The EU Medical Device Regulation (MDR) and In Vitro Diagnostic Regulation (IVDR) require manufacturers to address cybersecurity throughout the entire product lifecycle. ISO 27001, combined with the IEC 81001-5-1 standard, provides a robust framework for meeting these requirements systematically. This focused 2-hour webinar explains how to integrate information-security management principles into medical device development and post-market activities.

The course addresses both organizational security (ISO 27001:2022) and product security (IEC 81001-5-1). It walks through MDR Annex I GSPR cybersecurity requirements (17.2 and 17.4), the IVDR equivalents, MDCG 2019-16 guidance, and Notified Body expectations for cybersecurity assessment. It then shows how to apply ISO 27001:2022 controls to medical device organizations and how IEC 81001-5-1 relates to IEC 62443 for product-specific security.

Lifecycle topics include secure development lifecycle (SDL) implementation, pre-market security documentation, post-market monitoring, vulnerability and patch management, and incident response and communication. The session covers technical-file cybersecurity documentation, security risk management file structure, evidence for conformity assessment, an implementation roadmap, and case-study examples. Registration includes presentation slides, a certificate of training, and a live Q&A.

Agenda at a glance:

• Regulatory cybersecurity requirements — MDR Annex I GSPR 17.2/17.4, IVDR equivalents, MDCG 2019-16, and Notified Body expectations.
• ISO 27001:2022 framework application — ISMS structure, risk-based control selection, Annex A relevance, and QMS integration.
• IEC 81001-5-1 product security — scope, relationship to IEC 62443, security risk management, secure design, and testing.
• Lifecycle security management — SDL implementation, pre- and post-market activities, vulnerability and patch management, and incident response.
• Documentation, compliance, and practical implementation — technical-file documentation, evidence requirements, roadmap, tools, and case studies.

After this webinar, attendees will be able to answer -

• What cybersecurity does MDR/IVDR require under Annex I GSPR, and how do Notified Bodies assess it?
• How can ISO 27001:2022 organizational controls be applied to a medical device organization?
• How does IEC 81001-5-1 govern product-specific security, and how does it relate to IEC 62443?
• What does a lifecycle-based security management process look like from development through post-market?
• What cybersecurity documentation belongs in the technical file and security risk management file?
• How should post-market security monitoring, vulnerability handling, and incident response be set up?

This webinar benefits the following agencies -

The session is built around EU MDR and IVDR cybersecurity requirements and references ISO 27001:2022, IEC 81001-5-1, IEC 62443, and MDCG 2019-16. It is relevant to medical device and IVD manufacturers placing products on the EU market.

Who should attend?

This webinar benefits professionals responsible for cybersecurity and regulatory compliance of medical devices, including:

• Regulatory Affairs Managers dealing with cybersecurity requirements
• Information Security and Cybersecurity specialists
• Quality Managers responsible for MDR/IVDR compliance
• Software development and IT security professionals
• Risk management specialists