Premarket eSTAR cybersecurity documentation

What eSTAR is and where cybersecurity fits

eSTAR is FDA's interactive PDF form for preparing a complete premarket submission. FDA requires it for 510(k) and De Novo submissions to CDRH and CBER unless exempted, and treats it as voluntary for PMA.

The form is the container. What goes into the cybersecurity attachments comes from FDA's guidance, Cybersecurity in Medical Devices: Quality Management System Considerations and Content of Premarket Submissions (February 3, 2026), and from Section 524B of the FD&C Act for cyber devices. Appendix 4 of the guidance maps the documents. FDA says the table is not meant to serve as merely a deliverable checklist, and it remains the most reliable list of what a reviewer expects to find.

The documents a reviewer looks for

Each item below maps to a section of the guidance.

• Threat model. Assets, interfaces, threats and mitigations across the whole system, with the rationale for the method chosen (Section V.A.1).
• Security architecture views. A global system view, a multi-patient harm view, an updatability and patchability view, and use case views for functions where a compromise could touch safety (Section V.B.2).
• Cybersecurity risk assessment. A separate document from the ISO 14971 safety risk assessment, scored on exploitability before and after mitigation (Section V.A.2).
• SBOM and vulnerability assessment. A machine-readable SBOM with level of support and end-of-support date per component, and an assessment of every known vulnerability (Sections V.A.4 and 524B(b)(3)).
• Unresolved anomalies assessment. Open software anomalies evaluated for security impact (Section V.A.5).
• Measures and metrics. The three FDA metrics, tracked from the first release (Section V.A.6).
• Cybersecurity controls. Requirements and acceptance criteria across eight control categories, with evidence they were implemented and tested (Section V.B.1 and Appendix 1).
• Security testing documentation. The four test types, including the original penetration test report (Section V.C).
• Cybersecurity labeling. What users need to deploy, operate and respond (Section VI.A).
• Cybersecurity management plan. The postmarket commitments that satisfy 524B(b)(1) (Section VI.B).

The security risk management report wraps several of these and carries the traceability between the threat model, the risk assessment, the SBOM and the testing documentation.

Why submissions draw questions

Documents that disagree with each other cause more deficiency questions than any single weak document. A threat model lists an interface the architecture views omit, a risk assessment scores a component missing from the SBOM, or the controls table claims encryption the test report never exercised. Traceability is the check a reviewer runs, and teams tend to write it last.

For cyber devices the stakes are higher. FDA can find that a submission lacks reasonable assurance of cybersecurity, which it treats as part of safety and effectiveness (Section VII.E).

Build it, buy it, or split it

• In-house. Lowest cash cost. It needs a product security lead, a regulatory owner and one engineer who knows every interface and component.
• A consultancy writes the package. The fastest route for a first submission. Check that the provider maps its output to the eSTAR fields and works with your regulatory team on submission.
• Tooling compiles it from engineering data. Documents generated from one component inventory cannot contradict each other. The team still owns the content.
• Split. Common in practice: engineers keep the system description and the SBOM, a specialist writes the threat model and risk assessment, and an independent party tests.

Questions to ask a documentation provider

1. Which documents do you deliver, and how does each map to the guidance sections and the eSTAR fields?
2. Who owns the threat model and the system description after delivery?
3. How do you keep the threat model, risk assessment, SBOM, controls and test report consistent?
4. Is the traceability matrix part of the deliverable?
5. Do you cover the cybersecurity management plan and the metrics definitions?
6. Is support for FDA Additional Information requests included, and for how long?
7. How do documents get updated for a modification (Section VII.D) or the next release?
8. Which parts do you subcontract, and who signs the penetration test?

Before you file

• The SBOM opens and is machine-readable.
• Every architecture view is present, or explicitly justified as not applicable.
• The penetration test report is the original and states tester independence, scope, duration and methods.
• Deferred findings have a plan with a release and a date.
• The management plan names people, sources, cadence and timelines.
• The labeling list has an answer for every item.