IEC/AWI 81001-5-1
(Main)Health software and health IT systems safety, effectiveness and security - Part 5-1: Security - Activities in the product life cycle
Health software and health IT systems safety, effectiveness and security - Part 5-1: Security - Activities in the product life cycle
This document defines the LIFE CYCLE requirements for development and maintenance of HEALTH SOFTWARE needed to support conformance to IEC 62443-4-1 – taking the specific needs for HEALTH SOFTWARE into account. The set of PROCESSES, ACTIVITIES, and TASKS described in this document establishes a common framework for secure HEALTH SOFTWARE LIFE CYCLE PROCESSES. The purpose is to increase the CYBERSECURITY of HEALTH SOFTWARE by establishing certain ACTIVITIES and TASKS in the HEALTH SOFTWARE LIFE CYCLE PROCESSES and also by increasing the SECURITY of SOFTWARE LIFE CYCLE PROCESSES themselves. It is important to maintain an appropriate balance of the key properties SAFETY, effectiveness and SECURITY as discussed in ISO 81001-1. This document excludes specification of ACCOMPANYING DOCUMENTATION contents.
Sécurité, efficacité et sûreté des logiciels de santé et des systèmes TI de santé — Partie 5-1: Sûreté — Activités du cycle de vie du produit
Le présent document définit les exigences de CYCLE DE VIE relatives au développement et à la maintenance des LOGICIELS DE SANTE, nécessaires pour venir à l’appui de la conformité à l’IEC 62443-4-1 – compte tenu des besoins spécifiques pour les LOGICIELS DE SANTE. L’ensemble des PROCESSUS, ACTIVITES et TACHES décrits dans le présent document établit un cadre commun pour des PROCESSUS sécurisés du CYCLE DE VIE DES LOGICIELS DE SANTE. Ces processus ont pour objet de renforcer la CYBERSECURITE des LOGICIELS DE SANTE par l'établissement de certaines ACTIVITES et TACHES dans les PROCESSUS DU CYCLE DE VIE desdits LOGICIELS, ainsi que par le renforcement de la SURETE des PROCESSUS DU CYCLE DE VIE DES LOGICIELS proprement dit. Il est important de maintenir un équilibre approprié des propriétés clés (SECURITE, efficacité et SURETE) traitées dans l’ISO 81001-1. Le présent document exclut la spécification du contenu de la DOCUMENTATION D’ACCOMPAGNEMENT.
General Information
- Status
- Not Published
- Technical Committee
- ISO/TC 215 - Health informatics
- Current Stage
- 1099 - New project approved
- Start Date
- 22-Sep-2025
- Completion Date
- 27-Dec-2025
Relations
- Effective Date
- 16-Oct-2025
Overview
IEC/AWI 81001-5-1 (Health software and health IT systems safety, effectiveness and security - Part 5-1: Security - Activities in the product life cycle) defines life‑cycle requirements for developing and maintaining health software to support conformance with IEC 62443-4-1 while accounting for the specific needs of healthcare. The document establishes a common framework of processes, activities and tasks to increase the cybersecurity of health software and the security of software life‑cycle processes themselves. It also stresses maintaining the balance of safety, effectiveness and security (per ISO 81001-1). Note: this interpretation sheet clarifies lifecycle and risk‑transfer activities but does not prescribe the full contents of accompanying documentation.
Key topics and technical requirements
- Secure software life cycle (SDLC) activities: defined processes, activities and tasks to be integrated into product development and maintenance to improve overall cybersecurity.
- Software item classification: categories - MAINTAINED, SUPPORTED, REQUIRED - and rules for mapping, nested inclusion and how classifications affect risk transfer and obligations.
- Risk transfer and management: manufacturer and operator responsibilities across the product life cycle, including identification and management of security risks for all software items (see 5.2.3).
- Update and integrity controls: obligations to communicate and provide updates (6.3.1–6.3.3), ensure verifiable integrity of manufacturer‑provided updates, and manage update timing between manufacturers and operators.
