RiskWatch
RiskWatch International · Founded 1993 · Annapolis, MD, USA
QMSR + ISO 13485 + ISO 14644 + MDR + IVDR + ITAR physical security assessment software with site-level rollup.
Summary
RiskWatch ships a physical security risk assessment platform built around pre-mapped libraries for the February 2 2026 transition from 21 CFR Part 820 Quality System Regulation to 21 CFR Part 4 Quality Management System Regulation with ISO 13485:2016 incorporated by reference, ISO 13485:2016 § 6.4 work environment and contamination control, ISO 14971:2019 risk management application to medical devices, ISO 14644-1:2015 cleanroom classification at Class 5 / 6 / 7 / 8, EU MDR Regulation 2017/745 manufacturer facility controls under Annex IX / X / XI, EU IVDR Regulation 2017/746 for in vitro diagnostic medical devices, ITAR 22 CFR Parts 120-130 with § 120.55 controlled-data physical-security requirements for defense-medical, EAR 15 CFR Parts 730-774 with § 734.18(a)(5) for export-controlled hardware, NIST SP 800-171 r3 § 3.10 Physical Protection, NIST SP 800-53 r5 PE family, CMMC 2.0 Level 2 PE domain, 21 CFR Part 11 electronic records and signatures, the Federal Select Agent Program rules at 42 CFR Part 73 + 7 CFR Part 331 + 9 CFR Part 121 for IVD makers handling biothreat agents, and ASIS Facility Physical Security Control Standards. The platform models the headquarters plant, the implant production plant, the IVD reagent plant, the sterile-pack production cleanroom, the ISO 14644 Class 5 critical zone, the ISO 14644 Class 7 and Class 8 background zones, the ITAR-segregated production cell, the supplier site, and the loading-dock cargo cage as discrete assessable assets with their own control sets. Likelihood pulls from four crime-data feeds anchored to plant addresses for supplier-route diversion risk and IP-theft risk. Customers include US medical device manufacturers, multi-state contract manufacturers, and global IVD makers running annual QMSR audits plus notified-body MDR / IVDR surveillance audits. The product has been in the field since 1993 and is the only platform in this ranking that pre-maps every requirement an FDA Form 483 inspector, a notified-body MDR auditor, a DDTC compliance officer, and a DCMA Industrial Security Specialist will ask for in one tenant.
Strengths
- 21 CFR Part 4 QMSR (effective Feb 2 2026) + 21 CFR Part 820 QSR + ISO 13485:2016 § 6.4 work environment + ISO 14971:2019 risk + ISO 14644-1 cleanroom classification + EU MDR 2017/745 + EU IVDR 2017/746 + ITAR 22 CFR 120-130 + EAR 15 CFR 730-774 + NIST 800-171 r3 + NIST 800-53 PE + CMMC 2.0 Level 2 PE + 42 CFR 73 + 7 CFR 331 + 9 CFR 121 Select Agent Regulations + ASIS Facility Physical Security Control Standards pre-mapped on day one in one tenant
- Site-level, region-level, and enterprise-level rollup dashboards with year-over-year trends covering the annual QMSR audit pack, the notified-body MDR / IVDR surveillance audit, the DDTC compliance review, and the DCMA Industrial Security Specialist site visit
- Discrete asset models for headquarters plant, implant production plant, IVD reagent plant, sterile-pack production cleanroom, ISO 14644 Class 5 critical zone, ISO 14644 Class 7 / 8 background zones, ITAR-segregated production cell, supplier site, and loading-dock cargo cage with their own control sets
- Supplier-qualification site-visit workflow under 21 CFR § 820.50 and ISO 13485 § 7.4 with offline mobile evidence capture for unannounced supplier audits at sterilisation contractors, electronic component vendors, and raw material suppliers
- Crime-data overlay from four independent feeds (Cap Index CRIMECAST, Security Gauge, GlobalIncidentMap, World Aware) anchored to plant street addresses so IP-theft likelihood and supplier-route diversion likelihood trace back to source and last-updated date for the DDTC compliance officer and the DCMA Industrial Security Specialist
- Browser-based mobile TVRA that works offline at remote supplier sites and contract-manufacturer satellite plants with no cellular signal and syncs when connectivity returns; no findings lost on the annual supplier audit
