What cybersecurity requirements apply to connected medical software?

Cybersecurity is a product characteristic

For connected medical software, an attack can not only affect confidentiality but also influence diagnosis, therapy, or availability. Therefore, cybersecurity is part of the safety and performance assessment of the medical device. MDR Annex I number 17.2 requires a development and manufacturing process according to the state of the art for software-based products, which considers the software lifecycle, risk management including information security, as well as verification and validation.

According to number 17.4, the manufacturer must define minimum requirements for hardware, IT networks, and IT security measures necessary for the intended operation. These requirements must be provided in such a way that operators can safely install, configure, and operate the product. Cybersecurity is thus a shared responsibility, but the manufacturer must not silently shift essential prerequisites onto the operator.

Secure lifecycle

MDCG 2019-16 Rev. 1 and IEC 81001-5-1:2021 lead to a risk-based process that includes:

• Security requirements and threat model for the product, interfaces, and supply chain,
• secure architecture with minimal rights, separation of critical functions, and secured default values,
• controlled third-party components and traceable software composition,
• code review, static and dynamic analyses, as well as risk-based penetration testing,
• strong authentication, authorization, encryption, and tamper-proof logging,
• signed or otherwise authenticated updates with secure rollback,
• vulnerability acceptance, assessment, coordinated disclosure, and timely remediation,
• post-market monitoring and feedback into risk files and clinical evaluation.

A component list or SBOM supports the rapid assessment of newly published vulnerabilities but does not replace threat analysis or the examination of actual accessibility and impact. A CVSS score alone does not determine the medical risk; what matters is whether and how a vulnerability in the specific product architecture can affect patient safety or essential performance.

Clearly specify operational requirements

Product information includes supported operating systems, network segmentation, ports and protocols, role model, backup and restart requirements, logging, patch process, and behavior in case of connection or integrity loss. For cloud and remote maintenance access, responsibilities, key management, and response paths must be defined.

IEC 81001-5-1:2021 describes security activities in the lifecycle of health software; ISO 81001-1:2021 classifies safety, effectiveness, and security as key properties to be balanced together. What controls are sufficient must be justified for the intended purpose, exposure, and damage potential of the specific product.