IEC TR 60601-4-5: security capabilities for medical devices, explained

Rather than inventing a new security framework for medical devices, IEC TR 60601-4-5 explicitly borrows one that already existed for industrial control systems. Its own Introduction states it "references already existing SECURITY LEVEL (SL) requirements for components of an IT-NETWORK as listed in IEC 62443-4-2:2019" and "modifies IEC 62443-4-2:2019 only for specific aspects of MEDICAL DEVICES in MEDICAL IT-NETWORKS." The "component requirements" (CRs) it specifies for medical devices are, per its own text, "mainly derived from the IT-NETWORK 'system requirements' (SRs) in IEC 62443-3-3, which are in turn derived from the overall foundational requirements defined in IEC TS 62443-1-1:2009" — with an added layer of medical-device-specific "requirement enhancements" (REs) on top.

Its normative references are narrow and specific: IEC 60601-1:2005 (plus its 2012 and 2020 amendments), the base medical electrical equipment safety standard, and IEC 62443-4-2:2019 itself.

Per Clause 1, the document "provides detailed technical specifications for SECURITY features of MEDICAL DEVICES used in MEDICAL IT-NETWORKS," covering medical electrical equipment, medical electrical systems and medical device software, and "is applicable to MEDICAL DEVICES with external data interface(s) — for example when connected to a MEDICAL IT-NETWORK or when a human interface is used for processing... CONFIDENTIAL DATA." Three explicit exclusions matter for scoping a security review:

• In-vitro diagnostic devices (IVD) are entirely out of scope.
• Industry protocols themselves — the document names DICOM and HL7 specifically — are not covered; it addresses the device's security posture, not the wire protocols it speaks.
• Non-medical-device software on a medical IT network that doesn't meet the definition of medical device software is out of scope, even if it runs on the same network.

The intended audience, per the Introduction, is medical device manufacturers and compliance authorities first, with medical IT-network integrators as a secondary audience who use a device's declared capability level to decide what additional network-level countermeasures they need to add.

Like the IEC 62443 series it borrows from, IEC TR 60601-4-5 organizes security around seven foundational requirements originally defined in IEC TS 62443-1-1:2009:

These seven requirements are what a medical device's capability security level (SL-C) is measured against. The document is careful to scope SL-C narrowly: it is "a measure of the effectiveness strength of the COUNTERMEASURES... for the addressed SECURITY property," evaluated at the device level — not the target security level (SL-T) a network operator sets for a zone of their network, nor the achieved security level (SL-A) of the network as a whole once the device is integrated. Both SL-T and SL-A are explicitly out of scope for this document; it only standardizes the device side of that equation. Countermeasures that raise a device's SL-C can be technical (firewalls, cryptography), administrative (policies and procedures) or physical (a locked cabinet, an encapsulated circuit board) — the standard treats all three as valid, not just code-level controls.

IEC 60601-1 already defines essential performance — the minimum safe behavior a device must maintain under normal and single-fault conditions. IEC TR 60601-4-5 adds a parallel, security-specific concept it calls essential function: "a function or capability that is required to maintain BASIC SAFETY, ESSENTIAL PERFORMANCE, a minimum of clinical functionality... and operational AVAILABILITY" specifically in the context of "a successful attack on the MEDICAL IT-NETWORK and its connected MEDICAL DEVICES." The practical implication: a device under active attack is allowed to lose non-essential features and still be considered compliant, as long as its essential function survives. The document names the three failure modes it's trying to prevent: loss of protection, loss of control, and loss of view.

IEC TR 60601-4-5 is a copyright-protected IEC publication, not an open document. Per the IEC's own webstore listing, the 51-page Edition 1.0 report carries a list price of CHF 335 (ISBN 978-2-8322-9227-3), with a stability date of 2028. A free preview — covering the foreword, introduction, Clause 1 scope, Clause 2 normative references and the first page or so of Clause 3's terms and definitions — is distributed through IEC's standards-preview partners and is what this guide draws its direct quotations from. The detailed normative content that would let a manufacturer actually self-score a device's SL-C — Clause 4's common security constraints, Clause 5's security-level-by-requirement table, Clause 6's technical description and Clause 7's full CR-to-SL-C mapping table, plus Annex A's worked examples and its correlation to IEC TR 80001-2-2 — sits behind the paywall. One secondary source (ISS AG, cited above) states the report is intended to help manufacturers address specific clauses of the EU Medical Device Regulation's General Safety and Performance Requirements; that specific regulatory cross-reference comes from a third-party summary, not from the portion of the standard this guide could independently verify, so treat it as a lead to confirm against the full text rather than a settled fact.