Every activity in an ELTON subscription began as a deficiency on a real submission, and each one traces to the requirement it evidences.
ELTON’s activities were written backwards from FDA feedback on submissions ELTON has worked through.
A deficiency question lands on one customer’s submission.
The artifact that closes it is produced from the digital twin.
The answer becomes an activity in every subscription.
The next submission has the evidence before anyone asks.
The list keeps growing because reviewers keep asking new questions. The interface-by-interface V&V request below arrived in January 2026 and was a standing activity within the quarter.
Reviewer wording from FDA deficiency letters, product identifiers removed, and the activity that now answers each.
“You state that these findings are ‘deferred.’ However, these findings pose a security risk that should be mitigated to ensure patient safety from device tampering.”
FDA rejects the deferral outright and points to the pentest’s own recommendation as the fix. Pentest recommendations are high level, so ELTON writes the remediation down to the code fix and proves it with a retest.
“You did not provide complete V&V test results for interface-specific security mechanisms. Please provide adequate V&V for the electronic interfaces, or an acceptable justification for the omission.”
Interface-specific test cases are derived from the twin, executed at the deepest available tier and recorded pass or fail with evidence for each mechanism.
“A vulnerability management plan is required under Section 524B of the FD&C Act. Please provide a vulnerability management plan and describe your continuous monitoring and disclosure processes.”
ELTON runs that function as a managed program: SBOM monitoring against new CVEs, exploitability re-analyzed on the current release twin, annual penetration testing, the plan and the evidence it is followed.
“You provided a penetration testing report that contains a subset of findings. Please provide evidence of testing for all in-scope components and any historical testing performed during development.”
Every in-scope component is tested from the twin and the full history is retained, each test case, result and disposition across releases, so the evidence is assembled before the deadline.
“You provided a postmarket vulnerability management plan that does not include regular penetration testing.”
ELTON tests every release and at least annually, validating reported findings and SBOM-derived issues on the real device.
Each activity in a subscription, the requirement it evidences, and where that requirement is written.
| Included activity | What FDA asks for | Where it is written | What ELTON delivers |
|---|---|---|---|
| Iterative testing, premarket | Cybersecurity testing through development, with the reports in the submission: security requirements testing, threat mitigation testing, vulnerability testing and penetration testing. | Premarket guidance, Section V.A.3 Cybersecurity Testing; Section 524B(b)(2), processes that give reasonable assurance the device is cybersecure. | Every premarket release is tested through to final, results land on the digital twin, and the submission-ready report is regenerated on demand. |
| Annual testing, postmarket | Testing repeated at regular intervals after release, annually in the guidance's own example, as part of the postmarket cybersecurity plan. | Premarket guidance, Section V.A.3 and V.B.2 Cybersecurity Management Plans; Section 524B(b)(1), the plan to monitor, identify and address postmarket vulnerabilities. | The supported release is tested once a year on the real device, and the living report stays current between tests. |
| Continuous vulnerability verification (exploitability determination) | Monitor for new vulnerabilities after release and assess the exploitability of each one before deciding what it means for the device. | Section 524B(b)(1); Postmarket guidance, Section VI.A, assessing the exploitability of the cybersecurity vulnerability. | New CVEs are correlated with the twin and the test results, then verified at the twin, in code or firmware, and on the device, so each one resolves to Affected or Not Affected with evidence. |
| FDA MDDT-qualified vulnerability severity ratings | An exploitability-based cybersecurity risk assessment, with CVSS applied the way FDA qualified it for medical devices. | Premarket guidance, Section V.A.1 Cybersecurity Risk Assessment; Postmarket guidance, Section VI.A (CVSS as an exploitability tool); the Rubric for Applying CVSS to Medical Devices, qualified under the MDDT program (Q171974). | Product-adjusted CVSSv3 and CVSSv4 for every finding through the MDDT-qualified rubric, each rating evidenced against the twin's security profile. |
| Digital twin of each product release | Security architecture views for the release and an SBOM of commercial, open-source and off-the-shelf components. | Premarket guidance, Section V.A.2 Security Architecture and V.A.1 SBOM; Section 524B(b)(3). | A twin per release: components, interfaces, data flows, assets, trust boundaries and countermeasures, with software and hardware materials exportable as CycloneDX. |
