IEC TS 81001-2-2:2025
The IEC catalogue of security capabilities for health software and medical devices (logoff, audit, authorisation, updates, de-identification, backup, emergency access, integrity, malware protection, node and person authentication, physical locks, component roadmaps, hardening, storage and transmission protection) plus connectivity, personal data, remote service, SBOM and security guide information, and how manufacturers and health delivery organisations select, communicate and risk-manage them.
IEC TS 81001-2-2:2025 is a compliance framework from International with 3 domains and 26 controls. The largest domains are Clause 5: The seventeen security capabilities – IEC TS 81001-2-2:2025 (18 controls), Clause 6: Additional supporting information for security management – IEC TS 81001-2-2:2025 (5 controls), Clause 4: How security capabilities are used, communicated and fed into risk management – IEC TS 81001-2-2:2025 (3 controls). Every control below carries what it requires and what an assessor expects to see.
Framework summaries on this platform are interpretations grounded in the published source, for educational and compliance planning purposes. They do not reproduce or replace the official standards. Refer to the authoritative source for the definitive text. Framework names and trademarks belong to their respective organisations.
Framework Domains (3)
Clause 4: How security capabilities are used, communicated and fed into risk management – IEC TS 81001-2-2:2025
| Code | Title |
|---|---|
| iec-ts-81001-2-2-2025::4.2 | Use the capabilities to communicate security properties and shared responsibility |
| iec-ts-81001-2-2-2025::4.3 | Select capabilities as risk control options from intended use and environment |
| iec-ts-81001-2-2-2025::4.4 | Run security risk management through an established risk process |
Clause 5: The seventeen security capabilities – IEC TS 81001-2-2:2025
| Code | Title |
|---|---|
| iec-ts-81001-2-2-2025::5.1 | Ship capabilities secure by default and disclose what is configurable |
| iec-ts-81001-2-2-2025::5.10 | Malware detection and protection (MLDP) |
| iec-ts-81001-2-2-2025::5.11 | Node authentication (NAUT) |
| iec-ts-81001-2-2-2025::5.12 | Person authentication (PAUT) |
| iec-ts-81001-2-2-2025::5.13 | Physical locks on product (PLOK) |
| iec-ts-81001-2-2-2025::5.14 | Third-party components in product life cycle roadmaps (RDMP) |
| iec-ts-81001-2-2-2025::5.15 | System and application hardening (SAHD) |
| iec-ts-81001-2-2-2025::5.16 | Health data storage confidentiality (STCF) |
| iec-ts-81001-2-2-2025::5.17 | Transmission confidentiality (TXCF) |
| iec-ts-81001-2-2-2025::5.18 | Transmission integrity and authenticity (TXIG) |
| iec-ts-81001-2-2-2025::5.2 | Automatic logoff (ALOF) |
| iec-ts-81001-2-2-2025::5.3 | Audit controls (AUDT) |
| iec-ts-81001-2-2-2025::5.4 | Authorization (AUTH) |
| iec-ts-81001-2-2-2025::5.5 | Cybersecurity product upgrades (CSUP) |
| iec-ts-81001-2-2-2025::5.6 | Health data de-identification (DIDT) |
| iec-ts-81001-2-2-2025::5.7 | Data backup and disaster recovery (DTBK) |
| iec-ts-81001-2-2-2025::5.8 | Emergency access (EMRG) |
| iec-ts-81001-2-2-2025::5.9 | Health data integrity and authenticity (IGAU) |
Clause 6: Additional supporting information for security management – IEC TS 81001-2-2:2025
| Code | Title |
|---|---|
| iec-ts-81001-2-2-2025::6.2 | Connectivity capabilities (CONN) |
| iec-ts-81001-2-2-2025::6.3 | Management of personally identifiable information (MPII) |
| iec-ts-81001-2-2-2025::6.4 | Remote services (RMOT) |
| iec-ts-81001-2-2-2025::6.5 | Software bill of materials (SBOM) |
| iec-ts-81001-2-2-2025::6.6 | Security guides (SGUD) |
What is IEC TS 81001-2-2:2025 and who does it apply to?
IEC TS 81001-2-2:2025 is a compliance framework from International with 3 domains and 26 controls. The IEC catalogue of security capabilities for health software and medical devices (logoff, audit, authorisation, updates, de-identification, backup, emergency access, integrity, malware protection, node and person authentication, physical locks, component roadmaps, hardening, storage and transmission protection) plus connectivity, personal data, remote service, SBOM and security guide information, and how manufacturers and health delivery organisations select, communicate and risk-manage them. It is used by organisations to establish and maintain compliance with industry standards and regulatory requirements.
What does IEC TS 81001-2-2:2025 actually require?
IEC TS 81001-2-2:2025 has 26 controls organised across 3 domains. The largest domains are Clause 5: The seventeen security capabilities – IEC TS 81001-2-2:2025 (18 controls), Clause 6: Additional supporting information for security management – IEC TS 81001-2-2:2025 (5 controls), Clause 4: How security capabilities are used, communicated and fed into risk management – IEC TS 81001-2-2:2025 (3 controls). Each control defines specific requirements that organisations must implement to achieve compliance.
If I already comply with another framework, how much of IEC TS 81001-2-2:2025 do I already cover?
IEC TS 81001-2-2:2025 does not currently have cross-framework mappings in our system. Check back as we continuously expand our mapping database.
How do I implement IEC TS 81001-2-2:2025?
Start your IEC TS 81001-2-2:2025 compliance journey by running a self-assessment on our platform to identify your current compliance posture. Our AI advisory can answer specific questions about IEC TS 81001-2-2:2025 requirements, and cross-framework mapping helps you leverage existing controls from other frameworks you may already comply with. Create a free account to access all 26 controls and track your progress.
Start Your Compliance Journey
Create a free account to run self-assessments, get AI advisory, and track your compliance progress across 1,248 frameworks.
Get Started Free →Free forever, no credit card required