Difference between revisions of "User:Shawndouglas/sandbox/sublevel25"

From LIMSWiki
Jump to navigationJump to search
(Replaced content with "<div class="nonumtoc">__TOC__</div> {{ombox | type = notice | style = width: 960px; | text = This is sublevel25 of my sandbox, where I play with features and...")
Tag: Replaced
 
(32 intermediate revisions by the same user not shown)
Line 1: Line 1:
{|
<div class="nonumtoc">__TOC__</div>
| STYLE="vertical-align:top;"|
{{ombox
{| class="wikitable collapsible" border="1" cellpadding="10" cellspacing="0"
| type      = notice
|-
| style     = width: 960px;
  ! colspan="2" style="text-align:left; padding-left:20px; padding-top:10px; padding-bottom:10px;"|
| text     = This is sublevel25 of my sandbox, where I play with features and test MediaWiki code. If you wish to leave a comment for me, please see [[User_talk:Shawndouglas|my discussion page]] instead.<p></p>
|-
}}
  ! style="color:brown; background-color:#ffffee; width:500px;"| Regulation, Specification, or Guidance
  ! style="color:brown; background-color:#ffffee; width:700px;"| Requirement
|-
  | style="padding:5px; width:500px;" |[https://www.astm.org/e1578-18.html ASTM E1578-18 E-17-1]
  | style="background-color:white;" |'''31.1''' System functionality should support ALCOA principles.
|-
  | style="padding:5px; width:500px;" |
[https://www.astm.org/e1578-18.html ASTM E1578-18 E-17-2]<br />
[https://nepis.epa.gov/Exe/ZyPDF.cgi?Dockey=30006MXP.PDF EPA 815-R-05-004 Chap. IV, Sec. 8]<br />
[https://www.epa.gov/sites/production/files/documents/erln_lab_requirements.pdf EPA ERLN Laboratory Requirements 4.8.6]<br />
[https://www.epa.gov/sites/production/files/documents/erln_lab_requirements.pdf EPA ERLN Laboratory Requirements 4.9.1 and 4.9.7]<br />
[https://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf NIST 800-53, Rev. 4, SI-12]
  | style="background-color:white;" |'''31.2''' The system shall protect entered data so as to prevent it from being obscured by new data, keeping both the old and current data available for review.
|-
  | style="padding:5px; width:500px;" |
[https://www.astm.org/e1578-18.html ASTM E1578-18 E-17-3]<br />
[https://www.law.cornell.edu/cfr/text/21/58.190 21 CFR Part 58.190]<br />
[https://nepis.epa.gov/Exe/ZyPDF.cgi?Dockey=30006MXP.PDF EPA 815-R-05-004 Chap. IV, Sec. 8]<br />
[https://www.epa.gov/sites/production/files/documents/erln_lab_requirements.pdf EPA ERLN Laboratory Requirements 4.3.4.1]<br />
[https://www.epa.gov/sites/production/files/documents/erln_lab_requirements.pdf EPA ERLN Laboratory Requirements 4.8.6]<br />
[https://www.epa.gov/sites/production/files/documents/erln_lab_requirements.pdf EPA ERLN Laboratory Requirements 4.8.9]<br />
[https://www.epa.gov/sites/production/files/documents/erln_lab_requirements.pdf EPA ERLN Laboratory Requirements 4.9.9]<br />
[https://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf NIST 800-53, Rev. 4, SI-12]<br />
[https://www.oecd.org/chemicalsafety/testing/oecdseriesonprinciplesofgoodlaboratorypracticeglpandcompliancemonitoring.htm OECD GLP Principles 10]<br />
[https://www.ams.usda.gov/datasets/pdp/pdp-standard-operating-procedures USDA Administrative Procedures for the PDP 5.2.1]<br />
[https://www.ams.usda.gov/datasets/pdp/pdp-standard-operating-procedures USDA Data and Instrumentation for PDP 8.1.3]
  | style="background-color:white;" |'''31.3''' The system shall maintain a true, readable copy of an instrument's original (raw) data for on-demand review.
|-
  | style="padding:5px; width:500px;" |
[https://www.law.cornell.edu/cfr/text/7/91.30 7 CFR Part 91.30]<br />
[https://www.law.cornell.edu/cfr/text/7/331.17 7 CFR Part 331.17 (c)]<br />
[https://www.law.cornell.edu/cfr/text/9/121.17 9 CFR Part 121.17 (c)]<br />
[https://www.law.cornell.edu/cfr/text/21/11.10 21 CFR Part 11.10 (c)]<br />
[https://www.law.cornell.edu/cfr/text/21/58.195 21 CFR Part 58.195]<br />
[https://www.law.cornell.edu/cfr/text/21/211.180 21 CFR Part 211.180]<br />
[https://www.law.cornell.edu/cfr/text/21/211.110 21 CFR Part 212.110 (c)]<br />
[https://www.law.cornell.edu/cfr/text/21/225.42 21 CFR Part 225.42 (b-8)]<br />
[https://www.law.cornell.edu/cfr/text/21/225.58 21 CFR Part 225.58 (c–d)]<br />
[https://www.law.cornell.edu/cfr/text/21/225.102 21 CFR Part 225.102]<br />
[https://www.law.cornell.edu/cfr/text/21/225.110 21 CFR Part 225.110]<br />
[https://www.law.cornell.edu/cfr/text/21/225.158 21 CFR Part 225.158]<br />
[https://www.law.cornell.edu/cfr/text/21/225.202 21 CFR Part 225.202]<br />
[https://www.law.cornell.edu/cfr/text/21/226.42 21 CFR Part 226.42 (a)]<br />
[https://www.law.cornell.edu/cfr/text/21/226.58 21 CFR Part 226.58 (f)]<br />
[https://www.law.cornell.edu/cfr/text/21/226.102 21 CFR Part 226.102]<br />
[https://www.law.cornell.edu/cfr/text/21/226.115 21 CFR Part 226.115]<br />
[https://www.law.cornell.edu/cfr/text/21/312.57 21 CFR Part 312.57]<br />
[https://www.law.cornell.edu/cfr/text/21/312.62 21 CFR Part 312.62]<br />
[https://www.law.cornell.edu/cfr/text/21/606.160 21 CFR Part 606.160 (d)]<br />
[https://www.law.cornell.edu/cfr/text/21/812.140 21 CFR Part 812.140 (d)]<br />
[https://www.law.cornell.edu/cfr/text/21/820.180 21 CFR Part 820.180 (b)]<br />
[https://www.law.cornell.edu/cfr/text/29/1910.1030 29 CFR Part 1910.1030 (h-2)]<br />
[https://www.law.cornell.edu/cfr/text/40/141.33 40 CFR Part 141.33]<br />
[https://www.law.cornell.edu/cfr/text/40/141.722 40 CFR Part 141.722]<br />
[https://www.law.cornell.edu/cfr/text/40/part-704/subpart-A 40 CFR Part 704 Subpart A]<br />
[https://www.law.cornell.edu/cfr/text/40/717.15 40 CFR Part 717.15 (d)]<br />
[https://www.law.cornell.edu/cfr/text/42/73.17 42 CFR Part 73.17 (c)]<br />
[https://www.law.cornell.edu/cfr/text/42/493.1105 42 CFR Part 493.1105]<br />
[https://www.law.cornell.edu/cfr/text/42/493.1283 42 CFR Part 493.1283]<br />
[https://www.law.cornell.edu/cfr/text/45/164.105 45 CFR Part 164.105]<br />
[https://www.law.cornell.edu/cfr/text/45/164.316 45 CFR Part 164.316]<br />
[https://www.law.cornell.edu/cfr/text/45/164.530 45 CFR Part 164.530]<br />
[https://www.aafco.org/Publications/QA-QC-Guidelines-for-Feed-Laboratories AAFCO QA/QC Guidelines for Feed Laboratories Sec. 2.4.4 or 3.1]<br />
[https://www.aavld.org/accreditation-requirements-page AAVLD Requirements for an AVMDL Sec. 4.10.1.2]<br />
[https://www.aavld.org/accreditation-requirements-page AAVLD Requirements for an AVMDL Sec. 4.10.2.1]<br />
[https://www.aavld.org/accreditation-requirements-page AAVLD Requirements for an AVMDL Sec. 5.4.3.2]<br />
[https://www.abft.org/files/ABFT_LAP_Standards_May_31_2013.pdf ABFT Accreditation Manual Sec. E-33]<br />
[https://www.aihaaccreditedlabs.org/policies AIHA-LAP Policies 2022 2A.7.5.1]<br />
