Medical devices
FDA 524B and hospital security reviews, prepared.
For makers of connected medical devices selling in the US and Canada. FDA wants a cybersecurity section in the submission; hospitals want an MDS2 form and answers before they buy. We prepare both, and handle vulnerabilities after clearance.
Sounds familiar?
Your FDA submission needs a cybersecurity section.
Section 524B covers devices with software and connectivity. We prepare the file: threat model, security architecture views, software bill of materials, vulnerability management plan and input for labeling. Your regulatory lead submits it.
A hospital sends an MDS2 form and a security questionnaire.
We fill the MDS2 for each device and answer the questionnaire from the same evidence, so the answers match.
A vulnerability turns up after clearance.
524B expects you to monitor and patch. Respond takes the report, assesses it with your engineers and ships the fix.
In the EU, medical devices fall under the Medical Device Regulation, not the Cyber Resilience Act (CRA Article 2(2)). Source: Morgan Lewis, Nov 2025, CRA Article 2
What it costs
US dollars, before taxes. Lab and auditor fees at cost.
| 524B cybersecurity file | Quoted on request | Per device: threat model, architecture views, SBOM, vulnerability plan, labeling input. Lab penetration test coordinated, lab fee at cost. |
|---|---|---|
| MDS2 form | Quoted on request | Per device, with matching questionnaire answers. |
| Respond plan | US$990 a month | Post-clearance vulnerability handling and patches. |
| Operate plan | US$590 a month | Device data hosted in Canada or the US, access logged. |
What we commit to
- Written scope before work starts.
- Every deliverable dated and kept in your evidence file.
- Vulnerability reports acknowledged within one business day; on Respond and Secure, received 24/7 with an engineer on call.
- A first answer to any request within one business day, Vancouver time.
- A named lead you can escalate to.
You own your product and its security. We own the work we deliver, in writing. No one can promise a site or product will never be hacked. Doing nothing is far riskier. We shorten the time you stay exposed, and we keep the record.
Tell us what you run, and what keeps you up at night.
Write in your language or in English. We reply within one business day with first questions and a time to talk; calls in English, by appointment.