--- title: "SOUP, Software of Unknown Provenance | MedTech Terms" description: "Software not developed for medical device use, or lacking adequate development records, incorporated into a device." lang: en json-ld: | { "@context": "https://schema.org", "@graph": [ { "@type": "DefinedTerm", "@id": "https://medtechterms.com/terms/soup#term", "name": "Software of Unknown Provenance", "alternateName": "SOUP", "description": "Per IEC 62304 clause 3.29, SOUP is a software item that is already developed and generally available and that has not been developed for the purpose of being incorporated into the medical device (also known as OTS - off-the-shelf software), or a software item previously developed for which adequate records of the development processes are not available. Common examples: operating systems, compilers, open-source libraries, third-party SDKs, and firmware components.", "url": "https://medtechterms.com/terms/soup", "termCode": "soup", "inDefinedTermSet": { "@type": "DefinedTermSet", "name": "MedTech Terms", "url": "https://medtechterms.com/terms" } }, { "@type": "Article", "@id": "https://medtechterms.com/terms/soup#article", "headline": "SOUP, Software of Unknown Provenance", "description": "Software not developed for medical device use, or lacking adequate development records, incorporated into a device.", "url": "https://medtechterms.com/terms/soup", "mainEntityOfPage": { "@type": "WebPage", "@id": "https://medtechterms.com/terms/soup" }, "about": { "@id": "https://medtechterms.com/terms/soup#term" }, "articleSection": "Software & AI", "inLanguage": "en", "keywords": "Software of Unknown Provenance, SOUP, Software & AI, medical device, MedTech", "author": { "@type": "Person", "name": "Christian Espinosa", "jobTitle": "Founder, Blue Goat Cyber", "url": "https://bluegoatcyber.com" }, "publisher": { "@type": "Organization", "name": "MedTech Terms", "url": "https://medtechterms.com" }, "isPartOf": { "@type": "WebSite", "name": "MedTech Terms", "url": "https://medtechterms.com" }, "datePublished": "2026-05-05", "dateModified": "2026-05-05", "citation": [ { "@type": "CreativeWork", "name": "IEC 62304:2006/AMD1:2015", "url": "https://www.iso.org/standard/64686.html", "publisher": { "@type": "Organization", "name": "ISO" } }, { "@type": "CreativeWork", "name": "FDA Cybersecurity in Medical Devices (2023)", "url": "https://www.fda.gov/regulatory-information/search-fda-guidance-documents/cybersecurity-medical-devices-quality-system-considerations-and-content-premarket-submissions", "publisher": { "@type": "Organization", "name": "FDA" } }, { "@type": "CreativeWork", "name": "MDCG Software Guidance", "url": "https://health.ec.europa.eu/medical-devices-sector/new-regulations/guidance-mdcg-endorsed-documents-and-other-guidance_en", "publisher": { "@type": "Organization", "name": "MDCG" } } ], "mentions": [ { "@type": "DefinedTerm", "@id": "https://medtechterms.com/terms/iec-62304#term", "name": "IEC 62304", "url": "https://medtechterms.com/terms/iec-62304" }, { "@type": "DefinedTerm", "@id": "https://medtechterms.com/terms/sbom#term", "name": "Software Bill of Materials", "alternateName": "SBOM", "url": "https://medtechterms.com/terms/sbom" }, { "@type": "DefinedTerm", "@id": "https://medtechterms.com/terms/spdx#term", "name": "SPDX", "alternateName": "SPDX", "url": "https://medtechterms.com/terms/spdx" }, { "@type": "DefinedTerm", "@id": "https://medtechterms.com/terms/cyclonedx#term", "name": "CycloneDX", "url": "https://medtechterms.com/terms/cyclonedx" }, { "@type": "DefinedTerm", "@id": "https://medtechterms.com/terms/software-safety-class#term", "name": "Software Safety Classification", "url": "https://medtechterms.com/terms/software-safety-class" }, { "@type": "DefinedTerm", "@id": "https://medtechterms.com/terms/section-524b#term", "name": "Section 524B of the FD&C Act", "alternateName": "524B", "url": "https://medtechterms.com/terms/section-524b" } ] }, { "@type": "BreadcrumbList", "itemListElement": [ { "@type": "ListItem", "position": 1, "name": "Home", "item": "https://medtechterms.com/" }, { "@type": "ListItem", "position": 