Recognized Consensus Standards: Medical Devices

Part B: Supplementary Information Sheet (SIS)

FR Recognition List Number

043

Date of Entry 06/27/2016 

FR Recognition Number

13-83

Standard

AAMI  TIR57:2016
Principles for medical device security - Risk management.

Scope/Abstract

Provides guidance on methods to perform information security risk management for a medical device in the context of the Safety Risk Management process required by ISO 14971. The TIR incorporates the expanded view of risk management from IEC 80001-1 by incorporating the same key properties of Safety, Effectiveness and Data & Systems Security with Annexes that provide process details and illustrative examples.

Extent of Recognition

Complete standard

Relevant FDA Guidance and/or Supportive Publications*

Content of Premarket Submissions for Management of Cybersecurity in Medical Devices - Guidance for Industry and Food and Drug Administration Staff, Document Issued on: October 2, 2014.

Postmarket Management of Cybersecurity in Medical Devices- Draft Guidance for Industry and Food and Drug Administration Staff, Document issued on: January 22, 2016.

NIST Special Publication 800-82, Guide to Industrial Control Systems (ICS) Security, June 2011.



Appropriate Use of Voluntary Consensus Standards in Premarket Submissions for Medical Devices - Guidance for Industry and Food and Drug Administration Staff, issued September 2018.

FDA Technical Contacts

CDRH Division of Medical Device Cybersecurity   FDA/OC/CDRH/OST/ORR   --   CyberMed@fda.hhs.gov

OPEQ Cybersecurity Team   FDA/OC/CDRH/OPEQ   --   OPEQ_Cybersecurity@fda.hhs.gov

Standards Development Organization

AAMI Association for the Advancement of Medical Instrumentation http://www.aami.org

FDA Specialty Task Group (STG)

Software/Informatics

*These are provided as examples and others may be applicable.