Cybersecurity is now a key factor in the approval process
IEC 81001-5-1 is already considered the state of the art, and Notified Bodies as well as the FDA now reject submissions solely on the grounds of inadequate cybersecurity.
IEC 81001-5-1 MDCG 2019-16 · SBOM Secure by Design · EU & FDA
Providing Robust Evidence of Cybersecurity for Medical Device Software
We consistently integrate cybersecurity into development and quality management, ensuring that practical, regulatory-compliant processes are established throughout the product life cycle. We transform known requirements into verifiable work packages, clear responsibilities, and traceable evidence—based on risk rather than hasty activism.
10+
Years of Experience in Security and Regulatory Affairs
7+
Years of Experience in Threat Analysis
7+
Years of SBOM & Update Reviews
5+
Security & Risk Management Experts
What It's All About
Security That Remains Practical in Day-to-Day Development
Metecon integrates cybersecurity into your processes in a way that ensures security requirements remain feasible in day-to-day development and that documentation is generated in a traceable manner. We translate regulatory and normative requirements into clear work packages, responsibilities, and documentation structures—tailored to the product, risk, and maturity level—and prioritize measures with a risk-based approach across usage, architecture, maintenance, and the life cycle. In this way, cybersecurity becomes part of a consistent development and life cycle process rather than an isolated, additional task.
Intended for: Heads of Software Development / Heads of R&D and Heads of Regulatory Affairs / RA Managers, as well as executives at smaller manufacturers and Quality Management Representatives.
Typical Challenges
Three Problems That Arise Without a Consistent Cybersecurity Strategy
Reactive Measures Instead of Work Packages
Cybersecurity requirements are known, but they have not been translated into concrete, verifiable work packages. This leads to frantic, reactive action.
Silos Instead of Collaboration
Development, RA, QM, and the cybersecurity team work independently of each other. Documentation remains contradictory or incomplete.
Discontinuities Instead of Consistency
Risk, security measures, testing, and operational processes are not integrated. This leads to follow-up inquiries and additional work.
Overview of Requirements
The EU, the FDA, and the Standards Stack—Clearly Organized
The EU and the FDA have some requirements in common, but differ in certain details. We integrate both sets of requirements into a consistent documentation framework.
MDR/IVDR & MDCG 2019-16
FDA: Premarket & SBOM
Standards Stack
EU: MDR/IVDR & MDCG 2019-16
The general safety requirements (MDR/IVDR Annex I, including Section 17.2 on cybersecurity) are specified in detail by Guideline MDCG 2019-16.
The EU sets the requirements through the MDR/IVDR regulatory framework. Implementation is carried out through standards such as IEC 81001-5-1.
Annex I & MDCG 2019-16
Clearly break down the safety requirements from the MDR/IVDR to apply them to your product and incorporate them into your safety concept.
Security by Design
Cybersecurity as a design principle rather than an afterthought, throughout the entire life cycle
Notified Body
Prepare consistent evidence of information security and present it in a robust manner during discussions with the Notified Body.
Relevant Fundamentals
- MDR Annex I (including 17.2 Information Security) / IVDR Annex I (including 16.2 Information Security)
- MDCG 2019-16 (Guidance on Cybersecurity for Medical Devices)
- Harmonization of IEC 81001-5-1 with the MDR is planned and already represents the state of the art
FDA: Premarket Cybersecurity & SBOM
The FDA requires an SBOM that complies with NTIA specifications, including end-of-support information for each component, architectural views, and metrics on vulnerability response capabilities. “Cyber device” refers to all data interfaces, including USB.
SBOM According to the NTIA
Software bill of materials, including end-of-support for each item. Precise, as required by the FDA.
Architectural Views
Presenting safety-related architecture in a transparent manner—a key focus of the FDA.
Vulnerability Metrics
Measure and document responsiveness to vulnerabilities.
Relevant Fundamentals
- FDA Premarket Cybersecurity Guidance
- "cyber device", including all data interfaces
- EU vs. FDA Mapping: Identify and meet requirements once, then use them for both markets
Standards Stack: IEC 81001-5-1 & Others
IEC 81001-5-1 is the process standard for cybersecurity in the software life cycle and supplements IEC 62304/IEC 82304-1. For cybersecurity in risk management, AAMI TIR57 supplements traditional risk management according to ISO 14971 with security activities.
