A written fixed-fee quote after scoping. No public tier prices, automatic retainer inclusion, or one-size-fits-all procedure package.
An agreed procedure and supporting forms, drafted or revised in your document format. The quote identifies the topic, inputs, review work, and handoff.
Agreed gap review, procedure revisions, record templates, evidence mapping, responsibilities, and rollout support across the selected processes.
Procedure and form names, product scope, evidence inputs, process-owner reviews, agreed revisions, delivery dependencies, training or rollout support, and the fixed fee. Work outside the agreed scope requires a separately agreed scope change.
Device-specific threat modeling, SBOM generation, and penetration testing are not automatically included in SOP drafting. Neither are full QMS implementation, certification, or general software verification and validation. A consulting retainer remains separate unless expressly included in the agreed scope.
Your quality team owns procedure approval, implementation, training records, and ongoing maintenance. Your manufacturer retains clinical-risk evaluation, risk acceptance, and release decisions.
Medical device advisories and safety communications, with links to original sources. An alert is a reason to assess applicability, not proof that your device is affected.
Connect threats to controls and test evidence. Compare the CISA 2026 SBOM fields with the NTIA 2021 baseline the FDA still cites, plus its support fields. Guidance recommendations remain separate from statutory duties.
Fixed-fee engagement
Included work is defined in the signed proposal. These scope options are not automatic inclusions in every engagement.
A written fixed-fee quote after scoping. The proposal names deliverables, versions, assumptions, required inputs, exclusions, and agreed dates. Additional work requires a separately agreed scope change. Missing inputs, access restrictions, manufacturer fixes, and review feedback can affect delivery.
