What ISO Actually Requires for EtO, Radiation, Steam, and Sterile Packaging Validation
Affiliate Disclosure: Some links in this article are affiliate links. If you purchase through them, The Standards Navigator may earn a commission at no additional cost to you.
Your Sterilization Validation File Is the First Thing an Auditor Opens
A device that isn’t sterile doesn’t ship. That’s the entire premise behind four ISO sterilization standards most regulatory affairs teams only fully understand after a finding forces them to.
ISO 11135 governs ethylene oxide (EtO) sterilization. ISO 11137 governs radiation sterilization (gamma, e-beam, X-ray). ISO 17665 governs moist heat (steam). ISO 11607 governs the sterile barrier packaging that has to keep the device sterile until someone opens it. Supporting all four is ISO 11737, which governs bioburden determination and the sterility test methods used to validate and verify each method. None of them are optional if you’re claiming “STERILE” on a label, and under ISO 13485 and the FDA’s Quality Management System Regulation (QMSR), your device history record has to show a validated process behind that claim — not a one-time test result.
If you’re still building out your quality management system, our ISO 13485 Implementation Roadmap covers where sterilization validation fits into the broader QMS build. If you already have a QMS and are trying to close a specific gap, keep reading.
I’ve reviewed process validation files during ISO 9001 internal audits where the finding wasn’t that the process failed — it was that nobody could produce the record proving why the acceptance criteria were set the way they were. While I haven’t personally validated a sterilization process, I’ve evaluated documentation, traceability, and process validation evidence like this as part of broader QMS audits, and the pattern holds across every process type: auditors don’t just want a passing result, they want the rationale that came before it. Miss that documentation trail and it doesn’t matter how many lots passed — the finding still lands.
Most teams miss this step — check your sterilization documentation against the full standard before your next audit →
In This Guide
- The four core sterilization method standards and what each one actually requires
- How ISO 11607 packaging validation fits alongside method validation
- Sterility Assurance Level (SAL) and why 10⁻⁶ is the number that matters
- Contract sterilizer relationships — who’s responsible for what
- Common audit findings in sterilization validation files
- How these standards connect to ISO 13485, ISO 14971, and the FDA QMSR
Table of Contents
👉 Start Here (Top Resources)
- ISO 13485:2016 — Official Standard (ANSI Webstore) — the QMS standard that governs how sterilization validation records are controlled and maintained.
- ISO 13485 Training — BSI Group — structured training on the QMS clauses that sterilization validation must satisfy.
Why Sterilization Standards Sit Inside Your QMS
Sterilization validation isn’t a standalone technical exercise — it’s a QMS output. ISO 13485 Clause 7.5.7 specifically requires validation of sterilization processes before routine use. The FDA’s Quality Management System Regulation (QMSR), effective February 2, 2026, makes ISO 13485:2016 the core requirement set for device manufacturers marketing in the U.S., with a defined set of FDA-specific additions layered on top — it’s not a loose reference to “many” of the standard’s requirements, it’s the operative regulation. That means your sterilization validation protocol, your acceptance criteria, and your revalidation schedule all have to trace back into your document control and CAPA systems — the same systems we covered in ISO 13485 Documentation Requirements and CAPA Requirements in ISO 13485.
If you are still finalizing your core QMS documentation → get the sterilization validation SOP structure right before you run your first qualification batch. Retrofitting documentation after the fact is where most rework happens.
The Standards Aren’t Interchangeable
One of the biggest misconceptions in this space is that manufacturers can choose whichever sterilization standard fits their production schedule best. In reality, the applicable standard is dictated by the sterilization modality itself — not preference. ISO 11135 cannot substitute for ISO 11137, and neither one replaces the packaging validation requirements in ISO 11607. Method selection is a design and materials decision made early in development, and it determines which standard — and which validation pathway — applies for the life of the product.
