ISO 13485 §7.2.3 customer communication channels and complaint handling procedures already established for product issues.
Coordinated vulnerability disclosure procedure with defined timelines, CVSS scoring in advisories, affected version enumeration, and resolution description for regulatory and user notifications.
Published CVD policy and at least one advisory record with all four required fields — missing CVSS scores or incomplete version coverage are frequent findings.
Maps to
IEC 81001-5-1: §4.1.7 Disclosing SECURITY-related issues
ISO 13485: §7.2.3 Communication
Requirement text
The manufacturer shall establish activities for informing regulatory authorities and product users about vulnerabilities in supported products in a timely manner. Disclosures shall include: vulnerability description, CVSS score (or equivalent ranking system), affected product versions, and description of the resolution.
Why this clause exists
Manufacturers that discover security vulnerabilities in deployed medical devices face an institutional temptation to delay or suppress disclosure: disclosure exposes liability, may trigger regulatory scrutiny, and creates customer concern. This behavior causes direct patient harm — hospitals operating vulnerable devices without awareness cannot implement compensating controls, cannot make informed procurement decisions, and cannot plan remediation. IEC 81001-5-1:2021 clause 4.1.7 establishes a mandatory coordinated vulnerability disclosure obligation, requiring that regulatory authorities and product users be informed in a timely manner, with specific content — CVSS score, affected versions, and resolution description — to enable informed response. The CVSS score requirement is significant: it prohibits the vague 'security improvement' language that was common in early medical device security advisories, forcing manufacturers to quantify severity in a standardized way that regulators and operators can interpret. FDA's 2023 cybersecurity guidance reinforced this requirement by specifying that manufacturers must have a documented CVD policy as part of their premarket submission and that postmarket disclosures must align with the coordinated disclosure process defined therein.
What changed
IEC 81001-5-1:2021 is the first standalone cybersecurity standard purpose-built for health software and medical device software. Published in December 2021, it was adapted from IEC 62443-4-1 (industrial control systems security) to address the unique safety and regulatory context of medical devices — adding health-specific requirements that account for patient safety, clinical workflows, and the manufacturer-HDO relationship.
The standard mirrors IEC 62304's lifecycle structure but adds security-specific activities at every phase — planning, development, testing, release, and maintenance. It requires security risk management to be integrated with ISO 14971 safety risk management, not treated as a separate IT concern. FDA recognized it as Consensus Standard 13-122 (date of entry December 19, 2022). FDA's February 2026 cybersecurity guidance, Section V, lists IEC 81001-5-1 among the "possible frameworks to consider" for secure product development, and FDA's recognition record for the standard notes that conformance "may not satisfy all the cybersecurity requirements outlined in Section 524B of FD&C Act".
EU MDR harmonization was originally targeted for May 2024 but postponed to May 2028.
Common gaps (what we see in audits)
- No vulnerability disclosure policy or process — Manufacturers lack a published vulnerability disclosure policy, have no secure channel for receiving reports, and have no defined process for coordinating with reporters through investigation and remediation. A compliant process requires a defined intake channel, triage timeline (often 72 hours), and communication plan.