Difference between revisions of "Template:LIMSpec/Configuration management"

From LIMSWiki
Jump to navigationJump to search
(Moving the new 32.42 to Cybersecurity)
m (Tweaks)
 
(10 intermediate revisions by the same user not shown)
Line 8: Line 8:
   ! style="color:brown; background-color:#ffffee; width:700px;"| Requirement
   ! style="color:brown; background-color:#ffffee; width:700px;"| Requirement
  |-  
  |-  
   | style="padding:5px; width:500px;" |[https://www.astm.org/Standards/E1578.htm ASTM E1578-18 S-1-1]
   | style="padding:5px; width:500px;" |[https://www.astm.org/e1578-18.html ASTM E1578-18 S-1-1]<br />[https://www.aphl.org/aboutAPHL/publications/Documents/GH-2019May-LIS-Guidebook-web.pdf APHL 2019 LIS Project Management Guidebook]
   | style="background-color:white;" |'''32.1''' The system shall provide tools to enter and manage user-configurable lookup or master data.
   | style="background-color:white;" |'''32.1''' The system shall provide tools to enter and manage user-configurable lookup or master data.
  |-  
  |-  
   | style="padding:5px; width:500px;" |[https://www.astm.org/Standards/E1578.htm ASTM E1578-18 S-1-2]
   | style="padding:5px; width:500px;" |[https://www.astm.org/e1578-18.html ASTM E1578-18 S-1-2]
   | style="background-color:white;" |'''32.2''' The system shall allow authorized users to configure the specification limits for sample and instrument tests.
   | style="background-color:white;" |'''32.2''' The system shall allow authorized users to configure the specification limits for sample and instrument tests.
  |-  
  |-  
Line 17: Line 17:
   | style="background-color:white;" |'''32.3''' The system shall allow system nomenclature to be configured to use specific data code sets—such as the International Classification of Diseases or the Healthcare Common Procedure Coding System—or mandated terminology to support regulatory requirements.
   | style="background-color:white;" |'''32.3''' The system shall allow system nomenclature to be configured to use specific data code sets—such as the International Classification of Diseases or the Healthcare Common Procedure Coding System—or mandated terminology to support regulatory requirements.
  |-  
  |-  
   | style="padding:5px; width:500px;" |[https://www.astm.org/Standards/E1578.htm ASTM E1578-18 S-1-3]
   | style="padding:5px; width:500px;" |[https://www.astm.org/e1578-18.html ASTM E1578-18 S-1-3]
   | style="background-color:white;" |'''32.4''' The system should allow authorized personnel to configure the review and approval of multiple tests at the sample, batch, project, and experiment levels.
   | style="background-color:white;" |'''32.4''' The system should allow authorized personnel to configure the review and approval of multiple tests at the sample, batch, project, and experiment levels.
  |-  
  |-  
   | style="padding:5px; width:500px;" |[https://www.astm.org/Standards/E1578.htm ASTM E1578-18 S-1-4]
   | style="padding:5px; width:500px;" |[https://www.astm.org/e1578-18.html ASTM E1578-18 S-1-4]
   | style="background-color:white;" |'''32.5''' The system should allow warning and material specification limits to be entered and configured so as to allow their comparison against entered results and determinations for determining whether the results meet those specifications or limits.
   | style="background-color:white;" |'''32.5''' The system should allow warning and material specification limits to be entered and configured so as to allow their comparison against entered results and determinations for determining whether the results meet those specifications or limits.
  |-  
  |-  
Line 26: Line 26:
   | style="background-color:white;" |'''32.6''' The system should provide a configurable means of allowing the system to automatically save after each entry to help meet ALCOA, CGMP, and other requirements to contemporaneously record data into records.
   | style="background-color:white;" |'''32.6''' The system should provide a configurable means of allowing the system to automatically save after each entry to help meet ALCOA, CGMP, and other requirements to contemporaneously record data into records.
  |-  
  |-  
   | style="padding:5px; width:500px;" |[https://www.law.cornell.edu/cfr/text/40/3.10 40 CFR Part 3.10]<br />[https://www.law.cornell.edu/cfr/text/40/3.2000 40 CFR Part 3.2000]<br />[https://www.astm.org/Standards/E1578.htm ASTM E1578-18 S-1-5]
   | style="padding:5px; width:500px;" |
[https://www.law.cornell.edu/cfr/text/40/3.10 40 CFR Part 3.10]<br />
[https://www.law.cornell.edu/cfr/text/40/3.2000 40 CFR Part 3.2000]<br />
[https://www.acmg.net/ACMG/Medical-Genetics-Practice-Resources/Genetics_Lab_Standards/ACMG/Medical-Genetics-Practice-Resources/Genetics_Lab_Standards.aspx ACMG Technical Standards for Clinical Genetics Laboratories C13.3]<br />
[https://www.astm.org/e1578-18.html ASTM E1578-18 S-1-5]<br />
[https://csrc.nist.gov/publications/detail/sp/800-53/rev-5/final NIST 800-53, Rev. 5, AU-10]<br />
[https://www.gmp-compliance.org/guidelines/gmp-guideline/who-guidance-on-good-data-and-record-management-practices WHO Technical Report Series, #996, Annex 5, Appendix 1]
   | style="background-color:white;" |'''32.7''' The system should provide a configurable (based on sample, test, or both) means of permitting electronic signatures for both entered results and approved reports.
   | style="background-color:white;" |'''32.7''' The system should provide a configurable (based on sample, test, or both) means of permitting electronic signatures for both entered results and approved reports.
  |-  
  |-  
   | style="padding:5px; width:500px;" |[https://www.astm.org/Standards/E1578.htm ASTM E1578-18 S-1-6]
   | style="padding:5px; width:500px;" |[https://www.astm.org/e1578-18.html ASTM E1578-18 S-1-6]
   | style="background-color:white;" |'''32.8''' The system should be capable of providing a complete list of all tests loaded in the system, the amount of material required for each test, and to which location the samples are to be sent for testing.
   | style="background-color:white;" |'''32.8''' The system should be capable of providing a complete list of all pending tests loaded in the system, the amount of material required for each test, and to which location the associated samples are to be sent for testing.
  |-  
  |-  
   | style="padding:5px; width:500px;" |[https://www.astm.org/Standards/E1578.htm ASTM E1578-18 S-1-7]
   | style="padding:5px; width:500px;" |[https://www.astm.org/e1578-18.html ASTM E1578-18 S-1-7]
   | style="background-color:white;" |'''32.9''' The system shall support configurable laboratory workflows based on appropriate laboratory process and procedure.
   | style="background-color:white;" |'''32.9''' The system shall support configurable laboratory workflows based on appropriate laboratory process and procedure.
  |-  
  |-  
   | style="padding:5px; width:500px;" |[https://www.astm.org/Standards/E1578.htm ASTM E1578-18 S-1-8]
   | style="padding:5px; width:500px;" |[https://www.astm.org/e1578-18.html ASTM E1578-18 S-1-8]
   | style="background-color:white;" |'''32.10''' The system shall allow authorized personnel to assign status values for purposes of tracking sample progress or other portions of laboratory workflow.
   | style="background-color:white;" |'''32.10''' The system shall allow authorized personnel to assign status values for purposes of tracking sample progress or other portions of laboratory workflow.
  |-  
  |-  
   | style="padding:5px; width:500px;" |[https://www.law.cornell.edu/cfr/text/21/211.68 21 CFR Part 211.68]<br />[https://www.astm.org/Standards/E1578.htm ASTM E1578-18 S-1-9]
   | style="padding:5px; width:500px;" |[https://www.law.cornell.edu/cfr/text/21/211.68 21 CFR Part 211.68]<br />[https://www.aphl.org/aboutAPHL/publications/Documents/GH-2019May-LIS-Guidebook-web.pdf APHL 2019 LIS Project Management Guidebook]<br />[https://www.astm.org/e1578-18.html ASTM E1578-18 S-1-9]
   | style="background-color:white;" |'''32.11''' The system should allow authorized personnel to perform revision control of lookup or master data.
   | style="background-color:white;" |'''32.11''' The system should allow authorized personnel to perform revision control of lookup or master data.
  |-  
  |-  
   | style="padding:5px; width:500px;" |[https://www.astm.org/Standards/E1578.htm ASTM E1578-18 S-1-10]
