IEC 81001-5-1:2021

Overview

IEC 81001-5-1:2021 (Health software and health IT systems - Part 5-1) defines life‑cycle requirements to increase the cybersecurity of health software and health IT systems. Intended to support conformance with IEC 62443-4-1, the standard prescribes a common framework of processes, activities and tasks across the health software life cycle. It emphasizes maintaining an appropriate balance among safety, effectiveness and security (as discussed in ISO 81001-1) and focuses on activities in development, release, maintenance and decommissioning. The document does not prescribe the exact contents of accompanying documentation.

Key topics and technical requirements

• Secure life‑cycle processes: Establishes required activities across planning, development, integration, testing, release and maintenance phases of health software.
• Quality management & responsibilities: Calls for defined quality systems, explicit assignment of security responsibilities, and continuous improvement.
• Security risk management: Defines processes to identify vulnerabilities, assess threats, estimate and control security risks and monitor controls.
• Software classification & supplier management: Addresses classification of software items (e.g., maintained vs supported), and management of third‑party components.
• Secure design and implementation: Covers architectural defence‑in‑depth, secure design best practices and secure coding standards.
• Verification & testing: Requires security‑focused verification, vulnerability testing, threat mitigation testing and guidance on penetration testing and tester independence.
• Release & integrity controls: Covers release documentation, file integrity, private key controls and criteria for resolving security findings before release.
• Maintenance & vulnerability handling: Establishes maintenance planning, timely security updates, verification of updates and processes for receiving and addressing vulnerability reports.
• Configuration and problem resolution: Includes software configuration management and structured problem/incident resolution processes.
• : Informative annexes provide methods (e.g., STRIDE, attack‑defense concepts), implementation guidance and rationale.