medicaldevicepentest.com

Security testing evidence for the device file

Scope an engagement

About medicaldevicepentest.com

Updated

medicaldevicepentest.com is a reference on security testing for medical devices and in vitro diagnostic devices, written for regulatory affairs and product security leads at manufacturers. Readers in a regulated role need to know where guidance comes from, so the provenance is set out here.

Publisher

The site is published by SEQ SIA (registration number 40203410806), Lastādijas iela 12 k-3, Riga, LV-1050, Latvia, trading as OffSeq, a provider of penetration testing and security assessment services. Contact: support@offseq.com.

We are not affiliated with the European Commission, the Medical Device Coordination Group, any notified body, any competent authority or the United States Food and Drug Administration. Nothing here is an official interpretation of the MDR, the IVDR or the FD&C Act, and nothing here is a conformity assessment.

Authorship

SEQ SIA (OffSeq) is responsible for publishing, maintaining and updating this site. Articles carry team attribution rather than a byline. Sources are listed on every guide so a reader can check the basis for each statement.

How the content is sourced

  • Every regulatory statement is quoted from the instrument or the guidance itself, and the link goes to the document we read: the EUR-Lex consolidated text for the MDR and IVDR, the Commission-hosted PDF for MDCG 2019-16 rev.1, the FDA-hosted PDF for the premarket cybersecurity guidance, and the ENISA-hosted PDF for the procurement guidelines.
  • Consolidated EU texts are cited with their consolidation date, because a consolidated text has no legal effect of its own and can be superseded between visits.
  • Where a source does not settle a question, the page says so rather than filling the gap. There is no page on this site about a rule we could not read.
  • We do not publish prices, market-size estimates or competitor comparisons. Cost is discussed as a list of drivers, never as a figure without a scope.
  • Engagement descriptions are generalised. No client, target environment, device model or unremediated finding is identifiable from anything published here.
  • The “Updated” date moves only when the text changes; an automated content-hash ledger reverts an unearned bump.

Commercial interest

We sell the testing this site describes, which is a direct interest in you concluding that you need it. Read every recommendation here with that in mind.

  • Links to OffSeq are our own service links, not a market comparison. We do not rank, score or name competing providers.
  • No vendor, notified body, standards body or tooling supplier pays for a mention. There is no advertising and no affiliate revenue.
  • Where an obligation does not apply to a device, the site says so, including when that means a smaller engagement or none at all. The Cyber Resilience Act answer on the home page is the clearest example: it rules out a service rather than selling one.

Not advice

This site is not legal, regulatory or conformity-assessment advice. Device classification, the conformity assessment route, the submission pathway and the sufficiency of any evidence are matters for the manufacturer together with its notified body, its competent authority or the reviewing agency.

Corrections

If a quotation, a citation or a date on this site is wrong, tell us at support@offseq.com and we will correct and re-date the page in the open.