Assess the maturity of your medical device security compliance

Building a mature product security compliance process takes time.

Use this self-assessment tool to discover where you are on that journey, identify gaps, and see how to efficiently close them.

After completion, a Cybellum expert will reach out to you to go over the detailed results.

Get Started

How prepared do you feel your organization is for FDA Premarket & Postmarket requirements ?

These regulations do not pertain to our organization

We are currently assessing strategies for compliance

We are proactively addressing this in house

We have engaged the vendor market for an accelerated strategy for compliance

• Previous
• Next

Please select how you are currently defining your assets?

No definition. Not sure what software assets we have in our products

Basic SBOM Management via manual effort or scanning tools

Enriched asset definition through multiple sources

Full asset definition, including SBOMs, HBOMs, Ports, and threat modeling

• Previous
• Next

Please select which most closely aligns to your organization:

Manual, ad-hoc vulnerability assessments

Some assurance processes are automated, but only for a few teams/BUs/products

Assurance process is automated but only for part of the lifecycle (pre or post production)

Systematic assurance pre and post production including: risk-based vulnerability management, licensing management and policy validation

• Previous
• Next

Please select which most closely aligns to your organization:

Compliance reports exist, but are disconnected, no consistent format or central repository

A consistent format or framework exists for some compliance evidence, such as SBOMs

One central place for generating and aggregating compliance evidence across multiple areas, including SBOMs, assets, vulnerabilities and risk

Full integration of evidence data into QMS, PLM/ALM and other systems

• Previous
• Next

Please select which most closely aligns to your organization:

No centralized destination for risk management. Risk status has to be pieced together manually based on data from multiple sources

Dashboards exist for some risk management areas, such as lists of vulnerabilities in products, but are updated infrequently

Dashboards are automatically updated thanks to some integrations with asset data and/or vulnerability/risk data

Full integration into enterprise systems as well as asset management, risk data and compliance data to provide a 360 degree picture of risk for every product at any given time

• Previous
• Next

Overall, what is the internal level of effort to manage your product risk for compliance?

Significant level of internal effort which is unsustainable

Moderate level of internal effort with assistance of tooling

Manageable level of internal effort with advanced tooling

Minimal level of internal effort with enterprise level tooling

• Previous
• Next

You’re almost there!

Tell us a bit more about you and your business to view your results