Section 524B made the cybersecurity of your product a condition of getting to market. But the systems that design, build, release and support that product — your quality system, your manufacturing execution, your complaint handling — have no such gate. They just have to keep working. This page is about what happens when they don't.
Your submission covered the software bill of materials (SBOM), the secure development framework, the postmarket vulnerability process. None of it covers what happens when your manufacturing execution system, your quality management system, or your contract manufacturer goes down.
When the electronic quality management system (eQMS) that controls release is unavailable, product doesn't ship — and complaint handling, CAPA and postmarket surveillance clocks keep running whether your systems are up or not.
524B requires processes to monitor, identify and address vulnerabilities in marketed devices on an ongoing basis. If the systems and teams running that process are down or in chaos, the obligation doesn't wait.
A missed complaint-handling clock is a nonconformity. A release made while the quality system was impaired is a finding. A recall coordinated over email and spreadsheets, under pressure, is how a manageable field action becomes an inspection issue.
The manufacturers that come through disruptions cleanly aren't the ones with the thickest procedures. They're the ones who knew which systems their obligations ran on, and had already decided who does what when one of them fails.
| What you're accountable for | What it means in practice | What Resilis offers |
|---|---|---|
| Postmarket cybersecurity — FD&C Act Section 524B | Ongoing processes to monitor, identify and address vulnerabilities in marketed devices. A product-security obligation — but one that runs on people, systems and coordination that must keep functioning | Continuity for the operation behind the obligation: the teams, systems and escalation paths your postmarket process depends on, mapped and exercisable. Resilis is not a 524B compliance tool — it keeps the operation running that your 524B process lives in |
| Quality system continuity (ISO 13485 discipline / FDA quality system requirements) | Release, complaint handling, CAPA and document control all run on validated systems. When they're down, obligations don't pause | Your quality-critical systems mapped as dependencies, with defined fallback, escalation, and reflex cards — one-page action aids per role — before failure |
| Field actions and recalls | Coordination under time pressure, across regulatory, quality, supply chain and communications — with a record regulators can inspect afterward | A crisis structure with roles and authorities decided in advance, executed in the platform, every action dated and attributed as it happens |
| Contract manufacturer and supplier dependency | Your obligations don't transfer when the work does | A dependency map spanning contract manufacturers, sterilizers, and critical component suppliers, with oversight evidence per critical partner |
| Learning loop | Disruptions and exercises should improve the procedures | After-action findings surfaced as suggested updates for your quality organization to review and validate — nothing changes without human sign-off |
Abbreviations: SaMD — software as a medical device; SBOM — software bill of materials; eQMS — electronic quality management system; CAPA — corrective and preventive action; FD&C Act — Federal Food, Drug, and Cosmetic Act; RA/QA — regulatory affairs / quality assurance; ISO — International Organization for Standardization.
Resilis works from system dependencies, recovery objectives and impact figures. No device history records, no design files, no patient data. Bringing Resilis in doesn't extend the boundary of your validated environment.
Resilis supports your continuity program; it is not a system of record in your quality system and we don't ask you to validate it as one. If your quality organization needs supplier qualification documentation, we'll work to what your standard operating procedures require.
Infrastructure certified to ISO 27001 and PCI-DSS. SOC 2 is underway — controls in place today; the report formalizes what buyers expect. Hosting and residency are addressed at onboarding: US-region hosting for US clients.
The enterprise resilience platforms are priced for the conglomerates. Your obligations are the same shape at a tenth the headcount.
Hugues Lajoie has lived your regulatory world: as Chief Executive Officer of Deeplink Medical, he built teleradiology technology certified as a medical device — the quality-system, certification and data-integrity discipline your industry runs on — after years running operational risk and business continuity inside a regulated bank. Julien Puaux spent a decade on crisis assignments for major institutions and served on the emergency desk at Médecins Sans Frontières (MSF).
One founder has certified a medical device. The other has coordinated real emergency response. That combination is why the product treats a quality-system outage as the operational crisis it is.
Your first conversation isn't with an SDR — it's with an independent advisor who works alongside Resilis on its US expansion. It's a working session, not a pitch: we map the systems and partners your quality obligations actually run on, where a failure would stop release or a field action, and how your team would run it if it happened tomorrow.
Book a 20-minute review