Regulatory Open Forum

This message was posted by a user wishing to remain anonymous

Hi everyone,

I would like to clarify some terminology pertaining to software development. In FDA's Guidance for the Content of Premarket Submissions for Software Contained in Medical Devices, one documentation requirement is Software Development Environment Description,  the document appears to be equivalent to the Software Maintenance Plan as outlined in IEC 62304:2006.  I also notice that the guidance was published in 2005, well before the publication of IEC 62304, can we assume that the maintenance plan is equivalent to the software development environment description in content? 

Thank you.

Hello Anonymous

No, I don't consider them the same.  The software development environment can be similar to that used for software maintenance, as long as you use the same general processes for software like design, coding, review, v&v, release. However, an "environment" is not the same as a plan (which relies on an "environment").

Software development -  FDA wants to know what platforms, tools you use to develop, code, test, release.  And they also want to see how you do this from a organisational perspective - software project management, developers, independent testers, etc. How did you qualify tools and OTS used?   Also, how did you classify risk, hazards and harms before and during development.

Maintenance - they want to know how you plan to maintain the software.  Is it by pushing out scheduled updates, reactive to bugs found, and/or  planned new features? How do you track updates to any OTS integrated into your software to see whether or how those updates impact your software?

I have had clients who want to submit huge plans and reports for tool selection and testing, in addition to SRS, SAD, SDD, V&V, Traceability, revision history, etc.  I wouldn't recommend that. Keep your documentation about development and maintenance tools and routine SOPS in your design file and QMS. 

All you need to do for these two areas in the submission is describe the development and maintenance tools and processes, which are usually slightly different, and sometimes handled by different.groups too.  Then describe the plan for maintenace.  Both are short text. 

Somewhere in there as part of development risk management you have considered cybersecurity risks and designed and tested appropriately.  Describe this.  And as part of your maintenance plan, how will you address old and emerging cyber risks?  Describe this too.

Ps- while FDA still recognizes the 2006 version of IEC 62304, I usually recommend they use the 2015 version (also recognized), as I think it better addresses considerations for OTS and legacy software.

------------------------------
Ginger Cantor, MBA, RAC
Founder/Principal Consultant
Centaur Consulting LLC
River Falls, Wisconsin 54022 USA
715-307-1850
centaurconsultingllc@gmail.com
------------------------------

Original Message:
Sent: 16-Feb-2019 11:49
From: Anonymous Member
Subject: Software Maintenance Plan (IEC 62304) and Software Development Environment Description (FDA)

This message was posted by a user wishing to remain anonymous

Hi everyone,

I would like to clarify some terminology pertaining to software development. In FDA's Guidance for the Content of Premarket Submissions for Software Contained in Medical Devices, one documentation requirement is Software Development Environment Description,  the document appears to be equivalent to the Software Maintenance Plan as outlined in IEC 62304:2006.  I also notice that the guidance was published in 2005, well before the publication of IEC 62304, can we assume that the maintenance plan is equivalent to the software development environment description in content?

Thank you.

Agree with the comments that Ginger wrote that the software development environment and maintenance release may not be the same and many would argue are definitely not the same as to the reasons Ginger described above.  Typically in the 510(k) application Section 16 - Software we provide a Standard Operating Procedure (SOP) (or a couple procedures) that describe how the software is developed, tested, released, and maintained.  So often time the maintenance plan is integrated into the SOP or we have a separate procedure for version release which describes some of the components from IEC 62304 for maintenance plan.  Often times we also have a linkage in configuration management for maintenance processes.  Also completely agree that you should be using the 2015 version of IEC 62304 as there were some important changes from the 2006 version.

------------------------------
Richard Vincins RAC
Vice President Global Regulatory Affairs
------------------------------

Original Message:
Sent: 17-Feb-2019 07:52
From: Ginger Cantor
Subject: Software Maintenance Plan (IEC 62304) and Software Development Environment Description (FDA)

Hello Anonymous

No, I don't consider them the same.  The software development environment can be similar to that used for software maintenance, as long as you use the same general processes for software like design, coding, review, v&v, release. However, an "environment" is not the same as a plan (which relies on an "environment").

Software development -  FDA wants to know what platforms, tools you use to develop, code, test, release.  And they also want to see how you do this from a organisational perspective - software project management, developers, independent testers, etc. How did you qualify tools and OTS used?   Also, how did you classify risk, hazards and harms before and during development.

Maintenance - they want to know how you plan to maintain the software.  Is it by pushing out scheduled updates, reactive to bugs found, and/or  planned new features? How do you track updates to any OTS integrated into your software to see whether or how those updates impact your software?

I have had clients who want to submit huge plans and reports for tool selection and testing, in addition to SRS, SAD, SDD, V&V, Traceability, revision history, etc.  I wouldn't recommend that. Keep your documentation about development and maintenance tools and routine SOPS in your design file and QMS.

All you need to do for these two areas in the submission is describe the development and maintenance tools and processes, which are usually slightly different, and sometimes handled by different.groups too.  Then describe the plan for maintenace.  Both are short text.

Somewhere in there as part of development risk management you have considered cybersecurity risks and designed and tested appropriately.  Describe this.  And as part of your maintenance plan, how will you address old and emerging cyber risks?  Describe this too.

Ps- while FDA still recognizes the 2006 version of IEC 62304, I usually recommend they use the 2015 version (also recognized), as I think it better addresses considerations for OTS and legacy software.

------------------------------
Ginger Cantor, MBA, RAC
Founder/Principal Consultant
Centaur Consulting LLC
River Falls, Wisconsin 54022 USA
715-307-1850
centaurconsultingllc@gmail.com

Original Message:
Sent: 16-Feb-2019 11:49
From: Anonymous Member
Subject: Software Maintenance Plan (IEC 62304) and Software Development Environment Description (FDA)

This message was posted by a user wishing to remain anonymous

Hi everyone,

I would like to clarify some terminology pertaining to software development. In FDA's Guidance for the Content of Premarket Submissions for Software Contained in Medical Devices, one documentation requirement is Software Development Environment Description,  the document appears to be equivalent to the Software Maintenance Plan as outlined in IEC 62304:2006.  I also notice that the guidance was published in 2005, well before the publication of IEC 62304, can we assume that the maintenance plan is equivalent to the software development environment description in content?

Thank you.