@neobiotechlabs/neobiotech-dev-agent-codex 0.1.39

package/vendor/dev-docs-templates/templates/mdr_docs/PA/intended-use.md

@@ -0,0 +1,116 @@
+# Intended Use
+
+<!-- AI AGENT 작성 지침
+이 문서는 MDR Annex II 1.1, ISO 14971 Cl.5.2, IEC 62366-1 Cl.5.1 기반 사용 목적 정의서입니다.
+PA 단계의 첫 번째 핵심 문서로, 모든 이후 문서의 근거가 됩니다.
+
+작성 지침:
+1. "Intended Use": 의료 기기의 核心 기능을 명확하고 간결하게 기술하세요
+   - 무엇을 하는가? (진단/치료/모니터링)
+   - 어떤 방식으로? (AI 분석, 데이터 수집 등)
+   - 어떤 결과를 제공하는가? (점수, 권고사항, 시각화 등)
+   예시: "This software is intended to assist clinicians in detecting {CONDITION} by analyzing {INPUT_DATA} and providing a risk score."
+
+2. "Intended Medical Indication": 대상 질환/상태를 구체적으로 기술하고
+   "제외 기준(Exclusion Criteria)"을 반드시 포함하세요
+
+3. "Patient Population": 나이, 체중, 동반 질환 등 구체적 특성을 기술하세요
+
+4. "User Profile": 의료 종사자인지 일반 사용자인지 명확히 구분하세요
+   - 필요한 교육/자격 요건
+   - 기술 숙련도 수준
+
+5. "Use Environment": 병원 환경인지 재택 환경인지 구분하고
+   소음, 조명, 시간 압박 등 환경적 특성을 기술하세요
+
+6. "Operating Principle": 입력 -> 처리 -> 출력 흐름을 명확히 기술하세요
+   AI/ML 모델을 사용하는 경우 반드시 "보조 진단 도구"임을 명시하세요
+
+완성 체크리스트:
+  [ ] 제품명 및 버전 기재
+  [ ] Medical Indication에 제외 기준(Contraindications) 포함
+  [ ] 의도된 사용자와 환자 집단 구분 명확
+  [ ] MDR 등급 결정을 위한 충분한 정보 제공
+  [ ] IFU(instructions-for-use.md)와 내용 일치 확인
+-->
+
+
+## Mapping of Requirements to Document Sections
+
+| MDR Class | MDR Section                   | Document Section |
+| --------- | ----------------------------- | ---------------- |
+| (All)     | Annex II, 1.1 a) - d), h), i) | (All)            |
+
+| ISO 14971:2019 Section | Document Section |
+| ---------------------- | ---------------- |
+| 5.2                    | (All)            |
+
+| IEC 62366-1:2015 Section | Document Section |
+| ------------------------ | ---------------- |
+| 5.1                      | (All)            |
+
+## Product
+
+ * Name: *\<product name\>*
+ * Version: *\<product version\>*
+ * Basic UDI-DI: *\<insert UDI-DI, if/when available\>*
+
+## Intended Use
+
+> Describe the core medical functionality of your device and how it treats, diagnoses or alleviates a disease.
+> Keep it high-level so that this description is true for as long as possible even when the device is updated.
+
+## Intended Medical Indication
+
+> Describe the condition(s) and/or disease(s) to be screened, monitored, treated, diagnosed, or prevented by
+> your software. Importantly, also list exclusion criteria: Maybe patients with a certain diagnosis should not
+> be using your device.
+
+## Contraindications
+
+> List anything that you want to explicitly exclude from your intended use.
+
+## Patient Population
+
+> Describe the patient population your software is intended to be used on. Note that this may overlap with the
+> user profile (section below), but not necessarily. Your software could be used by physicians to diagnose
+> diseases in patients, so in that case, they don't overlap. Some ideas for characteristics to describe: Age
+> group, weight range, health, condition(s).
+
+## User Profile
+
+> Describe the typical user of the software. Some ideas could be: Qualifications, prior training (for your
+> software), technical proficiency, time spent using the software.
+
+## Use Environment Including Software/Hardware
+
+> Describe the typical use environment. What sort of devices is this running on? Does the software only run on
+> one device or multiple devices? Is it loud and chaotic like in an emergency ward? How's the lighting?
+>
+> Also, add other software or hardware which is required by your device. Most commonly, apps require users to
+> have a smartphone with a compatible operating system (iOS / Android).
+
+## Operating Principle
+
+> It's kind of a stretch to describe the "operating principle" of software. I guess this makes more sense for
+> hardware devices. In any case, I'd just generally state what sort of input goes in and what output comes
+> out, e.g. you could be processing images and returning diagnoses.
+
+The device is stand-alone software. It receives input from the user and outputs information.
