Structured assessment. Written risk report. Investor & acquirer ready.
This service combines the depth of the Audit Readiness Sprint (IEC 62304 + IEC 81001-5-1 project documentation) with hands-on codebase quality, scalability, and infrastructure investigation - delivered as a single risk-graded written report.
What this assessment covers:
IEC 62304: Software lifecycle documentation — class-appropriate gap analysis
IEC 81001-5-1: Cybersecurity documentation - STRIDE, SBOM, controls evidence
Codebase: Quality, maintainability, test coverage, dependency hygiene
Architecture: Scalability, modularity, cloud/device boundary design
Infrastructure: Deployment, CI/CD, monitoring, data residency, security posture
Assesment scope - Five investigation workstreams
Workstream 1 - IEC 62304
Software Lifecycle Documentation Review
Software Development Plan — class-appropriate completeness
Software Requirements Specification and architecture evidence
SOUP list — identification, risk assessment, verification records
Unit implementation, integration and system testing records
Change management, release artefacts and version control
Workstream 2 — IEC 81001-5-1
Cybersecurity Documentation Review
Security risk assessment and threat modelling documentation
SBOM completeness and vulnerability management evidence
Security requirements, controls specification and testing records
Gap analysis vs MDCG 2019-16 and FDA 2023 Cybersecurity Guidance
Workstream 3 - Codebase Quality
Codebase Quality & Technical Debt Assessment
Static analysis — maintainability index, code complexity, duplication
Test coverage assessment — unit, integration, system test completeness
Dependency hygiene — outdated libraries, licence risks, CVE exposure
Technical debt inventory — ranked by remediation effort and risk
Workstream 4 - Architecture
Architecture & Scalability Review
Architectural fitness for SaMD regulatory lifecycle
Modularity and maintainability — separation of concerns
Scalability — load, data volume, and user growth projections
Cloud/device boundary — security, data flow, latency risk
Workstream 5 - Infrastructure
Infrastructure, CI/CD & Security Posture Review
Deployment architecture — cloud, environment segregation, IaC
CI/CD pipeline — test gates, release controls, rollback
Data residency — GDPR, HIPAA, MDR Article 83
Security posture — access controls, secrets management
We need 30 minutes to explore how to accelerate your project.
Lock in your assessment.
Module pricing, timelines and conference terms
All prices shown include the 20% conference discount valid when contract signed within 30 days of event. Module 1 includes workstreams 1, 3, 4, 5. Module 2 adds workstream 2. Bundle includes all five workstreams.
Software Class A Low Risk SaMD
Module 1 IEC 62304 Only
€5,200
EUR 6,500/ Standard Price
Module 2 IEC 81001-5-1 Only
€4,400
EUR 5,500/ Standard Price
Bundle Package
€8,720
EUR 10,900/ Standard Price
Software Class B Medium Risk SaMD
Module 1 IEC 62304 Only
€11,600
EUR 14,500/ Standard price
Module 2 IEC 81001-5-1 Only
€9,200
EUR 11,500/ Standard price
Bundle Package
€18,520
EUR 20,500/ Standard Price
Software Class C High Risk SaMD
Module 1 IEC 62304 Only
€24,000
EUR 30,000/ Standard price
Module 2 IEC 81001-5-1 Only
€16,000
EUR 20,000/ Standard price
Bundle Package
€31,920
EUR 39,900 / Standard price
Engagement details
Typical timeline
Kick-off, document intake, codebase access setup
Documentation review + static analysis (WS 1–3)
Infrastucture review (WS 4-5)
Risk-graded report + remediation roadmap delivered
Who this is for
PE/VC funds assessing digital health acquisition targets
Series A–C investors requiring pre-investment technical assurance
Medtech acquirers evaluating target company technology risk
Founders preparing for investor due diligence data room
Companies preparing for MDR notified body or FDA pre-submission
Terms
All prices are fixed fees excluding VAT.
Every engagement includes:
30-min discovery call
Written scope
Senior QA/RA review
Our Partners
