FDA 510(k) update guidance has introduced new expectations around cybersecurity for medical devices, reshaping how manufacturers must approach compliance, documentation and ongoing support.
This update matters not just to regulatory teams, but also to businesses navigating digital transformation. With medical technologies becoming more interconnected, the security of these devices is now a key factor in gaining and maintaining market access. For businesses, staying compliant means not only protecting patient safety but also ensuring continuity, credibility and commercial success.
What Has Changed in the 2025 FDA 510(k) Update?
The 2025 guidance builds on the 2023 revisions but now fully integrates the legal requirements set out in Section 524B of the Food, Drug and Cosmetic Act, which were introduced by the Food and Drug Omnibus Reform Act (FDORA) in 2022.
Key updates include:
- A dedicated section on cyber devices, which now have a formal legal definition
- Clear expectations for premarket cybersecurity documentation, including software bills of materials (SBOMs), update and patching policies, and coordinated vulnerability disclosure plans
- Stronger alignment with recognised standards, such as ANSI/AAMI SW96:2023
- Reinforcement that cybersecurity is central to the device’s safety and effectiveness, influencing whether it is approved or rejected
Cybersecurity Now Defines Regulatory Success
One of the most important changes is the FDA’s message that cybersecurity is no longer a back-office technical concern. It is now a regulatory gateway.
Submissions for devices that meet the “cyber device” definition must include complete and clearly structured cybersecurity documentation. If these documents are missing or incomplete, the application can be rejected outright, even if the clinical aspects of the device are sound.
In 510(k) reviews specifically, cybersecurity risk is now weighed alongside clinical safety. A lack of robust protection, such as failing to encrypt patient data or ignoring patch management, can result in a “not substantially equivalent” (NSE) ruling, blocking the product from reaching market.
The Role of Penetration Testing in FDA Compliance
One increasingly essential part of meeting FDA expectations is penetration testing, simulating real-world attacks to identify vulnerabilities before a malicious actor does. While not named directly in the guidance, the FDA now expects businesses to demonstrate that their devices and associated systems can withstand credible cyber threats.
Penetration testing helps fulfil this requirement by validating the effectiveness of security controls, supporting threat modelling, and ensuring your risk assessments are grounded in real evidence. It also supports documentation and decision-making throughout the total product lifecycle.
Amicis Group offers sector-specific penetration testing tailored to regulated environments like medtech. Our experts work with your internal teams to uncover hidden risks and provide detailed, actionable findings — helping you stay compliant, secure, and audit-ready.
Total Lifecycle Responsibility of Medical Technology
The updated guidance makes clear that businesses must account for cybersecurity across the entire lifecycle of a medical device, not just during development or submission.
Manufacturers must now:
- Monitor vulnerabilities post-market
- Maintain update and patch schedules
- Document how risks are managed for both active and legacy devices
- Align with secure-by-design and secure-by-default principles
This shift demands not only technical expertise, but also clear strategies, documentation, and dedicated resources, which can stretch internal teams.
Why Managed Support Makes Sense
For many businesses, these changes create operational pressures. Navigating regulatory complexity, maintaining compliance over time, and defending against cyber threats all require more than a one-off effort. It is an ongoing responsibility that spans risk management, software inventory, technical documentation, and system design.
That is where Amicis Group comes in.
Our cybersecurity specialists work with businesses to assess, improve and manage their cybersecurity posture as part of a secure-by-design framework. Whether you are preparing for a 510(k) submission or need long-term lifecycle support, we help ensure that your systems, processes and documentation meet the evolving expectations of regulators and customers alike.
Next Steps for your FDA 510(k) Update
The FDA 510(k) update is not just a regulatory change — it is a business upgrade opportunity. Businesses that embrace cybersecurity now will be better positioned to gain approvals, protect patient safety, and stay competitive in a complex digital market.
If you are unsure how these changes apply to your devices or need support aligning your systems to the new expectations, Amicis Group can help.
Call us today on 0333 305 5348 or email hello@amicisgroup.co.uk to discuss your needs.
Please also visit our Medical Device Cyber Security page.