   | style="padding:5px; width:500px;" |[https://www.astm.org/e1578-18.html ASTM E1578-18 S-1-10]<br />[https://www.aphl.org/aboutAPHL/publications/Documents/GH-2019May-LIS-Guidebook-web.pdf APHL 2019 LIS Project Management Guidebook]
   | style="background-color:white;" |'''32.12''' The system should provide a means for importing lookup or master data.
   | style="background-color:white;" |'''32.12''' The system should provide a means for importing lookup or master data.
  |-  
  |-  
   | style="padding:5px; width:500px;" |
   | style="padding:5px; width:500px;" |
[https://www.aihaaccreditedlabs.org/Policies/Pages/default.aspx AIHA-LAP Policies 2018 2A.7.8.4]<br />
[https://www.aihaaccreditedlabs.org/policies AIHA-LAP Policies 2022 2A.7.8.4]<br />
[https://www.astm.org/Standards/E1578.htm ASTM E1578-18 S-1-11]<br />
[https://www.astm.org/e1578-18.html ASTM E1578-18 S-1-11]<br />
[https://www.epa.gov/sites/production/files/documents/erln_lab_requirements.pdf EPA ERLN Laboratory Requirements 4.11.6]<br />
[https://www.epa.gov/sites/production/files/documents/erln_lab_requirements.pdf EPA ERLN Laboratory Requirements 4.11.6]<br />
[https://www.ams.usda.gov/datasets/pdp/pdp-standard-operating-procedures USDA Data and Instrumentation for PDP 9.1]
[https://www.ams.usda.gov/datasets/pdp/pdp-standard-operating-procedures USDA Data and Instrumentation for PDP 9.1]
   | style="background-color:white;" |'''32.13''' The system shall be able to define the number of significant figures (i.e., set rounding rules) for reported numeric data.
   | style="background-color:white;" |'''32.13''' The system shall be able to define the number of significant figures (i.e., set rounding rules) for reported numeric data.
  |-  
  |-  
   | style="padding:5px; width:500px;" |[https://www.astm.org/Standards/E1578.htm ASTM E1578-18 S-1-12]
   | style="padding:5px; width:500px;" |[https://www.astm.org/e1578-18.html ASTM E1578-18 S-1-12]
   | style="background-color:white;" |'''32.14''' The system should allow calculated limits to be created and managed based on test results and relevant metadata.
   | style="background-color:white;" |'''32.14''' The system should allow calculated limits to be created and managed based on test results and relevant metadata.
  |-  
  |-  
   | style="padding:5px; width:500px;" |[https://www.astm.org/Standards/E1578.htm ASTM E1578-18 S-1-13]<br />[https://www.epa.gov/sites/production/files/documents/erln_lab_requirements.pdf EPA ERLN Laboratory Requirements 3.2.6]<br />[https://www.epa.gov/sites/production/files/documents/erln_lab_requirements.pdf EPA ERLN Laboratory Requirements 4.9.11]
   | style="padding:5px; width:500px;" |[https://www.astm.org/e1578-18.html ASTM E1578-18 S-1-13]<br />[https://www.epa.gov/sites/production/files/documents/erln_lab_requirements.pdf EPA ERLN Laboratory Requirements 3.2.6]<br />[https://www.epa.gov/sites/production/files/documents/erln_lab_requirements.pdf EPA ERLN Laboratory Requirements 4.9.11]
   | style="background-color:white;" |'''32.15''' The system should provide a clear alert or notification upon entry of out-of-specification results.
   | style="background-color:white;" |'''32.15''' The system should provide a clear alert or notification upon entry of out-of-specification results.
  |-  
  |-  
   | style="padding:5px; width:500px;" |[https://www.astm.org/Standards/E1578.htm ASTM E1578-18 S-1-14]
   | style="padding:5px; width:500px;" |[https://www.astm.org/e1578-18.html ASTM E1578-18 S-1-14]
   | style="background-color:white;" |'''32.16''' The system shall allow authorized personnel to update static and dynamic data.
   | style="background-color:white;" |'''32.16''' The system shall allow authorized personnel to update static and dynamic data.
  |-  
  |-  
   | style="padding:5px; width:500px;" |[https://www.astm.org/Standards/E1578.htm ASTM E1578-18 S-1-15]
   | style="padding:5px; width:500px;" |[https://www.astm.org/e1578-18.html ASTM E1578-18 S-1-15]
   | style="background-color:white;" |'''32.17''' The system should allow workflow events and status changes to trigger one or more user-defined actions.
   | style="background-color:white;" |'''32.17''' The system should allow workflow events and status changes to trigger one or more user-defined actions.
  |-  
  |-  
   | style="padding:5px; width:500px;" |[https://www.astm.org/Standards/E1578.htm ASTM E1578-18 S-1-17]<br />
   | style="padding:5px; width:500px;" |[https://www.astm.org/e1578-18.html ASTM E1578-18 S-1-17]<br />[https://www.fbi.gov/services/cjis/cjis-security-policy-resource-center CJIS Security Policy 5.7.1]<br />[https://csrc.nist.gov/publications/detail/sp/800-53/rev-5/final NIST 800-53, Rev. 5, AC-6(1)]<br />[https://csrc.nist.gov/publications/detail/sp/800-53/rev-5/final NIST 800-53, Rev. 5, CM-7]
[https://www.fbi.gov/services/cjis/cjis-security-policy-resource-center CJIS Security Policy 5.7.1]<br />
[https://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf NIST 800-53, Rev. 4, AC-6(1)]<br />
[https://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf NIST 800-53, Rev. 4, CM-7]
   | style="background-color:white;" |'''32.18''' The system should provide an interface for administrative access that permits approved users to configure the system without extra programming or manipulation of data storage systems.
   | style="background-color:white;" |'''32.18''' The system should provide an interface for administrative access that permits approved users to configure the system without extra programming or manipulation of data storage systems.
  |-  
  |-  
   | style="padding:5px; width:500px;" |[https://www.astm.org/Standards/E1578.htm ASTM E1578-18 S-1-18]
   | style="padding:5px; width:500px;" |[https://www.astm.org/e1578-18.html ASTM E1578-18 S-1-18]<br />[https://elss.cap.org/elss/ShowProperty?nodePath=/UCMCON/Contribution%20Folders/DctmContent/education/OnlineCourseContent/2017/LAP-TLTM/misc/lam.pdf CAP Laboratory Accreditation Manual]
   | style="background-color:white;" |'''32.19''' The system should allow administrators to programmatically customize system modules or build calculations within the application.
   | style="background-color:white;" |'''32.19''' The system should allow administrators to programmatically customize system modules or build calculations within the application, while also accurately documenting those system modifications.
  |-  
  |-  
   | style="padding:5px; width:500px;" |[https://www.astm.org/Standards/E1578.htm ASTM E1578-18 S-1-19]
   | style="padding:5px; width:500px;" |[https://www.astm.org/e1578-18.html ASTM E1578-18 S-1-19]
   | style="background-color:white;" |'''32.20''' The system should provide a multiuser interface that can be configured to local user needs, including display language, character sets, and time zones.
   | style="background-color:white;" |'''32.20''' The system should provide a multiuser interface that can be configured to local user needs, including display language, character sets, and time zones.
  |-  
  |-  
   | style="padding:5px; width:500px;" |[https://www.law.cornell.edu/cfr/text/21/11.100 21 CFR Part 11.100 (a)]<br />
   | style="padding:5px; width:500px;" |
[https://www.astm.org/Standards/E1578.htm ASTM E1578-18 S-1-20]<br />
[https://www.law.cornell.edu/cfr/text/21/11.100 21 CFR Part 11.100 (a)]<br />
[https://www.astm.org/e1578-18.html ASTM E1578-18 S-1-20]<br />
[https://ec.europa.eu/health/sites/health/files/files/eudralex/vol-4/annex11_01-2011_en.pdf E.U. Annex 11-14]<br />
[https://ec.europa.eu/health/sites/health/files/files/eudralex/vol-4/annex11_01-2011_en.pdf E.U. Annex 11-14]<br />
[https://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf NIST 800-53, Rev. 4, CM-5(1)]
[https://csrc.nist.gov/publications/detail/sp/800-53/rev-5/final NIST 800-53, Rev. 5, CM-5(1)]<br />
[https://www.gmp-compliance.org/guidelines/gmp-guideline/who-guidance-on-good-data-and-record-management-practices WHO Technical Report Series, #996, Annex 5, Appendix 1]
   | style="background-color:white;" |'''32.21''' The system should support rules governing electronic records and electronic signatures in regulated environments.
   | style="background-color:white;" |'''32.21''' The system should support rules governing electronic records and electronic signatures in regulated environments.
  |-  
  |-  
   | style="padding:5px; width:500px;" |