+
+## Part of the Body / Type of Tissue Interacted With
+
+The device is stand-alone software. It receives input from the user and outputs information. It doesn't come
+in contact with tissue or bodily fluids.
+
+## Variants / Accessories
+
+> Describe variants and/or accessories of/to this device, if applicable. For typical stand-alone software of
+> startups, this shouldn't be applicable.
+
+---
+
+Template Copyright [openregulatory.com](https://openregulatory.com). See [template
+license](https://openregulatory.com/template-license).
+
+Please don't remove this notice even if you've modified contents of this template.

package/vendor/dev-docs-templates/templates/mdr_docs/PA/mdr-classification-document.md

@@ -0,0 +1,114 @@
+# MDR Classification Document
+
+## Mapping of Requirements
+
+| Medical Device Regulation (MDR) | Document Section |
+| ------------------------------- | ---------------- |
+| Annex VIII | (All) |
+
+**Related documents:**
+
+* Intended Use
+* SOP Product Certification and Registration
+
+## Summary
+
+| Product:        | (enter content) |
+|-----------------|-----------------|
+| Version:        | (enter content) |
+| Classification: | (enter content) |
+| Rule:           | (enter content) |
+
+Rationale for the qualification of the product as a medical device (MDR Annex II, para. 1.1.e):
+See Intended Use Statement
+
+## Chapter 1: Applicable Definitions
+
+> You will need to carefully check and fill out all rows below. Some rows are pre-filled for applicability
+> under the assumption of a stand-alone software medical device. However, this is quite an essential document
+> and you're better off checking twice.
+
+**1. Duration of Use**
+
+| Term       | Definition                                                      | Applicable |
+|------------|-----------------------------------------------------------------|------------|
+| Transient  | Normally intended for continuous use for less than 60 minutes.  |            |
+| Short term | Normally intended for continuous use for not more than 30 days. |            |
+| Long term  | Normally intended for continuous use for more than 30 days.     |            |
+|            |                                                                 |            |
+
+**2. Invasive and Active Devices**
+
+| Definition | Applicable |
+| ---------- | ---------- |
+| **2.1 Body orifice** means any natural opening in the body, as well as the external surface of the eyeball, or any permanent artificial opening, such as a stoma. | No |
+| **2.2 Surgically invasive device** means:<br>(a) an invasive device which penetrates inside the body through the surface of the body, including through mucous membranes of body orifices with the aid or in the context of a surgical operation; and<br>(b) a device which produces penetration other than through a body orifice. | No |
+| **2.3 Reusable surgical instrument** means an instrument intended for surgical use in cutting, drilling, sawing, scratching, scraping, clamping, retracting, clipping or similar procedures, without a connection to an active device and which is intended by the manufacturer to be reused after appropriate procedures such as cleaning, disinfection and sterilization have been carried out. | No |
+| **2.4 Active therapeutic device** means any active device used, whether alone or in combination with other devices, to<br>support, modify, replace or restore biological functions or structures with a view to treatment or alleviation of an<br>illness, injury or disability. |  |
+| **2.5 Active device intended for diagnosis and monitoring** means any active device used, whether alone or in combination with other devices, to supply information for detecting, diagnosing, monitoring or treating physio logical conditions, states of health, illnesses or congenital deformities. |  |
+| **2.6 Central circulatory system** means the following blood vessels:<br>arteriae pulmonales, aorta ascendens, arcus aortae, aorta descendens to the bifurcatio aortae, arteriae coronariae, arteria carotis communis, arteria carotis externa, arteria carotis interna, arteriae cerebrales, truncus brachiocephalicus, venae cordis, venae pulmonales, vena cava superior and vena cava inferior. |  |
+| **2.7 Central nervous system** means the brain, meninges and spinal cord. |  |
+| **2.8 Injured skin or mucous membrane** means an area of skin or a mucous membrane presenting a pathological<br>change or change following disease or a wound. |  |
+
+## Chapter 2: Implementing Rules
+
+| Rules | Applicable |
+| ----- | ---------- |
+| **3.1** Application of the classification rules shall be governed by the intended purpose of the devices. | Yes |
+| **3.2** If the device in question is intended to be used in combination with another device, the classification rules shall apply separately to each of the devices. Accessories for a medical device and for a product listed in Annex XVI MDR shall be classified in their own right separately from the device with which they are used. |  |
+| **3.3** Software, which drives a device or influences the use of a device, shall fall within the same class as the device.<br>If the software is independent of any other device, it shall be classified in its own right. |  |
+| **3.4** If the device is not intended to be used solely or principally in a specific part of the body, it shall be considered and classified on the basis of the most critical specified use. |  |
+| **3.5** If several rules, or if, within the same rule, several sub-rules, apply to the same device based on the device's intended purpose, the strictest rule and sub-rule resulting in the higher classification shall apply. |  |
