IEC/TS 81001-2-2:2025

Overview

IEC/TS 81001-2-2:2025 - Health software and health IT systems safety, effectiveness and security (Part 2-2) provides guidance for the implementation, disclosure and communication of security needs, risks and controls across the life cycle of health software and health IT systems. This IEC Technical Specification consolidates and updates previous TRs (IEC TR 80001-2-2 and 80001-2-8), extends scope from medical device software to all health software, and aligns with ISO 81001-1:2021 and updated IEC 80001-1. It applies to software on any platform or environment (cloud, on‑premise, hybrid), and is intended for information exchange between manufacturers, healthcare delivery organizations (HDOs) and other stakeholders.

Key Topics

The document organizes a common set of high-level security capabilities and practical guidance for their use in a risk management context. Key technical topics include:

• A catalog of security capabilities such as automatic logoff, audit controls, authorization, person and node authentication, malware detection/protection, transmission confidentiality and integrity, data backup & disaster recovery, emergency access, system/application hardening, and physical locks (see Clause 5).
• Additional supporting information: connectivity capabilities, management of personally identifiable information (PII), remote services, Software Bill of Materials (SBOM), and security guides (Clause 6).
• Guidance on communication and shared responsibility between manufacturers and HDOs, and on applying these capabilities within risk management processes (Clause 4).
• Mappings to established control frameworks and standards including ISO/IEC 27002, NIST SP 800‑53 Rev 5, IEC 62443‑4‑2, IEC TR 60601‑4‑5, and ISO/IEEE 11073‑40102.
• Notable changes: consolidation of prior guidance, removal of the “Configuration of Security Features (CNFS)” capability (requiring explicit communication of configurable features), and expanded disclosure expectations (e.g., SBOM and MDS2 references).

Applications

Who uses IEC/TS 81001-2-2:2025 and why:

• Health software manufacturers and medical device manufacturers: to define, implement and disclose security capabilities and produce consistent security documentation for purchasers and regulators.
• Healthcare Delivery Organizations (HDOs): to evaluate supplier security claims, integrate products safely into clinical networks, and allocate shared security responsibilities.
• Procurement, clinical engineers, cybersecurity teams, integrators and risk managers: for vendor assessment, system integration, incident preparedness and compliance planning.
• Applicable across cloud, on‑premise and hybrid deployments and supports integration into device lifecycles, vulnerability management, and supply‑chain transparency (SBOM).

Related standards

• ISO 81001‑1:2021 (principles and definitions for health software safety, effectiveness and security)
• ISO/IEC 27002; NIST SP 800‑53 Rev 5; IEC 62443‑4‑2; IEC TR 60601‑4‑5; ISO/IEEE 11073‑40102 These mappings help implementers translate IEC/TS 81001-2-2 security capabilities into specific technical controls and organizational measures.

Keywords: IEC/TS 81001-2-2:2025, health software security, health IT systems, security capabilities, SBOM, risk management, HDO, manufacturers, cybersecurity standards.