ISO/TS 11633-1:2026

• Abstract:

  This document specifies requirements and recommendations for remote maintenance services (RMSs) of medical devices and medical information systems in healthcare facilities (HCFs). This document is applicable to HCFs and remote service centres (RSCs) providing remote maintenance services for medical devices and medical information systems. This document specifies the risk assessment necessary to protect remote maintenance activities, taking into consideration the special characteristics of the healthcare field such as patient safety, regulations and privacy protections. This document provides practical examples of risk analysis to protect both the HCF and RMS provider information assets in a safe and efficient (i.e. economical) manner. These assets are primarily the information system itself and personal health data held in the information system.

• Status: Published
• Publication Date: 01-Sep-2026
• ICS: 35.240.80 - IT applications in health care technology
• Technical Committee: ISO/TC 215 - Health informatics
• Drafting Committee: ISO/TC 215/WG 4 - Security, Safety and Privacy
• Current Stage: 6060 - International Standard published
• Start Date: 02-Sep-2026
• Due Date: 20-Nov-2026
• Completion Date: 02-Sep-2026

• Revises: ISO/TS 11633-1:2019 - Health informatics — Information security management for remote maintenance of medical devices and medical information systems — Part 1: Requirements and risk analysis
• Effective Date: 02-Dec-2023

ISO/TS 11633-1:2026 is an ISO Technical Specification for information security management in remote maintenance services (RMSs) of medical devices and medical information systems. It specifies requirements and recommendations for healthcare facilities (HCFs) and remote service centres (RSCs) that carry out remote maintenance, with attention to patient safety, regulation, privacy, and the security of health information held in those systems.

What does ISO/TS 11633-1:2026 specify?

ISO/TS 11633-1:2026 specifies how RMSs for medical devices and medical information systems should be planned, assessed, protected, and managed in HCFs. It covers the shared risk picture between the HCF and the RSC, and it organizes the material into scope, terms, contents of RMSs, security requirements and risk analysis, plus three informative annexes.

The document is structured around:

• Clause 4, which describes the assumed RMS architecture and two main connection types
• Clause 5, which sets out risk analysis, operational security measures, contracts, personal information protection, and management measures
• Annex A, which gives typical RMS use cases
• Annex B, which gives examples of threats by asset
• Annex C, which shows an example approach to risk analysis

Annex	What it covers
Annex A	Typical RMS use cases and workflows
Annex B	Examples of threats by assets at RSC equipment, RSC internal network, external network, HCF internal network, and HCF maintenance target devices
Annex C	Example of how to conduct risk analysis, including site classification and a protection profile

What are the key requirements of ISO/TS 11633-1:2026?

ISO/TS 11633-1:2026 focuses on risk-based controls for remote maintenance, shared responsibility between the HCF and the RSC, and documented agreements about security. In practice, it asks both sides to identify what can go wrong, decide what must be protected, and put technical and organizational controls in place before remote maintenance starts.

Risk analysis and shared responsibility

• Clause 5.1 requires risk analysis for RMSs, including identifying threats to information assets, estimating likelihood and frequency, and assessing impact. This matters because the main security issues are not only technical - they also affect patient safety and service continuity.
• Clause 5.1 states that risk analysis should follow ISO 31000 and ISO/IEC 27005 methodology. For users, that means the analysis should be structured and traceable, not ad hoc.
• Clause 5.1 says the HCF and the RSC shall both conduct risk analysis and agree the results. In practice, one party cannot define the whole risk picture alone because remote maintenance crosses organizational boundaries.
• Annex C gives an example method for classifying the site and building a protection profile. That helps teams turn general risk ideas into a repeatable assessment for each HCF.

Security controls for RMS operation

• Clause 4 describes an assumed architecture with a target device, internal networks in the HCF and RSC, an external network between them, and equipment and services in the RSC. This tells readers where security boundaries need to be considered.
• Clause 4.2 covers RMS using one-to-one communication on a telephone network, including PSTN-based access and cellular networks. The suggested controls include caller number identification, call back, one-time password verification, and log review.
• Clause 4.3 covers RMS using Internet connections, including firewall use, anti-virus software, VPN encryption, and user authentication such as one-time passwords, multi-factor authentication, and digital certificates. In practice, this means remote access should be controlled at the network and user level.
• Clause 4.3 also notes that newer approaches such as cloud services need additional security controls. That is important for buyers and operators because the standard expects the control set to grow with the technology used.

