--- title: "Software Team Onboarding - Learning Path - MedTech Terms" description: "What software engineers joining a MedTech team need to know: IEC 62304 lifecycle, SOUP, cybersecurity under Section 524B, and AI change control." lang: en json-ld: | { "@context": "https://schema.org", "@graph": [ { "@type": [ "Course", "LearningResource" ], "@id": "https://medtechterms.com/paths/software-team-onboarding#course", "name": "Software Team Onboarding", "description": "What software engineers joining a MedTech team need to know: IEC 62304 lifecycle, SOUP, cybersecurity under Section 524B, and AI change control.", "url": "https://medtechterms.com/paths/software-team-onboarding", "courseCode": "software-team-onboarding", "educationalLevel": "Professional", "learningResourceType": "Curriculum", "inLanguage": "en", "teaches": [ "Software as a Medical Device", "Software in a Medical Device", "IEC 62304", "Software Safety Classification", "Software of Unknown Provenance", "Verification & Validation", "Clinical Decision Support", "Section 524B of the FD&C Act", "Secure Product Development Framework", "Software Bill of Materials", "Threat Modeling", "Predetermined Change Control Plan" ], "about": [ { "@type": "DefinedTerm", "@id": "https://medtechterms.com/terms/samd#term", "name": "Software as a Medical Device", "alternateName": "SaMD", "url": "https://medtechterms.com/terms/samd" }, { "@type": "DefinedTerm", "@id": "https://medtechterms.com/terms/simd#term", "name": "Software in a Medical Device", "alternateName": "SiMD", "url": "https://medtechterms.com/terms/simd" }, { "@type": "DefinedTerm", "@id": "https://medtechterms.com/terms/iec-62304#term", "name": "IEC 62304", "url": "https://medtechterms.com/terms/iec-62304" }, { "@type": "DefinedTerm", "@id": "https://medtechterms.com/terms/software-safety-class#term", "name": "Software Safety Classification", "url": "https://medtechterms.com/terms/software-safety-class" }, { "@type": "DefinedTerm", "@id": "https://medtechterms.com/terms/soup#term", "name": "Software of Unknown Provenance", "alternateName": "SOUP", "url": "https://medtechterms.com/terms/soup" }, { "@type": "DefinedTerm", "@id": "https://medtechterms.com/terms/verification-validation#term", "name": "Verification & Validation", "alternateName": "V&V", "url": "https://medtechterms.com/terms/verification-validation" }, { "@type": "DefinedTerm", "@id": "https://medtechterms.com/terms/cds#term", "name": "Clinical Decision Support", "alternateName": "CDS", "url": "https://medtechterms.com/terms/cds" }, { "@type": "DefinedTerm", "@id": "https://medtechterms.com/terms/section-524b#term", "name": "Section 524B of the FD&C Act", "alternateName": "524B", "url": "https://medtechterms.com/terms/section-524b" }, { "@type": "DefinedTerm", "@id": "https://medtechterms.com/terms/spdf#term", "name": "Secure Product Development Framework", "alternateName": "SPDF", "url": "https://medtechterms.com/terms/spdf" }, { "@type": "DefinedTerm", "@id": "https://medtechterms.com/terms/sbom#term", "name": "Software Bill of Materials", "alternateName": "SBOM", "url": "https://medtechterms.com/terms/sbom" }, { "@type": "DefinedTerm", "@id": "https://medtechterms.com/terms/threat-modeling#term", "name": "Threat Modeling", "url": "https://medtechterms.com/terms/threat-modeling" }, { "@type": "DefinedTerm", "@id": "https://medtechterms.com/terms/ai-ml-pccp#term", "name": "Predetermined Change Control Plan", "alternateName": "PCCP", "url": "https://medtechterms.com/terms/ai-ml-pccp" } ], "audience": { "@type": "EducationalAudience", "educationalRole": "Software · DevOps · Security" }, "provider": { "@type": "Organization", "name": "MedTech Terms", "url": "https://medtechterms.com", "sameAs": [ "https://bluegoatcyber.com" ] }, "offers": { "@type": "Offer", "price": "0", "priceCurrency": "USD", "category": "Free", "availability": "https://schema.org/InStock" }, "hasCourseInstance": { "@type": "CourseInstance", "@id": "https://medtechterms.com/paths/software-team-onboarding#instance", "courseMode": "Online", "courseWorkload": "PT60M", "inLanguage": "en", "instructor": { "@type": "Person", "name": "Christian