IEC TR 80001-2-2:2012

Application of risk management for IT-networks incorporating medical devices - Part 2-2: Guidance for the disclosure and communication of medical device security needs, risks and controls

IEC/TR 80001-2-2:2012(E), which is a technical report, creates a framework for the disclosure of security-related capabilities and risks necessary for managing the risk in connecting medical devices to IT-networks and for the security dialog that surrounds the IEC 80001-1 risk management of IT-network connection. This security report presents an informative set of common, high-level security-related capabilities useful in understanding the user needs, the type of security controls to be considered and the risks that lead to the controls. Intended use and local factors determine which exact capabilities will be useful in the dialog about risk. The capability descriptions in this report are intended to supply health delivery organizations (HDOs), medical device manufacturers (MDMs), and IT vendors with a basis for discussing risk and their respective roles and responsibilities toward its management. This discussion among the risk partners serves as the basis for one or more responsibility agreements as specified in IEC 80001-1.

General Information

• Status: Published
• Publication Date: 09-Jul-2012
• ICS: 01 - GENERALITIES. TERMINOLOGY. STANDARDIZATION. DOCUMENTATION
• ICS: 11.040.01 - Medical equipment in general
• Technical Committee: SC 62A - Common aspects of medical equipment, software, and systems
• Drafting Committee: JWG 7 - TC 62/SC 62A/JWG 7
• Current Stage: PPUB - Publication issued
• Start Date: 30-Sep-2012
• Completion Date: 10-Jul-2012

Standards Content (Sample)

IEC/TR 80001-2-2


Edition 1.0 2012-07




TECHNICAL



REPORT









colour

inside









Application of risk management for IT-networks incorporating medical devices –

Part 2-2: Guidance for the disclosure and communication of medical device

security needs, risks and controls




































IEC/TR 80001-2-2:2012(E)

---------------------- Page: 1 ----------------------
THIS PUBLICATION IS COPYRIGHT PROTECTED
Copyright © 2012 IEC, Geneva, Switzerland

All rights reserved. Unless otherwise specified, no part of this publication may be reproduced or utilized in any form
or by any means, electronic or mechanical, including photocopying and microfilm, without permission in writing from
either IEC or IEC's member National Committee in the country of the requester.
If you have any questions about IEC copyright or have an enquiry about obtaining additional rights to this publication,
please contact the address below or your local IEC member National Committee for further information.


IEC Central Office Tel.: [phone]
3, rue de Varembé Fax: [phone]
CH-1211 Geneva 20 [e-mail]
Switzerland www.iec.ch

About the IEC
The International Electrotechnical Commission (IEC) is the leading global organization that prepares and publishes
International Standards for all electrical, electronic and related technologies.

About IEC publications
The technical content of IEC publications is kept under constant review by the IEC. Please make sure that you have the
latest edition, a corrigenda or an amendment might have been published.

Useful links:

IEC publications search - www.iec.ch/searchpub Electropedia - www.electropedia.org
The advanced search enables you to find IEC publications The world's leading online dictionary of electronic and
by a variety of criteria (reference number, text, technical electrical terms containing more than 30 000 terms and
committee,…). definitions in English and French, with equivalent terms in
It also gives information on projects, replaced and additional languages. Also known as the International
withdrawn publications. Electrotechnical Vocabulary (IEV) on-line.

IEC Just Published - webstore.iec.ch/justpublished Customer Service Centre - webstore.iec.ch/csc
Stay up to date on all new IEC publications. Just Published If you wish to give us your feedback on this publication
details all new publications released. Available on-line and or need further assistance, please contact the
also once a month by email. Customer Service Centre: [e-mail].

---------------------- Page: 2 ----------------------
IEC/TR 80001-2-2


Edition 1.0 2012-07




TECHNICAL



REPORT








colour

inside










Application of risk management for IT-networks incorporating medical devices –

Part 2-2: Guidance for the disclosure and communication of medical device

security needs, risks and controls


























INTERNATIONAL

ELECTROTECHNICAL

COMMISSION

PRICE CODE
XA


ICS 11.040.01 ISBN 978-2-83220-202-9



  Warning! Make sure that you obtained this publication from an authorized distributor.

---------------------- Page: 3 ----------------------
– 2 – TR 80001-2-2  IEC:2012(E)
CONTENTS
FOREWORD . 4
INTRODUCTION . 6
1 Scope . 7
2 Normative references . 8
3 Terms and definitions . 8
4 Use of SECURITY CAPABILITIES . 12
4.1 Structure of a SECURITY CAPABILITY entry. 12
4.2 Guidance for use of SECURITY CAPABILITIES in the RISK MANAGEMENT PROCESS . 12
4.3 Relationship of ISO 14971-based RISK MANAGEMENT to IT security RISK
MANAGEMENT . 13
5 SECURITY CAPABILITIES . 14
5.1 Automatic logoff – ALOF . 14
5.2 Audit controls – AUDT . 14
5.3 Authorization – AUTH .
...