Question 1

Does the FDA require an SBOM for medical devices?

Accepted Answer

For cyber devices, yes. Section 524B(b)(3) requires a machine-readable SBOM in the premarket submission, and has since March 2023. From October 2023 the FDA can refuse a submission that arrives without one.

Question 2

What is a cyber device under Section 524B?

Accepted Answer

A device that runs software, can reach the internet or another network directly or indirectly, and could be exposed to a cybersecurity threat. That covers most connected devices and software as a medical device.

Question 3

What SBOM format does the FDA accept?

Accepted Answer

CycloneDX or SPDX, supplied as machine-readable JSON or XML with a human-readable copy alongside it. A PDF or spreadsheet on its own does not meet the requirement.

Question 4

What does a compliant medical-device SBOM have to contain?

Accepted Answer

The NTIA minimum elements for every component: supplier, name, version, a purl or CPE identifier, dependency relationships, and the SBOM's author and timestamp. Beyond that, the FDA asks for each component's level of support and end-of-support date, the known vulnerabilities, and exploitability through VEX. It also has to stay current as the software changes.

Question 5

What cybersecurity metrics does the FDA want?

Accepted Answer

Three, reported in the premarket submission and in PMA annual reports: the share of vulnerabilities you have patched (defect density), the time from finding a vulnerability to a patch (patch velocity), and the time from a patch being ready to its full rollout in the field, which Interlynk calls Deploy Velocity.

Question 6

Does the EU MDR require an SBOM?

Accepted Answer

Not by name. Annex I 17.2 requires security that meets the state of the art, and the MDCG 2019-16 guidance expects the kind of vulnerability monitoring only an SBOM makes practical, so an SBOM is now effectively the standard.

Question 7

Does the EU Cyber Resilience Act apply to medical devices?

Accepted Answer

No. The CRA exempts devices regulated under the MDR and IVDR to avoid regulating them twice, so your route in Europe runs through the MDR. The CRA's SBOM and vulnerability-handling expectations still shape what state of the art means under the MDR.

Question 8

Can one SBOM satisfy both the FDA and the EU?

Accepted Answer

Yes. The work is the same on both sides, so a complete, current, machine-readable SBOM can be exported in whatever format each submission calls for. You build the capability once and reuse it.

Question 9

What happens if I submit to the FDA without an SBOM?

Accepted Answer

The FDA can issue a Refuse-to-Accept, which means the submission does not enter substantive review until you fix the gap. That usually costs weeks and reads as a wider problem in the cybersecurity program.

Nieuw

SBOM voor embedded C/C++

Interlynk · SBOM-compliance voor medische hulpmiddelen

Interlynk · SBOM-compliance voor medische hulpmiddelen

Interlynk · SBOM-compliance voor medische hulpmiddelen

Indieningsklare SBOM voor FDA 524B.

Indieningsklare SBOM voor FDA 524B.

Indieningsklare SBOM voor FDA 524B.

HET PROBLEEM

HET PROBLEEM

HET PROBLEEM

FDA 524B maakt van SBOM's indieningsbewijs.

FDA 524B maakt van SBOM's indieningsbewijs.

WAT DE FDA VERWACHT

WAT DE FDA VERWACHT

WAT DE FDA VERWACHT

Het 524B-bewijspakket, geautomatiseerd.

Het 524B-bewijspakket, geautomatiseerd.

Machineleesbare SBOM

Kwetsbaarheidsmonitoring

Secure-by-design-bewijs

Audit- en indieningsgereedheid

524B-CHECKLIST

524B-CHECKLIST

524B-CHECKLIST

Wat beoordelaars vragen, en wat Interlynk levert.

Wat beoordelaars vragen, en wat Interlynk levert.

HOE INTERLYNK HELPT

HOE INTERLYNK HELPT

HOE INTERLYNK HELPT

Eén workflow, van buildbewijs tot FDA-respons.

Eén workflow, van buildbewijs tot FDA-respons.

Genereren

Valideren

Monitoren

Rapporteren

FAQ

FAQ

FAQ

FDA 524B-vragen, beantwoord.

FDA 524B-vragen, beantwoord.

FDA 524B-vragen, beantwoord.

Vereist de FDA een SBOM voor medische hulpmiddelen?

Wat is een cyber-apparaat onder Section 524B?

Welk SBOM-formaat accepteert de FDA?

Wat moet een conforme SBOM voor een medisch hulpmiddel bevatten?

Welke cyberbeveiligingsmetrieken wil de FDA?

Vereist de EU-MDR een SBOM?

Is de EU Cyber Resilience Act van toepassing op medische hulpmiddelen?

Kan één SBOM zowel aan de FDA als aan de EU voldoen?

Wat gebeurt er als ik bij de FDA indien zonder SBOM?

Audit-klare SBOM. Bij elke build.

Audit-klare SBOM. Bij elke build.

Audit-klare SBOM. Bij elke build.

Functies

SBOM-automatisering

Open source-beheer

Leveranciersmonitoring

Post-quantumgereedheid

LynkMCP

Oplossingen

FDA 524B-compliance

CRA-compliance

Embedded C/C++ SBOM

Hulpbronnen

Gidsen

Blog

Nieuws

Docs

Opensource-tools

Vergelijkingen

Bedrijf

Over ons

Contact

Privacybeleid

Functies

SBOM-automatisering

Open source-beheer

Leveranciersmonitoring

Post-quantumgereedheid