Espinosa", "jobTitle": "Founder, Blue Goat Cyber", "url": "https://medtechterms.com/authors/christian-espinosa" } }, "hasPart": [ { "@type": "LearningResource", "@id": "https://medtechterms.com/terms/samd#lesson-software-team-onboarding", "name": "Software as a Medical Device", "url": "https://medtechterms.com/terms/samd", "learningResourceType": "Lesson", "inLanguage": "en", "description": "The distinction that decides whether your app is itself a device.", "about": { "@type": "DefinedTerm", "@id": "https://medtechterms.com/terms/samd#term", "name": "Software as a Medical Device", "alternateName": "SaMD", "url": "https://medtechterms.com/terms/samd" }, "isPartOf": { "@id": "https://medtechterms.com/paths/software-team-onboarding#course" } }, { "@type": "LearningResource", "@id": "https://medtechterms.com/terms/simd#lesson-software-team-onboarding", "name": "Software in a Medical Device", "url": "https://medtechterms.com/terms/simd", "learningResourceType": "Lesson", "inLanguage": "en", "description": "The other side: software embedded in or required by a hardware device.", "about": { "@type": "DefinedTerm", "@id": "https://medtechterms.com/terms/simd#term", "name": "Software in a Medical Device", "alternateName": "SiMD", "url": "https://medtechterms.com/terms/simd" }, "isPartOf": { "@id": "https://medtechterms.com/paths/software-team-onboarding#course" } }, { "@type": "LearningResource", "@id": "https://medtechterms.com/terms/iec-62304#lesson-software-team-onboarding", "name": "IEC 62304", "url": "https://medtechterms.com/terms/iec-62304", "learningResourceType": "Lesson", "inLanguage": "en", "description": "The lifecycle standard that shapes your SDLC deliverables.", "about": { "@type": "DefinedTerm", "@id": "https://medtechterms.com/terms/iec-62304#term", "name": "IEC 62304", "url": "https://medtechterms.com/terms/iec-62304" }, "isPartOf": { "@id": "https://medtechterms.com/paths/software-team-onboarding#course" } }, { "@type": "LearningResource", "@id": "https://medtechterms.com/terms/software-safety-class#lesson-software-team-onboarding", "name": "Software Safety Classification", "url": "https://medtechterms.com/terms/software-safety-class", "learningResourceType": "Lesson", "inLanguage": "en", "description": "Class A / B / C: the single biggest driver of process rigor.", "about": { "@type": "DefinedTerm", "@id": "https://medtechterms.com/terms/software-safety-class#term", "name": "Software Safety Classification", "url": "https://medtechterms.com/terms/software-safety-class" }, "isPartOf": { "@id": "https://medtechterms.com/paths/software-team-onboarding#course" } }, { "@type": "LearningResource", "@id": "https://medtechterms.com/terms/soup#lesson-software-team-onboarding", "name": "Software of Unknown Provenance", "url": "https://medtechterms.com/terms/soup", "learningResourceType": "Lesson", "inLanguage": "en", "description": "Software Of Unknown Provenance: how open-source dependencies get evaluated.", "about": { "@type": "DefinedTerm", "@id": "https://medtechterms.com/terms/soup#term", "name": "Software of Unknown Provenance", "alternateName": "SOUP", "url": "https://medtechterms.com/terms/soup" }, "isPartOf": { "@id": "https://medtechterms.com/paths/software-team-onboarding#course" } }, { "@type": "LearningResource", "@id": "https://medtechterms.com/terms/verification-validation#lesson-software-team-onboarding", "name": "Verification & Validation", "url": "https://medtechterms.com/terms/verification-validation", "learningResourceType": "Lesson", "inLanguage": "en", "description": "The MedTech meanings of V&V, which do not match engineering shorthand.", "about": { "@type": "DefinedTerm", "@id": "https://medtechterms.com/terms/verification-validation#term", "name": "Verification & Validation", "alternateName": "V&V", "url": "https://medtechterms.com/terms/verification-validation" }, "isPartOf": { "@id": "https://medtechterms.com/paths/software-team-onboarding#course" } }, { "@type": "LearningResource", "@id": "https://medtechterms.com/terms/cds#lesson-software-team-onboarding", "name": "Clinical