   | style="padding:5px; width:500px;" |
[https://www.law.cornell.edu/cfr/text/7/332.11 7 CFR Part 332.11]<br />
[https://www.law.cornell.edu/cfr/text/7/331.11 7 CFR Part 331.11]<br />
[https://www.law.cornell.edu/cfr/text/9/121.11 9 CFR Part 121.11]<br />
[https://www.law.cornell.edu/cfr/text/9/121.11 9 CFR Part 121.11]<br />
[https://www.law.cornell.edu/cfr/text/10/20.2110 10 CFR Part 20.2110]<br />
[https://www.law.cornell.edu/cfr/text/10/30.51 10 CFR Part 30.51 (c-1]<br />
[https://www.law.cornell.edu/cfr/text/21/11.10 21 CFR Part 11.10 (d)]<br />
[https://www.law.cornell.edu/cfr/text/21/11.10 21 CFR Part 11.10 (d)]<br />
[https://www.law.cornell.edu/cfr/text/21/211.68 21 CFR Part 211.68]<br />
[https://www.law.cornell.edu/cfr/text/21/211.68 21 CFR Part 211.68]<br />
[https://www.law.cornell.edu/cfr/text/42/73.11 42 CFR Part 73.11]<br />
[https://www.law.cornell.edu/cfr/text/42/73.11 42 CFR Part 73.11]<br />
[https://www.law.cornell.edu/cfr/text/45/164.308 45 CFR Part 164.308]<br />
[https://www.law.cornell.edu/cfr/text/45/164.308 45 CFR Part 164.308]<br />
[https://www.uslegalforms.com/form-library/256001-c211-specific-checklist-combined-iso-iec-17025-and-veterinary-laboratory-accreditation A2LA C211 4.13.1.4]<br />
[https://www.uslegalforms.com/form-library/256001-c211-specific-checklist-combined-iso-iec-17025-and-veterinary-laboratory-accreditation A2LA C211 5.4.7.2]<br />
[https://www.aavld.org/accreditation-requirements-page AAVLD Requirements for an AVMDL Sec. 4.10.1.3–4]<br />
[https://www.aavld.org/accreditation-requirements-page AAVLD Requirements for an AVMDL Sec. 4.10.1.3–4]<br />
[https://www.aavld.org/accreditation-requirements-page AAVLD Requirements for an AVMDL Sec. 5.4.4.1]<br />
[https://www.aavld.org/accreditation-requirements-page AAVLD Requirements for an AVMDL Sec. 5.4.4.1]<br />
[http://des.wa.gov/sites/default/files/public/documents/About/1063/RFP/Add7_Item4ASCLD.pdf ASCLD/LAB Supp. Reqs. for the Accreditation of Forensic Science Testing Laboratories 5.4.7.2.1]<br />
[https://www.acmg.net/ACMG/Medical-Genetics-Practice-Resources/Genetics_Lab_Standards/ACMG/Medical-Genetics-Practice-Resources/Genetics_Lab_Standards.aspx ACMG Technical Standards for Clinical Genetics Laboratories C5.3]<br />
[https://www.astm.org/Standards/E1492.htm ASTM E1492-11 4.2.4]<br />
[https://des.wa.gov/sites/default/files/public/documents/About/1063/RFP/Add7_Item4ASCLD.pdf ASCLD/LAB Supp. Reqs. for the Accreditation of Forensic Science Testing Laboratories 5.4.7.2.1]<br />
[https://www.astm.org/Standards/E1578.htm ASTM E1578-18 S-1-16]<br />
[https://www.astm.org/e1492-11r17.html ASTM E1492-11 4.2.4]<br />
[https://www.astm.org/Standards/E1578.htm ASTM E1578-18 S-1-21]<br />
[https://www.astm.org/e1578-18.html ASTM E1578-18 S-1-16]<br />
[https://www.astm.org/e1578-18.html ASTM E1578-18 S-1-21]<br />
[https://www.fbi.gov/services/cjis/cjis-security-policy-resource-center CJIS Security Policy 5.5.2]<br />
[https://www.fbi.gov/services/cjis/cjis-security-policy-resource-center CJIS Security Policy 5.5.2]<br />
[https://clsi.org/standards/products/quality-management-systems/documents/qms22/ CLSI QMS22 2.4.3]<br />
[https://ec.europa.eu/health/sites/health/files/files/eudralex/vol-4/annex11_01-2011_en.pdf E.U. Annex 11-12]<br />
[https://ec.europa.eu/health/sites/health/files/files/eudralex/vol-4/annex11_01-2011_en.pdf E.U. Annex 11-12]<br />
[https://nepis.epa.gov/Exe/ZyPDF.cgi?Dockey=30006MXP.PDF EPA 815-R-05-004 Chap. IV, Sec. 8.6]<br />
[https://nepis.epa.gov/Exe/ZyPDF.cgi?Dockey=30006MXP.PDF EPA 815-R-05-004 Chap. IV, Sec. 8.6]<br />
Line 100: Line 111:
[https://www.epa.gov/sites/production/files/documents/erln_lab_requirements.pdf EPA ERLN Laboratory Requirements 4.1.14–15]<br />
[https://www.epa.gov/sites/production/files/documents/erln_lab_requirements.pdf EPA ERLN Laboratory Requirements 4.1.14–15]<br />
[https://www.epa.gov/sites/production/files/documents/erln_lab_requirements.pdf EPA ERLN Laboratory Requirements 4.9.4 and 4.9.14]<br />
[https://www.epa.gov/sites/production/files/documents/erln_lab_requirements.pdf EPA ERLN Laboratory Requirements 4.9.4 and 4.9.14]<br />
[https://ichgcp.net/ ICH GCP 2.10]<br />
[https://www.iso.org/standard/66912.html ISO/IEC 17025:2017 4.2.1]<br />
[https://www.iso.org/standard/66912.html ISO/IEC 17025:2017 7.11.3]<br />
[https://www.iso.org/standard/66912.html ISO/IEC 17025:2017 7.11.3]<br />
[https://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf NIST 800-53, Rev. 4, CM-5 and CM-5(1)]<br />
[https://csrc.nist.gov/publications/detail/sp/800-53/rev-5/final NIST 800-53, Rev. 5, CM-5 and CM-5(1)]<br />
[https://www.wadsworth.org/regulatory/clep/clinical-labs/laboratory-standards NYSDOH CLEP Clinical Laboratory Standards of Practice, General Systems Standards]<br />
[https://www.pfp-ifss.org/ifss-resources/human-and-animal-food-testing-laboratories-best-practices-manual-december-2018/ PFP Human and Animal Food Testing Laboratories Best Practices Manual]<br />
[https://ris.dls.virginia.gov/uploads/1VAC30/dibr/Microsoft%20Word%20-%20STD-ELV1-2016-Rev2.1_LabReqs_ANSIapp.doc-20210426142653.pdf TNI EL-V1-2016-Rev.2.1 (V1,M2 4.13.1.4]<br />
[https://www.ams.usda.gov/datasets/pdp/pdp-standard-operating-procedures USDA Administrative Procedures for the PDP 5.2.4]<br />
[https://www.ams.usda.gov/datasets/pdp/pdp-standard-operating-procedures USDA Administrative Procedures for the PDP 5.2.4]<br />
[https://extranet.who.int/prequal/content/who-technical-report-seriesWHO Technical Report Series, #986, Annex 2, 15.9]
[https://www.wada-ama.org/en/resources/world-anti-doping-program/international-standard-laboratories-isl WADA International Standard for Laboratories (ISL) 5.2.3.5]<br />
[https://www.who.int/medicines/areas/quality_safety/quality_assurance/expert_committee/trs_986/en/ WHO Technical Report Series, #986, Annex 2, 15.9]
   | style="background-color:white;" |'''32.22''' The system shall provide a security interface usable across all modules of the system that secures data and operations and prevents unauthorized access to data and functions.
   | style="background-color:white;" |'''32.22''' The system shall provide a security interface usable across all modules of the system that secures data and operations and prevents unauthorized access to data and functions.
  |-  
  |-  
   | style="padding:5px; width:500px;" |[https://www.fbi.gov/services/cjis/cjis-security-policy-resource-center CJIS Security Policy 5.5.2.2–3]<br /[https://www.epa.gov/sites/production/files/documents/erln_lab_requirements.pdf EPA ERLN Laboratory Requirements 4.1.14–15]<br />
   | style="padding:5px; width:500px;" |
[https://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf NIST 800-53, Rev. 4, AC-2(11)]
[https://cdn.scsglobalservices.com/files/program_documents/brc_food_standard_8_0.pdf BRC GSFS, Issue 8, 3.2.1]<br />
[https://cdn.scsglobalservices.com/files/program_documents/brc_food_standard_8_0.pdf BRC GSFS, Issue 8, 3.3.1]<br />
[https://www.fbi.gov/services/cjis/cjis-security-policy-resource-center CJIS Security Policy 5.5.2.2–3]<br />
[https://www.epa.gov/sites/production/files/documents/erln_lab_requirements.pdf EPA ERLN Laboratory Requirements 4.1.14–15]<br />
[https://csrc.nist.gov/publications/detail/sp/800-53/rev-5/final NIST 800-53, Rev. 5, AC-2(11)]
   | style="background-color:white;" |'''32.23''' The system shall be able to granularly define access control down to the object level, role level, physical location, logical location, network address, and chronometric restriction level for the protection of regulated, patented, confidential, and classified data, methods, or other types of information.
   | style="background-color:white;" |'''32.23''' The system shall be able to granularly define access control down to the object level, role level, physical location, logical location, network address, and chronometric restriction level for the protection of regulated, patented, confidential, and classified data, methods, or other types of information.
  |-  
  |-  
   | style="padding:5px; width:500px;" |[https://www.astm.org/Standards/E1578.htm ASTM E1578-18 S-1-22]<br />[https://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf NIST 800-53, Rev. 4, IA-2(10)]
   | style="padding:5px; width:500px;" |[https://www.astm.org/e1578-18.html ASTM E1578-18 S-1-22]<br />[https://csrc.nist.gov/publications/detail/sp/800-53/rev-5/final NIST 800-53, Rev. 5, IA-2(10)]
