The blog

CYBERSECURITY · 8 MIN A medical device SBOM: the legal requirement (FDA §524B, CRA) and how to keep it

The SBOM went from best practice to legal requirement: FDA §524B, the Cyber Resilience Act, IEC 81001-5-1. What it must contain, the CycloneDX/SPDX formats, and how to generate and maintain it.

REGULATORY · 10 MIN The MDR technical documentation for software: the structure a notified body expects

MDR Annexes II and III applied to a SaMD: which sections, which artifacts, and the mistakes that stall an audit. The technical file structure a notified body expects.

CYBERSECURITY · 7 MIN FDA §524B: the cybersecurity plan without which your submission will be refused

Section 524B of the FD&C Act: cyber device criteria, the 4 legal requirements (vulnerability plan, secure development, SBOM, patches), differences with the EU, and an 8-point checklist.

ENGINEERING · 8 MIN The IEC 62304 documentation that writes itself: our CI/CD pipeline

Generating IEC 62304 documentation from the CI/CD pipeline: SOUP list from the SBOM, requirements-tests traceability, PR reviews, release notes. Concrete mapping and an example pipeline.

CYBERSECURITY · 8 MIN IEC 81001-5-1: where to start when you already have 100k lines of code

A realistic 5-step IEC 81001-5-1 catch-up plan for existing code: SBOM, threat model, vulnerability management, security testing and documentation — without rewriting your product.

REGULATORY · 9 MIN MDR Rule 11: why your app is probably Class IIa

Rule 11 of Annex VIII of the MDR explained for CTOs: decision tree, MDCG 2019-11 guidance, concrete consequences and edge cases. Why almost all SaMD is at least Class IIa.