Operation, contracts, and management

• Clause 5.2 requires security measures in RMS operation, including protection of communication routes, control of access to data, logging and audit trails, secure time synchronization such as NTP with authentication, and incident response procedures. This matters because remote work often depends on logs and time stamps to prove what happened.
• Clause 5.3 says the HCF and RSC shall have a contract that assigns responsibilities and addresses confidentiality, access, incident notification, changes to service, SLAs, dispute handling, and the HCF right to audit RMS security controls. In practice, this is the document that turns security expectations into enforceable obligations.
• Clause 5.4 requires the RMS provider to protect personal information through contract content, subcontractor oversight, regular demonstration of appropriate handling, and action when problems arise. That is especially relevant where remote work touches personal health data.
• Clause 5.5 requires both sides to establish and maintain an information security management system (ISMS) and to align their security policies. This means RMS security is not only about tools - it also depends on governance, policy consistency, and defined minimum security requirements.

What terms does ISO/TS 11633-1:2026 define?

ISO/TS 11633-1:2026 defines the core vocabulary needed to discuss RMS security in a consistent way. The most important terms are:

• Asset - anything of value to the organization, including health information, technical information, hardware, software, services, and medical devices that record or report data.
• Availability - the property of being accessible and usable when an authorized entity needs it.
• Confidentiality - the property that information is not disclosed to unauthorized individuals, entities, or processes.
• Information security - the preservation of confidentiality, integrity, and availability of information.
• Risk - the effect of uncertainty on objectives, usually expressed through sources, events, consequences, and likelihood.
• Risk analysis - the process of understanding risk and determining its level, which supports risk evaluation and treatment decisions.
• Risk assessment - the overall process of risk identification, risk analysis, and risk evaluation.
• Threat - a potential cause of an unwanted incident that can harm a system or organization.

Who uses ISO/TS 11633-1:2026?

ISO/TS 11633-1:2026 is used by HCFs, RSCs, medical device vendors, healthcare IT teams, and security or quality managers who set up or review remote maintenance services. It is also relevant to buyers and contract managers who need to define security obligations, service levels, and audit rights before remote access is allowed.

In practice, users apply it when they:

• assess whether a remote maintenance arrangement is acceptable
• choose controls for telephone-based or Internet-based remote access
• define logging, authentication, encryption, and incident response measures
• write contracts and SLAs for remote maintenance
• protect personal health information and other sensitive data
• build an ISMS for remote maintenance activities

What changed in ISO/TS 11633-1:2026 from the previous edition?

ISO/TS 11633-1:2026 is the second edition and it cancels and replaces ISO/TS 11633-1:2019. The foreword states that it has been technically revised, with the main changes being a complete revision to match the latest editions of ISO/IEC 27001 and ISO/IEC 27002, a revised clause structure, and an updated Clause 3 and Bibliography.

Which standards are used with ISO/TS 11633-1:2026?

ISO/TS 11633-1:2026 has no normative references in Clause 2, but it does point readers to several related standards and companion documents. Clause 5.1 links risk analysis to ISO 31000 and ISO/IEC 27005, while Clause 5.5 calls for an ISMS in accordance with ISO/IEC 27001.

The terminology and background references also draw on:

• ISO/IEC 27000 for information security vocabulary
• ISO 31073 for risk management vocabulary
• ISO 13131 for risk assessment terminology
• ISO/IEC 21827 for the definition of asset
• ISO/IEC 27002, named in the foreword as part of the technical revision basis
• ISO/TR 11633-2, which the Introduction cites for implementation examples and the Bibliography lists as the companion part

What does the ISO/TS 11633-1:2026 document contain?

ISO/TS 11633-1:2026 contains a model RMS architecture, two connection models, and a set of security features to consider for each. It also includes a risk analysis framework and a contract-oriented management section that can be used in real RMS arrangements.

Annex A provides four typical use cases - troubleshooting outages, scheduled maintenance, software updating, and performance monitoring - each with a workflow. Annex B gives threat examples by asset and site, using confidentiality, integrity, and availability classifications. Annex C shows how to carry out risk analysis by classifying the site and building a protection profile.