+| **3.6** In calculating the duration referred to in Section 1, continuous use shall mean:<br>(a) the entire duration of use of the same device without regard to temporary interruption of use during a procedure or temporary removal for purposes such as cleaning or disinfection of the device. Whether the interruption of use or the removal is temporary shall be established in relation to the duration of the use prior to and after the period when the use is interrupted or the device removed; and<br>(b) the accumulated use of a device that is intended by the manufacturer to be replaced immediately with another of the same type. |  |
+| **3.7** A device is considered to allow direct diagnosis when it provides the diagnosis of the disease or condition in question by itself or when it provides decisive information for the diagnosis. |  |
+
+## Chapter 3: Classification Rules
+
+**4.) Non-Invasive Devices**
+
+| Rules | Applicable |
+| ----- | ---------- |
+| ***Rule 1***<br>All non-invasive devices are classified as class I, unless one of the rules set out hereinafter applies. |  |
+| ***Rule 2***<br>All non-invasive devices intended for channelling or storing blood, body liquids, cells or tissues, liquids or gases for the purpose of eventual infusion, administration or introduction into the body are classified as class IIa:<br>— if they may be connected to a class IIa, class IIb or class III active device; or<br>— if they are intended for use for channelling or storing blood or other body liquids or for storing organs, parts<br>of organs or body cells and tissues, except for blood bags; blood bags are classified as class IIb.<br>In all other cases, such devices are classified as class I. | No |
+| ***Rule 3***<br>All non-invasive devices intended for modifying the biological or chemical composition of human tissues or cells, blood, other body liquids or other liquids intended for implantation or administration into the body are classified as class IIb, unless the treatment for which the device is used consists of filtration, centrifugation or exchanges of gas, heat, in which case they are classified as class IIa.<br><br>All non-invasive devices consisting of a substance or a mixture of substances intended to be used in vitro in direct<br>contact with human cells, tissues or organs taken from the human body or used in vitro with human embryos<br>before their implantation or administration into the body are classified as class III. | No |
+| ***Rule 4***<br>All non-invasive devices which come into contact with injured skin or mucous membrane are classified as:<br>— class I if they are intended to be used as a mechanical barrier, for compression or for absorption of exudates;<br>— class IIb if they are intended to be used principally for injuries to skin which have breached the dermis or<br>mucous membrane and can only heal by secondary intent;<br>— class IIa if they are principally intended to manage the micro-environment of injured skin or mucous membrane; and<br>— class IIa in all other cases.<br><br>This rule applies also to the invasive devices that come into contact with injured mucous membrane. | No |
+
+**5.) Invasive Devices**
+
+| Rules | Applicable |
+| ----- | ---------- |
+| ***Rule 5***<br>All invasive devices with respect to body orifices, other than surgically invasive devices, which are not intended for connection to an active device or which are intended for connection to a class I active device are classified as:<br>— class I if they are intended for transient use;<br>— class IIa if they are intended for short-term use, except if they are used in the oral cavity as far as the pharynx, in an ear canal up to the ear drum or in the nasal cavity, in which case they are classified as class I; and<br>— class IIb if they are intended for long-term use, except if they are used in the oral cavity as far as the pharynx, in an ear canal up to the ear drum or in the nasal cavity and are not liable to be absorbed by the mucous membrane, in which case they are classified as class IIa.<br><br>All invasive devices with respect to body orifices, other than surgically invasive devices, intended for connection<br>to a class IIa, class IIb or class III active device, are classified as class IIa. | No |
+| ***Rule 6***<br>All surgically invasive devices intended for transient use are classified as class IIa unless they:<br>— are intended specifically to control, diagnose, monitor or correct a defect of the heart or of the central circulatory system through direct contact with those parts of the body, in which case they are classified as class III;<br>— are reusable surgical instruments, in which case they are classified as class I;<br>— are intended specifically for use in direct contact with the heart or central circulatory system or the central nervous system, in which case they are classified as class III;<br>— are intended to supply energy in the form of ionising radiation in which case they are classified as class IIb;<br>— have a biological effect or are wholly or mainly absorbed in which case they are classified as class IIb; or<br>— are intended to administer medicinal products by means of a delivery system, if such administration of a medicinal product is done in a manner that is potentially hazardous taking account of the mode of application, in which case they are classified as class IIb. | No |
