SIR response builder

Pick the issue. Get the SIR response template.

Choose the type of cybersecurity issue the FDA reviewer raised. We assemble the section-by-section template blocks and example verbiage you can paste into your eSTAR SIR response.

Reviewed by

Christian Espinosa

Founder & CEO, Blue Goat Cyber

Last reviewed October 12, 2026

1. Choose the SIR issue type

Pick the category the reviewer flagged. Each category outputs a tailored restatement, direct answer, artifact pointer table, and citation set.

Select one category to continue.

What you'll see after you submit

Choose the issue - get the SIR response blocks

Four issue types: authentication, cryptography, vulnerability / CVE, SBOM / signing.
Auto-assembled 6-section template: restatement, direct answer, artifact pointers, standards, verification, closing.
Example reviewer ask verbatim so you know when this template applies.
Per-issue cautions and a scope guard to keep you from turning a SIR into an AI letter.

Common misconceptions

What teams usually get wrong

Myth: One SIR template fits every issue.
Reality: Reviewers cite specific standards per issue type. A generic template misses the guidance section and triggers a follow-up SIR.
Myth: A SIR is a chance to fix the design.
Reality: SIRs are for clarifying or replacing artifacts. Design changes require a Special 510(k) or a Traditional 510(k) - never an in-line SIR response.
Myth: Longer responses look more thorough.
Reality: Reviewers reject scope creep. A tightly scoped 2-3 page answer closes faster than a 30-page dump.
Myth: Citing 'our threat model' is enough.
Reality: Cite the artifact, version, and section - and the FDA guidance or standard clause. Anonymous references get re-SIR'd.