Be ready for the IT and security review before your hospital buyer asks.

Silicon Valley fractional CIO and CISO for medical device, SaMD, IVD, and life science startups, 1 to 100 employees. Remote service nationwide.

Led by Christian Busch. 25 years of enterprise SaaS at SAP, Elevance Health, and Cognizant. Stanford GSB mentor. CISSP-certified.

Review-ready IT stack diagramA concentric-ring diagram showing the company-side IT stack aligned to SOC 2, HITRUST, HIPAA, NIST 800-53, and ISO 27001 on the left, connected by leader lines to the four audiences it serves on the right: investors, auditors, insurers, and hospitals, each with their specific requirements noted.
Or take the two-minute readiness check first

Who it is for

  • Post-seed startups

    Define a company-side tech stack built to scale, from day one, before the first decision that costs six figures to undo.

  • Mature B2B medtech

    Audit and optimize the existing stack so the company is ready for hospital, lab, and CISO buying-center review.

Frameworks and artifacts Inoculis helps companies prepare for or coordinate around

Company-side security
  • HITRUST
  • HIPAA
  • ISO 27001
  • SOC 2
  • NIST 800-53
Quality and regulated-records interface
  • QMSR / ISO 13485
  • 21 CFR Part 11
Device-side coordination (with R&D, Quality, Regulatory)
  • FDA Section 524B
  • MDS2
  • SBOM
  • IEC 62304

Readiness check

Not ready to book? Take the two-minute SaMD readiness check.

Seven questions across HIPAA, QMS, cloud, vendors, and SaMD cybersecurity. A scored senior read in your inbox.

Start theReadiness Check

Services

Seven engagements, built around the moments founders feel them.

Two flagship engagements anchor the practice. Five supporting engagements pick up the work around them.

Primary engagement

Hospital Security Review Readiness

The company-side evidence library, IAM posture, and questionnaire-response library your customer’s CISO buying center expects, prepared before deployment.

Learn more

Primary engagement

Fractional CIO and CISO

Senior IT and security leadership in your weekly cadence. Owner-led, month-to-month, less than half the loaded cost of a full-time hire.

Learn more

Supporting engagement

Day-Zero Stack Selection

Pick the company-side stack the first time. The decision in week one that helps avoid the migration in year ten.

Learn more

Supporting engagement

Stack Setup Sprint

Stand up the company-side stack the first time: Microsoft 365, identity, core SaaS, endpoints, and file storage. The build that follows Day-Zero Stack Selection.

Learn more

Supporting engagement

Compliance Framework Roadmaps

A defensible 12-to-24-month plan for the framework your customer is asking about. Fixed price, two to three weeks.

Learn more

Supporting engagement

Hospital Vendor Security Questionnaire Support

Build and maintain the company-side response library so the second hospital questionnaire starts from a baseline, not a blank page.

Learn more

Supporting engagement

Secure AI Foundation

A technical owner for your first AI build, with cloud under a BAA or on-premises hardware sized to the use case.

Learn more

The Problem

Three decisions that show up as expensive surprises.

Pattern A

The QMS chosen to save money

It works at year one. By year ten, when the company is preparing its FDA submission, the QMS cannot produce the audit trail Quality and Regulatory need. The fix is a mid-submission migration to a validated platform: a six-figure cost, a year of work, and a go-to-market delay on top.

Pattern B

The CRM bought as an inventory system

Someone in the room says, "Salesforce is just a database, we can configure inventory on top." For a medical device company shipping physical product, inventory and traceability are the foundational systems. Salesforce is a CRM. Founders sign a multi-year contract for the wrong primary tool, then buy the right one on top.

Pattern C

The hospital vendor security review the company did not plan for

The device clears regulatory review. The team plans deployment. Then the hospital CISO buying center asks for a full package of company-side security evidence: framework readiness, an MDS2 response, an SBOM, a breach response plan, BAAs. None of it was prepared. The deal slips by months.

The Solution

The Inoculis Method: Strategy, Selection, Stewardship.

01

Strategy

A senior advisor maps your company-side IT, security, and compliance roadmap against hospital, lab, payor, and provider customer requirements. Two-year horizon, one-page output. Your "do not buy" list comes out of this session.

02

Selection

Christian selects the company stack: identity, SaaS, network, QMS, inventory, and file storage. The stack has one identity surface, one QMS, and one audit trail. He coordinates with R&D, Quality, and Regulatory on device-specific artifacts (MDS2, SBOM, IEC 62304). The device team keeps ownership of device-side answers.

03

Stewardship

Christian serves as fractional CIO and CISO, joining your weekly leadership meetings. He oversees the MSP and represents your interests when vendors pitch, helping you base spending on what you need at your stage rather than the vendor’s quota.

What Inoculis does, and what it does not

The boundary, in plain language.

What Inoculis does

  • Choose and operate the company’s IT, identity, network, and SaaS stack
  • Help select the QMS, inventory, and document management systems
  • Build the company-side evidence library for hospital and lab vendor security reviews
  • Coordinate with R&D on MDS2 (Inoculis prepares company-side answers; R&D prepares device-firmware answers)
  • Oversee MSPs and cybersecurity vendors so the budget stays honest
  • Provide senior fractional CIO and CISO leadership
  • Coordinate compliance readiness for HITRUST, HIPAA, ISO 27001, SOC 2, NIST 800-53
  • Stay buyer-side. No Microsoft CSP or other reseller commissions that would put Inoculis on the vendor’s payroll.

