[Paper Review] DevOps in an ISO 13485 Regulated Environment: A Multivocal Literature Review

Martin Forsberg Lie, Mary Sánchez‐Gordón+1 more|arXiv (Cornell University)|Jul 22, 2020

Software Engineering Techniques and Practices19 references4 citations

TL;DR

This paper conducts a multivocal literature review (2015–2020) to examine DevOps adoption in ISO 13485-regulated medical device environments, identifying key challenges and benefits across regulatory, compliance, security, organizational, and technical dimensions. It proposes a practical checklist to guide organizations in successfully implementing DevOps while maintaining regulatory compliance, emphasizing leadership support, coaching, and iterative learning during transition.

ABSTRACT

Background: Medical device development projects must follow proper directives and regulations to be able to market and sell the end-product in their respective territories. The regulations describe requirements that seem to be opposite to efficient software development and short time-to-market. As agile approaches, like DevOps, are becoming more and more popular in software industry, a discrepancy between these modern methods and traditional regulated development has been reported. Although examples of successful adoption in this context exist, the research is sparse. Aims: The objective of this study is twofold: to review the current state of DevOps adoption in regulated medical device environment; and to propose a checklist based on that review for introducing DevOps in that context. Method: A multivocal literature review is performed and evidence is synthesized from sources published between 2015 to March of 2020 to capture the opinions of experts and community in this field. Results: Our findings reveal that adoption of DevOps in a regulated medical device environment such as ISO 13485 has its challenges, but potential benefits may outweigh those in areas such as regulatory, compliance, security, organizational and technical. Conclusion: DevOps for regulated medical device environments is a highly appealing approach as compared to traditional methods and could be particularly suited for regulated medical development. However, an organization must properly anchor a transition to DevOps in top-level management and be supportive in the initial phase utilizing professional coaching and space for iterative learning; as such an initiative is a complex organizational and technical task.

Motivation & Objective

• To investigate the current state of DevOps adoption in regulated medical device development under ISO 13485 standards.
• To identify key challenges and benefits of integrating DevOps into regulated software development processes.
• To synthesize evidence from expert and community sources on DevOps implementation in medical device contexts.
• To develop a practical checklist for organizations aiming to adopt DevOps in ISO 13485-compliant environments.
• To support organizational transition through leadership engagement, coaching, and iterative learning frameworks.

Proposed method

• Conducting a multivocal literature review using sources published between 2015 and March 2020.
• Synthesizing evidence from academic papers, industry reports, and community forums to capture expert and practitioner perspectives.
• Categorizing findings into regulatory, compliance, security, organizational, and technical dimensions.
• Identifying recurring themes and critical success factors for DevOps adoption in regulated settings.
• Deriving a structured checklist based on synthesized evidence to guide implementation.
• Validating the checklist’s relevance through alignment with empirical findings and regulatory expectations.

Experimental results

Research questions

• RQ1 How is DevOps currently being adopted in ISO 13485-regulated medical device development environments?
• RQ2 What are the primary challenges organizations face when integrating DevOps into regulated medical software development?
• RQ3 What benefits does DevOps offer in terms of compliance, security, and time-to-market within regulated contexts?
• RQ4 What organizational and technical enablers are critical for successful DevOps adoption in regulated medical device settings?
• RQ5 How can a structured checklist support the transition to DevOps while maintaining ISO 13485 compliance?

Key findings

• DevOps adoption in ISO 13485 environments faces significant challenges related to regulatory compliance, documentation, and audit readiness.
• Despite these challenges, potential benefits in development speed, quality, and security outweigh the risks when properly managed.
• Organizational factors such as leadership support, coaching, and iterative learning are critical for successful transition to DevOps.
• Technical and process integration must align with ISO 13485 requirements, including version control, traceability, and change management.
• The proposed checklist provides a structured, evidence-based framework to guide DevOps implementation in regulated medical device development.
• The study confirms that DevOps is a viable and highly appealing alternative to traditional methods in regulated medical software contexts.