Information security management is becoming ever more important in the medical device industry. ISO/IEC 27001, the international standard for information security management systems (ISMS), is closely linked in practice to the EU In Vitro Diagnostic Medical Devices Regulation (IVDR). This article explains the standard and how it relates to the IVDR.
1. What is ISO/IEC 27001?
ISO/IEC 27001, published by the International Organization for Standardization (ISO) and the International Electrotechnical Commission (IEC), specifies requirements for establishing, implementing, maintaining and continually improving an information security management system. The current edition is ISO/IEC 27001:2022 (amended in 2024 to address climate change considerations).
2. Links to the IVDR
The IVDR does not reference ISO/IEC 27001 directly, but it contains information security requirements in several key areas:
- Software: Annex I, Section 16 requires devices that incorporate software, and software that is a device, to be developed and manufactured according to the state of the art, taking into account the principles of the development lifecycle, risk management, verification and validation, and information security.
- Data protection: Article 102 IVDR requires personal data to be processed in accordance with the EU General Data Protection Regulation (GDPR, Regulation (EU) 2016/679), which replaced the former Directive 95/46/EC.
- IT security: Annex I, Section 16.4 requires manufacturers to set out minimum requirements for hardware, IT network characteristics and IT security measures, including protection against unauthorised access.
Manufacturers that also want to comply with ISO/IEC 27001 can combine its framework with the IVDR provisions on software security and data protection, for example:
- using the ISO/IEC 27001 risk assessment process to support the risk management requirements of Annex I, Section 3 IVDR (alongside ISO 14971);
- using ISO/IEC 27001 access control measures to support compliance with data protection requirements.
3. ISO/IEC 27001:2022 clauses and key documents
Medical device manufacturers can voluntarily adopt an ISMS framework such as ISO/IEC 27001 as a complement to their quality management system. This helps them manage information security risks systematically and operate compliantly under the IVDR. The table below shows which clauses are typically covered by the core documents:
| Clause | Title | Key document |
|---|---|---|
| 4.1 | Understanding the organisation and its context | – |
| 4.2 | Understanding the needs and expectations of interested parties | – |
| 4.3 | Determining the scope of the ISMS | Information security policy and scope |
| 4.4 | Information security management system | Information security policy and scope |
| 5.1 | Leadership and commitment | Information security policy and scope |
| 5.2 | Policy | Information security policy and scope |
| 5.3 | Organisational roles, responsibilities and authorities | Information security policy and scope |
| 6.1.1 | Actions to address risks and opportunities – general | Information security risk assessment |
| 6.1.2 | Information security risk assessment | Information security risk assessment |
| 6.1.3 | Information security risk treatment | Information security risk assessment; information security controls |
| 6.2 | Information security objectives and planning to achieve them | – |
| 6.3 | Planning of changes | – |
| 7.1–7.4 | Resources, competence, awareness, communication | – |
| 7.5 | Documented information (general, creating and updating, control) | – |
| 8.1–8.3 | Operational planning and control, risk assessment, risk treatment | – |
| 9.1 | Monitoring, measurement, analysis and evaluation | – |
| 9.2 | Internal audit (general, programme) | – |
| 9.3 | Management review (general, inputs, results) | – |
| 10.1–10.2 | Continual improvement; nonconformity and corrective action | – |
| Annex A | Information security controls reference | Information security controls |
How EVERBIZ can help
EVERBIZ supports manufacturers in building an ISMS alongside their ISO 13485 quality system and in meeting the cybersecurity and data protection requirements of the IVDR and MDR. Contact us.
This article is for general information only and does not constitute legal advice.