Join our team

ISO 13485 is the international standard for quality management systems specific to the medical device industry. It's based on the ISO 9001 process model but tailored to the regulatory environment medical device companies operate in, with a much stronger emphasis on risk management, traceability, and documentation throughout the product lifecycle.

Oxford Brain Diagnostics has documented QMS system with defined processes and records; management responsibility, including a quality policy and management review; resource management (competence, training, infrastructure, and work environment, including contamination control where relevant); product realization, covering design and development, purchasing and supplier controls, production and process validation, and device traceability/labeling; and measurement, analysis, and improvement, including complaint handling, corrective and preventive action (CAPA), internal audits, and reporting to regulatory authorities (such as adverse event or vigilance reporting).

ISO 27001 is the premier international standard for information security, published by the International Organization for Standardization (ISO) in collaboration with the International Electrotechnical Commission (IEC).

It belongs to the ISO/IEC 27000 series and offers a framework for organisations of any size or industry to safeguard their information through an Information Security Management System (ISMS).

Cyber Essentials Plus is the higher of the two tiers in the UK's Cyber Essentials scheme, run by the National Cyber Security Centre (NCSC) and administered through IASME (the accreditation body) and its certification bodies. The base tier, Cyber Essentials, is a self-assessment: an organisation completes a questionnaire covering five technical controls and a qualified assessor reviews and verifies the answers. Cyber Essentials Plus builds on that by adding independent, hands-on technical verification rather than relying purely on self-attestation.

The five control areas are the same as the base standard: firewalls and internet gateways, secure configuration, user access control, malware protection, and security update (patch) management. For Plus, an accredited assessor actually tests the organisation's systems against these controls, which typically involves an internal and external vulnerability scan, checks on a sample of representative devices (laptops, servers, mobile devices) to confirm configuration and patching standards are actually followed in practice, and simulated phishing or malware tests to check user-side and endpoint controls, not just policy documents.

ALCOA++ is a data integrity framework used heavily in regulated industries like pharma, medical devices, and diagnostics (originally from FDA/GxP guidance, and relevant to your work given GAMP/MHRA-type expectations). It's an extension of the original ALCOA principles, with extra criteria added as regulators (particularly MHRA and later WHO/FDA guidance) recognized that electronic records and modern data systems needed more explicit rules than the original 1990s framework covered.

The "++" adds a further set of principles that have become expected for modern, especially electronic, data: Complete (all data included, with no selective deletion or missing repeats/reprocesses), Consistent (all elements of a record, like timestamps and sequences, are chronologically consistent), Enduring (recorded on durable media that lasts for the required retention period, not something like a whiteboard or sticky note), and Available (accessible and retrievable for review, audit, or inspection throughout the retention period).