| Threat-model-driven test case creation | A threat model that informs the risk assessment and the test plan, so what gets tested follows from how the device can be attacked. | Premarket guidance, Section V.A.1 Threat Modeling and Section V.A.3 threat mitigation testing. | Test cases are generated from the twin's components and their EMB3D properties, so coverage reads as a list before testing starts. |
| Test case traceability to design | Traceability from security requirements and design controls to the tests that verified them, kept in the design history file. | Premarket guidance, Section V.A.3 and Appendix 2; QMSR, 21 CFR Part 820 incorporating ISO 13485 clauses 7.3.3 and 7.3.6, design inputs and design verification. | Every test case maps to the twin component and the control it exercises, and the matrix exports with the report. |
| Vulnerability traceability to test cases | Findings tied to the tests that produced them, including a security assessment of unresolved anomalies. | Premarket guidance, Section V.A.3 test reports and Section V.A.1, assessment of unresolved anomalies. | Every finding links to its test case, its evidence and its component, so a reviewer can walk from the vulnerability back to the test. |
| Exploitability classification: directly exploitable, conditionally exploitable, weakness | Decide whether the risk is controlled or uncontrolled from exploitability and severity of patient harm, and separate known unacceptable vulnerabilities from critical ones. | Postmarket guidance, Sections VI and VII, controlled and uncontrolled risk; Section 524B(b)(2)(A) and (B). | Three verdicts on every finding, and a VEX-aligned disposition with CISA-defined justifications for everything dismissed. |
| Prescriptive remediation | Updates and patches on a regular cycle for known unacceptable vulnerabilities, out of cycle for critical ones, with corrective and preventive action under the quality system. | Section 524B(b)(2)(A) and (B); Postmarket guidance, Section VII Remediating and Reporting; QMSR, ISO 13485 clauses 8.5.2 and 8.5.3. | One fix per root cause, tied to the chain it closes, written for the developer who ships it and tracked to Fixed in a later release. |
| Mitigation prioritization | Risk-based remediation: what to fix first, on what timeline, by the risk it carries to patients. | Postmarket guidance, Section VII; Section 524B(b)(2). | Root causes ranked by the exploitable chains they close, with mean time to triage and mean time to remediation tracked across the program. |
ELTON meets FDA premarket (Section 524B) and postmarket cybersecurity vulnerability testing and management requirements. The rubric is FDA-qualified under the MDDT program; the ratings and dispositions are ELTON’s, evidenced against your product.
Each documentation deficiency pairs a reviewer request with an artifact derived from the same digital twin.
A digital twin with threat modeling layered on it: exploitable-path analysis, chaining, and mitigations traced across assets and controls.
Privilege-boundary weaknesses found by testing and linked back to roles and controls.
Outdated cryptographic libraries and configurations flagged, implementation confirmed by testing.
Confirmation of whether integrity protection is cryptographic and effective, linked to the controls in scope.
Exposed interfaces, default accounts and unused functionality tested and linked to the architecture.
A managed product security operations function that alerts you when a vulnerability hits a release.
Unsupported or unprotected OS components highlighted, with test results confirming mitigation.
Pentest, fuzzing, SAST and DAST with methodology, scope and results, each finding traced to risks and controls.
Controls substantiated by linking vulnerabilities and test results to control objectives.
SBOM components monitored against lifecycle data, end-of-life vulnerabilities flagged.
Patchability findings tied to vulnerabilities and controls, mapped to scope.
A living, validated CycloneDX SBOM consistent with the NTIA minimum elements.
Findings integrated into a cybersecurity FMEA with traceability to scope and controls.
Remediation and regression evidence captured, with new test results evidencing closure.
SBOMs monitored for new vulnerabilities, showing the evolving risk posture.
Findings traceable to disclosure workflows, so FDA can see how risks are communicated.
Vulnerabilities prioritized by exploitability and severity to justify patch cycles.
The customer-facing cybersecurity information, with responsibilities carried from manufacturer to customer.
Does ELTON make a device FDA compliant?
ELTON meets FDA premarket (Section 524B) and postmarket cybersecurity vulnerability testing and management requirements. Compliance of the submission is FDA's decision; ELTON produces the testing, ratings, traceability and plans the reviewer asks for, evidenced against your product.
Where do ELTON's activities come from?
From FDA deficiency letters on submissions ELTON has worked through. Each time a reviewer asked a customer for something, the answer became a standing activity in every subscription, traced to the requirement it evidences.
What is the most common cybersecurity deficiency?
Penetration test findings marked deferred. FDA rejects the deferral, cites Section 524B(b)(2) and points to the pentest's own recommendation as the fix, which is why ELTON writes remediation down to the code fix and proves it with a retest.