itSMF Switzerland - Blog #ISO200001

Medical devices and health software: a closer look to the related ISO standards

Mon, 09 Dec 2024 22:35:01 +0100

Reading time: ~ 3 min.

Medical devices and health software: data protection and security and the main related ISO standards

The growing availability of technological solutions that can be implemented in the health industry products and services brings new challenges regarding the need of compliance to high levels of protection and security of (sensitive) data.

To manage these needs of data security and protection related to medical devices and health softwares, we can consider in particular the IEC 81001-5-12021.

In the next lines, we're going to understand how this standard can be relevant and its main correlations with the European Regulations and other ISO standards.

Medical devices and health software: IEC 81001-5-1:2021 standard

The IEC 81001-5-1:2021 on «Health software and health IT systems safety, effectiveness and security – Part 5-1: Security – Activities in the product life cycle» defines the life cycle requirements in health software development and maintenance.

This standard provides a common framework for secure health software life cycle processes, thanks to its set of processes, activities and tasks. These are the main sections of the documentation:

✅ 1 Scope

✅ 2 Normative references

✅ 3 Terms and definitions

✅ 4 General requirements

✅ 5 Software development process

✅ 6 Software maintenance process

✅ 7 Security risk management process

✅ 8 Software configuration management process
✅ 9 Software problem resolution process

✅Annex A (informative) Rationale
✅Annex B (informative) Guidance on implementation of security life cycle activities
✅Annex C (informative) Threat modelling

✅Annex D (informative) Relation to practices in IEC 62443-4-1:2018
✅ Annex E (informative) Documents specified in IEC 62443-4-1

✅Annex F (normative) Transitional health software
✅ Annex G (normative) Object identifiers

The purpose of IEC 81001-5-1:2021 standard is to increase the health software cybersecurity through activities and tasks in the health software life cycle processes as well as improving security in software life cycle processes themselves.

IEC 81001-5-1 standard and the relationship with European regulation and ISO standards

If we take a closer look at the IEC 81001-5-1 standard we can detect some natural correlations with the European regulation on Medical devices, the MDR 2017/745. The correlations are detectable both on software embedded into medical devices as well as for SaMD (Software as a Medical Device).

We can find also relevant correlations with ISO/IEC 20000-1:2018 standard on «Information technology — Service management Part 1: Service management system requirements», in this case regarding the common requirements in the software developement cycle.

If we take a glimpse in the future, we can imagine that there will be stronger correlations between the management of the software cycle and the security requirements in the development of AI solutions in medical device industry.

In this case, the correlation is between IEC 81001-5-1 and the ISO/IEC 42001:2023 standard on «Information technology — Artificial intelligence — Management system».

To better figure out the «big picture», take a look at our infographic:

If you want to keep you up-to-date with the most recent news on this topic, don't forget to follow us on our social media channels or subscribe to our newsletter: every month, you'll get valuable content from our experts.

SUBSCRIBE TO OUR NEWSLETTER

Need to know more about it?

Click on one of the options below to enter in the itSMF Enviroment and for being updated the way which is best for you.

Subscribe to itSMF Newsletter

DISCOVER OUR EVENT CALENDAR

Get the benefits of Membership Program

Our sponsors

A special thanks to our Advanced Sponsors:

The EU Network & Information Security 2 (NIS 2) Directive: a GRC approach with the main related ISO standards

Wed, 22 May 2024 18:08:00 +0200

Reading time: ~ 2 min.

The EU Network & Information Security 2 Directive (NIS 2)

Our today post is focused primarily on the Directive (EU) 2022/2555, the Network and Information Security directive issued by the European Parliament and the European Council, which is knowns also as the «NIS 2».

The NIS 2 Directive is focused on measures for a high common level of cybersecurity across the Union, and especially:

amending the Regulation (EU) No. 910/2014 on electronic identification and trust services for electronic transactions in the internal market and repealing Directive 1999/93/EC;
amending the Directive (EU) 2018/1972 of the European Parliament and of the Council of 11 December 2018 establishing the European Electronic Communications Code (Recast)Text with EEA relevance;
repealing the Directive (EU) 2016/1148 of the European Parliament and of the Council of 6 July 2016 concerning measures for a high common level of security of network and information systems across the Union.

