IEC 62304 §9 problem resolution process and document change control covering software defect tracking and correction.
Security-specific scope extension to accompanying documentation errors, IFU security guidance gaps, and security configuration omissions tracked through the existing defect system.
Defect records for documentation-only security findings — absence of documentation defect tracking separate from software defects is a common gap area.
Maps to
IEC 81001-5-1: §4.1.9 ACCOMPANYING DOCUMENTATION review
ISO 13485: §7.3 Design and development
Requirement text
The manufacturer shall establish activities for identifying, characterizing, and tracking to closure security-related errors and omissions in accompanying documentation, including the security guidelines.
Why this clause exists
When a security vulnerability is resolved in software, the accompanying documentation — installation guides, Instructions for Use, security configuration guides, release notes — often contains information that was accurate for the vulnerable configuration but is now incorrect, misleading, or incomplete. A firewall rule documented in the IFU that was bypassed by the vulnerability, a default credential referenced in an admin guide that was part of the attack surface, a network architecture diagram that no longer reflects security controls — each represents a documentation defect that perpetuates risk for operators who rely on the documentation to configure and operate the device securely. IEC 81001-5-1:2021 clause 4.1.9 establishes that documentation errors and omissions with security relevance must be identified, characterized, and tracked to closure through a formal process — the same discipline applied to software defects but extended to the documentation that operators depend on for secure operation. This requirement is particularly important for MedTech, where device operators may lack the technical background to identify documentation errors independently and rely on manufacturer-provided guidance to make security decisions.
What changed
IEC 81001-5-1:2021 is the first standalone cybersecurity standard purpose-built for health software and medical device software. Published in December 2021, it was adapted from IEC 62443-4-1 (industrial control systems security) to address the unique safety and regulatory context of medical devices — adding health-specific requirements that account for patient safety, clinical workflows, and the manufacturer-HDO relationship.
The standard mirrors IEC 62304's lifecycle structure but adds security-specific activities at every phase — planning, development, testing, release, and maintenance. It requires security risk management to be integrated with ISO 14971 safety risk management, not treated as a separate IT concern. FDA recognized it as Consensus Standard 13-122 (date of entry December 19, 2022). FDA's February 2026 cybersecurity guidance, Section V, lists IEC 81001-5-1 among the "possible frameworks to consider" for secure product development, and FDA's recognition record for the standard notes that conformance "may not satisfy all the cybersecurity requirements outlined in Section 524B of FD&C Act".
EU MDR harmonization was originally targeted for May 2024 but postponed to May 2028.
Common gaps (what we see in audits)
- Accompanying documentation lacks security guidance for operators — Product documentation (IFU, installation guides, admin manuals) does not include security-relevant information that operators need: hardening guidance, network configuration requirements, default credential changes, and security maintenance responsibilities.