AAMI TIR97
AAMI Technical Information Report on post-market security risk management for medical device manufacturers, the operational companion to TIR57.
Definition
AAMI TIR97:2019/(R)2023, Principles for medical device security: Postmarket risk management for device manufacturers, provides guidance on postmarket security risk management in the ISO 14971 safety-risk-management context and is intended to be used with AAMI TIR57.What this means in practice
TIR97 can inform postmarket risk-management procedures. Claims about required VEX statements, metrics, notification content or deadlines require verification in the licensed report. FDA guidance is now the February 2026 edition.Examples
- Illustrative: A MedTech manufacturer used AAMI TIR97 to establish a clear process for monitoring newly disclosed vulnerabilities in third-party software components embedded in their medical devices after they were released to market.
- Illustrative: Following AAMI TIR97 guidelines, a device manufacturer developed an internal procedure for rapidly assessing the exploitability and potential patient safety impact of a newly discovered cybersecurity flaw in one of their deployed imaging systems.
- Illustrative: To comply with post-market cybersecurity expectations, a MedTech company structured its incident response plan around AAMI TIR97's recommendations for coordinated vulnerability disclosure and customer communication.
- •Do not treat TIR57 or TIR97 guidance as independently binding lifecycle requirements. Assess applicable law and the editions actually used.
- •Skipping the patient-safety impact assessment step and defaulting to CVSS, TIR97 expects an explicit linkage between exploitability and harm.
- •Document risk-appropriate customer communications; verify any claimed TIR97-specific content or timing against the licensed text.
Frequently asked questions
Related terms
Grouped by themeEditor's picks
· Hand-selected related conceptsAAMI Technical Information Report providing MedTech-specific guidance on cybersecurity risk management.
A documented process for receiving, triaging, and responsibly disclosing security vulnerabilities reported by external researchers.
International standard defining secure-product-lifecycle activities for health software, including medical devices.
The bundle of cybersecurity artifacts a sponsor includes in a 510(k), De Novo, PMA, or HDE submission for a cyber device.
More in Cybersecurity
· Same categoryThe federal statute that gives FDA explicit premarket authority over cybersecurity for cyber devices.
A machine-readable statement that explains whether a known vulnerability is actually exploitable in a specific product.
AAMI/ANSI standard establishing requirements for medical-device cybersecurity activities throughout the lifecycle.
Unauthorized remote control of an implanted neurostimulator (e.g., DBS) to alter stimulation parameters and harm a patient.
Where this term appears across MedTech Terms.
Latest in MedTech
Sources
4 sourcesSources support the definition or relevant regulatory context, not necessarily every claim on this page. Each is graded against our source-tier hierarchy so you can see what rests on binding law versus commentary.
Official-source claim check:
Publisher abstract confirms guidance on postmarket security risk management with ISO 14971 and TIR57.
Partial review: verified corrections are applied, but this is not a full accuracy certification. The last full review date is unchanged.
Remaining verification limits
- Full TIR97 and cited IEC/AAMI clauses are paywalled and were not validated. Abstract validates scope only.
- 1AAMI TIR97:2019Tier 2 UncheckedAAMIarray.aami.org
- 2FDA Cybersecurity in Medical Devices Guidance (February 2026)Tier 2 VerifiedFDAfda.gov
- 3HSCC - Health Sector Coordinating CouncilTier 4 VerifiedHSCChealthsectorcouncil.org
- 4FDA final guidance, February 3, 2026Tier 2 UncheckedFDAfda.gov
Inline markers like [1] jump to the matching reference above.