IEC 81001-5-1 (Health Software Cybersecurity)
IEC 81001-5-1 is the international standard for cybersecurity activities in the lifecycle of health software: software that is itself a medical device, runs in a medical device, or is used in health IT systems. It describes which security activities a manufacturer has to perform and document, from requirements analysis to post-market maintenance. The standard is derived from IEC 62443-4-1 and transfers its process requirements to the healthcare domain.
Who does IEC 81001-5-1 apply to?
The standard addresses manufacturers of health software, which means medical device manufacturers whose products contain or consist of software, as well as providers of software for health IT systems. From a regulatory perspective it is relevant in two worlds: in the EU, manufacturers use it to support the cybersecurity requirements of the Medical Device Regulation (MDR); in the US, the FDA has recognized the standard as a consensus standard. Regulators expect the activities described in the standard to have been carried out verifiably.
The activities across the lifecycle
IEC 81001-5-1 structures the security work along the software lifecycle:
- Security management: roles, responsibilities and a process that integrates security into development.
- Requirements and threat modeling: systematic analysis of which threats affect the product and which security requirements follow from them.
- Secure architecture and implementation: security by design, secure coding guidelines, handling of third-party components.
- Verification and security testing: evidence that the requirements have been implemented, for example through vulnerability scans and penetration tests.
- Vulnerability management and updates: monitoring of new vulnerabilities, assessment, remediation and communication after market release.
- Documentation for users: information that operators need for secure use.
Interaction with IEC 62304 and ISO 14971
The standard does not stand alone. IEC 62304 describes the software lifecycle for medical devices with a focus on safety, ISO 14971 the risk management. IEC 81001-5-1 complements both with the security perspective: security risks are embedded in the same risk management, and security activities are assigned to the phases of the software lifecycle. The result is continuous evidence in which safety and security arguments fit together.
Threat modeling as the central evidence
At the core of the standard is documented threat modeling. It describes the product with its interfaces and data flows, identifies possible attacks, evaluates their impact on patient safety and data protection, and derives security requirements from them. The FDA cybersecurity guidance explicitly requires the same, plus a software bill of materials (SBOM). The threat model has to stay current across the lifecycle: every new vulnerability in a component and every change to the product requires a reassessment.
IEC 81001-5-1 in practice
For many manufacturers, threat modeling is the most laborious part because it has to be maintained across product variants, versions and years. A model-based approach helps: if the threat and risk analysis is kept as a model rather than a document, changes to the product can be traced directly in the risk assessment, and the reports for MDR and FDA can be generated from the same baseline. itemis SECURE supports this approach with a threat analysis according to IEC 81001-5-1 whose assessment models and reports can be adapted to the requirements of the respective authority.