   | style="background-color:white;" |'''32.24''' The system should support single sign-on such that a user can log in once and access all permitted functions and data.
   | style="background-color:white;" |'''32.24''' The system should support single sign-on such that a user can log in once and access all permitted functions and data.
  |-  
  |-  
Line 117: Line 138:
[https://www.law.cornell.edu/cfr/text/45/164.312 45 CFR Part 164.312]<br />
[https://www.law.cornell.edu/cfr/text/45/164.312 45 CFR Part 164.312]<br />
[https://www.law.cornell.edu/cfr/text/45/170.315 45 CFR Part 170.315 (d)]<br />
[https://www.law.cornell.edu/cfr/text/45/170.315 45 CFR Part 170.315 (d)]<br />
[http://des.wa.gov/sites/default/files/public/documents/About/1063/RFP/Add7_Item4ASCLD.pdf ASCLD/LAB Supp. Reqs. for the Accreditation of Forensic Science Testing Laboratories 5.4.7.2.1]<br />
[https://www.aphl.org/aboutAPHL/publications/Documents/GH-2019May-LIS-Guidebook-web.pdf APHL 2019 LIS Project Management Guidebook]<br />
[https://www.astm.org/Standards/E1578.htm ASTM E1578-18 E17-5 and S-3-1]<br />
[https://des.wa.gov/sites/default/files/public/documents/About/1063/RFP/Add7_Item4ASCLD.pdf ASCLD/LAB Supp. Reqs. for the Accreditation of Forensic Science Testing Laboratories 5.4.7.2.1]<br />
[https://www.astm.org/e1578-18.html ASTM E1578-18 E17-5 and S-3-1]<br />
[https://www.fbi.gov/services/cjis/cjis-security-policy-resource-center CJIS Security Policy 5.6.1]<br />
[https://www.fbi.gov/services/cjis/cjis-security-policy-resource-center CJIS Security Policy 5.6.1]<br />
[https://clsi.org/standards/products/quality-management-systems/documents/qms22/ CLSI QMS22 2.4.2.2]<br />
[https://ec.europa.eu/health/sites/health/files/files/eudralex/vol-4/annex11_01-2011_en.pdf E.U. Annex 11-14]<br />
[https://ec.europa.eu/health/sites/health/files/files/eudralex/vol-4/annex11_01-2011_en.pdf E.U. Annex 11-14]<br />
[https://nepis.epa.gov/Exe/ZyPDF.cgi?Dockey=30006MXP.PDF EPA 815-R-05-004 Chap. IV, Sec. 8.6]<br />
[https://nepis.epa.gov/Exe/ZyPDF.cgi?Dockey=30006MXP.PDF EPA 815-R-05-004 Chap. IV, Sec. 8.6]<br />
Line 126: Line 149:
[https://www.epa.gov/sites/production/files/documents/erln_lab_requirements.pdf EPA ERLN Laboratory Requirements 4.9.4]<br />
[https://www.epa.gov/sites/production/files/documents/erln_lab_requirements.pdf EPA ERLN Laboratory Requirements 4.9.4]<br />
[https://www.iso.org/standard/56115.html ISO 15189:2012 5.10.3]<br />
[https://www.iso.org/standard/56115.html ISO 15189:2012 5.10.3]<br />
[https://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf NIST 800-53, Rev. 4, AC-2(7) and AC-3]<br />
[https://csrc.nist.gov/publications/detail/sp/800-53/rev-5/final NIST 800-53, Rev. 5, AC-2(7) and AC-3]<br />
[https://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf NIST 800-53, Rev. 4, IA-2, IA-5, and IA-8]<br />
[https://csrc.nist.gov/publications/detail/sp/800-53/rev-5/final NIST 800-53, Rev. 5, IA-2, IA-5, and IA-8]<br />
[https://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf NIST 800-53, Rev. 4, MA-4]<br />
[https://csrc.nist.gov/publications/detail/sp/800-53/rev-5/final NIST 800-53, Rev. 5, MA-4]<br />
[https://extranet.who.int/prequal/content/who-technical-report-series WHO Technical Report Series, #986, Annex 2, 15.9]
[https://www.wada-ama.org/en/resources/world-anti-doping-program/international-standard-laboratories-isl WADA International Standard for Laboratories (ISL) 5.2.3.5]<br />
[https://extranet.who.int/prequal/content/who-technical-report-series WHO Technical Report Series, #986, Annex 2, 15.9]<br />
[https://www.gmp-compliance.org/guidelines/gmp-guideline/who-guidance-on-good-data-and-record-management-practices WHO Technical Report Series, #996, Annex 5, Appendix 1]
   | style="background-color:white;" |'''32.25''' The system shall provide initial login access using at least two unique identification components, e.g., a user identifier and password, or biometric information linked to and used by the genuine user.
   | style="background-color:white;" |'''32.25''' The system shall provide initial login access using at least two unique identification components, e.g., a user identifier and password, or biometric information linked to and used by the genuine user.
  |-  
  |-  
   | style="padding:5px; width:500px;" |
   | style="padding:5px; width:500px;" |
[https://www.law.cornell.edu/cfr/text/21/11.300 21 CFR Part 11.300 (a)]<br />
[https://www.law.cornell.edu/cfr/text/21/11.300 21 CFR Part 11.300 (a)]<br />
[https://www.astm.org/Standards/E1578.htm ASTM E1578-18 E17-5 and S-3-1]<br />
[https://www.astm.org/e1578-18.html ASTM E1578-18 E17-5 and S-3-1]<br />
[https://nepis.epa.gov/Exe/ZyPDF.cgi?Dockey=30006MXP.PDF EPA 815-R-05-004 Chap. IV, Sec. 8.6]<br />
[https://nepis.epa.gov/Exe/ZyPDF.cgi?Dockey=30006MXP.PDF EPA 815-R-05-004 Chap. IV, Sec. 8.6]<br />
[https://nepis.epa.gov/Exe/ZyPDF.cgi?Dockey=30006MXP.PDF EPA 815-R-05-004 Chap. VI, Sec. 8.6]<br />
[https://nepis.epa.gov/Exe/ZyPDF.cgi?Dockey=30006MXP.PDF EPA 815-R-05-004 Chap. VI, Sec. 8.6]<br />
[https://www.iso.org/standard/56115.html ISO 15189:2012 5.10.3]<br />
[https://www.iso.org/standard/56115.html ISO 15189:2012 5.10.3]<br />
[https://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf NIST 800-53, Rev. 4, IA-4 and IA-5]
[https://csrc.nist.gov/publications/detail/sp/800-53/rev-5/final NIST 800-53, Rev. 5, IA-4 and IA-5]
   | style="background-color:white;" |'''32.26''' The system shall prevent the same combination of identification components from being used across more than one account.
   | style="background-color:white;" |'''32.26''' The system shall prevent the same combination of identification components from being used across more than one account.
  |-  
  |-  
   | style="padding:5px; width:500px;" |
   | style="padding:5px; width:500px;" |
[https://www.law.cornell.edu/cfr/text/21/11.300 21 CFR Part 11.300 (b)]<br />[https://www.astm.org/Standards/E1578.htm ASTM E1578-18 E17-5 and S-3-1]<br />[https://www.iso.org/standard/56115.html ISO 15189:2012 5.10.3]<br />[https://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf NIST 800-53, Rev. 4, IA-5 and IA-5(1)]
[https://www.law.cornell.edu/cfr/text/21/11.300 21 CFR Part 11.300 (b)]<br />
[https://www.astm.org/e1578-18.html ASTM E1578-18 E17-5 and S-3-1]<br />
[https://clsi.org/standards/products/quality-management-systems/documents/qms22/ CLSI QMS22 2.4.2]<br />
[https://www.iso.org/standard/56115.html ISO 15189:2012 5.10.3]<br />
[https://csrc.nist.gov/publications/detail/sp/800-53/rev-5/final NIST 800-53, Rev. 5, IA-5 and IA-5(1)]
   | style="background-color:white;" |'''32.27''' The system shall allow the administrator to define a time period in days after which a user will be prompted to change their password.
   | style="background-color:white;" |'''32.27''' The system shall allow the administrator to define a time period in days after which a user will be prompted to change their password.
  |-  
  |-  
   | style="padding:5px; width:500px;" |[https://www.fbi.gov/services/cjis/cjis-security-policy-resource-center CJIS Security Policy 5.6.3.1]<br />[https://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf NIST 800-53, Rev. 4, AC-2(3)]<br />
   | style="padding:5px; width:500px;" |[https://www.fbi.gov/services/cjis/cjis-security-policy-resource-center CJIS Security Policy 5.6.3.1]<br />[https://csrc.nist.gov/publications/detail/sp/800-53/rev-5/final NIST 800-53, Rev. 5, AC-2(3)]<br />[https://csrc.nist.gov/publications/detail/sp/800-53/rev-5/final NIST 800-53, Rev. 5, IA-4 and IA-5(1)]<br />[https://csrc.nist.gov/publications/detail/sp/800-53/rev-5/final NIST 800-53, Rev. 5, PS-4]
[https://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf NIST 800-53, Rev. 4, IA-4 and IA-5(1)]<br />
[https://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf NIST 800-53, Rev. 4, PS-4]
   | style="background-color:white;" |'''32.28''' The system shall allow the administrator to define a time period of inactivity for a user identifier, after which it will be disabled and archived.
   | style="background-color:white;" |'''32.28''' The system shall allow the administrator to define a time period of inactivity for a user identifier, after which it will be disabled and archived.
  |-  
  |-  