Technical
Specification
ISO/TS 11633-1
Second edition
Health informatics — Information
2026-09
security management for remote
maintenance of medical devices and
medical information systems —
Part 1:
Requirements and risk analysis
Informatique de santé — Management de la sécurité de
l'information pour la maintenance à distance des dispositifs
médicaux et des systèmes d'information médicale —
Partie 1: Exigences et analyse du risque
Reference number
© ISO 2026
All rights reserved. Unless otherwise specified, or required in the context of its implementation, no part of this publication may
be reproduced or utilized otherwise in any form or by any means, electronic or mechanical, including photocopying, or posting on
the internet or an intranet, without prior written permission. Permission can be requested from either ISO at the address below
or ISO’s member body in the country of the requester.
ISO copyright office
CP 401 • Ch. de Blandonnet 8
CH-1214 Vernier, Geneva
Phone: [phone]
Email: [e-mail]
Website: www.iso.org
Published in Switzerland
ii
Contents Page
Foreword .iv
Introduction .v
1 Scope . 1
2 Normative references . 1
3 Terms, definitions and abbreviated terms . 1
3.1 Terms and definitions .1
3.2 Abbreviated terms .3
4 Contents of RMS of medical devices and medical information systems . 3
4.1 Assumed RMS architecture .3
4.2 RMS using one to one communication on telephone network .4
4.2.1 One to one communication on telephone network features.4
4.2.2 Security features for one to one communication on telephone network .4
4.3 RMS using the Internet connections .5
4.3.1 Internet connections features .5
4.3.2 Security features for internet connections.5
5 Security requirement and risk analysis of RMS of medical devices and medical
information systems . 5
5.1 Risk analysis .5
5.2 Security measures in RMS operation .6
5.3 Contracts involving HCF, RSC, and necessary third parties .6
5.4 Protection of personal information .6
5.5 Management measures .7
Annex A (informative) Use cases of RMSs . 8
Annex B (informative) Examples of threats by assets of remote maintenance services .13
Annex C (informative) Example of how to conduct risk analysis .18
Bibliography . 19

iii
Foreword
ISO (the International Organization for Standardization) is a worldwide federation of national standards
bodies (ISO member bodies). The work of preparing International Standards is normally carried out through
ISO technical committees. Each member body interested in a subject for which a technical committee
has been established has the right to be represented on that committee. International organizations,
governmental and non-governmental, in liaison with ISO, also take part in the work. ISO collaborates closely
with the International Electrotechnical Commission (IEC) on all matters of electrotechnical standardization.
The procedures used to develop this document and those intended for its further maintenance are described
in the ISO/IEC Directives, Part 1. In particular, the different approval criteria needed for the different types
of ISO documents should be noted. This document was drafted in accordance with the editorial rules of the
ISO/IEC Directives, Part 2 (see www.iso.org/directives).
ISO draws attention to the possibility that the implementation of this document may involve the use of (a)
patent(s). ISO takes no position concerning the evidence, validity or applicability of any claimed patent
rights in respect thereof. As of the date of publication of this document, ISO had not received notice of (a)
patent(s) which may be required to implement this document. However, implementers are cautioned that
this may not represent the latest information, which may be obtained from the patent database available at
www.iso.org/patents. ISO shall not be held responsible for identifying any or all such patent rights.
Any trade name used in this document is information given for the convenience of users and does not
constitute an endorsement.
For an explanation of the voluntary nature of standards, the meaning of ISO specific terms and expressions
related to conformity assessment, as well as information about ISO’s adherence to the World Trade
Organization (WTO) principles in the Technical Barriers to Trade (TBT), see www.iso.org/iso/foreword.html.
This document was prepared by Technical Committee ISO/TC 215, Health informatics.
This second edition cancels and replaces the first edition (ISO/TS 11633-1:2019), which has been technically
revised.
The main changes are as follows:
— complete revision to correspond to the latest editions of ISO/IEC 27001 and ISO/IEC 27002;
— revision of the clause structure;
— update of Clause 3 and the Bibliography.
A list of all parts in the ISO 11633 series can be found on the ISO website.
Any feedback or questions on this document should be directed to the user’s national standards body. A
complete listing of these bodies can be found at www.iso.org/members.html.

