Form outside observation; their software is required to suck by itself, and rely on decade old versions of other software as well. That may not have been the intent of regulation but (as so often happens) appears to have been the outcome.

The FDA have pretty strict standards in terms of project management. Of course it depends on the "class" of the medical device we are talking about. But if the software is used for diagnostics, you will need a whole battery of controls (test, documentation, processes, etc).