What is PD IEC/TR 80001-2-9 - Security and risk management for medical devices about?
PD IEC/TR 80001-2-9 outlines a process for supporting confidence in the use of the IEC 80001 series by developing security assurance cases to complement a security risk management process.
PD IEC/TR 80001-2-9 establishes a security case framework and provides guidance to health care delivery organizations and medical device manufacturers for identifying, developing, interpreting, updating and maintaining security cases for networked medical devices.
PD IEC/TR 80001-2-9 is used to fill the gap between medical device manufacturers and health care delivery organizations in providing adequate information to support the health care delivery organization's risk management of IT networks.
The intention of PD IEC/TR 80001-2-9 is to complement risk management and in turn provide a greater level of assurance for a medical device by providing evidence to support the implementation of security control, hence providing confidence in the establishment of each of the security capabilities.
Who is PD IEC/TR 80001-2-9 - Security and risk management for medical devices for?
PD IEC/TR 80001-2-9 on security and risk management for medical devices is useful for:
- Health care delivery organizations
- Medical device manufacturers
- Software developers/IT engineers
- IT-network sectors
Why should you use PD IEC/TR 80001-2-9 - Security and risk management for medical devices?
The purpose of developing the security case is to demonstrate confidence in the establishment of IEC TR 80001-2-2 security capabilities. The quality of artifacts gathered and documented during the development of the security case is agreed upon and documented as part of a responsibility agreement between the relevant stakeholders. PD IEC/TR 80001-2-9 provides you guidance for one such methodology, using a specific security pattern, to develop and interpret security cases in a systematic manner.
PD IEC/TR 80001-2-9 helps you by providing a greater level of assurance for a medical device by mapping specific risk management steps to each of the IEC TR 80001-2-2 security capabilities, identifying associated threats and vulnerabilities and presenting them in the format of a security case with the inclusion of a re-useable security pattern.
PD IEC/TR 80001-2-9 provides you guidance for the selection of appropriate security controls to establish security capabilities and presenting them as part of the security case pattern (IEC TR 80001-2-8 provides examples of such security controls).