk analysis (21 CFR 820.30(g)).

## 3. Third-party software
Supplier controls for SOUP and open-source components follow 21 CFR 820.50. The SBOM is stored in the DHF.

## 4. Postmarket
Vulnerability reports received through the CVD program are evaluated as complaints under 21 CFR 820.198 and, where needed, routed to CAPA (21 CFR 820.100).

$ python3 qsr_refs_check.py dhf
dhf/cybersecurity-management-plan.md:4: 'Quality System Considerations and Content of Premarket Submissions' -> the February 2026 title: Quality Management System Considerations and Content of Premarket Submissions
dhf/cybersecurity-management-plan.md:7: '820.30(c)' -> ISO 13485 7.3.3 (design and development inputs)
dhf/cybersecurity-management-plan.md:7: '820.30(d)' -> ISO 13485 7.3.4 (design and development outputs)
dhf/cybersecurity-management-plan.md:8: '820.30(f)' -> ISO 13485 7.3.6 (design and development verification)
dhf/cybersecurity-management-plan.md:9: '820.30(g)' -> ISO 13485 7.3.7 (validation, including software) and 7.1 (risk management)
dhf/cybersecurity-management-plan.md:12: '820.50' -> ISO 13485 7.4 (purchasing / supplier controls)
dhf/cybersecurity-management-plan.md:12: 'DHF' -> Design and Development File (ISO 13485 7.3.10)
dhf/cybersecurity-management-plan.md:15: '820.100' -> ISO 13485 8.4 and 8.5 (analysis of data, improvement, CAPA)
dhf/cybersecurity-management-plan.md:15: '820.198' -> ISO 13485 8.2.2 and 21 CFR 820.35(a) (complaint handling)
9 pre-QMSR reference(s) in 1 file(s)

As a check on the mapping, we ran it on the text of both FDA documents: it finds 55 old-style references in the June 2025 guidance and none in the February 2026 one. It works on text, so export Word or PDF documents first. It suggests where to look, not new wording: whether a sentence should cite clause 7.3.7, 7.1 or both depends on what the sentence says.

What to do

1. Reference the February 2026 guidance by its new title in submissions and procedures. The June 2025 version is superseded.
2. Update citations in cybersecurity documentation, using the crosswalk above. Start with the documents that end up in submissions: the cybersecurity management plan, risk assessment and SBOM procedures.
3. Rename the record references. Where procedures say the threat model or SBOM lives in the DHF or DMR, point them to the Design and Development File or Medical Device File, and check that your QMSR transition actually created those files.
4. Tie vulnerability handling to clauses 8.4 and 8.5, and keep the 21 CFR Part 806 reporting path for corrections and removals.
5. Don't redo the engineering. The SBOM, threat model and testing expectations are unchanged. Our posts on SBOM requirements under section 524B and premarket cybersecurity and SBOMs in 2026 still describe what FDA expects in the submission.

The fair view

This is a small revision, and FDA handled it the right way: same docket, a clear supersession note, and no new expectations slipped in with the citation changes. For a manufacturer whose quality system already follows ISO 13485, as many do for markets outside the US, the new references will feel more natural than the old ones.

The risk is in quiet drift. Submissions are assembled from templates, and a template that still cites 820.30(g) and the Design History File isn't wrong about cybersecurity, but it no longer matches the regulation FDA inspects against or the guidance its reviewers use. A few hours spent updating the references now costs less than explaining them during a review.