+| ***Rule 7***<br>All surgically invasive devices intended for short-term use are classified as class IIa unless they:<br>— are intended specifically to control, diagnose, monitor or correct a defect of the heart or of the central circulatory system through direct contact with those parts of the body, in which case they are classified as class III;<br>— are intended specifically for use in direct contact with the heart or central circulatory system or the central nervous system, in which case they are classified as class III;<br>— are intended to supply energy in the form of ionizing radiation in which case they are classified as class IIb;<br>— have a biological effect or are wholly or mainly absorbed in which case they are classified as class III;<br>— are intended to undergo chemical change in the body in which case they are classified as class IIb, except if the devices are placed in the teeth; or<br>— are intended to administer medicines, in which case they are classified as class IIb. | No |
+| ***Rule 8***<br>All implantable devices and long-term surgically invasive devices are classified as class IIb unless they:<br>— are intended to be placed in the teeth, in which case they are classified as class IIa;<br>— are intended to be used in direct contact with the heart, the central circulatory system or the central nervous system, in which case they are classified as class III;<br>— have a biological effect or are wholly or mainly absorbed, in which case they are classified as class III;<br>— are intended to undergo chemical change in the body in which case they are classified as class III, except if the devices are placed in the teeth;<br>— are intended to administer medicinal products, in which case they are classified as class III;<br>— are active implantable devices or their accessories, in which cases they are classified as class III;<br>— are breast implants or surgical meshes, in which cases they are classified as class III;<br>— are total or partial joint replacements, in which case they are classified as class III, with the exception of ancillary components such as screws, wedges, plates and instruments; or<br>— are spinal disc replacement implants or are implantable devices that come into contact with the spinal column, in which case they are classified as class III with the exception of components such as screws, wedges, plates and instruments. | No |
+
+**6.) Active Devices**
+
+| Rules | Applicable |
+| ----- | ---------- |
+| ***Rule 9***<br>All active therapeutic devices intended to administer or exchange energy are classified as class IIa unless their characteristics are such that they may administer energy to or exchange energy with the human body in a potentially hazardous way, taking account of the nature, the density and site of application of the energy, in which case they are classified as class IIb.<br><br>All active devices intended to control or monitor the performance of active therapeutic class IIb devices, or intended directly to influence the performance of such devices are classified as class IIb.<br><br>All active devices intended to emit ionizing radiation for therapeutic purposes, including devices which control or monitor such devices, or which directly influence their performance, are classified as class IIb.<br><br>All active devices that are intended for controlling, monitoring or directly influencing the performance of active implantable devices are classified as class III. |  |
+| ***Rule 10***<br>Active devices intended for diagnosis and monitoring are classified as class IIa:<br>— if they are intended to supply energy which will be absorbed by the human body, except for devices intended to illuminate the patient's body, in the visible spectrum, in which case they are classified as class I;<br>— if they are intended to image in vivo distribution of radiopharmaceuticals; or<br>— if they are intended to allow direct diagnosis or monitoring of vital physiological processes, unless they are specifically intended for monitoring of vital physiological parameters and the nature of variations of those parameters is such that it could result in immediate danger to the patient, for instance variations in cardiac performance, respiration, activity of the central nervous system, or they are intended for diagnosis in clinical situations where the patient is in immediate danger, in which cases they are classified as class IIb.<br><br>Active devices intended to emit ionizing radiation and intended for diagnostic or therapeutic radiology, including interventional radiology devices and devices which control or monitor such devices, or which directly influence their performance, are classified as class IIb. |  |
+| ***Rule 11***<br>Software intended to provide information which is used to take decisions with diagnosis or therapeutic purposes is classified as class IIa, except if such decisions have an impact that may cause:<br>— death or an irreversible deterioration of a person's state of health, in which case it is in class III; or<br>— a serious deterioration of a person's state of health or a surgical intervention, in which case it is classified as class IIb.<br><br>Software intended to monitor physiological processes is classified as class IIa, except if it is intended for monitoring of vital physiological parameters, where the nature of variations of those parameters is such that it could result in immediate danger to the patient, in which case it is classified as class IIb. All other software is classified as class I. | Yes |
