IEC TR 60601-4-5. Technical specifications of Cybersecurity applied to Health Products

Technical report 60601-4-5 provides detailed technical specifications for the security functions of medical devices used in medical IT networks.

Note: This technical report is not part of the list of requests to be a harmonized standard. However, it may be a good idea to apply it anyway.

Medical devices discussed in this document include:

• electrical medical equipment,
• medical electrical systems and
• medical device software

Note: Medical device software, although not within the scope of IEC 60601 (all chapters of this standard), can also make use of this document.

This technical report is based on the seven basic requirements described in IEC TS 62443-1-1:2009 and provides specifications for different levels of medical device capacity security.

The specified security capabilities can be used to successfully integrate the device into defined security zones and conduits of a medical IT network with an appropriate medical IT network target security level.

It is applicable to medical devices with external data interfaces used to capture sensitive data.

This technical report does not provide new validation and verification activities. It does provide the security requirements that our software medical device must have. The activities associated with these requirements were defined in regulation 81001-5-1.