IEC 80001-1:2010 [1] recognises that medical devices are incorporated into IT-networks to achieve desirable benefits1. The standard defines the roles, responsibilities and activities that are necessary for the risk management of IT-networks incorporating medical devices to address safety, effectiveness and data and system security. It applies throughout the life cycle of IT-networks incorporating medical devices and applies to responsible organizations, medical device manufacturers and providers of other information technology. IEC 80001-1:2010 draws on processes set out in ISO 14971:2007 [2] intended to be used by equipment manufacturers to identify hazards associated with medical devices. It also draws on ISO/IEC 20000-1:2011 [3] which specifies the requirements for an IT service provider to meet when implementing an IT service management system