1、BSI Standards Publication Application of risk management for IT-networks incorporating medical devices Application guidance Part 2-7: Guidance for Healthcare Delivery Organizations (HDOs) on how to self-assess their conformance with IEC 80001-1 PD ISO/TR 80001-2-7:2015National foreword This Publishe
2、d Document is the UK implementation of ISO/TR 80001-2-7:2015. The UK participation in its preparation was entrusted by Technical Committee CH/62, Electrical Equipment in Medical Practice, to Sub- committee CH/62/1, Common aspects of Electrical Equipment used in Medical Practice. A list of organizati
3、ons represented on this committee can be obtained on request to its secretary. This publication does not purport to include all the necessary provisions of a contract. Users are responsible for its correct application. The British Standards Institution 2015. Published by BSI Standards Limited 2015 I
4、SBN 978 0 580 83412 7 ICS 11.040.01, 35.240.80 Compliance with a British Standard cannot confer immunity from legal obligations. This Published Document was published under the authority of the Standards Policy and Strategy Committee on 31 March 2015. Amendments/corrigenda issued since publication D
5、ate Text affected PUBLISHED DOCUMENT PD ISO/TR 80001-2-7:2015 ISO 2015 Application of risk management for IT-networks incorporating medical devices Application guidance Guidance for Healthcare Delivery Part 2-7: Organizations (HDOs) on how to self- assess their conformance with IEC 80001-1 Applicati
6、on du management du risque aux rseaux des technologies de linformation contenant les dispositifs mdicaux Conseils pour les applications Partie 2-7: Directives de prestation de soins de sant organisations sur la faon de sauto-valuer leur conformit avec la norme IEC 80001-1 TECHNICAL REPORT ISO/TR 800
7、01-2-7 Reference number ISO/TR 80001-2-7:2015(E) First edition 2015-04-01 ISO/TR 80001-2-7:2015(E)ii ISO 2015 All rights reserved COPYRIGHT PROTECTED DOCUMENT ISO 2015 All rights reserved. Unless otherwise specified, no part of this publication may be reproduced or utilized otherwise in any form or
8、by any means, electronic or mechanical, including photocopying, or posting on the internet or an intranet, without prior written permission. Permission can be requested from either ISO at the address below or ISOs member body in the country of the requester. ISO copyright office Case postale 56 CH-1
9、211 Geneva 20 Tel. + 41 22 749 01 11 Fax + 41 22 749 09 47 E-mail copyrightiso.org Web www.iso.org Published in Switzerland PD ISO/TR 80001-2-7:2015 ISO/TR 80001-2-7:2015(E)Foreword iv Introduction v 1 Scope . 1 2 Normative references 1 3 T erms and definitions . 1 4 Assessment Method . 2 4.1 Prereq
10、uisites . 2 4.2 Assessment Method Overview 2 4.3 Assessment Stages . 3 4.3.1 Stage 1 Defining Assessment Scope . 3 4.3.2 Stage 2 Stakeholder Involvement . 3 4.3.3 Stage 3 Information Collection and Evaluation 3 4.3.4 Stage 4 Findings Report 3 4.3.5 Stage 5 Presentation of Findings 4 4.3.6 Stage 6 Im
11、provement Plan (optional) 4 4.3.7 Stage 7 Follow-up Assessment (optional) 4 4.4 Process attribute rating scale . 4 4.4.1 Rating of process attributes . 4 4.4.2 Process attribute rating values 4 4.5 Capability Levels 5 4.6 Tailoring the Assessment Method 5 Annex A (informative) Assessment Method 7 An
12、nex B (informative) Process Reference Model .38 Annex C (informative) Process Assessment Model .50 Annex D (informative) A bbr e viations and Pr oc ess Identifiers 100 Bibliography .102 ISO 2015 All rights reserved iii Contents Page PD ISO/TR 80001-2-7:2015 ISO/TR 80001-2-7:2015(E) Foreword ISO (the
13、 International Organization for Standardization) is a worldwide federation of national standards bodies (ISO member bodies). The work of preparing International Standards is normally carried out through ISO technical committees. Each member body interested in a subject for which a technical committe
14、e has been established has the right to be represented on that committee. International organizations, governmental and non-governmental, in liaison with ISO, also take part in the work. ISO collaborates closely with the International Electrotechnical Commission (IEC) on all matters of electrotechni
15、cal standardization. The procedures used to develop this document and those intended for its further maintenance are described in the ISO/IEC Directives, Part 1. In particular the different approval criteria needed for the different types of ISO documents should be noted. This document was drafted i
16、n accordance with the editorial rules of the ISO/IEC Directives, Part 2 (see www.iso.org/directives). Attention is drawn to the possibility that some of the elements of this document may be the subject of patent rights. ISO shall not be held responsible for identifying any or all such patent rights.
