IEC 62304 interface specifications covering API definitions, data formats, and inter-component communication protocols.
Ten-element security characterization per interface: trust boundary analysis, access controls, input validation, security roles, third-party component security, and threat mitigation traceability.
Interface design specification with all ten elements per interface — FDA expects all interfaces enumerated as attack surfaces; incomplete characterization is a major submission finding.
Maps to
IEC 81001-5-1: §5.4.3 Secure HEALTH SOFTWARE interfaces
Requirement text
The health software design shall identify and characterize each interface of the health software including physical and logical interfaces. As appropriate, the manufacturer identifies as part of the design: a) whether the interface is externally or internally accessible; b) security implications of the health software security context on the external interface; c) potential users of the interface and the assets accessible through it; d) whether the static design includes access across trust boundaries; e) security considerations, assumptions and/or constraints including applicable threats; f) security roles, privileges/rights and access control permissions; g) security capabilities and/or compensating mechanisms to safeguard the interface including run-time validation of inputs and error handling; h) use of third-party software items for the interface and their security capabilities; i) documentation for externally accessible interfaces; and j) description of how the design mitigates threats from the threat model.
Why this clause exists
Software interfaces — APIs, message queues, file import/export pathways, network protocols, and inter-process communication channels — are the primary attack surface for adversaries because they accept external data, cross trust boundaries, and expose functionality that can be manipulated if not properly secured. Interface security design failures are among the most commonly exploited vulnerability classes in health software: insufficient authentication on API endpoints, missing input validation allowing injection attacks, cleartext transmission of sensitive data, and insecure deserialization of interface data. IEC 81001-5-1:2021 clause 5.4.3 requires that health software interfaces be designed with explicit security controls addressing each of these risks. The clause specifically addresses the health software context, where interfaces frequently carry patient data, device commands, and clinical workflow information that creates direct patient safety consequences if compromised. Interface security design must be detailed enough to drive implementation and test — not a general statement that 'all interfaces use secure protocols' but a specification of which protocol, which version, which authentication mechanism, and which validation logic.
What changed
IEC 81001-5-1:2021 is the first standalone cybersecurity standard purpose-built for health software and medical device software. Published in December 2021, it was adapted from IEC 62443-4-1 (industrial control systems security) to address the unique safety and regulatory context of medical devices — adding health-specific requirements that account for patient safety, clinical workflows, and the manufacturer-HDO relationship.
The standard mirrors IEC 62304's lifecycle structure but adds security-specific activities at every phase — planning, development, testing, release, and maintenance. It requires security risk management to be integrated with ISO 14971 safety risk management, not treated as a separate IT concern. FDA formally recognized it as Consensus Standard 13-122 on December 19, 2022 and references it as providing one acceptable framework for satisfying the cybersecurity requirements of Section 524B(b)(2), which requires manufacturers to design, develop, and maintain processes and procedures to provide a reasonable assurance that cyber devices and related systems are cybersecure.
EU MDR harmonization was originally targeted for May 2024 but postponed to May 2028. Despite this delay, Notified Bodies and Competent Authorities universally recognize it as "state of the art" for health software cybersecurity under MDR GSPR Annex I, Section 17.2. Missing or inadequate cybersecurity documentation is already a top cause of Notified Body major non-conformities for SaMD. A December 2025 Interpretation Sheet (ISH1:2025) clarified software item classification into maintained, supported, and required software categories, affecting risk transfer and post-market obligations.
Common gaps (what we see in audits)
- Interface security requirements incomplete — External interfaces (APIs, network protocols, user interfaces, removable media ports) are designed for functionality without specifying security requirements for each interface — authentication, authorization, encryption, input validation, and rate limiting. FDA states all interfaces must be enumerated as potential attack surfaces.