[https://des.wa.gov/sites/default/files/public/documents/About/1063/RFP/Add7_Item4ASCLD.pdf ASCLD/LAB Supp. Reqs. for the Accreditation of Forensic Science Testing Laboratories 4.14.1.2 and 4.15.1.2]<br />
[https://des.wa.gov/sites/default/files/public/documents/About/1063/RFP/Add7_Item4ASCLD.pdf ASCLD/LAB Supp. Reqs. for the Accreditation of Forensic Science Testing Laboratories 5.9.3.6 and 5.9.7]<br />
[https://www.astm.org/e1578-18.html ASTM E1578-18 E-17-4]<br />
[https://www.fbi.gov/services/cjis/cjis-security-policy-resource-center CJIS Security Policy 5.3.4]<br />
[https://www.fbi.gov/services/cjis/cjis-security-policy-resource-center CJIS Security Policy 5.4.6–7]<br />
[https://www.fbi.gov/services/cjis/cjis-security-policy-resource-center CJIS Security Policy 5.5.2.1]<br />
[https://ec.europa.eu/health/sites/health/files/files/eudralex/vol-4/annex11_01-2011_en.pdf E.U. Annex 11-7.1]<br />
[https://eur-lex.europa.eu/eli/dir/2003/94/oj E.U. Commission Directive 2003/94/EC Article 9.1]<br />
[https://eur-lex.europa.eu/eli/dir/2003/94/oj E.U. Commission Directive 2003/94/EC Article 11.4]<br />
[https://nepis.epa.gov/Exe/ZyPDF.cgi?Dockey=30006MXP.PDF EPA 815-R-05-004 Chap. III, Sec. 15]<br />
[https://nepis.epa.gov/Exe/ZyPDF.cgi?Dockey=30006MXP.PDF EPA 815-R-05-004 Chap. IV, Sec. 8]<br />
[https://www.epa.gov/sites/production/files/documents/erln_lab_requirements.pdf EPA ERLN Laboratory Requirements 4.9.18]<br />
[https://www.epa.gov/sites/production/files/documents/erln_lab_requirements.pdf EPA ERLN Laboratory Requirements 4.11.17]<br />
[https://www.epa.gov/quality/guidance-quality-assurance-project-plans-epa-qag-5 EPA QA/G-5 2.1.9]<br />
[https://www.iso.org/standard/56115.html ISO 15189:2012 4.3]<br />
[https://www.iso.org/standard/66912.html ISO/IEC 17025:2017 8.4.2]<br />
[https://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf NIST 800-53, Rev. 4, AT-4]<br />
[https://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf NIST 800-53, Rev. 4, AU-11 and AU-11(1)]<br />
[https://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf NIST 800-53, Rev. 4, SI-12]<br />
[https://www.oecd.org/chemicalsafety/testing/oecdseriesonprinciplesofgoodlaboratorypracticeglpandcompliancemonitoring.htm OECD GLP Principles 10]<br />
[https://www.ams.usda.gov/datasets/pdp/pdp-standard-operating-procedures USDA Administrative Procedures for the PDP 5.4]<br />
[https://www.ams.usda.gov/datasets/pdp/pdp-standard-operating-procedures USDA Sampling Procedures for PDP 6.5]<br />
[https://www.who.int/medicines/areas/quality_safety/quality_assurance/expert_committee/trs_986/en/ WHO Technical Report Series, #986, Annex 2, 15.8–9]
  | style="background-color:white;" |'''31.4''' The system shall have a mechanism to securely retain data in the system for a specific time period and enable protections that ensure the accurate and ready retrieval of that data throughout the records retention period.
|-
  | style="padding:5px; width:500px;" |[https://www.astm.org/e1578-18.html ASTM E1578-18 E-17-6]<br />[https://www.fbi.gov/services/cjis/cjis-security-policy-resource-center CJIS Security Policy 5.4.4]<br />[https://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf NIST 800-53, Rev. 4, AU-8]
  | style="background-color:white;" |'''31.5''' The system shall accurately reflect the system date and time in its use of electronic record time stamps.
|-
  | style="padding:5px; width:500px;" |[https://www.astm.org/e1578-18.html ASTM E1578-18 E-17-7]<br />[https://www.fbi.gov/services/cjis/cjis-security-policy-resource-center CJIS Security Policy 5.6.1]
  | style="background-color:white;" |'''31.6''' The system shall require each and every user to be assigned a unique user ID.
|-
  | style="padding:5px; width:500px;" |
[https://www.astm.org/e1578-18.html ASTM E1578-18 E-17-8]<br />
[https://www.law.cornell.edu/cfr/text/21/11.10 21 CFR Part 11.10 (e)]<br />
[https://www.fbi.gov/services/cjis/cjis-security-policy-resource-center CJIS Security Policy 5.4.5]<br />
[https://ec.europa.eu/health/sites/health/files/files/eudralex/vol-4/annex11_01-2011_en.pdf E.U. Annex 11-9]<br />
[https://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf NIST 800-53, Rev. 4, AU-9]
  | style="background-color:white;" |'''31.7''' The system shall prevent the modification, deletion, or disabling of its audit trail, as well as record such attempts.
|-
  | style="padding:5px; width:500px;" |[https://www.fbi.gov/services/cjis/cjis-security-policy-resource-center CJIS Security Policy 5.4.2]<br />[https://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf NIST 800-53, Rev. 4, AU-5]<br />[https://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf NIST 800-53, Rev. 4, SI-4]
  | style="background-color:white;" |'''31.8''' The system shall be capable of identifying instances of audit processing failure (e.g., write errors, general failure of the audit tool, etc.), sending alerts or notifications to appropriate personnel in such cases.
|-
|}
|}


{|
==Sandbox begins below==
| STYLE="vertical-align:top;"|
{| class="wikitable collapsible" border="1" cellpadding="10" cellspacing="0"
|-
  ! colspan="2" style="text-align:left; padding-left:20px; padding-top:10px; padding-bottom:10px;"|
|-
  ! style="color:brown; background-color:#ffffee; width:500px;"| Regulation, Specification, or Guidance
  ! style="color:brown; background-color:#ffffee; width:700px;"| Requirement
|-
  | style="padding:5px; width:500px;" |[https://www.astm.org/e1578-18.html ASTM E1578-18 S-1-1]
  | style="background-color:white;" |'''32.1''' The system shall provide tools to enter and manage user-configurable lookup or master data.
|-
  | style="padding:5px; width:500px;" |[https://www.astm.org/e1578-18.html ASTM E1578-18 S-1-2]
  | style="background-color:white;" |'''32.2''' The system shall allow authorized users to configure the specification limits for sample and instrument tests.
|-
  | style="padding:5px; width:500px;" |[https://www.law.cornell.edu/cfr/text/45/162.1002 45 CFR Part 162.1002]<br />[https://www.ams.usda.gov/datasets/pdp/pdp-standard-operating-procedures USDA Sampling Procedures for PDP 6.3.2]
  | style="background-color:white;" |'''32.3''' The system shall allow system nomenclature to be configured to use specific data code sets—such as the International Classification of Diseases or the Healthcare Common Procedure Coding System—or mandated terminology to support regulatory requirements.
|-
  | style="padding:5px; width:500px;" |[https://www.astm.org/e1578-18.html ASTM E1578-18 S-1-3]
  | style="background-color:white;" |'''32.4''' The system should allow authorized personnel to configure the review and approval of multiple tests at the sample, batch, project, and experiment levels.
