--- title: cybersecurity-baseline-assement description: Medical device cybersecurity assessment that identifies gaps, maps risks, and gives you a clear remediation roadmap. No fluff, just actionable results. --- ![Group 682 (1)](https://thaumatec.eu/hubfs/Group%20682%20(1).png "Group 682 (1)") Conference Exclusive - EUR 13K-33K - 3 Fixed-Price Tiers # Cybersecurity Baseline Assessment  Know your attack surface. Prove it to regulators. Fixed price. 3–8 weeks. FDA & MDR aligned. FDA's 2023 Cybersecurity Guidance and MDCG 2019-16 now require structured, documented security evidence for every connected medical device. **Most companies don't know what they're missing until a regulator, procurement team, or notified body asks — and they can't deliver.** [Book a call](https://calendly.com/thaumatecgroup/thaumatec-30-min-exploratory-call) #### Security risks we identify & remediate: - No SBOM — unknown vulnerable components inside your device - Missing threat model — no documented attack surface analysis - Unpatched CVEs — live vulnerabilities with no monitoring process - Regulatory gap — cybersecurity evidence not submission-ready ##### Cybersecurity baseline assesment ## Class A - Low Risk SaMD EUR 13,000/ Standard Fee ### EUR 10,400 excl. VAT - Conference Special Price (-20%) ## Class B - Medium Risk SaMD EUR 21,000/Standard Fee #### EUR 16,800 excl. VAT - Conference Special Price (-20%) ## Class C - High Risk SaMD EUR 33,000/Standard Fee ### EUR 26,400 excl. VAT - Conference Special Price (-20%) ##### The security risks your ogranisation faces right now ### No SBOM — no visibility into what is inside your device Without a Software Bill of Materials you cannot answer the question regulators and procurement teams now ask first: what components are in your device, and are any of them vulnerable? FDA 2023 and MDCG 2019-16 both require an SBOM maintained over the full product lifecycle. ### No threat model — no documented attack surface analysis STRIDE and MITRE ATT&CK-based threat modelling are expected by FDA, notified bodies, and enterprise procurement teams. Without a formal threat model, your security posture is undocumented and cannot be presented as regulatory submission evidence. ### Unmonitored CVEs are a live, compounding liability New vulnerabilities in open-source and third-party components are disclosed every day. Without a CVE monitoring programme tied to your SBOM, you cannot detect when a shipped component becomes exploitable or demonstrate a documented post-market response process. ### Cybersecurity evidence is not submission-ready — auditors know it FDA's 2023 Guidance requires a Cybersecurity Management Plan in every 510(k) and PMA. MDR requires equivalent evidence for connected devices. Ad-hoc pen test screenshots and informal security notes are not a substitute — reviewers know the difference. ## What every engagement delivers ### STRIDE Threat Model Report Structured threat model using STRIDE and MITRE ATT&CK for ICS/healthcare. Covers your full attack surface, threat actors, entry points, and control gaps. Formatted for direct inclusion in FDA 510(k)/PMA and MDR technical files. ### SBOM Creation (SPDX / CycloneDX) Machine-readable Software Bill of Materials listing all third-party and open-source components with version and licence data. Aligned with FDA's 2023 requirement to submit an SBOM with every new medical device application. ### CVE Monitoring Programme Setup Automated CVE monitoring pipeline tied to your SBOM — tooling, alert thresholds, and a documented response workflow. Enables ongoing post-market cybersecurity vigilance you can demonstrate to FDA and notified bodies. ### Remediation Priority Roadmap Risk-ranked security findings with CVSS-based exploitability scores, remediation actions, effort estimates, and a sequenced 90-day action plan to reach a fully defensible, regulator-ready security baseline. ### Conference pricing ends 30 days after the event. Lock in your assessment. [Book a call](https://calendly.com/thaumatecgroup/thaumatec-30-min-exploratory-call) ## Fixed-price tiers by software