17、 Details of any patent rights identified during the development of the document will be in the Introduction and/or on the ISO list of patent declarations received (see www.iso.org/patents). Any trade name used in this document is information given for the convenience of users and does not constitute
18、 an endorsement. For an explanation on the meaning of ISO specific terms and expressions related to conformity assessment, as well as information about ISOs adherence to the WTO principles in the Technical Barriers to Trade (TBT), see the following URL: Foreword Supplementary information. The commit
19、tee responsible for this document is ISO/TC 215, Heath informatics. ISO/IEC/TR 80001 consists of the following parts, under the general title Application of risk management for IT-networks incorporating medical devices: Part 1: Roles, responsibilities and activities Part 2-1: Step-by-step risk manag
20、ement of medical IT-networks; Practical applications and Examples Part 2-2: Guidance for the communication of medical device security needs, risks and controls Part 2-3: Guidance for wireless networks Part 2-4: General implementation guidance for Healthcare Delivery Organizations Part 2-5: Applicati
21、on guidance Guidance for distributed alarm systems Part 2-6: Application guidance Guidance for responsibility agreements Part 2-7: Guidance for Healthcare Delivery Organizations (HDOs) on how to self-assess their conformance with IEC 80001-1 The following parts are under preparation: Part 2-8: Appli
22、cation guidance Guidance on standards for establishing the security capabilities identified in IEC 80001-2-2iv ISO 2015 All rights reserved PD ISO/TR 80001-2-7:2015 ISO/TR 80001-2-7:2015(E) Introduction This part of ISO/TR 80001 provides guidance for a Healthcare Delivery Organization (HDO) that wis
23、hes to self-assess its implementation of the processes of IEC 80001-1. This part of ISO/TR 80001 can be used to assess Medical IT-Network projects where IEC 80001-1 has been determined to be applicable. This part of ISO/TR 80001 provides an exemplar assessment method which includes a set of question
24、s which can be used to assess the performance of risk management of a Medical IT-Network incorporating a medical device. This assessment method can be used in its presented form or can be tailored to meet the needs of a specific HDO. A Process Reference Model (PRM) and an example Process Assessment
25、Model (PAM) that meet the requirements of ISO/IEC 15504-2 are included in the Appendices of this part of ISO/TR 80001. The PRM and PAM can be used to provide a standardized basis for tailoring the exemplar assessment method where required. This part of ISO/TR 80001 can be used in a number of ways in
26、cluding the following. a) The assessment method can be used to perform an assessment to determine conformance against IEC 80001-1. b) In instances where conformance has been established, the assessment method can also be used to assess risk management processes and determine the capability level at
27、which these processes are being performed. c) Based on the context of the HDO being assessed, the assessment method can be tailored to address the individual HDO use, needs and concerns. The results of the assessment will highlight any weaknesses within current risk management processes and can be u
28、sed as a basis for the improvement of these processes. Where necessary, modification of the assessment method can be undertaken with reference to the PRM and PAM for IEC 80001-1 which are also included in this part of ISO/TR 80001. This approach allows for a lightweight assessment approach to which
29、more rigour can be added if required. For example, a re-assessment may be required in instances where an initial assessment revealed weaknesses in the current risk management processes and improvements have subsequently been made which require re-assessment to assess their impact on conformance. A r
30、e-assessment may also be performed in instances where confirmation is required that process improvement measures which have been undertaken have resulted in the achievement of a higher capability level. This part of ISO/TR 80001 provides the following: guidance for a HDO to self-assess implementatio
31、n of the processes of IEC 80001-1; an exemplar assessment method which includes a set of questions, can be used to assess the performance of risk management of a Medical IT -Network incorporating a medical device, can be used in its presented form, and can be tailored on a standardised basis using t
32、he included PRM and PAM; a PRM that meet the requirements of ISO/IEC 15504-2; an example PAM that meet the requirements of ISO/IEC 15504-2. NOTE This part of ISO/TR 80001 contains original material that is 2013, Dundalk Institute of Technology, Ireland. Permission is granted to ISO and IEC to reprod
