FDA §524B,
made verifiable.
The FDA can refuse to accept a cyber device submission that can't show cybersecurity. RankShieldMD turns the §524B obligations into signed artifacts your reviewer can verify.
For the regulatory, quality, and product-security leads who own a device's cybersecurity story, RankShieldMD produces the signed evidence a §524B submission relies on: a postmarket vulnerability-management feed, secure-design device identity, and an SBOM covering commercial, open-source, and off-the-shelf components. It produces evidence that supports your submission — it never makes your submission, never makes you compliant, and it is non-device by design.
The submission
can be refused.
Section 524B of the FD&C Act, added by the Consolidated Appropriations Act 2023 and effective March 29, 2023, gives the FDA authority to refuse to accept a premarket submission for a cyber device that lacks adequate cybersecurity information. A cyber device meets a three-part test: it contains software, it can connect to the internet, and it has a characteristic that could be vulnerable. The operative premarket guidance was finalized June 27, 2025. Refuse-to-accept happens at the gate, before review even begins — so the cybersecurity evidence has to be present and inspectable, not narrated.
Three duties.
Three artifacts.
Section 524B(b) names three obligations. (b)(1) a postmarket plan to monitor, identify, and address vulnerabilities with coordinated disclosure; (b)(2) processes for a reasonable assurance the device is cybersecure, with updates and patches; (b)(3) a software bill of materials. RankShieldMD produces each as a signed, verifiable artifact: a postmarket decision feed for (b)(1), post-quantum device identity plus compensating-control containment for (b)(2), and a CycloneDX SBOM for (b)(3) — each externally anchored and independently checkable.
A signed
bill of materials.
The §524B(b)(3) SBOM has to cover commercial, open-source, and off-the-shelf components. RankShieldMD emits it in the standard CycloneDX and SPDX formats, machine-readable and human-readable, and seals each to the transparency ledger tied to a specific build. For AI-enabled devices it can also emit a clinical AIBOM describing models, datasets, and lineage. The AIBOM is a voluntary, emerging practice rather than a statutory §524B requirement, and we present it that way — the SBOM is the signed artifact your reviewer confirms.
Contain it.
Document it.
Some devices can't be patched, recalled, or taken offline. For those, RankShieldMD supports a compensating control such as network segmentation that brings residual risk to an acceptable level, proves the containment holds with posture evidence, and records the decision in a residual-risk dossier referencing ISO 14971. The device keeps running; its reachable attack surface shrinks; and the reasoning is written down as verifiable evidence a reviewer can inspect, not a silent gap in the file that invites a refuse-to-accept.
Bring a device
or a fleet.
Bring one product line or your whole device fleet. We'll show you the §524B obligations produced as signed artifacts, an SBOM your reviewer can verify, and residual-risk dossiers for what you can't patch. Evidence that supports your submission, verifiable, PHI-free, non-device.
What is FDA medical device cybersecurity under §524B?
FDA medical device cybersecurity is the set of obligations a cyber device must satisfy under Section 524B of the Food, Drug, and Cosmetic Act — a postmarket vulnerability-management plan with coordinated disclosure, a reasonable assurance the device is cybersecure with updates and patches, and a software bill of materials — backed by evidence the agency can refuse to accept a submission without. Section 524B was added by the Consolidated Appropriations Act 2023 and took effect March 29, 2023, and it gives the FDA authority to refuse to accept a premarket submission for a cyber device that lacks adequate cybersecurity information. A cyber device is defined by a three-part test: it includes device software, it can connect to the internet, and it has a characteristic that could be vulnerable to cybersecurity threats. The operative premarket guidance describing how the agency expects a reasonable assurance of cybersecurity to be demonstrated was finalized June 27, 2025. What §524B does not do is hand you a checklist a tool can silently satisfy; it describes obligations you must be able to evidence at the point of submission. That is where RankShieldMD works: it produces evidence that supports your submission — a signed postmarket feed, post-quantum device identity, and a CycloneDX SBOM sealed to an externally-anchored, post-quantum-signed transparency ledger — and it never makes your submission, never makes you compliant or cleared, and works on device identity and integrity, never on protected health information.