iv
Introduction
Advancement of information and communications technology (ICT) has changed how networks are
used in society. Similarly, in healthcare, information systems which were once closed in each healthcare
facility (HCF) are now connected to the outside by networks and are progressing to the point of being
able to facilitate sharing and exchange of health information accumulated in these information systems.
Such information and communication networks are spreading not only in between HCFs but also between
HCFs and vendors of medical devices and healthcare information systems. Maintenance of such systems
is paramount to keeping them up-to-date. By practicing remote maintenance services (RMS), it becomes
possible to reduce down-time and lower costs for this maintenance activity.
While there are benefits to remote maintenance, such remote connections with external organizations also
expose HCFs and vendors to risks regarding confidentiality, integrity and availability of information and
systems, risks which previously received scant consideration.
Although normal remote maintenance is generally done on a contract basis, in the case of medical devices,
risk assessment is commonly a legal prerequisite. Therefore, it is necessary to implement appropriate risk
assessment where remote maintenance is provided in any healthcare context. The risk assessment examples
provided in ISO/TR 11633-2 provide support for HCFs and RMS providers to implement risk assessment
effectively.
By implementing the risk assessment process and employing controls referencing ISO/TR 11633-2, HCFs
owners and RMS providers will be able to obtain the following benefits:
— Risk assessment can result in improved efficiency. If the risk assessment document created through the
use of ISO/TR 11633-2 does not fully conform to ISO/IEC 27001, it can be used in part in a risk assessment
of an incompatible area, thus reducing the risk assessment effort required.
— Documented validity of the RMS security countermeasures in place will be available to third parties.
If providing RMS to two or more sites, the provider can apply countermeasures consistently and effectively.

v
Technical Specification ISO/TS 11633-1:2026(en)
Health informatics — Information security management
for remote maintenance of medical devices and medical
information systems —
Part 1:
Requirements and risk analysis
1 Scope
This document specifies requirements and recommendations for remote maintenance services (RMSs) of
medical devices and medical information systems in healthcare facilities (HCFs). This document is applicable
to HCFs and remote service centres (RSCs) providing remote maintenance services for medical devices and
medical information systems.
This document specifies the risk assessment necessary to protect remote maintenance activities, taking
into consideration the special characteristics of the healthcare field such as patient safety, regulations and
privacy protections.
This document provides practical examples of risk analysis to protect both the HCF and RMS provider
information assets in a safe and efficient (i.e. economical) manner. These assets are primarily the information
system itself and personal health data held in the information system.
2 Normative references
There are no normative references in this document.
3 Terms, definitions and abbreviated terms
For the purposes of this document, the following terms and definitions apply.
ISO and IEC maintain terminology databases for use in standardization at the following addresses:
— ISO Online browsing platform: available at https:// www .iso .org/ obp
— IEC Electropedia: available at https:// www .electropedia .org/
3.1 Terms and definitions
3.1.1
asset
anything that has value to the organization
Note 1 to entry: In the context of health information security (3.1.4), information assets include:
a) health information;
b) technical information (credentials, passwords, calibration data, etc.);
c) non-health information (e.g. financials, administrative, legal, human resources);
d) IT services;
e) hardware;
f) software;
g) communications facilities;
h) media;
i) IT facilities;
j) medical devices that record or report data.
[SOURCE: ISO/IEC 21827:2008, 3.4, modified — Note 1 to entry was added.]
3.1.2
availability
property of being accessible and usable upon demand by an authorized entity
[SOURCE: ISO/IEC 27000:2018, 3.7]
3.1.3
confidentiality
property that information is not made available or disclosed to unauthorized individuals, entities, or
processes
[SOURCE: ISO/IEC 21827:2008, 3.13]
3.1.4
information security
preservation of confidentiality (3.1.3), integrity and availability (3.1.2) of information
Note 1 to entry: In addition, other properties, such as authenticity, accountability, non-repudiation, and reliability can
also be involved.
Note 2 to entry: Other properties, particularly accountability of users, but also authenticity, non-repudiation, and
reliability are often mentioned as aspects of information security but could be considered as derived from the three
core properties in the definition.
[SOURCE: ISO/IEC 27000:2018, 3.28, modified — Note 2 to entry was added.]
3.1.5
risk
effect of uncertainty on objectives
Note 1 to entry: An effect is a deviation from the expected. It can be positive, negative or both, and can address, create
or result in opportunities and threats (3.1.8).
Note 2 to entry: Objectives can have different aspects and categories, and can be applied at different levels.
Note 3 to entry: Risk is usually expressed in terms of risk sources, potential events, their consequences and their
likelihood.
[SOURCE: ISO 31000:2018, 3.1]
3.1.6
risk analysis
process to comprehend the nature of risk (3.1.5) and to determine the level of risk
Note 1 to entry: Risk analysis provides the basis for risk evaluation and decisions about risk treatment.
Note 2 to entry: Risk analysis includes risk estimation.
[SOURCE: ISO 31073:2022, 3.3.15, modified — Note 2 to entry was added.]

