Deep dives on FDA expectations, threat modeling, penetration testing, SDLC, and the standards your team is being asked to meet.
Showing 12 of 272 articles · Page 1 of 23
How SPDF activities map to IEC 62304 software lifecycle processes - the exact crosswalk FDA reviewers expect, where they overlap, and where 62304 falls short.
Read article
The threat intelligence sources medical device manufacturers should monitor to satisfy FDA Section 524B postmarket obligations: H-ISAC, CISA KEV, ICS advisories, NVD, MITRE ATT&CK for ICS, and vendor PSIRTs.
Read article
A subsection-by-subsection walkthrough of FDA Section 524B for cyber medical devices: what 524B(a), (b)(1), (b)(2), (b)(3), (b)(4), and (c) require, what artifacts satisfy each, and the deficiency patterns reviewers flag most.
Read article
How to run CAPA for medical device cybersecurity findings: when a vulnerability or FDA deficiency triggers a CAPA, what evidence closes it, and how the QMSR loop ties to 524B postmarket obligations.
Read article
FMEA covers random and systematic failure modes; threat modeling covers adversarial action. Both are required for a 524B submission, and they do not substitute for each other. Here is how to scope them, link them, and avoid the gap.
Read article
How HHS 405(d) and the Health Industry Cybersecurity Practices (HICP) Medical Device Security practice maps to FDA Section 524B artifacts, and how manufacturers should align their premarket and postmarket programs to satisfy both reviewers and hospital procurement.
Read article
What the FDA's Feb 3, 2026 guidance expects for penetration test recency, version-match, post-change re-testing, and pre-submission remediation, plus when a delta re-test will do and when you need a full one.
Read article
When HIPAA applies to medical device manufacturers, how the 2025 Security Rule NPRM raises the bar, and how HIPAA obligations intersect with the FDA's Feb 2026 premarket cybersecurity guidance.
Read article
Which EHR and EMR systems medical devices connect to (Epic, Oracle Health, MEDITECH, Allscripts, athenahealth), the integration protocols (HL7, FHIR, DICOM), and the cybersecurity risks the FDA expects you to document.
Read article
What the CISA Known Exploited Vulnerabilities (KEV) catalog is, how medical device manufacturers should use it in SBOM/VEX triage, and how the FDA treats KEV-listed CVEs.
Read article
How Health Canada regulates medical device cybersecurity in 2026: pre-market license expectations, MDEL obligations, and how to reuse an FDA Section 524B package.
Read article
What the FDA expects from infusion pump cybersecurity submissions in 2026: threat model focus areas, Section 524B evidence, and the deficiencies that delay clearance.
Read article30-minute strategy session. No cost, no commitment - just answers from people who've shipped 250+ FDA submissions.
