Medical Device

Cybersecurity
and IEC 81001-5-1
What You Need to Know

White paper

Abstract
In today’s highly connected world, cyberattacks against critical systems and equipment are becoming an all-too-frequent
occurrence. Insurance industry consultancy Embroker notes that cybercrime increased 600% during the Covid-19
pandemic of 2020 and that the number of cyberattacks worldwide is expected to double by the year 2025.1

The issue of cybersecurity is a special concern for several industries, including the medical device industry. Quality
healthcare depends on secure access to advanced medical technologies that use software and communications
protocols to actively exchange vital patient information with other medical systems and devices. Cyber breaches
impacting medical devices put the safety of individual patients at risk and severely compromise the quality of healthcare
for people worldwide.

To help address the growing challenges of software-related cybersecurity concerns linked to medical devices, the
International Electrotechnical Commission (IEC) has published IEC 81001-5-1, “Health software and health IT system
safety, effectiveness and security—Part 5-1: Security—Activities in the product life cycle.” The standard is expected to
gain Harmonized Standard status under the European Union’s (EU) Medical Device Regulation (2017/745, MDR).

In this white paper, we’ll discuss the state of medical device cybersecurity and provide details on the scope and
requirements of IEC 81001-5-1. We’ll also discuss the implementation timeline for the standard, and how device
manufacturers can integrate the standard’s requirements into their product development activities.

TÜV SÜD
Contents
THE IMPORTANCE OF CYBERSECURITY PROTECTION OF MEDICAL DEVICES 3

CYBERSECURITY RISKS ASSOCIATED WITH MEDICAL DEVICES 4

THE CURRENT STATE OF CYBERSECURITY REQUIREMENTS FOR MEDICAL DEVICES 5

THE ROLE OF IEC 81001-5-1 IN STRENGTHENING CYBERSECURITY 6

HOW TÜV SÜD IS WORKING WITH THE MEDICAL DEVICE INDUSTRY TO ADDRESS CYBERSECURITY THREATS 8

CONCLUSION 9

About TÜV SÜD expert

Dr. Abtin Rad
Global Director Functional Safety, Software and Digitization, TÜV SÜD,
Munich Germany
Dr. Abtin Rad has 13 years of professional experience as a Biomedical
and Electrical Engineer focusing on Software, Cybersecurity, and Artificial
Intelligence. Dr. Abtin Rad is a Cybersecurity and Artificial Intelligence
Specialist for medical devices and medical software and a Lead Auditor
for ISO 13485, ISO 9001, MDSAP, and MDD/MDR.

2 Cybersecurity, medical devices, and IEC 81001-5-1 | TÜV SÜD

The importance of cybersecurity protection of
medical devices
The application of new and innovative professionals advanced warning of a billion (USD) by 2026. A year-over-
technologies has always been a key potential device failure or malfunction. year growth rate of nearly 25% from
factor in the advancements in medical Over time, connected devices and the the projected $1.7 billion market size
devices, equipment, and systems that data they generate provide essential in 2021.2 This growth is also being
we enjoy today. But few innovations information on the effectiveness of driven by efforts to expand access to
in recent memory have done more to various treatment modalities, thereby healthcare services in remote areas
transform healthcare than connected making meaningful contributions to and support the increased demand for
technologies. ongoing efforts to improve patient home healthcare solutions to serve
outcomes. patients with chronic health issues.
Connected medical devices support
the real-time transfer of important These and other advantages of
diagnostic data to information connected medical technologies The global medical
technology systems, where artificial are driving significant growth in
intelligence and machine learning can this sector of the medical device
device connectivity
be used to quickly identify individual industry. A recent report by market will reach $4.9
patient health patterns and anomalies. ResearchandMarkets on the state of billion (USD) by the
In addition, connected devices also connected medical devices predicts
allow for the monitoring of device that the global medical device
year 2026.
performance, giving healthcare connectivity market will reach $4.9

3 Cybersecurity, medical devices, and IEC 81001-5-1 | TÜV SÜD

Cybersecurity risks associated with medical devices
At the same time, the expanding use of
connected technologies in the delivery
of healthcare services also introduces
a number of potentially significant
cybersecurity risks.

