Class III / De Novo cyber experience
- Blue Goat
- Submissions across Class II + III + De Novo
- PMA consultant without cyber depth
- Cyber treated as add-on to regulatory work
- In-house
- Built clause-by-clause from statute
PMA & De Novo Cybersecurity
PMA & De Novo Cybersecurity Submissions
Device risks and available evidence determine cybersecurity documentation and testing for PMA and De Novo. Scope can include architecture, threat modeling, SBOM work, testing, labeling, and vulnerability management planning. 275+ FDA submissions supported, zero cybersecurity rejections.
PMA and De Novo cybersecurity submission services aligned to the FDA February 2026 final guidance.
Request a written scope instead- Fixed fee after scoping
- Uncontrolled-risk retests included
- Deficiency responses covered
275+ FDA submissions supported, zero cybersecurity rejections.
Last updated
Included in your agreed scope
- PMA & De Novo cybersecurity sections
- Multi-patient harm threat model
- Full-scope penetration testing
- SPDF + QMSR / ISO 13485 integration
- Postmarket cybersecurity management plan
- Major Deficiency / hold-letter response support
Trusted by medical device teams worldwide
Lifecycle scope
What's different about PMA & De Novo cybersecurity
The proposal identifies included deliverables, exclusions, manufacturer inputs, and review responsibilities for this engagement.
01
Multi-patient harm view
Architecture documentation considers global system, multi-patient harm, updateability, and security use cases as applicable. Device risks determine breadth; architecture views and threat modeling remain distinct.
02
Full pen-test scope
The proposal identifies included versions, interfaces, access, and exclusions. Deliverables include the Test Plan, Test Cases, Test Report, and scoped retest evidence.
03
SPDF inside your QMS
Device SPDF records support traceability. Cybersecurity procedure revisions and implementation support are separately scoped within the existing QMS, which your quality team owns.
04
Postmarket plan that holds up
Planning covers monitoring, CVD, response responsibilities, and vulnerability handling. Update processes support (b)(2). Ongoing postmarket operations are separately agreed.
05
Major Deficiency response
Review the actual letter and deadline before agreeing point-by-point technical responses, evidence updates, and any testing needed. Your regulatory team reviews and submits.
06
Pre-Sub (Q-Sub) support
We can scope cybersecurity questions and briefing materials for a Pre-Submission meeting. Feedback does not guarantee acceptance or a regulatory outcome.
Illustrative security checks
Where PMA & De Novo cyber submissions get stopped
These are device-specific evidence review areas, not predictions of findings or regulatory action.
Single-patient threat model only
Threat model considers harm to one patient but not the multi-patient cascade, the failure mode FDA expects to see addressed on PMA-class devices.
Pen test scope misses cloud or RF
Device-only pen test with no cloud API or wireless coverage. Reviewers flag the missing attack surface and the submission stalls.
SPDF documented but not integrated
SPDF exists as a standalone document with no traceability into design controls, ECOs, or risk management. Reviewers ask for the integration evidence.
Postmarket plan is aspirational
Postmarket cybersecurity management plan describes what you intend to do, not what is operational. Reviewers want evidence the program exists today.
No interoperability or compensating controls
Device connects to clinical networks or shared infrastructure with no documented compensating controls for the connected environment.
Risk file not updated for cybersecurity
ISO 14971 risk file does not include cybersecurity-driven hazards or controls. Mandatory under AAMI TIR57 alignment and called out by reviewers.
What happens after you book the call
- 1Scoping
Review your device and evidence
Discuss architecture, available records, access, responsibilities, and target dates. Agree confidential handling before transferring device material.
- 2Proposal
Agree deliverables, fee, and dates
The proposal identifies included work, exclusions, manufacturer inputs, and delivery milestones. The 24-hour quote turnaround is separate from delivery, remediation, and review time.
- 3Agreed dates
Build, test, and hand over
Build the agreed threat model, SBOM, architecture, security testing evidence, labeling, and vulnerability management plan. Your regulatory team reviews and assembles the submission.
