Checklist: Cyber Device (Section 524B) Applicability Determination

This is a ready-to-use checklist for one specific, narrow question: is this device, or this device constituent of a combination product, a cyber device under section 524B of the FD&C Act. It is a gating determination separate from the Documentation Level (Basic/Enhanced) determination and separate from the IEC 62304 software safety classification; all three are commonly needed for the same product but answer different questions. Replace every <<FILL: ...>> placeholder with your own specifics. A filled specimen follows.

Document control header

Field	Entry
Checklist title	Cyber Device (Section 524B) Applicability Determination
Document number	`<<FILL: CHK-ID, e.g. CHK-SEC-007>>`
Product / device constituent	`<<FILL: product name>>`
Completed by	`<<FILL: name, role>>`
Date	`<<FILL: date>>`

Instructions

Answer each item in order; all three statutory items must be “Yes” for a cyber device.

Stop and record “Not a cyber device” as soon as one of the first three items is “No.”
Still complete the proportionate-security note at the end, since FDA may expect reasonable security content even outside section 524B.

The checklist

#	Item	Yes / No	Evidence / basis
1	Does the device include software, including firmware or programmable logic, that is validated, installed, or authorized by the sponsor?	`<<FILL>>`	`<<FILL: architecture reference>>`
2	Can the device connect to the internet, directly or indirectly (including through a paired phone app, a gateway, or a cloud service the app reaches)?	`<<FILL>>`	`<<FILL: connectivity diagram or data flow reference>>`
3	Does the device contain technological characteristics that could be vulnerable to cybersecurity threats?	`<<FILL>>`	`<<FILL: threat model reference>>`
4	Is the device, or is it a constituent part of, a combination product under 21 CFR 3.2(e)?	`<<FILL>>`	`<<FILL: PMOA determination reference, if applicable>>`
5	If item 4 is Yes, has the lead FDA review division been confirmed for this submission?	`<<FILL>>`	`<<FILL: pre-submission meeting minutes or OCP correspondence>>`

Determination

Field	Entry
Items 1 through 3 all “Yes”?	`<<FILL: Yes / No>>`
Resulting status	`<<FILL: Cyber device, section 524B applies in full / Not a cyber device>>`
If “Not a cyber device,” proportionate security content still planned	`<<FILL: describe, or "None, rationale documented">>`
Linked determinations	Documentation Level: `<<FILL: Basic/Enhanced>>`; IEC 62304 class: `<<FILL: A/B/C>>`

Acceptance criteria

Each of the three statutory items has a documented basis, not only a yes/no mark.
“Internet connectivity” is assessed to include indirect paths (a paired app reaching a cloud service), not only a direct network interface on the device itself.
For a combination-product constituent, the lead review division is confirmed and recorded before this checklist is finalized.
The determination is cross-checked against the Documentation Level and IEC 62304 classification so the three outputs are consistent with each other.
A “Not a cyber device” outcome still records whether proportionate security content will be included anyway.

References

Section 524B, Federal Food, Drug, and Cosmetic Act. 21 CFR 3.2(e) (combination product definition) and 21 CFR 4.2 (cGMP requirements for combination products). FDA guidance, Cybersecurity in Medical Devices: Quality Management System Considerations and Content of Premarket Submissions (current version; confirm the version in force).

Revision history

Version	Date	Author	Summary of change
`<<FILL: 1.0>>`	`<<FILL: date>>`	`<<FILL: author>>`	Initial issue.

Approvals

Role	Name	Signature	Date
Completed by	`<<FILL>>`
Reviewed by (Product Security)	`<<FILL>>`
Approved by (Regulatory Affairs)	`<<FILL>>`

Filled specimen

#	Item	Yes / No	Evidence / basis
1	Includes sponsor-validated software/firmware?	Yes	Dose-computation firmware and companion app, both built and signed in-house
2	Can connect to the internet, directly or indirectly?	Yes	Companion app pairs over Bluetooth and syncs dosing logs to a cloud service
3	Contains technological characteristics that could be vulnerable?	Yes	Threat model THM-2026-014 identifies the pairing exchange and the cloud sync channel as attack surfaces
4	Constituent part of a combination product?	Yes	Biologic-led injector system, PMOA determination PMOA-2026-0031
5	Lead review division confirmed?	Yes	CBER, Office of Therapeutic Products, confirmed 14 May 2026

Determination: items 1 through 3 are Yes, so the device is a cyber device under section 524B.

Documentation Level: Enhanced, the combination-product default.
IEC 62304 class: C, for the dose-computation module.
The same product is independently Enhanced, a cyber device, and Class C; the three determinations happen to agree here but none is derived from the others.

Common inspection findings this checklist prevents

A device treated as outside section 524B because its direct network interface is absent, while a paired app’s cloud connection was never assessed as an indirect path.
A cyber device determination made without reference to the combination-product status, so the lead review division question surfaces only when the submission is already assembled.
A “not a cyber device” conclusion with no record of whether any proportionate security content was still planned.

How to adapt this checklist

Set your document number and complete the header for each product or device constituent separately; do not reuse one completed checklist across multiple products.
Link items 1 through 3 to a specific architecture diagram, data flow diagram, and threat model rather than a general statement.
For a combination product, do not finalize this checklist until the lead review division is confirmed in writing.