We map the cybersecurity concerns in your FDA Refuse to Accept (RTA) letter to a rebuild plan and supporting evidence for your resubmission.
If the FDA raises a cybersecurity question, we answer it at no extra cost until the cybersecurity portion is closed.
275+ FDA submissions supported, zero cybersecurity rejections.
An RTA on cybersecurity grounds identifies concerns at the FDA acceptance stage. We review the letter and supporting documentation, then rebuild the cybersecurity evidence within the agreed scope for your eSTAR resubmission. Free 30-min discovery call.
Free 30-min call · Senior US expert · Mutual NDA before the call
Last updated
“The timeliness of this project exceeded my expectations; this was not my experience with other vendors.”
Tim Sandberg, Vice President of IT Operations, Matrix One
Trusted by medical device teams worldwide
The proposal identifies included deliverables, exclusions, manufacturer inputs, and review responsibilities for this engagement.
We map the cybersecurity items identified in your RTA letter to supporting artifacts and document remaining gaps for manufacturer review.
The rebuild plan is aligned to the February 2026 final premarket cybersecurity guidance and addresses the applicable Section 524B(b)(1)-(3) requirements. Acceptance decisions belong to the FDA.
SPDX is the default; CycloneDX can be agreed. Vulnerability assessments use device-specific evidence; VEX is optional manufacturer-reviewed communication.
Full threat model with multi-patient harm, updateability, and use-environment views. Aligned to AAMI TIR57 / ANSI/AAMI SW96.
Device, cloud, mobile, and wireless attack surfaces tested independently. Findings traced back to threat model and risk file.
One fixed-fee quote covers the agreed rebuild and retesting scope. If the FDA raises a cybersecurity question, we answer it at no extra cost until the cybersecurity portion is closed.
The RTA letter identifies the concerns to address. We review the items below against your letter and documentation to define the rebuild scope.
Review whether the applicable attestation and supporting cybersecurity evidence are included in the submission.
Review whether an SBOM is included and whether its contents and format address the concerns identified in the RTA letter.
A threat model may exist internally but be absent from the eSTAR cybersecurity attachments. Check the submitted attachments against the RTA letter.
Compare the documented test scope with the device's cloud, mobile, and wireless interfaces. Explain exclusions and identify evidence gaps.
Check whether the submission contains the relevant Secure Product Development Framework documentation and supporting evidence.
No customer security guide, no SBOM disclosure, no end-of-support communication. Reviewer cites missing transparency under 524B(b)(2).
What you actually get versus a generic regulatory consultant or scrambling to fix the cyber RTA findings in-house.
| Capability | Blue Goat Cyber | Generic regulatory consultant | In-house |
|---|---|---|---|
| RTA cybersecurity-checklist coverage | Identified cyber RTA items mapped to supporting deliverables | Regulatory focus, cyber items left thin | First time mapping the checklist |
| Speed to resubmission | Dates agreed after letter and evidence review | Hourly, drifts with scope | Competes with engineering work |
| eSTAR-attachable deliverables | Organized for attachment to the resubmission | Word docs that need reformatting | Reformatted each time |
| Track record | 275+ FDA submissions supported, zero cybersecurity rejections. | Variable, cyber-specific track unclear | First-submission risk |
| Pricing model | Fixed fee, revisions included | Hourly + change orders | Hidden internal cost |
Discuss architecture, available records, access, responsibilities, and target dates. Agree confidential handling before transferring device material.
The proposal identifies included work, exclusions, manufacturer inputs, and delivery milestones. The 24-hour quote turnaround is separate from delivery, remediation, and review time.
Update the artifacts and testing identified by the letter review. Deliver a point-by-point response with evidence references for your regulatory team to review and submit. The FDA decides the outcome.
"The timeliness of this project exceeded my expectations; this was not my experience with other vendors. Blue Goat Cyber delivered a thorough, detailed report and complete testing faster than I anticipated, without compromising quality."
If the FDA raises a cybersecurity question, we answer it at no extra cost until the cybersecurity portion is closed.
We sign a mutual NDA before the initial call so you can share device details, architecture, and FDA correspondence freely.
The quote identifies deliverables, assumptions, and dates. Quote turnaround is separate from the time needed to deliver the work.
Senior-led cybersecurity work within the agreed scope. Your team reviews the evidence and owns risk, release, and submission decisions.
Who you're talking to
MBA, CISSP · U.S. Air Force Academy graduate · 30+ years in cybersecurity
Christian leads the senior medical device cybersecurity team behind 275+ FDA submissions supported, zero cybersecurity rejections. Author of three books including Medical Device Cybersecurity: An In-Depth Guide.
30-minute call with a senior medical device cybersecurity expert. Fixed-fee quote within 24 hours of the scoping call. Your regulatory team reviews and submits the rebuilt evidence on separately agreed dates.