According to some
estimates, approximately
30% of the world’s data
volume is currently
being generated by the
healthcare industry
alone, greater than
the amounts of data
generated by the
manufacturing sector, Like other data sets, health-related by a leading medical device
financial services, or data includes confidential information manufacturer. The recall was
that can be misused when accessed issued after it was determined that
media and entertainment
by those with malicious intent. a vulnerability in the device design
entities. Names and addresses of patients, would allow unauthorized third
medical conditions and diseases, parties to modify the pacemaker’s
prescribed drugs, and therapies, programming commands.5
To begin, health-related information and even details about insurance
generated in connection with the care coverage are just some examples of ■
In 2018, a medical syringe pump
and treatment of an average patient sensitive data collected by connected was found to have a critical
is approaching 80 megabytes of data medical devices that are vulnerable to vulnerability that would allow an
each year,3 an estimate that doesn’t cybersecurity threats and breaches. attacker to direct the operation
include data generated by the rapidly of the pump when connected to a
growing number of consumer-oriented Then there are a number of highly terminal server.6
healthcare apps. According to some publicized incidents in which hackers
estimates, approximately 30% of the have uncovered cybersecurity ■
In late 2019, the U.S. FDA identified
world’s data volume is currently being vulnerabilities in connected medical 11 separate vulnerabilities in a
generated by the healthcare industry devices or device software that would third-party software component
alone, greater than the amounts of potentially allow them to gain remote that supported network
data generated by the manufacturing access and control their operation. communications. The vulnerabilities
sector, financial services, or media Examples of such incidents include: would potentially allow anyone to
and entertainment entities. And take remote control of a device
healthcare data is expected to ■
In 2017, the U.S. Food and Drug using the software, change its
experience a compound annual Administration (FDA) issued a recall function, or cause information leaks
growth rate (CAGR) of 36% between of an estimated 465,000 implantable or logic flows that could interfere
now and 2025.4 cardiac pacemakers produced with device function.7

4 Cybersecurity, medical devices, and IEC 81001-5-1 | TÜV SÜD

■
In early 2020, the U.S. FDA monitor alarms, generate false manufacturers experienced at least
also notified the industry of alarms, or otherwise interfere with one cyberattack on one or more of
cybersecurity vulnerabilities in their intended function.8 their products in the previous 12
clinical information servers widely months.9 And, with the anticipated
used in healthcare environments. Unfortunately, cyberattacks against growth in the deployment and use
According to the FDA, the connected medical devices are of connected medical devices, the
vulnerabilities could potentially becoming all too common. According number of cyberattacks is only likely
allow an attacker to remotely take to a 2020 survey conducted by to increase.
control of a device connected to Swedish software company ir.deto,
the server, and silence patient more than 82% of medical device

The current state of cybersecurity requirements for

medical devices
Amidst this growing threat landscape guidance on developing connected exemplified by the Commission of the
applicable to connected medical medical devices that can help secure European Union (EU) and their evolving
devices, regulators in major them from the most likely cyber threats. regulations applicable to cybersecurity
jurisdictions are increasingly aware of considerations in medical devices.
the need to provide the industry with Evidence of the growing concern
more clear and direct regulations and among regulators is perhaps best

Major progress was To help device manufacturers better understand how

End of the transitional
reflected in the EU’s to address the relevant essential MDR requirements
period for the
MDR issued in 2017 applicable to cybersecurity, the EU’s Medical Device
First issued almost 30 European Medical
and which took full Coordination Group (MDCG) issued in December 2019
years ago in 1993, the Devices Regulation
effect in 2021 for its “Guidance on Cybersecurity for Medical Devices.”
EU’s Medical Device 2017/745.
medical devices, and
Directive (93/42/
which includes six Also known as MDCG 2019-16, the MDCG’s Guidance
EEC) includes just From 26 May
paragraphs in Annex runs 46 pages and provides detailed descriptions
a single sentence 2021, new devices
I, “General Safety of basic cybersecurity concepts, secure design
that indirectly refers have to meet the
and Performance and manufacturing practices, documentation and
to cybersecurity- requirements of
Requirements,” that instructions for use, and post-market surveillance and
related concerns. the MDR in order
directly address vigilance. Recently updated, the Guidance serves as a
to be placed in the
cybersecurity roadmap for manufacturers seeking approval of their
European market.
considerations. connected devices for sale in the EU.

