IEC 62304 §5.2 software requirements and ISO 13485 design input documentation covering functional capabilities across the product lifecycle.
Security requirements specified per lifecycle phase — installation, operation, maintenance, and decommissioning — derived from the threat model rather than generic checklists.
Security requirements specification with per-phase coverage and traceability to the threat model — checklist-derived requirements without threat model linkage are a major gap.
Maps to
IEC 81001-5-1: §5.2.1 HEALTH SOFTWARE SECURITY requirements
Requirement text
The manufacturer shall establish an activity (or activities) for ensuring that security requirements are documented for the health software, including requirements for security capabilities related to installation, operation, maintenance, and decommissioning.
Why this clause exists
Security requirements that are derived only from compliance checklists — 'the device must use TLS 1.2 because the standard says so' — produce documentation that satisfies a formal review but fails to address the actual security needs of the specific product in its deployment environment. A radiation therapy planning system operating on a hospital internal network has different security requirements than a cloud-connected insulin dose management system, even if both must reference the same clauses of IEC 81001-5-1. Clause 5.2.1 requires security requirements to be derived from the security risk management process and threat modeling — meaning the specific threats identified for this product's architecture and deployment context drive the specific requirements written for this development cycle. This is not a compliance checkbox: security requirements derived from documented threats are verifiable (you can trace them back to the threat), testable (you can write a test that confirms the threat is mitigated), and defensible on inspection (you can show the reviewer why this requirement exists).
What changed
IEC 81001-5-1:2021 is the first standalone cybersecurity standard purpose-built for health software and medical device software. Published in December 2021, it was adapted from IEC 62443-4-1 (industrial control systems security) to address the unique safety and regulatory context of medical devices — adding health-specific requirements that account for patient safety, clinical workflows, and the manufacturer-HDO relationship.
The standard mirrors IEC 62304's lifecycle structure but adds security-specific activities at every phase — planning, development, testing, release, and maintenance. It requires security risk management to be integrated with ISO 14971 safety risk management, not treated as a separate IT concern. FDA recognized it as Consensus Standard 13-122 (date of entry December 19, 2022). FDA's February 2026 cybersecurity guidance, Section V, lists IEC 81001-5-1 among the "possible frameworks to consider" for secure product development, and FDA's recognition record for the standard notes that conformance "may not satisfy all the cybersecurity requirements outlined in Section 524B of FD&C Act".
EU MDR harmonization was originally targeted for May 2024 but postponed to May 2028.
Common gaps (what we see in audits)
- Security requirements derived from checklists rather than threat models — Security requirements are copied from generic compliance checklists rather than derived from the product-specific threat model and security risk assessment. Functional requirements exist (e.g., 'Device shall connect to Wi-Fi') but security requirements (e.g., 'Device shall use WPA3 and certificate-based auth') are missing or not traceable.