+| ***Rule 12***<br>All active devices intended to administer and/or remove medicinal products, body liquids or other substances to or from the body are classified as class IIa, unless this is done in a manner that is potentially hazardous, taking account of the nature of the substances involved, of the part of the body concerned and of the mode of application in which case they are classified as class IIb. |  |
+| ***Rule 13***<br>All other active devices are classified as class I. |  |
+
+**7.) Special Rules**
+
+| Rules | Applicable |
+| ----- | ---------- |
+| ***Rule 14***<br>All devices incorporating, as an integral part, a substance which, if used separately, can be considered to be a medicinal product, as defined in point 2 of Article 1 of Directive 2001/83/EC, including a medicinal product derived from human blood or human plasma, as defined in point 10 of Article 1 of that Directive, and that has an action ancillary to that of the devices, are classified as class III. | No |
+| ***Rule 15***<br>All devices used for contraception or prevention of the transmission of sexually transmitted diseases are classified as class IIb, unless they are implantable or long term invasive devices, in which case they are classified as class III. | No |
+| ***Rule 16***<br>All devices intended specifically to be used for disinfecting, cleaning, rinsing or, where appropriate, hydrating contact lenses are classified as class IIb.<br><br>All devices intended specifically to be used for disinfecting or sterilising medical devices are classified as class IIa, unless they are disinfecting solutions or washer-disinfectors intended specifically to be used for disinfecting invasive devices, as the end point of processing, in which case they are classified as class IIb.<br><br>This rule does not apply to devices that are intended to clean devices other than contact lenses by means of physical action only. | No |
+| ***Rule 17***<br>Devices specifically intended for recording of diagnostic images generated by X-ray radiation are classified as class IIa. | No |
+| ***Rule 18***<br>All devices manufactured utilizing tissues or cells of human or animal origin, or their derivatives, which are non-viable or rendered non-viable, are classified as class III, unless such devices are manufactured utilizing tissues or cells of animal origin, or their derivatives, which are non-viable or rendered non-viable and are devices intended to come into contact with intact skin only. | No |
+| ***Rule 19***<br>All devices incorporating or consisting of nanomaterial are classified as:<br>— class III if they present a high or medium potential for internal exposure;<br>— class IIb if they present a low potential for internal exposure; and<br>— class IIa if they present a negligible potential for internal exposure. | No |
+| ***Rule 20***<br>All invasive devices with respect to body orifices, other than surgically invasive devices, which are intended to administer medicinal products by inhalation are classified as class IIa, unless their mode of action has an essential impact on the efficacy and safety of the administered medicinal product or they are intended to treat life-threatening conditions, in which case they are classified as class IIb. | No |
+| ***Rule 21***<br>Devices that are composed of substances or of combinations of substances that are intended to be introduced into the human body via a body orifice or applied to the skin and that are absorbed by or locally dispersed in the human body are classified as:<br>— class III if they, or their products of metabolism, are systemically absorbed by the human body in order to achieve the intended purpose;<br>— class III if they achieve their intended purpose in the stomach or lower gastrointestinal tract and they, or their products of metabolism, are systemically absorbed by the human body;<br>— class IIa if they are applied to the skin or if they are applied in the nasal or oral cavity as far as the pharynx, and achieve their intended purpose on those cavities; and<br>— class IIb in all other cases. | No |
+| ***Rule 22***<br>Active therapeutic devices with an integrated or incorporated diagnostic function which significantly determines the patient management by the device, such as closed loop systems or automated external defibrillators, are classified as class III. |  |
+
+---
+
+Template Copyright [openregulatory.com](https://openregulatory.com). See [template
+license](https://openregulatory.com/template-license).
+
+Please don't remove this notice even if you've modified contents of this template.

package/vendor/dev-docs-templates/templates/mdr_docs/PA/risk-management-plan.md

@@ -0,0 +1,198 @@
+# Risk Management Plan
+
+<!-- AI AGENT 작성 지침
+이 문서는 ISO 14971:2019 기반 위험 관리 계획서입니다. PA 단계에서 작성하는 핵심 산출물입니다.
+
+작성 전 반드시 다음 문서를 참조하세요:
+  - 사용 목적 정의서(intended-use.md): 의도된 사용자, 사용 환경, 의료 목적 확인
+
+작성 지침:
+1. 제품명과 버전을 문서 상단에 명시하세요
+2. 1.2.1 사용량 추정은 실제 제품의 예상 사용자 수와 수명을 기반으로 작성하세요
+   - 예: 제품 수명 3년, 일일 100회 사용 -> 총 109,575회 사용
+3. 1.2.2 중증도 등급(S1~S4)은 실제 제품에서 발생 가능한 위해 예시로 변경하세요
+   - 진단 보조 SW의 경우: 오진으로 인한 불필요한 시술, 치료 지연 등
+4. 1.2.3 확률 등급(P1~P5)의 "Estimated Maximum Event Count"를 실제 사용량 계산 결과로 업데이트하세요
+5. 1.2.4 위험 허용 매트릭스는 제품의 의료적 이득-위험 균형을 반영하여 결정하세요
+6. 담당자(Roles) 섹션에 실제 담당자 이름과 역할을 기재하세요
+
+위험 관리 계획서 완성 체크리스트:
+  [ ] 제품명/버전 명시
+  [ ] 위험 관리자(Risk Manager) 지정
+  [ ] 사용량 추정 수치 입력
+  [ ] 중증도 정의가 제품 특성에 맞게 수정됨
+  [ ] 위험 허용 매트릭스 경영진 승인 완료
+  [ ] SOP Integrated Software Development 참조 확인
+-->
+
+
+The Risk Management Plan contains the risk policy and defines the criteria for risk acceptance. It also
+references relevant processes and activities which will be conducted for product-specific risk management as
+part of the integrated software development process (SOP Integrated Software Development).