   | style="padding:5px; width:500px;" |[https://www.fbi.gov/services/cjis/cjis-security-policy-resource-center CJIS Security Policy 5.5.2.2]<br />[https://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf NIST 800-53, Rev. 4, AC-10]
   | style="padding:5px; width:500px;" |[https://www.fbi.gov/services/cjis/cjis-security-policy-resource-center CJIS Security Policy 5.5.2.2]<br />[https://csrc.nist.gov/publications/detail/sp/800-53/rev-5/final NIST 800-53, Rev. 5, AC-10]
   | style="background-color:white;" |'''32.29''' The system shall allow the administrator or authorized personnel to configure the allowance or prevention of multiple concurrent active sessions for one unique user.
   | style="background-color:white;" |'''32.29''' The system shall allow the administrator or authorized personnel to configure the allowance or prevention of multiple concurrent active sessions for one unique user.
  |-  
  |-  
   | style="padding:5px; width:500px;" |[https://www.fbi.gov/services/cjis/cjis-security-policy-resource-center CJIS Security Policy 5.5.4]<br />[https://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf NIST 800-53, Rev. 4, AC-8]
   | style="padding:5px; width:500px;" |[https://www.fbi.gov/services/cjis/cjis-security-policy-resource-center CJIS Security Policy 5.5.4]<br />[https://csrc.nist.gov/publications/detail/sp/800-53/rev-5/final NIST 800-53, Rev. 5, AC-8]
   | style="background-color:white;" |'''32.30''' The system shall allow the administrator or authorized personnel to configure approved system use (e.g., "you are accessing a restricted information system," "system use indicates consent to being monitored, recorded, and audited") and other types of notifications to appear before or after a user logs in to the system. These notifications should remain on the screen until acknowledged by the user.
   | style="background-color:white;" |'''32.30''' The system shall allow the administrator or authorized personnel to configure approved system use (e.g., "you are accessing a restricted information system," "system use indicates consent to being monitored, recorded, and audited") and other types of notifications to appear before or after a user logs in to the system. These notifications should remain on the screen until acknowledged by the user.
  |-  
  |-  
Line 163: Line 190:
[https://www.law.cornell.edu/cfr/text/21/211.188 21 CFR Part 211.188]<br />
[https://www.law.cornell.edu/cfr/text/21/211.188 21 CFR Part 211.188]<br />
[https://www.law.cornell.edu/cfr/text/21/211.194 21 CFR Part 211.194]<br />
[https://www.law.cornell.edu/cfr/text/21/211.194 21 CFR Part 211.194]<br />
[https://www.astm.org/Standards/E1578.htm ASTM E1578-18 E17-5 and S-3-1]<br />
[https://www.uslegalforms.com/form-library/256001-c211-specific-checklist-combined-iso-iec-17025-and-veterinary-laboratory-accreditation A2LA C211 4.13.2.1]<br />
[https://www.astm.org/e1578-18.html ASTM E1578-18 E17-5 and S-3-1]<br />
[https://elss.cap.org/elss/ShowProperty?nodePath=/UCMCON/Contribution%20Folders/DctmContent/education/OnlineCourseContent/2017/LAP-TLTM/misc/lam.pdf CAP Laboratory Accreditation Manual]<br />
[https://www.fbi.gov/services/cjis/cjis-security-policy-resource-center CJIS Security Policy 5.4.1.1]<br />
[https://www.fbi.gov/services/cjis/cjis-security-policy-resource-center CJIS Security Policy 5.4.1.1]<br />
[https://ec.europa.eu/health/sites/health/files/files/eudralex/vol-1/dir_2003_94/dir_2003_94_en.pdf E.U. Commission Directive 2003/94/EC Article 9.2]<br />
[https://clsi.org/standards/products/quality-management-systems/documents/qms22/ CLSI QMS22 2.4.4]<br />
[https://eur-lex.europa.eu/eli/dir/2003/94/oj E.U. Commission Directive 2003/94/EC Article 9.2]<br />
[https://www.iso.org/standard/56115.html ISO 15189:2012 5.10.3]<br />
[https://www.iso.org/standard/56115.html ISO 15189:2012 5.10.3]<br />
[https://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf NIST 800-53, Rev. 4, CM-5(1)]<br />
[https://csrc.nist.gov/publications/detail/sp/800-53/rev-5/final NIST 800-53, Rev. 5, CM-5(1)]<br />
[https://extranet.who.int/prequal/content/who-technical-report-series WHO Technical Report Series, #986, Annex 2, 15.9]
[https://www.wada-ama.org/en/resources/world-anti-doping-program/international-standard-laboratories-isl WADA International Standard for Laboratories (ISL) 5.2.3.5]<br />
   | style="background-color:white;" |'''32.31''' The system shall keep an accurate audit trail of login activities, including failed login attempts and electronic signings.
[https://www.who.int/medicines/areas/quality_safety/quality_assurance/expert_committee/trs_986/en/ WHO Technical Report Series, #986, Annex 2, 15.9]
   | style="background-color:white;" |'''32.31''' The system shall keep an accurate audit trail of login activities, including failed login attempts, unauthorized logins, and electronic signings.
  |-
  |-
   | style="padding:5px; width:500px;" |
   | style="padding:5px; width:500px;" |
[https://www.law.cornell.edu/cfr/text/21/11.300 21 CFR Part 11.300 (d)]<br />
[https://www.law.cornell.edu/cfr/text/21/11.300 21 CFR Part 11.300 (d)]<br />
[https://www.astm.org/Standards/E1578.htm ASTM E1578-18 E17-5 and S-3-1]<br />
[https://www.astm.org/e1578-18.html ASTM E1578-18 E17-5 and S-3-1]<br />
[https://www.fbi.gov/services/cjis/cjis-security-policy-resource-center CJIS Security Policy 5.5.3]<br />
[https://www.fbi.gov/services/cjis/cjis-security-policy-resource-center CJIS Security Policy 5.5.3]<br />
[https://www.iso.org/standard/56115.html ISO 15189:2012 5.10.3]<br />
[https://www.iso.org/standard/56115.html ISO 15189:2012 5.10.3]<br />
[https://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf NIST 800-53, Rev. 4, AC-7]
[https://csrc.nist.gov/publications/detail/sp/800-53/rev-5/final NIST 800-53, Rev. 5, AC-7]
   | style="background-color:white;" |'''32.32''' The system shall allow the administrator or authorized personnel to define the number of failed login attempts before the system locks the user out.
   | style="background-color:white;" |'''32.32''' The system shall allow the administrator or authorized personnel to define the number of failed login attempts before the system locks the user out.
  |-  
  |-  
   | style="padding:5px; width:500px;" |[https://www.law.cornell.edu/cfr/text/21/11.200 21 CFR Part 11.200 (a)]<br />[https://www.astm.org/Standards/E1578.htm ASTM E1578-18 S-3-1]
   | style="padding:5px; width:500px;" |[https://www.law.cornell.edu/cfr/text/21/11.200 21 CFR Part 11.200 (a)]<br />[https://www.astm.org/e1578-18.html ASTM E1578-18 S-3-1]
   | style="background-color:white;" |'''32.33''' The system shall require at least one unique identification component for additional electronic signings (beyond initial login) during a single, continuous session.
   | style="background-color:white;" |'''32.33''' The system shall require at least one unique identification component for additional electronic signings (beyond initial login) during a single, continuous session.
  |-  
  |-  
   | style="padding:5px; width:500px;" |
   | style="padding:5px; width:500px;" |
[https://www.law.cornell.edu/cfr/text/7/332.11 7 CFR Part 332.11]<br />
[https://www.law.cornell.edu/cfr/text/7/331.11 7 CFR Part 331.11]<br />
[https://www.law.cornell.edu/cfr/text/9/121.11 9 CFR Part 121.11]<br />
[https://www.law.cornell.edu/cfr/text/9/121.11 9 CFR Part 121.11]<br />
[https://www.law.cornell.edu/cfr/text/21/11.200 21 CFR Part 11.200 (a)]<br />
[https://www.law.cornell.edu/cfr/text/21/11.200 21 CFR Part 11.200 (a)]<br />
Line 191: Line 222:
[https://www.law.cornell.edu/cfr/text/21/212.50 21 CFR Part 212.50 (c-10)]<br />
[https://www.law.cornell.edu/cfr/text/21/212.50 21 CFR Part 212.50 (c-10)]<br />
[https://www.law.cornell.edu/cfr/text/42/73.11 42 CFR Part 73.11]<br />
[https://www.law.cornell.edu/cfr/text/42/73.11 42 CFR Part 73.11]<br />
[https://www.astm.org/Standards/E1578.htm ASTM E1578-18 S-3-1]<br />
[https://www.astm.org/e1578-18.html ASTM E1578-18 S-3-1]<br />
[https://www.fbi.gov/services/cjis/cjis-security-policy-resource-center CJIS Security Policy 5.6.3.2]<br />
[https://www.fbi.gov/services/cjis/cjis-security-policy-resource-center CJIS Security Policy 5.6.3.2]<br />
[https://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf NIST 800-53, Rev. 4, IA-5]
[https://csrc.nist.gov/publications/detail/sp/800-53/rev-5/final NIST 800-53, Rev. 5, IA-5]