We remember that this NIS 2 Direct (date 14 December 2022) entered into force on 13th January 2023 and its implementation in national regulation must be done on 17th October 2024 at the latest.

As an European Directive, it lays down the results or goals that each Member State must achieve, however it is up to the single country to devise their own laws on how to reach these results or goals.

Where does the EU Network & Information Security 2 Directive (NIS 2) apply?

The NIS2 applies to all the sectores that the law defines «critical», such as:

📘 energy;

📘 public services;

📘 financial services;

📘 health services;

📘 telecommunications;

📘 space;

📘 public administration;

📘 ect.

The EU Network & Information Security 2 Directive (NIS 2) structure

The Directive (EU) 2022/2555 on Network & Information Security (NIS 2) is divided in the following chapters:

🔖Whereas (144)

🔖 Chapter I: general provisions

🔖Chapter II: coordinated cybersecurity frameworks

🔖Chapter III: cooperation at union and international level

🔖Chapter IV: cybersecurity risk-management measures and reporting obligations

🔖Chapter V: jurisdiction and registration

🔖Chapter VI: information sharing

🔖Chapter VII: supervision and enforcement

🔖Chapter VIII: delegated and implementing acts

🔖Annex I: sectors of high criticality
🔖Annex II: other critical sectors

How can we manage the compliance with all the requirements set by NIS 2? Our solution is a GRC Approach: let's take a closer look in the chapter below.

How to apply the NIS 2 EU Directive?

We can choose a GRC approach to apply the Directive (EU) 2022/2555 that can be based on the main ISO standards in relationship with the law.

Lets check them out:

✅ ISO 20000-1 on IT services;

✅ ISO 27001 on Information Security; on Risk Management;

✅ ISO 22301 on Business Continuity;

✅ ISO 31000 on Risk Management;

✅ ISO 27035 on Incident Management.

Our infographic on the NIS2 Directive application with our GRC approach (and the main ISO standards)

To better figure out the «big picture», take a look at our infographic:

If you want to keep you up-to-date with the most recent news on this topic, don't forget to follow our social media or subscribe on our newsletter.

Need to know more about it?

Click on one of the options below to enter in the itSMF Enviroment and for being updated the way which is best for you.

Subscribe to itSMF Newsletter

DISCOVER OUR EVENT CALENDAR

Get the benefits of Membership Program

Our sponsors

A special thanks to our Advanced Sponsors:

The EU Regulation on Digital Operational Resilience Act (DORA): GRC approach and main related standards

Wed, 24 Apr 2024 07:00:00 +0200

Reading time: ~ 2 min.

The EU Digital Operational Resilience Act (DORA)

In our post, we're going to take a closer look to the EU Regulation 2022/2554, the Digital Operational Resilience Act for the financial sector issued by the European Parliament and the European Council (known as well as «DORA»).

First of all, we should remember that the EU Regulation (date 14 December 2022) entered into force on 16 January 2023 and it applies to the EU financial service providers.

We have to know that the Digital Operational Resilience Act amended also these regulations:

📘 Regulation (EC) No. 1060/2009;

📘 Regulation (EU) No. 648/2012;

📘 Regulation (EU) No. 600/2014;

📘 Regulation (EU) No. 909/2014;

📘 Regulation (EU) No. 2016/1011.

Let's check out in the next lines which requirements have been set by the lawmakers on the new «DORA».

The Digital Operational Resilience Act: the main requirements

The EU Regulation 2022/2554 defines in particular a set of requirements which are meant to ensure digital resilience and security.

The main parts of the Digital Operational Resilience Act on these matters are in the following chapters:

🔖 1. General Provisions

🔖 2. ICT Risk Management

🔖 3. ICT Related Incident Management Process

🔖 4. Digital Operational Resilience test

🔖 5. Managing of ICT Third Party Risk

🔖 6. Information Sharing Arrangement

How can we manage the compliance with all the requirements set by DORA? Our solution is a GRC Approach: let's take a closer look in the chapter below.