33、uce and circulate this material, this being without prejudice to the rights of Dundalk Institute of Technology to exploit the original text elsewhere. ISO 2015 All rights reserved v PD ISO/TR 80001-2-7:2015 Application of risk management for IT-networks incorporating medical devices Application guid
34、ance Part 2-7: Guidance for Healthcare Delivery Organizations (HDOs) on how to self-assess their conformance with IEC 80001-1 1 Scope The purpose of this part of ISO/TR 80001 is to provide guidance to HDOs on self-assessment of their conformance against IEC 80001-1. The purpose of this part of ISO/T
35、R 80001 is to a) provide guidance to HDOs on self-assessment of their conformance against IEC 80001-1, b) provide an exemplar assessment method which can be used by HDOs in varying contexts to assess themselves against IEC 80001-1, c) define a PRM comprising a set of processes, described in terms of
36、 process purpose and outcomes that demonstrate coverage of the requirements of IEC 80001-1, and d) define a PAM that meets the requirements of ISO/IEC 15504-2 and that supports the performance of an assessment by providing indicators for guidance on the interpretation of the process purposes and out
37、comes as defined in IEC 80001-1 (PRM) and the process attributes as defined in ISO/IEC 15504-2. This part of ISO/TR 80001 does not introduce any requirements in addition to those expressed in IEC 80001-1. 2 Normative references The following documents, in whole or in part, are normatively referenced
38、 in this document and are indispensable for its application. For dated references, only the edition cited applies. For undated references, the latest edition of the referenced document (including any amendments) applies. Members of ISO and IEC maintain registers of currently valid International Stan
39、dards. IEC 80001-1:2010, Application of Risk Management for IT-Networks incorporating Medical Devices Part 1: Roles, responsibilities and activities ISO/IEC 15504-1, Information technology Process assessment Part 1: Concepts and vocabulary ISO/IEC 15504-2:2003, Information technology Process assessm
40、ent Part 2: Performing an assessment 3 T erms a nd definiti ons For the purposes of this document, the terms and definitions given in ISO/IEC 15504-1 and IEC 80001-1 apply. TECHNICAL REPORT ISO/TR 80001-2-7:2015(E) ISO 2015 All rights reserved 1 PD ISO/TR 80001-2-7:2015 ISO/TR 80001-2-7:2015(E) 4 As
41、sessment Method 4.1 Prerequisites In order to perform an assessment, an assessor is required. When performing an assessment, it is preferable to have more than one assessor. In cases where the assessment is performed by more than one assessor, a lead assessor should be nominated. The need for multip
42、le assessors is determined by the context of the HDO and the system under assessment. The context of the HDO and the scope of the assessment also determine the need for the modification of the presented exemplar assessment method. In addition, to performing the assessment, the assessor should consid
43、er interacting with all relevant risk management stakeholders both those internal and external to the HDO. The assessor should also have access to all relevant materials related to the performance of risk management activities. 4.2 Assessment Method Overview The use of an assessment method allows as
44、sessments to be performed in a consistent and repeatable manner. The assessment method which is presented in this part of ISO/TR 80001 is based on the processes and practices as defined in the PRM and PAM which are presented in the appendices of this part of ISO/TR 80001. Figure 1 shows the 14 proce
45、sses and their respective process categories which are contained in the PAM. The PAM, which can be found in Annex C, provides a full description of these processes including the activities (base practices) which must be performed to successfully achieve the purpose of the process. The assessment met
46、hod consists of an approach to performing the assessment and a set of questions which allows the assessor to collect objective evidence to support an assessment of how each of the activities are being performed (and support the assignment of a capability rating to each process). On the basis of the
47、evidence gathered during the assessment, the strengths and weaknesses of the processes can be identified and recommendations can be made to improve risk management practices and conformance with IEC 80001-1. PAM Processes: Medical IT Network Risk Management Process Group (MRM) 2 C 3 Change Release M
48、anagement & Conguraon Management Process Group (CRCM) CC Ch C CC2 D hpp CC3 GL Live Network Risk Management Process Group (LNRM) L L2 Medical IT Network Documentaon and Planning Process Group (MDP) D D4 D2 D D5 O D3 p b Figure 1 PAM Processes Assessment Method2 ISO 2015 All rights reserved PD ISO/TR 80001-2-7:2015 ISO/TR 80001-2-7:2015(E) 4.3 Assessment Stages In order to produce a repea