|-
  | style="padding:5px; width:500px;" |[https://www.astm.org/e1578-18.html ASTM E1578-18 S-1-4]
  | style="background-color:white;" |'''32.5''' The system should allow warning and material specification limits to be entered and configured so as to allow their comparison against entered results and determinations for determining whether the results meet those specifications or limits.
|-
  | style="padding:5px; width:500px;" |[https://www.law.cornell.edu/cfr/text/21/211.100 21 CFR Part 211.100 (b)]<br />[https://www.law.cornell.edu/cfr/text/21/211.160 21 CFR Part 211.160 (a)]
  | style="background-color:white;" |'''32.6''' The system should provide a configurable means of allowing the system to automatically save after each entry to help meet ALCOA, CGMP, and other requirements to contemporaneously record data into records.
|-
  | style="padding:5px; width:500px;" |[https://www.law.cornell.edu/cfr/text/40/3.10 40 CFR Part 3.10]<br />[https://www.law.cornell.edu/cfr/text/40/3.2000 40 CFR Part 3.2000]<br />[https://www.astm.org/e1578-18.html ASTM E1578-18 S-1-5]
  | style="background-color:white;" |'''32.7''' The system should provide a configurable (based on sample, test, or both) means of permitting electronic signatures for both entered results and approved reports.
|-
  | style="padding:5px; width:500px;" |[https://www.astm.org/e1578-18.html ASTM E1578-18 S-1-6]
  | style="background-color:white;" |'''32.8''' The system should be capable of providing a complete list of all pending tests loaded in the system, the amount of material required for each test, and to which location the associated samples are to be sent for testing.
|-
  | style="padding:5px; width:500px;" |[https://www.astm.org/e1578-18.html ASTM E1578-18 S-1-7]
  | style="background-color:white;" |'''32.9''' The system shall support configurable laboratory workflows based on appropriate laboratory process and procedure.
|-
  | style="padding:5px; width:500px;" |[https://www.astm.org/e1578-18.html ASTM E1578-18 S-1-8]
  | style="background-color:white;" |'''32.10''' The system shall allow authorized personnel to assign status values for purposes of tracking sample progress or other portions of laboratory workflow.
|-
  | style="padding:5px; width:500px;" |[https://www.law.cornell.edu/cfr/text/21/211.68 21 CFR Part 211.68]<br />[https://www.astm.org/e1578-18.html ASTM E1578-18 S-1-9]
  | style="background-color:white;" |'''32.11''' The system should allow authorized personnel to perform revision control of lookup or master data.
|-
  | style="padding:5px; width:500px;" |[https://www.astm.org/e1578-18.html ASTM E1578-18 S-1-10]
  | style="background-color:white;" |'''32.12''' The system should provide a means for importing lookup or master data.
|-
  | style="padding:5px; width:500px;" |
[https://www.aihaaccreditedlabs.org/policies AIHA-LAP Policies 2022 2A.7.8.4]<br />
[https://www.astm.org/e1578-18.html ASTM E1578-18 S-1-11]<br />
[https://www.epa.gov/sites/production/files/documents/erln_lab_requirements.pdf EPA ERLN Laboratory Requirements 4.11.6]<br />
[https://www.ams.usda.gov/datasets/pdp/pdp-standard-operating-procedures USDA Data and Instrumentation for PDP 9.1]
  | style="background-color:white;" |'''32.13''' The system shall be able to define the number of significant figures (i.e., set rounding rules) for reported numeric data.
|-
  | style="padding:5px; width:500px;" |[https://www.astm.org/e1578-18.html ASTM E1578-18 S-1-12]
  | style="background-color:white;" |'''32.14''' The system should allow calculated limits to be created and managed based on test results and relevant metadata.
|-
  | style="padding:5px; width:500px;" |[https://www.astm.org/e1578-18.html ASTM E1578-18 S-1-13]<br />[https://www.epa.gov/sites/production/files/documents/erln_lab_requirements.pdf EPA ERLN Laboratory Requirements 3.2.6]<br />[https://www.epa.gov/sites/production/files/documents/erln_lab_requirements.pdf EPA ERLN Laboratory Requirements 4.9.11]
  | style="background-color:white;" |'''32.15''' The system should provide a clear alert or notification upon entry of out-of-specification results.
|-
  | style="padding:5px; width:500px;" |[https://www.astm.org/e1578-18.html ASTM E1578-18 S-1-14]
  | style="background-color:white;" |'''32.16''' The system shall allow authorized personnel to update static and dynamic data.
|-
  | style="padding:5px; width:500px;" |[https://www.astm.org/e1578-18.html ASTM E1578-18 S-1-15]
  | style="background-color:white;" |'''32.17''' The system should allow workflow events and status changes to trigger one or more user-defined actions.
|-
  | style="padding:5px; width:500px;" |[https://www.astm.org/e1578-18.html ASTM E1578-18 S-1-17]<br />
[https://www.fbi.gov/services/cjis/cjis-security-policy-resource-center CJIS Security Policy 5.7.1]<br />
[https://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf NIST 800-53, Rev. 4, AC-6(1)]<br />
[https://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf NIST 800-53, Rev. 4, CM-7]
  | style="background-color:white;" |'''32.18''' The system should provide an interface for administrative access that permits approved users to configure the system without extra programming or manipulation of data storage systems.
|-
  | style="padding:5px; width:500px;" |[https://www.astm.org/e1578-18.html ASTM E1578-18 S-1-18]
  | style="background-color:white;" |'''32.19''' The system should allow administrators to programmatically customize system modules or build calculations within the application.
|-
  | style="padding:5px; width:500px;" |[https://www.astm.org/e1578-18.html ASTM E1578-18 S-1-19]
  | style="background-color:white;" |'''32.20''' The system should provide a multiuser interface that can be configured to local user needs, including display language, character sets, and time zones.
|-
  | style="padding:5px; width:500px;" |[https://www.law.cornell.edu/cfr/text/21/11.100 21 CFR Part 11.100 (a)]<br />
[https://www.astm.org/e1578-18.html ASTM E1578-18 S-1-20]<br />
[https://ec.europa.eu/health/sites/health/files/files/eudralex/vol-4/annex11_01-2011_en.pdf E.U. Annex 11-14]<br />
[https://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf NIST 800-53, Rev. 4, CM-5(1)]
  | style="background-color:white;" |'''32.21''' The system should support rules governing electronic records and electronic signatures in regulated environments.