How to manage the compliance with DORA requirements?

We can support the management – in an integrated way – of the requirements set by the Digital Operational Resilience Act with the GRC approach based in particular on these ISO standards:

✅ ISO 38500 on Governance;

✅ ISO 31000 on Risk Management;

✅ ISO 37301 on Compliance Management.

This GRC approach provides a useful basis for addressing and integrating too the main aspects of these reference standards:

📘 Resilience and Business Continuity (ISO 22301);

📘 Information Security (ISO 27001);

📘 ICT Services (ISO 20000-1).

Our infographic on DORA requirements and the related ISO standards

To better figure out the «big picture», take a look at our infographic:

If you want to keep you up-to-date with the most recent news on this topic, don't forget to follow our social media or subscribe on our newsletter.

Need to know more about it?

Click on one of the options below to enter in the itSMF Enviroment and for being updated the way which is best for you.

Subscribe to itSMF Newsletter

DISCOVER OUR EVENT CALENDAR

Get the benefits of Membership Program

Our sponsors

A special thanks to our Advanced Sponsors:

Système de management standard ISO 20000-1 (TIC) et approche GRC

Tue, 24 Jan 2023 13:24:39 +0100

Temps de lecture: ~ 3 min.

Système de management standard ISO 20000-1 (Gestion des services TIC) et approche GRC

Le standard ISO/IEC 20000-1:2018 «Technologies de l'information — Gestion des services — Partie 1: Exigences du système de management des services» spécifie les exigences relatives à l’adoption d'un système de management des services (SMS), avec une référence particulière aux services des technologies de l'information et de la communication (TIC).

La norme ISO 20000-1 s'applique à la fois auxOrganisations du secteur des TIC et aux Organisations n'appartenant pas au secteur des TICqui, cependant, doivent gérer leurs services TIC de manière efficace et efficiente.

En effet, même les entreprises non-TIC dépendent de plus en plus du soutien des services TIC pour fournir des produits et des services qui répondent aux besoins de leurs clients.

Il existe donc une relation de plus en plus directe entre la norme ISO 20000-1 et la norme ISO 9001 pour les systèmes de management de la qualité.

Les raisons pour lesquelles adopter un système de management des services selon ISO 20000-1

Pourquoi les Organismes adoptent-elles un système de management des services (SMS) conforme à la norme ISO 20000-1?

Dans la plupart des cas, pour poursuivre les objectifs suivants :

Assurer le respect des niveaux de service convenus avec le client, internes ou externes à l'Organisation;
Assurer le respect des exigences obligatoires applicables aux services ;
Gérer les services de manière efficace et efficiente;
Protéger et renforcer la réputation et la crédibilité de l’organisme;

Un Systeme de Management des Services ISO 20000-1: quels sont les aspects à considerer?

Pour savoir si on est en train de faire le bon choix, il y a ces aspects principaux à considérer:

Portefeuille des services (gestion des actifs et de la configuration);
Relations et accords avec les clients et les fournisseurs;
Offre et demande des services (budget et capacité);
Conception, construction et transition du service;
Résolution et satisfaction (gestion des demandes, incidents et problèmes);
Garantie des services (Noter. Cela inclut aussi les aspects de sécurité de l'information, voir la norme ISO 27001 et la continuité des activités, voir la norme ISO 22301).

Les Systèmes de Management les plus proches aux systèmes de gestion des services IT selon ISO 20000-1?

Voici ce qu'ils sont les systèmes de management les plus étroitement liés aux systèmes de gestion des services informatiques selon la norme ISO 20000-1:

systèmes de management de la qualité selon la norme ISO 9001;
systèmes de gestion de la sécurité de l'information selon la norme ISO 27001;
systèmes de gestion de la continuité des activités selon la norme ISO 22301.