Real-world example: a disposable syringe is commonly validated under ISO 11137 using gamma or e-beam radiation, while the sterile barrier system around it is separately validated under ISO 11607. An orthopedic power drill with onboard electronics, by contrast, often can’t tolerate radiation dose without degrading — which is why EtO validation under ISO 11135 becomes the practical path, even though it carries a longer aeration and residual-testing burden than radiation would.
| Standard | Covers | Validation Focus | Typical Products |
|---|---|---|---|
| ISO 11135 | Ethylene oxide (EtO) | Gas cycle validation | Electronics, plastics, mixed-material assemblies |
| ISO 11137 | Radiation (gamma / e-beam / X-ray) | Dose validation | Disposable, polymer-based devices |
| ISO 17665 | Moist heat (steam) | Temperature/pressure qualification | Reusable surgical instruments |
| ISO 11607 | Sterile packaging | Seal & sterile barrier validation | All terminally sterilized devices |
ISO 11135: Ethylene Oxide Sterilization
ISO 11135 covers development, validation, and routine control of EtO sterilization — the most common method for devices with mixed materials, electronics, or complex geometries that can’t tolerate radiation or heat.
The standard requires:
- Process definition — establishing gas concentration, temperature, humidity, and exposure time that reliably achieves the target sterility assurance level
- Installation and performance qualification — proving the chamber and load configuration actually deliver the defined process
- Routine monitoring — biological indicators and process parameter records for every production cycle
- EtO residual testing — confirming aeration reduces residual gas and byproducts to acceptable levels before release
Watch-outs specific to EtO: aeration time, residual limits, and material compatibility all need documented justification, not just a passing result. If you need the current edition for your validation team, ISO 11135:2014 is available through ANSI Webstore.
ISO 11137: Radiation Sterilization
ISO 11137 covers gamma, electron beam, and X-ray sterilization in three parts: requirements (Part 1), dose setting (Part 2), and dose auditing (Part 3). Radiation is common for single-use, polymer-based disposables produced at volume.
| Element | What It Covers | Why It Matters in an Audit |
|---|---|---|
| Dose setting | Establishing the minimum dose that achieves the target SAL (e.g., VDmax or Method 1 approaches) | Auditors want to see the substantiation data, not just the final dose |
| Dose auditing | Ongoing verification that the substantiated dose remains effective as product or process changes occur | A missed dose audit is a common nonconformance |
| Material compatibility | Polymer aging, discoloration, and embrittlement risk at the selected dose | Ties directly into design verification records |
If you are switching from gamma to e-beam or X-ray for the same product → you need new dose substantiation data. The modality change is not a paperwork formality. ISO 11137:2025 is the current edition covering dose-setting and dose-auditing requirements.
ISO 17665: Moist Heat Sterilization
ISO 17665 covers steam sterilization — pressurized saturated steam, typically 121°C to 134°C. It remains the preferred method for reusable surgical instruments and devices that tolerate heat and moisture, largely because it’s simple, fast, and doesn’t carry the residual or dose-substantiation burden that EtO and radiation do.
Validation under ISO 17665 centers on physical qualification (proving the autoclave load reaches and holds temperature throughout) paired with biological indicator challenge testing. The standard also requires routine control — meaning every production cycle needs monitored, recorded parameters, not just periodic spot checks. ISO 17665:2024 is the current edition.
ISO 11607: Sterile Packaging
Sterilization validation doesn’t end when the device comes out of the chamber. ISO 11607 — in two parts — governs the sterile barrier system that has to maintain sterility through distribution, storage, and shelf life until the point of use.
Part 1 covers materials, sterile barrier system design, and preformed barrier requirements. Part 2 covers validation of the forming, sealing, and assembly processes used to create that barrier. A device can pass every sterilization requirement in ISO 11135, 11137, or 17665 and still fail on the market if the package seal isn’t validated to hold sterility through the labeled shelf life.
Packaging validation goes well beyond confirming a seal exists. A complete ISO 11607 validation file typically includes seal integrity testing, burst testing, dye penetration testing, and peel strength testing to confirm the barrier holds under mechanical stress — plus transit simulation testing (ASTM D4169 is the common reference standard) to prove the package survives real-world distribution handling, and accelerated aging studies to substantiate the labeled shelf life before real-time aging data exists. Skipping any one of these doesn’t just create an audit finding — it creates a product that may not actually stay sterile on the shelf.
