IEC/DIS 80001-1

Safety, effectiveness and security in the implementation and use of connected medical devices or connected health software

Titre manque

Standards Content (sample)

DRAFT INTERNATIONAL STANDARD
IEC/DIS 80001-1
ISO/TC 215 Secretariat: ANSI
Voting begins on: Voting terminates on:
2020-01-23 2020-04-16
Application of risk management for IT-networks
incorporating medical devices —
Part 1:
Roles, responsibilities and activities

Application du management du risque aux réseaux des technologies de l'information contenant les

dispositifs médicaux —
Partie 1: Rôles, responsabilités et activités
ICS: 11.040.01; 35.240.80
Member bodies are requested to consult relevant national interests in IEC/SC
62A before casting their ballot to the e-Balloting application.
THIS DOCUMENT IS A DRAFT CIRCULATED
FOR COMMENT AND APPROVAL. IT IS
THEREFORE SUBJECT TO CHANGE AND MAY
NOT BE REFERRED TO AS AN INTERNATIONAL
STANDARD UNTIL PUBLISHED AS SUCH.
IN ADDITION TO THEIR EVALUATION AS
BEING ACCEPTABLE FOR INDUSTRIAL,
This document is circulated as received from the committee secretariat.
TECHNOLOGICAL, COMMERCIAL AND
USER PURPOSES, DRAFT INTERNATIONAL
STANDARDS MAY ON OCCASION HAVE TO
BE CONSIDERED IN THE LIGHT OF THEIR
POTENTIAL TO BECOME STANDARDS TO
WHICH REFERENCE MAY BE MADE IN
Reference number
NATIONAL REGULATIONS.
IEC/DIS 80001-1:2020(E)
RECIPIENTS OF THIS DRAFT ARE INVITED
TO SUBMIT, WITH THEIR COMMENTS,
NOTIFICATION OF ANY RELEVANT PATENT
RIGHTS OF WHICH THEY ARE AWARE AND TO
PROVIDE SUPPORTING DOCUMENTATION. IEC 2020
---------------------- Page: 1 ----------------------
IEC/DIS 80001-1:2020(E)
ii © IEC 2020 – All rights reserved
---------------------- Page: 2 ----------------------
IEC/DIS 80001-1:2020(E)
1 CONTENTS

3 FOREWORD ........................................................................................................................... 4

4 INTRODUCTION ..................................................................................................................... 7

5 1 Scope .............................................................................................................................. 9

6 2 Normative references ...................................................................................................... 9

7 3 Terms and Definitions ...................................................................................................... 9

8 4 Principles ........................................................................................................................ 10

9 5 Framework ...................................................................................................................... 11

10 5.1 General ................................................................................................................. 11

11 5.2 Leadership and commitment ................................................................................. 11

12 5.3 Integrating RISK MANAGEMENT ................................................................................. 11

13 5.4 Design/planning .................................................................................................... 12

14 5.5 Implementation ..................................................................................................... 16

15 5.6 Evaluation ............................................................................................................. 16

16 5.7 Improvement ......................................................................................................... 16

17 6 Risk analysis ................................................................................................................. 17

18 6.1 Generic Requirements .......................................................................................... 17

19 6.2 Lifecycle specific requirements ............................................................................. 23

21 Annex A (informative) Mapping of IEC 80001-1 text to reorganized document (by

22 section) ......................................................................................................................... 28

23 Annex B ................................................................................................................................ 34

24 2 Foreword ....................................................................................................................... 34

25 3 Information System Categorization ................................................................................ 35

26 4 Introduction / Title .......................................................................................................... 35

27 5 Reference Documents ................................................................................................... 35

28 6 System Level Description .............................................................................................. 35

29 6.1 Environment Description ....................................................................................... 35

30 6.2 Network Ports, Protocols and Services .................................................................. 36

31 6.3 Purpose of connection to the health IT infrastructure ............................................ 36

32 6.4 Networking Requirements ..................................................................................... 36

33 6.5 Required IT-network services ................................................................................ 36

34 6.6 Data Flows and Protocols ..................................................................................... 36

35 7 Security and User Access .............................................................................................. 37

36 7.1 Malware / Antivirus / White-Listing ........................................................................ 37

37 7.2 Security exclusions ............................................................................................... 37

38 7.3 System Access ..................................................................................................... 37

39 8 Risk Management .......................................................................................................... 39

40 8.1 Hazardous situations resulting from health IT infrastructure failure ....................... 39

