FDA recommends threat modeling throughout design, covering every element of the medical device system, with stated assumptions about the environment and a record of risks from the supply chain, manufacturing, interoperation, updates and decommissioning. The model feeds the risk assessment and goes into the premarket submission with the method explained.
What the model is for
The guidance describes threat modeling as a process for identifying security objectives, risks and vulnerabilities across the system, then defining countermeasures to prevent, mitigate, monitor or respond to threats across the lifecycle. It is meant to inform the cybersecurity risk analysis, not sit beside it.
FDA suggests it be performed throughout the design process and reviewed during design reviews. It is not a one time workshop.
What the model should contain
According to the guidance, a threat model should:
- Identify system risks and mitigations, and inform the before and after mitigation risk ratings.
- State assumptions about the system and its environment of use.
- Capture risks from the supply chain, manufacturing, deployment, interoperation with other devices, maintenance and update activity, and decommissioning, which a traditional safety assessment can miss.
The guidance gives one concrete assumption as an example: hospital networks are inherently hostile, so assume an adversary controls the network and can alter, drop and replay packets. Writing that sentence down changes design choices, since it rules out trusting the network for integrity.
System, not just the device
The guidance wants threat modeling to include all elements of the medical device system. That means the device plus what it talks to, such as update servers, healthcare facility networks, cloud connections, other devices and patient home networks. The security architecture views in the guidance are partly a way to present this model to FDA. See the four architecture views FDA recommends.
Picking a method
FDA does not mandate a method. Several are acceptable, singly or combined, and the submission should explain why the method was chosen. The guidance points to the MDIC and MITRE Playbook for Threat Modeling Medical Devices as an educational resource. FDA's cybersecurity page lists that playbook with a date of November 30, 2021.
Common ways a model falls short
- It covers the device firmware but ignores the update path.
- Assumptions are unwritten, so reviewers cannot challenge them.
- Mitigations are listed with no link to the test that proves they work.
- It is never revisited after release, even though new vulnerabilities in components change the picture.
The guidance asks for traceability between the threat model, risk assessment, SBOM and testing documentation, which is the cure for the third problem.
Quick check
Do I have to use STRIDE or a specific method?
No. FDA says several methodologies may be used, alone or combined, and asks you to give the rationale for the one you chose.
Is the threat model part of the submission?
FDA recommends that premarket submissions include threat modeling documentation, so reviewers can see how the system was analyzed for risks that affect safety and effectiveness.
Sources
- FDA guidance, Cybersecurity in Medical Devices: Quality Management System Considerations and Content of Premarket Submissions (February 3, 2026)
- FDA medical device cybersecurity resources page
Last reviewed: 19 October 2026.