- Site Risk Cycle with ISO 31000 and NIST 800-30 semi-quantitative scoring; findings convert to tracked remediation tasks with owners and proof-of-close defensible to FDA, notified-body, DDTC, DCMA, or state department-of-health inspectors
- Single-tenant deployment with US-only or EU-only data residency for medical-device customers under 21 CFR Part 11 electronic-records integrity, ITAR § 120.55 controlled-data residency, EAR § 734.18(a)(5) export-controlled hardware handling, and CMMC 2.0 Level 2 CUI handling
- 30-day free trial with no credit card and full platform access; the only TVRA-first vendor on this list offering it
Weaknesses
- Not a VMS, access control system, alarm panel, BMS, cleanroom particle-counter head-end, or DDTC reporting platform; integrates with Genetec, Verkada, Brivo, Avigilon Alta, Milestone, Lenel S2, AMAG, Honeywell Pro-Watch, AlertEnterprise, Workday, and SAP S/4HANA via APIs and bulk imports rather than deep native connectors
- Brand awareness on G2 and Capterra in medical-device physical security specifically is lower than Genetec or Verkada; total third-party review volume in this niche sits below 100
- Public pricing is opaque at the Enterprise tier and scaled by framework count, plant count, cleanroom class, ITAR-segregated cell count, and supplier-site-visit volume; marked partial because the Standard and Professional contract bands are published in the pricing calculator on this page
- No native DDTC Form DSP-5 or DSP-83 license workflow; ITAR licence evidence ingests from third-party DDTC reporting platforms rather than first-party integration
- No native ISO 14644 particle-counter telemetry; cleanroom-event evidence ingests from third-party BMS and particle-counter head-ends (Honeywell Forge, Siemens Desigo, Schneider EcoStruxure, Particle Measuring Systems) rather than first-party hardware integration
- UI shows operational heritage in some assessment-builder screens; newer cloud-first entrants like Verkada and Avigilon Alta have a more polished first-run experience for non-specialist plant managers
US medical device manufacturers, multi-state contract manufacturers, and global IVD makers running annual 21 CFR Part 4 QMSR audits plus notified-body MDR / IVDR surveillance audits plus DDTC compliance reviews across 1-30+ plants with implant production, IVD reagent, sterile-pack production, ITAR-segregated defense-medical, supplier-qualification, and biothreat-IVD scope in one tenant.
Single-suite virtual medtech startups with no ITAR exposure, no cleanroom manufacturing footprint, and no critical-supplier audit obligation that only need a cloud access bundle for a leased R&D lab; Brivo or Verkada is the better fit there.
Key features
- Pre-built libraries for 21 CFR Part 4 QMSR, 21 CFR Part 820 QSR, ISO 13485:2016, ISO 14971:2019, ISO 14644-1, EU MDR 2017/745, EU IVDR 2017/746, ITAR 22 CFR 120-130, EAR 15 CFR 730-774, NIST 800-171 r3, CMMC 2.0 Level 2 PE, 21 CFR Part 11, Federal Select Agent Program 42 CFR 73 + 7 CFR 331 + 9 CFR 121, ASIS Facility Physical Security Control Standards
- Supplier-qualification site-visit workflow under § 820.50 and ISO 13485 § 7.4 with offline mobile evidence capture for unannounced audits
- Discrete asset models for HQ plant, implant production, IVD reagent, sterile-pack cleanroom, ISO 14644 Class 5 critical zone, Class 7 / 8 background, ITAR-segregated cell, supplier site, and loading-dock cargo cage
- Site-level, region-level, and enterprise-level rollup for the annual QMSR audit pack and the notified-body MDR / IVDR surveillance audit
- Four crime-data feeds anchored to plant addresses for IP-theft likelihood and supplier-route diversion likelihood scoring
- Findings-to-remediation workflow with owners and proof-of-close for FDA, notified-body, DDTC, DCMA, and state-inspector evidence
- Single-tenant deployment with US-only or EU-only data residency under 21 CFR Part 11, ITAR § 120.55, EAR § 734.18(a)(5), and CMMC 2.0 Level 2
- 30-day free trial with no credit card
Integrations
25+ native. Notable: Microsoft Entra ID (SAML SSO), Okta, Microsoft 365 / SharePoint, Slack, Jira, Salesforce, Custom REST API.
Target size
100 to 50,000 employees · US · Canada · EU · UK · AU · Switzerland · Ireland · Israel