> For the complete documentation index, see [llms.txt](https://docs.medcrypt.com/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://docs.medcrypt.com/msi/check-estar-readiness/find-and-close-compliance-gaps.md).

# Find and close compliance gaps

MSI gives you two ways to find what's missing from your documentation. The **Gap Register** tracks every element of the FDA premarket cybersecurity gap assessment against your documents. **AINN Analysis** reads an FDA additional information letter and checks whether your updated documents answer each of the FDA's questions.

## Before you begin

* Select the device and device version you're working on, and upload its documents.
* For AINN Analysis, have the FDA letter as a PDF or .txt file, and put your updated submission documents in a document collection.
* The Gap Register isn't available for every organization. If you don't see **Gap Register** in the sidebar, contact Medcrypt.

## Track gaps in the Gap Register

The Gap Register lists every requirement in the gap assessment, grouped by regulatory section, with an outcome for each based on what MSI found in your documents.

1. In the sidebar, select **Gap Register**.
2. If the register says it hasn't been assessed yet, select **Regenerate**, or run a regulatory audit to populate it. The register also updates on its own when, for example, you upload a document or complete an audit.
3. Choose a tab:
   * **Register**: every gap element, organized by section.
   * **Outstanding**: only the gaps that still need attention, with what's **Missing** and the suggested **Remediation** for each.
4. Narrow the list with **Search gaps...** and the **Outcome**, **Review**, and **Assignee** filters. Use **Sort by** to order rows by **Element**, **Outcome**, or **Review State**.

| Outcome                 | Meaning                                                           |
| ----------------------- | ----------------------------------------------------------------- |
| **Fully Addressed**     | Your documents cover the element.                                 |
| **Partially Addressed** | Some evidence was found, but not enough.                          |
| **Missing**             | No evidence was found in the documents attached.                  |
| **Not Assessed**        | The element hasn't been checked yet.                              |
| **Not Applicable**      | The element doesn't apply to this device, with a recorded reason. |

### Close a gap

1. Select **View Details** on a gap, or select the row. The details show the **Requirement**, the **Current Evidence**, the **Recommendation**, where the evidence is **Expected In**, and any **Evidence Documents** MSI found.
2. To add evidence, select **Upload Documents**, choose a **Collection**, and upload the files. Keep **Attach this collection to the device after upload** selected so MSI reads the new documents into the device's knowledge base.
3. To assign the gap to a teammate, use the assign control under **Assigned To**.
4. If the outcome is wrong, select **Override Outcome**, choose the **Outcome**, and give a **Reason**. A reason is required for **Not Applicable**. To undo it, select **Remove Override**.
5. When you've checked the gap, select **Mark as Reviewed**.

When an automated source suggests a new outcome for a gap, the details show a **Gap Status Proposal**. Select **Accept Proposal** or **Reject Proposal**.

To download the register, select **Export**.

## Respond to an FDA additional information request

During a premarket review, the FDA can put the review on hold and send an additional information request, often called an AI letter or AINN letter. It lists specific deficiencies, or asks, that you must answer before the review continues. AINN Analysis breaks the letter into individual asks and checks each one against your updated documents.

1. In the sidebar, select **Deliverables**, then select the **AINN Analysis** tab. The same tab also appears in the Gap Register.
2. Under **AINN Letter**, upload the FDA letter (PDF or .txt).
3. In **New Document Collection**, select the collection with your updated submission documents.
4. Optional: in **Old Document Collection (Optional)**, select the collection with your original submission, for comparison.
5. Select **Analyze**. Progress moves through **Parsing Letter**, **Fast Analysis**, and **Deep Analysis**.

The tab shows a warning icon when an analysis has items for you to review.

### Understand the results

The results table lists each **FDA Ask** with its **Category**, **Severity**, **Status**, **Confidence**, and **Remediation**. Each ask's status is **Addressed**, **Partially Addressed**, or **Not Addressed**. Expand a row to see the analysis, the citations from your documents it relied on, and the status history.

To see each cited excerpt and whether it was verified word for word against your documents, select **Traceability**.

### Review and respond

1. On an ask, select **Update Status**.
2. Choose the **Status**, explain what evidence supports it in **Justification**, and select **Submit Review**.
3. When you're ready to answer the FDA, select **Export**, then:
   * **Export PDF** or **Export DOCX** to download the analysis.
   * **Generate FDA Response** to draft a response, then **Export Response Letter** to download it once it's ready.

To analyze another letter, select **New AINN Analysis**. Earlier analyses are listed under **Previous Analyses**.

## Next steps

* [Check eSTAR readiness](/msi/check-estar-readiness.md): confirm your documentation covers the eSTAR cybersecurity requirements.
* [Run a regulatory audit](/msi/check-estar-readiness/run-a-regulatory-audit.md): run a simulated FDA review, which also updates the Gap Register.
* [Generate submission documents](/msi/check-estar-readiness/generate-submission-documents.md): produce the documents your gaps call for.