ISO 27001 for medical devices

ISO/IEC 27001 describes a management system for information security: how a company identifies, assesses and treats risks to the confidentiality, integrity and availability of its information. Certification is carried out by accredited bodies, with a surveillance audit every year and recertification every three years. The 2022 edition with 93 controls in its annex is the relevant one; certificates under the old 2013 edition expired at the end of October 2025.

In medical technology this concerns two groups. First, software and IT service providers that handle development data, patient data or connected products for their customers — for them the certificate is often a precondition for being asked to quote at all. Second, manufacturers themselves that fall under the NIS 2 Directive or whose hospital customers demand a demonstrably secured supply chain.

It matters what the certificate does not say: it attests a company's management system, not the security of a medical device. For the cybersecurity of a device under the MDR, IEC 81001-5-1 and guidance MDCG 2019-16 are decisive. With every certificate it is also worth checking the scope — it may be limited to one site or one data centre.