+
+## Mapping of Standard Requirements to Document Sections
+
+| ISO 14971:2019 Section | Document Section                                |
+| ---------------------- | ----------------------------------------------- |
+| 4.1                    | 1                                               |
+| 4.2                    | 1.2, 3                                          |
+| 4.3                    | (Records of competence are kept as Part of QMS) |
+| 4.4                    | (all)                                           |
+| 4.5                    | (all)                                           |
+| 5.1                    | 1.1                                             |
+| 7.2                    | 1.3                                             |
+| 10.1                   | 1.4                                             |
+
+## 1. Relevant Processes
+
+### 1.1 Risk Management Process and Activities
+
+Risk Management Activities are integrated in the software development lifecycle as described in SOP Integrated
+Software Development. The scope of this risk management plan therefore covers the entire software device lifecycle.
+
+When creating a first-time risk analysis for a product, Annex C of ISO 14971 should be reviewed for applicable examples.
+
+### 1.2 Risk Policy and Risk Acceptability
+
+The following policy establishes criteria for risk acceptability following ISO 14971:2019 and ISO/TR
+24971:2020. It applies to all people and activities involved in the design, development and distribution
+process of the medical device, and intends to ensure highest levels of medical device safety consistent with
+stakeholder expectations.
+
+The manufacturer defines framework criteria for risk acceptability in the form of estimated usage, severity of
+harm and probability of occurrence. The criteria are initially defined as part of the early software development process and reviewed during each post-market surveillance cycle.
+
+Estimated usage, categories of severity / probability and risk matrix acceptance are defined based on
+applicable regulatory requirements, relevant international norms and standards, as well as the generally
+acknowledged state of the art (e.g. accepted results of scientific research, reports published by authorities,
+established industry best practices).
+
+Acceptability for individual risks always must be established based on both, the estimated severity and the
+estimated probability of a risk. The risk is deemed acceptable based on a combination of both, following the
+risk matrix defined in para. 1.2.4.
+
+All identified risks must be reduced as far as possible (AFAP) without adversely affecting the
+benefit-risk-ratio. Risk control measures implemented to reduce the risks must be chosen in the following
+order:
+
+1. Inherent safety by design
+2. Protective measures
+3. Information for safety
+
+Users of the device must be informed about any remaining residual risks.
+
+Acceptability of the overall residual risk is established as part of the clinical evaluation process by
+weighing benefits from intended use against the overall residual risk. Benefits may be described by their
+magnitude or extent, the probability of experience within the intended patient population, the duration and
+frequency of the benefit. For example, the manufacturer may compare the device to similar medical devices
+available on the market: residual risks can be compared individually to corresponding risks of the similar
+device, considering differences in intended use. The overall evaluation of the benefit-risk-ratio should take
+into account knowledge of the intended medical indication, the generally acknowledged state of the art in
+technology and medicine, and the availability of alternative medical devices or treatments.
+
+#### 1.2.1 Estimates for Usage
+
+> Define estimates for how much you think your device is going to be used in the market.
+
+| Usage             | Values                                                                                                             |
+| ----------------- | ------------------------------------------------------------------------------------------------------------------ |
+| Product life span | Enter number of years you expect the device to be in the market (from design conceptualization to decommissioning) |
+| Users             | Enter number of estimated users here                                                                               |
+| Usages / user     | Enter number of estimated times the device is used per user                                                        |
+| Total usages      | Do the math!                                                                                                       |
+
+The software's lifetime is established to be [for example: three years]. This is what is expected to be the
+maximum time until the implementation of a significant change, by which the manufacturer is able to react to
+the relevant changes to the software device environment, such as SOUP changes, cybersecurity innovations, or
+the evolving technological or medical state of the art.
+
+Estimated product lifetime may not align with the planned PMS / PMCF surveillance periods, as continuous risk
+management involves continuous updates of the risk management file in order to account for new information in
+a timely manner.
+
+#### 1.2.2 Severity of Harm
+
+> Define what can go wrong with your product here. Make the examples specific - chances are, your product
+> can't cause skin lacerations. In all likelihood it also doesn't cause death. So, feel free to remove
+> severity rows here. But most importantly, customize the definitions and examples so that they resemble the
+> harms in your product.
+
+| Severity         | Definition and Examples                                                                                   |
+| ---------------- | --------------------------------------------------------------------------------------------------------- |
+| S1: Negligible   | Minor, reversible damage, e.g. superficial skin irritation, delay of non-critical treatment               |
+| S2: Marginal     | Minor, reversible damage with required medical intervention, e.g. skin laceration requiring stitches      |
+| S3: Critical     | Major, irreversible damage with required medical intervention, e.g. irreversible deterioration of disease |
+| S4: Catastrophic | Death                                                                                                     |
+
+#### 1.2.3 Probability of Occurrence
+
+> Define your probabilities. You can probably just use these definitions. The idea is that each probability
+> row is 10^2 apart from adjacent ones.