41 Bibliography .......................................................................................................................... 40

43 Figure 1: Lifecycle framework addressing safety, security & effectiveness of health IT

44 software and health IT systems ............................................................................................... 8

45 FIGURE 2 – RISK MANAGEMENT PROCESS ................................................................................... 13

© IEC 2019 – All rights reserved
---------------------- Page: 3 ----------------------
IEC/DIS 80001-1:2020(E)

47 Table A.1 – IEC 80001-1 requirements table ......................................................................... 28

© IEC 2019 – All rights reserved
---------------------- Page: 4 ----------------------
IEC/DIS 80001-1:2020(E)
50 INTERNATIONAL ELECTROTECHNICAL COMMISSION
51 ____________
53 SAFETY, EFFECTIVENESS AND SECURITY IN THE IMPLEMENTATION AND
54 USE OF CONNECTED MEDICAL DEVICES OR CONNECTED HEALTH
55 SOFTWARE
57 Part 1: Application of RISK MANAGEMENT
61 FOREWORD

62 1) The International Electrotechnical Commission (IEC) is a worldwide organization for standardization comprising

63 all national electrotechnical committees (IEC National Committees). The object of IEC is to promote

64 international co-operation on all questions concerning standardization in the electrical and electronic fields. To

65 this end and in addition to other activities, IEC publishes International Standards, Technical Specifications,

66 Technical Reports, Publicly Available Specifications (PAS) and Guides (hereafter referred to as “IEC

67 Publication(s)”). Their preparation is entrusted to technical committees; any IEC National Committee interested

68 in the subject dealt with may participate in this preparatory work. International, governmental and non-

69 governmental organizations liaising with the IEC also participate in this preparation. IEC collaborates closely

70 with the International Organization for Standardization (ISO) in accordance with conditions determined by

71 agreement between the two organizations.

72 2) The formal decisions or agreements of IEC on technical matters express, as nearly as possible, an international

73 consensus of opinion on the relevant subjects since each technical committee has representation from all

74 interested IEC National Committees.

75 3) IEC Publications have the form of recommendations for international use and are accepted by IEC National

76 Committees in that sense. While all reasonable efforts are made to ensure that the technical content of IEC

77 Publications is accurate, IEC cannot be held responsible for the way in which they are used or for any

78 misinterpretation by any end user.

79 4) In order to promote international uniformity, IEC National Committees undertake to apply IEC Publications

80 transparently to the maximum extent possible in their national and regional publications. Any divergence

81 between any IEC Publication and the corresponding national or regional publication shall be clearly indicated in

82 the latter.

83 5) IEC itself does not provide any attestation of conformity. Independent certification bodies provide conformity

84 assessment services and, in some areas, access to IEC marks of conformity. IEC is not responsible for any

85 services carried out by independent certification bodies.

86 6) All users should ensure that they have the latest edition of this publication.

87 7) No liability shall attach to IEC or its directors, employees, servants or agents including individual experts and

88 members of its technical committees and IEC National Committees for any personal injury, property damage or

89 other damage of any nature whatsoever, whether direct or indirect, or for costs (including legal fees) and

90 expenses arising out of the publication, use of, or reliance upon, this IEC Publication or any other IEC

91 Publications.

92 8) Attention is drawn to the Normative references cited in this publication. Use of the referenced publications is

93 indispensable for the correct application of this publication.

94 9) Attention is drawn to the possibility that some of the elements of this IEC Publication may be the subject of

95 patent rights. IEC shall not be held responsible for identifying any or all such patent rights.

96 International Standard IEC 80001-1 has been prepared by a joint working group of

97 Subcommittee 62A: Common aspects of electrical equipment used in medical practice, of IEC

98 Technical Committee 62: Electrical equipment in medical practice and ISO Technical

99 Committee 215: Health informatics.
100 It is published as a double logo standard.

101 This second edition cancels and replaces the first edition published in 2010. This edition

102 constitutes a technical revision.
© IEC 2019 – All rights reserved
---------------------- Page: 5 ----------------------
IEC/DIS 80001-1:2020(E)

103 This edition includes the following significant technical changes with respect to the previous

104 edition:
105 a) structure changed to better align with ISO 31000;

106 b) establishment of requirements and guidance for an ORGANIZATION in the application of RISK

107 MANAGEMENT;

108 communication of the value, intention and purpose of RISK MANAGEMENT through principles that

109 support preservation of the KEY PROPERTIES during the implementation and use of connected

110 HEALTH SOFTWARE and/or HEALTH IT SYSTEMS.
111 The text of this International Standard is based on the following documents:
FDIS Report on voting
XX/XX/FDIS XX/XX/RVD
112

113 Full information on the voting for the approval of this International Standard can be found in

114 the report on voting indicated in the above table.

