ISO 13485 QMS structure, role documentation, and process ownership — 81001-5-1 security activities integrate into that existing foundation.
Explicit QMS scope extension to cybersecurity, RACI matrix covering security-specific roles, and documented personnel accountability per 81001-5-1 process.
QMS scope statement referencing cybersecurity and a RACI mapping each 81001-5-1 process to a named role — absence of either is a major finding.
Maps to
IEC 81001-5-1: §4.1.1 Quality management system, §4.1.2 Identification of responsibilities
ISO 13485: §4.1 General requirements
Requirement text
The manufacturer shall perform security activities in the product life cycle on the basis of an established and documented quality management system (ISO 13485 or equivalent). The manufacturer shall designate and document the organizational roles and personnel responsible for each of the activities and processes required by this standard.
Why this clause exists
When security is treated as an informal engineering practice rather than a formally governed QMS activity, accountability gaps emerge immediately — no one owns threat model sign-off, vulnerability assessments happen ad hoc, and post-market security monitoring falls to whoever notices. The predictable outcome is that security obligations quietly atrophy between product releases while the QMS records show everything in order. IEC 81001-5-1:2021 clause 4.1.1 anchors security inside the ISO 13485 quality system precisely because both systems share the same root mechanism: documented roles and a closed-loop improvement cycle. Regulators learned this lesson from decades of Part 820 enforcement: activities that aren't in the QMS don't get done consistently, and they can't be verified on inspection. FDA's recognition of this standard as Consensus Standard 13-122 (December 19, 2022) reflects the agency's expectation that cybersecurity governance is not a separate IT program but a structured set of QMS-documented processes with named accountable roles — the same standard of evidence expected for any other design and development activity under 21 CFR 820 or ISO 13485.
What changed
IEC 81001-5-1:2021 is the first standalone cybersecurity standard purpose-built for health software and medical device software. Published in December 2021, it was adapted from IEC 62443-4-1 (industrial control systems security) to address the unique safety and regulatory context of medical devices — adding health-specific requirements that account for patient safety, clinical workflows, and the manufacturer-HDO relationship.
The standard mirrors IEC 62304's lifecycle structure but adds security-specific activities at every phase — planning, development, testing, release, and maintenance. It requires security risk management to be integrated with ISO 14971 safety risk management, not treated as a separate IT concern. FDA formally recognized it as Consensus Standard 13-122 on December 19, 2022 and references it as providing one acceptable framework for satisfying the cybersecurity requirements of Section 524B(b)(2), which requires manufacturers to design, develop, and maintain processes and procedures to provide a reasonable assurance that cyber devices and related systems are cybersecure.
EU MDR harmonization was originally targeted for May 2024 but postponed to May 2028. Despite this delay, Notified Bodies and Competent Authorities universally recognize it as "state of the art" for health software cybersecurity under MDR GSPR Annex I, Section 17.2. Missing or inadequate cybersecurity documentation is already a top cause of Notified Body major non-conformities for SaMD. A December 2025 Interpretation Sheet (ISH1:2025) clarified software item classification into maintained, supported, and required software categories, affecting risk transfer and post-market obligations.
Common gaps (what we see in audits)
- Security activities not integrated into QMS — Organizations treat cybersecurity as a standalone IT concern rather than integrating security activities into their ISO 13485 quality management system. Security roles and responsibilities are undefined or assigned informally without documented RACI matrices covering each IEC 81001-5-1 process.