Соответствие требованиям

Куда я попал?

Вы попали в сервис, который помогает корпоративным службам безопасности строить свои рабочие процессы: управление рисками, контроль соответствия требованиям, учет активов, планирование и сопровождение защитных мер на всем их жизненном цикле, распределение задач и т.д.
Еще SECURITM является платформой для обмена опытом и наработками между участниками сообщества служб безопасности.

Подробнее

Good Manufacturing Practice. Annex 11: Computerised Systems

Стандарт № GMP Annex 11: Computerised Systems (EN) от 30.11.2011

Р. 4

Для проведения оценки соответствия по документу войдите в систему.

Показывать только требования

Operational Phase

5. Data

Computerised systems exchanging data electronically with other systems should include appropriate built-in checks for the correct and secure entry and processing of data, in order to minimize the risks.

6. Accuracy Checks

For critical data entered manually, there should be an additional check on the accuracy of the data. This check may be done by a second operator or by validated electronic means. The criticality and the potential consequences of erroneous or incorrectly entered data to a system should be covered by risk management.

7. Data Storage

7.1 Data should be secured by both physical and electronic means against damage. Stored data should be checked for accessibility, readability and accuracy. Access to data should be ensured throughout the retention period.

7.2 Regular back-ups of all relevant data should be done. Integrity and accuracy of backup data and the ability to restore the data should be checked during validation and monitored periodically.

8. Printouts

8.1 It should be possible to obtain clear printed copies of electronically stored data.

8.2 For records supporting batch release it should be possible to generate printouts indicating if any of the data has been changed since the original entry.

9. Audit Trails

Consideration should be given, based on a risk assessment, to building into the system the creation of a record of all GMP-relevant changes and deletions (a system generated "audit trail"). For change or deletion of GMP-relevant data the reason should be documented. Audit trails need to be available and convertible to a generally intelligible form and regularly reviewed.

10. Change and Configuration Management

Any changes to a computerised system including system configurations should only be made in a controlled manner in accordance with a defined procedure.

11. Periodic evaluation

Computerised systems should be periodically evaluated to confirm that they remain in a valid state and are compliant with GMP. Such evaluations should include, where appropriate, the current range of functionality, deviation records, incidents, problems, upgrade history, performance, reliability, security and validation status reports.

12. Security

12.1 Physical and/or logical controls should be in place to restrict access to computerised system to authorised persons. Suitable methods of preventing unauthorised entry to the system may include the use of keys, pass cards, personal codes with passwords, biometrics, restricted access to computer equipment and data storage areas.

12.2 The extent of security controls depends on the criticality of the computerised system.

12.3 Creation, change, and cancellation of access authorisations should be recorded.

12.4 Management systems for data and for documents should be designed to record the identity of operators entering, changing, confirming or deleting data including date and time.

13. Incident Management

All incidents, not only system failures and data errors, should be reported and assessed. The root cause of a critical incident should be identified and should form the basis of corrective and preventive actions.

14. Electronic Signature

Electronic records may be signed electronically. Electronic signatures are expected to:

have the same impact as hand-written signatures within the boundaries of the company,
be permanently linked to their respective record,
include the time and date that they were applied.

15. Batch release

When a computerised system is used for recording certification and batch release, the system should allow only Qualified Persons to certify the release of the batches and it should clearly identify and record the person releasing or certifying the batches. This should be performed using an electronic signature.

16. Business Continuity

For the availability of computerised systems supporting critical processes, provisions should be made to ensure continuity of support for those processes in the event of a system breakdown (e.g. a manual or alternative system). The time required to bring the alternative arrangements into use should be based on risk and appropriate for a particular system and the business process it supports. These arrangements should be adequately documented and tested.

17. Archiving

Data may be archived. This data should be checked for accessibility, readability and integrity. If relevant changes are to be made to the system (e.g. computer equipment or programs), then the ability to retrieve the data should be ensured and tested.

Связанные защитные меры

	Название	Дата	Влияние
Community 1 13 / 21	Резервное копирование документов с ПК Ежедневно Автоматически Техническая Восстанавливающая Компенсирующая 20.06.2022	20.06.2022	1 13 / 21
Цель: сохранение документов в случае их уничтожения на ПК. Например, в результате кражи ПК, случайного или умышленного уничтожения файлов пользователем, запуска вируса-шифровальщика. Документы определенных форматов (doc, xls и т.п.) со всех доменных ПК регулярно копируются на сервер резервных копий. Варианты реализации: ПО для резервного копирования; DCAP системы защиты; Скрипты. В заметке к защитной мере приведен скрипт для создания системы резервного копирования документов с пользовательских ПК, на базе Групповой политики домена + Планировщика заданий + Скриптов на vbs/bat + Robocopy