Frameworks / Annex 11 to EU GMP - Computerised Systems / Clause 10 Annex 11 to EU GMP - Computerised Systems
Operational Phase - Change and Configuration
Annex 11 to EU GMP - Computerised Systems Clause 10: Change and configuration management All changes to computerised systems must follow defined change management procedures and be documented.
Maintained by Gerard Blokdyk · Verified against the published standard 31 May 2026 · Control text last updated 21 May 2026 What else in your programme already covers this This control maps to 372 controls across 171 other frameworks. If you already hold one of them, the evidence you collected for it is the starting point here rather than new work.
IEC62304-4.1 Quality Management System IEC62304-5.1 Software Development Planning IEC62304-5.2 Software Requirements Analysis IEC62304-5.3 Software Architectural Design IEC62304-7.2 Risk Control Measures IEC62304-8.2 Change Control IEC62304-9.4 Use Change Control Process FEDRAMP-CM-1 Configuration Management Policy FEDRAMP-CM-2 Baseline Configuration FEDRAMP-CM-6 Configuration Settings FEDRAMP-CP-9 System Backup FedRAMP-Boundary Authorization Boundary, SSP, SAR, POA&M documentation FedRAMP-ConMon Continuous Monitoring (ConMon) and Significant Change Requests NRC7354-2 Critical Digital Asset (CDA) Identification, Scope, and Boundary NRC7354-4 Security Controls Implementation per NRC RG 5.71 Appendix B/C RG5.71-C.3 Cyber Security Training RG5.71-C.5 Recovery and Restoration RG5.71-C.6 Configuration Management NISTSP82-1 OT Security Program Governance, Policy, Roles, and Safety-Security Integration NISTSP82-5 OT Configuration Management, Patching, Vulnerability Management, and Malware Protection NISTSP82-6 OT Audit, Monitoring, Anomaly Detection, and OT-Specific SOC NISTSP82-7 OT Incident Response, Forensics, Recovery, and Continuity SSAE18-CC3.4 CC3.4 - COSO Principle 9: Change Management SSAE18-CC7.4 CC7.4 - Incident Response SSAE18-CC8.1 CC8.1 - Infrastructure and Software Change Management SSAE18-PI1.1 PI1.1 - Processing Integrity Definition API1164-14 Physical Security API1164-22 Configuration management for OT systems API1164-23 Change management procedures ASD37-04 User application hardening (Essential) ASD37-10 Server application hardening (Very Good) ASD37-11 Operating system hardening (Very Good) MLE.1 Machine Learning Requirements Analysis MLE.3 Machine Learning Training SUP.8 Configuration Management BSI-23 Baseline configuration establishment BSI-24 Configuration change control BSI-26 System component inventory DA-1 Enterprise Data Architecture DIQ-2 Data Quality Management RMD-1 Reference Data Management GAMP5-Lifecycle-VModel-URS-FS-DS-IQOQPQ V-Model Lifecycle - URS + FS + DS + IQ + OQ + PQ + Traceability GAMP5-Risk-CriticalThinking Risk-Based Approach, Critical Thinking and 5 Key Concepts GAMP5-Supplier-Operations-Change-Periodic Supplier Assessment, Operational Phase, Change Control and Periodic Review IEC62443-14 System security hardening IEC62443-22 Configuration management for OT systems IEC62443-23 Change management procedures ISO-15189-5.1 Legal entity ISO-15189-5.4 Structure and authority ISO-15189-6.7 Service agreements ISO-19650-1-4 Information management concepts ISO-19650-1-7 Common Data Environment (CDE) concept ISO-19650-3-5.3 Trigger events for information exchange ISO-22320-5.1 General process requirements ISO-22320-5.3 Incident