SIR response builder

Pick the issue. Get the SIR response template.

Choose the type of cybersecurity issue the FDA reviewer raised. We assemble the section-by-section template blocks and example verbiage you can paste into your eSTAR SIR response.

Reviewed by

Christian Espinosa

Founder & CEO, Blue Goat Cyber

Last reviewed November 2, 2026

1. Choose the SIR issue type

Pick the category the reviewer flagged. Each category outputs a tailored restatement, direct answer, artifact pointer table, and citation set.

Select one category to continue.

What you'll see after you submit

Choose the issue - get the SIR response blocks

Four issue types: authentication, cryptography, vulnerability / CVE, SBOM / signing.
Auto-assembled 6-section template: restatement, direct answer, artifact pointers, standards, verification, closing.
Illustrative reviewer questions, not quotations from actual FDA letters.
Per-issue cautions and change-assessment considerations for regulatory-team review.

Common misconceptions

What teams usually get wrong

Myth: One SIR template fits every issue.
Reality: Address the actual question and cite the device-specific evidence and applicable guidance. Templates do not predict reviewer decisions.
Myth: A SIR is a chance to fix the design.
Reality: A response may involve revised evidence or proposed design changes. Assess the change and coordinate with the reviewer; the applicable pathway and change requirements determine whether a new submission is needed.
Myth: Longer responses look more thorough.
Reality: Keep the answer focused and traceable while including enough evidence to resolve the actual request. No universal page count or response outcome applies.
Myth: Citing 'our threat model' is enough.
Reality: Cite the artifact, version, and section, with applicable guidance or standard references. Verify every claim against the actual evidence.