Cybersecurity & Privacy
Security built into your product lifecycle and documented the way regulators and notified bodies expect.
The problem
Connected medical devices and health software are now reviewed for cybersecurity before they reach the market. The EU MDR and IVDR include IT security in their general safety and performance requirements, and the FDA expects a cybersecurity section in premarket submissions, including a software bill of materials for cyber devices.
Security often arrives late, as a document written for the submission rather than a practice in development. Missing threat models, an incomplete SBOM or no plan for vulnerabilities after launch then delay approval and leave risks in the field.
What we do
We work out which rules apply to each product and market: EU MDR or IVDR, FDA premarket cybersecurity, NIS2 for your organisation and the EU Cyber Resilience Act for connected products that are not medical devices.
We compare your development and maintenance processes with IEC 81001-5-1 and give you a prioritised gap list.
We model threats to the device, its interfaces and its cloud services, assess security risks and link them to your safety risk management.
We build a software bill of materials, set up monitoring for known vulnerabilities and define how you assess, fix and disclose them after launch.
We test the product, including penetration testing, and prepare the security risk management file and cybersecurity documentation for your technical file or premarket submission.
How we deliver
We map your regulatory obligations, assess your secure development lifecycle and plan the work for each product.
We carry out threat modelling, security risk assessments, SBOM creation and testing, and write the documentation with your engineering and regulatory teams.
We run postmarket vulnerability monitoring for you: tracking new vulnerabilities in your SBOM, assessing their impact and keeping the documentation current.
Frameworks
Platform
From December 2026, the Fidempli platform removes or pseudonymises patient and health data before any AI model sees it, with the re-identification key kept in the EU. That protects the AI tools your teams use in development, support and complaint handling.
Explore the platform
The EU MDR and IVDR include IT security in their general safety and performance requirements. IEC 81001-5-1 describes security activities across the health software lifecycle. NIS2 may apply to your organisation, depending on your size and sector.
Products covered by the MDR and IVDR are excluded from the Cyber Resilience Act. Connected products you make that are not medical devices, such as companion apps or accessories, may fall under it. We help you sort each product.
Premarket submissions for devices with cybersecurity risk need documentation such as a threat model, security risk assessment, an SBOM and a plan for monitoring and addressing vulnerabilities after launch.
It documents the security risks you identified, how you assessed and controlled them and what risk remains. It sits alongside your safety risk management and is updated throughout the product's life.
Yes. We build the SBOM and threat model retrospectively, set up vulnerability monitoring and close documentation gaps before your next submission or audit.
Fidempli provides governance, risk and compliance advisory and works alongside your legal counsel. We do not provide legal advice.
A senior consultant replies within one business day. Or join the 3–5 design partners shaping the platform before launch.
