Insights

Field notes from the MedTech security trenches.

Deep dives on FDA expectations, threat modeling, penetration testing, SDLC, and the standards your team is being asked to meet.

FDA· Jul 22, 2026

Q-Sub vs Pre-Sub: FDA Cybersecurity Feedback Guide

Q-Sub vs Pre-Sub for FDA cybersecurity: what they are, how they differ, and when to use a Pre-Submission to de-risk Section 524B threat models, SBOMs, and pen tests.

#FDA#Pre-Sub#Q-Sub

Read article

Standards· Jul 21, 2026

AAMI SW96 vs TIR57: Did SW96 Replace It?

AAMI SW96 didn't formally replace TIR57, but SW96 is now the FDA-recognized normative standard. Here's what changed and what the FDA expects in 2026.

#AAMI SW96#AAMI TIR57#FDA

Read article

FDA· Jul 21, 2026

FDA SIR Cybersecurity Response: eSTAR Prep Guide

FDA Submission Issue Request (SIR) response strategy for cybersecurity: eSTAR prep checklist, common 524B gaps, and how to answer without restarting review.

#FDA#eSTAR#Cybersecurity

Read article

FDA· Jul 10, 2026

Medical Device Pen Testing: FDA vs EU MDR 2026

Medical device pen testing under FDA vs EU MDR: the 5 FDA report elements, MDR Annex I §17.2/17.4, and how one report serves both submissions.

#FDA#EU MDR#Penetration Testing

Read article

FDA· Jul 10, 2026

Mining FDA Databases for Cybersecurity Precedent

A five-source workflow (510(k), De Novo, PMA, MAUDE, FOIA) for mining FDA cybersecurity precedent by product code before a Section 524B filing.

#FDA#510(k)#De Novo

Read article

Compliance· Jul 10, 2026

FDA PCCP Beyond AI: Cybersecurity, Firmware Uses | Blue Goat

The FDA PCCP guidance isn't AI-only. Use a predetermined change control plan for cybersecurity patches, firmware updates, and SBOM component swaps.

#PCCP#Section 524B#Firmware

Read article

Fundamentals· Jul 7, 2026

When to Start Medical Device Cybersecurity

You're two years into product development and still "not ready" for cybersecurity? You're already late.

#Primer

Read article

Standards· Jul 7, 2026

How SPDF Maps to IEC 81001-5-1 Activities

A phase-by-phase mapping of the FDA's SPDF onto IEC 81001-5-1 activities, so dual FDA + EU submissions produce one artifact set instead of two.

#Primer

Read article

Standards· Jul 7, 2026

IEC 81001-5-1 vs IEC 62304 for Medical Devices

IEC 62304 governs the software lifecycle. IEC 81001-5-1 adds security activities on top.

#Primer

Read article

Standards· Jul 7, 2026

How JSP2 and MDS2 Fit Together for Medtech

JSP2 is a development framework, MDS2 is a procurement disclosure form. Here's how the two artifacts complement each other across the device lifecycle.

#Primer

Read article

Standards· Jul 7, 2026

JSP2 vs SPDF vs IEC 81001-5-1: Framework Pick

The FDA lists JSP2, SPDF, IEC 81001-5-1, and ISA/IEC 62443-4-1 as acceptable cybersecurity frameworks. Here's how to actually pick one for your submission.

#Primer

Read article

FDA· Jul 2, 2026

Premarket FDA Cybersecurity Checklist

The premarket FDA cybersecurity submission checklist medical device teams use to pass 510(k) and PMA review under Section 524B and the 2026 guidance.

#Primer

Read article

Ready when you are

Get FDA cleared without the cybersecurity headaches.

30-minute strategy session. No cost, no commitment - just answers from people who've shipped 250+ FDA submissions.