115 This document has been drafted in accordance with the ISO/IEC Directives, Part 2.

116 In this document, the following print types are used:
117 • requirements and definitions: roman type;
118 • test specifications: italic type;

119 • informative material appearing outside of tables, such as notes, examples and references: in smaller type.

120 Normative text of tables is also in a smaller type.

121 Terms defined in Clause 3 of this document or as noted are printed in SMALL CAPITALS.

122 In referring to the structure of this document, the term

123 • “clause” means one of the five numbered divisions within the table of contents, inclusive of

124 all subdivisions (e.g. Clause 5 includes subclauses 5.1, 5.2, etc.);

125 • “subclause” means a numbered subdivision of a clause (e.g. 5.1, 5.2 and 5.3 are all

126 subclauses of Clause 5).

127 References to clauses within this document are preceded by the term “Clause” followed by the

128 clause number. References to subclauses within this particular document are by number only.

129 In this document, the conjunctive “or” is used as an “inclusive or” so a statement is true if any

130 combination of the conditions is true.

131 The verbal forms used in this document conform to usage described in ISO/IEC Directives,

132 Part 2. For the purposes of this document, the auxiliary verb:

133 • “shall” means that compliance with a requirement or a test is mandatory for compliance

134 with this document;

135 • “should” means that compliance with a requirement or a test is recommended but is not

136 mandatory for compliance with this document;

137 • “may” is used to describe permission (e.g. a permissible way to achieve compliance with a

138 requirement or test);
139 • “can” is used to describe a possibility or capability;
© IEC 2019 – All rights reserved
---------------------- Page: 6 ----------------------
IEC/DIS 80001-1:2020(E)

140 • “must” is used to express an external constraint that is not a requirement of the document;

141 and
142 • “establish” means to define, document, and implement.

143 A list of all parts of the IEC 80001 series, published under the general title Safety,

144 effectiveness and security in the implementation and use of connected health IT systems or

145 connected health software, can be found on the IEC website.

146 The committee has decided that the contents of this document will remain unchanged until the

147 stability date indicated on the IEC website under "http://webstore.iec.ch" in the data related to

148 the specific document. At this date, the document will be
149 • reconfirmed,
150 • withdrawn,
151 • replaced by a revised edition, or
152 • amended.
153

154 The National Committees are requested to note that for this document the stability date

155 is 2026.

156 THIS TEXT IS INCLUDED FOR THE INFORMATION OF THE NATIONAL COMMITTEES AND WILL BE

157 DELETED AT THE PUBLICATION STAGE.
158
© IEC 2019 – All rights reserved
---------------------- Page: 7 ----------------------
IEC/DIS 80001-1:2020(E)
159 INTRODUCTION

160 HEALTHCARE DELIVERY ORGANIZATIONS rely on safe, effective and secure systems as business-

161 critical factors. However, ineffective management of the implementation and use of connected

162 systems can threaten the ability to deliver health services.

163 Connected systems that deliver health services, generally involve multiple software

164 applications, various medical devices and complex HEALTH IT SYSTEMS that rely upon shared

165 infrastructure including wired or wireless networks, point to point connections, application

166 servers and data storage, interface engines, security and performance management software,

167 etc. These HEALTH IT INFRASTRUCTURES are often used for both clinical (e.g. patient monitoring

168 systems) and non-clinical organizational functions (e.g. accounting, scheduling, social

169 networking, multimedia, file sharing). These connected systems can involve small

170 departmental networks to large integrated infrastructures spanning multiple locations as well

171 as cloud-based services operated by third parties. The requirements and guidance in this

172 document are intended for multiple stakeholders involved in the application of RISK

173 MANAGEMENT to systems that include HEALTH IT SYSTEMS and / or HEALTH IT INFRASTRUCTURE.

174 Within the context of ISO 81001-1, this document covers the generic lifecycle phase

175 “implementation & clinical use” (see the lifecycle diagram in Figure 1).
© IEC 2019 – All rights reserved
---------------------- Page: 8 ----------------------
IEC/DIS 80001-1:2020(E)
176
177

178 Figure 1: Lifecycle framework addressing safety, security & effectiveness of health IT

179 software and health IT systems

180 This document facilitates ORGANIZATIONS in using or adapting existing work practices and

181 processes, personnel and tools wherever practicable to address the requirements of this

182 document. For example, if an organization has an existing RISK MANAGEMENT PROCESS, this can be

183 used or adapted to support the three KEY PROPERTIES of SAFETY, EFFECTIVENESS, and SECURITY.