|-
  | style="padding:5px; width:500px;" |
[https://www.law.cornell.edu/cfr/text/7/331.11 7 CFR Part 331.11]<br />
[https://www.law.cornell.edu/cfr/text/9/121.11 9 CFR Part 121.11]<br />
[https://www.law.cornell.edu/cfr/text/21/11.10 21 CFR Part 11.10 (d)]<br />
[https://www.law.cornell.edu/cfr/text/21/211.68 21 CFR Part 211.68]<br />
[https://www.law.cornell.edu/cfr/text/42/73.11 42 CFR Part 73.11]<br />
[https://www.law.cornell.edu/cfr/text/45/164.308 45 CFR Part 164.308]<br />
[https://www.aavld.org/accreditation-requirements-page AAVLD Requirements for an AVMDL Sec. 4.10.1.3–4]<br />
[https://www.aavld.org/accreditation-requirements-page AAVLD Requirements for an AVMDL Sec. 5.4.4.1]<br />
[https://des.wa.gov/sites/default/files/public/documents/About/1063/RFP/Add7_Item4ASCLD.pdf ASCLD/LAB Supp. Reqs. for the Accreditation of Forensic Science Testing Laboratories 5.4.7.2.1]<br />
[https://www.astm.org/e1492-11r17.html ASTM E1492-11 4.2.4]<br />
[https://www.astm.org/e1578-18.html ASTM E1578-18 S-1-16]<br />
[https://www.astm.org/e1578-18.html ASTM E1578-18 S-1-21]<br />
[https://www.fbi.gov/services/cjis/cjis-security-policy-resource-center CJIS Security Policy 5.5.2]<br />
[https://ec.europa.eu/health/sites/health/files/files/eudralex/vol-4/annex11_01-2011_en.pdf E.U. Annex 11-12]<br />
[https://nepis.epa.gov/Exe/ZyPDF.cgi?Dockey=30006MXP.PDF EPA 815-R-05-004 Chap. IV, Sec. 8.6]<br />
[https://nepis.epa.gov/Exe/ZyPDF.cgi?Dockey=30006MXP.PDF EPA 815-R-05-004 Chap. VI, Sec. 8.6]<br />
[https://www.epa.gov/sites/production/files/documents/erln_lab_requirements.pdf EPA ERLN Laboratory Requirements 4.1.14–15]<br />
[https://www.epa.gov/sites/production/files/documents/erln_lab_requirements.pdf EPA ERLN Laboratory Requirements 4.9.4 and 4.9.14]<br />
[https://www.iso.org/standard/66912.html ISO/IEC 17025:2017 7.11.3]<br />
[https://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf NIST 800-53, Rev. 4, CM-5 and CM-5(1)]<br />
[https://www.ams.usda.gov/datasets/pdp/pdp-standard-operating-procedures USDA Administrative Procedures for the PDP 5.2.4]<br />
[https://www.who.int/medicines/areas/quality_safety/quality_assurance/expert_committee/trs_986/en/ WHO Technical Report Series, #986, Annex 2, 15.9]
  | style="background-color:white;" |'''32.22''' The system shall provide a security interface usable across all modules of the system that secures data and operations and prevents unauthorized access to data and functions.
|-
  | style="padding:5px; width:500px;" |[https://www.fbi.gov/services/cjis/cjis-security-policy-resource-center CJIS Security Policy 5.5.2.2–3]<br />[https://www.epa.gov/sites/production/files/documents/erln_lab_requirements.pdf EPA ERLN Laboratory Requirements 4.1.14–15]<br />
[https://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf NIST 800-53, Rev. 4, AC-2(11)]
  | style="background-color:white;" |'''32.23''' The system shall be able to granularly define access control down to the object level, role level, physical location, logical location, network address, and chronometric restriction level for the protection of regulated, patented, confidential, and classified data, methods, or other types of information.
|-
  | style="padding:5px; width:500px;" |[https://www.astm.org/e1578-18.html ASTM E1578-18 S-1-22]<br />[https://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf NIST 800-53, Rev. 4, IA-2(10)]
  | style="background-color:white;" |'''32.24''' The system should support single sign-on such that a user can log in once and access all permitted functions and data.
|-
  | style="padding:5px; width:500px;" |
[https://www.law.cornell.edu/cfr/text/21/11.200 21 CFR Part 11.200 (a)]<br />
[https://www.law.cornell.edu/cfr/text/45/164.312 45 CFR Part 164.312]<br />
[https://www.law.cornell.edu/cfr/text/45/170.315 45 CFR Part 170.315 (d)]<br />
[https://des.wa.gov/sites/default/files/public/documents/About/1063/RFP/Add7_Item4ASCLD.pdf ASCLD/LAB Supp. Reqs. for the Accreditation of Forensic Science Testing Laboratories 5.4.7.2.1]<br />
[https://www.astm.org/e1578-18.html ASTM E1578-18 E17-5 and S-3-1]<br />
[https://www.fbi.gov/services/cjis/cjis-security-policy-resource-center CJIS Security Policy 5.6.1]<br />
[https://ec.europa.eu/health/sites/health/files/files/eudralex/vol-4/annex11_01-2011_en.pdf E.U. Annex 11-14]<br />
[https://nepis.epa.gov/Exe/ZyPDF.cgi?Dockey=30006MXP.PDF EPA 815-R-05-004 Chap. IV, Sec. 8.6]<br />
[https://nepis.epa.gov/Exe/ZyPDF.cgi?Dockey=30006MXP.PDF EPA 815-R-05-004 Chap. VI, Sec. 7.6]<br />
[https://nepis.epa.gov/Exe/ZyPDF.cgi?Dockey=30006MXP.PDF EPA 815-R-05-004 Chap. VI, Sec. 8.6]<br />
[https://www.epa.gov/sites/production/files/documents/erln_lab_requirements.pdf EPA ERLN Laboratory Requirements 4.9.4]<br />
[https://www.iso.org/standard/56115.html ISO 15189:2012 5.10.3]<br />
[https://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf NIST 800-53, Rev. 4, AC-2(7) and AC-3]<br />
[https://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf NIST 800-53, Rev. 4, IA-2, IA-5, and IA-8]<br />
[https://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf NIST 800-53, Rev. 4, MA-4]<br />
[https://extranet.who.int/prequal/content/who-technical-report-series WHO Technical Report Series, #986, Annex 2, 15.9]
  | style="background-color:white;" |'''32.25''' The system shall provide initial login access using at least two unique identification components, e.g., a user identifier and password, or biometric information linked to and used by the genuine user.
|-
  | style="padding:5px; width:500px;" |
[https://www.law.cornell.edu/cfr/text/21/11.300 21 CFR Part 11.300 (a)]<br />
[https://www.astm.org/e1578-18.html ASTM E1578-18 E17-5 and S-3-1]<br />
[https://nepis.epa.gov/Exe/ZyPDF.cgi?Dockey=30006MXP.PDF EPA 815-R-05-004 Chap. IV, Sec. 8.6]<br />
[https://nepis.epa.gov/Exe/ZyPDF.cgi?Dockey=30006MXP.PDF EPA 815-R-05-004 Chap. VI, Sec. 8.6]<br />
[https://www.iso.org/standard/56115.html ISO 15189:2012 5.10.3]<br />
[https://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf NIST 800-53, Rev. 4, IA-4 and IA-5]
  | style="background-color:white;" |'''32.26''' The system shall prevent the same combination of identification components from being used across more than one account.
|-
  | style="padding:5px; width:500px;" |
[https://www.law.cornell.edu/cfr/text/21/11.300 21 CFR Part 11.300 (b)]<br />[https://www.astm.org/e1578-18.html ASTM E1578-18 E17-5 and S-3-1]<br />[https://www.iso.org/standard/56115.html ISO 15189:2012 5.10.3]<br />[https://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf NIST 800-53, Rev. 4, IA-5 and IA-5(1)]
  | style="background-color:white;" |'''32.27''' The system shall allow the administrator to define a time period in days after which a user will be prompted to change their password.
|-
  | style="padding:5px; width:500px;" |[https://www.fbi.gov/services/cjis/cjis-security-policy-resource-center CJIS Security Policy 5.6.3.1]<br />[https://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf NIST 800-53, Rev. 4, AC-2(3)]<br />
[https://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf NIST 800-53, Rev. 4, IA-4 and IA-5(1)]<br />
[https://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf NIST 800-53, Rev. 4, PS-4]
  | style="background-color:white;" |'''32.28''' The system shall allow the administrator to define a time period of inactivity for a user identifier, after which it will be disabled and archived.
|-
  | style="padding:5px; width:500px;" |[https://www.fbi.gov/services/cjis/cjis-security-policy-resource-center CJIS Security Policy 5.5.2.2]<br />[https://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf NIST 800-53, Rev. 4, AC-10]
  | style="background-color:white;" |'''32.29''' The system shall allow the administrator or authorized personnel to configure the allowance or prevention of multiple concurrent active sessions for one unique user.
|-
  | style="padding:5px; width:500px;" |[https://www.fbi.gov/services/cjis/cjis-security-policy-resource-center CJIS Security Policy 5.5.4]<br />[https://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf NIST 800-53, Rev. 4, AC-8]
  | style="background-color:white;" |'''32.30''' The system shall allow the administrator or authorized personnel to configure approved system use (e.g., "you are accessing a restricted information system," "system use indicates consent to being monitored, recorded, and audited") and other types of notifications to appear before or after a user logs in to the system. These notifications should remain on the screen until acknowledged by the user.
