Risk & cybersecurity
I connect software to the risk file and security to safety. That means software risk analysis built on your real architecture, and a cybersecurity package that gives FDA the evidence it now expects for connected devices.
When teams bring me in
- Your risk file names software as a cause but never says which software item or which control
- Your device connects to a network and needs a premarket cybersecurity package
- FDA sent a deficiency letter about cybersecurity or the SBOM
- Security risk and safety risk are managed in documents that never meet
What you get
- Risk and security risk management plans
- Software FMEA and software contribution analysis
- Threat model and security architecture views
- SBOM and vulnerability assessment
- Premarket cybersecurity documentation
- Post-market cybersecurity management plan
How I help
Software risk analysis
Software contribution analysis and software FMEA on an item-by-item basis, connected to the system hazards in your ISO 14971 file, with risk controls traced to requirements and verification.
Threat modeling
Security architecture views, trust boundaries and threat modeling (STRIDE, attack trees) under a security risk management process aligned with AAMI SW96 and TIR57.
SBOM and vulnerabilities
An SBOM generated from the build and kept in step with the SOUP list, with a vulnerability assessment that explains exploitability in your device, not just a list of CVEs.
Premarket package and post-market plan
The cybersecurity documentation FDA expects for cyber devices, plus a workable plan for monitoring, patching and coordinated vulnerability disclosure.
Case study
Answering an FDA cybersecurity request for additional information
FDA accepted the response.
Read the case study →How engagements work
Most work starts with a short call and a fixed-scope assessment, then moves to a project or a monthly retainer. I work remotely, with on-site time when it helps; travel is billed as set out in the engagement agreement.
Related guides: ISO 14971 · Cybersecurity (TIR57, SW96, FDA)
Other capability areas
Software quality & V&V
I help device teams run an IEC 62304 lifecycle that produces the right evidence the first time: a safety class you can defend, a plan sized to it, and verification and traceability a reviewer can follow from requirement to result.
Design controls & regulatory
I help teams keep design controls, usability and the quality system in a state that holds up to an FDA inspection or a notified-body audit, and assemble software documentation that reads as one coherent story in a submission.