IEC 81001-5-1
Security activities by life cycle phase – the process standard as the backbone of the verification framework.
AAMI TIR57 & Threat Modeling
Risk management supplemented by cybersecurity.
Relevant Fundamentals
- IEC 81001-5-1 – security processes throughout the software life cycle
- IEC 62304 / IEC 82304-1 – software life cycle, medical device software, and healthcare software
- ISO 14971 + AAMI TIR57 – risk management and security risk management
- IEC/TR 60601-4-5 (referenced in IEC 62443) – security for networked medical devices and technical security requirements
- ISO/IEC 27001 – information security management at the organizational level
Metecon Service
We develop the right strategy for your product (including PMCF) and guide you from planning through implementation—ensuring regulatory compliance while minimizing the workload for your team.
Security by Design
Cybersecurity Throughout the Product Life Cycle—in Six Steps
1
Security Concept & Architecture
Define security objectives, the threat model, and the security architecture early on—during the design and development phases.
2
Security Risk Management
Conduct threat modeling and security risk assessment (AAMI TIR57).
3
Measures & Implementation
Translate security requirements into verifiable work packages and clear responsibilities.
4
Verification Through Testing of Information Security-Related Requirements, Validation Through Penetration Testing, and Traceability
The backbone of compliance: Plan security tests and penetration tests and consistently link them to requirements, risks, and releases. This ensures that it can be demonstrated at any time that every threat has been addressed and that the measures taken are effective.
5
Release & SBOM
Create a software bill of materials and consistently compile security documentation for submission (EU/FDA).
6
Post-Market: PSIRT (Product Security Incident Response Team) Ensures Clear Responsibilities and Updates
Monitor vulnerabilities, manage updates, and keep cybersecurity documentation up to date following changes.
Risk-Based Rather Than Reactive
We prioritize measures based on actual usage, architecture, and risk. This results in a practical approach to cybersecurity that effectively integrates development, changes, and regulatory requirements in a way that is manageable over the long term.
Why Metecon
Cybersecurity Expertise That Meets Industry Benchmarks
Threat Modeling & Security Risk
Documented threat model and other methods in accordance with AAMI TIR57. Provides information for risk management in accordance with ISO 14971.
SBOM & Vulnerability Management
7+ years of experience with SBOM and update reviews, including vulnerability and update management throughout the life cycle.
Security Testing & Penetration Testing
Test strategy and penetration tests are consistently linked to requirements and risks.
Audit-Ready and Embedded in the QMS
Secure development, change/configuration management, CAPA, and supplier control—all audit-ready within the QMS.
EU & FDA from a Single Source
Identify and meet requirements once, then use them for both markets. With EU-vs-FDA mapping.
Threat model documented Consistent security evidence 5+ experts in security & RM
The benchmarks are based on the strengths of leading providers—the depth of specialized knowledge from expert institutions, security specialists' expertise in SBOM and threat modeling, and testing expertise. Metecon meets these criteria and integrates them into its MDSW product documentation through end-to-end process integration.
Part of the MDSW documentation
Cybersecurity (information security) is a component of software life cycle activities. We cover medical device software (MDSW), AI regulation, and software validation on separate pages—linked here as related product documentation.
What We Specifically Offer
An Overview of Cybersecurity Services
-
GAP Analysis of Your Cybersecurity Concept
Reviewing existing cybersecurity policies and identifying gaps in compliance with MDR/IVDR, MDCG 2019-16, and IEC 81001-5-1. Includes specific recommendations for action.
-
Workshops & Training on Cybersecurity
In-house training and workshops on cybersecurity requirements and processes for development, regulatory affairs, and quality management.
-
SBOM & Penetration Testing Tools in Our Partner Network
For SBOM creation, vulnerability scans, and penetration tests, we integrate specialized tools and partners as needed. Integrated into your compliance framework.
-
Support for Audits & Certification
Preparation and coaching for cybersecurity, applicable to assessments, audits, and conformity assessment. Valid for use with Notified Bodies and the FDA.
-
Information Security for IVD Software
The same approach applies under the IVDR to software in and as an IVD.
From the Gap to Reliable Evidence
We start right where you are. With a GAP analysis, risk-based prioritization, and a clear roadmap to a consistent cybersecurity compliance framework.