2, "name": "Terms", "item": "https://medtechterms.com/terms" }, { "@type": "ListItem", "position": 3, "name": "Software & AI", "item": "https://medtechterms.com/terms?cat=Software%20%26%20AI" }, { "@type": "ListItem", "position": 4, "name": "Software of Unknown Provenance", "item": "https://medtechterms.com/terms/soup" } ] }, { "@type": "FAQPage", "@id": "https://medtechterms.com/terms/soup#faq", "mainEntity": [ { "@type": "Question", "name": "Is open-source software automatically SOUP?", "acceptedAnswer": { "@type": "Answer", "text": "Almost always yes. Even if source is available, it typically was not developed for medical device use and lacks lifecycle records meeting IEC 62304. The exception is when the manufacturer takes it in-house and applies the full IEC 62304 process including retrospective evidence." } }, { "@type": "Question", "name": "How does SOUP relate to SBOM?", "acceptedAnswer": { "@type": "Answer", "text": "Every SOUP item must appear in the SBOM, but SBOM inclusion alone is not SOUP compliance. SOUP additionally requires requirements specification, anomaly-list review, and integration into the risk file." } }, { "@type": "Question", "name": "Do I need to monitor CVEs for every SOUP component?", "acceptedAnswer": { "@type": "Answer", "text": "Yes. FDA's 2023 cybersecurity guidance and EU MDR Annex I 17.2 require ongoing vulnerability monitoring for all software in the device, which necessarily includes SOUP." } }, { "@type": "Question", "name": "What about SOUP in Class A software?", "acceptedAnswer": { "@type": "Answer", "text": "IEC 62304 still requires SOUP identification and requirements specification for all classes. The relaxations for Class A (no unit testing, no detailed design) do not remove SOUP obligations." } } ] } ] } --- [ MedTech Terms The authoritative reference ](/) Browse Learn [Latest](/latest) About 1. [Home](/) 2. / 3. [Terms](/terms) 4. / 5. [Software & AI](/terms?cat=Software%20%26%20AI) 6. / 7. Software of Unknown Provenance [All terms](/terms) Software & AI [Software Lifecycle](/ecosystems/software-lifecycle)SOUP # Software of Unknown Provenance Software not developed for medical device use, or lacking adequate development records, incorporated into a device. Reviewed by [Christian Espinosa, Founder, Blue Goat Cyber](/authors/christian-espinosa) Last reviewed May 5, 2026 ## Definition Per [IEC 62304](/terms/iec-62304) clause 3.29, SOUP is a software item that is already developed and generally available and that has not been developed for the purpose of being incorporated into the medical device (also known as OTS - off-the-shelf software), or a software item previously developed for which adequate records of the development processes are not available. Common examples: operating systems, compilers, open-source libraries, third-party SDKs, and firmware components. What the regulation says Regulators view Software of Unknown Provenance (SOUP) as a critical component requiring stringent controls due to its potential impact on medical device safety and effectiveness. Standards like [IEC 62304](/terms/iec-62304):2006+A1:2015, "Medical device software, Software life cycle processes," specifically address SOUP, outlining requirements for its identification, risk management, and documentation within the medical device software life cycle. The FDA also emphasizes the importance of managing off-the-shelf software, which includes SOUP, in its guidance documents regarding premarket submissions for medical devices. ## What this means in practice [IEC 62304](/terms/iec-62304) clauses 5.3.3, 5.3.4, 7.1.2, and 7.1.3 impose specific obligations: identify the SOUP item (title, version, manufacturer), specify functional and performance requirements, document hardware and software requirements, evaluate anomaly lists published by the SOUP supplier, and address SOUP-related hazards in the risk file. FDA's 2023 Cybersecurity in Medical Devices guidance and Section [524B](/terms/section-524b) further require every SOUP component to appear in the [SBOM](/terms/sbom) ( [SPDX](/terms/spdx) or [CycloneDX](/terms/cyclonedx)), be monitored for vulnerabilities throughout the device lifecycle, and have a coordinated disclosure and patch plan. Notified Bodies routinely audit SOUP evaluation as part of QMS surveillance. ## Examples - Linux kernel in a bedside monitor: SOUP requiring version pinning, CVE monitoring, and hazard analysis of relied-upon kernel features. - OpenSSL used for TLS: SOUP that must be tracked in the SBOM with active vulnerability monitoring (Heartbleed-class risks). - A commercial DICOM library: SOUP with functional requirements documented against the vendor's release notes and known anomaly list. - A Python numerical library (NumPy) used in an image-analysis SaMD: SOUP requiring documented rationale for numerical accuracy in the intended clinical range. Common pitfalls - • Listing SOUP only in the SBOM but not evaluating anomaly lists or writing SOUP-specific requirements. IEC 62304 requires both. - • Treating an internally reused legacy component as 'in-house' when development records are inadequate - it is SOUP by definition. - • Not re-evaluating SOUP after a version bump. Any SOUP change triggers a change impact analysis under IEC 62304 clause 6. - • Missing SOUP in Class C software items where clause 5.3.4 requires additional performance requirements and hardware requirements to be specified. - • Assuming an FDA-cleared SOUP inherits regulatory status - it does not; the device manufacturer remains responsible. ## Frequently asked questions Is open-source software automatically SOUP? Almost always yes. Even if source is available, it typically was not developed for medical device use and lacks lifecycle records meeting [IEC 62304](/terms/iec-62304). The exception is when the manufacturer takes it in-house and applies the full IEC 62304 process including retrospective evidence. How does SOUP relate to SBOM? Do I need to monitor CVEs for every SOUP component? What about SOUP in Class A software? ## Cross-references ### Used by Things that build on this term. - [ IEC 62304 ](/terms/iec-62304) ## Related terms Grouped by theme ### Editor's picks · Hand-selected related concepts [ Software & AI Software Safety Classification IEC 62304 classes A, B, C reflecting potential harm from software failure. ](/terms/software-safety-class)[ Standards IEC 62304 Lifecycle requirements for medical device software. ](/terms/iec-62304)[ Cybersecurity Section 524B of the FD&C Act(524B) The federal statute that gives FDA explicit premarket authority over cybersecurity for cyber devices. ](/terms/section-524b)[ Cybersecurity Software Bill of Materials(SBOM) A machine-readable inventory of all software components, including open-source and third-party libraries, used to build a medical device. ](/terms/sbom) ### SaMD & AI/ML Devices · From this learning path [ Software & AI Clinical Decision Support(CDS) Software providing healthcare professionals with knowledge and patient-specific information. Adjacent lesson ](/terms/cds?from=samd-and-ai)[ Software & AI Predetermined Change Control Plan(PCCP) FDA mechanism to pre-authorize specific modifications to AI/ML-enabled devices. ](/terms/ai-ml-pccp?from=samd-and-ai)[ Software & AI Software as a Medical Device(SaMD) Software intended for medical purposes that performs without being part of a hardware device. ](/terms/samd?from=samd-and-ai)[ Software & AI Software in a Medical Device(SiMD) Software embedded in or required to operate a hardware medical device. ](/terms/simd?from=samd-and-ai) ### Software Team Onboarding · From this learning path [ Quality & Risk Verification & Validation(V&V) Confirming design outputs meet inputs (V) and that devices meet user needs (V). Adjacent lesson ](/terms/verification-validation?from=software-team-onboarding)[ Cybersecurity Secure Product Development Framework(SPDF) A documented, risk-based set of processes that build cybersecurity into a medical device across its full lifecycle. ](/terms/spdf?from=software-team-onboarding)[ Cybersecurity Threat Modeling A structured analysis that identifies how an attacker