@memoarchitect/ontology 0.4.4

package/src/compliance/dhf-templates/21cfr820/transfer-plan.md

@@ -0,0 +1,50 @@
+---
+id: transfer-plan
+title: Design Transfer Plan
+standard: 21 CFR Part 820
+clauses: ["820.30(h)"]
+required_for: ["FDA_510k", "FDA_PMA"]
+---
+
+{{include:shared/snippets/document-control-header.md}}
+
+---
+
+## 1. Purpose
+
+Defines design transfer activities for **{{project.product}}** per 21 CFR 820.30(h), ensuring device design is correctly translated to production specifications.
+
+---
+
+## 2. Transfer Checklist
+
+Checklist of items required before design transfer to production is complete:
+
+| Activity | Responsible | Completion Date | Status |
+| --- | --- | --- | --- |
+| Engineering drawings released to production | | | |
+| Software build process documented | | | |
+| Production procedures validated | | | |
+| Test equipment calibrated | | | |
+| Production personnel trained | | | |
+| First article inspection completed | | | |
+
+---
+
+## 3. Production Specifications
+
+Production specifications derived from the design outputs:
+
+```memo-query
+kind: DesignOutput
+display: table
+columns: name, layer, doc
+sort: name
+empty: "No design outputs defined."
+```
+
+---
+
+{{include:shared/snippets/revision-history-table.md}}
+
+{{include:shared/snippets/approval-block.md}}

package/src/compliance/dhf-templates/21cfr820/user-needs.md

@@ -0,0 +1,81 @@
+---
+id: user-needs
+title: User Needs Document
+standard: 21 CFR Part 820
+clauses: ["820.30(c)"]
+required_for: ["FDA_510k", "FDA_PMA"]
+---
+
+{{include:shared/snippets/document-control-header.md}}
+
+{{toc}}
+
+---
+
+## 1. Purpose
+
+This document captures user needs for **{{project.product}}** per 21 CFR 820.30(c) Design Input requirements. User needs represent the intended purpose of the device as stated by customers and intended users.
+
+---
+
+## 2. Intended Users
+
+Identify every intended user group of **{{project.product}}**, including their roles, training assumptions, and use environments.
+
+_[TODO: Describe all intended user groups with their roles, training levels, and environments]_
+
+---
+
+## 3. User Needs
+
+User needs captured for **{{project.product}}** are listed below from the model. Each user need should trace forward to at least one design input:
+
+```memo-query
+kind: [StakeholderNeed, Requirement]
+display: table
+columns: name, layer, doc
+sort: name
+empty: "No user need elements defined. Add StakeholderNeed or Requirement elements."
+```
+
+---
+
+## 4. Use Cases
+
+Use cases describing how intended users interact with **{{project.product}}**, drawn from the model:
+
+```memo-query
+kind: UseCase
+display: table
+columns: name, layer, doc
+sort: name
+empty: "No use cases defined."
+```
+
+---
+
+## 5. Customer Requirements
+
+List customer-stated requirements that serve as input to the design process.
+
+_[TODO: List customer-stated requirements as input to the design process]_
+
+---
+
+## 6. Regulatory Requirements
+
+Regulatory and standards requirements applicable to **{{project.product}}**:
+
+| Standard | Applicability | Notes |
+| --- | --- | --- |
+| 21 CFR Part 820 | Quality System Regulation | |
+| IEC 62304 | Software lifecycle | If Class B/C SW |
+| ISO 14971 | Risk management | |
+
+---
+
+{{include:shared/snippets/revision-history-table.md}}
+
+{{include:shared/snippets/approval-block.md}}
+
+{{include:shared/snippets/references-section.md}}