1993 2017 2019 2021

Medical Device
Medical Device Medical Device Coordination Group End of MDR
Directive
Regulation (MDCG) 2019-16 transitional period
(93/42/EEC)

5 Cybersecurity, medical devices, and IEC 81001-5-1 | TÜV SÜD

In the U.S., the FDA has published “Postmarket Management of cybersecurity issues specific to
several of its own guidances Cybersecurity in Medical Devices,” medical devices. While there are
applicable to cybersecurity issues was issued in late 2016 and provides a number of industry-accepted
in medical devices. Issued in 2014, a framework for medical device standards available that apply to
the FDA’s guidance, “Content cybersecurity risk management and cybersecurity issues in general,
of Premarket Submissions for details on remediating and reporting medical device manufacturers
Management of Cybersecurity cybersecurity vulnerabilities. have lacked a life-cycle standard
of Medical Devices,” outlines that directly addresses the issue of
considerations that manufacturers These and other regulations and cybersecurity as it impacts connected
should include as part of their device guidances reflect the growing medical devices. The absence of a
design and development phases to cyber threat and the evolution of dedicated standard has held back
be documented in their submissions thinking about how manufacturers efforts to deploy common strategies to
under both its premarket notification can minimize them. However, protect advanced connected medical
(510(k)) and premarket approval (PMA) there continues to be considerable technologies from current and future
programs. The FDA’s most recent divergence within the industry on cybersecurity concerns.
guidance related to cybersecurity, the best ways to effectively address

The role of IEC 81001-5-1 in strengthening

cybersecurity
In an effort to fill this critical void, products and applications are used
the International Electrotechnical in a variety of health-related systems
Commission (IEC) has developed a
“Software intended to and devices, software as a medical
new standard focused exclusively be used specifically for device (SaMD), and software-only
on cybersecurity issues impacting managing, maintaining, products intended for health-related
software used in connected health uses.
or improving the health
technologies, including medical
devices and consumer-oriented health of individual persons, Further, IEC 81001-5-1 covers health
products and applications. or the delivery of software’s entire product life cycle,
care, or which has from product development through
Released in December 2021 after post-market use and monitoring.
more than three years of discussions
been developed for For this reason, the standard also
and deliberations, IEC 81001-5-1 the purposes of being recognizes the critical role of
is an important supplement to IEC incorporated into a healthcare delivery organizations in
62304, “Medical device software – maintaining effective cybersecurity
medical device.”
Software lifecycle processes,” which practices, emphasizing the importance
establishes a common framework for of bilateral communications between
the life cycle processes related to device manufacturers and software
medical device software. Specifically, As this definition clearly confirms, developers and those responsible for
IEC 81001-5-1 addresses security the broader scope of “health the actual use of connected devices.
issues related to all types of “health software” includes not just
software,” which is defined in the manufacturers of medical devices
standard as: but also software developers whose

6 Cybersecurity, medical devices, and IEC 81001-5-1 | TÜV SÜD

Like other process-related standards, or software developer as part of the cyberthreats. Specific activities are
IEC 81001-5-1 details the activities to overall product development life cycle described in clauses 4 through 9 of the
be undertaken by the manufacturer to help ensure protection against standard as follows:

General requirements Software development process Software maintenance process

(clause 4) (clause 5) (clause 6)
Includes the implementation and Covers conducting a health Addresses the establishment of a
application of a quality management software requirements analysis software maintenance plan that
system that includes considerations with special attention to software- includes timely delivery of software
of product security, as well as the specific security risks, software updates to protect against new
application of a risk management design and integration testing, and emerging cyberthreats, and
system that addresses security in including threat mitigation modification implementation.
information technology devices and testing, vulnerability and
software. penetration testing.

Security risk management Software configuration Software problem resolution

process (clause 7) management process (clause 8) process (clause 9)
Calls for identifying potential Requires manufacturers to develop Includes establishing a process to
vulnerabilities, threats, and the a general product development, receive notifications about potential
associated adverse impacts, an maintenance, and support process security vulnerabilities, review and
estimation and evaluation of those that includes configuration analyze those vulnerabilities, and
risks, taking steps to control those management with change controls take steps to address security-
risks, and ongoing monitoring to and change history, as well as related issues.
assess the effectiveness of risk information on external components
controls. that are or could be susceptible to
security vulnerabilities.

IEC 81001-5-1 also includes several potential security threats, and offers that can be used in support of
informative Annexes that can help details on several approaches that submissions for 510(k) and PMA
manufacturers and developers meet can be used to develop an accurate review. But, regardless of the
the standard’s requirements. Annex B threat model. standard’s actual effective date,
guides the implementation of life cycle connected device manufacturers and
activities to help ensure the security IEC 81001-5-1 is expected to be developers of health software can
of health software. And Annex designated by the EU Commission gain significant benefits from meeting
C provides a detailed discussion as a harmonized standard under the the requirements of ISO 81000-5-1 in
of threat modeling, a systematic MDR with an anticipated effective current and future product designs.
approach for analyzing the security of date in May 2024. The standard is
a device or an application to facilitate also likely to be recognized by the
the identification and prioritization of U.S. FCC as a “consensus standard”

