Advisory FAQ: premarket, submission, and postmarket

Premarket: designing the device

Can we start the advisory before we have a submission date?

Yes. Many teams start during design. Your advisor joins design reviews, helps set security requirements, and keeps the threat model in step with the design, so the FDA package is built as you go instead of at the end.

What does the advisor do during design and development?

Reviews architecture changes for security impact, keeps the threat model and security risk file current, helps pick secure components, and answers questions from engineering and quality as they come up.

Do we still need a separate threat modeling project?

Sometimes. If you have no threat model yet, a fixed-fee threat modeling project builds it, and the advisor keeps it current afterward. If you already have one, the advisor can maintain it from there.

Does the advisor help with our Secure Product Development Framework (SPDF)?

Yes. The advisor helps you set up and follow SPDF activities in your existing quality system, so the FDA sees security as part of how you build the device.

Submission: getting ready and getting through review

Does the advisory cover our FDA premarket submission?

It covers the ongoing work around it: keeping documents consistent, preparing security content for eSTAR, scoping penetration testing, and answering reviewer questions. A full premarket cybersecurity package is a separate fixed-fee project, and your advisor helps scope it.

Is penetration testing included?

No. Penetration tests are separate fixed-fee projects. Your advisor helps plan the scope and timing so the test report lines up with your submission.

What if we get an FDA deficiency letter?

Your advisor already knows your device and files, so the response starts from current evidence. A full deficiency response is scoped as a separate fixed-fee project if new work is needed.

Can the advisor help with PCCPs and later submissions?

Yes. The advisor prepares security content for planned changes, PCCPs, and new submissions, so each one starts from files that are already up to date.

Postmarket: after clearance

What does the advisor do after FDA clearance?

Reviews new vulnerabilities in your components each week, rates patient risk, helps decide on patches and customer notices, and keeps the SBOM, threat model, and risk file current as the device changes.

Does it help with Section 524B postmarket obligations?

Yes. The advisor helps you run the vulnerability monitoring, disclosure, and update processes you described in your submission, and keeps the records that show you followed them.

Can the advisor answer hospital security questionnaires?

Yes. The advisor helps answer hospital security reviews and MDS2 questions using your current files, so sales don't stall after clearance.

How is this different from SBOM monitoring?

SBOM monitoring flags new CVEs. The advisor decides what they mean for your device and patients, and what to do next.

How the retainer works

How much does it cost?

Starting at $5,000 a month, billed as a fixed monthly retainer.

Will we work with the same person each week?

Yes. You get a named senior advisor who learns your device.

Is this a CISO or IT security service?

No. It covers medical device product security: the device, its software, apps, and cloud. It doesn't cover your company's internal IT.

How do we start?

Send a request. We reply within one business day to set up a short call about your device and team, then confirm a start date.

Related services

• FDA premarket cybersecurity
• Medical device penetration testing
• FDA postmarket cybersecurity