ISO 13485 §7.2.3 customer communication channels and complaint handling procedures already established for product issues.
Coordinated vulnerability disclosure procedure with defined timelines, CVSS scoring in advisories, affected version enumeration, and resolution description for regulatory and user notifications.
Published CVD policy and at least one advisory record with all four required fields — missing CVSS scores or incomplete version coverage are frequent findings.
Maps to
IEC 81001-5-1: §4.1.7 Disclosing SECURITY-related issues
ISO 13485: §7.2.3 Communication
Requirement text
The manufacturer shall establish activities for informing regulatory authorities and product users about vulnerabilities in supported products in a timely manner. Disclosures shall include: vulnerability description, CVSS score (or equivalent ranking system), affected product versions, and description of the resolution.
Why this clause exists
Manufacturers that discover security vulnerabilities in deployed medical devices face an institutional temptation to delay or suppress disclosure: disclosure exposes liability, may trigger regulatory scrutiny, and creates customer concern. This behavior causes direct patient harm — hospitals operating vulnerable devices without awareness cannot implement compensating controls, cannot make informed procurement decisions, and cannot plan remediation. IEC 81001-5-1:2021 clause 4.1.7 establishes a mandatory coordinated vulnerability disclosure obligation, requiring that regulatory authorities and product users be informed in a timely manner, with specific content — CVSS score, affected versions, and resolution description — to enable informed response. The CVSS score requirement is significant: it prohibits the vague 'security improvement' language that was common in early medical device security advisories, forcing manufacturers to quantify severity in a standardized way that regulators and operators can interpret. FDA's 2023 cybersecurity guidance reinforced this requirement by specifying that manufacturers must have a documented CVD policy as part of their premarket submission and that postmarket disclosures must align with the coordinated disclosure process defined therein.
What changed
IEC 81001-5-1:2021 is the first standalone cybersecurity standard purpose-built for health software and medical device software. Published in December 2021, it was adapted from IEC 62443-4-1 (industrial control systems security) to address the unique safety and regulatory context of medical devices — adding health-specific requirements that account for patient safety, clinical workflows, and the manufacturer-HDO relationship.
The standard mirrors IEC 62304's lifecycle structure but adds security-specific activities at every phase — planning, development, testing, release, and maintenance. It requires security risk management to be integrated with ISO 14971 safety risk management, not treated as a separate IT concern. FDA formally recognized it as Consensus Standard 13-122 on December 19, 2022 and references it as providing one acceptable framework for satisfying the cybersecurity requirements of Section 524B(b)(2), which requires manufacturers to design, develop, and maintain processes and procedures to provide a reasonable assurance that cyber devices and related systems are cybersecure.
EU MDR harmonization was originally targeted for May 2024 but postponed to May 2028. Despite this delay, Notified Bodies and Competent Authorities universally recognize it as "state of the art" for health software cybersecurity under MDR GSPR Annex I, Section 17.2. Missing or inadequate cybersecurity documentation is already a top cause of Notified Body major non-conformities for SaMD. A December 2025 Interpretation Sheet (ISH1:2025) clarified software item classification into maintained, supported, and required software categories, affecting risk transfer and post-market obligations.
Common gaps (what we see in audits)
- No vulnerability disclosure policy or process — Manufacturers lack a published vulnerability disclosure policy, have no secure channel for receiving reports, and have no defined process for coordinating with reporters through investigation and remediation. A compliant process requires a defined intake channel, triage timeline (often 72 hours), and communication plan.