IEC 62304 §9 problem resolution process and document change control covering software defect tracking and correction.
Security-specific scope extension to accompanying documentation errors, IFU security guidance gaps, and security configuration omissions tracked through the existing defect system.
Defect records for documentation-only security findings — absence of documentation defect tracking separate from software defects is a common gap area.
Maps to
IEC 81001-5-1: §4.1.9 ACCOMPANYING DOCUMENTATION review
ISO 13485: §7.3 Design and development
Requirement text
The manufacturer shall establish activities for identifying, characterizing, and tracking to closure security-related errors and omissions in accompanying documentation, including the security guidelines.
Why this clause exists
When a security vulnerability is resolved in software, the accompanying documentation — installation guides, Instructions for Use, security configuration guides, release notes — often contains information that was accurate for the vulnerable configuration but is now incorrect, misleading, or incomplete. A firewall rule documented in the IFU that was bypassed by the vulnerability, a default credential referenced in an admin guide that was part of the attack surface, a network architecture diagram that no longer reflects security controls — each represents a documentation defect that perpetuates risk for operators who rely on the documentation to configure and operate the device securely. IEC 81001-5-1:2021 clause 4.1.9 establishes that documentation errors and omissions with security relevance must be identified, characterized, and tracked to closure through a formal process — the same discipline applied to software defects but extended to the documentation that operators depend on for secure operation. This requirement is particularly important for MedTech, where device operators may lack the technical background to identify documentation errors independently and rely on manufacturer-provided guidance to make security decisions.
What changed
IEC 81001-5-1:2021 is the first standalone cybersecurity standard purpose-built for health software and medical device software. Published in December 2021, it was adapted from IEC 62443-4-1 (industrial control systems security) to address the unique safety and regulatory context of medical devices — adding health-specific requirements that account for patient safety, clinical workflows, and the manufacturer-HDO relationship.
The standard mirrors IEC 62304's lifecycle structure but adds security-specific activities at every phase — planning, development, testing, release, and maintenance. It requires security risk management to be integrated with ISO 14971 safety risk management, not treated as a separate IT concern. FDA formally recognized it as Consensus Standard 13-122 on December 19, 2022 and references it as providing one acceptable framework for satisfying the cybersecurity requirements of Section 524B(b)(2), which requires manufacturers to design, develop, and maintain processes and procedures to provide a reasonable assurance that cyber devices and related systems are cybersecure.
EU MDR harmonization was originally targeted for May 2024 but postponed to May 2028. Despite this delay, Notified Bodies and Competent Authorities universally recognize it as "state of the art" for health software cybersecurity under MDR GSPR Annex I, Section 17.2. Missing or inadequate cybersecurity documentation is already a top cause of Notified Body major non-conformities for SaMD. A December 2025 Interpretation Sheet (ISH1:2025) clarified software item classification into maintained, supported, and required software categories, affecting risk transfer and post-market obligations.
Common gaps (what we see in audits)
- Accompanying documentation lacks security guidance for operators — Product documentation (IFU, installation guides, admin manuals) does not include security-relevant information that operators need: hardening guidance, network configuration requirements, default credential changes, and security maintenance responsibilities.