CoChat
Sign Up
Cited by 22Software Engineering Techniques and PracticesSafety Systems Engineering in AutonomyHealthcare Regulation

DevOps in an ISO 13485 Regulated Environment: A Multivocal Literature Review

Open access
Lie, Martin Forsberg, Sánchez-Gordón, Mary, Colomo-Palacios, Ricardo·2020·Proceedings of the 14th ACM / IEEE International Symposium on Empirical Software Engineering and Measurement (ESEM)
DOI 10.1145/3382494.3410679
Open this paper in CoChat — free accountOpen PDF

Abstract

Background: Medical device development projects must follow proper directives and regulations to be able to market and sell the end-product in their respective territories. The regulations describe requirements that seem to be opposite to efficient software development and short time-to-market. As agile approaches, like DevOps, are becoming more and more popular in software industry, a discrepancy between these modern methods and traditional regulated development has been reported. Although examples of successful adoption in this context exist, the research is sparse. Aims: The objective of this study is twofold: to review the current state of DevOps adoption in regulated medical device environment; and to propose a checklist based on that review for introducing DevOps in that context. Method: A multivocal literature review is performed and evidence is synthesized from sources published between 2015 to March of 2020 to capture the opinions of experts and community in this field. Results: Our findings reveal that adoption of DevOps in a regulated medical device environment such as ISO 13485 has its challenges, but potential benefits may outweigh those in areas such as regulatory, compliance, security, organizational and technical. Conclusion: DevOps for regulated medical device environments is a highly appealing approach as compared to traditional methods and could be particularly suited for regulated medical development. However, an organization must properly anchor a transition to DevOps in top-level management and be supportive in the initial phase utilizing professional coaching and space for iterative learning; as such an initiative is a complex organizational and technical task.

The claims and statistics of this paper haven’t been checked yet.

Run the check — free, no account needed. It reads the open-access text and checks the sources it cites.

A few free checks a day · papers already verified open instantly · results are public

Integrity signals

Registry

Crossref · 10.1145/3382494.3410679

Cites

36 of 36 references verified0 citation errors · 0 not checkable

Statistics

Claims the paper makes

The claims and statistics of this paper haven’t been checked yet.

Run the check — free, no account needed. It reads the open-access text and checks the sources it cites.

A few free checks a day · papers already verified open instantly · results are public

Claims other papers make about this one

Each is checked against this paper’s own text: does it say what the citing paper says it does?

  • Buffer systems, artificial saliva, and selected saliva/serum samples show that PDA-based biosensing platforms can achieve improved biomolecule immobilization, signal transduction, fluorescence/electrochemical/SERS detection, and salivary biomarker analysis.

    “Buffer systems, artificial saliva, and selected saliva/serum samples show improved biomolecule immobilization, signal transduction, fluorescence/electrochemical/SERS detection, and salivary biomarker analysis.”

    From Polydopamine-Based Biomaterials in Oral Medicine: Applications, Mechanisms, and Translational Challenges (2026) · cites this paper as [98]

    The Study Protocol (p. 3) concerns a literature review of DevOps and regulated medical-device software, not biosensing experiments. Searches for artificial saliva, PDA, polydopamine, SERS, and salivary biomarkers found no passage in our copy addressing the attributed claim. (LLM, conf=0.78)

    Experimental — accuracy not yet measured

Self-check

Percentages, sums and reported differences re-computed from the paper’s own numbers.

The self-check needs the paper’s full text.

Cites

Flagged first, then by citations

Research works printed but not linked: 1

  1. [5][5] Jim Bird. 2016. DevOpsSec . O'Reilly Media, Inc. -

Cited by

Sorted by citations

Related

Authors
Lie, M. F., Sánchez-Gordón, M., & Colomo-Palacios, R.
Affiliations
  • Østfold University of Applied Sciences (NO)
  • Østfold University College, Halden, Norway
ORCID
Lie, Martin Forsberg
Venue
Proceedings of the 14th ACM / IEEE International Symposium on Empirical Software Engineering and Measurement (ESEM)
Publisher
ACM
Published
2020-10-05
Pages
1-11
ISSN
1938-6451 (ISSN-L)
DOI
10.1145/3382494.3410679
OpenAlex
W4288079612
Cited by
21
References
36
Citations by year
2026: 4 · 2025: 1 · 2024: 7 · 2023: 1 · 2022: 4 · 2021: 4
FWCI
1.71
Type
conference paper
Language
en
Open access
Licence
www.acm.org/publications/policies/copyright_policy#Background (vor)
Locations
  • Proceedings of the ... ACM-IEEE International Symposium on Empirical Software Engineering and Measurement/International Symposium on Empirical Software Engineering and Measurement (publishedVersion)
  • arXiv (Cornell University) (submittedVersion)
  • arXiv (Cornell University)
Topics
  • Physical Sciences › Computer Science › Information Systems › Software Engineering Techniques and Practices
  • Physical Sciences › Engineering › Safety, Risk, Reliability and Quality › Safety Systems Engineering in Autonomy
  • Health Sciences › Health Professions › Health Information Management › Healthcare Regulation
Keywords
DevOps, ISO 13485, medical device development, regulatory compliance, agile software development, regulatory challenges, change management, medical device software

About these checks

Registry, retraction, Cites and statistics results are computed, not judged, with one exception: a printed reference that no index lists is read once by a model before it counts as a citation error. Claims are extracted by a model and kept only when their quote appears verbatim in the text; each cited source is then checked, with a model’s help, for whether it says what the claim relies on. Those verdicts can be wrong — read the claim’s quote and the cited source before relying on one.

Statistics and arithmetic are recomputed, not judged.

Confidence bands are shown only for fields calibrated on our annotated test set. None is calibrated yet, so no band is shown.

What counts as a claim ›How we measure confidence ›How we check this ›

Are you an author, or do you see a problem with this page? Request a review