Most common finding: manufacturers validate the sterilization cycle thoroughly but treat packaging validation as an afterthought — seal strength testing without the accompanying shelf-life and transit simulation data auditors expect to see referenced together. ISO 11607:2019 covers both parts of the packaging validation requirement.
Sterility Assurance Level: The 10⁻⁶ Standard
Every one of these standards is built around the same target: a Sterility Assurance Level of 10⁻⁶, meaning no more than a one-in-a-million probability that a viable microorganism survives the sterilization process. SAL isn’t a claim you assert — it’s a number you prove through bioburden testing, biological indicator challenges, and the validation approach specified in the relevant method standard.
This is where ISO 11737 (microbiological methods) connects in. Bioburden testing under ISO 11737-1 establishes your starting point; the sterility test methods in ISO 11737-2 support validation and ongoing verification. If you haven’t mapped your bioburden data into your sterilization validation protocol, that’s a gap worth closing before your next surveillance audit.
Using a Contract Sterilizer Doesn’t Transfer the Risk
The most common objection we hear: “We use a contract sterilizer — isn’t this their responsibility?”
No. Under ISO 13485’s supplier control requirements — covered in detail in Supplier Controls for Medical Devices — the device manufacturer retains ultimate responsibility for the validated state of the sterilization process, even when a contract sterilizer physically performs it. Your quality agreement with that sterilizer needs to define who owns revalidation triggers, who reviews dose audit data, and who gets notified of process deviations. An FDA or notified body auditor will ask you these questions directly — “we outsource it” is not an acceptable answer.
Common Findings in Sterilization Validation Files
- Missing or incomplete dose substantiation rationale (radiation)
- Aeration and residual data not linked to the specific product configuration tested (EtO)
- Packaging validation treated as separate from — rather than integrated with — sterilization validation
- Revalidation not triggered after a documented process, material, or supplier change
- Contract sterilizer quality agreements that don’t specify deviation notification requirements
Common Sterilization Myths
- Sterile packaging isn’t optional. It’s a validated element of the sterilization claim, not a shipping convenience.
- Contract sterilizers don’t assume regulatory responsibility. The device manufacturer does, regardless of who runs the cycle.
- Passing one validation run doesn’t eliminate revalidation requirements. Process, material, or supplier changes reset the clock.
- SAL isn’t measured by a single sterility test. It’s established through bioburden data, biological indicator challenges, and the validation approach specified in the method standard — not one passing sample.
Quick Audit Checklist
- ✅ Process definition and qualification records on file for the sterilization method used
- ✅ Dose substantiation and dose audit data current (radiation only)
- ✅ Residual and aeration data linked to product-specific testing (EtO only)
- ✅ Packaging validation (ISO 11607-1 and -2) referenced alongside sterilization validation
- ✅ Bioburden data mapped to SAL 10⁻⁶ justification
- ✅ Contract sterilizer quality agreement defines revalidation and deviation ownership
- ⚠️ Revalidation schedule reviewed after any process, material, or supplier change
Not sure your current documentation would hold up? Run it against the ISO 13485 Gap Assessment Checklist before your next scheduled audit →
FAQ
What’s the difference between ISO 11135 and ISO 11137?
ISO 11135 governs ethylene oxide (EtO) sterilization, a gas-based low-temperature method suited to mixed-material and electronic devices. ISO 11137 governs radiation sterilization — gamma, e-beam, and X-ray — typically used for high-volume, polymer-based disposables. They require different validation approaches: dose substantiation for radiation, and gas concentration/exposure/aeration qualification for EtO.
Does ISO 17665 apply to reusable devices?
Yes. ISO 17665 covers moist heat (steam) sterilization, which is the most common method for reusable surgical instruments and devices that tolerate heat and moisture without degradation.
Is ISO 11607 required if I use a contract packaging supplier?
