Preface |
|
xv | |
1 Introduction |
|
1 | (4) |
2 What Is a Computer Systems Validation (CSV)? |
|
5 | (10) |
|
|
8 | (2) |
|
When Are Computer Systems Validated? |
|
|
10 | (1) |
|
Sample Related Regulations/Guidance |
|
|
10 | (1) |
|
|
11 | (2) |
|
|
13 | (2) |
3 CGMP Regulatory Requirements for Production Computer Systems |
|
15 | (22) |
|
|
15 | (1) |
|
Expectations by Key Regulatory Authorities |
|
|
16 | (10) |
|
|
16 | (1) |
|
|
17 | (1) |
|
|
17 | (1) |
|
|
18 | (1) |
|
|
18 | (2) |
|
|
20 | (1) |
|
|
21 | (1) |
|
|
21 | (5) |
|
CGMP Applicability to Hardware and Software |
|
|
21 | (1) |
|
|
22 | (4) |
|
Expectation by Worldwide Entities |
|
|
26 | (6) |
|
|
26 | (3) |
|
|
29 | (1) |
|
OMCL Network of the Council of Europe |
|
|
30 | (1) |
|
|
31 | (1) |
|
|
31 | (1) |
|
|
32 | (1) |
|
|
32 | (3) |
|
|
35 | (1) |
|
|
35 | (2) |
4 Maxims in CSV |
|
37 | (4) |
|
|
37 | (1) |
|
|
38 | (1) |
|
|
38 | (1) |
|
|
39 | (1) |
|
|
39 | (2) |
5 General CSV Principles |
|
41 | (8) |
|
|
41 | (1) |
|
|
41 | (1) |
|
|
42 | (1) |
|
|
42 | (1) |
|
|
43 | (1) |
|
|
43 | (1) |
|
|
44 | (1) |
|
|
44 | (1) |
|
|
45 | (2) |
|
|
47 | (1) |
|
|
47 | (2) |
6 System Life Cycle |
|
49 | (6) |
|
|
49 | (1) |
|
|
50 | (2) |
|
Applicable Quality Principles to the SLC |
|
|
52 | (1) |
|
|
53 | (1) |
|
Sample Related Regulations/Guidance/Standards |
|
|
54 | (1) |
|
|
54 | (1) |
|
|
54 | (1) |
7 SLC Documentation |
|
55 | (8) |
|
|
56 | (2) |
|
|
56 | (1) |
|
|
56 | (1) |
|
|
57 | (1) |
|
|
58 | (1) |
|
|
58 | (1) |
|
Typical Documentation for the Acquisition Process |
|
|
58 | (2) |
|
|
60 | (1) |
|
Test Scripts and Test Results |
|
|
60 | (1) |
|
|
60 | (1) |
|
Confirmation of Consistent Functionality |
|
|
61 | (1) |
|
|
61 | (1) |
|
|
62 | (1) |
8 Management of the Computer System Requirements |
|
63 | (18) |
|
|
63 | (3) |
|
|
66 | (1) |
|
Obtaining an Understanding of Requirements |
|
|
67 | (1) |
|
Obtaining Commitment to Requirements |
|
|
68 | (2) |
|
Managing Requirements Changes |
|
|
70 | (3) |
|
Maintaining Bidirectional Traceability of Requirements |
|
|
73 | (2) |
|
Ensuring Alignment Between Project Work and Requirements |
|
|
75 | (3) |
|
|
78 | (1) |
|
|
78 | (1) |
|
|
79 | (1) |
|
|
79 | (2) |
9 Risk Based Validation |
|
81 | (10) |
|
|
81 | (1) |
|
Risk Assessment in Computer Validation, Where Does It Apply? |
|
|
82 | (2) |
|
|
84 | (2) |
|
|
85 | (1) |
|
|
86 | (1) |
|
Risk Evaluation and Assessment |
|
|
86 | (1) |
|
Integration Risk Management with SLC |
|
|
86 | (1) |
|
|
87 | (1) |
|
|
87 | (1) |
|
|
87 | (1) |
|
|
87 | (1) |
|
|
87 | (1) |
|
|
88 | (1) |
|
Regulatory Requirements/Guidance |
|
|
88 | (1) |
|
|
89 | (1) |
|
|
89 | (2) |
10 CSV Plans and Schedules |
|
91 | (6) |
|
|
91 | (3) |
|
|
94 | (3) |
11 Project Management, SLC, Production CSV, ITIL |
|
97 | (6) |
|
|
97 | (1) |
|
Alignment-New Technology/Service Life Cycle |
|
|
98 | (1) |
|
Alignment-Service Deployment |
|
|
99 | (3) |
|
|
102 | (1) |
12 Computer Systems Operational Life |
|
103 | (8) |
|
|
103 | (1) |
|
|
104 | (1) |
|
|
105 | (3) |
|
|
108 | (1) |
|
|
109 | (1) |
|
|
109 | (2) |
13 Suppliers and Service Providers |
|
111 | (6) |
|
|
115 | (1) |
|
|
115 | (1) |
|
|
115 | (2) |
14 Trustworthy Computer Systems |
|
117 | (18) |
|
Introduction to Trustworthy Computer Systems |
|
|
118 | (1) |
|
Computer Systems Suited to Performing Their Intended Functions |
|
|
119 | (4) |
|
|
121 | (1) |
|
|
121 | (1) |
|
World Health Organization (WHO) |
|
|
122 | (1) |
|
|
122 | (1) |
|
|
123 | (1) |
|
Provide a Reasonably Reliable Level of Availability, Reliability and Correct Operation |
|
|
123 | (3) |
|
|
124 | (1) |
|
|
125 | (1) |
|
|
125 | (1) |
|
PIC/S PI-011-3, ASEAN and Canadian HPFBI |
|
|
125 | (1) |
|
|
125 | (1) |
|
|
126 | (1) |
|
|
126 | (1) |
|
|
126 | (1) |
|
