Document Control

Clause 7.3 exclusion under FDA QMSR is no longer a settled historical decision. Contract manufacturers and component suppliers must update ISO 13485 quality manual justifications, reassess design activity boundaries, and prepare current audit evidence.

**Excerpt:** ISO 27001:2022 removed asset/threat/vulnerability as a normative prerequisite for risk identification. Organisations that carried their methodology forward without documenting the choice under Clause 6.1.2 now face a Major nonconformity risk at their next audit. (42 words)