It puts device-makers ahead of where regulation is heading, not past a rule that already exists — the FDA expects crypto-agility and migration planning today and does not mandate post-quantum cryptography, and an AIBOM remains a voluntary practice rather than a §524B requirement.
How do you meet FDA 524B cybersecurity requirements?
You meet §524B by turning each of its three statutory obligations into concrete, inspectable evidence before you file, rather than a narrative you assemble at the last minute. Section 524B(b) names them precisely: (b)(1) a plan to monitor, identify, and address postmarket cybersecurity vulnerabilities and exploits in a reasonable time, including a coordinated disclosure process; (b)(2) a design and processes that provide a reasonable assurance the device and the systems it connects to are cybersecure, along with updates and patches; and (b)(3) a software bill of materials covering commercial, open-source, and off-the-shelf software components. The way to meet each one is to produce it as an artifact a reviewer can hold and check. RankShieldMD does exactly that. It generates a signed postmarket decision and integrity feed for (b)(1), a composite post-quantum device identity plus compensating-control containment for (b)(2), and a CycloneDX SBOM for (b)(3), and it seals each to an externally-anchored, post-quantum-signed transparency ledger with a verify recipe. An FDA reviewer, an auditor, or a buyer can then recompute and confirm the artifact without trusting a dashboard. The obligation stays yours; what changes is that the evidence behind it is verifiable rather than asserted. RankShieldMD produces evidence that supports your submission — it never makes your submission, and it never makes you compliant or cleared.
What cybersecurity documentation does an FDA medical device submission need?
A cyber device submission needs documentation that evidences each §524B obligation and the security engineering behind it, and the strongest version of that documentation is a set of artifacts rather than assertions. In practice a submission carries a postmarket vulnerability-management plan with a coordinated disclosure process, a secure-design record showing a reasonable assurance the device and its connected systems are cybersecure together with the processes for updates and patches, and a software bill of materials covering commercial, open-source, and off-the-shelf components. Around those core items, reviewers typically expect a threat model, a security risk assessment, an architecture and data-flow view, and evidence of security testing, all consistent with the premarket guidance the FDA finalized June 27, 2025. The weakest version of this documentation is a deck of screenshots and claims assembled the week before filing; the strongest is a portfolio of signed, tamper-evident artifacts tied to specific builds. RankShieldMD produces the load-bearing pieces in that stronger form. The postmarket feed, the device-identity credentials, the SBOM, and the residual-risk dossier are each generated as a cryptographic artifact, externally anchored, and shipped with a verify recipe, so the documentation is objective evidence a reviewer can recompute rather than a story someone reconstructs. The submission remains yours to compile and file; RankShieldMD makes the cybersecurity evidence inside it verifiable.
How do you avoid an FDA refuse-to-accept for cybersecurity?
You avoid a refuse-to-accept by making sure every §524B obligation is present as a concrete, inspectable artifact before the submission reaches the acceptance gate. The FDA can refuse to accept a cyber device submission that lacks adequate cybersecurity information, and that authority operates at the front door, before substantive review even begins. The most common way submissions stumble there is not a bad security design but a missing or merely narrated one: an obligation described in prose with no underlying artifact, an SBOM that is a partial list in a slide, or a postmarket plan that reads as an intention rather than a running program. The defense is to have each obligation exist as something a reviewer can open and confirm. RankShieldMD is built around that discipline. It produces the postmarket vulnerability feed, the secure-design device identity, and the SBOM as signed artifacts, seals each to a transparency ledger, and ships a verify recipe so their existence and integrity are demonstrable rather than claimed. When the acceptance reviewer looks for evidence that a control is real, the answer is an artifact that recomputes correctly, not a promise. This supports acceptance; it does not guarantee it, and the FDA remains the deciding authority. What RankShieldMD removes is the specific, avoidable failure of arriving at the gate with obligations that cannot be shown.
