Understanding OTS and SOUP

Understanding OTS and SOUP

Understanding OTS and SOUP is very important in every lifecycle stages of medical device and HealthIT software development.  In the late 1990’s, the US FDA first published guidance documentation on the use of Off-The-Shelf (OTS) software in medical devices (or sometimes referred to as “OTSS”).  At that time, OTSS generally accounted for a very small fraction of the executing software in medical device.  Since that time however, the use of OTS software in medical devices has steadily increased to where many of today’s medical devices, particularly “Software as a Medical Device (SaMD),” operate with the majority of the overall software in the product being OTSS.  In 2019, FDA updated the previous guidance (2019-Off-The-Shelf Software-FDA).  The opening paragraph of the guidance points out:

  • OTSS use has expanded along with use of general-purpose computer hardware
  • The premise of OTSS use is that it allows the manufacturer to concentrate on the application software
  • OTSS may not be appropriate for a given specific use in a medical device
  • The manufacturer using OTSS generally gives up software life cycle control, but still bears the responsibility for the continued safe and effective performance of the medical device

As with all software in medical devices, the use of OTSS must be guided using the safety risk management process.  The key activity in the risk management process for OTSS would be identifying all of the hazardous situations for which failures of the OTSS could contribute.  This is not a trivial activity – so while the use of OTSS can save development time, it requires MORE risk analysis time.

Related to the US FDA “OTS” acronym is the concept of “SOUP” defined in IEC 62304 (link to the popular FAQ on 62304 (62304 FAQ)).  IEC 62304 defines SOUP as “software of unknown provenance.”  What is meant by that?  The standard provides this definition.   SOUP is a software item that is:

  1. already developed and generally available and that has not been developed for the purpose of being incorporated into the medical device; or
  2. software previously developed for which adequate records of the development processes are not available (often called “legacy”)

Essentially SOUP is software for which the manufacturer lacks sufficient records to establish conformance with IEC 62304.  Of course we understand that the missing (or non-existent) records are the common types of records one creates when designing higher quality software, namely:

  • planning
  • software risk analysis
  • software requirements
  • software architecture and design
  • software unit verification
  • software integration verification
  • software system verification
  • software release documentation

The use of OTSS and/or SOUP can have advantages and disadvantages – one must consider both in planning its use.  Understanding OTS and SOUP should be a key training element for software project teams.

Image:  Shmuel Csaba Otto Traian, CC BY-SA 3.0 <https://creativecommons.org/licenses/by-sa/3.0>, via Wikimedia Commons

About the author

Brian is a biomedical software engineer - whatever that is! Started writing machine code for the Intel 8080 in 1983. Still enjoys designing and developing code. But probably enjoys his garden more now and watching plants grow ... and grandkids grow!

SoftwareCPR Training Courses:

IEC 62304 and other emerging standards for Medical Device and HealthIT Software

Our flagship course for preparing regulatory, quality, engineering, operations, and others for the activities and documentation expected for IEC 62304 conformance and for FDA expectations. The goal is to educate on the intent and purpose so that the participants are able to make informed decisions in the future.  Focus is not simply what the standard says, but what is meant and discuss examples and approaches one might implement to comply.  Special deep discount pricing available to FDA attendees and other regulators.

3-days onsite with group exercises, quizzes, examples, Q&A.

Instructor: Brian Pate

Next public offering:  TBD

Email training@softwarecpr.com to request a special pre-registration discount.  Limited number of pre-registration coupons.

Registration Link:




Being Agile & Yet Compliant (Public or Private)

Our SoftwareCPR unique approach to incorporating agile and lean engineering to your medical device software process training course is now open for scheduling!

  • Agile principles that align well with medical
  • Backlog management
  • Agile risk management
  • Incremental and iterative software development lifecycle management
  •  Frequent release management
  • And more!

2-days onsite (4 days virtual) with group exercises, quizzes, examples, Q&A.

Instructors: Mike Russell, Ron Baerg

Next public offering: March 7 & 28, 2024

Virtual via Zoom

Registration Link:

Register Now



Medical Device Cybersecurity (Public or Private)

This course takes a deep dive into the US FDA expectations for cybersecurity activities in the product development process with central focus on the cybersecurity risk analysis process. Overall approach will be tied to relevant standards and FDA guidance documentation. The course will follow the ISO 14971:2019 framework for overall structure but utilize IEC 62304, IEC 81001-5-1, and AAMI TIR57 for specific details regarding cybersecurity planning, risk characterization, threat modeling, and control strategies.

2-days onsite with group exercises, quizzes, examples, Q&A.

Instructor: Dr Peter Rech, 2nd instructor (optional)

Next public offering:  TBD

Corporate Office

15148 Springview St.
Tampa, FL 33624
Partners located in the US (CA, FL, MA, MN, TX) and Canada.