package/src/compliance/dhf-templates/21cfr820/vv-plan.md

@@ -0,0 +1,89 @@
+---
+id: vv-plan
+title: Verification and Validation Plan
+standard: 21 CFR Part 820
+clauses: ["820.30(f)", "820.30(g)"]
+required_for: ["FDA_510k", "FDA_PMA", "CE"]
+---
+
+{{include:shared/snippets/document-control-header.md}}
+
+{{toc}}
+
+---
+
+## 1. Purpose
+
+This V&V Plan defines verification and validation activities for **{{project.product}}** per 21 CFR 820.30(f)-(g) and ISO 13485:2016 §7.3.6-7.3.7.
+
+---
+
+## 2. Scope
+
+This plan covers:
+- Software verification (per IEC 62304 §5.6-5.7)
+- Hardware verification
+- System-level validation
+- Usability validation (per IEC 62366-1)
+
+---
+
+## 3. Verification Activities
+
+### 3.1 Requirements to Verify
+
+```memo-query
+kind: [Requirement, Requirement]
+display: table
+columns: name, layer, doc
+sort: name
+empty: "No requirements defined."
+```
+
+### 3.2 Verification Test Cases
+
+```memo-query
+kind: [TestCase, VerificationActivity]
+display: table
+columns: name, kind, layer, doc
+sort: name
+empty: "No verification test cases defined."
+```
+
+---
+
+## 4. Validation Activities
+
+Validation activities demonstrating that **{{project.product}}** meets user needs and intended uses:
+
+```memo-query
+kind: ValidationActivity
+display: table
+columns: name, layer, doc
+sort: name
+empty: "No validation activities defined."
+```
+
+---
+
+## 5. Acceptance Criteria
+
+State the objective criteria that must be met for the validation to be considered successful.
+
+_[TODO: Define objective acceptance criteria for all V&V activities]_
+
+---
+
+## 6. Test Environment
+
+Describe the hardware, software, tools, and configuration of the test environment in sufficient detail to reproduce the test setup.
+
+_[TODO: Describe hardware, software, and clinical test environments]_
+
+---
+
+{{include:shared/snippets/revision-history-table.md}}
+
+{{include:shared/snippets/approval-block.md}}
+
+{{include:shared/snippets/references-section.md}}

package/src/compliance/dhf-templates/21cfr820/vv-report.md

@@ -0,0 +1,85 @@
+---
+id: vv-report
+title: Verification and Validation Report
+standard: 21 CFR Part 820
+clauses: ["820.30(f)", "820.30(g)"]
+required_for: ["FDA_510k", "FDA_PMA", "CE"]
+---
+
+{{include:shared/snippets/document-control-header.md}}
+
+{{toc}}
+
+---
+
+## 1. Purpose
+
+This V&V Report documents the results of all verification and validation activities for **{{project.product}}**.
+
+---
+
+## 2. Summary
+
+Summary metrics computed live from the model:
+
+```memo-query
+kind: TestCase
+display: count
+label: Total test cases
+```
+
+```memo-query
+kind: [VerificationActivity, ValidationActivity]
+display: count
+label: V&V activities
+```
+
+---
+
+## 3. Verification Results
+
+### 3.1 Test Results by Requirement
+
+```memo-query
+kind: [TestCase, VerificationActivity]
+display: table
+columns: name, kind, layer, doc
+sort: name
+empty: "No verification activities defined."
+```
+
+---
+
+## 4. Validation Results
+
+Results of the validation activities are summarized below:
+
+```memo-query
+kind: ValidationActivity
+display: table
+columns: name, layer, doc
+sort: name
+empty: "No validation activities defined."
+```
+
+---
+
+## 5. Known Anomalies and Deviations
+
+Record any anomalies, deviations from plan, and their disposition, including rationale for acceptance of unresolved anomalies.
+
+_[TODO: List any unresolved anomalies and provide justification for acceptance]_
+
+---
+
+## 6. V&V Conclusion
+
+State the overall verification and validation conclusion for **{{project.product}}**, including any conditions, limitations, or required follow-up actions.
+
+_[TODO: State whether the device meets all design inputs and is fit for intended use]_
+
+---
+
+{{include:shared/snippets/revision-history-table.md}}
+
+{{include:shared/snippets/approval-block.md}}

package/src/compliance/dhf-templates/fda-cybersecurity/incident-response.md

@@ -0,0 +1,66 @@
+---
+id: incident-response
+title: Cybersecurity Incident Response Plan
+standard: FDA Cybersecurity Guidance 2023
+clauses: ["5.2"]
+required_for: ["FDA_510k", "FDA_PMA"]
+---
+
+{{include:shared/snippets/document-control-header.md}}
+
+---
+
+## 1. Purpose
+
+Defines the incident response process for cybersecurity events affecting **{{project.product}}**.
+
+---
+
+## 2. Incident Classification
+
+Define the severity classes for security incidents and the criteria for assigning them.
+
+| Class | Description | Response Time | FDA Reporting |
+| --- | --- | --- | --- |
+| Class 1 | Exploited vulnerability affecting device safety | 24 hours | Required within 30 days |
+| Class 2 | Unpatched but known vulnerability | 72 hours | Likely required |
+| Class 3 | Suspected security event | 5 days | Assess case-by-case |
+
+---
+
+## 3. Response Team
+
+Identify the incident response team members, their roles, and contact paths.
+
+| Role | Responsible Party | Contact |
+| --- | --- | --- |
+| Incident Commander | | |
+| Security Lead | | |
+| Regulatory Affairs | | |
+| Clinical Safety | | |
+| Legal/Compliance | | |
+
+---
+
+## 4. Response Procedure
+
+1. Detection and initial assessment
+2. Containment of affected devices
+3. Impact analysis (patient safety, data)
+4. Develop and test patch
+5. Deploy and verify patch
+6. FDA notification (if required)
+7. Customer notification
+8. Post-incident review
+
+---
+
+## 5. Coordinated Vulnerability Disclosure
+
+Describe the process by which external researchers can report vulnerabilities and how reports are triaged and disclosed.
+
+_[TODO: Describe the coordinated disclosure policy for external researchers]_
+
+---
+
+{{include:shared/snippets/revision-history-table.md}}

package/src/compliance/dhf-templates/fda-cybersecurity/postmarket-surveillance.md

