Resources: standards

What a Regulated SDLC & Quality System Actually Requires

What separates a regulated software SDLC from a generic one: audit-ready documentation, named regulatory frameworks (FDA QMSR and ISO 13485:2016, HIPAA, NIST, ONC, FedRAMP, SOC 2, ISO 27001), and traceable roles and tasks.

Requirements-to-Test Traceability Matrix Guide

How to build and maintain a requirements-to-test traceability matrix for regulated software: a working template, a source-control-derived generation approach, and a real SQL query for deriving traceability from a database of record.

FDA Software Documentation Requirements for Premarket Submissions

FDA's 2023 premarket software documentation guidance: Basic vs. Enhanced Documentation Level, the risk-based test that determines which applies, and the specific artifacts each level requires.

IEC 62366 Human Factors & Usability Engineering for Medical Software

IEC 62366-1 human factors and usability engineering for medical device software: Use-Related Risk Analysis, critical-task identification, and the summative usability test evidence FDA expects.

Cybersecurity Evidence & Threat Modeling for Connected Devices

Cybersecurity evidence for connected medical devices under FD&C Act Section 524B and FDA's 2023 cybersecurity guidance: SBOM minimum elements, threat modeling, and vulnerability-monitoring plan requirements.

NIST SP 800-218 & the Secure Software Development Framework (SSDF)

NIST SP 800-218 Secure Software Development Framework (SSDF): the four practice groups (PO/PS/PW/RV) behind the CISA self-attestation form, with a concrete readiness checklist for each.

FedRAMP Engineering Evidence & Continuous Monitoring

FedRAMP ConMon evidence: the NIST SP 800-53 baseline, monthly scans, the POA&M and its 30-day high-risk window, and machine-readable OSCAL.

CMMC Software Engineering & Practice Traceability

CMMC 2.0 software engineering practice traceability: Level 1/2/3 structure, NIST SP 800-171 practice mapping, SPRS scoring mechanics, and a practice-to-evidence ledger template.

ISO 14971:2019 — Risk Management for Medical Device Software

ISO 14971:2019 risk management for medical device software, explained practically: the risk management file's five linked parts, the hazard-to-control-to-verification chain, and where the file most often breaks.

FDA QMSR (21 CFR Part 820 Harmonization) — Design Controls for Device Software

FDA's Quality System Regulation Amendments (QMSR): how 21 CFR Part 820 design controls map onto ISO 13485:2016 after the February 2026 compliance date, and what a design history file needs to show either way.

IEC 62304: what it actually requires of your software

Medical device software life cycle processes — Class A/B/C safety classification, the five clause groups, and a Class C documentation checklist.