L'approche GRC et les SMS selon le standard ISO 20000-1

L'adoption d'une approche GRC (Gouvernance ISO 38500, Gestion des Risques ISO 31000, Gestion de la Conformité ISO 37301) va nous aider à compléter des systèmes de management des services informatiques avec d'autres systèmes de management.

À l'aide de l'infographie suivante, on peut mieux comprendre les avantages de cette solution:

Les prochaines news de itSMF Switzerland

Vous voulez vous tenir au courant des news de itSMF Switzerland? Inscrivez-vous à notre newsletter ou connectez-vous à notre page d'entreprise sur LinkedIn.

SUIVEZ-NOUS SUR NOTRE PAGE LINKEDIN

Need to know more about it?

Click on one of the options below to enter in the itSMF Enviroment and for being updated the way which is best for you.

Subscribe to itSMF Newsletter

DISCOVER OUR EVENT CALENDAR

Get the benefits of Membership Program

Software as a Medical Device (SWaaMD) and the ISO Management Systems

Wed, 20 Jul 2022 07:00:00 +0200

Reading time: ~ 4 min.

Software as a Medical Device: a booming market

Several reports on Software as a Medical Device (SWaaMD) market highlights very interesting growth trends. If you take a look at the last one issued by Industry Research you won't be disappointed by the forecasts on 2022-28 global sales you're going to find on it.

The Global Software as a Medical Device Market Size in 2021 valuation was at 1048 million USD and according to this report it will reach 10190 million USD in 2028, with a CAGR of 38.39%.

In particular, the European SWaaMD market was about 5,430 USD million in 2019 in 2019 and it is expected to reach 24,898 UDS million in 2027, with a Compound Annual Growth Rate of 21.6% (2020-27).

If you think about the reasons why this market shows this promising growing trends you will find probably the memories of the first COVID-19 pandemic wave and the shortage of empty beds in hospital wards worldwide.

The public health systems had to strengthen their digitalization to provide therapies to patients in particular due to the overload of the healthcare infrastructure.

The European SWaaMD market and the compliance with EU regulations

Even if to someone it could seems to be useless to remember, we want to remark that ALL the medical devices you plan to sell on the EU market must be CE marked.

Moreover software can also be classified as medical devices pursuant to EU Regulation 745/2017. In this case, we usually refer to «Software as a Medical Device» (SWaaMD) as outlined by the guidelines «MDCG 2019-11: Guidance on Qualification and Classification of Software in Regulation (EU) 2017/745 - MDR and Regulation (EU) 2017/746 - IVDR».

The exact evaluation on which are the laws you have to make sure you're compliant with to market your SWaaMD in EU it is critical to grant you the access to a growing market that is also regulated with restrictive privacy regulation (GDPR) in particular with sensitive personal data (e.g. the health condition of people).

Software as a Medical Device and the ISO Management Systems

As many other digital solutions, also on the Software as a Medical Device market we find some standards that are useful to define the main references you have to follow to develop products that are going to meet the needs and the expectations of the healthcare industry.

One of the most relevant standard is the IEC 62304:2006 known as a technical international standard about «Medical device software - software life cycle processes». But let focus a little bit more on the relationships you're going to find between ISO management systems and the mandatory requirements.

The ISO management systems and mandatory requirements

If we focus in particular on the correlations between some of the most important ISO management systems and the mandatory requirements (compliance management), we can't forget to mention these ones:

IT Service ISO20000-1 about «Software life cycle»
ISO9001 and ISO13485about «Quality for SW design and development»
ISO/IEC25010:2011about «Models for SW quality»
ISO27001 about «Information security for integrity, availability and confidentiality requirements»
GDPR (as stated before) and LPD-DSG-LPD (Federal Act on Data Protection) for Switzerland, to be compliant with the privacy requirements refereed to by MDR 745/2017 itself.

To give you a better view on Software as a Medical Device, ISO Management Systems and Compliance, take a look at our infographic.

We will for sure come back on this hot topic in the next posts we are going to publish on our posts.

If you have any question for us, feel free to drop us a line on our contact page.

