Cybersecurityfor Medical
Devices
Best practice guidelines andregulatory requirements

Cybersecurity
ISO 81001-1 defines cybersecurity as “a state whereinformation and systems are protected from unauthorized
activities, such as access, use, disclosure, disruption,modification, or destruction to a degree that the relatedrisks to confidentiality, integrity, and availability aremaintained at an acceptable level throughout the lifecycle”.

Current pitfalls
Modern medical devices benefit from improved
cybersecurity features. However, many legacy devices
still in use today, were not designed to bounce current
cybersecurity threats and to meet today’s stringent
requirements, potentially posing increased risks topatients’ safety.
Manufacturers are required to ensure that medical
devices placed on the EU and UK markets meet the newtechnology challenges related to cybersecurity risks.
This best practice guideline allows you to access thereference documentation in order to fulfill the essential
requirements for medical devices cybersecurity.

MDR and IVDR
requirements
MDR and IVDR introduced stricter safety requirements
for all medical devices incorporating electronic
programmable systems and software, now considered
medical devices themselves. The regulations require
manufacturers to develop and manufacture medical
devices in accordance with the state of the art taking
into account risk management, information security andprotection against unauthorized access.
Cybersecurity requirements are listed in Annex I of
MDR and IVDR:• Medical Device Regulation (MDR) 2017/745• In-vitro Diagnostic Regulation (IVDR) 2017/746
For additional information on the correspondence of
these requirements between the two regulations and on
cybersecurity activities to be conducted across the lifecycle of medical devices, please refer to MDCG 2019-16.
For guidance on qualification and classification of software
in MDR and IVDR, please refer to MDCG 2019-11.

Get in touch
Whether you are starting the certification process, looking
to transfer or need to discuss your options, we can guide
you through the process.

Request a quote© 2024 BSI. All rights reserved.

2

Other legislation and guidance
Several requirements generally associated withcybersecurity are not explicitly mentioned in the EU
MDR and IVDR. Given the growing level of digitalizationin healthcare, an increasing amount of national andinternational requirements and guidance relevant tothe domain of cybersecurity are being published.

EuropeNIS Directive
Provides legal measures to improve existing
cybersecurity status across the EU throughpreparedness, cooperation and security culture.
General Data Protection Regulation (GDPR)
Regulates individuals’ personal data processing in EU.
TEAM NB on Cybersecurity
Focuses on the harmonization of cybersecurity relatedStandards, risk assessment, high level penetration
test requirements, secure development life cycle andcybersecurity Post-Market Surveillance.

UKInternational

The Data Protection Act 2018 (UK GDPR)
Regulates individuals’ personal data processing inthe UK.

IMDRF Guide on Cybersecurity of medical devices

The NIS Regulation 2018 (UK)
Provides legal measures to improve the level ofsecurity of network and information system for theprovision of essential and digital services.

Complementary to IMDRF/CYBER WG/N60, thisguide promotes a globally harmonized approach
to medical devices cybersecurity. It focuses onfoundational security principles and best practices
that span the total product life cycle (TPLC) ofmedical devices.
Risks associated with cybersecurity threats andvulnerabilities should indeed be consideredthroughout all stages in the life of a medical device,from development through end of support (EOS).
To effectively manage the dynamic nature ofcybersecurity risk, risk management should beapplied throughout the TPLC where cybersecurity
risk is evaluated and mitigated in various partsof the TPLC, including but not limited to design,manufacturing, testing, and post-market
monitoring activities.

© 2024 BSI. All rights reserved.

3

BSI Assurance UK Ltd (0086)

BSI Group The Netherlands B.V. (2797)

BSI Group America Inc.

Kitemark Court,
Davy Avenue, Knowlhill,
Milton Keynes, MK5 8PP
United Kingdom

Say Building,John M. Keynesplein 91066 EP Amsterdam
The Netherlands

12950 Worldgate Drive,
Suite 800
Herndon, VA 20170
USA+44 345 080 9000

+31 20 346 0780

+1 800 862 4977

Find our services at
bsigroup.com/medical

Email us at
Read about our certification Find us on
medicaldevices@bsigroup.com
LinkedIn
services at: bsigroup.com/medical

Email us with questions at:medicaldevices@bsigroup.com

Find us on
LinkedIn© 2024rightsreserved.
reserved. Rev00.
© 2024
BSI.BSI.
All Allrights
Rev.
01 