ISO 13485 product scope documentation and software item inventory from IEC 62304 software development planning.
Formal per-product applicability determination for the secure lifecycle, with documented criteria and threat-based assessment of connectivity and data sensitivity.
Applicability register or SBOM annotating each product's in-scope determination — undocumented assumptions about scope are a common gap area.
Maps to
IEC 81001-5-1: §4.1.3 Identification of applicability
Requirement text
The manufacturer is recommended to identify which products or parts of products the secure life cycle applies to. This is about product types and their components (e.g., software items), not individual product instances.
Why this clause exists
Applicability scoping failures take two forms: over-inclusion — applying the full secure lifecycle to software items that have no security implications — or, more dangerously, under-inclusion — assuming that a medical device's embedded software is not 'networked enough' to warrant security lifecycle governance. The under-inclusion failure is the historically harmful one. Devices with no user-visible network interface have frequently contained Bluetooth stacks, JTAG debug interfaces, or firmware update mechanisms that create exploitable attack surfaces. IEC 81001-5-1:2021 clause 4.1.3 requires a documented, criteria-based determination — not an assumption — of which products and software items are subject to the secure lifecycle, precisely because the assessment must survive scrutiny on audit. FDA inspectors reviewing 510(k) cybersecurity submissions frequently find that manufacturers have not performed this scoping exercise at all, treating security lifecycle compliance as a documentation overlay rather than a genuine risk-based applicability determination.
What changed
IEC 81001-5-1:2021 is the first standalone cybersecurity standard purpose-built for health software and medical device software. Published in December 2021, it was adapted from IEC 62443-4-1 (industrial control systems security) to address the unique safety and regulatory context of medical devices — adding health-specific requirements that account for patient safety, clinical workflows, and the manufacturer-HDO relationship.
The standard mirrors IEC 62304's lifecycle structure but adds security-specific activities at every phase — planning, development, testing, release, and maintenance. It requires security risk management to be integrated with ISO 14971 safety risk management, not treated as a separate IT concern. FDA recognized it as Consensus Standard 13-122 (date of entry December 19, 2022). FDA's February 2026 cybersecurity guidance, Section V, lists IEC 81001-5-1 among the "possible frameworks to consider" for secure product development, and FDA's recognition record for the standard notes that conformance "may not satisfy all the cybersecurity requirements outlined in Section 524B of FD&C Act".
EU MDR harmonization was originally targeted for May 2024 but postponed to May 2028.
Common gaps (what we see in audits)
- No documented applicability determination per product — Manufacturers fail to document which products and software items are subject to the secure lifecycle. The determination of applicability is assumed rather than formally assessed through threat modeling and documented with explicit inclusion/exclusion rationale.