When Do I Need to Comply with IEC 81001-5-1?

Written by Karl Larsson on 14 August 2024. Posted in Expert's Secret.

For those navigating the complexities of Health and Medical Device Software, understanding and integrating IEC 81001-5-1 into your processes is crucial, especially in today's landscape where cybersecurity is increasingly essential.

Recent regulatory shifts, such as the EU Commission's decision on 27th of May, 2024 to delay many standards' harmonisation deadlines under EU MDR and IVDR, including IEC 81001-5-1 until 2028, highlight the need to grasp not just when but also why compliance with this standard is critical.

What is IEC 81001-5-1?

IEC 81001-5-1 is a cybersecurity process standard that outlines life cycle requirements covering the entire span of health software (including Medical Device Software (MDSW), Software in a Medical Device (SiMD), and Software as a Medical Device (SaMD)) from development through maintenance. Its primary aim is to enhance the cybersecurity of health software by integrating security measures at every stage of the software lifecycle, complementing safety-focused standards like IEC 62304. It was initially set to be recognized as a harmonized standard under the EU MDR and IVDR by 24th of May 2024.

The Current Regulatory and Advisory Landscape in the EU

While the EU's harmonization postponement introduces some uncertainty, influential voices within the industry have been recommending proactive compliance:

IGNB Recommendations: According to the Association of German Notified Bodies’ questionnaires from 2023, while compliance with IEC 81001-5-1 isn’t mandatory before it's harmonised, IGNB strongly recommends early adoption. This endorsement underscores the standard's relevance and the urgency of addressing cybersecurity risks sooner rather than later.
Team NB Position: Team NB, representing various European notified bodies, has endorsed IEC 81001-5-1 as a state-of-the-art standard since 2022, advocating for its adoption through transition plans as soon as possible. They emphasize the standard's role in establishing secure development life cycles, reflecting a broad consensus on its immediate utility and future necessity. [1]

International Compliance

Global markets such as the USA and Japan have already embraced IEC 81001-5-1, recognizing its critical role in ensuring product safety and market access:

In the USA, it has been a recognised consensus standard (like UL 2900-1 and 2900-2-1) since 2022 [4], and FDA’s latest cybersecurity guidance also recommends adapting this standard to use it as a framework for secure product development and maintenance.
In Japan, since 1st of April 2024, it is required that medical device manufacturers demonstrate conformity to the Essential Principles having updated cyber security requirements from 2023, including conformance to JIS T 81001-5-1 (IEC 81001-5-1). [5]

Why Comply Now?

Cybersecurity as a Continuous Requirement: Cyber threats do not pause while regulations catch up. The proactive implementation of IEC 81001-5-1 helps mitigate these risks promptly.
Regulatory Expectations and Market Needs: Even though the EU has extended harmonisation deadlines, and the current regulations do not require such an extensive security management that IEC 81001-5-1 provides, the market and regulatory bodies expect advanced cybersecurity measures.
Filling Current Gaps: Many aspects that IEC 81001-5-1 covers, such as security relevant design inputs, secure design, security risk management including threat modelling and security testing (including but not limited to penetration testing), are already necessary under existing EU MDR, IVDR, and other regulations. Manufacturers implementing these measures independently may face inconsistencies and inefficiencies that adherence to a state-of-the-art standard like IEC 81001-5-1 can alleviate.

Implementation Advantages

Adopting IEC 81001-5-1 sooner rather than later provides several benefits:

Standardization of Security Practices: Instead of navigating varying interpretations of what constitutes adequate cybersecurity, companies can rely on a recognized standard that outlines clear, actionable tasks and processes.
Integration into Quality Management Systems (QMS): Aligning cybersecurity practices with QMS requirements becomes streamlined, ensuring that security measures are not just add-ons but are integrated throughout the product lifecycle.
Preparation for Future Regulatory Changes: With cybersecurity becoming a more prominent focus of medical device regulation globally, early compliance positions companies favourably for future shifts in the regulatory landscape.

Practical Integration into QMS

Much of the standard details activities and tasks that are logical (e.g., threat modelling, vulnerability testing, penetration testing) and may already be familiar to medical software developers, as these practices might already be implemented even without strict adherence to this standard. Common software development practices also include integrating security-related design inputs, following secure coding standards, and applying configuration management.

However, certain aspects of the standard could introduce new challenges or learning opportunities, even for seasoned security professionals. Specifically, the concept of classifying software items in relation to risk transfer and managing them effectively might be less familiar and necessitate thoughtful integration into current practices.

Implementing IEC 81001-5-1 into a QMS can be daunting, especially for startups with limited resources. To manage this effectively, companies, particularly those developing new devices, may consider adopting a staggered transition plan.

This strategy allows them to systematically embed cybersecurity measures into their processes without overextending their resources. Initially, they should focus on ensuring that cybersecurity measures are incorporated from the outset of software development. Subsequently, they can concentrate on the secure release of the software and the establishment of post-market management and monitoring practices. This structured approach guarantees that the software is secure-by-design, positioning cybersecurity as an integral and effective component rather than a superficial add-on.

Conclusion

The question of when to comply with IEC 81001-5-1 might be influenced by regulatory timelines, but the reasons to comply sooner are compelling. Beyond mere compliance, integrating IEC 81001-5-1 reflects a commitment to safety, security, and excellence in Health Software Lifecycle Management. As cyber threats evolve, the importance of robust cybersecurity measures will only increase, making timely adoption of standards like IEC 81001-5-1 not just a strategic advantage but a necessary safeguard.

About the Expert

Peter Roka is a seasoned professional with over ten years in the medical device industry, specializing in medical device software and QMS development. With a robust background in electrical and biomedical engineering, along with extensive experience in developing and managing medical devices, as well as regulatory and quality consultancy, he brings a unique and comprehensive blend of R&D and QARA expertise to guide the entire product lifecycle.