- Vulnerability disclosure and severity ranking: processes for disclosing security issues, including using severity frameworks (e.g., CVSS) and ranking vulnerabilities to prioritize remediation.
- Monitoring and incident awareness: requirements for monitoring public incident reports and reviewing relevant security information to maintain a secure state.
- Accompanying documentation review: requirements for providing essential documentation to operators about risk transfer and supported software items, while not specifying exact document content.
Practical applications and who uses it
- Medical device and health software manufacturers: integrate lifecycle security activities, define software item categories, and manage update/notification obligations.
- Health IT product developers and integrators: adopt the SDLC framework to align with IEC 62443‑4‑1 and ensure interoperable, secure deployments.
- Hospital IT/security teams and operators: understand risk transfer, update responsibilities, and plan change management for shared infrastructure.
- Regulatory and compliance teams, risk managers, and auditors: use the standard to assess lifecycle security practices and manufacturer/operator responsibilities.
Related standards
- IEC 62443-4-1 (industrial/OT product development security)
- ISO 81001-1 (sociotechnical ecosystem, safety‑security balance)
- CVSS guidance (vulnerability severity ranking)
This standard is essential for anyone implementing or regulating secure development, maintenance and risk transfer practices for health software in connected healthcare ecosystems.
Frequently Asked Questions
IEC/AWI 81001-5-1 is a draft published by the International Organization for Standardization (ISO). Its full title is "Health software and health IT systems safety, effectiveness and security - Part 5-1: Security - Activities in the product life cycle". This standard covers: This document defines the LIFE CYCLE requirements for development and maintenance of HEALTH SOFTWARE needed to support conformance to IEC 62443-4-1 – taking the specific needs for HEALTH SOFTWARE into account. The set of PROCESSES, ACTIVITIES, and TASKS described in this document establishes a common framework for secure HEALTH SOFTWARE LIFE CYCLE PROCESSES. The purpose is to increase the CYBERSECURITY of HEALTH SOFTWARE by establishing certain ACTIVITIES and TASKS in the HEALTH SOFTWARE LIFE CYCLE PROCESSES and also by increasing the SECURITY of SOFTWARE LIFE CYCLE PROCESSES themselves. It is important to maintain an appropriate balance of the key properties SAFETY, effectiveness and SECURITY as discussed in ISO 81001-1. This document excludes specification of ACCOMPANYING DOCUMENTATION contents.
This document defines the LIFE CYCLE requirements for development and maintenance of HEALTH SOFTWARE needed to support conformance to IEC 62443-4-1 – taking the specific needs for HEALTH SOFTWARE into account. The set of PROCESSES, ACTIVITIES, and TASKS described in this document establishes a common framework for secure HEALTH SOFTWARE LIFE CYCLE PROCESSES. The purpose is to increase the CYBERSECURITY of HEALTH SOFTWARE by establishing certain ACTIVITIES and TASKS in the HEALTH SOFTWARE LIFE CYCLE PROCESSES and also by increasing the SECURITY of SOFTWARE LIFE CYCLE PROCESSES themselves. It is important to maintain an appropriate balance of the key properties SAFETY, effectiveness and SECURITY as discussed in ISO 81001-1. This document excludes specification of ACCOMPANYING DOCUMENTATION contents.
IEC/AWI 81001-5-1 is classified under the following ICS (International Classification for Standards) categories: 35.030 - IT Security; 35.080 - Software; 35.240.80 - IT applications in health care technology. The ICS classification helps identify the subject area and facilitates finding related standards.
IEC/AWI 81001-5-1 has the following relationships with other standards: It is inter standard links to IEC 81001-5-1:2021. Understanding these relationships helps ensure you are using the most current and applicable version of the standard.
IEC/AWI 81001-5-1 is available in PDF format for immediate download after purchase. The document can be added to your cart and obtained through the secure checkout process. Digital delivery ensures instant access to the complete standard document.
