IEC 62304 §5.6 software integration testing and integration test plan covering component interaction verification.
Security policy difference evaluation across trust boundaries during integration — authentication, authorization, and encryption enforcement verified at each boundary in the integrated system.
Integration test plan with trust boundary security test cases — functional integration tests without security policy verification at boundaries are a moderate gap.
Maps to
IEC 81001-5-1: §5.6 Software integration testing
Requirement text
The manufacturer can perform some of the software system testing as a part of software integration testing (see 5.7). As a part of health software integration testing, the manufacturer should consider security policy differences across trust boundaries.
Why this clause exists
Integration testing validates how components behave together — at the interfaces between modules, across subsystem boundaries, and in the presence of realistic data flows. Security integration testing is distinct from security unit testing and from pre-release security verification: unit tests verify individual components in isolation, which can validate correct component behavior while missing interaction vulnerabilities; pre-release testing validates the fully integrated system. The integration phase is specifically when interface-level security controls — authentication between services, authorization at subsystem boundaries, encrypted channels between components — first operate as a complete system and can be verified holistically. IEC 81001-5-1:2021 clause 5.6 requires security testing during integration specifically to catch vulnerabilities that emerge from component interaction: an authentication mechanism that works correctly in isolation but fails when combined with a caching layer; an input validation rule correctly implemented in component A but bypassed by unexpected encoding from component B. Organizations that perform security testing only at the pre-release system level miss integration-phase vulnerabilities that are costly to remediate when discovered late.
What changed
IEC 81001-5-1:2021 is the first standalone cybersecurity standard purpose-built for health software and medical device software. Published in December 2021, it was adapted from IEC 62443-4-1 (industrial control systems security) to address the unique safety and regulatory context of medical devices — adding health-specific requirements that account for patient safety, clinical workflows, and the manufacturer-HDO relationship.
The standard mirrors IEC 62304's lifecycle structure but adds security-specific activities at every phase — planning, development, testing, release, and maintenance. It requires security risk management to be integrated with ISO 14971 safety risk management, not treated as a separate IT concern. FDA formally recognized it as Consensus Standard 13-122 on December 19, 2022 and references it as providing one acceptable framework for satisfying the cybersecurity requirements of Section 524B(b)(2), which requires manufacturers to design, develop, and maintain processes and procedures to provide a reasonable assurance that cyber devices and related systems are cybersecure.
EU MDR harmonization was originally targeted for May 2024 but postponed to May 2028. Despite this delay, Notified Bodies and Competent Authorities universally recognize it as "state of the art" for health software cybersecurity under MDR GSPR Annex I, Section 17.2. Missing or inadequate cybersecurity documentation is already a top cause of Notified Body major non-conformities for SaMD. A December 2025 Interpretation Sheet (ISH1:2025) clarified software item classification into maintained, supported, and required software categories, affecting risk transfer and post-market obligations.
Common gaps (what we see in audits)
- Integration testing does not include security test cases — Integration testing verifies functional component interactions but does not test security-relevant interactions — authentication enforcement between components, data encryption in transit, or privilege escalation through component interactions.