   | style="background-color:white;" |'''32.34''' The vendor shall provide training materials emphasizing the importance of not sharing unique identification components with other individuals and promoting compliance review for ensuring such practices are followed.
   | style="background-color:white;" |'''32.34''' The vendor shall provide training materials emphasizing the importance of not sharing unique identification components with other individuals and promoting compliance review for ensuring such practices are followed.
  |-  
  |-  
   | style="padding:5px; width:500px;" |
   | style="padding:5px; width:500px;" |
[https://www.law.cornell.edu/cfr/text/7/332.11 7 CFR Part 332.11]<br />
[https://www.law.cornell.edu/cfr/text/7/331.11 7 CFR Part 331.11]<br />
[https://www.law.cornell.edu/cfr/text/9/121.11 9 CFR Part 121.11]<br />
[https://www.law.cornell.edu/cfr/text/9/121.11 9 CFR Part 121.11]<br />
[https://www.law.cornell.edu/cfr/text/21/11.10 21 CFR Part 11.10 (d)]<br />
[https://www.law.cornell.edu/cfr/text/21/11.10 21 CFR Part 11.10 (d)]<br />
Line 205: Line 236:
[https://www.law.cornell.edu/cfr/text/45/164.514 45 CFR Part 164.514]<br />
[https://www.law.cornell.edu/cfr/text/45/164.514 45 CFR Part 164.514]<br />
[https://www.law.cornell.edu/cfr/text/45/170.315 45 CFR Part 170.315 (d)]<br />
[https://www.law.cornell.edu/cfr/text/45/170.315 45 CFR Part 170.315 (d)]<br />
[https://www.astm.org/Standards/E1578.htm ASTM E1578-18 S-1-25]<br />
[https://www.astm.org/e1578-18.html ASTM E1578-18 S-1-25]<br />
[https://www.fbi.gov/services/cjis/cjis-security-policy-resource-center CJIS Security Policy 5.5.1]<br />
[https://www.fbi.gov/services/cjis/cjis-security-policy-resource-center CJIS Security Policy 5.5.1]<br />
[https://www.epa.gov/sites/production/files/documents/erln_lab_requirements.pdf EPA ERLN Laboratory Requirements 4.1.14–15]<br />
[https://www.epa.gov/sites/production/files/documents/erln_lab_requirements.pdf EPA ERLN Laboratory Requirements 4.1.14–15]<br />
[https://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf NIST 800-53, Rev. 4, AC-3]<br />
[https://csrc.nist.gov/publications/detail/sp/800-53/rev-5/final NIST 800-53, Rev. 5, AC-3]<br />
[https://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf NIST 800-53, Rev. 4, IA-2, IA-5, and IA-8]
[https://csrc.nist.gov/publications/detail/sp/800-53/rev-5/final NIST 800-53, Rev. 5, IA-2, IA-5, and IA-8]
   | style="background-color:white;" |'''32.35''' The system shall support the ability to initially assign new individual users to system groups, roles, or both.
   | style="background-color:white;" |'''32.35''' The system shall support the ability to initially assign new individual users to system groups, roles, or both.
  |-  
  |-  
Line 215: Line 246:
[https://www.law.cornell.edu/cfr/text/21/11.100 21 CFR Part 11.100 (a)]<br />
[https://www.law.cornell.edu/cfr/text/21/11.100 21 CFR Part 11.100 (a)]<br />
[https://www.law.cornell.edu/cfr/text/45/164.312 45 CFR Part 164.312]<br />
[https://www.law.cornell.edu/cfr/text/45/164.312 45 CFR Part 164.312]<br />
[https://www.astm.org/Standards/E1578.htm ASTM E1578-18 S-1-24]<br />
[https://www.astm.org/e1578-18.html ASTM E1578-18 S-1-24]<br />
[https://ec.europa.eu/health/sites/health/files/files/eudralex/vol-4/annex11_01-2011_en.pdf E.U. Annex 11-14]
[https://ec.europa.eu/health/sites/health/files/files/eudralex/vol-4/annex11_01-2011_en.pdf E.U. Annex 11-14]<br />
[https://csrc.nist.gov/publications/detail/sp/800-53/rev-5/final NIST 800-53, Rev. 5, AU-10 and AU-10(3)]<br />
[https://www.gmp-compliance.org/guidelines/gmp-guideline/who-guidance-on-good-data-and-record-management-practices WHO Technical Report Series, #996, Annex 5, Appendix 1]
   | style="background-color:white;" |'''32.36''' The system shall force a user's electronic signature to be unique and traceable to a specific user's account.
   | style="background-color:white;" |'''32.36''' The system shall force a user's electronic signature to be unique and traceable to a specific user's account.
  |-  
  |-  
   | style="padding:5px; width:500px;" |[https://www.law.cornell.edu/cfr/text/21/11.100 21 CFR Part 11.100 (a)]<br />[https://www.astm.org/Standards/E1578.htm ASTM E1578-18 S-1-24]<br />
   | style="padding:5px; width:500px;" |[https://www.law.cornell.edu/cfr/text/21/11.100 21 CFR Part 11.100 (a)]<br />[https://www.astm.org/e1578-18.html ASTM E1578-18 S-1-24]<br />[https://csrc.nist.gov/publications/detail/sp/800-53/rev-5/final NIST 800-53, Rev. 5, AU-10 and AU-10(3)]
   | style="background-color:white;" |'''32.37''' The system shall prevent the reuse or reassignment of a user's electronic signature.
   | style="background-color:white;" |'''32.37''' The system shall prevent the reuse or reassignment of a user's electronic signature.
  |-  
  |-  
Line 225: Line 258:
   | style="background-color:white;" |'''32.38''' When the system generates a complete and accurate copy of an electronically signed record, it shall also display the printed name of the signer, the date and time of signature execution, and any applicable meaning associated with the signature. This shall be applicable for both electronically displayed and printed copies of the electronic record.
   | style="background-color:white;" |'''32.38''' When the system generates a complete and accurate copy of an electronically signed record, it shall also display the printed name of the signer, the date and time of signature execution, and any applicable meaning associated with the signature. This shall be applicable for both electronically displayed and printed copies of the electronic record.
  |-
  |-
   | style="padding:5px; width:500px;" |[https://www.astm.org/Standards/E1578.htm ASTM E1578-18 S-1-26]
   | style="padding:5px; width:500px;" |
[https://www.astm.org/e1578-18.html ASTM E1578-18 S-1-26]<br />
[https://www.aphl.org/aboutAPHL/publications/Documents/GH-2019May-LIS-Guidebook-web.pdf APHL 2019 LIS Project Management Guidebook]<br />
[https://clsi.org/standards/products/quality-management-systems/documents/qms22/ CLSI QMS22 2.8.5.3]<br />
[https://www.gmp-compliance.org/guidelines/gmp-guideline/who-guidance-on-good-data-and-record-management-practices WHO Technical Report Series, #996, Annex 5, Appendix 1]
   | style="background-color:white;" |'''32.39''' The system should provide a means to migrate static data into the system.
   | style="background-color:white;" |'''32.39''' The system should provide a means to migrate static data into the system.
  |-   
  |-   
   | style="padding:5px; width:500px;" |[https://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf NIST 800-53, Rev. 4, IA-5(1) and IA-5(4)]
   | style="padding:5px; width:500px;" |[https://csrc.nist.gov/publications/detail/sp/800-53/rev-5/final NIST 800-53, Rev. 5, IA-5(1)]<br />[https://clsi.org/standards/products/quality-management-systems/documents/qms22/ CLSI QMS22 2.4.2]
   | style="background-color:white;" |'''32.40''' The system should provide a means for automatically authenticating if a user's proposed password meets the length, complexity, minimum number of changed characters, and other requirements as configured by the administrator or another authorized system user.
   | style="background-color:white;" |'''32.40''' The system should provide a means for automatically authenticating if a user's proposed password meets the length, complexity, minimum number of changed characters, and other requirements as configured by the administrator or another authorized system user.
  |-  
  |-  
   | style="padding:5px; width:500px;" |[https://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf NIST 800-53, Rev. 4, IA-6]
   | style="padding:5px; width:500px;" |[https://csrc.nist.gov/publications/detail/sp/800-53/rev-5/final NIST 800-53, Rev. 5, IA-6]
   | style="background-color:white;" |'''32.41''' The system should provide a means for obscuring authentication feedback as it is entered into the system, e.g., displaying asterisks rather than the typed password or displaying actual typed feedback for a distinctly short period of time before obscuring it.
   | style="background-color:white;" |'''32.41''' The system should provide a means for obscuring authentication feedback as it is entered into the system, e.g., displaying asterisks rather than the typed password or displaying actual typed feedback for a distinctly short period of time before obscuring it.
  |-  
  |-  
|}
|}
|}
|}

