ISO 13485 QMS structure, role documentation, and process ownership — 81001-5-1 security activities integrate into that existing foundation.
Explicit QMS scope extension to cybersecurity, RACI matrix covering security-specific roles, and documented personnel accountability per 81001-5-1 process.
QMS scope statement referencing cybersecurity and a RACI mapping each 81001-5-1 process to a named role — absence of either is a major finding.
Maps to
IEC 81001-5-1: §4.1.1 Quality management system, §4.1.2 Identification of responsibilities
ISO 13485: §4.1 General requirements
Requirement text
The manufacturer shall perform security activities in the product life cycle on the basis of an established and documented quality management system. The manufacturer shall designate and document the organizational roles and personnel responsible for each of the activities and processes required by this standard.
Why this clause exists
When security is treated as an informal engineering practice rather than a formally governed QMS activity, accountability gaps emerge immediately — no one owns threat model sign-off, vulnerability assessments happen ad hoc, and post-market security monitoring falls to whoever notices. The predictable outcome is that security obligations quietly atrophy between product releases while the QMS records show everything in order. IEC 81001-5-1:2021 clause 4.1.1 anchors security inside the ISO 13485 quality system precisely because both systems share the same root mechanism: documented roles and a closed-loop improvement cycle. Regulators learned this lesson from decades of Part 820 enforcement: activities that aren't in the QMS don't get done consistently, and they can't be verified on inspection. FDA recognized this standard as Consensus Standard 13-122 (date of entry December 19, 2022), and its February 2026 cybersecurity guidance recommends that manufacturers "use device design processes such as those described in the QMSR, including ISO 13485, to support secure product development and maintenance."
What changed
IEC 81001-5-1:2021 is the first standalone cybersecurity standard purpose-built for health software and medical device software. Published in December 2021, it was adapted from IEC 62443-4-1 (industrial control systems security) to address the unique safety and regulatory context of medical devices — adding health-specific requirements that account for patient safety, clinical workflows, and the manufacturer-HDO relationship.
The standard mirrors IEC 62304's lifecycle structure but adds security-specific activities at every phase — planning, development, testing, release, and maintenance. It requires security risk management to be integrated with ISO 14971 safety risk management, not treated as a separate IT concern. FDA recognized it as Consensus Standard 13-122 (date of entry December 19, 2022). FDA's February 2026 cybersecurity guidance, Section V, lists IEC 81001-5-1 among the "possible frameworks to consider" for secure product development, and FDA's recognition record for the standard notes that conformance "may not satisfy all the cybersecurity requirements outlined in Section 524B of FD&C Act".
EU MDR harmonization was originally targeted for May 2024 but postponed to May 2028.
Common gaps (what we see in audits)
- Security activities not integrated into QMS — Organizations treat cybersecurity as a standalone IT concern rather than integrating security activities into their ISO 13485 quality management system. Security roles and responsibilities are undefined or assigned informally without documented RACI matrices covering each IEC 81001-5-1 process.