Yes. ISO 11607 validation requirements apply regardless of whether packaging design and sealing are performed in-house or by a contract supplier. The device manufacturer is responsible for confirming that validation data exists and is current for the specific packaging configuration used.
What is Sterility Assurance Level (SAL) and why is 10⁻⁶ the target?
SAL is the probability that a single viable microorganism survives a sterilization process. A SAL of 10⁻⁶ means no more than a one-in-a-million chance — the internationally recognized benchmark for terminally sterilized medical devices across ISO 11135, 11137, and 17665.
Do I need to revalidate if I switch contract sterilizers?
In most cases, yes. A change in sterilizer, chamber configuration, or load pattern can affect cycle parameters even when the method and standard stay the same. Revalidation requirements should be defined in your change control procedure, not decided case by case.
How does ISO 14971 relate to sterilization validation?
ISO 14971 risk management informs the acceptance criteria and failure mode analysis behind your sterilization validation protocol — particularly for identifying what happens if sterility assurance isn’t achieved. See our breakdown in Risk Management in Medical Devices for how the two standards connect.
Does the FDA QMSR require anything beyond ISO 13485 for sterilization?
The QMSR incorporates ISO 13485 by reference, so the core sterilization validation requirement flows through Clause 7.5.7. FDA also maintains a Recognized Consensus Standards database mapping specific editions of ISO 11135, 11137, 17665, and related standards — always confirm current recognition status before citing a specific edition in a submission.
What’s the most common reason sterilization validation fails an audit?
Missing documentation trail — not process failure. Auditors most often cite an inability to produce the rationale behind acceptance criteria, dose substantiation, or revalidation triggers, even when every routine monitoring record shows a passing result.
Not Sure What to Do Next?
🔹 Still researching your sterilization pathway? Read What Is ISO 13485? to see how sterilization validation fits into the full QMS picture.
🔹 Ready to close documentation gaps before your next audit? BSI Group’s ISO 13485 training walks through the clauses that govern sterilization validation records.
🔹 Need the actual standard text for your validation team? If you’re purchasing more than one, the ANSI Webstore Medical Device Packages bundle covers ISO 13485, ISO 14971, and the sterilization standards together — often at a lower combined cost than buying each individually.
📥 Free Resources
- ISO 9001 Roadmap — step-by-step implementation guide for manufacturers building or improving a quality management system.
- Manufacturing Compliance Checklist — practical compliance reference covering key ISO, OSHA, and quality requirements for production environments.
- Supplier Quality Checklist — evaluation tool for assessing supplier quality controls and flow-down compliance before audits or new contracts.
- ISO 13485 Gap Assessment Checklist — free checklist for medical device manufacturers assessing their QMS against ISO 13485 requirements.
- AS9100 Rev D Gap Assessment Checklist — 74-item clause-by-clause checklist for aerospace suppliers assessing their QMS before certification.
The Documentation Trail Is the Real Deliverable
Sterilization validation isn’t a lab exercise you complete once and file away — it’s a living record your QMS has to maintain across every process, material, and supplier change. Get the documentation structure right the first time, and the biological indicator result becomes the easy part. The Standards Navigator will keep tracking updates to ISO 11135, 11137, 17665, and 11607 as FDA recognition status evolves, so you’re not caught citing a superseded edition.
📬 Stay Ahead of Your Next Sterilization Audit
Most sterilization validation findings don’t come from a failed cycle — they come from a documentation trail an auditor can’t follow six months later. Manufacturers who treat sterilization validation as a one-time project end up scrambling before every surveillance audit; the ones who build revalidation triggers into their change control process rarely get surprised.
The Standards Navigator tracks sterilization, packaging, and QMS standard updates specifically for medical device manufacturers navigating ISO 13485 and the FDA QMSR.
👉 Get updates on sterilization and medical device compliance standards 👉 Be first to access new ISO 13485 gap assessment tools and checklists
Subscribe below to stay ahead.
The Standards Navigator — Industrial Compliance. Clearly Explained.