management structure (command) ISO-22320-5.4 Roles and responsibilities ISO-26262-3-5 Item definition ISO-26262-8-7 Configuration management ISO-26262-8-8 Change management ISO23894-1 Scope of AI Risk Management ISO23894-3 AI-Specific Terminology ISO23894-6.2 Scope, Context and Criteria 27004-3 Terms and definitions 27004-A.2 Patching and Vulnerability Measures 27004-B.1 Example measurement definitions ISO27019-14 System security hardening ISO27019-22 Configuration management for OT systems ISO27019-23 Change management procedures 27557-1 Scope 27557-3 Terms and definitions 27557-6.2 Scope, context, and criteria for privacy 29100-1 Scope 29100-3 Terms and definitions 29100-4.1 Actors and roles MTCS-Governance-ISMS-Risk-HR-Lifecycle-Compliance-Cloud-Strategy-Roles-Responsibilities MTCS Governance + ISMS + Risk Management + HR Security + Cloud Service Lifecycle + Compliance + Roles MTCS-Logging-Monitoring-Compliance-Audit-SLA-Configuration-SIEM-SOAR-Cloud-Monitoring-CSPM MTCS Logging + Monitoring + Compliance + Audit + SLA + Configuration + SIEM + SOAR + CSPM MTCS-Operations-Physical-Network-Tier-III-Data-Centre-Hardening-Patching-Network-Segmentation-DDoS MTCS Operations + Physical + Network + Tier III Data Centre + Hardening + Patching + Segmentation + DDoS NIST-CSF-DE.AE-08 Incidents are declared when adverse events meet the defined incident criteria NIST-CSF-PR.AA-05 Access permissions, entitlements, and authorizations are defined in a policy, managed, enforced, and reviewed, and incorporate the principles of least privilege and separation of duties NIST-CSF-PR.PS-01 Configuration management practices are established and applied NDPA-1 Applicability, Scope, and Carve-Outs NDPA-2 Consumer Rights - Access, Correct, Delete, Portability, Appeal NDPA-5 Privacy Notice, Data Minimisation, and Purpose Limitation NG-NDPA-1 Scope, Applicability, and Establishment of Nigeria Data Protection Commission NG-NDPA-2 Lawful Basis, Consent, and Data Protection Principles NG-NDPA-5 Security of Processing, Breach Notification, and DPIA ORANWG11-2 O-RAN Interface Security: E2, A1, O1, O2, Open Fronthaul ORANWG11-3 Cryptography, TLS, SSH, IPsec, and PKI Lifecycle Management ORANWG11-6 Security Test Specifications, Certification, and Conformance DSOMM-1 Culture, Organization, Education, and Governance DSOMM-2 Implementation Practices, Secure Coding, and Threat Modelling DSOMM-3 Build, Deployment, Infrastructure Hardening, and Secrets Management PICSGMP-2 Chapter 2: Personnel - Qualified Personnel, Key Responsibilities, Training PICSGMP-5 Chapter 5: Production Operations and Material Management PICSGMP-7 Chapter 7: Outsourced Activities and Supplier Management SOC2-CC4.2 CC4.2 Evaluating and communicating control deficiencies (COSO principle 17) SOC2-CC7.4 CC7.4 Responding to security incidents SOC2-CC8.1 CC8.1 Managing changes to procedures, software, data and infrastructure TRINIDAD-1 Scope, Definitions, Commission TRINIDAD-2 Lawful Processing and Consent TRINIDAD-3 Data Subject Rights Section 6(5) Definition of Foreign Public Official Section 8 Definition of Associated Person UKBRIBE-3 Due Diligence on Third Parties 58.1 Scope 58.3 Definitions AWWA-1.1 Security Policy and Governance AWWA-4.3 Configuration Management AL-DPA-1 Scope and Definitions AL-DPA-3 Lawful Basis for Processing AT-DSG-2 Section 2 - Scope and application AT-DSG-8 Section 22 - Functions