IEC 62304 §5.6 software integration testing and integration test plan covering component interaction verification.
Security policy difference evaluation across trust boundaries during integration — authentication, authorization, and encryption enforcement verified at each boundary in the integrated system.
Integration test plan with trust boundary security test cases — functional integration tests without security policy verification at boundaries are a moderate gap.
Maps to
IEC 81001-5-1: §5.6 Software integration testing
Requirement text
The manufacturer can perform some of the software system testing as a part of software integration testing (see 5.7). As a part of health software integration testing, the manufacturer should consider security policy differences across trust boundaries.
Why this clause exists
Integration testing validates how components behave together — at the interfaces between modules, across subsystem boundaries, and in the presence of realistic data flows. Security integration testing is distinct from security unit testing and from pre-release security verification: unit tests verify individual components in isolation, which can validate correct component behavior while missing interaction vulnerabilities; pre-release testing validates the fully integrated system. The integration phase is specifically when interface-level security controls — authentication between services, authorization at subsystem boundaries, encrypted channels between components — first operate as a complete system and can be verified holistically. IEC 81001-5-1:2021 clause 5.6 requires security testing during integration specifically to catch vulnerabilities that emerge from component interaction: an authentication mechanism that works correctly in isolation but fails when combined with a caching layer; an input validation rule correctly implemented in component A but bypassed by unexpected encoding from component B. Organizations that perform security testing only at the pre-release system level miss integration-phase vulnerabilities that are costly to remediate when discovered late.
What changed
IEC 81001-5-1:2021 is the first standalone cybersecurity standard purpose-built for health software and medical device software. Published in December 2021, it was adapted from IEC 62443-4-1 (industrial control systems security) to address the unique safety and regulatory context of medical devices — adding health-specific requirements that account for patient safety, clinical workflows, and the manufacturer-HDO relationship.
The standard mirrors IEC 62304's lifecycle structure but adds security-specific activities at every phase — planning, development, testing, release, and maintenance. It requires security risk management to be integrated with ISO 14971 safety risk management, not treated as a separate IT concern. FDA recognized it as Consensus Standard 13-122 (date of entry December 19, 2022). FDA's February 2026 cybersecurity guidance, Section V, lists IEC 81001-5-1 among the "possible frameworks to consider" for secure product development, and FDA's recognition record for the standard notes that conformance "may not satisfy all the cybersecurity requirements outlined in Section 524B of FD&C Act".
EU MDR harmonization was originally targeted for May 2024 but postponed to May 2028.
Common gaps (what we see in audits)
- Integration testing does not include security test cases — Integration testing verifies functional component interactions but does not test security-relevant interactions — authentication enforcement between components, data encryption in transit, or privilege escalation through component interactions.