Compliance FrameworksInternational
IEC 62304
Medical Device Software Lifecycle: SOUP tracking, configuration management, integrity.
Medical Device Software Lifecycle: SOUP tracking, configuration management, integrity.
| Region | International |
| Country or scope | International |
| Sector | Healthcare |
| In your workspace | On unless you switch it off in Compliance › Manage. |
How Safeguard covers IEC 62304
- Scan requirements: 6, all decided by a scan.
- Controls: the scan requirements below, plus 9 controls from Safeguard's control catalog for IEC 62304.
- Automated tests: none map to it directly. You can link any automated test to its controls yourself (how).
- Policy templates: 24: 2 written for IEC 62304 and 22 from the standard set.
How each kind of coverage works, and what the readiness score counts: Compliance frameworks.
What a scan checks
Each scan of a product checks these 6 requirements against what the scan found, including the product's software inventory (SBOM).
| Requirement | What Safeguard checks | Decided by |
|---|---|---|
IEC62304-8.1.1 Configuration Item Identification | The manufacturer must establish a scheme identifying all configuration items that make up the software system, i.e. a complete component inventory (IEC 62304 §8.1.1) | Scan |
IEC62304-8.1.2-ID SOUP Identification | Each SOUP item must be documented with its title and a unique version or other designator, so every third-party component needs both a name and version (IEC 62304 §8.1.2) | Scan |
IEC62304-8.1.2-MFR SOUP Manufacturer Attribution | The manufacturer of each SOUP item must be recorded as part of its configuration identification (IEC 62304 §8.1.2) | Scan |
IEC62304-7.1.3 Published SOUP Anomaly Evaluation | Published anomaly lists for SOUP items must be evaluated, which requires components to be identifiable against public vulnerability and anomaly sources (IEC 62304 §7.1.3) | Scan |
IEC62304-8.1.3 System Configuration Documentation | The set of configuration items and their versions comprising the software system must be documented (IEC 62304 §8.1.3) | Scan |
IEC62304-6.1 Maintenance Monitoring of SOUP | The maintenance process must monitor SOUP for upgrades and fixes, which is only actionable when component versions are specific rather than vague ranges (IEC 62304 §6.1) | Scan |
More controls in the catalog
The framework's Controls tab lists its scan requirements and these controls from Safeguard's control catalog. Evidence them with automated tests, uploaded evidence, policies or an attestation.
| Control | Name |
|---|---|
IEC62304-5.1 | Define Medical Device Software Development Planning |
IEC62304-5.2 | Document Software Requirements for Safety Classification |
IEC62304-5.3 | Produce Software Architecture for Class B/C Systems |
IEC62304-5.5 | Implement and Document Unit Testing for Safety Software |
IEC62304-5.8 | Perform and Document Software Integration and System Testing |
IEC62304-8.1.2 | Manage SOUP (Software of Unknown Provenance) |
IEC62304-9.1 | Establish a Software Problem Resolution Process |
IEC62304-7.1 | Conduct Software Risk Management per ISO 14971 |
IEC62304-5.6 | Perform Integration Testing Across Software Items |
Policy templates
Written for IEC 62304:
- Medical Device Software Lifecycle Policy (IEC 62304)
- SOUP (Software of Unknown Provenance) Management Policy (IEC 62304)
And 22 from the standard set, adapted to IEC 62304.