A cyber device is a medical device that includes software, has the ability to connect to the internet, and has technological characteristics that could be vulnerable to cybersecurity threats. FDA reads "ability to connect" broadly. A device that was never meant to be online can still qualify, because USB, Bluetooth and similar links count.
The three tests in the statute
Section 524B of the FD&C Act was added by the Consolidated Appropriations Act, 2023, signed on December 29, 2022. FDA's FAQ page says the amendments took effect on March 29, 2023.
Section 524B(c) defines a cyber device as one that meets all three criteria. First, it includes software validated, installed or authorized by the sponsor as a device or in a device. Second, it has the ability to connect to the internet. Third, it contains technological characteristics that could be vulnerable to cybersecurity threats.
All three must hold. A purely mechanical device with no software is outside the definition.
How FDA reads "software"
FDA's February 2026 guidance says it considers a cyber device to include devices that are or contain software, including firmware and programmable logic. So an embedded controller with firmware counts as software for this purpose. You cannot exit the definition by saying "it is only firmware".
How FDA reads "ability to connect to the internet"
This is the part that surprises teams. The guidance treats the ability to connect as covering any means, intended or not, including any point found when you evaluate the threat surface and the environment of use. Its reasoning is that if a device can be connected to the internet, it may be, whatever the sponsor intended.
The guidance gives an illustrative, not exhaustive, list of features that count:
- Network, server or cloud service provider connections.
- Radio frequency links such as Wi-Fi, cellular, Bluetooth and Bluetooth Low Energy.
- Magnetic inductive communication, for example between an implant and its programmer.
- Hardware connectors that can reach the internet, such as USB, ethernet and serial ports.
The guidance adds that a service connection over USB may be brief, but the ability to connect is still present.
What changes if you are a cyber device
Anyone submitting a 510(k), PMA, PDP, De Novo or HDE for a cyber device must include the information 524B(b) requires. That is a plan to monitor, identify and address postmarket vulnerabilities including coordinated vulnerability disclosure, processes that give reasonable assurance the device and related systems are cybersecure with updates and patches available, and an SBOM covering commercial, open source and off-the-shelf components.
FDA's FAQ also states the requirements do not apply to submissions made before March 29, 2023. A previously authorized cyber device that later needs a new premarket submission for a change is covered by the law at that point.
For a practical walk through of the SBOM piece, see FDA SBOM requirements under section 524B.
When you are not sure
The FAQ says that if a sponsor is unsure whether its device is a cyber device, it should contact FDA. Do that early, before the submission is drafted. The cost of asking is low, and the cost of a submission that omits required material is not.
If you ship open source components in device software, a dependency inventory is the starting point for the SBOM. Safeguard's SBOM and dependency scanning can produce one, and there is a free scan at https://gold.safeguard.sh/scan. It does not decide whether your device is a cyber device or whether a submission is complete.
Quick check
Is a device with only a USB service port a cyber device?
It can be. FDA's guidance lists USB, ethernet and serial connectors among features that give a device the ability to connect to the internet, even when the connection is brief and used only for servicing.
Does 524B apply to 510(k) exempt devices?
The statute attaches to premarket submissions under the listed pathways. FDA's guidance says its general recommendations also apply to devices that need no premarket submission. Confirm your specific case with FDA.
Sources
- FDA cybersecurity FAQs
- FDA guidance, Cybersecurity in Medical Devices: Quality Management System Considerations and Content of Premarket Submissions (February 3, 2026)
Last reviewed: 19 October 2026.
