Legacy / EOS triage

Legacy / End-of-Support Component Triage

For devices stuck on Windows 10 IoT, RHEL 7, end-of-life kernels, or unsupported chipsets. Score the residual risk, capture the compensating controls, and export a memo a reviewer will accept.

Risk factors + controls → reviewer-ready compensating-controls memo

• Frames the legacy component the way the FDA's TPLC guidance asks you to: risk, control, residual, exit plan.
• Each compensating control comes with a clear submission-evidence line so you know exactly what to attach.
• Markdown export drops straight into the cybersecurity risk-management report.

What teams usually get wrong

• Myth: EOS components are an automatic submission blocker.

  Reality: They aren't - but only if you document the residual risk and the compensating controls in a way the reviewer can verify. Hand-waving gets a deficiency letter.

• Myth: A vendor LTS contract is enough on its own.

  Reality: It's a strong control, but reviewers also want to see segmentation, monitoring, and an exit plan with a date.

Primary sources behind this tool

1. FDA Postmarket Management of Cybersecurity in Medical Devices - FDA
2. FDA Total Product Lifecycle (TPLC) approach to cybersecurity - FDA
3. ANSI/AAMI SW96:2023 - Standard for Medical Device Security - AAMI

Pair with

Make the memo defensible.