IEC 62304 software problem resolution and existing functional testing activities for component and system behavior.
Five required test categories: abuse case and fuzz testing, attack surface analysis, closed-box vulnerability scanning, SCA on release binaries with SBOM comparison, and dynamic security testing.
Vulnerability test reports covering all five categories per release — automated scanning alone without fuzz testing and manual attack surface analysis does not satisfy 5.7.3.
Maps to
IEC 81001-5-1: §5.7.3 VULNERABILITY testing
Requirement text
The manufacturer shall establish an activity (or activities) for performing tests that focus on identifying and characterizing potential security vulnerabilities in the health software. Known vulnerability testing shall be based upon, at a minimum, recent contents of an established, industry-recognized, public source for known vulnerabilities. As appropriate, testing shall include: a) abuse case testing for malformed or unexpected input focused on uncovering security issues, including manual or automated abuse case testing and specialized types of abuse case testing on all external interfaces and protocols (examples include fuzz testing and network traffic load testing and capacity testing); b) attack surface testing (ingress/egress, weak ACLs, exposed ports, elevated privileges); c) closed-box known vulnerability scanning of (if applicable) hardware, host, interfaces or software items; d) software composition analysis on all binary executable files including embedded firmware, to be used with the health software and delivered by a third-party supplier (this analysis can be used to detect known vulnerabilities in the software items, linking to vulnerable libraries, security rule violations, compiler settings that can lead to vulnerabilities, and comparison of the software encountered to the software bill of materials); and e) dynamic security testing (fuzz, DoS, memory leaks, shared memory access without authentication) — shall be applied if tools are available.
Why this clause exists
Vulnerability testing — systematic examination of the software and its dependencies for known and novel vulnerabilities — operates in the space between requirements-based testing and adversarial penetration testing. Requirements testing verifies that specified controls work; penetration testing attacks the system as an adversary would; vulnerability testing systematically identifies weaknesses that may not have been specified as requirements at all — vulnerabilities introduced by third-party components, implementation errors that static analysis missed, or configuration weaknesses in the deployment environment. IEC 81001-5-1:2021 clause 5.7.3 requires vulnerability testing as a distinct activity from requirements testing and penetration testing, using methods such as dynamic analysis and fuzz testing that exercise the system with unexpected inputs and execution paths. DAST tools and fuzz testing discover vulnerability classes — memory corruption, unexpected error handling, parsing failures — that do not surface in functional or requirements-based test suites because they arise from execution paths not defined in the requirements.
What changed
IEC 81001-5-1:2021 is the first standalone cybersecurity standard purpose-built for health software and medical device software. Published in December 2021, it was adapted from IEC 62443-4-1 (industrial control systems security) to address the unique safety and regulatory context of medical devices — adding health-specific requirements that account for patient safety, clinical workflows, and the manufacturer-HDO relationship.
The standard mirrors IEC 62304's lifecycle structure but adds security-specific activities at every phase — planning, development, testing, release, and maintenance. It requires security risk management to be integrated with ISO 14971 safety risk management, not treated as a separate IT concern. FDA recognized it as Consensus Standard 13-122 (date of entry December 19, 2022). FDA's February 2026 cybersecurity guidance, Section V, lists IEC 81001-5-1 among the "possible frameworks to consider" for secure product development, and FDA's recognition record for the standard notes that conformance "may not satisfy all the cybersecurity requirements outlined in Section 524B of FD&C Act".
EU MDR harmonization was originally targeted for May 2024 but postponed to May 2028.
Common gaps (what we see in audits)
- Vulnerability testing limited to automated scanning — Vulnerability testing consists solely of running automated scanners without manual analysis of results, verification of exploitability, or testing of vulnerability classes specific to the device's technology stack and threat model.