The Four Documents FDA Now Expects From Every Connected Medical Device
Picture a ten-person MedTech company building a connected glucose monitor. A hospital's procurement team asks for the SBOM, or FDA asks for the threat model behind the 510(k), and nobody has it ready. Not because the team is careless. Until FDA's 2023 Cybersecurity Guidance and MDCG 2019-16, nobody asked for these documents. Now every connected device needs them. Not because the team is careless. Until FDA's 2023 Cybersecurity Guidance and MDCG 2019-16, nobody asked for these documents. Now every connected device needs them. Nobody on the team has that ready. Not because they're careless. A ten-person team usually doesn't have a full-time security person, and this work was never on the plan until someone asked for it. Picture a ten-person MedTech company building a connected glucose monitor. A hospital's procurement team asks for the SBOM, or FDA asks for the threat model behind the 510(k), and nobody has it ready. Not because the team is careless. Until FDA's 2023 Cybersecurity Guidance and MDCG 2019-16, nobody asked for these documents. Now every connected device needs them.
The four documents
- A Software Bill of Materials (SBOM). A list of every third-party and open-source piece inside the device, with version numbers and licence info, kept up to date over time. Without it, nobody, including you, can answer the question "what's actually in this device, and is any of it vulnerable?"
- A threat model. Usually built with STRIDE or MITRE ATT&CK. It needs to show where an attacker could get in and where the gaps are, not just be a slide someone made once and forgot about.
- A CVE monitoring record. A way to catch it when a component you already shipped turns out to be vulnerable, plus a documented plan for what happens next.
- A Cybersecurity Management Plan. The document that ties the other three together so a reviewer can actually check them. FDA expects one in every 510(k) and PMA. MDR expects the equivalent for connected devices sold in the EU.
None of these are optional anymore, and ad-hoc pen test screenshots or informal notes don't count. Reviewers know the difference.
Why small teams get caught out here
The instinct, once a team realizes this, is to hire a security person. For a team of ten, that's usually the wrong move.
Someone who understands security and also understands SaMD, IEC 62304, and regulatory submissions is hard to find and expensive to hire. It can take months just to find the right person. And once hired, they'd spend their first few months building the exact four documents above, mostly from scratch, before settling into maintaining them.
The real issue isn't a lack of people. It's that these four documents don't exist yet, in the right format. A small team doesn't need a department. It needs those four things done right once, then kept current.
What doing it without a hire looks like
Treat it as a fixed, one-time project rather than a new internal job to fill.
Build the threat model and SBOM once, in a format that goes straight into 510(k), PMA, and MDR files
Set up CVE monitoring once, linked to the SBOM, so it keeps running with little extra effort after that
Get a remediation plan that ranks issues by risk, so the team knows what to fix first instead of guessing
It's a bit like how a small company handles legal or accounting work. Bring in the right expertise for a clear, defined job, get something that holds up when someone checks it, then move on.
Where Thaumatec fits
This is exactly what Thaumatec's Cybersecurity Baseline Assessment does. Fixed price, 3-8 weeks depending on the device's risk class, and it covers all four documents in one package, ready to drop into a regulatory submission.
It won't replace having security know-how in the company at some point. But it gets the four required documents done properly now, without a costly hire and a long search, so the next time procurement or FDA asks, the team already has the answer.
The takeaway
Small MedTech teams aren't bad at security. They just don't have four documents that regulators and procurement teams now expect by default. That's a scoping problem, not a hiring problem, and it can be solved without adding anyone to the team.