Latest revision as of 14:29, 23 June 2023

Regulation, Specification, or Guidance Requirement
ASTM E1578-18 S-1-1
APHL 2019 LIS Project Management Guidebook
32.1 The system shall provide tools to enter and manage user-configurable lookup or master data.
ASTM E1578-18 S-1-2 32.2 The system shall allow authorized users to configure the specification limits for sample and instrument tests.
45 CFR Part 162.1002
USDA Sampling Procedures for PDP 6.3.2
32.3 The system shall allow system nomenclature to be configured to use specific data code sets—such as the International Classification of Diseases or the Healthcare Common Procedure Coding System—or mandated terminology to support regulatory requirements.
ASTM E1578-18 S-1-3 32.4 The system should allow authorized personnel to configure the review and approval of multiple tests at the sample, batch, project, and experiment levels.
ASTM E1578-18 S-1-4 32.5 The system should allow warning and material specification limits to be entered and configured so as to allow their comparison against entered results and determinations for determining whether the results meet those specifications or limits.
21 CFR Part 211.100 (b)
21 CFR Part 211.160 (a)
32.6 The system should provide a configurable means of allowing the system to automatically save after each entry to help meet ALCOA, CGMP, and other requirements to contemporaneously record data into records.

40 CFR Part 3.10
40 CFR Part 3.2000
ACMG Technical Standards for Clinical Genetics Laboratories C13.3
ASTM E1578-18 S-1-5
NIST 800-53, Rev. 5, AU-10
WHO Technical Report Series, #996, Annex 5, Appendix 1

32.7 The system should provide a configurable (based on sample, test, or both) means of permitting electronic signatures for both entered results and approved reports.
ASTM E1578-18 S-1-6 32.8 The system should be capable of providing a complete list of all pending tests loaded in the system, the amount of material required for each test, and to which location the associated samples are to be sent for testing.
ASTM E1578-18 S-1-7 32.9 The system shall support configurable laboratory workflows based on appropriate laboratory process and procedure.
ASTM E1578-18 S-1-8 32.10 The system shall allow authorized personnel to assign status values for purposes of tracking sample progress or other portions of laboratory workflow.
21 CFR Part 211.68
APHL 2019 LIS Project Management Guidebook
ASTM E1578-18 S-1-9
32.11 The system should allow authorized personnel to perform revision control of lookup or master data.
ASTM E1578-18 S-1-10
APHL 2019 LIS Project Management Guidebook
32.12 The system should provide a means for importing lookup or master data.

AIHA-LAP Policies 2022 2A.7.8.4
ASTM E1578-18 S-1-11
EPA ERLN Laboratory Requirements 4.11.6
USDA Data and Instrumentation for PDP 9.1

32.13 The system shall be able to define the number of significant figures (i.e., set rounding rules) for reported numeric data.
ASTM E1578-18 S-1-12 32.14 The system should allow calculated limits to be created and managed based on test results and relevant metadata.
ASTM E1578-18 S-1-13
EPA ERLN Laboratory Requirements 3.2.6
EPA ERLN Laboratory Requirements 4.9.11
32.15 The system should provide a clear alert or notification upon entry of out-of-specification results.
ASTM E1578-18 S-1-14 32.16 The system shall allow authorized personnel to update static and dynamic data.
ASTM E1578-18 S-1-15 32.17 The system should allow workflow events and status changes to trigger one or more user-defined actions.
ASTM E1578-18 S-1-17
CJIS Security Policy 5.7.1
NIST 800-53, Rev. 5, AC-6(1)
NIST 800-53, Rev. 5, CM-7
32.18 The system should provide an interface for administrative access that permits approved users to configure the system without extra programming or manipulation of data storage systems.
ASTM E1578-18 S-1-18
CAP Laboratory Accreditation Manual
32.19 The system should allow administrators to programmatically customize system modules or build calculations within the application, while also accurately documenting those system modifications.
ASTM E1578-18 S-1-19 32.20 The system should provide a multiuser interface that can be configured to local user needs, including display language, character sets, and time zones.

21 CFR Part 11.100 (a)
ASTM E1578-18 S-1-20
E.U. Annex 11-14
NIST 800-53, Rev. 5, CM-5(1)
WHO Technical Report Series, #996, Annex 5, Appendix 1

32.21 The system should support rules governing electronic records and electronic signatures in regulated environments.

7 CFR Part 331.11
9 CFR Part 121.11
10 CFR Part 20.2110
10 CFR Part 30.51 (c-1
21 CFR Part 11.10 (d)
21 CFR Part 211.68
42 CFR Part 73.11
45 CFR Part 164.308
A2LA C211 4.13.1.4
A2LA C211 5.4.7.2
AAVLD Requirements for an AVMDL Sec. 4.10.1.3–4
AAVLD Requirements for an AVMDL Sec. 5.4.4.1
ACMG Technical Standards for Clinical Genetics Laboratories C5.3
ASCLD/LAB Supp. Reqs. for the Accreditation of Forensic Science Testing Laboratories 5.4.7.2.1
ASTM E1492-11 4.2.4
ASTM E1578-18 S-1-16
ASTM E1578-18 S-1-21
CJIS Security Policy 5.5.2
CLSI QMS22 2.4.3
E.U. Annex 11-12
EPA 815-R-05-004 Chap. IV, Sec. 8.6
EPA 815-R-05-004 Chap. VI, Sec. 8.6
EPA ERLN Laboratory Requirements 4.1.14–15
EPA ERLN Laboratory Requirements 4.9.4 and 4.9.14
ICH GCP 2.10
ISO/IEC 17025:2017 4.2.1
ISO/IEC 17025:2017 7.11.3
NIST 800-53, Rev. 5, CM-5 and CM-5(1)
NYSDOH CLEP Clinical Laboratory Standards of Practice, General Systems Standards
PFP Human and Animal Food Testing Laboratories Best Practices Manual
TNI EL-V1-2016-Rev.2.1 (V1,M2 4.13.1.4
USDA Administrative Procedures for the PDP 5.2.4
WADA International Standard for Laboratories (ISL) 5.2.3.5
WHO Technical Report Series, #986, Annex 2, 15.9

32.22 The system shall provide a security interface usable across all modules of the system that secures data and operations and prevents unauthorized access to data and functions.