How do you produce SBOM and postmarket monitoring evidence for FDA?
You produce them as signed, machine-readable artifacts that stay tied to the builds and events they describe, so a reviewer can confirm exactly what runs on a device and how vulnerabilities are being handled. For the SBOM, §524B(b)(3) expects coverage of commercial, open-source, and off-the-shelf components, and RankShieldMD emits it in the standard CycloneDX and SPDX formats, both machine-readable and human-readable, then seals each SBOM to the post-quantum-signed transparency ledger tied to a specific build. That means the bill of materials for a given device version is a confirmable fact rather than a document that drifts out of date. For AI-enabled devices, RankShieldMD can emit a clinical AIBOM alongside the SBOM, documenting models, datasets, and lineage; that AIBOM is a voluntary, emerging practice rather than a §524B statutory requirement, and we present it as strengthening the record, not satisfying a rule. For postmarket monitoring under §524B(b)(1), RankShieldMD produces a signed decision and integrity feed that records vulnerability identification, triage, and disposition as they happen, with a coordinated disclosure process behind it. Instead of a one-time attestation that a program exists, the postmarket obligation becomes a continuously evidenced stream a reviewer or auditor can inspect. In both cases the evidence is exportable, externally anchored, and independently verifiable, so it files directly into the submission and the quality record rather than being reconstructed later.
How do you secure a device you can't patch and still satisfy the FDA?
You change what can reach the device instead of what runs on it, and you record the decision so it stands up under review. Some devices cannot be patched, recalled, or taken offline: they are too old, too constrained, or too embedded in care to interrupt, yet they remain on the network serving patients. Pretending such a device is secure is not an option, and neither is ripping out an installed base. RankShieldMD approaches it the way a risk file should — contain, prove, and document. First, contain the device with a compensating control, most often network segmentation that limits which systems can reach it, so that even without a patch the exploitable surface is reduced. Second, prove the containment actually holds with verifiable posture evidence, so the segmentation is a demonstrable fact rather than a diagram in a policy binder. Third, document the remaining exposure in a residual-risk dossier that references ISO 14971, the standard for medical-device risk management, so the decision to keep the device in service is a reasoned, recorded judgment with the residual risk brought to an acceptable level. That combination is what lets an unpatchable device coexist with a §524B postmarket program. The device stays useful, the risk is bounded and written down, and a reviewer can see exactly why continued operation is acceptable rather than being asked to take it on faith or discovering a silent gap.
Where to go next.
Evidence for every submission
The postmarket, secure-design, and SBOM artifacts a §524B submission relies on, produced as signed evidence for regulatory, quality, and product-security leads.
Explore → POST-QUANTUM IDENTITYDevice identity, rotated in the field
Composite ML-DSA-65 with Ed25519 credentials and in-field key rotation, so a device certified today stays defensible for its full service life without a recall.
Explore → CONTAINMENT & DOSSIERSContain the device you can't patch
Compensating-control segmentation, verifiable IoMT posture, and ISO 14971 residual-risk dossiers for unpatchable and end-of-life devices in the field.
Explore →What we are careful never to claim.
It supports your submission
RankShieldMD produces evidence that supports your §524B submission. It never makes your submission, never renders an FDA decision, and cannot make an organization compliant or cleared.
The FDA doesn't mandate PQC yet
Today the FDA expects crypto-agility and migration planning. RankShieldMD puts you ahead of where regulation is heading, not past a rule that already exists. Quantum-safe, not quantum-proof.
It's device identity, not PHI
RankShieldMD works on device identities, credentials, SBOMs, and posture evidence. It is non-device and PHI-free by construction, and the AIBOM it can emit is voluntary, not a §524B mandate.
Ask RankShieldMD about FDA §524B.
How do I meet FDA §524B cybersecurity requirements?
