← All resources Cybersecurity Standards
Cybersecurity standards that impact the medical device lifecycle
Meeting regulatory expectations means aligning with an ecosystem of international cybersecurity, software, risk management, and quality standards — not just the regulations themselves. Here's the current landscape.
| Standard | Year | Lifecycle Coverage | Primary Focus | Rationale |
|---|---|---|---|---|
| IEC 81001-5-1 | 2021 | Full lifecycle | Product cybersecurity | Foundational standard for health software and software-containing devices. |
| ANSI/AAMI SW96 | 2023 | Full lifecycle | Security risk management | Security risk management methods aligned with ISO 14971. |
| AAMI TIR57 | 2023 | Full lifecycle | Security risk management | Practical guidance linking cybersecurity to patient safety. |
| AAMI TIR97 | 2023 | Post-market | Operational cybersecurity | Covers vulnerability intake, remediation, patching, and communication. |
| ISO 14971 | 2019 | Full lifecycle | Risk management | Cybersecurity risks evaluated as hazard sources. |
| ISO/TR 24971 | 2020 | Full lifecycle | Risk management guidance | Companion guidance document explaining how to apply ISO 14971 in practice. |
| ISO/IEC 23894 | 2023 | Full lifecycle | AI risk management | Adapts ISO 31000 risk management principles to AI-specific risks — robustness, bias, algorithmic transparency, human-AI interaction — relevant for risk assessment of AI-enabled devices. |
| ISO 13485 | 2016 | Full lifecycle | Quality management system | Governs design controls, change management, and post-market processes. |
| IEC 62304 | 2006+A1:2015 | Full lifecycle | Software lifecycle | Medical-device software lifecycle processes; provides a foundation for integrating cybersecurity into software development, not itself a security standard. |
| IEC 82304-1 | 2016 | Full lifecycle | Health software safety & security | Relevant for standalone software and SaMD. |
| NIST CSF 2.0 | 2024 | Organization-wide & product | Risk-based framework | Accepted by FDA and healthcare stakeholders. |
| NIST AI RMF 1.0 | 2023 | Organization-wide & product | AI risk-based framework | Voluntary framework for managing AI risk and promoting trustworthy, responsible AI — the AI sibling to NIST CSF 2.0, relevant for AI-enabled device risk governance. |
| NIST SP 800-53 | 2020 | Full lifecycle | Security & privacy controls | Comprehensive control catalog. |
| NIST SP 800-30 | 2012 | Full lifecycle | Risk assessment | Complements ISO 14971 methodology. |
| NIST SP 800-61 | 2025 | Post-market | Incident response | Revision 3 reframes it as a CSF 2.0 community profile for incident response, superseding the original Incident Handling Guide. |
| NIST SP 800-218 (SSDF) | 2022 | Pre-market | Secure software development | Secure Software Development Framework — practices referenced by FDA guidance for aligning a Secure Product Development Framework (SPDF). |
| NIST SP 800-40 Rev. 4 | 2022 | Post-market | Patch management | Enterprise patch management planning, referenced for postmarket vulnerability remediation timelines and patching capability. |
| ISO/IEC 27001 | 2022 | Organization-wide | Information security management | Governance and secure development policies. |
| ISO/IEC 27002 | 2022 | Organization-wide | Security controls | Implementation guidance for controls. |
| ISO/IEC 27005 | 2022 | Organization-wide | Information security risk management | Companion guidance to ISO/IEC 27001 for identifying, assessing, and treating information security risks — the enterprise-ISMS counterpart to ISO 14971 for device safety risk. |
| ISO/IEC 42001 | 2023 | Organization-wide | AI management system | Certifiable AI governance framework — the AI counterpart to ISO/IEC 27001, covering how an organization manages AI risk, oversight, and lifecycle controls. |
| ISO 27799 | 2025 | Providers | Security controls | Health organization-specific guidance, based on ISO/IEC 27002. |
| ISO/IEC 29147 | 2018 | Post-market | Vulnerability disclosure | Coordinated disclosure principles. |
| ISO/IEC 30111 | 2019 | Post-market | Vulnerability handling | Operational processes for remediation. |
| ANSI/NEMA HN 1 (MDS2) | 2019 | Procurement | Security disclosure | Standardized form manufacturers complete to disclose a device's security control features to healthcare delivery organizations. |
| ANSI/AAMI/IEC TIR80001-2-2 | 2012 | Procurement | IT-network security disclosure | Guidance framework for communicating medical device security needs, risks, and controls between manufacturers and healthcare delivery organizations for IT-network risk management — complements the MDS2 disclosure form above. |
| ANSI/CAN/UL 2900-2-1 | 2023 | Full lifecycle | Product cybersecurity testing | Particular requirements for network-connectable components of healthcare and wellness systems, building on the UL 2900-1 general requirements. |
| IEC 62443-4-1 | 2018 | Pre-market | Secure product development lifecycle | Secure development lifecycle (SDL) requirements for products used in industrial automation and control systems — requirements definition, secure design, secure implementation, verification/validation, defect and patch management, and end-of-life; relevant to connected medical device components built to IACS-adjacent expectations. |
Need help mapping standards to your program?
We'll help you decide which standards matter most for your device and markets.