Pick the issue. Get the SIR response template.

Choose the type of cybersecurity issue the FDA reviewer raised. We assemble the section-by-section template blocks and example verbiage you can paste into your eSTAR SIR response.

1. Choose the SIR issue type

Pick the category the reviewer flagged. Each category outputs a tailored restatement, direct answer, artifact pointer table, and citation set.

Choose the issue - get the SIR response blocks

• Four issue types: authentication, cryptography, vulnerability / CVE, SBOM / signing.
• Auto-assembled 6-section template: restatement, direct answer, artifact pointers, standards, verification, closing.
• Example reviewer ask verbatim so you know when this template applies.
• Per-issue cautions and a scope guard to keep you from turning a SIR into an AI letter.

What teams usually get wrong

• Myth: One SIR template fits every issue.

  Reality: Reviewers cite specific standards per issue type. A generic template misses the guidance section and triggers a follow-up SIR.

• Myth: A SIR is a chance to fix the design.

  Reality: SIRs are for clarifying or replacing artifacts. Design changes require a Special 510(k) or a Traditional 510(k) - never an in-line SIR response.

• Myth: Longer responses look more thorough.

  Reality: Reviewers reject scope creep. A tightly scoped 2-3 page answer closes faster than a 30-page dump.

• Myth: Citing 'our threat model' is enough.

  Reality: Cite the artifact, version, and section - and the FDA guidance or standard clause. Anonymous references get re-SIR'd.

Primary sources behind this tool

1. Cybersecurity in Medical Devices: QMS Considerations and Content of Premarket Submissions (Feb 3, 2026 final) - FDA
2. eSTAR Program for 510(k) submissions - FDA
3. NTIA SBOM Minimum Elements - NTIA
4. NIST SP 800-131A Rev. 2 (approved algorithms) - NIST

Related SIR and deficiency resources