|-
  | style="padding:5px; width:500px;" |
[https://www.law.cornell.edu/cfr/text/21/11.300 21 CFR Part 11.300 (d)]<br />
[https://www.law.cornell.edu/cfr/text/21/211.68 21 CFR Part 211.68]<br />
[https://www.law.cornell.edu/cfr/text/21/211.100 21 CFR Part 211.100]<br />
[https://www.law.cornell.edu/cfr/text/21/211.160 21 CFR Part 211.160 (a)]<br />
[https://www.law.cornell.edu/cfr/text/21/211.188 21 CFR Part 211.188]<br />
[https://www.law.cornell.edu/cfr/text/21/211.194 21 CFR Part 211.194]<br />
[https://www.astm.org/e1578-18.html ASTM E1578-18 E17-5 and S-3-1]<br />
[https://www.fbi.gov/services/cjis/cjis-security-policy-resource-center CJIS Security Policy 5.4.1.1]<br />
[https://eur-lex.europa.eu/eli/dir/2003/94/oj E.U. Commission Directive 2003/94/EC Article 9.2]<br />
[https://www.iso.org/standard/56115.html ISO 15189:2012 5.10.3]<br />
[https://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf NIST 800-53, Rev. 4, CM-5(1)]<br />
[https://www.who.int/medicines/areas/quality_safety/quality_assurance/expert_committee/trs_986/en/ WHO Technical Report Series, #986, Annex 2, 15.9]
  | style="background-color:white;" |'''32.31''' The system shall keep an accurate audit trail of login activities, including failed login attempts and electronic signings.
|-
  | style="padding:5px; width:500px;" |
[https://www.law.cornell.edu/cfr/text/21/11.300 21 CFR Part 11.300 (d)]<br />
[https://www.astm.org/e1578-18.html ASTM E1578-18 E17-5 and S-3-1]<br />
[https://www.fbi.gov/services/cjis/cjis-security-policy-resource-center CJIS Security Policy 5.5.3]<br />
[https://www.iso.org/standard/56115.html ISO 15189:2012 5.10.3]<br />
[https://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf NIST 800-53, Rev. 4, AC-7]
  | style="background-color:white;" |'''32.32''' The system shall allow the administrator or authorized personnel to define the number of failed login attempts before the system locks the user out.
|-
  | style="padding:5px; width:500px;" |[https://www.law.cornell.edu/cfr/text/21/11.200 21 CFR Part 11.200 (a)]<br />[https://www.astm.org/e1578-18.html ASTM E1578-18 S-3-1]
  | style="background-color:white;" |'''32.33''' The system shall require at least one unique identification component for additional electronic signings (beyond initial login) during a single, continuous session.
|-
  | style="padding:5px; width:500px;" |
[https://www.law.cornell.edu/cfr/text/7/331.11 7 CFR Part 331.11]<br />
[https://www.law.cornell.edu/cfr/text/9/121.11 9 CFR Part 121.11]<br />
[https://www.law.cornell.edu/cfr/text/21/11.200 21 CFR Part 11.200 (a)]<br />
[https://www.law.cornell.edu/cfr/text/21/211.68 21 CFR Part 211.68 (b)]<br />
[https://www.law.cornell.edu/cfr/text/21/211.188 21 CFR Part 211.188 (b-11)]<br />
[https://www.law.cornell.edu/cfr/text/21/211.194 21 CFR Part 211.194 (a-7 and a-8)]<br />
[https://www.law.cornell.edu/cfr/text/21/212.50 21 CFR Part 212.50 (c-10)]<br />
[https://www.law.cornell.edu/cfr/text/42/73.11 42 CFR Part 73.11]<br />
[https://www.astm.org/e1578-18.html ASTM E1578-18 S-3-1]<br />
[https://www.fbi.gov/services/cjis/cjis-security-policy-resource-center CJIS Security Policy 5.6.3.2]<br />
[https://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf NIST 800-53, Rev. 4, IA-5]
  | style="background-color:white;" |'''32.34''' The vendor shall provide training materials emphasizing the importance of not sharing unique identification components with other individuals and promoting compliance review for ensuring such practices are followed.
|-
  | style="padding:5px; width:500px;" |
[https://www.law.cornell.edu/cfr/text/7/331.11 7 CFR Part 331.11]<br />
[https://www.law.cornell.edu/cfr/text/9/121.11 9 CFR Part 121.11]<br />
[https://www.law.cornell.edu/cfr/text/21/11.10 21 CFR Part 11.10 (d)]<br />
[https://www.law.cornell.edu/cfr/text/42/73.11 42 CFR Part 73.11]<br />
[https://www.law.cornell.edu/cfr/text/42/493.1231 42 CFR Part 493.1231]<br />
[https://www.law.cornell.edu/cfr/text/45/164.308 45 CFR Part 164.308]<br />
[https://www.law.cornell.edu/cfr/text/45/164.514 45 CFR Part 164.514]<br />
[https://www.law.cornell.edu/cfr/text/45/170.315 45 CFR Part 170.315 (d)]<br />
[https://www.astm.org/e1578-18.html ASTM E1578-18 S-1-25]<br />
[https://www.fbi.gov/services/cjis/cjis-security-policy-resource-center CJIS Security Policy 5.5.1]<br />
[https://www.epa.gov/sites/production/files/documents/erln_lab_requirements.pdf EPA ERLN Laboratory Requirements 4.1.14–15]<br />
[https://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf NIST 800-53, Rev. 4, AC-3]<br />
[https://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf NIST 800-53, Rev. 4, IA-2, IA-5, and IA-8]
  | style="background-color:white;" |'''32.35''' The system shall support the ability to initially assign new individual users to system groups, roles, or both.
|-
  | style="padding:5px; width:500px;" |
[https://www.law.cornell.edu/cfr/text/21/11.100 21 CFR Part 11.100 (a)]<br />
[https://www.law.cornell.edu/cfr/text/45/164.312 45 CFR Part 164.312]<br />
[https://www.astm.org/e1578-18.html ASTM E1578-18 S-1-24]<br />
[https://ec.europa.eu/health/sites/health/files/files/eudralex/vol-4/annex11_01-2011_en.pdf E.U. Annex 11-14]
  | style="background-color:white;" |'''32.36''' The system shall force a user's electronic signature to be unique and traceable to a specific user's account.
|-
  | style="padding:5px; width:500px;" |[https://www.law.cornell.edu/cfr/text/21/11.100 21 CFR Part 11.100 (a)]<br />[https://www.astm.org/e1578-18.html ASTM E1578-18 S-1-24]<br />
  | style="background-color:white;" |'''32.37''' The system shall prevent the reuse or reassignment of a user's electronic signature.
|-
  | style="padding:5px; width:500px;" |[https://www.law.cornell.edu/cfr/text/21/11.50 21 CFR Part 11.50]<br />[https://ec.europa.eu/health/sites/health/files/files/eudralex/vol-4/annex11_01-2011_en.pdf E.U. Annex 11-14]
  | style="background-color:white;" |'''32.38''' When the system generates a complete and accurate copy of an electronically signed record, it shall also display the printed name of the signer, the date and time of signature execution, and any applicable meaning associated with the signature. This shall be applicable for both electronically displayed and printed copies of the electronic record.
|-
  | style="padding:5px; width:500px;" |[https://www.astm.org/e1578-18.html ASTM E1578-18 S-1-26]
  | style="background-color:white;" |'''32.39''' The system should provide a means to migrate static data into the system.
|- 
  | style="padding:5px; width:500px;" |[https://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf NIST 800-53, Rev. 4, IA-5(1) and IA-5(4)]
  | style="background-color:white;" |'''32.40''' The system should provide a means for automatically authenticating if a user's proposed password meets the length, complexity, minimum number of changed characters, and other requirements as configured by the administrator or another authorized system user.
