Contract analysis

I. Executive Summary The purpose of this memorandum is to provide a comprehensive mapping of the requirements set forth in the U.S. Food and Drug Administration ("FDA") final guidance document entitled Cybersecurity in Medical Devices: Quality System Considerations and Content of Premarket Submissions (September 2023) (the "September 2023 Cybersecurity Guidance" or the "Guidance") to the specific system architecture,

1. Pre-Submission Meeting Package (Target Submission: June 16, 2025). The checklist will be used to prepare the cybersecurity-related sections of the Pre-Sub meeting package, including preliminary cybersecurity documentation and specific questions for the FDA regarding the agency's expectations for cybersecurity content in the 510(k) submission. The Pre-Sub meeting is currently scheduled for August 14, 2025, with CDR

II. Applicable Regulatory Framework and Guidance

II.A. Primary FDA Guidance The primary regulatory guidance document governing the cybersecurity content requirements for the Lumina CGM System premarket submission is the FDA's final guidance entitled "Cybersecurity in Medical Devices: Quality System Considerations and Content of Premarket Submissions", published in September 2023 (the "September 2023 Cybersecurity Guidance" or the "Guidance"). This document supersed

II.B. Supplementary Standards and References In addition to the September 2023 Cybersecurity Guidance, the cybersecurity documentation for the Lumina CGM System should reference and align with the following supplementary standards, guidance documents, and frameworks: IEC 62304:2006/A1:2015 — Medical device software — Software life cycle processes. This international standard establishes requirements for the software

II.C. Connection to Other Submission Requirements The cybersecurity documentation described in this checklist does not exist in isolation but must be integrated with and cross-referenced to several other components of the 510(k) submission. The following cross-references are particularly important: Software Documentation Requirements. The cybersecurity documentation is closely interrelated with the software documenta

III. System Architecture — Cybersecurity-Relevant Features This section describes the cybersecurity-relevant aspects of the Lumina CGM System architecture. The descriptions provided herein are based on the technical specifications and design documentation provided by the Solstice Biomedical Devices Ltd. engineering team as of the date of this memorandum. These descriptions will form the basis for the cybersecurity an

III.A. Lumina C14 Sensor — Communication Interfaces The Lumina C14 Implantable Subcutaneous Continuous Glucose Monitoring Sensor is a disposable, single-use electrochemical sensor designed for subcutaneous insertion via a spring-loaded applicator. The C14 Sensor contains an embedded microcontroller running Lumina Firmware v3.4.2, which manages the electrochemical sensing process, performs initial signal conditioning

III.B. Lumina R7 Reader/Transmitter — Communication Interfaces The Lumina R7 Wearable Reader/Transmitter is a reusable arm-worn device that serves as the primary user interface and computational hub of the Lumina CGM System. The R7 Reader runs the Lumina Reader OS v2.1.0, which encompasses the operating system, application software, display management, communication stacks, and the integrated LuminaPredict Algorithm

III.C. Lumina Mobile Application The Lumina Mobile App v1.0.3 is a companion software application available for iOS and Android platforms. The Mobile App communicates with the R7 Reader via BLE and connects to the Lumina cloud infrastructure via the internet (typically through the user's cellular data or Wi-Fi connection). The Lumina Mobile App provides the following functionality: • Display of real-time glucose valu

III.D. Cloud Infrastructure The Lumina CGM System relies on cloud-based infrastructure for several functions that are integral to the overall system architecture: • Data Storage and Synchronization: Historical glucose data is uploaded to the cloud from the R7 Reader (directly or via the Mobile App) and stored securely for access by the user, healthcare providers, and authorized caregivers. • User Account Management:

III.E. Data Flow Diagram Requirement The September 2023 Cybersecurity Guidance specifically requires that premarket submissions include a comprehensive data flow diagram showing all external interfaces, communication pathways, data types exchanged across each interface, and trust boundaries within the system architecture. The data flow diagram is a foundational document for the cybersecurity analysis, as it defines t

IV.A. Methodology — STRIDE Framework The FDA's September 2023 Cybersecurity Guidance requires that premarket submissions include documentation of a threat model that identifies and assesses cybersecurity threats to the device. The Guidance does not mandate a specific threat modeling methodology but states that the manufacturer should use a systematic, structured approach and should document the methodology, assumptio

IV.B. STRIDE Analysis — BLE 5.2 Sensor-to-Reader Link (C14 ↔ R7) The BLE 5.2 wireless communication link between the C14 Sensor and the R7 Reader is the most safety-critical communication pathway in the Lumina CGM System. Any compromise of this link could directly affect the accuracy, timeliness, and integrity of glucose measurements presented to the user. Spoofing. There is a risk that an unauthorized device could a

