New tool built on CycloneDX — MedSBOM for FDA/IEC-62304 compliance

[karthikraja14]

Hi CycloneDX community,

I wanted to share a new open-source tool that builds on the CycloneDX ecosystem: MedSBOM.

It takes CycloneDX JSON SBOMs (and SPDX) and generates FDA-submission-ready compliance documentation — specifically:

• FDA Premarket Cybersecurity Summary
• IEC 62304 §7.1.3 SOUP Risk Assessment
• Vulnerability Review Log (audit trail)

It also does CVE matching against NVD, CISA KEV checking, and end-of-life detection with composite risk scoring.

The goal is to bridge the gap between "I have an SBOM" and "I have regulatory evidence" for medical device manufacturers dealing with the FDA 2023 guidance and PATCH Act requirements.

Tested with CycloneDX 1.6 format. Works with output from cyclonedx-python, Syft, Trivy, etc.

GitHub: https://github.com/karthikraja14/MedSBOM
PyPI: pip install medsbom
License: Apache 2.0

Would love feedback from this community since you all understand the SBOM ecosystem deeply. Particularly interested in:

• Are there CycloneDX fields we should be leveraging better?
• Any plans for healthcare/medical-specific extensions in CycloneDX?
• Would a CycloneDX plugin/integration make sense?

Thanks!