BRC GSFS, Issue 8, 3.2.1
BRC GSFS, Issue 8, 3.3.1
CJIS Security Policy 5.5.2.2–3
EPA ERLN Laboratory Requirements 4.1.14–15
NIST 800-53, Rev. 5, AC-2(11)

32.23 The system shall be able to granularly define access control down to the object level, role level, physical location, logical location, network address, and chronometric restriction level for the protection of regulated, patented, confidential, and classified data, methods, or other types of information.
ASTM E1578-18 S-1-22
NIST 800-53, Rev. 5, IA-2(10)
32.24 The system should support single sign-on such that a user can log in once and access all permitted functions and data.

21 CFR Part 11.200 (a)
45 CFR Part 164.312
45 CFR Part 170.315 (d)
APHL 2019 LIS Project Management Guidebook
ASCLD/LAB Supp. Reqs. for the Accreditation of Forensic Science Testing Laboratories 5.4.7.2.1
ASTM E1578-18 E17-5 and S-3-1
CJIS Security Policy 5.6.1
CLSI QMS22 2.4.2.2
E.U. Annex 11-14
EPA 815-R-05-004 Chap. IV, Sec. 8.6
EPA 815-R-05-004 Chap. VI, Sec. 7.6
EPA 815-R-05-004 Chap. VI, Sec. 8.6
EPA ERLN Laboratory Requirements 4.9.4
ISO 15189:2012 5.10.3
NIST 800-53, Rev. 5, AC-2(7) and AC-3
NIST 800-53, Rev. 5, IA-2, IA-5, and IA-8
NIST 800-53, Rev. 5, MA-4
WADA International Standard for Laboratories (ISL) 5.2.3.5
WHO Technical Report Series, #986, Annex 2, 15.9
WHO Technical Report Series, #996, Annex 5, Appendix 1

32.25 The system shall provide initial login access using at least two unique identification components, e.g., a user identifier and password, or biometric information linked to and used by the genuine user.

21 CFR Part 11.300 (a)
ASTM E1578-18 E17-5 and S-3-1
EPA 815-R-05-004 Chap. IV, Sec. 8.6
EPA 815-R-05-004 Chap. VI, Sec. 8.6
ISO 15189:2012 5.10.3
NIST 800-53, Rev. 5, IA-4 and IA-5

32.26 The system shall prevent the same combination of identification components from being used across more than one account.

21 CFR Part 11.300 (b)
ASTM E1578-18 E17-5 and S-3-1
CLSI QMS22 2.4.2
ISO 15189:2012 5.10.3
NIST 800-53, Rev. 5, IA-5 and IA-5(1)

32.27 The system shall allow the administrator to define a time period in days after which a user will be prompted to change their password.
CJIS Security Policy 5.6.3.1
NIST 800-53, Rev. 5, AC-2(3)
NIST 800-53, Rev. 5, IA-4 and IA-5(1)
NIST 800-53, Rev. 5, PS-4
32.28 The system shall allow the administrator to define a time period of inactivity for a user identifier, after which it will be disabled and archived.
CJIS Security Policy 5.5.2.2
NIST 800-53, Rev. 5, AC-10
32.29 The system shall allow the administrator or authorized personnel to configure the allowance or prevention of multiple concurrent active sessions for one unique user.
CJIS Security Policy 5.5.4
NIST 800-53, Rev. 5, AC-8
32.30 The system shall allow the administrator or authorized personnel to configure approved system use (e.g., "you are accessing a restricted information system," "system use indicates consent to being monitored, recorded, and audited") and other types of notifications to appear before or after a user logs in to the system. These notifications should remain on the screen until acknowledged by the user.

21 CFR Part 11.300 (d)
21 CFR Part 211.68
21 CFR Part 211.100
21 CFR Part 211.160 (a)
21 CFR Part 211.188
21 CFR Part 211.194
A2LA C211 4.13.2.1
ASTM E1578-18 E17-5 and S-3-1
CAP Laboratory Accreditation Manual
CJIS Security Policy 5.4.1.1
CLSI QMS22 2.4.4
E.U. Commission Directive 2003/94/EC Article 9.2
ISO 15189:2012 5.10.3
NIST 800-53, Rev. 5, CM-5(1)
WADA International Standard for Laboratories (ISL) 5.2.3.5
WHO Technical Report Series, #986, Annex 2, 15.9

32.31 The system shall keep an accurate audit trail of login activities, including failed login attempts, unauthorized logins, and electronic signings.

21 CFR Part 11.300 (d)
ASTM E1578-18 E17-5 and S-3-1
CJIS Security Policy 5.5.3
ISO 15189:2012 5.10.3
NIST 800-53, Rev. 5, AC-7

32.32 The system shall allow the administrator or authorized personnel to define the number of failed login attempts before the system locks the user out.
21 CFR Part 11.200 (a)
ASTM E1578-18 S-3-1
32.33 The system shall require at least one unique identification component for additional electronic signings (beyond initial login) during a single, continuous session.

7 CFR Part 331.11
9 CFR Part 121.11
21 CFR Part 11.200 (a)
21 CFR Part 211.68 (b)
21 CFR Part 211.188 (b-11)
21 CFR Part 211.194 (a-7 and a-8)
21 CFR Part 212.50 (c-10)
42 CFR Part 73.11
ASTM E1578-18 S-3-1
CJIS Security Policy 5.6.3.2
NIST 800-53, Rev. 5, IA-5

32.34 The vendor shall provide training materials emphasizing the importance of not sharing unique identification components with other individuals and promoting compliance review for ensuring such practices are followed.

7 CFR Part 331.11
9 CFR Part 121.11
21 CFR Part 11.10 (d)
42 CFR Part 73.11
42 CFR Part 493.1231
45 CFR Part 164.308
45 CFR Part 164.514
45 CFR Part 170.315 (d)
ASTM E1578-18 S-1-25
CJIS Security Policy 5.5.1
EPA ERLN Laboratory Requirements 4.1.14–15
NIST 800-53, Rev. 5, AC-3
NIST 800-53, Rev. 5, IA-2, IA-5, and IA-8

32.35 The system shall support the ability to initially assign new individual users to system groups, roles, or both.

21 CFR Part 11.100 (a)
45 CFR Part 164.312
ASTM E1578-18 S-1-24
E.U. Annex 11-14
NIST 800-53, Rev. 5, AU-10 and AU-10(3)
WHO Technical Report Series, #996, Annex 5, Appendix 1

32.36 The system shall force a user's electronic signature to be unique and traceable to a specific user's account.
21 CFR Part 11.100 (a)
ASTM E1578-18 S-1-24
NIST 800-53, Rev. 5, AU-10 and AU-10(3)
32.37 The system shall prevent the reuse or reassignment of a user's electronic signature.
21 CFR Part 11.50
E.U. Annex 11-14
32.38 When the system generates a complete and accurate copy of an electronically signed record, it shall also display the printed name of the signer, the date and time of signature execution, and any applicable meaning associated with the signature. This shall be applicable for both electronically displayed and printed copies of the electronic record.

ASTM E1578-18 S-1-26
APHL 2019 LIS Project Management Guidebook
CLSI QMS22 2.8.5.3
WHO Technical Report Series, #996, Annex 5, Appendix 1

32.39 The system should provide a means to migrate static data into the system.
NIST 800-53, Rev. 5, IA-5(1)
CLSI QMS22 2.4.2
32.40 The system should provide a means for automatically authenticating if a user's proposed password meets the length, complexity, minimum number of changed characters, and other requirements as configured by the administrator or another authorized system user.
NIST 800-53, Rev. 5, IA-6 32.41 The system should provide a means for obscuring authentication feedback as it is entered into the system, e.g., displaying asterisks rather than the typed password or displaying actual typed feedback for a distinctly short period of time before obscuring it.