@@ -0,0 +1,63 @@
+---
+id: postmarket-surveillance
+title: Post-Market Cybersecurity Surveillance Plan
+standard: FDA Cybersecurity Guidance 2023
+clauses: ["5"]
+required_for: ["FDA_510k", "FDA_PMA"]
+---
+
+{{include:shared/snippets/document-control-header.md}}
+
+---
+
+## 1. Purpose
+
+Defines ongoing cybersecurity surveillance for **{{project.product}}** in the post-market phase per FDA's 2023 guidance.
+
+---
+
+## 2. Surveillance Sources
+
+- NVD / CVE database monitoring for SOUP vulnerabilities
+- ICS-CERT / FDA MedSun cybersecurity alerts
+- Vulnerability reports from customers and researchers
+- Threat intelligence feeds
+
+---
+
+## 3. SOUP Monitoring
+
+Describe the process for ongoing monitoring of SOUP components for newly published vulnerabilities.
+
+```memo-query
+kind: SOUPComponent
+display: table
+columns: name, doc
+sort: name
+empty: "No SOUP components to monitor."
+```
+
+---
+
+## 4. Response Timelines
+
+Define target timelines for triage, containment, remediation, and notification per incident class.
+
+| Severity | CVSS Score | Response Target |
+| --- | --- | --- |
+| Critical | 9.0–10.0 | 30 days |
+| High | 7.0–8.9 | 60 days |
+| Medium | 4.0–6.9 | 90 days |
+| Low | < 4.0 | Next release |
+
+---
+
+## 5. Patch and Update Process
+
+Describe how security patches are developed, verified, approved, and deployed to fielded devices.
+
+_[TODO: Describe how security patches are tested, validated, and released]_
+
+---
+
+{{include:shared/snippets/revision-history-table.md}}

package/src/compliance/dhf-templates/fda-cybersecurity/security-arch.md

@@ -0,0 +1,83 @@
+---
+id: security-arch
+title: Cybersecurity Architecture Description
+standard: FDA Cybersecurity Guidance 2023
+clauses: ["3.3"]
+required_for: ["FDA_510k", "FDA_PMA"]
+---
+
+{{include:shared/snippets/document-control-header.md}}
+
+{{toc}}
+
+---
+
+## 1. Purpose
+
+Describes the cybersecurity architecture for **{{project.product}}** per FDA's 2023 guidance and IEC 81001-5-1:2021.
+
+---
+
+## 2. Security Architecture
+
+This section describes the security architecture of **{{project.product}}**. The security-relevant elements below are drawn from the model:
+
+{{diagram:security-architecture}}
+
+---
+
+## 3. Trusted Zones and Communication Paths
+
+Define the trusted zones, the communication paths crossing zone boundaries, and the protection applied at each crossing.
+
+```memo-query
+kind: Interface
+display: table
+columns: name, layer, doc
+sort: name
+empty: "No interfaces defined."
+```
+
+---
+
+## 4. Security Controls
+
+Security controls implemented in **{{project.product}}** are listed below from the model. Each control should trace to at least one identified threat:
+
+```memo-query
+kind: SecurityControl
+display: table
+columns: name, layer, doc
+sort: name
+empty: "No security controls defined."
+```
+
+---
+
+## 5. Cybersecurity Design Principles Applied
+
+Describe how core security principles (least privilege, defense in depth, secure defaults, fail secure) are applied in the design.
+
+_[TODO: Document which NIST CSF or IEC 81001-5-1 principles are applied]_
+
+| Principle | Implementation | Reference |
+| --- | --- | --- |
+| Least privilege | | |
+| Defense in depth | | |
+| Fail secure | | |
+| Cryptographic controls | | |
+| Secure boot | | |
+
+---
+
+## 6. Security Testing
+
+Describe the security testing performed (e.g. static analysis, fuzzing, penetration testing) and reference the detailed results.
+
+_[TODO: Describe penetration testing, vulnerability scanning, and security code review]_
+
+---
+
+{{include:shared/snippets/revision-history-table.md}}
+
+{{include:shared/snippets/approval-block.md}}

