Technical Information Report AAMI TIR57: 2016 Principles for medical device security—Risk management AAMI Advancing Safety in Healthcare Technology AAMI TIR57:2016 AAMl Technical Information Report Principles for medical device securityRisk management Approved 5 June 2016 by Association for the Advancement of Medical Instrumentation Abstract: Provides guidance on methods to perform information security risk management for a medical device in the context of the Safety Risk Management process required by ISO 14971. The TIR incorporates the expanded view of risk management from IEC 80001-1 by incorporating the same key properties of Safety, Effectiveness and Data & Systems Security with Annexes that provide process details and illustrative examples Keywords: medical device, information security, risk management AAMl Technical Information Report A technical information report (TIR) is a publication of the Association for the Advancement of Medical Instrumentation (AAMl) Standards Board that addresses a particular aspect of medical technology. Although the material presented in a TIR may need further evaluation by experts, releasing the information is valuable because the industry and the professions have an immediate need for it. A TiR differs markedly from a standard or recommended practice, and readers should understand the differences betweenthesedocuments. Standards and recommended practices are subject to a formal process of committee approval, public review, and of American National Standards, by the American National Standards Institute. A TIR is not subject to the same formal approval process as a standard. However, a TIR is approved for distribution by a technical committee and the AAMI Standards Board. Another difference is that, although both standards and TiRs are periodically reviewed, a standard must be acted -reaffirmed, revised, or withdrawn 10 years. For a TIR, AAMl consults with a technical committee about five years after the publication date (and periodically thereafter) for guidance on whether the document is stll useful-that is, to check that the information is relevant or of historical value. If the information is not useful, the TiR is removed from circulation A TiR may be developed because it is more responsive to underlying safety or performance issues than a standard or recommended practice, or because achieving consensus is extremely difficult or unlikely. Unlike a standard, a TiR permits the inclusion of differing viewpoints on technical issues. CAUTION NOTICE: This AAMI TIR may be revised or withdrawn at any time. Because it addresses a rapidly more recent than this document. All standards, recommended practices, technical information reports, and other types of technical documents developed by AAMl are voluntary, and their application is solely within the discretion and professional judgment of the or procurement authorities, in which case the adopting agency is responsible for enforcement of its rules and regulations. 4301 N. Fairfax Drive, Suite 301, Arlington, VA 22203-1633. Published by Association for the Advancement of Medical Instrumentation 4301 N Fairfax Drive, Suite 301 Arlington, VA22203-1633 @ 2016 by the Association for the Advancement of Medical Instrumentation All Rights Reserved This publication is subject to copyright claims of AAMl. Publication, reproduction, photocopying, storage, or transmission, electronically or otherwise, of all or any part of this document without the prior written permission of the Association for the Advancement of Medical Instrumentation is strictly prohibited by law. It is illegal under federal law (17 U.S.C. $ 101, et seq.) to make copies of all or any part of this document (whether internally or externally) without 4301 N Fairfax Drive, Suite 301, Arlington, VA 22203-1633. Phone: (703) 525-4890; Fax: (703) 276-0793 Printed in the United States of America ISBN 1-57020-612-0 Contents Page Glossary of equivalent standards. Committee representation.... Forew