IV.C. STRIDE Analysis — BLE Reader-to-Mobile App Link (R7 ↔ Mobile App) The BLE communication link between the R7 Reader and the Lumina Mobile App presents a threat profile that is analogous in many respects to the sensor-to-reader link described in Section IV.B above, with several important additional considerations arising from the mobile application environment. Spoofing. An unauthorized application or device coul

IV.D. STRIDE Analysis — Cloud Connectivity (Mobile App ↔ Cloud; R7 ↔ Cloud) The cloud connectivity interfaces of the Lumina CGM System present a distinct threat profile characterized by exposure to internet-based attack vectors, the involvement of third-party cloud service providers, and the need to protect large volumes of stored health data. Spoofing. Man-in-the-middle ("MITM") attacks on the network connection bet

IV.E. STRIDE Analysis — Software Update / OTA Update Channel The software update and OTA update delivery channel is a particularly high-value target for cybersecurity attacks because a compromise of this channel could enable an attacker to distribute malicious firmware or software to a large number of devices simultaneously. Spoofing and Tampering. The primary threat to the update channel is the injection of unauthor

IV.F. Threat Model Documentation Requirements — Action Items Based on the preliminary STRIDE analysis presented in this Section IV, the following action items are identified: Action Item 4.1: The Solstice engineering team (under the direction of Dr. Aisling Burke, CTO) must prepare a complete STRIDE threat model report documenting, for each identified threat: (a) a detailed description of the threat scenario; (b) the

V. Software Bill of Materials (SBOM)

V.A. FDA SBOM Requirements The September 2023 Cybersecurity Guidance establishes a clear and specific requirement that premarket submissions for cyber devices must include a Software Bill of Materials (SBOM). The SBOM is intended to provide the FDA and the device manufacturer with a comprehensive, transparent inventory of all software components included in the device, enabling the identification and tracking of know

V.B. SBOM Scope for Lumina CGM System The SBOM for the Lumina CGM System must cover all four software components of the System, each of which has its own distinct software composition: Lumina Firmware v3.4.2 (C14 Sensor). The C14 Sensor firmware runs on an embedded microcontroller with limited computational resources. The SBOM for this component is expected to include, at a minimum: the embedded real-time operating s

V.C. SBOM Format and Delivery The FDA's September 2023 Cybersecurity Guidance recommends that SBOMs be provided in a machine-readable format to facilitate automated vulnerability analysis and tracking. Two widely accepted machine-readable SBOM formats are recommended: • SPDX (Software Package Data Exchange): An open standard maintained by the Linux Foundation for communicating software bill of materials information.

V.D. SBOM Action Items Action Item 5.1: The Solstice engineering team must compile a comprehensive SBOM for all four software components of the Lumina CGM System (C14 Firmware v3.4.2, R7 Reader OS v2.1.0, LuminaPredict Algorithm v2.1, and Mobile App v1.0.3), in both machine-readable (SPDX or CycloneDX) and human-readable formats. Action Item 5.2: The Solstice engineering team must conduct a vulnerability scan of all

VI. Vulnerability Assessment and Management

VI.A. Pre-Market Vulnerability Assessment The September 2023 Cybersecurity Guidance requires that premarket submissions include documentation of a vulnerability assessment demonstrating that the manufacturer has systematically identified, evaluated, and addressed known vulnerabilities in the device's software components, communication protocols, and system architecture. The vulnerability assessment is distinct from (

VI.B. BLE 5.2 Protocol Vulnerabilities The BLE 5.2 communication protocol used by the Lumina CGM System has been the subject of extensive security research, and several vulnerability classes affecting various versions of the Bluetooth and BLE specifications have been publicly documented. The Solstice engineering team must assess the Lumina CGM System's BLE 5.2 implementation against these known vulnerability classes

VI.C. Mobile Application Vulnerabilities The Lumina Mobile App v1.0.3, as an application running on consumer mobile devices, is subject to a wide range of application-level vulnerabilities. The vulnerability assessment for the Mobile App should be structured around the OWASP Mobile Top 10 vulnerability classification, which identifies the ten most critical security risks for mobile applications:

10. Extraneous Functionality The vulnerability assessment should evaluate the Lumina Mobile App against each of these risk categories on both the iOS and Android platforms. Platform-specific vulnerability considerations should also be addressed, including differences in the security models of iOS and Android, the handling of app permissions, the security of inter-process communication, and the protection of data stor