Tester Independence

Maps to

IEC 81001-5-1: §5.7.5

Requirement text

The manufacturer shall document means of ensuring objectivity of the test effort for: a) attack surface analysis; b) security requirements testing; c) threat mitigation testing; d) vulnerability testing; e) known vulnerability scanning; and f) penetration testing. See Table A.1 for required independence levels.

What changed

IEC 81001-5-1:2021 is the first standalone cybersecurity standard purpose-built for health software and medical device software. Published in December 2021, it was adapted from IEC 62443-4-1 (industrial control systems security) to address the unique safety and regulatory context of medical devices — adding 64 health-specific requirements that account for patient safety, clinical workflows, and the manufacturer-HDO relationship.

The standard mirrors IEC 62304's lifecycle structure but adds security-specific activities at every phase — planning, development, testing, release, and maintenance. It requires security risk management to be integrated with ISO 14971 safety risk management, not treated as a separate IT concern. FDA formally recognized it as Consensus Standard #13-112 in December 2022 and references it as providing a framework for the Secure Product Development Framework (SPDF) required by Section 524B.

EU MDR harmonization was originally targeted for May 2024 but postponed to May 2028. Despite this delay, Notified Bodies and Competent Authorities universally recognize it as "state of the art" for health software cybersecurity under MDR GSPR Annex I, Section 17.2. Missing or inadequate cybersecurity documentation is already a top cause of Notified Body major non-conformities for SaMD. A December 2025 Interpretation Sheet (ISH1:2025) clarified software item classification into maintained, supported, and required software categories, affecting risk transfer and post-market obligations.

Atomic constraints

•Means of ensuring objectivity must be documented for attack surface analysis.
•Means of ensuring objectivity must be documented for security requirements testing.
•Means of ensuring objectivity must be documented for threat mitigation testing.
•Means of ensuring objectivity must be documented for vulnerability testing.
•Means of ensuring objectivity must be documented for known vulnerability scanning.
•Means of ensuring objectivity must be documented for penetration testing.
•Independence levels must reference Table A.1 of IEC 81001-5-1.

Common gaps

Developers testing their own security implementations

major

Security testing including penetration testing is performed by the same engineers who developed the security controls. IEC 81001-5-1 requires independence between testers and developers. Most manufacturers lack a separate internal security testing team.

Evidence signals

•
FILE_EXISTS
Test.*Independence|Tester.*Objectivity|Testing.*Plan|Security.*Test.*Plan
•
CONTENT_MATCH
Does this document describe the independence level of testers for each type of security testing activity, referencing required independence levels and documenting whether testers are internal or external to the development team?

Audit defense

The Security Test Plan for [your product] (Doc ID: [your document ID]) documents the means of ensuring objectivity for all six required security test types, with tester independence levels defined in accordance with Table A.1 of IEC 81001-5-1.

Review your documents against this clause →