7 Cybersecurity, medical devices, and IEC 81001-5-1 | TÜV SÜD

How TÜV SÜD is working with the medical device
industry to address cybersecurity threats
For decades, TÜV SÜD has been awareness among regulatory range of testing and other services
at the forefront of efforts to comply bodies regarding the importance to fully assess the security of your
with regulatory requirements and of addressing cybersecurity devices and health software against
standards applicable to medical considerations, our testing cyber threats. This includes:
devices. With the increased laboratories offer a comprehensive

Product testing Compliance assessments Customized

This category of cybersecurity testing and This category of testing and cybersecurity tests
services includes the assessment of your services includes testing This includes the
cybersecurity measures for compliance against the requirements development and execution
with the most current regulations, of the standards mentioned of product-specific testing
standards, and guidances, including earlier, vulnerability scans, and methods not addressed
IEC 81001-5-1, IEC TR 60601-4-5, IEC 62304, penetration tests. A detailed in current regulations
MDCG 2019-16, and other applicable test report is provided, along and standards, and
requirements. Systems testing can also with an optional report on assessments of provider-
include vulnerability scans of your devices compliance with EU and FDA specific security solutions.
and software to help identify areas of premarket requirements.
greatest concern.

Our expert technical professionals bring our extensive and in-depth issues, enabling them to bring
conduct these security-related tests experience in the medical device connected medical devices and health
and services in our state-of-the-art industry to help our clients solve software to market.
testing facilities. In every case, we their most challenging cybersecurity

8 Cybersecurity, medical devices, and IEC 81001-5-1 | TÜV SÜD

Conclusion
The growing cyber threat landscape
for connected medical devices
requires that device manufacturers
and software developers take a
proactive approach in designing
their products to minimize the
risk of potential cybersecurity
vulnerabilities. IEC 81001-5-1
provides a detailed roadmap that
manufacturers and developers can
adopt, thereby helping to ensure the
safety and security of their products
throughout their entire lifecycle.

TÜV SÜD is one of the world’s leading

Notified Bodies for the review and
approval of medical devices. TÜV SÜD
is also accredited by the IMDRF’s device professionals based in more medical technologies and other
Medical Device Single Audit Program than 30 locations worldwide, TÜV medical devices and software, visit
(MDSAP), which provides a path SÜD has the resources to support www.tuvsud.com/en-us. Or contact
for demonstrating compliance with your efforts. us at [email protected]
key medical device requirements in
the U.S., Canada, Japan, Brazil, and For more information about
Australia. With more than 750 medical TÜV SÜD testing of connected

9 Cybersecurity, medical devices, and IEC 81001-5-1 | TÜV SÜD

FOOTNOTES
[1] “2021 Must-Know Cyber Attack Statistics and Trends,” published on August 11, 2021, [6] “Critical Cybersecurity Vulnerability Found in BD Alaris Plus Pump,” an article posted
and available at https://www.embroker.com/blog/cyber-attack-statistics/ (as of 15 to the website of Cybersecurity News on August 27, 2018 and available at https://
November 2021). healthitsecurity.com/news/critical-cybersecurity-vulnerability-found-in-bd-alaris-plus-
pump (as of 15 November 2021).
[2] “Global Medical Device Connectivity Market Report 2021,” press release published
on August 24, 2021, and available at https://www.businesswire.com/news/ [7] “Urgent/11 Cybersecurity Vulnerabilities in a Widely-Used Third Party Software
home/20210824005471/en/Global-Medical-Device-Connectivity-Market-Report-2021- Component May Introduce Risks During Use of Certain Medical Devices: FDA Safety
Shift-from-Payment-For-Performance-to-Payment-For-Outcomes-Models-is-Boosting- Communication,” issued by the U.S. FDA on October 1, 2019, and available at https://
the-Demand-for-Medical-Device-Connectivity-Solutions---ResearchAndMarkets.com www.fda.gov/medical-devices/safety-communications/urgent11-cybersecurity-
(as of 15 November 2021). vulnerabilities-widely-used-third-party-software-component-may-introduce (as of 15
November 2021).
[3] “Better Patient Outcomes Through Mining of Biomedical Big Data,” published in
December, 2018 and available at the website of Frontiers in ICT at https://www. [8] “Cybersecurity Vulnerabilities in Certain GE Healthcare Clinical Information Central
frontiersin.org/articles/10.3389/fict.2018.00030/full (as of 15 November 2021). Stations and Telemetry Servers: Safety Communication,” issued by the U.S. FDA
on January 23, 2020, and available at https://www.fda.gov/medical-devices/
[4] “The healthcare data explosion,” one of a series of articles on the state of healthcare safety-communications/cybersecurity-vulnerabilities-certain-ge-healthcare-clinical-
produced by RBC Capital Markets (no date), and available at https://www.rbccm.com/ information-central-stations-and (as of 15 November 2021).
en/gib/healthcare/episode/the_healthcare_data_explosion (as of 15 November 2021).
[9] “ir.deto Global Connected Industries Cybersecurity Survey: IOT Cyberattacks Are the
[5] “FDA announces first-ever recall of a medical device due to cyber risk,” an article Norm, The Security Mindset Isn’t,” findings of a survey conducted by ir.deto in 2019
posted to the website of Cisco, and available at https://blogs.cisco.com/healthcare/ and available at https://resources.irdeto.com/assets/global-connected-industries-
fda-announces-first-ever-recall-of-a-medical-device-due-to-cyber-risk (as of 15 cybersecurity-survey-1 (as of 15 November 2021).
November 2021).