Section 524B of the FD&C Act, added by the Consolidated Appropriations Act 2023 and effective March 29, 2023, requires a cyber device submission to carry a postmarket vulnerability-management plan with coordinated disclosure, processes for a reasonable assurance the device is cybersecure with updates and patches, and a software bill of materials. You meet it by producing each of those obligations as defensible evidence a reviewer can inspect. RankShieldMD generates a signed postmarket decision feed, post-quantum device identity, and a CycloneDX SBOM sealed to a transparency ledger, so the evidence that supports §524B is verifiable rather than asserted. It produces evidence that supports your submission; it does not make you compliant or cleared.
When did §524B take effect and what is the operative guidance?
Section 524B was added by the Consolidated Appropriations Act 2023 and took effect March 29, 2023. The operative premarket cybersecurity guidance the FDA expects manufacturers to follow was finalized June 27, 2025, and it describes how the agency expects a reasonable assurance of cybersecurity to be demonstrated under §524B. RankShieldMD is built to produce the identity and integrity artifacts that support the design and postmarket expectations that guidance describes. It does not replace the guidance or the submission; it produces evidence that supports them.
Does RankShieldMD make my device FDA compliant or cleared?
No. RankShieldMD produces verifiable evidence that supports your §524B submission and postmarket program. It never files your submission, never renders an FDA decision, and cannot make an organization compliant or cleared. Compliance is your overall posture and the FDA is the deciding authority. We say produces evidence that supports your submission, never makes you compliant or cleared.
What counts as a cyber device under §524B?
Section 524B applies to a cyber device, which the statute defines with a three-part test: the device includes software validated, installed, or authorized by the sponsor as a device or in a device; the device has the ability to connect to the internet; and the device contains any such technological characteristic that could be vulnerable to cybersecurity threats. A device that meets all three is a cyber device and its submission is subject to the §524B requirements. RankShieldMD helps a cyber device produce the postmarket, secure-design, and SBOM evidence those requirements rely on.
Is a device that is not internet-connected still in scope?
The statutory three-part test for a cyber device requires the ability to connect to the internet as one element, alongside device software and a vulnerable characteristic. A device that genuinely cannot connect to the internet may fall outside the strict definition, but manufacturers should assess connectivity carefully because peripheral, wireless, and service-network pathways are easy to overlook. Where a device is in scope, RankShieldMD produces the identity, SBOM, and postmarket evidence its submission relies on. We do not render the classification decision for you; that determination is yours and the FDA's.
What cybersecurity documentation does an FDA submission need?
A cyber device submission generally needs a postmarket vulnerability-management plan with a coordinated disclosure process, a secure-design record showing a reasonable assurance the device and connected systems are cybersecure with the processes for updates and patches, and a software bill of materials covering commercial, open-source, and off-the-shelf components. Threat models, security risk assessments, and architecture views typically accompany them. RankShieldMD produces the postmarket monitoring feed, device-identity credentials, and the SBOM as signed, externally-anchored artifacts, so the documentation is verifiable evidence rather than a narrative reconstructed at submission time.
How do I avoid an FDA refuse-to-accept for cybersecurity?
The FDA can refuse to accept a cyber device submission that lacks adequate cybersecurity information, which usually means an obligation is narrated rather than evidenced or an artifact is missing. You reduce that risk by having each §524B obligation present as a concrete, inspectable artifact before you file: a real postmarket plan, a documented secure-design assurance, and a machine-readable SBOM. RankShieldMD produces each as a signed artifact sealed to a transparency ledger with a verify recipe, so a reviewer can confirm the evidence exists and is intact. It supports acceptance; it does not guarantee it, and the FDA remains the deciding authority.
How does the evidence slot into a QMSR or ISO 13485 record?
RankShieldMD artifacts are designed to drop into your quality system. The Quality Management System Regulation, which harmonizes the FDA quality-system requirements with ISO 13485, takes effect February 2, 2026 and requires objective evidence that processes were followed and risk decisions justified. Signed SBOMs, device-identity credentials, postmarket monitoring records, and residual-risk dossiers are exportable, externally anchored, and independently verifiable, so they file as objective evidence in a QMSR and ISO 13485 record rather than being reconstructed at audit time. The evidence is portable to your quality management system, not locked in a vendor dashboard.
