ISO 13485, IEC 62304, ISO 14971, ISO 27001

This is the “umbrella” standard. While ISO 9001 is for general quality, ISO 13485 is specifically for the medical device industry.

The Goal: To prove you have a consistent system for designing, developing, and manufacturing devices.
Key Focus: Documentation and traceability. If a component in your IoT device fails, you must be able to trace exactly where that part came from and which batch of devices it is in.
In IoT Security: It ensures that security updates or “patches” follow a controlled process rather than being pushed live without testing.

If your IoT device has code (firmware, apps, or cloud logic), this standard is your roadmap.

The Goal: To ensure the software is “safe by design” through a rigorous development lifecycle.
Key Focus: It categorizes software based on the risk of injury to the patient:
- Class A: No injury possible.
- Class B: Non-serious injury.
- Class C: Death or serious injury.
In IoT Security: It mandates “Software Configuration Management,” which is vital for tracking vulnerabilities in open-source libraries (like Log4j) used in your IoT stack.

This is arguably the most important standard for an IoT Security Engineer. It focuses entirely on Risk Management.

The Goal: To identify, estimate, and evaluate every possible hazard associated with the device.
Key Focus: It doesn’t just look at “technical bugs”; it looks at use errors. For example, “What happens if a hacker intercepts the Bluetooth signal of an insulin pump?”
In IoT Security: It forces you to balance Security Risks (data breach) with Safety Risks (patient harm). Sometimes, a security measure (like a long password) can actually be a safety risk in an emergency.

While the others focus on the “device” and “safety,” ISO 27001 focuses on the Information.

The Goal: To protect the Confidentiality, Integrity, and Availability (CIA) of data.
Key Focus: Managing the organization’s security risks through an Information Security Management System (ISMS).
In IoT Security: This covers your cloud infrastructure and databases. If your IoT device collects patient heart rates, ISO 27001 ensures that the server where that data sits is encrypted, audited, and protected from unauthorized access.

Published by Aksa