Latest Articles

Preparing a medical device for FDA 510(k) submission involves more than showing that its software performs as intended. When a device uses wireless communication, mobile applications, cloud services, APIs, or third-party software, manufacturers also need to understand cybersecurity risks across the complete system. A threat model report documents how the device is built, where it […]

The HSA query is concise. The evaluator wants a traceability matrix from your security risks to controls and tests. They want to know which operating systems your app supports. Your team provided a well-written architecture document and a scan summary. It did not include proof that the controls work, or a clear statement of which […]

If you sell software to a federal agency, you have probably lived this already. You spend weeks pulling together an attestation form. Then a memo comes out, the form becomes optional, and nobody tells you what replaces it. You ask your contracting officer. They are not sure either. You ask another agency you work with, […]

TL;DR: EU IVDR Cybersecurity The EU IVDR (Regulation (EU) 2017/746) treats cybersecurity as a patient-safety issue. Annex I, Sections 16.2 and 16.4 cover software information security and minimum IT security requirements. Notified bodies use MDCG 2019-16 rev. 1 as their reference. Class D legacy devices have until 31 December 2027, and Class C until 31 […]

Introduction: A Best Practices Guide With No Pass Mark The hospital’s procurement team has one more request before it signs. It wants the product life cycle documentation described in section 7.1.1 of HSA’s new GL-10 guide, plus an SBOM for the device. Your sales lead forwards the email with a single line: “Do we have […]

Introduction: Why Connected Device Submissions Stall at HSA’s Cybersecurity Item Your CSDT is in, screening went smoothly, and then HSA comes back asking for two things the file doesn’t have: security test reports for the device and a traceability matrix showing how each cybersecurity risk is controlled and tested. The architecture section describes encryption and […]

If your UK business handles personal data belonging to customers in Ireland, Germany, or the Netherlands, you’re working under two data protection laws at the same time: EU GDPR and UK GDPR. They started out almost identical after Brexit. They are not anymore. The differences now affect your lawful basis, your transfer paperwork, how you […]

A Technical Team Head’s guide for UK manufacturers selling software or connected products into the EU.  Under the CRA, every product sold in the EU with digital elements needs a software bill of materials. In order for these documents to satisfy their purpose, they need to live within a company’s technical file (and should go […]

One audit finding can put your Aadhaar authentication operations at risk. Not because someone broke in, but because you couldn’t prove that your systems met the required controls. That’s one of the less obvious challenges of UIDAI Aadhaar compliance. It’s not enough to have security controls in place. You also need evidence that they work. […]