IEC 62304 §5.2 software requirements and ISO 13485 design input documentation covering functional capabilities across the product lifecycle.
Security requirements specified per lifecycle phase — installation, operation, maintenance, and decommissioning — derived from the threat model rather than generic checklists.
Security requirements specification with per-phase coverage and traceability to the threat model — checklist-derived requirements without threat model linkage are a major gap.
Maps to
IEC 81001-5-1: §5.2.1 HEALTH SOFTWARE SECURITY requirements
Requirement text
The manufacturer shall establish an activity (or activities) for ensuring that security requirements are documented for the health software, including requirements for security capabilities related to installation, operation, maintenance, and decommissioning.
Why this clause exists
Security requirements that are derived only from compliance checklists — 'the device must use TLS 1.2 because the standard says so' — produce documentation that satisfies a formal review but fails to address the actual security needs of the specific product in its deployment environment. A radiation therapy planning system operating on a hospital internal network has different security requirements than a cloud-connected insulin dose management system, even if both must reference the same clauses of IEC 81001-5-1. Clause 5.2.1 requires security requirements to be derived from the security risk management process and threat modeling — meaning the specific threats identified for this product's architecture and deployment context drive the specific requirements written for this development cycle. This is not a compliance checkbox: security requirements derived from documented threats are verifiable (you can trace them back to the threat), testable (you can write a test that confirms the threat is mitigated), and defensible on inspection (you can show the reviewer why this requirement exists).
What changed
IEC 81001-5-1:2021 is the first standalone cybersecurity standard purpose-built for health software and medical device software. Published in December 2021, it was adapted from IEC 62443-4-1 (industrial control systems security) to address the unique safety and regulatory context of medical devices — adding health-specific requirements that account for patient safety, clinical workflows, and the manufacturer-HDO relationship.
The standard mirrors IEC 62304's lifecycle structure but adds security-specific activities at every phase — planning, development, testing, release, and maintenance. It requires security risk management to be integrated with ISO 14971 safety risk management, not treated as a separate IT concern. FDA formally recognized it as Consensus Standard 13-122 on December 19, 2022 and references it as providing one acceptable framework for satisfying the cybersecurity requirements of Section 524B(b)(2), which requires manufacturers to design, develop, and maintain processes and procedures to provide a reasonable assurance that cyber devices and related systems are cybersecure.
EU MDR harmonization was originally targeted for May 2024 but postponed to May 2028. Despite this delay, Notified Bodies and Competent Authorities universally recognize it as "state of the art" for health software cybersecurity under MDR GSPR Annex I, Section 17.2. Missing or inadequate cybersecurity documentation is already a top cause of Notified Body major non-conformities for SaMD. A December 2025 Interpretation Sheet (ISH1:2025) clarified software item classification into maintained, supported, and required software categories, affecting risk transfer and post-market obligations.
Common gaps (what we see in audits)
- Security requirements derived from checklists rather than threat models — Security requirements are copied from generic compliance checklists rather than derived from the product-specific threat model and security risk assessment. Functional requirements exist (e.g., 'Device shall connect to Wi-Fi') but security requirements (e.g., 'Device shall use WPA3 and certificate-based auth') are missing or not traceable.