3.1.7
risk assessment
overall process of risk identification, risk analysis (3.1.6), and risk evaluation
[SOURCE: ISO 13131:2021, 3.4.13, modified — Note 1 to entry was removed.]
3.1.8
threat
potential cause of an unwanted incident, which can result in harm to a system or organization
3.2 Abbreviated terms
HCF healthcare facility
ISMS information security management system
ISP internet service provider
NTP network time protocol
PHI protected health information
PSTN public switched telephone network
RSC remote service centre
RMS remote maintenance service
VPN virtual private network
4 Contents of RMS of medical devices and medical information systems
4.1 Assumed RMS architecture
The following architectural configuration is assumed in this document (Figure 1):
— target device;
— internal network within a HCF;
— external network connecting a HCF and RSC;
— internal network within a RSC;
— equipment and services in the RSC.

Figure 1 — Assumed RMS architecture
This document introduces potential types of RMSs and provides options for appropriate security controls to
be considered during the risk analysis phase.
Use cases of RMSs are provided in Annex A.
The types of RMS and technical security measures related to each type are specified in 4.2 and 4.3.
4.2 RMS using one to one communication on telephone network
4.2.1 One to one communication on telephone network features
In the past, dial-up server functions typically used public switched telephone network (PSTN) with a modem.
More recently, cellular networks such as 3G, 4G, and 5G have become more commonly utilized.
Telephone network and telecommunication lines have the following features:
— one to one communication pathway between a HCF and the RSC which can be secured;
— tapping of the communication line is difficult because a PSTN is fully digitalized.
4.2.2 Security features for one to one communication on telephone network
The following security features should be applied as appropriate:
— use of caller number identification and call back function;
— user verification such as one-time password;
— review and audits of communication logs to identify illegal access.

4.3 RMS using the Internet connections
4.3.1 Internet connections features
Internet connections have the following features:
— worldwide accessibility: enabling access to devices worldwide, transcending national and regional
boundaries;
— multimedia: supporting a variety of formats, including text, images, audio, and video;
— economical: enabling the transmission of large volumes of information at low cost compared to traditional
communication methods.
4.3.2 Security features for internet connections
The following security features should be used as appropriate:
— use of suitable firewall;
— deployment of anti-virus software;
— use of virtual private network (VPN) for encryption of communication path;
— application of user authentication methods such as one-time passwords, multi-factor authentication and
digital certificates
The use of the latest technologies for RMS, such as cloud services, should require the implementation of
additional security controls.
5 Security requirement and risk analysis of RMS of medical devices and medical
information systems
5.1 Risk analysis
A typical risk assessment involves the following:
— identifying threats to information assets;
— estimating likelihood and frequency;
— assessing impact if threats occur.
Risk analysis should follow ISO 31000 and ISO/IEC 27005 methodology.
In addition to the above, because RMS is an operation that spans two different organizations, HCF and RSC,
risk analysis shall also be conducted by both parties and the results shall be agreed upon.
This document models typical use cases assumed for RMSs in Annex A and provides an example risk
assessment for the model. Using the results of this risk assessment makes it possible to perform risk analysis
using a baseline approach or a combination approach.
Examples of threats by assets of RMSs are provided in Annex B and an example of how to conduct risk
analysis in Annex C.
Examples of risk analysis are shown in ISO/TR 11633-2.

5.2 Security measures in RMS operation
When setting up RMS operations, the following points shall be considered:
— identification and security issues regarding data accessible by the RSC operator;
— implementation of controls to prevent unauthorised access to the system and data;
— protection of communication routes;
— security management for RSC devices;
— identification and use of third parties in the service provision by RMS;
— monitoring unauthorized access and operations through logs and audit trails, and regular audits;
— ensuring secure time synchroniza
...