package/src/compliance/dhf-templates/fda-cybersecurity/threat-model.md

@@ -0,0 +1,100 @@
+---
+id: threat-model
+title: Cybersecurity Threat Model
+standard: FDA Cybersecurity Guidance 2023
+clauses: ["3.2"]
+required_for: ["FDA_510k", "FDA_PMA"]
+---
+
+{{include:shared/snippets/document-control-header.md}}
+
+{{toc}}
+
+---
+
+## 1. Purpose
+
+This threat model documents cybersecurity threats for **{{project.product}}** per FDA's 2023 Cybersecurity in Medical Devices guidance and IEC 81001-5-1:2021.
+
+---
+
+## 2. System Assets
+
+Assets requiring protection (data, functions, interfaces), drawn from the model:
+
+```memo-query
+kind: [SoftwareSystem, Interface, SOUPComponent]
+display: table
+columns: name, kind, layer, doc
+sort: name
+empty: "No system assets defined."
+```
+
+---
+
+## 3. Entry Points and Attack Surface
+
+Entry points and externally reachable interfaces constituting the attack surface, drawn from the model:
+
+```memo-query
+kind: Interface
+display: table
+columns: name, layer, doc
+sort: name
+empty: "No interfaces defined."
+```
+
+---
+
+## 4. Threat Catalog
+
+The threat catalog below is generated from the model. Each threat should be assessed for likelihood and impact and trace to mitigating security controls:
+
+```memo-query
+kind: ThreatModel
+display: table
+columns: name, layer, doc
+sort: name
+empty: "No threat model elements defined. Add ThreatModel elements."
+```
+
+### 4.1 STRIDE Analysis
+
+| Threat Category | Description | Affected Assets | Likelihood | Impact |
+| --- | --- | --- | --- | --- |
+| Spoofing | | | | |
+| Tampering | | | | |
+| Repudiation | | | | |
+| Information Disclosure | | | | |
+| Denial of Service | | | | |
+| Elevation of Privilege | | | | |
+
+---
+
+## 5. Security Controls
+
+Security controls implemented in **{{project.product}}** are listed below from the model. Each control should trace to at least one identified threat:
+
+```memo-query
+kind: SecurityControl
+display: table
+columns: name, layer, doc
+sort: name
+empty: "No security controls defined."
+```
+
+---
+
+## 6. Unmitigated Threats
+
+Threats without a mitigating security control are surfaced below by a live model query — this list should be empty before release:
+
+_[TODO: List any threats without security controls and provide residual risk justification]_
+
+---
+
+{{include:shared/snippets/revision-history-table.md}}
+
+{{include:shared/snippets/approval-block.md}}
+
+{{include:shared/snippets/references-section.md}}

package/src/compliance/dhf-templates/fda-cybersecurity/vuln-assessment.md

@@ -0,0 +1,77 @@
+---
+id: vuln-assessment
+title: Vulnerability Assessment and Penetration Testing Report
+standard: FDA Cybersecurity Guidance 2023
+clauses: ["3.4"]
+required_for: ["FDA_510k", "FDA_PMA"]
+---
+
+{{include:shared/snippets/document-control-header.md}}
+
+{{toc}}
+
+---
+
+## 1. Purpose
+
+Documents cybersecurity vulnerability assessment and testing for **{{project.product}}** per FDA's 2023 cybersecurity guidance.
+
+---
+
+## 2. Scope of Assessment
+
+Define the boundaries of this assessment: components, interfaces, and threat classes in and out of scope.
+
+```memo-query
+kind: [SoftwareSystem, SoftwareItem, Interface]
+display: table
+columns: name, kind, layer
+sort: name
+empty: "No software assets defined."
+```
+
+---
+
+## 3. SOUP/Third-Party Component Vulnerabilities
+
+Known vulnerabilities in SOUP and third-party components (e.g. from CVE/NVD monitoring) and their disposition:
+
+```memo-query
+kind: SOUPComponent
+display: table
+columns: name, doc
+sort: name
+empty: "No SOUP components defined."
+```
+
+---
+
+## 4. Vulnerability Findings
+
+Identified vulnerabilities and their assessment are listed below:
+
+| CVE / Finding | Component | Severity (CVSS) | Status | Mitigation |
+| --- | --- | --- | --- | --- |
+| | | | | |
+
+---
+
+## 5. Penetration Test Results
+
+Summarize the scope, methodology, and findings of penetration testing.
+
+_[TODO: Summarize penetration testing scope, methodology, and findings]_
+
+---
+
+## 6. Residual Vulnerabilities
+
+Vulnerabilities remaining after mitigation, with the rationale for their acceptability:
+
+_[TODO: Document any accepted residual vulnerabilities with justification]_
+
+---
+
+{{include:shared/snippets/revision-history-table.md}}
+
+{{include:shared/snippets/approval-block.md}}