Decision Support", "url": "https://medtechterms.com/terms/cds", "learningResourceType": "Lesson", "inLanguage": "en", "description": "Clinical Decision Support: where the device / non-device line matters most for software.", "about": { "@type": "DefinedTerm", "@id": "https://medtechterms.com/terms/cds#term", "name": "Clinical Decision Support", "alternateName": "CDS", "url": "https://medtechterms.com/terms/cds" }, "isPartOf": { "@id": "https://medtechterms.com/paths/software-team-onboarding#course" } }, { "@type": "LearningResource", "@id": "https://medtechterms.com/terms/section-524b#lesson-software-team-onboarding", "name": "Section 524B of the FD&C Act", "url": "https://medtechterms.com/terms/section-524b", "learningResourceType": "Lesson", "inLanguage": "en", "description": "The FD&C Act section that turned cybersecurity into a premarket must-have.", "about": { "@type": "DefinedTerm", "@id": "https://medtechterms.com/terms/section-524b#term", "name": "Section 524B of the FD&C Act", "alternateName": "524B", "url": "https://medtechterms.com/terms/section-524b" }, "isPartOf": { "@id": "https://medtechterms.com/paths/software-team-onboarding#course" } }, { "@type": "LearningResource", "@id": "https://medtechterms.com/terms/spdf#lesson-software-team-onboarding", "name": "Secure Product Development Framework", "url": "https://medtechterms.com/terms/spdf", "learningResourceType": "Lesson", "inLanguage": "en", "description": "Secure Product Development Framework: the process 524B expects.", "about": { "@type": "DefinedTerm", "@id": "https://medtechterms.com/terms/spdf#term", "name": "Secure Product Development Framework", "alternateName": "SPDF", "url": "https://medtechterms.com/terms/spdf" }, "isPartOf": { "@id": "https://medtechterms.com/paths/software-team-onboarding#course" } }, { "@type": "LearningResource", "@id": "https://medtechterms.com/terms/sbom#lesson-software-team-onboarding", "name": "Software Bill of Materials", "url": "https://medtechterms.com/terms/sbom", "learningResourceType": "Lesson", "inLanguage": "en", "description": "Software Bill of Materials: now required in the eSTAR premarket package.", "about": { "@type": "DefinedTerm", "@id": "https://medtechterms.com/terms/sbom#term", "name": "Software Bill of Materials", "alternateName": "SBOM", "url": "https://medtechterms.com/terms/sbom" }, "isPartOf": { "@id": "https://medtechterms.com/paths/software-team-onboarding#course" } }, { "@type": "LearningResource", "@id": "https://medtechterms.com/terms/threat-modeling#lesson-software-team-onboarding", "name": "Threat Modeling", "url": "https://medtechterms.com/terms/threat-modeling", "learningResourceType": "Lesson", "inLanguage": "en", "description": "The design-time practice regulators expect to see documented, not just done.", "about": { "@type": "DefinedTerm", "@id": "https://medtechterms.com/terms/threat-modeling#term", "name": "Threat Modeling", "url": "https://medtechterms.com/terms/threat-modeling" }, "isPartOf": { "@id": "https://medtechterms.com/paths/software-team-onboarding#course" } }, { "@type": "LearningResource", "@id": "https://medtechterms.com/terms/ai-ml-pccp#lesson-software-team-onboarding", "name": "Predetermined Change Control Plan", "url": "https://medtechterms.com/terms/ai-ml-pccp", "learningResourceType": "Lesson", "inLanguage": "en", "description": "How to ship model updates without a new submission each time.", "about": { "@type": "DefinedTerm", "@id": "https://medtechterms.com/terms/ai-ml-pccp#term", "name": "Predetermined Change Control Plan", "alternateName": "PCCP", "url": "https://medtechterms.com/terms/ai-ml-pccp" }, "isPartOf": { "@id": "https://medtechterms.com/paths/software-team-onboarding#course" } } ] }, { "@type": "ItemList", "@id": "https://medtechterms.com/paths/software-team-onboarding#itemlist", "name": "Software Team Onboarding", "itemListOrder": "https://schema.org/ItemListOrderAscending", "numberOfItems": 