|-
  | style="padding:5px; width:500px;" |[https://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf NIST 800-53, Rev. 4, IA-6]
  | style="background-color:white;" |'''32.41''' The system should provide a means for obscuring authentication feedback as it is entered into the system, e.g., displaying asterisks rather than the typed password or displaying actual typed feedback for a distinctly short period of time before obscuring it.
|-
|}
|}
 
{|
| STYLE="vertical-align:top;"|
{| class="wikitable collapsible" border="1" cellpadding="10" cellspacing="0"
|-
  ! colspan="2" style="text-align:left; padding-left:20px; padding-top:10px; padding-bottom:10px;"|
|-
  ! style="color:brown; background-color:#ffffee; width:500px;"| Regulation, Specification, or Guidance
  ! style="color:brown; background-color:#ffffee; width:700px;"| Requirement
|-
  | style="padding:5px; width:500px;" |[https://www.astm.org/e1578-18.html ASTM E1578-18 S-2-1]<br />[https://www.fbi.gov/services/cjis/cjis-security-policy-resource-center CJIS Security Policy Appendix G.8]<br />[https://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf NIST 800-53, Rev. 4, SA-4(3)]
  | style="background-color:white;" |'''33.1''' The vendor should be able to demonstrate the use of software development standards, secure coding practices, formal change control, and software revision control within its development practices. The vendor should also document its staff's skills and certifications.
|-
  | style="padding:5px; width:500px;" |[https://www.astm.org/e1578-18.html ASTM E1578-18 S-2-2]<br />[https://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf NIST 800-53, Rev. 4, SA-4(2)]
  | style="background-color:white;" |'''33.2''' The vendor should be willing to provide access to source code through a suitable escrow.
|-
  | style="padding:5px; width:500px;" |[https://www.astm.org/e1578-18.html ASTM E1578-18 S-2-3]
  | style="background-color:white;" |'''33.3''' The system should be able to document a summary and evaluation of enterprise performance markers and processes.
|-
  | style="padding:5px; width:500px;" |[https://www.astm.org/e1578-18.html ASTM E1578-18 S-2-4]<br />[https://www.iso.org/standard/56115.html ISO 15189:2012 5.10.3]<br />[https://www.iso.org/standard/66912.html ISO/IEC 17025:2017 7.11.5]<br />[https://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf NIST 800-53, Rev. 4, SA-4(1), SA-4(2), and SA-5]
  | style="background-color:white;" |'''33.4''' The system should be well documented by the vendor in comprehensive training material for all aspects of system use, including administration, operation, and troubleshooting.
|-
  | style="padding:5px; width:500px;" |
[https://www.law.cornell.edu/cfr/text/21/11.10 21 CFR Part 11.10 (a)]<br />
[https://www.law.cornell.edu/cfr/text/21/820.70 21 CFR Part 820.70 (i)]<br />
[https://ec.europa.eu/health/sites/health/files/files/eudralex/vol-4/annex11_01-2011_en.pdf E.U. Annex 11-11]<br />
[https://nepis.epa.gov/Exe/ZyPDF.cgi?Dockey=30006MXP.PDF EPA 815-R-05-004 Chap. IV, Sec. 8.6]<br />
[https://nepis.epa.gov/Exe/ZyPDF.cgi?Dockey=30006MXP.PDF EPA 815-R-05-004 Chap. VI, Sec. 8.6]<br />
[https://eur-lex.europa.eu/eli/dir/2003/94/oj E.U. Commission Directive 2003/94/EC Article 9.2]<br />
[https://www.iso.org/standard/56115.html ISO 15189:2012 5.10.3]<br />
[https://www.iso.org/standard/66912.html ISO/IEC 17025:2017 7.11.2]<br />
[https://www.oecd.org/chemicalsafety/testing/oecdseriesonprinciplesofgoodlaboratorypracticeglpandcompliancemonitoring.htm OECD GLP Principles 4.1]
  | style="background-color:white;" |'''33.5''' The system shall be validated initially and periodically, with those validation activities being documented, to ensure the accuracy, consistency, and reliability of system performance and its electronic records.
|-
  | style="padding:5px; width:500px;" |[https://www.astm.org/e1578-18.html ASTM E1578-18 S-2-2]<br />[https://ec.europa.eu/health/sites/health/files/files/eudralex/vol-4/annex11_01-2011_en.pdf E.U. Annex 11-4]
  | style="background-color:white;" |'''33.6''' The documentation associated with system validation shall discuss all applicable steps of the life cycle, justify applied methods and standards, and include change control records and observed deviations during validation, if applicable.
|-
|}
|}
 
{|
| STYLE="vertical-align:top;"|
{| class="wikitable collapsible" border="1" cellpadding="10" cellspacing="0"
|-
  ! colspan="2" style="text-align:left; padding-left:20px; padding-top:10px; padding-bottom:10px;"|
|-
  ! style="color:brown; background-color:#ffffee; width:500px;"| Regulation, Specification, or Guidance
  ! style="color:brown; background-color:#ffffee; width:700px;"| Requirement
|-
  | style="padding:5px; width:500px;" |
[https://www.law.cornell.edu/cfr/text/21/11.200 21 CFR Part 11.200 (a)]<br />
[https://www.law.cornell.edu/cfr/text/45/164.312 45 CFR Part 164.312]<br />
[https://www.law.cornell.edu/cfr/text/45/170.315 45 CFR Part 170.315 (d-5)]<br />
[https://www.astm.org/e1578-18.html ASTM E1578-18 S-3-1]<br />
[https://www.fbi.gov/services/cjis/cjis-security-policy-resource-center CJIS Security Policy 5.5.5]<br />
[https://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf NIST 800-53, Rev. 4, AC-11]
  | style="background-color:white;" |'''34.1''' The system shall provide administrators with a configurable period of time to apply to user access or inactivity before again prompting a user for authentication credentials.
|-
  | style="padding:5px; width:500px;" |[https://www.astm.org/e1578-18.html ASTM E1578-18 S-3-2]
  | style="background-color:white;" |'''34.2''' The system should provide a means for modifying personnel data in a batch.
|-
  | style="padding:5px; width:500px;" |[https://www.astm.org/e1578-18.html ASTM E1578-18 S-3-3]
  | style="background-color:white;" |'''34.3''' The system should support the storage of standard and industry-specific data formats.
|-
  | style="padding:5px; width:500px;" |
[https://www.law.cornell.edu/cfr/text/7/331.11 7 CFR Part 331.11]<br />
[https://www.law.cornell.edu/cfr/text/9/121.11 9 CFR Part 121.11]<br />
[https://www.law.cornell.edu/cfr/text/21/11.10 21 CFR Part 11.10 (d)]<br />
[https://www.law.cornell.edu/cfr/text/21/211.68 21 CFR Part 211.68 (b)]<br />
[https://www.law.cornell.edu/cfr/text/42/73.11 42 CFR Part 73.11]<br />
[https://www.law.cornell.edu/cfr/text/45/164.308 45 CFR Part 164.308]<br />
[https://www.law.cornell.edu/cfr/text/45/164.514 45 CFR Part 164.514]<br />
[https://www.astm.org/e1578-18.html ASTM E1578-18 S-3-7]<br />
[https://www.fbi.gov/services/cjis/cjis-security-policy-resource-center CJIS Security Policy 5.5.1]<br />
[https://www.fbi.gov/services/cjis/cjis-security-policy-resource-center CJIS Security Policy 5.5.2.4]<br />
[https://www.fbi.gov/services/cjis/cjis-security-policy-resource-center CJIS Security Policy Appendix G.5]<br />
[https://nepis.epa.gov/Exe/ZyPDF.cgi?Dockey=30006MXP.PDF EPA 815-R-05-004 Chap. IV, Sec. 8.6]<br />
[https://nepis.epa.gov/Exe/ZyPDF.cgi?Dockey=30006MXP.PDF EPA 815-R-05-004 Chap. VI, Sec. 8.6]<br />
[https://www.epa.gov/sites/production/files/documents/erln_lab_requirements.pdf EPA ERLN Laboratory Requirements 4.1.14–15]<br />
[https://www.iso.org/standard/56115.html ISO 15189:2012 5.10.2]<br />
[https://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf NIST 800-53, Rev. 4, AC-2(7) and AC-3]<br />
[https://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf NIST 800-53, Rev. 4, IA-2 and IA-8]<br />
[https://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf NIST 800-53, Rev. 4, MA-4]<br />
[https://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf NIST 800-53, Rev. 4, PS-4 and PS-5]<br />
[https://www.ams.usda.gov/datasets/pdp/pdp-standard-operating-procedures USDA Administrative Procedures for the PDP 5.2.4]<br />
[https://www.ams.usda.gov/datasets/pdp/pdp-standard-operating-procedures USDA Administrative Procedures for the PDP 5.5.1.2]
  | style="background-color:white;" |'''34.4''' The system shall support the ability to define, record, and change the level of access for individual users to system groups, roles, machines, processes, and objects based on their responsibilities, including when those responsibilities change. The system should be able to provide a list of individuals assigned to a given system group, role, machine, process, or object.