+
+> Also, change the "Estimated Maximum Event Count". That's the usage number you estimate for your (not yet
+> released product) during its entire lifecycle (which you need to define). So, if you assume that your
+> product will be on the market for 4 years and that it'll be used 100 times per day, that results in 146.100
+> usages (100 usages/day * 365.25 days/year * 4 years). The numbers in the lower columns of "Estimated Maximum
+> Event Count" are simply the total usage number multiplied by the upper limit probability of the same row,
+> e.g. you want to know "how often can probability P3 occur if the product is being used 100 times per day?"
+
+| Probability     | Upper Limit | Lower Limit | Estimated Maximum Event Count |
+| --------------- | ----------- | ----------- | ----------------------------- |
+| P5: Certain     | 1           | 10^-2       | 1000000 *(change this*)       |
+| P4: Likely      | 10^-2       | 10^-4       | 10000                         |
+| P3: Unlikely    | 10^-4       | 10^-6       | 100                           |
+| P2: Rare        | 10^-6       | 10^-8       | 1                             |
+| P1: Unthinkable | 10^-8       | 0           | 0                             |
+
+#### 1.2.4 Risk Acceptance Matrix
+
+> The most important part. You assess each severity-probability combination whether it's acceptable for you as
+> a company. There are no definitive rules on what's deemed acceptable. It depends on your company's risk
+> policy and, more importantly, the benefits of your product which you show in your clinical evaluation. So,
+> for example, if your product saves 10 lives per day, it might be acceptable to cause one death per day. If
+> your product doesn't save any lives, it might not be acceptable to cause any deaths. You get the idea, I
+> hope.
+
+| Probability     | S1: Negligible | S2: Marginal     | S3: Critical     | S4: Catastrophic | Estimated Maximum Event Count |
+| --------------- | -------------- | ---------------- | ---------------- | ---------------- | ----------------------------- |
+| P5: Certain     | acceptable     | **unacceptable** | **unacceptable** | **unacceptable** | 1000000                       |
+| P4: Likely      | acceptable     | **unacceptable** | **unacceptable** | **unacceptable** | 10000                         |
+| P3: Unlikely    | acceptable     | acceptable       | **unacceptable** | **unacceptable** | 100                           |
+| P2: Rare        | acceptable     | acceptable       | acceptable       | **unacceptable** | 1                             |
+| P1: Unthinkable | acceptable     | acceptable       | acceptable       | acceptable       | 0                             |
+
+### 1.3 Verification of Risk Control Measures
+
+Risk Control Measures are verified as described in the software development lifecycle as described in SOP
+Integrated Software Development.
+
+### 1.4 Assessment of the overall residual risk
+
+After determination of the Risk Control Measures any risk that could arise from the combination of the
+individual risks or mitigating measures is assessed. For this purpose, the probability and severity of the
+possible residual risk are estimated and evaluated using the existing risk matrix.
+
+### 1.5 Collection and Review of Post-Production Information
+
+Review and collection of Post-Production information is described in SOP Post-Market Surveillance.
+
+## 2. Related Documents
+
+ * SOP Integrated Software Development
+ * Risk Acceptance Matrix
+ * Risk Table
+ * Risk Management Report
+
+## 3. Roles
+
+| Title                                           | Name(s) |
+| ----------------------------------------------- | ------- |
+| Risk Manager                                    |         |
+| Context / Subject Matter Expert, e.g. physician |         |
+
+---
+
+Template Copyright [openregulatory.com](https://openregulatory.com). See [template
+license](https://openregulatory.com/template-license).
+
+Please don't remove this notice even if you've modified contents of this template.

package/vendor/dev-docs-templates/templates/mdr_docs/PA/security-management-plan.md

@@ -0,0 +1,101 @@
+# Security Management Plan
+
+<!-- AI AGENT 작성 지침
+이 문서는 IEC 81001-5-1:2021 (Health software — Part 5-1: Security activities
+in the software lifecycle) 및 AAMI TIR57 기반 보안 관리 계획서입니다.
+PA 단계 핵심 산출물로, 본 문서가 보안의 단일 진실의 원천입니다.