Interfaces
What Cybersecurity Is Interconnected With
Risk Management →
Assess and track cybersecurity risks in a manner consistent with product risk management (ISO 14971).
Technical Documentation →
Integrate safety analyses and the safety concept into the product documentation.
Verification & Validation →
Penetration testing and verification reports with clear traceability.
QMS & Auditing →
Ensure cybersecurity at the process level and firmly establish change/configuration management, CAPA, and supplier controls in a manner that stands up to audits.
Medical Device Software → (MDSW)
Cybersecurity as part of the software life cycle. From requirements to maintenance.
AI Regulation →
AI-based systems require robust cybersecurity strategies throughout their entire life cycle.
Thorsten Stumpf
Principal Expert Software & AI · RAC Devices · Metecon GmbHAs a Principal Expert in Software & AI and as a RAC Devices specialist, Thorsten Stumpf is one of our top software experts and has an extensive network in the industry on this topic. Thorsten’s team supports manufacturers in the regulatory implementation of cybersecurity requirements for medical device software and integrates cybersecurity in a structured manner into development and risk management processes—not as an add-on, but as an integral part of the regulatory product architecture.
IEC 81001-5-1 • Threat Model & SBOM • EU & FDA"Cybersecurity rarely fails due to a lack of knowledge, but rather due to a lack of implementation: Regulatory requirements are not implemented—or are not implemented consistently—and the development, regulatory affairs, and quality management teams do not incorporate information security to the required extent. We embed information security in a risk-based manner within development and quality management: using threat models, SBOMs, and consistent evidence throughout the entire life cycle—and you avoid last-minute activism right before submission."
– Thorsten Stumpf · Principal Expert Software & AI · RAC Devices · Metecon
Frequently Asked Questions About Cybersecurity for Medical Device Software
At which point should a cybersecurity strategy be developed?
As early as possible—starting with the design and development phase, when the architecture and security concept are being developed, and no later than before submission. Only cybersecurity measures that are incorporated early on will result in a product that embodies “security by design.”
How do security requirements, risk assessment, verification, and operations fit together consistently?
Through comprehensive documentation: Derive requirements from the threat model and risk assessment, validate them through verification and penetration tests, and keep them up to date via PMS even after release.
How can you tell if an existing cybersecurity strategy meets regulatory requirements?
When a documented threat model is in place, security risks are linked to product risk management, measures derived from it have been tested and validated, and the corresponding evidence is kept up to date throughout the product’s life cycle. A lack of cybersecurity activities within the process landscape and isolated individual documents that merely highlight cybersecurity in isolation—without any impact on the product’s information security—are a warning sign.
How does the process of demonstrating cybersecurity change as the product is further developed or when a software update is released?
Every change is evaluated for its impact on cybersecurity by updating the threat model or risk analysis. This makes it possible to assess whether new vulnerabilities arise, which tests need to be repeated, and how compliance can be consistently demonstrated.
Which interfaces with ISO 14971 must be consistently documented?
Security risks must be integrated with product risk management (ISO 14971). The results of cybersecurity activities must be consistently integrated into product risk management. The measures derived from risk management must, in turn, feed back into cybersecurity activities, such as penetration tests. Risk management remains the central linchpin for medical devices. For networked products, the safety and performance of the products must be guaranteed as well at all times throughout their life cycle.
When does it make sense to seek external assistance with cybersecurity?
When requirements are known but cannot be met with in-house resources; when development, regulatory affairs, quality management, and IT security operate in silos, preventing the consistent implementation of information security; or when there are shortcomings in the documentation of cybersecurity tailored to the needs of the relevant target market. External support provides structure, documentation expertise, and a consistent approach.
Which requirements apply under the MDR and IVDR?
The basis are the safety requirements set forth in Annex I of the MDR/IVDR (including 17.2 and 16.2), as well as guideline MDCG 2019-16.
How much does cybersecurity support cost at Metecon?
The effort involved depends on the product, architecture, risk, and maturity level, as well as the target markets (EU/FDA). During a free initial consultation, we’ll assess your situation, prioritize based on risk, and then provide a robust framework.
Building a Resilient Cybersecurity Framework
Start with a free initial consultation. We prioritize based on risk, align EU and FDA requirements, and outline your security compliance framework.
Your contact:
Milan Weiß
Sales Manager
T: +49 621 123469-040
milan.weiss@metecon.de
