Build IEC 60601-4-5 security evidence for connected medical devices

IEC TR 60601-4-5:2021 is an IEC Technical Report titled 'Medical electrical equipment, Part 4-5: Guidance and interpretation, Safety-related technical security specifications'. It gives detailed security specifications for medical devices used on medical IT networks, based on IEC 62443-4-2:2019, and lets manufacturers state a capability security level (SL-C) for their device across the seven IEC 62443 foundational requirements.

No. IEC TR 60601-4-5 is a Technical Report, which is informative guidance rather than an International Standard, so it is not mandatory and you cannot be certified against it. Manufacturers use it voluntarily to design and document device security capabilities, and regulators or hospital customers may refer to it when judging whether a connected medical device has appropriate security features.

Manufacturers of medical electrical equipment, manufacturer-supplied ME systems and medical device software that has an external data interface or a human interface handling confidential data are the main audience. Medical IT network integrators also use the declared SL-C to plan secure integration, and compliance authorities may use it during reviews. It does not apply to in-vitro diagnostic devices.

IEC TR 60601-4-5 is built directly on IEC 62443. It references the component requirements and requirement enhancements in IEC 62443-4-2:2019 and modifies only those aspects specific to medical devices. It uses the seven foundational requirements from IEC TS 62443-1-1: identification and authentication control, use control, system integrity, data confidentiality, restricted data flow, timely response to events and resource availability.

A capability security level (SL-C) describes how strong the security countermeasures of a device are for each foundational requirement. Under IEC TR 60601-4-5, the combination of component requirements and requirement enhancements a medical device implements determines its SL-C. Hospitals then compare this against the target security level (SL-T) of the network zone where the device will sit.

They work at different levels. ISO 27001 certifies an organisation's information security management system, while IEC TR 60601-4-5 specifies technical security capabilities of a medical device product. Many manufacturers run both: ISO 27001 controls such as access management, configuration management and supplier security support the processes that produce secure devices and their documentation.

IEC TR 60601-4-5 is mapped in OneClickComply's control library and is available on request rather than as a live framework today. Once enabled, you can link its constraints to controls you already operate, collect organisational evidence automatically and get guidance from our in-house auditors. Product-level security testing and SL-C claims remain your responsibility as manufacturer.