|-
  | style="padding:5px; width:500px;" |[https://www.astm.org/e1578-18.html ASTM E1578-18 S-3-8]
  | style="background-color:white;" |'''34.5''' The vendor should provide maintenance agreements and support services for its applications and services.
|-
  | style="padding:5px; width:500px;" |[https://www.astm.org/e1578-18.html ASTM E1578-18 S-3-9]<br />
[https://ec.europa.eu/health/sites/health/files/files/eudralex/vol-4/annex11_01-2011_en.pdf E.U. Annex 11-3.3]<br />
[https://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf NIST 800-53, Rev. 4, SA-16]<br />
[https://www.ams.usda.gov/datasets/pdp/pdp-standard-operating-procedures USDA Administrative Procedures for the PDP 5.2.4]
  | style="background-color:white;" |'''34.6''' The vendor shall provide help desk, training, and installation support, as well as high-quality system documentation. The documentation should be reviewed to ensure that user requirements are fulfilled.
|-
  | style="padding:5px; width:500px;" |
[https://www.law.cornell.edu/cfr/text/7/331.11 7 CFR Part 331.11]<br />
[https://www.law.cornell.edu/cfr/text/9/121.11 9 CFR Part 121.11]<br />
[https://www.law.cornell.edu/cfr/text/21/11.10 21 CFR Part 11.10 (c)]<br />
[https://www.law.cornell.edu/cfr/text/42/73.11 42 CFR Part 73.11]<br />
[https://www.law.cornell.edu/cfr/text/45/164.310 45 CFR Part 164.310]<br />
[https://www.aavld.org/accreditation-requirements-page AAVLD Requirements for an AVMDL Sec. 5.4.4.3]<br />
[https://www.abft.org/files/ABFT_LAP_Standards_May_31_2013.pdf ABFT Accreditation Manual Sec. D-5–D-8]<br />
[https://des.wa.gov/sites/default/files/public/documents/About/1063/RFP/Add7_Item4ASCLD.pdf ASCLD/LAB Supp. Reqs. for the Accreditation of Forensic Science Testing Laboratories 5.4.7.2.1]<br />
[https://www.astm.org/e1492-11r17.html ASTM E1492-11 4.2.4]<br />
[https://www.fbi.gov/services/cjis/cjis-security-policy-resource-center CJIS Security Policy 5.5.2]<br />
[https://www.fbi.gov/services/cjis/cjis-security-policy-resource-center CJIS Security Policy 5.8.1]<br />
[https://www.epa.gov/sites/production/files/documents/erln_lab_requirements.pdf EPA ERLN Laboratory Requirements 4.9.6]<br />
[https://ec.europa.eu/health/sites/health/files/files/eudralex/vol-4/annex11_01-2011_en.pdf E.U. Annex 11-7.1]<br />
[https://ec.europa.eu/health/sites/health/files/files/eudralex/vol-4/annex11_01-2011_en.pdf E.U. Annex 11-12]<br />
[https://www.iso.org/standard/56115.html ISO 15189:2012 5.10.2]<br />
[https://www.iso.org/standard/66912.html ISO/IEC 17025:2017 7.11.3]<br />
[https://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf NIST 800-53, Rev. 4, MA-5]<br />
[https://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf NIST 800-53, Rev. 4, MP-2]<br />
[https://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf NIST 800-53, Rev. 4, PE-3, PE-3(1), PE-6, PE-6(1), and PE-6(4)]<br />
[https://www.ams.usda.gov/datasets/pdp/pdp-standard-operating-procedures USDA Administrative Procedures for the PDP 5.2.1]
  | style="background-color:white;" |'''34.7''' The vendor shall restrict logical access to database storage components to authorized individuals. If providing a hosted service, the vendor should also restrict physical access to database storage components to authorized individuals. (In the case of an on-site solution, the buyer is responsible for limiting physical access to database storage components to meet 21 CFR Part 11, HIPAA, and CJIS guidelines.)
|-
  | style="padding:5px; width:500px;" |[https://www.fbi.gov/services/cjis/cjis-security-policy-resource-center CJIS Security Policy 5.5.1]
  | style="background-color:white;" |'''34.8''' The system shall be able to tag and document an individual, group, and system account as having been validated for regulatory purposes, and remind the administrator or authorized personnel on a configurable schedule when the account should be validated again.
|-
  | style="padding:5px; width:500px;" |
[https://www.law.cornell.edu/cfr/text/7/331.17 7 CFR Part 331.17]<br />
[https://www.law.cornell.edu/cfr/text/9/121.17 9 CFR Part 121.17]<br />
[https://www.law.cornell.edu/cfr/text/42/73.17 42 CFR Part 73.17]<br />
[https://www.astm.org/e1578-18.html ASTM E1578-18 S-3-10]
  | style="background-color:white;" |'''34.9''' The system should provide a means of integrating with an enterprise personnel security directory, as well as physical security systems.
|-
  | style="padding:5px; width:500px;" |
[https://www.law.cornell.edu/cfr/text/7/331.11 7 CFR Part 331.11]<br />
[https://www.law.cornell.edu/cfr/text/9/121.11 9 CFR Part 121.11]<br />
[https://www.law.cornell.edu/cfr/text/42/73.11 42 CFR Part 73.11]<br />
[https://www.astm.org/e1578-18.html ASTM E1578-18 S-3-11]<br />
[https://www.fbi.gov/services/cjis/cjis-security-policy-resource-center CJIS Security Policy 5.10.4.1]<br />
[https://www.epa.gov/sites/production/files/documents/erln_lab_requirements.pdf EPA ERLN Laboratory Requirements 4.9.13]<br />
[https://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf NIST 800-53, Rev. 4, SI-2(5)]
  | style="background-color:white;" |'''34.10''' The vendor should provide timely upgrades and patches, with complete documentation, that have been tested before installation and can be rolled back.
|-
  | style="padding:5px; width:500px;" |[https://www.astm.org/e1578-18.html ASTM E1578-18 S-3-12]
  | style="background-color:white;" |'''34.11''' The system shall provide a means for migrating data to a new release upon system upgrade.
|-
  | style="padding:5px; width:500px;" |[https://www.astm.org/e1578-18.html ASTM E1578-18 S-3-13]
  | style="background-color:white;" |'''34.12''' The system should be expedient with the retrieval of stored items.
|-
  | style="padding:5px; width:500px;" |[https://www.law.cornell.edu/cfr/text/21/11.10 21 CFR Part 11.10 (b)]<br />[https://ec.europa.eu/health/sites/health/files/files/eudralex/vol-4/annex11_01-2011_en.pdf E.U. Annex 11-5]<br />[https://ec.europa.eu/health/sites/health/files/files/eudralex/vol-4/annex11_01-2011_en.pdf E.U. Annex 11-8.1]
  | style="background-color:white;" |'''34.13''' The system shall allow the printing of stored electronic records in a complete, accurate, and human-readable format.
