Hello good people of the world! Today’s post is continuing the series on compliance in the cloud. In the last post, we looked at the FDA’s 21CFR11, which is the legal statute medical device, pharmaceutical, and biologic manufacturers must adhere to when using computer systems for electronic records and/or signatures as part of their manufacturing process for products sold in the United States.
But 21CFR11 is old (1997!) and vague, really only covering at a high-level the requirements for impacted computer systems. Industry has filled in the details, and the ISO standards are a good example of that.
ISO 27001 covers Information Security Management Systems and costs about US$130. Firms may reference ISO certification as evidence of 21CRF11 compliance, such as Microsoft’s statement here.
Below is a summary of the procedural and/or engineering controls required by the standard. You’ll see a lot of overlap with the CFRs, other industry guidance like GAMP5, and other regulations like MHRA’s data integrity expectations.
Management of Policies
- Policies shall be defined, approved by management, and distributed to employees.
- Policies shall be reviewed at a planned interval and must be revised when processes change.
- Responsibilities shall be defined.
- Duties shall be segregated to avoid conflicts of interest.
- Communication with relevant authorities shall be maintained.
- Communication with relevant special interest groups and forums shall be maintained.
- Information security shall be addressed in all projects.
Human Resource Security
- Background checks shall be employed.
- Responsibilities related to information security shall be documented and understood.
- Training relevant to job functions shall be mandated and documented.
- A formal disciplinary process shall exist for employees who have committed an information security breach.
- Responsibilities shall be managed appropriately upon employee termination.
Asset Management
- An inventory of assets shall be maintained.
- Each asset shall have an assigned owner.
- Acceptable use of each asset shall be documented.
- Distribution and return of assets shall be managed.
Information Classification
- Information shall be classified in terms of legal requirements, regulatory requirements, confidentiality, etc.
- Procedures shall exist for the labeling of information by classification.
- Management of assets shall take into consideration the classification of information associated with the asset.
Media Management
- Removable media shall be managed per procedure.
- A procedure shall exist for the proper disposal of media.
- Procedures shall exist for the physical transfer of media, including protecting against unauthorized transfer, and damage/corruption of media during transfer.
Access Control
- A procedure shall exist for access control.
- User access shall be limited to the networks, systems, and information required to perform their job duties.
- A procedure shall exist for the registration and de-registration of users.
- A procedure shall exist for the access provisioning of users to all applicable systems.
- The allocation of privileged access rights shall be restricted and controlled.
- Authentication information shall be controlled through a formalized process.
- Asset owners shall review user access at planned intervals.
- User access shall be removed at appropriate times, such as employee termination.
Cryptography
- Procedures shall exist for the use of cryptographic controls to protect information.
Physical Security
- Security perimeters shall be defined to protect areas containing sensitive information.
- Secure areas shall employee physical entry controls.
- Physical protection against external and environmental threats shall be established.
- Procedures shall exist for working in secure areas.
Equipment
- Equipment shall be protected from problems with supporting utilities.
- Cabling shall be protected from interception, interference, and damage.
- Equipment shall be maintained on planned intervals.
Operations Security
- Operating procedures shall exist.
- Change management procedures shall exist.
- Resource use and process capacity shall be measured and understood.
Backup
- Backup and restore procedures shall be documented and tested on planned intervals.
Logging
- Event logs shall be employed, retained, and reviewed on planned intervals.
- Logs shall be protected from tampering, unauthorized access, and loss.
- Administration activities shall be logged and reviewed on planned intervals.
- Clocks used by systems shall be synchronized to a single reference time source.
Development Processes
- Software development procedures shall be documented.
- Changes to systems in the development lifecycle shall be controlled.
- Development environments shall be secured.
- Security functionality shall be tested during development.
- Acceptance testing shall be established for all new versions of software.
- Test data shall be controlled.
Suppliers
- Risks associated with supplier access shall be documented and mitigated.
- Risks and mitigations shall be communicated and agreed upon with suppliers.
- Suppliers shall be audited on planned intervals.
- Changes to supplier relationships shall be controlled.
Incidents
- Procedures shall exist for the management of incidents.
- End users shall be required to report incidents.
- Corrective and preventive actions shall be applied to the management of incidents.
Business Continuity
- Procedures shall exist for the continuity of business processes during adverse events.
- Business continuity procedures shall address information security concerns.
Like this MWV (Mike Williamson Validation) blog post? Be sure to like, share, and subscribe!
Mike Williamson Validation 