What stays with R&D, Quality, or Regulatory

  • Device firmware and embedded software security
  • DHF, DMR, RMF authorship and version control
  • FDA premarket cybersecurity submissions and Section 524B authorship
  • SBOM generation for device software
  • IEC 62304 software lifecycle execution
  • Clinical study operations, regulatory submission strategy, FDA negotiation
  • Audit certification (auditors certify, Inoculis prepares)

Five ways to work with Inoculis

Pricing without the sales call. The first tier is free.

Not sure which tier fits your stage?

30 minutes. Three risks named. No commitment. The call settles which tier is right.

Tier 0

Readiness Call

Free

Duration
30 min
Deliverables
Three risks named in your stack
Risk mitigator
Zero commitment

Tier 1

Day-Zero Diagnostic

from $1,500

Duration
1 week
Deliverables
Stack recommendation, 12-month roadmap, and "do not buy" list
Risk mitigator
Fixed scope and price

Tier 2

Compliance Framework Roadmap

from $7,500

Duration
2 to 3 weeks
Deliverables
Single-framework gap analysis, controls inventory, and 12 to 24-month remediation plan
Risk mitigator
Fixed scope and price

Tier 3

Stack Setup Sprint

from $12,000

Duration
1 to 3 weeks
Deliverables
Baseline company-side stack configured for agreed systems, with handoff documentation
Risk mitigator
Fixed scope and price

Tier 4

Fractional CIO and CISO Retainer

from $8,000/mo

Duration
Month-to-month
Deliverables
Monthly fractional CIO and CISO support for agreed priorities, including executive advisory, vendor and security review support, policy work, roadmap execution, and an IT and security operating cadence
Risk mitigator
Scope and cadence defined before kickoff

Start with the level of help you need now. Move from readiness call to diagnostic, roadmap, implementation sprint, or ongoing fractional CIO and CISO support as your company grows.

The Compliance Framework Roadmap covers a single framework; multi-framework engagements happen inside the Fractional CIO and CISO Retainer. Implementation execution is in the retainer, not the Roadmap.

See full pricing details →

Proof of impact

Five invisible decisions. Six-figure consequences.

These patterns recur across medical device, SaMD, IVD, and digital health startups. The five decisions below look small in year one and become six-figure costs by year three. Clients stay unnamed. The patterns are what matter.

Case A

The QMS that could not produce the audit trail.

Speaks to
VP Quality, COO

Case B

Salesforce bought to customize as an inventory system.

Speaks to
CEO, CFO

Case C

Four vendors when one would have done.

Speaks to
COO, CFO

Case D

The hospital security review founders do not plan for.

Speaks to
CEO, Compliance Lead

Case E

Signing the BAA is the easy part.

Speaks to
CEO, CTO
Read the case studies
Christian Busch, Founder, Inoculis

Christian Busch

Founder, Inoculis

Certified Information Systems Security Professional, ISC2

Founder

The reason Inoculis exists.

Certified Information Systems Security Professional (CISSP) by ISC2. Certified in AI in Healthcare from Stanford Medicine. Twenty-five years of enterprise SaaS. Built an AI/ML platform on patient data at Elevance Health. Launched an IoT platform at SAP. Ran a digital product practice at Cognizant. Mentor at Stanford GSB and three Silicon Valley accelerators.

Backed by a vetted SME network of former Google, Meta, Amazon, and Cisco engineers, brought in for firewall, network, and specialty depth.

For more than five years, I worked on systems handling PHI and PII for medical device, SaMD, and healthcare AI companies. I saw costly remediation work that should never have been necessary. I do not want the next founder to live it. The full story is on the About page.

Read more about Christian

FAQ

Questions founders ask in the first call.

  • How does this compare to hiring a full-time CIO or CISO?

    A full-time CIO or CISO runs $250,000 to $400,000 loaded, which most early-stage medical device companies cannot defend on the cap table. The Fractional CIO and CISO Retainer starts at $8,000 per month, scoped to what your company needs, with no equity, recruiter fee, or hiring cycle. The full side-by-side comparison is on the For CFOs page.

  • What is your boundary with our R&D team?

    Inoculis works on the company-side foundation for IT, identity, security, and compliance readiness. Device firmware, embedded software, MDS2 device-side answers, SBOM generation for device software, the IEC 62304 software lifecycle, and FDA premarket submissions stay with R&D, Quality, and Regulatory. Christian coordinates with those teams while they retain ownership of their work.

  • Will Inoculis commit to a specific audit or certification result?

    No. Auditors certify and audit. Inoculis prepares. Any consultant who promises a certification is selling something that is not theirs to sell.

  • What if you are not the right fit?

    The retainer is month-to-month. Your first month is half fee. If the fit is wrong, you can end the engagement.

  • Are you local?

    Primarily Silicon Valley: in person with Peninsula founders and remotely with life science companies across the US.

  • Can you set up our IT, or only advise on it?

    Both. Christian can set up your environment directly through the Stack Setup Sprint: Microsoft 365, identity, the core SaaS stack, and endpoints. He also provides the senior leadership to keep it sound as the company grows. If you want an ongoing help desk, Inoculis can run it or bring in an MSP for Christian to oversee on your behalf. The incentive stays the same: keep your tool spend honest.