|-
  | style="padding:5px; width:500px;" |[https://www.astm.org/e1578-18.html ASTM E1578-18 S-3-14]
  | style="background-color:white;" |'''34.14''' The system should provide some sort of support for use on mobile technologies, particularly for the purpose of receiving notifications and monitoring processes.
|-
  | style="padding:5px; width:500px;" |[https://www.astm.org/e1578-18.html ASTM E1578-18 S-3-15]<br />
[https://www.epa.gov/sites/production/files/documents/erln_lab_requirements.pdf EPA ERLN Laboratory Requirements 4.9.13]<br />
[https://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf NIST 800-53, Rev. 4, CM-3(2)]<br />
[https://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf NIST 800-53, Rev. 4, SI-2]
  | style="background-color:white;" |'''34.15''' The system shall be able to install an upgrade into a test environment for testing purposes before upgrading the actual production environment.
|-
|}
|}
 
{|
| STYLE="vertical-align:top;"|
{| class="wikitable collapsible" border="1" cellpadding="10" cellspacing="0"
|-
  ! colspan="2" style="text-align:left; padding-left:20px; padding-top:10px; padding-bottom:10px;"|
|-
  ! style="color:brown; background-color:#ffffee; width:500px;"| Regulation, Specification, or Guidance
  ! style="color:brown; background-color:#ffffee; width:700px;"| Requirement
|-
  | style="padding:5px; width:500px;" |
[https://www.law.cornell.edu/cfr/text/42/493.1231 42 CFR Part 493.1231]<br />
[https://www.law.cornell.edu/cfr/text/45/164.312 45 CFR Part 164.312]<br />
[https://www.law.cornell.edu/cfr/text/45/170.315 45 CFR Part 170.315 (d-9)]<br />
[https://www.astm.org/e1578-18.html ASTM E1578-18 S-4-1]<br />
[https://www.fbi.gov/services/cjis/cjis-security-policy-resource-center CJIS Security Policy 5.6.4]<br />
[https://www.fbi.gov/services/cjis/cjis-security-policy-resource-center CJIS Security Policy 5.8.2.1]<br />
[https://www.fbi.gov/services/cjis/cjis-security-policy-resource-center CJIS Security Policy 5.10.1.2]<br />
[https://www.fbi.gov/services/cjis/cjis-security-policy-resource-center CJIS Security Policy Appendix G.6]<br />
[https://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf NIST 800-53, Rev. 4, AC-17(2)]
  | style="background-color:white;" |'''35.1''' The system should use secure communication protocols like SSL/TLS over Secure Hypertext Transfer Protocol with 256 bit encryption.
|-
  | style="padding:5px; width:500px;" |
[https://www.law.cornell.edu/cfr/text/42/493.1231 42 CFR Part 493.1231]<br />
[https://www.law.cornell.edu/cfr/text/45/164.312 45 CFR Part 164.312]<br />
[https://www.law.cornell.edu/cfr/text/45/170.315 45 CFR Part 170.315 (d)]<br />
[https://www.astm.org/e1578-18.html ASTM E1578-18 S-4-2]<br />
[https://www.fbi.gov/services/cjis/cjis-security-policy-resource-center CJIS Security Policy 5.5.2.4]<br />
[https://www.fbi.gov/services/cjis/cjis-security-policy-resource-center CJIS Security Policy 5.10.1.2]<br />
[https://www.fbi.gov/services/cjis/cjis-security-policy-resource-center CJIS Security Policy Appendix G.6]<br />
[https://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf NIST 800-53, Rev. 4, SC-13 and SC-28(1)]
  | style="background-color:white;" |'''35.2''' The system should support database encryption and be capable of recording the encryption status of the data contained within.
|-
  | style="padding:5px; width:500px;" |[https://www.law.cornell.edu/cfr/text/42/493.1231 42 CFR Part 493.1231]<br />
[https://www.fbi.gov/services/cjis/cjis-security-policy-resource-center CJIS Security Policy 5.6.2.2.1]<br />
[https://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf NIST 800-53, Rev. 4, AC-3]<br />
[https://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf NIST 800-53, Rev. 4, IA-2, IA-2(1–4), and IA-8]<br />
[https://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf NIST 800-53, Rev. 4, MA-4]
  | style="background-color:white;" |'''35.3''' The system should be able to support multifactor authentication.
|-
  | style="padding:5px; width:500px;" |[https://www.law.cornell.edu/cfr/text/45/170.202 45 CFR Part 170.202]<br />[https://www.law.cornell.edu/cfr/text/45/170.315 45 CFR Part 170.315 (h)]
  | style="background-color:white;" |'''35.4''' The system should support Office of the National Coordinator for Health Information Technology (ONC) transport standards and protocols for the reception and distribution of personal health information.
|-
  | style="padding:5px; width:500px;" |[https://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf NIST 800-53, Rev. 4, IA-7]
  | style="background-color:white;" |'''35.5''' The system should provide a means for authenticating an individual seeking to access any embedded cryptographic module within the system, as well as the individual's role in performing services within the module.
|-
  | style="padding:5px; width:500px;" |[https://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf NIST 800-53, Rev. 4, SC-15]
  | style="background-color:white;" |'''35.6''' The system should prevent connected collaborative computing devices (e.g., cameras, microphones, interactive whiteboards) from being activated without explicit permission from the end user, and it should provide a clear indication of any activation to the end user.
|-
|}
|}
 
{|
| STYLE="vertical-align:top;"|
{| class="wikitable collapsible" border="1" cellpadding="10" cellspacing="0"
|-
  ! colspan="2" style="text-align:left; padding-left:20px; padding-top:10px; padding-bottom:10px;"|
|-
  ! style="color:brown; background-color:#ffffee; width:500px;"| Regulation, Specification, or Guidance
  ! style="color:brown; background-color:#ffffee; width:700px;"| Requirement
|-
  | style="padding:5px; width:500px;" |[https://www.law.cornell.edu/cfr/text/45/part-164/subpart-E 45 CFR Part 164 Subpart E]<br />[https://www.astm.org/e1578-18.html ASTM E1578-18 S-5-1]
  | style="background-color:white;" |'''36.1''' The system shall comply with privacy protection compliance like that found in HIPAA provisions.
|-
  | style="padding:5px; width:500px;" |
[https://www.law.cornell.edu/cfr/text/45/164.105 45 CFR Part 164.105]<br />
[https://www.law.cornell.edu/cfr/text/45/part-164/subpart-C 45 CFR Part 164 Subpart C]<br />
[https://www.law.cornell.edu/cfr/text/45/170.315 45 CFR Part 170.315 (d)]<br />
[https://www.astm.org/e1578-18.html ASTM E1578-18 S-5-2]
  | style="background-color:white;" |'''36.2''' The system should be provisioned with enough security to prevent personally identifiable information in the system from being compromised.
|-
  | style="padding:5px; width:500px;" |[https://www.law.cornell.edu/cfr/text/45/164.514 45 CFR Part 164.514]
  | style="background-color:white;" |'''36.3''' The system shall allow authorized individuals to de-identify select data in the system, including but not limited to names, geographic locations, dates, government-issued identification numbers, telephone numbers, email addresses, full-face photos, and other personal identifiers.
|-
  | style="padding:5px; width:500px;" |[https://www.law.cornell.edu/cfr/text/45/part-164/subpart-E 45 CFR Part 164 Subpart E]<br />
[https://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf NIST 800-53, Rev. 4, AC-6]
  | style="background-color:white;" |'''36.4''' The system shall be able to verify and ensure that users authorized to view de-identified data are also not a member of a role that permits access to information that re-identifies the data, i.e., segregate duties.
|-
|}
|}

Latest revision as of 20:23, 16 August 2023

This is sublevel25 of my sandbox, where I play with features and test MediaWiki code. If you wish to leave a comment for me, please see my discussion page instead.

Sandbox begins below

Retrieved from "https://www.limswiki.org/index.php?title=User:Shawndouglas/sandbox/sublevel25&oldid=52870"