SOW Line-Item Checklist

Free Guide · Blue Goat Cyber · Updated 2026

CHECKLIST · 1 PAGE · PROSPECT RESOURCE

SOW Line-Item Justification Map Audit your cybersecurity SOW against FDA premarket requirements.

Use this to confirm that every line in your cybersecurity SOW maps to a specific FDA-expected artifact - and to surface any line items that do not.

Required premarket artifacts Secure Product Development Framework (SPDF) authored to the Feb 3, 2026 guidance?

Threat model covering all system boundaries and trust zones?

Cybersecurity risk assessment aligned with AAMI TIR57?

Software Bill of Materials in CycloneDX or SPDX format?

Penetration test scoped to the device, with a remediation pass included?

Vulnerability Disclosure Statement and CVD plan?

Cybersecurity labelling content for end users?

Common over-scoping

Generic NIST CSF gap analyses unrelated to FDA submission?

Enterprise IT pen testing of company infrastructure (not the device)?

ISO 27001 implementation work bundled into a premarket SOW?

Continuous monitoring tooling priced into a one-time engagement?

Common under-scoping

No allowance for FDA Additional Information (AI) responses?

Postmarket monitoring obligations under Section 524B(b) excluded?

No defined remediation pass after penetration testing?

How to read it. If section one is incomplete, the SOW is under-scoped for FDA. If section two has matches, you may be paying for IT work that does not advance your submission.

NEXT STEP → Book a 20-minute SOW review and we'll mark up the line items against the FDA-expected artifact list. Book your discovery call: go.bluegoatcyber.com/meetings/blue-goat-cyber/discovery-session

Page 1 · © Blue Goat Cyber · 250+ FDA submissions, zero rejections, since 2014

---

Talk to us

This guide is part of Blue Goat Cyber's MedTech cybersecurity library. To apply it to your device program, book a 30-minute strategy session - no cost, no obligation. Or browse all guides.