Secure from Intrusion and Misuse |
|
|
126 | (3) |
|
|
127 | (1) |
|
|
127 | (1) |
|
|
128 | (1) |
|
PIC/S PI-011-3, ASEAN and Canadian HPFBI |
|
|
128 | (1) |
|
|
128 | (1) |
|
|
129 | (1) |
|
|
129 | (1) |
|
Adhere to Generally Accepted Security Principles |
|
|
129 | (2) |
|
Trustworthy Computer Systems Infrastructure |
|
|
131 | (2) |
|
Computer System Procedures |
|
|
133 | (1) |
|
|
133 | (1) |
|
|
134 | (1) |
15 Control of Data and Records |
|
135 | (6) |
|
|
135 | (1) |
|
|
136 | (2) |
|
|
138 | (2) |
|
|
140 | (1) |
|
|
140 | (1) |
16 Technologies Supporting Integrity of E-Records |
|
141 | (22) |
|
|
141 | (3) |
|
Cryptographic Technologies |
|
|
144 | (6) |
|
Cryptographic Technologies Applicable to E-Records Integrity |
|
|
150 | (1) |
|
|
151 | (7) |
|
Access Controls and Authority Checks to Computer Resources |
|
|
152 | (1) |
|
|
153 | (1) |
|
|
154 | (1) |
|
Security of the Electronic Signatures |
|
|
155 | (1) |
|
Signature E-Records Linkage |
|
|
156 | (1) |
|
|
157 | (1) |
|
Uniqueness of the Electronic Signatures |
|
|
158 | (1) |
|
|
158 | (2) |
|
Integrity of E-Records in Transit |
|
|
158 | (2) |
|
|
160 | (1) |
|
|
160 | (1) |
|
|
161 | (1) |
|
|
162 | (1) |
|
|
162 | (1) |
17 Infrastructure Qualification Overview |
|
163 | (8) |
|
|
163 | (2) |
|
What Is Infrastructure Qualification? |
|
|
165 | (1) |
|
Why Do We Qualify Computer Infrastructure? |
|
|
166 | (1) |
|
Introduction to the Infrastructure Qualification Process |
|
|
167 | (2) |
|
|
169 | (2) |
18 Remediation Projects |
|
171 | (10) |
|
|
171 | (1) |
|
|
172 | (1) |
|
Corrective Action Planning |
|
|
173 | (1) |
|
|
174 | (2) |
|
|
174 | (1) |
|
|
175 | (1) |
|
|
175 | (1) |
|
New Applications and Application Upgrade Assessments |
|
|
175 | (1) |
|
Suppliers Qualification Program |
|
|
176 | (1) |
|
Remediation Project Report |
|
|
176 | (1) |
|
Special Case-Retrospective Evaluation |
|
|
176 | (2) |
|
Essentials Retrospective Evaluation Management |
|
|
178 | (1) |
|
|
179 | (1) |
|
Regulatory Requirements/Guidance |
|
|
179 | (1) |
|
|
180 | (1) |
19 Production CSV Program Organization |
|
181 | (8) |
|
|
181 | (1) |
|
|
181 | (1) |
|
CSV Cross-Functional Team |
|
|
182 | (2) |
|
Computer Systems Validation Groups and Teams |
|
|
184 | (1) |
|
|
185 | (1) |
|
Validation Program Coordinators |
|
|
185 | (4) |
20 Integration Between Computer System and E-Records Life Cycles |
|
189 | (12) |
|
|
189 | (1) |
|
|
190 | (6) |
|
Computer Systems Validation |
|
|
190 | (1) |
|
|
191 | (2) |
|
|
193 | (2) |
|
E-records Migration and Computer Systems Release to Operations |
|
|
195 | (1) |
|
|
196 | (4) |
|
Computer System Retirement-E-Records Migration |
|
|
197 | (1) |
|
|
197 | (2) |
|
|
199 | (1) |
|
|
200 | (1) |
21 Digital Date and Time Stamps |
|
201 | (6) |
|
|
201 | (1) |
|
|
201 | (1) |
|
Computer Clock Reliability |
|
|
202 | (1) |
|
Digital Time-Stamping Service |
|
|
203 | (1) |
|
|
204 | (1) |
|
Computer Systems Not Networked |
|
|
204 | (1) |
|
|
204 | (1) |
|
|
205 | (2) |
22 New Technologies and Critical Processes |
|
207 | (16) |
|
|
207 | (4) |
|
|
211 | (2) |
|
|
213 | (3) |
|
|
216 | (1) |
|
|
217 | (1) |
|
|
218 | (1) |
|
|
218 | (5) |
|
|
219 | (1) |
|
|
219 | (1) |
|
|
220 | (1) |
|
|
220 | (1) |
|
WLAN System Qualification |
|
|
220 | (1) |
|
Data Integrity in Wireless Environments |
|
|
221 | (2) |
23 All Together |
|
223 | (6) |
|
|
224 | (1) |
|
|
225 | (2) |
|
|
227 | (1) |
|
|
227 | (1) |
|
|
227 | (1) |
|
|
227 | (2) |
Appendix I: Glossary of Terms |
|
229 | (34) |
Appendix II: Abbreviations and/or Acronyms |
|
263 | (4) |
Appendix III: Regulatory Cross Match |
|
267 | (22) |
Appendix IV: Additional Readings |
|
289 | (6) |
Appendix V: Reference Papers on E-Records Integrity |
|
295 | (2) |
Appendix VI: Case Study-Cloud-Based SCADA |
|
297 | (18) |
Index |
|
315 | |