ISO 13485 §6.2 competence records, training profiles, and role descriptions already required for personnel performing quality activities.
Security-specific competency requirements per role, role-linked training profiles for threat modeling, secure coding, and security testing, with assessment records.
Training currency records mapped to security roles — generic awareness certificates without role-specific competency evidence do not satisfy clause 4.1.4.
Maps to
IEC 81001-5-1: §4.1.4 SECURITY expertise
ISO 13485: §6.2 Human resources
Requirement text
The manufacturer shall establish activities for identifying and providing security training and assessment programs to ensure that personnel assigned to the organizational roles and duties defined in 4.1.2 have demonstrated security expertise appropriate for those processes. Results of these activities include role descriptions, training profiles, and training records.
Why this clause exists
Generic security awareness training — phishing simulations and password hygiene modules — satisfies corporate IT compliance requirements but provides no preparation for the specialized skills required by IEC 81001-5-1 activities. A developer who has completed security awareness training but has never applied STRIDE to a data flow diagram cannot produce a defensible threat model. A tester who has not been trained in SAST or DAST tooling cannot execute a security requirements verification test. FDA's 2023 cybersecurity draft guidance specifically flagged inadequate personnel competency as a systemic gap, noting that the agency had observed threat models produced by personnel with no formal training in the methodology — documents that named threats without credible analysis of exploitability or impact. IEC 81001-5-1:2021 clause 4.1.4 requires not just training programs but demonstrated competency appropriate to each role's specific security activities, leveraging the same ISO 13485 clause 6.2 competence-record infrastructure already required for quality activities. The intent is role-specific qualification evidence, not generic course completion records.
What changed
IEC 81001-5-1:2021 is the first standalone cybersecurity standard purpose-built for health software and medical device software. Published in December 2021, it was adapted from IEC 62443-4-1 (industrial control systems security) to address the unique safety and regulatory context of medical devices — adding health-specific requirements that account for patient safety, clinical workflows, and the manufacturer-HDO relationship.
The standard mirrors IEC 62304's lifecycle structure but adds security-specific activities at every phase — planning, development, testing, release, and maintenance. It requires security risk management to be integrated with ISO 14971 safety risk management, not treated as a separate IT concern. FDA formally recognized it as Consensus Standard 13-122 on December 19, 2022 and references it as providing one acceptable framework for satisfying the cybersecurity requirements of Section 524B(b)(2), which requires manufacturers to design, develop, and maintain processes and procedures to provide a reasonable assurance that cyber devices and related systems are cybersecure.
EU MDR harmonization was originally targeted for May 2024 but postponed to May 2028. Despite this delay, Notified Bodies and Competent Authorities universally recognize it as "state of the art" for health software cybersecurity under MDR GSPR Annex I, Section 17.2. Missing or inadequate cybersecurity documentation is already a top cause of Notified Body major non-conformities for SaMD. A December 2025 Interpretation Sheet (ISH1:2025) clarified software item classification into maintained, supported, and required software categories, affecting risk transfer and post-market obligations.
Common gaps (what we see in audits)
- Security training is generic awareness rather than role-specific competency — Organizations provide generic cybersecurity awareness training (phishing, passwords) rather than role-specific competency training aligned to IEC 81001-5-1 activities. Developers lack secure coding training, testers lack security testing methodology training, and threat modeling personnel lack formal training in frameworks like STRIDE. FDA has noted that 'staff performing threat modeling is not adequately trained.'