184 Requirements are defined such that they can be evaluated and as such support an ORGANIZATION

185 in verifying and demonstrating the degree of compliance with this document.

186 The RISK MANAGEMENT requirements of this document are based upon existing concepts adapted

187 and extended for use by all stakeholders supporting implementation and clinical use of connected

188 or HEALTH SOFTWARE. This document aligns with ISO 81001-1, ISO Guide 63,
HEALTH IT SYSTEMS
189 IEC Guide 120. It also builds upon ISO 31000 and ISO 14971.
© IEC 2019 – All rights reserved
---------------------- Page: 9 ----------------------
IEC/DIS 80001-1:2020(E)
190 SAFETY, EFFECTIVENESS AND SECURITY IN THE IMPLEMENTATION AND
191 USE OF CONNECTED MEDICAL DEVICES OR CONNECTED HEALTH
192 SOFTWARE –
193
194 Part 1: Application of risk management
195 1 Scope

196 This document specifies a framework of general requirements, guidance, for ORGANIZATIONS in

197 the application of RISK MANAGEMENT before, during and after the connection of a HEALTH IT

198 SYSTEM within a HEALTH IT INFRASTRUCTURE, by addressing the KEY PROPERTIES of SAFETY,

199 EFFECTIVENESS and SECURITY whilst engaging appropriate stakeholders.
200 2 Normative references

201 ISO 81001-1 ED2, Health informatics – Health software and health IT systems safety,

202 effectiveness and security – Part 1: Foundational principles, concepts and terms.

203 3 Terms and Definitions

204 With the exception of the terms and definitions listed in this section all terms and definitions

205 used in this document are taken from ISO 81001-1 ED2.

206 ISO and IEC maintain terminological databases for use in standardization at the following

207 addresses:
208 • IEC Electropedia: available at http://www.electropedia.org/
209 • ISO Online browsing platform: available at http://www.iso.org/obp
210 3.1
211 CONSEQUENCE
212 outcome of an event affecting objectives
213 [BS ISO 31000:2018, definition 3.6]

214 Note 1 to entry: A consequence can be certain or uncertain and can have positive or negative direct or indirect

215 effects on objectives.

216 Note 2 to entry: Consequences can be expressed qualitatively or quantitatively.

217 Note 3 to entry: Any consequence can escalate through cascading and cumulative effects.

218 3.2
219 HEALTHCARE

220 care activities, services, management or supplies related to the health of an individual

221 [BS ISO 13940:2015, definition 3.1.1]

222 Note 1 to entry: This includes more than performing procedures for subjects of care. It includes, for example, the

223 management of information about patients, health status and relations within the healthcare delivery framework and

224 may also include the management of clinical knowledge.
225
226 3.3
227 INITIAL RISK

228 The RISK derived during risk estimation taking into consideration any retained RISK control

229 measures.
230 [ISO/IEC/IEEE 15026-1:2019, definition 3.3.3]
© IEC 2019 – All rights reserved
---------------------- Page: 10 ----------------------
IEC/DIS 80001-1:2020(E)
231
232 3.4
233 LIKELIHOOD
234 chance of something happening
235 [BS ISO 31000:2018, definition 3.7]

236 Note 1 to entry: In risk management terminology, the word “likelihood” is used to refer to the chance of something

237 happening, whether defined, measured or determined objectively or subjectively, qualitatively or quantitatively, and

238 described using general terms or mathematically (such as a probability or a frequency over a given time period).

239 Note 2 to entry: The English term “likelihood” does not have a direct equivalent in some languages; instead, the

240 equivalent of the term “probability” is often used. However, in English, “probability” is often narrowly interpreted as

241 a mathematical term. Therefore, in risk management terminology, “likelihood” is used with the intent that it should

242 have the same broad interpretation as the term “probability” has in many languages other than English.

