Modern medical devices integrate hardware and software, thereby expanding the attack surface and creating patient safety risks. Reg- ulators set cybersecurity expectations, and international standards guide implementation. However, outcome-based, method-agnostic policies give manufacturers wide latitude, producing variability, am- biguity, and fragmented, non-reproducible practices in training and education. We address this gap with a reproducible, open-source reference platform that operationalizes security-by-design in align- ment with current regulatory expectations and standards. We also report an initial pilot course using the platform as a foundation for consistent medical-device cybersecurity curricula.