IEC TR 80001-2-2:2012

FOREWORD
INTRODUCTION
1 Scope
2 Normative references
3 Terms and definitions
4 Use of SECURITY CAPABILITIES
5 SECURITY CAPABILITIES
6 Example of detailed specification under
  SECURITY CAPABILITY: Person authentication
  - PAUT
7 References
8 Other resources
9 Standards and frameworks
Annex A (informative) - Sample scenario showing the
        exchange of security information
Annex B (informative) - Examples of regional specification
        on a few SECURITY CAPABILITIES
Annex C (informative) - SECURITY CAPABILITY mapping to C-I-A-A
Bibliography

IEC/TR 80001-2-2:2012(E), which is a technical report, creates a framework for the disclosure of security-related capabilities and risks necessary for managing the risk in connecting medical devices to IT-networks and for the security dialog that surrounds the IEC 80001-1 risk management of IT-network connection. This security report presents an informative set of common, high-level security-related capabilities useful in understanding the user needs, the type of security controls to be considered and the risks that lead to the controls. Intended use and local factors determine which exact capabilities will be useful in the dialog about risk. The capability descriptions in this report are intended to supply health delivery organizations (HDOs), medical device manufacturers (MDMs), and IT vendors with a basis for discussing risk and their respective roles and responsibilities toward its management. This discussion among the risk partners serves as the basis for one or more responsibility agreements as specified in IEC 80001-1.