243 3.5
244 PROCESS

245 set of interrelated or interacting activities which transforms inputs into outputs

246 [IEC 80001-1 2010, definition 2.19]
247 NOTE The term “activities” covers use of resources
248 3.6
249 RISK MANAGER
250 person accountable for RISK MANAGEMENT of a HEALTH IT SYSTEM.
251 [IEC 80001-1 2010, definition 2.17]
252 3.7
253 RISK MANAGEMENT PLAN

254 A description of how the elements and resources of the risk management process will be

255 implemented within an organization or project
256 [BS ISO/IEC 16085:2006, definition 3.1.1]
257
258 4 Principles

259 The following principles provide the basis for RISK MANAGEMENT. They communicate the value,

260 intention and purpose of RISK MANAGEMENT and their application supports the preservation of

261 the KEY PROPERTIES during the implementation and use of HEALTH IT SYSTEMS within a HEALTH IT

262 INFRASTRUCTURE:

263 - RISK MANAGEMENT is an integral part of an ORGANIZATION’S activities at all stages of the

264 HEALTH IT SYSTEM lifecycle;

265 - Accountability for the RISK MANAGEMENT PROCESS remains with the HEALTHCARE DELIVERY

266 ORGANIZATION;

267 - A HEALTHCARE DELIVERY ORGANIZATION may assign responsibility for RISK MANAGEMENT of the

268 HEALTH IT SYSTEM and or HEALTH IT INFRASTRUCTURE to a different ORGANIZATION such as

269 providers of HEALTH IT SYSTEMS, HEALTH IT INFRASTRUCTURE or a collaboration of

270 HEALTHCARE DELIVERY ORGANIZATIONS.
271 creates and protects value. It contributes to the demonstrable maintenance
RISK MANAGEMENT

272 or/and improvement of SAFETY, EFFECTIVENESS and SECURITY in the implementation and use of

273 connected HEALTH IT SYSTEMS;
© IEC 2019 – All rights reserved
---------------------- Page: 11 ----------------------
IEC/DIS 80001-1:2020(E)

274 - A structured and comprehensive approach to RISK MANAGEMENT contributes to consistent

275 and comparable clinical outcomes;
276 - The RISK MANAGEMENT PROCESS is scalable and can be customised and made
277 proportionate to the ORGANIZATION’S objectives;

278 - Appropriate and timely involvement of stakeholders leads to improved awareness and

279 alignment across the ORGANIZATION and enables informed RISK MANAGEMENT;

280 - RISKS can emerge, change or disappear as new HEALTHCARE tools and methodologies are

281 developed. Proactive RISK MANAGEMENT anticipates, detects, acknowledges and responds

282 to changes and events in a timely manner;

283 - The inputs to RISK MANAGEMENT are based on historical and current information, as well as

284 future expectations. RISK MANAGEMENT explicitly considers any limitations and uncertainties

285 associated with such information and expectations. Information needs to be timely, clear

286 and available to relevant stakeholders;

287 - The sOCIOTECHNICAL ECOSYSTEM significantly influences all aspects of RISK MANAGEMENT at

288 each level within the HEALTHCARE DELIVERY ORGANIZATION and at each lifecycle stage; and

289 - RISK MANAGEMENT is a continuous activity, improved through learning and experience. RISK

290 MANAGEMENT strengthens ORGANIZATION resilience and supports the ORGANIZATION’S

291 business needs and objectives.
292 NOTE 1 Risk should be balanced across the KEY PROPERTIES wherever practical.
293
294 5 Framework
295 5.1 General

296 The purpose of the RISK MANAGEMENT framework is to assist the ORGANIZATION in integrating

297 RISK MANAGEMENT with other significant activities and functions. Effective RISK MANAGEMENT

298 depends on its integration with the governance of the ORGANIZATION, including decision-

299 making. This requires support from all stakeholders, particularly TOP MANAGEMENT.

300 Requirements in this document apply to HEALTHCARE DELIVERY ORGANIZATIONS and other

301 ORGANIZATIONS seeking conformance with this RISK MANAGEMENT framework. Those

302 requirements that apply to HEALTHCARE DELIVERY ORGANIZATIONS only are clearly identified.