How do I produce an SBOM and postmarket monitoring evidence for FDA?
Section 524B(b)(3) expects a software bill of materials covering commercial, open-source, and off-the-shelf components, and §524B(b)(1) expects a postmarket plan to monitor, identify, and address vulnerabilities with coordinated disclosure. RankShieldMD emits the SBOM in the standard CycloneDX and SPDX formats, both machine-readable and human-readable, and can seal each to the transparency ledger so a reviewer confirms the exact bill of materials tied to a given build. Postmarket monitoring is produced as a signed decision and integrity feed that records vulnerability handling as it happens, so the postmarket program is evidenced continuously rather than attested once.
What SBOM formats does RankShieldMD support?
RankShieldMD emits software bills of materials in CycloneDX and SPDX, the two widely adopted machine-readable formats, and produces human-readable views alongside them so the same bill of materials serves both an automated pipeline and a human reviewer. Each SBOM can be sealed to the post-quantum-signed transparency ledger and tied to a specific build, so the exact components running on a given device version are confirmable. The SBOM is a signed, tamper-evident artifact, not a screenshot in a slide deck.
What is an AIBOM and is it required?
An AI bill of materials, or AIBOM, describes the models, datasets, and lineage behind an AI-enabled device the way an SBOM describes software components. For AI-enabled medical devices RankShieldMD can emit a clinical AIBOM alongside the CycloneDX SBOM, so the AI supply chain is documented with the same rigor. An AIBOM is a voluntary, emerging practice rather than a §524B statutory requirement, and we present it that way. It strengthens the record for AI-enabled devices; it is not something the statute currently mandates.
How do I secure a device I cannot patch and still satisfy the FDA?
You change what can reach it and you write the decision down. When a device cannot be patched, recalled, or taken offline, RankShieldMD supports a compensating control such as network segmentation that brings the residual risk to an acceptable level, proves the containment holds with verifiable posture evidence, and records the reasoning in a residual-risk dossier referencing ISO 14971, the standard for medical-device risk management. The device keeps running, the reachable attack surface shrinks, and the decision to keep operating it is documented as defensible evidence rather than a silent gap. That is how an unpatchable device stays in service with a §524B postmarket program that holds up.
What about end-of-life devices already in the field?
End-of-life devices are the hardest case and the one containment is built for. A device past end-of-life may never receive another firmware update, yet it still serves patients on a shared network. RankShieldMD helps you contain it with a compensating control, prove the containment holds with posture evidence, and record the residual risk against ISO 14971 so the decision to keep operating it is reasoned and defensible rather than silent. The installed base keeps working, the exposure is bounded, and a reviewer can see exactly why continued operation is acceptable.
Is RankShieldMD a medical device?
No. It is security and quality tooling that helps device manufacturers meet their obligations. FDA classification turns on intended use, and RankShieldMD attests device identity and integrity; it never renders, drives, or influences a clinical decision. That non-device boundary is deliberate and it keeps clinical judgment with clinicians. It attests; it never renders.
Does RankShieldMD handle patient data?
No. RankShieldMD works on device identities, credentials, signed commands, SBOMs, and posture evidence, never on protected health information. It is PHI-free by construction. The device keeps doing its clinical job through its own systems, and RankShieldMD only proves identity and integrity, so adopting it shrinks your PHI footprint rather than growing it.
Does the FDA mandate post-quantum cryptography?
No, and we will not tell you otherwise. Today the FDA expects crypto-agility and migration planning rather than mandating specific post-quantum algorithms. RankShieldMD issues composite ML-DSA-65 with Ed25519 device identity and keeps it rotatable, so a device certified now can migrate forward as standards advance. This puts a device ahead of where regulation is heading, not past a rule that already exists. It is quantum-safe, not quantum-proof.
Turn the §524B requirement into evidence you can hand over.
Bring a device or a fleet. We'll show you the §524B obligations produced as signed evidence, an SBOM your reviewer can verify, and residual-risk dossiers for what you can't patch.