For devices stuck on Windows 10 IoT, RHEL 7, end-of-life kernels, or unsupported chipsets. Identify factors for manufacturer review, record proposed controls and evidence, and export a draft memo. This tool cannot accept residual risk or predict FDA acceptance.
Reviewed by
Christian Espinosa
Founder & CEO, Blue Goat Cyber
Risk factors present
Proposed controls to verify
What you'll see after you submit
Common misconceptions
Myth: EOS components are an automatic submission blocker.
Reality: Assess device-specific risk, supportability, control effectiveness, and applicable submission evidence. End-of-support status alone does not determine acceptance or rejection.
Myth: A vendor LTS contract is enough on its own.
Reality: Verify the actual support scope and effectiveness. Consider other controls based on the threat model; a support contract alone does not establish acceptable residual risk.
References & further reading
Tracked signals that change what reviewers expect. Items move on as new ones land.
RHEL 7 Extended Life Support phase ends - devices on RHEL 7 need a compensating-controls memo
CISA adds use-after-free in Linux kernel netfilter to KEV (CVE-2026-0511)
AI-letter analysis - 62% of FDA cyber deficiencies cite a missing or stale CVD URL
SLSA v1.1 published - tightened build-provenance language for regulated industries
Hands-on support to put the controls in place.
Read Legacy device cybersecurity servicesShow the threats the controls mitigate.
Read Threat Model StarterSet the monitoring SLA that backs up the memo.
Read Postmarket Cadence Calculator