303 5.2 Leadership and commitment

304 It is the responsibility of the TOP MANAGEMENT of the ORGANIZATION to ensure that RISK

305 MANAGEMENT is implemented throughout the HEALTH IT SYSTEM lifecycle, and that its

306 effectiveness is evaluated.
307 The ORGANIZATION shall:
308 a) establish and adhere to a defined PROCESS for RISK MANAGEMENT
309
310 5.3 Integrating RISK MANAGEMENT

311 Effective integration of RISK MANAGEMENT relies on an understanding of the ORGANIZATION’S

312 structures and context. Structures differ depending on the ORGANIZATION’S purpose, goals and

313 complexity. RISK is managed in every part of the ORGANIZATION’S structure. Everyone in an

314 ORGANIZATION has responsibility for managing RISK.

315 Integrating RISK MANAGEMENT is a dynamic and iterative process that can be customised to the

316 ORGANIZATION’S culture and objectives. RISK MANAGEMENT should be part of, and not separate

© IEC 2019 – All rights reserved
---------------------- Page: 12 ----------------------
IEC/DIS 80001-1:2020(E)

317 from, organizational purpose, governance, leadership, commitment, strategy, objectives and

318 operations.
319
320 5.4 Design/planning

321 The safe acquisition, installation, integration, implementation, clinical use, maintenance and

322 decommissioning of a HEALTH IT SYSTEM is dependent on effective RISK MANAGEMENT planning.

323 Planning activities apply to new implementations and modifications to existing HEALTH IT

324 SYSTEMS.
© IEC 2019 – All rights reserved
---------------------- Page: 13 ----------------------
IEC/DIS 80001-1:2020(E)

325 The purpose of the HEALTH IT SYSTEM RISK MANAGEMENT PLAN is to document and schedule the

326 RISK MANAGEMENT activities throughout all lifecycle phases of the HEALTH IT SYSTEM and

327 describe how a specific HEALTH IT SYSTEM project will adhere to the RISK MANAGEMENT PLAN.

328 The RISK MANAGEMENT PROCESS which establishes the requirements of this document is

329 depicted at Figure 2 and applies throughout the lifecycle of the HEALTH IT SYSTEM.

330
331
332 FIGURE 2 – RISK MANAGEMENT PROCESS

333 The extent of the RISK MANAGEMENT plan needs to be flexible and commensurate with the scale

334 and scope of functionality of the HEALTH IT SYSTEM whilst addressing the RISK MANAGEMENT

335 requirements specified within this document. Contents of the RISK MANAGEMENT PLAN should

336 include:
337
338 - a framework for RISK ANALYSIS;
339 - defined risk acceptance criteria;
340 - a list of the relevant procedures, policies and resources required; and
341 - reference to any ACCOMPANYING DOCUMENTS
342
343 5.4.1 General
344 The ORGANIZATION shall:

345 a) establish, at the start of a project, a HEALTH IT SYSTEM RISK MANAGEMENT FILE;

346 b) maintain the RISK MANAGEMENT FILE throughout the lifecycle of the HEALTH IT SYSTEM; and

347 c) ensure that the RISK MANAGEMENT FILE is recoverable in the event of failure.

348 The HEALTH IT SYSTEM RISK MANAGEMENT FILE provides a physical or logical repository of all

349 records which relate to the RISK MANAGEMENT PROCESS and any decisions that influence RISK

© IEC 2019 – All rights reserved
---------------------- Page: 14 ----------------------
IEC/DIS 80001-1:2020(E)

350 MANAGEMENT. It has to be maintained during the HEALTH IT SYSTEM lifecycle and be

351 recoverable in the event of failure.
352 5.4.2 Understanding the ORGANIZATION and the SOCIOTECHNICAL ECOSYSTEM

353 Before starting the design and implementation of the RISK MANAGEMENT PROCESS it is important

354 to evaluate and understand the internal and external SOCIOTECHNICAL ECOSYSTEM as this will

355 significantly influence the design of the PROCESS.
356 The ORGANIZATION shall:

357 a) establish and maintain a defined list of ASSETS that interface with or constitute part of a

358 HEALTH IT SYSTEM;

359 Factors which can affect the external SOCIOTECHNICAL ECOSYSTEM include but are not limited

360 to: key drivers and trends which affect the ORGANIZATION’S objectives; contractual relationships

361 and commitments; the complexity of networks and dependencies and any local regulatory

362 frameworks.

363 Factors which can affect the internal SOCIOTECHNICAL ECOSYSTEM include but are not limited

364 to: the vision, mission and values of the ORGANIZATION; the governance, structure and

365 accountabilities of the ORGANIZATION; any guidance and standards adopted by the

366 ORGANIZATION and the ORGANIZATION’S capability and assets.
367 5.4.3 Articulating risk management commitment

368 It is the responsibility of the ORGANIZATION’S TOP MANAGEMENT to demonstrate and articulate

369 their
...