Standards, Guidance & Notices
Showing 91–100 of 134
IEC
IEC 81001-5-1:2021
Health software and health IT systems safety, effectiveness and security — Part 5-1: Security — Activities in the product life cycle
Establishes a common framework for secure health software life cycle processes. Defines security activities and tasks to increase cybersecurity of health software.
Published: 2021-12-01
NIST
SP
SP
SP 800-213
IoT Device Cybersecurity Guidance for the Federal Government: Establishing IoT Device Cybersecurity Requirements
Organizations will increasingly use Internet of Things (IoT) devices for the mission benefits they can offer, but care must be taken in the acquisition and implementation of IoT devices. This publication contains background and recommendations to help organizations consider how an IoT device they plan to acquire can integrate into a system. IoT devices and their support for security controls are presented in the context of organizational and system risk management. This publication provides guidance on considering system security from the device perspective. This allows for the identification of device cybersecurity requirements—the abilities and actions an organization will expect from an IoT device and its manufacturer and/or third parties, respectively.
Published: 2021-11-29
NIST
SP
SP
SP 800-213A
IoT Device Cybersecurity Guidance for the Federal Government: IoT Device Cybersecurity Requirement Catalog
This publication provides a catalog of internet of things (IoT) device cybersecurity capabilities (i.e., features and functions needed from a device to support security controls) and non-technical supporting capabilities (i.e., actions and support needed from device manufacturers and other supporting entities to support security controls) that can help organizations as they use Special Publication (SP) 800-213 to determine and establish device cybersecurity requirements. This catalog cross references the capabilities in the catalog to the cybersecurity controls in NIST SP 800-53. Organizations should refer to SP 800-213 as that publication provides necessary context to effectively use this catalog and related material.
Published: 2021-11-29
EU
MDCG
MDCG
Helsinki Procedure
Helsinki Procedure for borderline and classification under MDR & IVDR
Establishes the procedure by which competent authorities (CAs) in EU Member States consult one another on complex borderline and classification questions under the MDR (2017/745) and IVDR (2017/746), producing consistent EU-wide positions published in the Manual on Borderline and Classification. Manufacturers and trade associations can request an EU-wide opinion via a CA. The initiating CA submits a standardised enquiry describing the device, its intended purpose and the classification issue; other CAs respond within about one month. If more than 75% agree, a draft Manual entry is prepared and put to a vote (adoption requires a 75% majority); where consensus is not reached, the case is escalated to CA meetings or a task force, with coordination from other MDCG working groups (e.g. the New Technologies Working Group) for technology-specific questions. The full process, from enquiry to publication, takes roughly 5.5 months. The procedure is not limited to any particular product category and can be used for unclear qualification/classification questions involving SaMD.
Published: 2021-09-01
NIST
IR
IR
IR 8259B
IoT Non-Technical Supporting Capability Core Baseline
Non-technical supporting capabilities are actions a manufacturer or third-party organization performs in support of the cybersecurity of an IoT device. This publication defines an Internet of Things (IoT) device manufacturers’ non-technical supporting capability core baseline, which is a set of non-technical supporting capabilities generally needed from manufacturers or other third parties to support common cybersecurity controls that protect an organization’s devices as well as device data, systems, and ecosystems. The purpose of this publication is to provide organizations a starting point to use in identifying the non-technical supporting capabilities needed in relation to IoT devices they will manufacture, integrate, or acquire. This publication is intended to be used in conjunction with NISTIR 8259, Foundational Cybersecurity Activities for IoT Device Manufacturers and NISTIR 8259A, IoT Device Cybersecurity Capability Core Baseline.
Published: 2021-08-25
ISO
ISO 81001-1:2021
Health software and health IT systems safety, effectiveness and security — Part 1: Principles and concepts
⚠ NEWER VERSION
ISO 81001-1 Ed.2 - Health Software and Health IT Systems - Safety, Effectiveness and Security - Part 1: Principles and Concepts (2026-08-05) →
Provides principles, concepts, terms and definitions for health software and health IT systems, covering safety, effectiveness and security across the full life cycle.
Published: 2021-03-01
NIST
SP
SP
SP 1800-24
Securing Picture Archiving and Communication System (PACS): Cybersecurity for the Healthcare Sector
Medical imaging plays an important role in diagnosing and treating patients. The system that manages medical images is known as the picture archiving communication system (PACS) and is nearly ubiquitous in healthcare environments. PACS is defined by the Food and Drug Administration (FDA) as a Class II device that “provides one or more capabilities relating to the acceptance, transfer, display, storage, and digital processing of medical images.” PACS centralizes functions surrounding medical imaging workflows and serves as an authoritative repository of medical image information.
PACS fits within a highly complex healthcare delivery organization (HDO) environment that involves interfacing with a range of interconnected systems. PACS may connect with clinical information systems and medical devices and engage with HDO-internal and affiliated health professionals. Complexity may introduce or expose opportunities that allow malicious actors to compromise the confidentiality, integrity, an
Published: 2020-12-21
NIST
IR
IR
IR 8259C
Creating a Profile Using the IoT Core Baseline and Non-Technical Baseline
The core baseline in NISTIR 8259A, IoT Device Cybersecurity Capability Core Baseline and the non-technical baseline in NISTIR 8259B, IoT Manufacturer Non-Technical Supporting Capability Core Baseline can be expanded upon based on more specific contextual information. Using source material with information pertinent to IoT device customers’ needs and goals, the central concepts of the NISTIR 8259 series can be used to guide the development of new elaboration on device cybersecurity capabilities an IoT device may need and the non-technical supporting capabilities that may be needed in relation to the IoT device. This process of expanding on the core baseline and non-technical baseline using additional contextual information is called profiling. A process by which readers of the NISTIR 8259 series can profile source documents is described in this publication.
Published: 2020-12-15
NIST
SP
SP
SP 800-53B
Control Baselines for Information Systems and Organizations
This publication provides security and privacy control baselines for the Federal Government. There are three security control baselines (one for each system impact level—low-impact, moderate-impact, and high-impact), as well as a privacy baseline that is applied to systems irrespective of impact level. In addition to the control baselines, this publication provides tailoring guidance and a set of working assumptions that help guide and inform the control selection process. Finally, this publication provides guidance on the development of overlays to facilitate control baseline customization for specific communities of interest, technologies, and environments of operation.
Published: 2020-12-10
NIST
SP
SP
SP 800-53 Rev. 5
Security and Privacy Controls for Information Systems and Organizations
This publication provides a catalog of security and privacy controls for information systems and organizations to protect organizational operations and assets, individuals, other organizations, and the Nation from a diverse set of threats and risks, including hostile attacks, human errors, natural disasters, structural failures, foreign intelligence entities, and privacy risks. The controls are flexible and customizable and implemented as part of an organization-wide process to manage risk. The controls address diverse requirements derived from mission and business needs, laws, executive orders, directives, regulations, policies, standards, and guidelines. Finally, the consolidated control catalog addresses security and privacy from a functionality perspective (i.e., the strength of functions and mechanisms provided by the controls) and from an assurance perspective (i.e., the measure of confidence in the security or privacy capability provided by the controls). Addressing functionalit
Published: 2020-12-10