COPYRIGHT NOTICE
The information contained in this document represents the current view of TÜV SÜD on the issues discussed as of the date of publication. Because TÜV SÜD must respond to changing
market conditions, it should not be interpreted to be a commitment on the part of TÜV SÜD, and TÜV SÜD cannot guarantee the accuracy of any information presented after the date of
publication. This White Paper is for informational purposes only. TÜV SÜD makes no warranties, express, implied or statutory, as to the information in this document. Complying with all
applicable copyright laws is the responsibility of the user. Without limiting the rights under copyright, no part of this document may be reproduced, stored in or introduced into a retrieval
system, or transmitted in any form or by any means (electronic, mechanical, photocopying, recording, or otherwise), or for any purpose, without the express written permission of TÜV
SÜD. TÜV SÜD may have patents, patent applications, trademarks, copyrights, or other intellectual property rights covering subject matter in this document. Except as expressly provided
in any written license agreement from TÜV SÜD, the furnishing of this document does not give you any license to these patents, trademarks, copyrights, or other intellectual property.
ANY REPRODUCTION, ADAPTATION OR TRANSLATION OF THIS DOCUMENT WITHOUT PRIOR WRITTEN PERMISSION IS PROHIBITED, EXCEPT AS ALLOWED UNDER THE COPYRIGHT
LAWS. © TÜV SÜD Group – 2022 – All rights reserved - TÜV SÜD is a registered trademark of TÜV SÜD Group

DISCLAIMER
All reasonable measures have been taken to ensure the quality, reliability, and accuracy of the information in the content. However, TÜV SÜD is not responsible for the third-party content
contained in this publication. TÜV SÜD makes no warranties or representations, expressed or implied, as to the accuracy or completeness of information contained in this publication.
This publication is intended to provide general information on a particular subject or subjects and is not an exhaustive treatment of such subject(s). Accordingly, the information in this
publication is not intended to constitute consulting or professional advice or services. If you are seeking advice on any matters relating to information in this publication, you should –
where appropriate – contact us directly with your specific query or seek advice from qualified professional people. The information contained in this publication may not be copied, quoted,
or referred to in any other publication or materials without the prior written consent of TÜV SÜD. All rights reserved
© 2022 TÜV SÜD.

10 Cybersecurity, medical devices, and IEC 81001-5-1 | TÜV SÜD

Find out more about TÜV SÜD’s services for
Cybersecurity in Medical Devices
www.tuvsud.com/en-us/medical-device-cybersecurity
[email protected]

Add value. Inspire trust.

TÜV SÜD is a trusted partner of choice for safety, security, and sustainability solutions. It specializes in testing,
certification, auditing, and advisory services. Since 1866, the company has remained committed to its purpose of
enabling progress by protecting people, the environment, and assets from technology-related risks. Through more
than 25,000 employees across over 1,000 locations, it adds value to customers and partners by enabling market access
and managing risks. By anticipating technological developments and facilitating change, TÜV SÜD inspires trust in a
physical and digital world to create a safer and more sustainable future.

GLOBAL HEADQUARTERS TÜV SÜD AMERICA HEADQUARTERS

TÜV SÜD AG TÜV SÜD America Inc.
2022 © TÜV SÜD AG | MKG/MHS/37.0/en/US

Westendstr. 199 401 Edgewater Place, Suite 500

80686 Munich Germany Wakefield, MA 01880
+49 89 5791 0 United States of America
www.tuvsud.com/en +1 978 573 2500
www.tuvsud.com/en-us