class ##### Class A Low Risk SaMD EUR 13,000 / Standard Fee EUR 10,400Conference -20% ### Included Scope & Delivarables - FDA / MDCG Compliance Gap Report - Full STRIDE Threat Modelling Matrix - Automated SBOM Generation & Setup (SPDX / CycloneDX) - Initial Vulnerability Scan & CVE triage ## CLASS B Medium Risk SaMD EUR 21,000 / Standard Fee EUR 16,800Conference -20% ### Included Scope & Deliverables - All Class A deliverables, plus: - STRIDE threat mapping to existing software architecture - Formal vulnerability management process drafting - Security test case generation ## CLASS C High Risk SaMD EUR 33,000 / Standard Fee EUR 26,400Conference -20% ### Included Scope & Deliverables - All Class B deliverables, plus: - Advanced threat modelling of complex cloud / device boundaries - SAST / DAST toolchain integration - Formal Post-Market Vulnerability Management Plan Our Partners ![HTS-LOGO](https://thaumatec.eu/hs-fs/hubfs/HTS-LOGO.jpg?width=286&height=209&name=HTS-LOGO.jpg) ![Biocom](https://thaumatec.eu/hs-fs/hubfs/Biocom.png?width=101&height=32&name=Biocom.png) ![Cherry-logo](https://thaumatec.eu/hs-fs/hubfs/Cherry-logo.webp?width=94&height=18&name=Cherry-logo.webp) ![MEDILINK-grey-smaller-300x239](https://thaumatec.eu/hs-fs/hubfs/MEDILINK-grey-smaller-300x239.webp?width=300&height=239&name=MEDILINK-grey-smaller-300x239.webp) ![Bild1-300x300-1](https://thaumatec.eu/hs-fs/hubfs/Bild1-300x300-1.gif?width=300&height=300&name=Bild1-300x300-1.gif) ![Boston-300x149](https://thaumatec.eu/hs-fs/hubfs/Boston-300x149.webp?width=300&height=149&name=Boston-300x149.webp) ![Bild1-300x174](https://thaumatec.eu/hs-fs/hubfs/Bild1-300x174.webp?width=300&height=174&name=Bild1-300x174.webp) ![ITCORNER-L-300x94](https://thaumatec.eu/hs-fs/hubfs/ITCORNER-L-300x94.webp?width=300&height=94&name=ITCORNER-L-300x94.webp) ![Medvia2-grey-300x86](https://thaumatec.eu/hs-fs/hubfs/Medvia2-grey-300x86.png?width=300&height=86&name=Medvia2-grey-300x86.png) ![pcl_1-300x150-1](https://thaumatec.eu/hs-fs/hubfs/pcl_1-300x150-1.webp?width=300&height=150&name=pcl_1-300x150-1.webp) ![fittech](https://thaumatec.eu/hs-fs/hubfs/fittech.jpg?width=200&height=200&name=fittech.jpg) ##### Trusted by industry leaders ![Smartqare_logo-BW](https://thaumatec.eu/hs-fs/hubfs/Smartqare_logo-BW.png?width=1200&height=494&name=Smartqare_logo-BW.png) ''Thaumatec was the only company that fulfilled the requirement of in-depth know-how of embedded software development and the proper QMS according to ISO13485 and IEC62304.'' Co-founder, SmartQare ![LOGO_Propeaq_Blue](https://thaumatec.eu/hs-fs/hubfs/LOGO_Propeaq_Blue.png?width=996&height=179&name=LOGO_Propeaq_Blue.png)   ''Thanks to the HealthTech Innovation accelerator, I am able to scale my product, by making it a smart device, and address new use cases - like improving the biorhythm of people with Parkinson’s disease.'' Founder & CEO Chrono Eyewear ## Engagement details ### Typical timeline Week 1  Kick-off, asset inventory, architecture review   Week 2  STRIDE threat modelling, SBOM generation   Week 3  CVE scan, vulnerability triage, monitoring setup   Week 4  Findings report and roadmap delivered Class B: 5–6 wks  ·  Class C: 7–8 wks ### Who this is for → Connected medical devices — FDA 510(k) or PMA→ SaMD / SiMD with MDR or IVDR obligations → CISOs preparing for procurement security audits → Companies with no existing threat model or SBOM → FDA pre-Sub meeting preparation ### Conference terms & contact All prices are fixed fees excluding VAT. Conference pricing valid when contract is signed within 30 days of event date. Every engagement includes: 60-min discovery call  ·  Written scope  ·  Senior QA/RA review [office@thaumatec.com](mailto:office@thaumatec.com) www.thaumatec.com ISO 27001  ·  ISO 13485  ·  FDA 2023  ·  MDCG 2019-16 ![Thaumatec_LOGO-black_tb](https://thaumatec.eu/hs-fs/hubfs/Thaumatec_LOGO-black_tb.png?width=1970&height=810&name=Thaumatec_LOGO-black_tb.png) ## Your Trusted HealthTech Innovation Partner.  We need 30 minutes to explore how to accelerate your project.  Contact us © 2026. All rights reserved.