IEC 62304 interface specifications covering API definitions, data formats, and inter-component communication protocols.
Ten-element security characterization per interface: trust boundary analysis, access controls, input validation, security roles, third-party component security, and threat mitigation traceability.
Interface design specification with all ten elements per interface — FDA expects all interfaces enumerated as attack surfaces; incomplete characterization is a major submission finding.
Maps to
IEC 81001-5-1: §5.4.3 Secure HEALTH SOFTWARE interfaces
Requirement text
The health software design shall identify and characterize each interface of the health software including physical and logical interfaces. As appropriate, the manufacturer identifies as part of the design: a) whether the interface is externally or internally accessible; b) security implications of the health software security context on the external interface; c) potential users of the interface and the assets accessible through it; d) whether the static design includes access across trust boundaries; e) security considerations, assumptions and/or constraints including applicable threats; f) security roles, privileges/rights and access control permissions; g) security capabilities and/or compensating mechanisms to safeguard the interface including run-time validation of inputs and error handling; h) use of third-party software items for the interface and their security capabilities; i) documentation that describes how to use the interface if it is externally accessible; and j) description of how the design mitigates threats from the threat model.
Why this clause exists
Software interfaces — APIs, message queues, file import/export pathways, network protocols, and inter-process communication channels — are the primary attack surface for adversaries because they accept external data, cross trust boundaries, and expose functionality that can be manipulated if not properly secured. Interface security design failures are among the most commonly exploited vulnerability classes in health software: insufficient authentication on API endpoints, missing input validation allowing injection attacks, cleartext transmission of sensitive data, and insecure deserialization of interface data. IEC 81001-5-1:2021 clause 5.4.3 requires that health software interfaces be designed with explicit security controls addressing each of these risks. The clause specifically addresses the health software context, where interfaces frequently carry patient data, device commands, and clinical workflow information that creates direct patient safety consequences if compromised. Interface security design must be detailed enough to drive implementation and test — not a general statement that 'all interfaces use secure protocols' but a specification of which protocol, which version, which authentication mechanism, and which validation logic.
What changed
IEC 81001-5-1:2021 is the first standalone cybersecurity standard purpose-built for health software and medical device software. Published in December 2021, it was adapted from IEC 62443-4-1 (industrial control systems security) to address the unique safety and regulatory context of medical devices — adding health-specific requirements that account for patient safety, clinical workflows, and the manufacturer-HDO relationship.
The standard mirrors IEC 62304's lifecycle structure but adds security-specific activities at every phase — planning, development, testing, release, and maintenance. It requires security risk management to be integrated with ISO 14971 safety risk management, not treated as a separate IT concern. FDA recognized it as Consensus Standard 13-122 (date of entry December 19, 2022). FDA's February 2026 cybersecurity guidance, Section V, lists IEC 81001-5-1 among the "possible frameworks to consider" for secure product development, and FDA's recognition record for the standard notes that conformance "may not satisfy all the cybersecurity requirements outlined in Section 524B of FD&C Act".
EU MDR harmonization was originally targeted for May 2024 but postponed to May 2028.
Common gaps (what we see in audits)
- Interface security requirements incomplete — External interfaces (APIs, network protocols, user interfaces, removable media ports) are designed for functionality without specifying security requirements for each interface — authentication, authorization, encryption, input validation, and rate limiting. FDA states all interfaces must be enumerated as potential attack surfaces.