12, "itemListElement": [ { "@type": "ListItem", "position": 1, "url": "https://medtechterms.com/terms/samd", "name": "Software as a Medical Device", "description": "The distinction that decides whether your app is itself a device." }, { "@type": "ListItem", "position": 2, "url": "https://medtechterms.com/terms/simd", "name": "Software in a Medical Device", "description": "The other side: software embedded in or required by a hardware device." }, { "@type": "ListItem", "position": 3, "url": "https://medtechterms.com/terms/iec-62304", "name": "IEC 62304", "description": "The lifecycle standard that shapes your SDLC deliverables." }, { "@type": "ListItem", "position": 4, "url": "https://medtechterms.com/terms/software-safety-class", "name": "Software Safety Classification", "description": "Class A / B / C: the single biggest driver of process rigor." }, { "@type": "ListItem", "position": 5, "url": "https://medtechterms.com/terms/soup", "name": "Software of Unknown Provenance", "description": "Software Of Unknown Provenance: how open-source dependencies get evaluated." }, { "@type": "ListItem", "position": 6, "url": "https://medtechterms.com/terms/verification-validation", "name": "Verification & Validation", "description": "The MedTech meanings of V&V, which do not match engineering shorthand." }, { "@type": "ListItem", "position": 7, "url": "https://medtechterms.com/terms/cds", "name": "Clinical Decision Support", "description": "Clinical Decision Support: where the device / non-device line matters most for software." }, { "@type": "ListItem", "position": 8, "url": "https://medtechterms.com/terms/section-524b", "name": "Section 524B of the FD&C Act", "description": "The FD&C Act section that turned cybersecurity into a premarket must-have." }, { "@type": "ListItem", "position": 9, "url": "https://medtechterms.com/terms/spdf", "name": "Secure Product Development Framework", "description": "Secure Product Development Framework: the process 524B expects." }, { "@type": "ListItem", "position": 10, "url": "https://medtechterms.com/terms/sbom", "name": "Software Bill of Materials", "description": "Software Bill of Materials: now required in the eSTAR premarket package." }, { "@type": "ListItem", "position": 11, "url": "https://medtechterms.com/terms/threat-modeling", "name": "Threat Modeling", "description": "The design-time practice regulators expect to see documented, not just done." }, { "@type": "ListItem", "position": 12, "url": "https://medtechterms.com/terms/ai-ml-pccp", "name": "Predetermined Change Control Plan", "description": "How to ship model updates without a new submission each time." } ] }, { "@type": "BreadcrumbList", "itemListElement": [ { "@type": "ListItem", "position": 1, "name": "Home", "item": "https://medtechterms.com/" }, { "@type": "ListItem", "position": 2, "name": "Learning Paths", "item": "https://medtechterms.com/paths" }, { "@type": "ListItem", "position": 3, "name": "Software Team Onboarding", "item": "https://medtechterms.com/paths/software-team-onboarding" } ] } ] } --- [ MedTech Terms The authoritative reference ](/) Browse Learn [Latest](/latest) About [All paths](/paths)Software · DevOps · Security · 12 terms # Software Team Onboarding What software engineers joining a MedTech team need to know: IEC 62304 lifecycle, SOUP, cybersecurity under Section 524B, and AI change control. Your progress 0 of 12 lessons complete · up next: Software as a Medical Device [Start path](/terms/samd?from=software-team-onboarding) 1. 1 [ Software & AI ## Software as a Medical Device(SaMD) Software intended for medical purposes that performs without being part of a hardware device. Why this term here: The distinction that decides whether your app is itself a device. ](/terms/samd?from=software-team-onboarding)Mark done 2. 2 [ Software & AI ## Software in a Medical Device(SiMD) Software embedded in or required to operate a hardware medical device. Why this term here: The other side: software embedded in or required by a hardware device. ](/terms/simd?from=software-team-onboarding)Mark done 3. 