Rehearse a cybersecurity incident on your marketed device before it happens. Part of our postmarket program, scoped to your device and response plan.
Part of FDA postmarket cybersecurity services.
Each exercise uses one scenario adapted to your device. These are starting points, not a fixed menu.
A security researcher contacts you about a remotely exploitable vulnerability in a fielded device and plans to publish in 45 days.
Tests: Disclosure intake, triage, patient-harm assessment, and customer communication.
A component in your SBOM is added to the CISA Known Exploited Vulnerabilities catalog on a Friday afternoon.
Tests: Exploitability assessment, out-of-cycle patch decision, and compensating controls.
A hospital customer reports ransomware on its network and asks whether your devices are affected or spreading it.
Tests: Evidence preservation, containment guidance, and coordination with the customer.
Your update server or cloud platform shows signs of unauthorized access affecting many patients at once.
Tests: Multi-patient impact, service shutdown decisions, and recovery.
Agree objectives, participants, the device and versions in scope, your current response plan, and whether the session is remote or on-site.
We build a device-specific scenario with timed injects from your architecture, threat model, SBOM, and deployment environment.
A discussion-based session, usually half a day, with engineering, product security, regulatory, quality, and customer-facing teams.
Response gaps, decision points, action owners, and priorities for updating your incident response plan.
A typical half-day session. Timing and injects are adjusted to your scenario and team.
Objectives, ground rules, roles, and the device and versions in scope.
The initial report or alert arrives. Who receives it, how is it logged, and who is told?
Exploitability, affected versions, and patient-safety impact. Who decides severity?
The situation worsens. Containment, customer guidance, and communication with regulators and researchers.
Patch or mitigation, field rollout, and confirming the fix reached deployed devices.
What worked, what was unclear, and where the response plan did not match what people did.
Agree action owners and next steps for the after-action report.
A tabletop exercise can be included with your postmarket retainer by agreement. Additional or standalone exercises are priced on exercise scope, delivery location, on-site requirements. You get a written price after a short scoping call.
Tell us about your device, your team, and whether you want remote or on-site. We reply within one business day to schedule scoping.
Medical device advisories and safety communications, with links to original sources. An alert is a reason to assess applicability, not proof that your device is affected.
Connect threats to controls and test evidence. Compare the CISA 2026 SBOM fields with the NTIA 2021 baseline the FDA still cites, plus its support fields. Guidance recommendations remain separate from statutory duties.
Fixed-fee engagement
Included work is defined in the signed proposal. These scope options are not automatic inclusions in every engagement.
A written fixed-fee quote after scoping. The proposal names deliverables, versions, assumptions, required inputs, exclusions, and agreed dates. Additional work requires a separately agreed scope change. Missing inputs, access restrictions, manufacturer fixes, and review feedback can affect delivery.