See you soon again with more relevant content :) and don't forget to follow us on our social media channels.

Need to know more about it?

Click on one of the options below to enter in the itSMF Enviroment and for being updated the way which is best for you.

Subscribe to itSMF Newsletter

DISCOVER OUR EVENT CALENDAR

Get the benefits of Membership Program

GRC and Data Protection: the GRC approch in EU and Swiss contexts

Wed, 04 Aug 2021 05:00:41 +0200

Reading time: ~ 2 min.

Data protection between EU and Switzerland: the GRC Data Protection approach on GDPR and LPD-DSG-LPD (FDA)

GRC and Data Protection: what about the approach in Switzerland?

We already told you about the new Federal Data Protection Act (also known as LPD) that was enacted in Switzerland in our previous post. Today we are getting back on this topic considering one big challenge for the Swiss companies: the GRC and data protection between European Union and Switzerland.

Many organizations in Switzerland will face a double challenge. They have to manage compliance with the requirements of the LPD and, at the same time, with GDPR too. This one - as known - applies also to the EU citizens personal data processing carried out outside of the EU.

Many Swiss companies have to find a solution that could be suitable for both the contexts.
How to manage compliance with the requirements of the LPD and the GDPR in an integrated way?

The adoption of a common GRC approach (Governance, Risk Management, Compliance) based on the main ISO standards can be of great help.

This can be the right choice with particular reference to the following standards:

Risk management according to ISO 31000
Privacy Impact Assesment on ISO 29134
Compliance management (ISO 37301)
Information security management system (ISO 27001)
Business continuity management system (ISO 22301)
IT Service Management System (ISO 20000-1).

Due to this high relevance for a lot of companies, we will have a special focus on topic with a dedicated class.

ITSMF and MGS will have a partnership on the next class about GRC and Data protection between EU and Switzerland.

We will held this class on 6th and 7th October: but you will get more info about during the next weeks.

Need to know more about it?

Click on one of the options below to enter in the itSMF Enviroment and for being updated the way which is best for you.

Subscribe the itSMF Newsletter

DISCOVER THE EVENT CALENDAR

Enter the itSMF Membership Program

GRC and data protection in Switzerland: structure and main requirements of the LPD

Thu, 22 Jul 2021 05:00:08 +0200

Reading time: ~ 2 min.

Data protection in Switzerland: the Swiss Federal Data Protection Act (DPA)

As is known, on September 25th, 2020, the Federal Data Protection Act (LPD) of Switzerland was enacted.
The LPD - similarly to the GDPR - has a three levels structure: you can find on it chapters, sections and single articles.
There are many clear correlations between the requirements of the Swiss LPD and the requirements of the European GDPR. These are:
The purpose and field of application.
The definition of personal data and processing.
The figures involved (data subject, data controller and data processor).
The applicable principles to the processing.
The rights of the data subject.
The privacy by design and by default.
The obligations of data controllers and processors.
The personal data protection.
The role of the data protection consultant.
The purpose and field of application.
The definition of personal data and processing.
The figures involved (data subject, data controller and data processor).
The applicable principles to the processing.
The rights of the data subject.
The privacy by design and by default.
The obligations of data controllers and processors.
The personal data protection.
The role of the data protection consultant.
How to manage the compliance with the requirements of the Swiss LPD? What is the right answer? Remember, every company has to pay attention to and comply with this act!

The adoption of a GRC (Governance, Risk Management and Compliance) approach based on the main ISO standards can be particularly useful, so we will check it on our next blog posts.

We are going to see how it is possible to execute everything in the right way in the next weeks: so please stay tuned!

Keep in mind also that we are going to take a deeper and closer look at this crucial topic on our next class by itSMF with the partnership of MGS.

This class is going to be scheduled on 6th and 7th October. We will keep you in touch shortly with some details and of course the enrollment.

Need to know more about it?

Click on one of the options below to enter in the itSMF Enviroment and for being updated the way which is best for you.

Subscribe the itSMF Newsletter

DISCOVER THE EVENT CALENDAR

Enter the itSMF Membership Program