3 [ Standards ## IEC 62304 Lifecycle requirements for medical device software. Why this term here: The lifecycle standard that shapes your SDLC deliverables. ](/terms/iec-62304?from=software-team-onboarding)Mark done 4. 4 [ Software & AI ## Software Safety Classification IEC 62304 classes A, B, C reflecting potential harm from software failure. Why this term here: Class A / B / C: the single biggest driver of process rigor. ](/terms/software-safety-class?from=software-team-onboarding)Mark done 5. 5 [ Software & AI ## Software of Unknown Provenance(SOUP) Software not developed for medical device use, or lacking adequate development records, incorporated into a device. Why this term here: Software Of Unknown Provenance: how open-source dependencies get evaluated. ](/terms/soup?from=software-team-onboarding)Mark done 6. 6 [ Quality & Risk ## Verification & Validation(V&V) Confirming design outputs meet inputs (V) and that devices meet user needs (V). Why this term here: The MedTech meanings of V&V, which do not match engineering shorthand. ](/terms/verification-validation?from=software-team-onboarding)Mark done 7. 7 [ Software & AI ## Clinical Decision Support(CDS) Software providing healthcare professionals with knowledge and patient-specific information. Why this term here: Clinical Decision Support: where the device / non-device line matters most for software. ](/terms/cds?from=software-team-onboarding)Mark done 8. 8 [ Cybersecurity ## Section 524B of the FD&C Act(524B) The federal statute that gives FDA explicit premarket authority over cybersecurity for cyber devices. Why this term here: The FD&C Act section that turned cybersecurity into a premarket must-have. ](/terms/section-524b?from=software-team-onboarding)Mark done 9. 9 [ Cybersecurity ## Secure Product Development Framework(SPDF) A documented, risk-based set of processes that build cybersecurity into a medical device across its full lifecycle. Why this term here: Secure Product Development Framework: the process 524B expects. ](/terms/spdf?from=software-team-onboarding)Mark done 10. 10 [ Cybersecurity ## Software Bill of Materials(SBOM) A machine-readable inventory of all software components, including open-source and third-party libraries, used to build a medical device. Why this term here: Software Bill of Materials: now required in the eSTAR premarket package. ](/terms/sbom?from=software-team-onboarding)Mark done 11. 11 [ Cybersecurity ## Threat Modeling A structured analysis that identifies how an attacker could compromise a medical device and what controls mitigate each threat. Why this term here: The design-time practice regulators expect to see documented, not just done. ](/terms/threat-modeling?from=software-team-onboarding)Mark done 12. 12 [ Software & AI ## Predetermined Change Control Plan(PCCP) FDA mechanism to pre-authorize specific modifications to AI/ML-enabled devices. Why this term here: How to ship model updates without a new submission each time. ](/terms/ai-ml-pccp?from=software-team-onboarding)Mark done Finished the path? Test yourself with a quiz tailored to these 12 terms. [Take the Software Team Onboarding quiz](/quiz?path=software-team-onboarding) MedTech Terms An authoritative, plain-language reference for the regulatory, quality, cybersecurity, and software terms that shape modern medical devices. Browse - [All terms](/terms) - [A–Z index](/a-z) - [Categories](/categories) - [Ecosystems](/ecosystems) - [Learning paths](/paths) - [Compare terms](/compare) - [Quiz](/quiz) Resources - [FDA Medical Devices](https://www.fda.gov/medical-devices) - [EU MDR](https://eur-lex.europa.eu/eli/reg/2017/745/oj) - [IMDRF](https://www.imdrf.org/) - [Methodology](/methodology) - [Changelog](/changelog) - [Editor: Christian Espinosa](/authors/christian-espinosa) - [About this site](/about) © 2026 MedTech Terms. Reference content for educational purposes - not regulatory advice. A community resource sponsored by [Blue Goat Cyber](https://bluegoatcyber.com)