+
+작성 전 반드시 다음 문서를 참조하세요:
+  - 소프트웨어 개발 및 유지보수 계획서(software-development-maintenance-plan.md): 개발 프로세스
+  - 위험 관리 계획서(risk-management-plan.md): 위해 정의, 위험 수용 기준
+  - 시스템 요구사항 명세서(system-requirements-spec.md): 시스템 경계, 자산
+
+작성 지침:
+1. Section 1 (보안 정책): Security by Design 원칙과 조직 보안 정책을 명시
+2. Section 3 (위협 모델링): 접근법(STRIDE 등)만 명시 — 구체적 위협 목록은 EA 산출물
+3. Section 5 (보안 V&V): 어떤 검증을 수행할지(SAST/SCA/침투테스트)만 명시 — 도구·절차 세부는 EA
+4. 본 문서는 PA 'Plan' 성격 — 구현 세부(SBOM 도구명·CVD runbook 등)는 EA/운영 단계로 미룸
+
+완성 체크리스트:
+  [ ] 보안 정책(Security by Design) 명시
+  [ ] 자산·위협 모델링 접근법 정의
+  [ ] 보안 요구사항 도출 기준(CIA) 정의
+  [ ] 보안 V&V 접근법(SAST/SCA/펜테스트) 명시
+  [ ] 취약점 관리·CVE 모니터링 주기 정의
+  [ ] 보안 담당자(Security Manager) 지정
+-->
+
+{PROJECT_NAME}의 보안 관리 계획서. 본 문서는 IEC 81001-5-1:2021에 따라 소프트웨어 보안
+활동을 정의하며, 보안의 단일 진실의 원천이다. 작성자: {AUTHOR}, 티켓: {TICKET_ID}, 일자: {DATE}.
+
+## Mapping of Standard Requirements to Document Sections
+
+| Standard                | Clause                                                                          | Document Section |
+| ----------------------- | ------------------------------------------------------------------------------- | ---------------- |
+| IEC 81001-5-1:2021      | 5.1.1 Cybersecurity risk management plan                                        | all              |
+| IEC 81001-5-1:2021      | 5.2 Threat modelling                                                            | 3                |
+| IEC 81001-5-1:2021      | 5.3 Specification of security requirements                                       | 4                |
+| IEC 81001-5-1:2021      | 5.4 Implementation of security controls (planning)                              | 4                |
+| IEC 81001-5-1:2021      | 5.5 Cybersecurity risk control verification (approach)                          | 5                |
+| IEC 81001-5-1:2021      | 7 Cybersecurity activities in the operation phase (approach)                    | 6, 7             |
+| AAMI TIR57              | Security Risk Management Process                                                | 3, 4             |
+
+## 1. Purpose, Scope and Security Policy
+
+> 목적·적용 범위·Security by Design 원칙·조직 보안 정책을 기술.
+
+* Security by Design 원칙: 최소 권한, 방어 심도, 보안 기본값(deny-by-default)
+* {SECURITY_POLICY}
+
+## 2. Security Organization and Roles
+
+| Title             | Name(s) |
+| ----------------- | ------- |
+| Security Manager  |         |
+| Incident Response |         |
+
+## 3. Threat Modelling Approach
+
+> 위협 모델링 **접근법**만 명시. 구체적 위협 식별·평가는 EA 산출물로 이관.
+
+* 방법론: {THREAT_METHODOLOGY} (예: STRIDE — Spoofing/Tampering/Repudiation/Info Disclosure/DoS/Elevation of Privilege)
+* 자산 식별 범위: {ASSET_SCOPE}
+
+## 4. Security Requirements
+
+> 보안 요구사항 도출 기준. CIA(기밀성·무결성·가용성) 관점.
+
+도출 기준:
+* 인증(Authentication): {AUTH_CRITERIA}
+* 권한 부여(Authorization): {AUTHZ_CRITERIA}
+* 암호화(Encryption): {CRYPTO_CRITERIA}
+* 로깅·감사(Logging): {LOGGING_CRITERIA}
+
+## 5. Security V&V Approach
+
+> 보안 검증 **접근법** — 무엇을 수행할지만 명시. 도구·절차 세부는 EA.
+
+* 정적 분석(SAST): {SAST_APPROACH}
+* 소프트웨어 구성 분석(SCA) / 취약점 스캔: {SCA_APPROACH}
+* 침투 테스트: {PENTEST_APPROACH}
+
+## 6. Vulnerability Management
+
+> 취약점 관리·CVE 모니터링 주기 — 계획 수준.
+
+* CVE 모니터링 주기: {CVE_MONITORING_FREQUENCY}
+* 취약점 등록·조치: {VULN_TRACKING}
+
+## 7. Cybersecurity Incident Response / CVD
+
+> 보안 사고 대응·Coordinated Vulnerability Disclosure 접근법 — 계획 수준.
+
+* 사고 대응 절차: {INCIDENT_RESPONSE}
+* CVD 정책: {CVD_POLICY}
+
+## 8. SBOM Management
+
+> Software Bill of Materials 관리 방침.
+
+* SBOM 형식: {SBOM_FORMAT} (예: SPDX, CycloneDX)
+* 생성·갱신 시점: {SBOM_GENERATION}