Standards Content (Sample)
IEC 81001-5-1:2021/ISH1:2025 © IEC 2025
INTERNATIONAL ELECTROTECHNICAL COMMISSION
____________
IEC 81001-5-1
Edition 1.0 2021-12
Health software and health IT systems safety, effectiveness and security -
Part 5-1: Security - Activities in the product life cycle
INTERPRETATION SHEET 1
This interpretation sheet has been prepared by subcommittee 62A: Common aspects of medical
equipment, software, and systems, of IEC technical committee 62: Medical equipment,
software, and systems.
The text of this interpretation sheet is based on the following documents:
DISH Report on voting
62A/1692/DISH 62A/1706/RVDISH
Full information on the voting for the approval of this interpretation sheet can be found in the
report on voting indicated in the above table.
___________
This interpretation sheet is intended to clarify the following:
a) Requirements which are needed to provide essential ACCOMPANYING DOCUMENTATION to the
operators of the HEALTH SOFTWARE product regarding the transfer of risk related to software
items from the MANUFACTURER to the responsible organization or operator.
b) Requirements which are needed to maintain SECURITY of the HEALTH SOFTWARE product
Interpretation of IEC 81001-5-1:2021, Introduction, 0.2
The HEALTH SOFTWARE is part of a connected and complex healthcare ecosystem, which is
integrated into a surrounding HEALTH IT SYSTEM and HEALTH IT INFRASTRUCTURE. ISO 81001-1
provides a definition of the sociotechnical ecosystem in which the HEALTH SOFTWARE operates
in, and how to reference the security aspect of the HEALTH SOFTWARE within an IT-system inside
a broader HEALTHCARE SYSTEM.
ICS 11.040.01, 35.240.80
IEC 81001-5-1:2021-12/ISH1:2025-11(en)
IEC 81001-5-1:2021/ISH1:2025 © IEC 2025
Interpretation of IEC 81001-5-1:2021, 4.1
4.1.7 Disclosing SECURITY-related issues
NOTE 1 This activity is related to 9.3 through 9.5 where additional supporting details are provided.
NOTE 2 On a) “CVSS” and “ranking” address the rating of the severity and characteristics of security vulnerabilities.
4.1.9 ACCOMPANYING DOCUMENTATION review
NOTE For clarification, the documents mentioned with “SECURITY guidelines” are detailed in 5.8.2 and 5.8.7.
Interpretation of IEC 81001-5-1:2021, 4.3
4.3 SOFTWARE ITEM classification relating to risk transfer
NOTE 1 (foundations, intentions):
Table 1 – SOFTWARE ITEM classification mapped to affected clauses
* Implied inclusion in clause since IEC 81001-5-1:2021, Clause 3 explicitly defines SUPPORTED SOFTWARE “includes
MAINTAINED SOFTWARE” and REQUIRED SOFTWARE “includes SUPPORTED SOFTWARE”.
SOFTWARE ITEM classification related to risk transfer from 4.3 is clarified as follows:
a) The SOFTWARE ITEM classification categories are nested, but only to ensure clauses that
explicitly mention a category are also understood to include the nested categories. Table 1
above notes all clauses that detail requirements specific to a SOFTWARE ITEM classification
and notes the implicit inclusion of nested categories. Further requirements of SOFTWARE
ITEM classification that are not explicit in an associated clause are not part of this document.
b) The manufacturer shall apply risk transfer activities for all SOFTWARE ITEMS according to their
associated category. An organization’s policy and procedures may choose different terms
for these classifications if clauses citing requirements for these SOFTWARE ITEM
classifications are satisfied. Risks for all SOFTWARE ITEMS should be identified and managed
(5.2.3), updates for SOFTWARE ITEMS controlled by the manufacturer or PRODUCT user should
be communicated (6.3.1) and updates to manufacturer provided SOFTWARE ITEMS should be
made available (6.3.2) and have verifiable integrity (6.3.3). For 4.3, any declaration of
conformance, or internal policy/procedure, should state the alternative terminology
leveraged and how it maps to the sp
...
Questions, Comments and Discussion
Ask us and Technical Secretary will try to provide an answer. You can facilitate discussion about the standard in here.
Loading comments...