Standards, Guidance & Notices
Showing 1–10 of 14
NIST
SP
SP
SP 800-218 Rev. 1
Secure Software Development Framework (SSDF) Version 1.2: Recommendations for Mitigating the Risk of Software Vulnerabilities
Few software development life cycle (SDLC) models explicitly address software security in detail, so secure software development practices usually need to be added to each SDLC model to ensure that the software being developed is well-secured. This document recommends the Secure Software Development Framework (SSDF) — a core set of high-level secure software development practices that can be integrated into each SDLC implementation. Following such practices should help software producers reduce the number of vulnerabilities in released software, reduce the potential impact of the exploitation of undetected or unaddressed vulnerabilities, and address the root causes of vulnerabilities to prevent future recurrences. Because the framework provides a common vocabulary for secure software development, software acquirers can also use it to foster communications with suppliers in acquisition processes and other management activities.
Published: 2025-12-17
ISO
ISO/TS 81001-2-1:2025
Health software and health IT systems safety, effectiveness and security — Part 2-1: Coordination — Guidance and requirements for the use of assurance cases for safety and security
Establishes requirements and guidance on assurance case framework for healthcare delivery organizations and health software manufacturers.
Published: 2025-01-01
NIST
SP
SP
SP 800-218A
Secure Software Development Practices for Generative AI and Dual-Use Foundation Models: An SSDF Community Profile
This document augments the secure software development practices and tasks defined in Secure Software Development Framework (SSDF) version 1.1 by adding practices, tasks, recommendations, considerations, notes, and informative references that are specific to AI model development throughout the software development life cycle. These additions are documented in the form of an SSDF Community Profile to support Executive Order (EO) 14110, Safe, Secure, and Trustworthy Development and Use of Artificial Intelligence, which tasked NIST with “developing a companion resource to the [SSDF] to incorporate secure development practices for generative AI and for dual-use foundation models.” This Community Profile is intended to be useful to the producers of AI models, the producers of AI systems that use those models, and the acquirers of those AI systems. This Profile should be used in conjunction with NIST Special Publication (SP) 800-218, Secure Software Development Framework (SSDF) Version 1.1:
Published: 2024-07-26
FDA
CDRH
CDRH
FDA-OTS-Software-2023
Off-The-Shelf (OTS) Software Use in Medical Devices
FDA guidance setting out the recommended documentation in premarket submissions for off-the-shelf (OTS) software incorporated into medical devices, such as operating systems, database management systems, and libraries. A practical basis for managing SOUP (Software of Unknown Provenance). It presents requirements for evaluating and documenting vendor information, known anomalies, and the support life cycle. Referenced in relation to the SOUP management requirements of IEC 62304.
Published: 2023-09-28
FDA
CDRH
CDRH
FDA-Device-Software-Functions-2023
Content of Premarket Submissions for Device Software Functions
FDA final guidance (2023) on the content of software documentation required in premarket submissions (510(k), PMA, De Novo) for SaMD and SiMD. It organizes documentation requirements by documentation level (Basic or Enhanced) and specifies what to include for software design specifications, architecture, verification and validation, and unresolved anomalies. It replaces the 2005 Guidance for the Content of Premarket Submissions for Software Contained in Medical Devices.
Published: 2023-06-14
AAMI
TIR
TIR
AAMI TIR45:2023
Guidance on the use of AGILE practices in the development of medical device software
Technical information report providing recommendations for complying with IEC 62304, FDA 21 CFR 820, and ISO 13485 when using agile practices to develop medical device software. Covers integration of cybersecurity, risk management, design validation, and human factors within an agile framework. Second edition revising TIR45:2012, approved March 2023.
Published: 2023-03-15
NIST
SP
SP
SP 800-218
Secure Software Development Framework (SSDF) Version 1.1: Recommendations for Mitigating the Risk of Software Vulnerabilities
Few software development life cycle (SDLC) models explicitly address software security in detail, so secure software development practices usually need to be added to each SDLC model to ensure that the software being developed is well-secured. This document recommends the Secure Software Development Framework (SSDF) – a core set of high-level secure software development practices that can be integrated into each SDLC implementation. Following these practices should help software producers reduce the number of vulnerabilities in released software, mitigate the potential impact of the exploitation of undetected or unaddressed vulnerabilities, and address the root causes of vulnerabilities to prevent future recurrences. Because the framework provides a common vocabulary for secure software development, software purchasers and consumers can also use it to foster communications with suppliers in acquisition processes and other management activities.
Published: 2022-02-03
ISO
ISO 81001-1:2021
Health software and health IT systems safety, effectiveness and security — Part 1: Principles and concepts
⚠ NEWER VERSION
ISO 81001-1 Ed.2 - Health Software and Health IT Systems - Safety, Effectiveness and Security - Part 1: Principles and Concepts (2026-08-05) →
Provides principles, concepts, terms and definitions for health software and health IT systems, covering safety, effectiveness and security across the full life cycle.
Published: 2021-03-01
AAMI
TIR
TIR
AAMI SW91 ED1:2018
AAMI SW91 ED1:2018
This AAMI technical information report establishes a standardized
classification system for defects identified in health software,
including software embedded in medical devices and Software as a
Medical Device (SaMD). The document defines defect categories based
on type, severity, and origin within the software development
lifecycle, enabling consistent defect tracking, root cause analysis,
and process improvement. The classification scheme supports
compliance with IEC 62304 software lifecycle requirements and FDA
quality system expectations, and is referenced in the context of
cybersecurity vulnerability management and postmarket surveillance
activities. Currently under reaffirmation review by the AAMI SM-WG08
Software Defect Classification Working Group (as of April 2025).
Published: 2018-11-02
JIS
Std
Std
JIS T 2304:2017
JIS T 2304:2017 Medical device software - Software lifecycle processes (equivalent to IEC 62304:2006+Amd.1:2015)
This JIS standard specifies software lifecycle processes for embedded software in medical devices and Software as a Medical Device (SaMD), corresponding to IEC 62304:2006+Amendment 1:2015. The document defines development and maintenance requirements according to safety classes A, B, and C, establishing a comprehensive framework for software development activities. Originally enacted in 2006, the standard was revised in 2017 to align with the 2015 amendment of the international standard. Manufacturers must comply with this standard when developing medical device software to ensure systematic control of design, development, verification, validation, and post-market activities. The lifecycle processes encompass requirements analysis, design specification, implementation, verification, and validation phases tailored to device risk classification. This standard serves as a foundational requirement under the Pharmaceutical Affairs Law (Yakuhin Kikai Hou) for medical device approval and registration in Japan.
Published: 2017-03-01