Side-by-side breakdown
| Dimension | ISO 27001 | IEC 81001-5-1 |
|---|---|---|
| Scope | Information security management system (ISMS) for an organisation. | Cybersecurity activities for health software across the product lifecycle. |
| Object protected | The organisation's information assets and IT estate. | The medical device's software and the patients/operators using it. |
| Audience | Enterprise IT, security teams, auditors. | Product engineering, regulatory, postmarket security. |
| FDA expectation | Helpful context but not sufficient for a cyber-device submission. | Direct fit - cited in 2026 premarket guidance as the SPDF reference. |
| Certification model | Third-party ISMS certification; recertified every 3 years. | Conformance assessment per product; no organisational certificate. |
| Common confusion | MedTech buyers often think SOC 2 + ISO 27001 covers their FDA cybersecurity obligation - it does not. | Often missed by IT-led security teams who focus on the enterprise rather than the device. |
When to use which
If you already hold ISO 27001 certification, reuse the policies and evidence (access control, change management, supplier security) inside your SPDF documentation - it accelerates the 81001-5-1 conformance work.
Run the two standards as parallel programs with one shared governance forum. The product security lead owns 81001-5-1; the CISO owns 27001; both report to the same risk committee.