"Blue Goat's niche expertise in FDA-facing cybersecurity made all the difference. Their reports were built with the FDA's expectations in mind; it gave us confidence that we were submitting exactly what reviewers want to see."
Blue Goat Cyber vs. the alternatives
What you actually get versus a PMA consultant without cyber depth, or building Class III cyber evidence in-house.
SPDF + threat model + SBOM; VEX optional
- Blue Goat
- Integrated, reviewer-format
- PMA consultant without cyber depth
- Piecemeal across subcontractors
- In-house
- Multiple owners, integration gaps
Postmarket commitments documented
- Blue Goat
- CVD + monitoring + patch SLAs
- PMA consultant without cyber depth
- Premarket only
- In-house
- Deferred until audit
Submission track record
- Blue Goat
- 275+ FDA submissions supported, zero cybersecurity rejections.
- PMA consultant without cyber depth
- Variable, cyber-specific track unclear
- In-house
- First-submission risk
Pricing model
- Blue Goat
- Fixed fee, revisions included
- PMA consultant without cyber depth
- Hourly + change orders
- In-house
- Hidden internal cost
| Capability | Blue Goat Cyber | PMA consultant without cyber depth | In-house |
|---|---|---|---|
| Class III / De Novo cyber experience | Submissions across Class II + III + De Novo | Cyber treated as add-on to regulatory work | Built clause-by-clause from statute |
| SPDF + threat model + SBOM; VEX optional | Integrated, reviewer-format | Piecemeal across subcontractors | Multiple owners, integration gaps |
| Postmarket commitments documented | CVD + monitoring + patch SLAs | Premarket only | Deferred until audit |
| Submission track record | 275+ FDA submissions supported, zero cybersecurity rejections. | Variable, cyber-specific track unclear | First-submission risk |
| Pricing model | Fixed fee, revisions included | Hourly + change orders | Hidden internal cost |
Support matched to your scope
If the FDA raises a cybersecurity question, we answer it at no extra cost until the cybersecurity portion is closed.
Mutual NDA before the call
We sign a mutual NDA before the initial call so you can share device details, architecture, and FDA correspondence freely.
Fixed-fee quote within 24 hours of the call
The quote identifies deliverables, assumptions, and dates. Quote turnaround is separate from the time needed to deliver the work.
Senior US engineers, fixed fee
Senior-led cybersecurity work within the agreed scope. Your team reviews the evidence and owns risk, release, and submission decisions.
Common questions
How is PMA cybersecurity different from 510(k)?
Device architecture, intended use, risk, and available evidence determine depth. PMA and 510(k) use different regulatory pathways, but a pathway label does not automatically prescribe testing coverage or a fielded postmarket program.
Do De Novo submissions need the same cybersecurity package as PMA?
Not automatically. De Novo establishes classification for a novel device; it is not synonymous with a PMA risk class. We scope evidence to the device, applicable obligations, and regulatory plan.
Can you support a Pre-Submission (Q-Sub) meeting?
Yes. We frame the cybersecurity questions for the Q-Sub, draft the briefing package, and join the call if you want a senior cyber voice in the room.
What happens if we get a Major Deficiency Letter?
We review the actual letter and deadline, then agree technical response work, documentation updates, and testing. Your regulatory team reviews and submits the response. The FDA decides the outcome.
How long does a full PMA cyber package take?
Dates follow review of scope, available evidence, test access, and manufacturer inputs. Engineering fixes, retests, and regulatory review are separate milestones. No universal duration applies.
Who you're talking to
Christian Espinosa, Founder & CEO
MBA, CISSP · U.S. Air Force Academy graduate · 30+ years in cybersecurity
Christian leads the senior medical device cybersecurity team behind 275+ FDA submissions supported, zero cybersecurity rejections. Author of three books including Medical Device Cybersecurity: An In-Depth Guide.
Ready to talk to a senior expert?
30 minutes with a senior medical device cybersecurity engineer. Mutual NDA signed before the call. No pitch, we'll tell you straight if you don't need us.
Replies in 1 business dayMutual NDA firstUS-based senior engineerNo sales pitch