could compromise a medical device and what controls mitigate each threat. ](/terms/threat-modeling?from=software-team-onboarding) Cited by Where this term appears across MedTech Terms. Learning paths (2) - [SaMD & AI/ML Devices](/paths/samd-and-ai)Lesson 5 of 9 - [Software Team Onboarding](/paths/software-team-onboarding)Lesson 5 of 12 Ecosystems (1) - [Software Lifecycle](/ecosystems/software-lifecycle) ## Primary references 3 sources Link health: 3 verified · last checked 2026-06-20 ISO· 1 FDA· 1 MDCG· 1 1. [1 IEC 62304:2006/AMD1:2015 Verified ISO · iso.org ](https://www.iso.org/standard/64686.html) 2. [2 FDA Cybersecurity in Medical Devices (2023) Verified FDA · fda.gov ](https://www.fda.gov/regulatory-information/search-fda-guidance-documents/cybersecurity-medical-devices-quality-system-considerations-and-content-premarket-submissions) 3. [3 MDCG Software Guidance Verified MDCG · health.ec.europa.eu ](https://health.ec.europa.eu/medical-devices-sector/new-regulations/guidance-mdcg-endorsed-documents-and-other-guidance_en) Inline markers like \[1\] jump to the matching reference above. Sponsor note ### Building software-as-a-medical-device? We help SaMD and AI/ML device teams meet IEC 62304 and the FDA's evolving expectations for software cybersecurity. [Book a 30-minute discovery session](https://go.bluegoatcyber.com/meetings/blue-goat-cyber/discovery-session) - No obligation - Expert-led from minute one - NDA available on request MedTech Terms is a community resource sponsored by [Blue Goat Cyber](https://bluegoatcyber.com). Definitions are independent of any vendor. On this term Category Software & AI Acronym SOUP Sources 3 Updated 5/5/2026 [Compare with another term](/compare?a=soup) Learn in 60 seconds Card Lesson Quiz Software not developed for medical device use, or lacking adequate development records, incorporated into a device. - · Notified Bodies routinely audit SOUP evaluation as part of QMS surveillance. - · Common examples: operating systems, compilers, open-source libraries, third-party SDKs, and firmware components. Remember this Watch out: Listing SOUP only in the SBOM but not evaluating anomaly lists or writing SOUP-specific requirements. IEC 62304 requires both. Related terms - [IEC 62304 ](/terms/iec-62304) - [Software Bill of Materials(SBOM) ](/terms/sbom) - [SPDX(SPDX) ](/terms/spdx) - [CycloneDX ](/terms/cyclonedx) - [Software Safety Classification ](/terms/software-safety-class) - [Section 524B of the FD&C Act(524B) ](/terms/section-524b) You may also need Auto-suggested from Software & AI and shared keywords. - [AAMI TIR45(TIR45) ](/terms/aami-tir45) - [Algorithm Change Protocol(ACP) ](/terms/algorithm-change-protocol) - [Medical Device Data System(MDDS) ](/terms/mdds) - [MLOps for Medical Devices(MLOps) ](/terms/mlops-medical-device) - [Model Card ](/terms/model-card) - [CISA Known Exploited Vulnerabilities Catalog(KEV) ](/terms/kev) [All Software & AI terms](/terms?cat=Software%20%26%20AI) From the Blue Goat network Related resources and services on this topic. - [ AI SaMD Insights How AI is changing SaMD - risk, regulation, and good machine-learning practice. ](https://ai-samd.com) - [ Med Device Cyber Podcast Conversations with medical device cybersecurity practitioners. ](https://mdcpodcast.com) MedTech Terms An authoritative, plain-language reference for the regulatory, quality, cybersecurity, and software terms that shape modern medical devices. Browse - [All terms](/terms) - [A–Z index](/a-z) - [Categories](/categories) - [Ecosystems](/ecosystems) - [Learning paths](/paths) - [Compare terms](/compare) - [Quiz](/quiz) Resources - [FDA Medical Devices](https://www.fda.gov/medical-devices) - [EU MDR](https://eur-lex.europa.eu/eli/reg/2017/745/oj) - [IMDRF](https://www.imdrf.org/) - [Methodology](/methodology) - [Changelog](/changelog) - [Editor: Christian Espinosa](/authors/christian-espinosa) - [About this site](/about) © 2026 MedTech Terms. Reference content for educational purposes - not regulatory advice. A community resource sponsored by [Blue Goat Cyber](https://bluegoatcyber.com)