and powers of the DPA FFIEC-05 Roles and responsibilities definition FFIEC-10 Secure configuration standards FISMA-3554-Agency-Responsibilities Federal Agency Responsibilities (44 USC 3554) - CIO + CISO + Program + Reporting FISMA-NIST-800-53-RMF-800-171-FIPS Operationalisation via NIST 800-53 + 800-37 RMF + 800-171 + FIPS 199 + FIPS 200 FTC-Safeguards-9-Elements 9 Safeguard Elements - Access, Inventory, Encryption, Secure-Dev, MFA, Disposal, Change-Mgmt, Monitoring, Pen-Test (16 CFR 314.4(c)) FTC-Safeguards-Scope-Defs Scope, Definitions and Financial Institution Applicability (16 CFR 314.1, 314.2) FDBR-702 Definitions (§501.702) FDBR-Scope-Defs Scope, Applicability Thresholds and Definitions (Fla. Stat. 501.701, 501.702, 501.703, 501.704) GLBA-Sec6801-PolicyDuty-SafeguardingStandard GLBA Section 6801 - Privacy Obligation Policy and Safeguarding Standard GLBA-Subordinate-Rules-Operationalisation GLBA Operationalisation through FTC Safeguards Rule, Privacy Rule, SEC Reg S-P and Banking-Agency Guidelines HKMA-SPM-CG-IC-AC-Governance-Control-Audit HKMA SPM Corporate Governance (CG-1/2/3/5/6), Internal Control (IC-1/5), Auditing (AC-G) HKMA-SPM-TM-Technology-TM-G-1-CRAF-Coord HKMA SPM Technology Management Modules (TM-G-1 to TM-G-4, TM-E-1) + Coordination with C-RAF IATF16949-Clause10-Improvement-Nonconformity-CorrectiveAction-Problem-ErrorProof IATF 16949 Clause 10 - Improvement + Nonconformity + Corrective Action + Problem Solving + Error Proofing + Continual Improvement IATF16949-Clause9-Performance-Monitoring-InternalAudit-ManagementReview IATF 16949 Clause 9 - Performance Evaluation + Monitoring + Internal Audit + Manufacturing Process Audit + Management Review 60601-1.3 Terminology and definitions 60601-1.4.1 General requirements ISO-20400-4.2 Principles of sustainable procurement ISO-20400-7.2 Integrating sustainability into specifications ISO-41001-4.1 Understanding the organization and its context ISO-41001-4.3 Determining the scope of the FM management system ISO-56002-4.3 Determining the scope of the innovation management system ISO-56002-8.3.4 Develop solutions ISO8000-DQM-02 Data Quality Dimensions ISO8000-MDG-03 Continuous Improvement ISO-17025-5.1 Legal entity ISO-17025-5.4 Personnel for the management system ISO20000-06 Change management processes ISO20000-10 Configuration management ISO-25012-5.2 Defining data quality measures ISO-25012-5.3 Planning and performing data quality evaluations 27011-1 Scope 27011-3 Terms and definitions 27014-1 Scope 27014-3 Terms and definitions 27400-3 Terms and definitions 27400-6.4 Default Configuration Security 29147-3 Terms and definitions 29147-9.2 Contact mechanisms and scope 30111-3 Terms and definitions 30111-5.1 Organizational policy ITIL4-06 Change management processes ITIL4-10 Configuration management IsraelPPL-Database-Registration-Definition-Document-Security-Level-Classification-Sec7-8-PPA-Registry Israel POPL Database Registration + Section 7 Database Definitions + Section 8 Registration Requirement + Database Definition Document + Security Level Classification + PPA Public Registry + Amendment 13 Threshold Changes IsraelPPL-Scope-5741-1981-Knesset-Amendment13-March2024-BasicLaw-Dignity-Sec1-Right-Privacy Israel Protection of Privacy Law 5741-1981 Scope + Knesset + Amendment No. 13 March 2024 + Basic Law Human Dignity and Liberty + Section 1 Right to Privacy + Constitutional Status + Chapter 1 Infringement of Privacy MAS-TRM-Access-Cryptography-Network-Security-Chapters-9-10-MFA-PKI-Encryption-Network-Segmentation MAS TRM Access Control + Cryptography + Network + Chapters 9-10 + MFA + PKI + Encryption + Network Segmentation MAS-TRM-Governance-Chapters-2-3-Board-Senior-Management-Risk-Framework-Information-Asset-Management MAS TRM Governance + Chapters 2-3 + Board + Senior Management + Risk Framework + Information Asset Management STANAG-1 STANAG 4774 Confidentiality Label Schema and XML Structure STANAG-2 STANAG 4778 Metadata Binding Mechanism and Cryptographic Binding NISTSP144-1 Cloud Governance, Risk Assessment, and Provider Trust Evaluation NISTSP144-7 Cloud Workload Protection, Containers, Serverless, and Configuration NISTSP145-7 Cloud Procurement Standards Aligned to NIST SP 800-145 Definition NISTSP145-8 Governance, Reporting, and Stakeholder Education on Cloud Definition NISTSP146-1 Cloud Adoption Strategy, Workload Suitability, and Decision Framework NISTSP146-4 IaaS Operational Recommendations and Workload Hardening OSFIB13-1 Governance, Risk Management, and Three Lines of Defense OSFIB13-3 Cyber Security: Identification, Protection, Detection, Response, Recovery OPENBANK-2 Strong Customer Authentication (SCA), Consent Lifecycle, and Customer UX OPENBANK-3 Mutual TLS, Token Binding, Request Signing (JWS), Key Management PCI-P2PE-05 Roles and responsibilities definition PCI-P2PE-10 Secure configuration standards PCI-PIN-05 Roles and responsibilities definition PCI-PIN-10 Secure configuration standards PCI-SSF-05 Roles and responsibilities definition PCI-SSF-10 Secure configuration standards PSDTWO-1 Strong Customer Authentication (SCA) Core Requirements PSDTWO-2 SCA Exemptions and Risk-Based Authentication PICERL-P2 Risk Assessment PICERL-P3 CSIRT Formation SASB-1 Business Model + Innovation (BMI) SASB-BMI-5 Physical Impacts of Climate Change C1 Organizational Boundary C3 Scope 1 and 2 Coverage ISMSP-SYS-01 System Hardening and Patch Management ISMSP-SYS-04 Vulnerability Management TANZANIA-1 Scope, Registration, Lawful Basis TANZANIA-4 Security and Cross-Border UKGAMBLE-1 Scope and Applicability to Licensees UKGAMBLE-4 Resilience and Incident Response US-SEC-DA-SC-01 Howey Test Application US-SEC-DA-SC-02 Registration Requirements CFR211-A-3 Section 211.3 - Definitions AS9100D-8.1 Operational Planning and Control 4.4.1 Resources, Roles, Responsibility, and Authority AZ-DPA-2 Article 2 - Basic Concepts CPG-6.B Supply Chain Incident Reporting COBIT-BAI02 Managed requirements definition CA-ITSG33-SC-01 Security Control Catalogue R.16-VATR.Unhosted Unhosted (self-hosted / non-custodial) wallet transfers - 2024 Targeted Update CJIS-7 Configuration Management Part11.10 Controls for closed systems (21 CFR §11.10) QMSR-ISO13485-Sec5 Management responsibility (ISO 13485:2016 Section 5 - incorporated via §820.10) CAT-D3-3 Corrective controls CA-9 Internal System Connections CA-9 Internal System Connections Sapin2-Pillar1-Code-of-Conduct Pillar 1 - Anti-Corruption Code of Conduct GLI33-EventWagering-System-Architecture GLI-33 Event Wagering System Architecture, Wager Engine, Odds Engine and Risk Management GhCSA-Implementation-Roadmap Implementation Roadmap - Organizational Roles, Tooling and Metrics IACS-UR-E27-Equipment-Hardening-SecureConfig-Communications IACS UR E27 - Equipment Hardening + Secure Configuration + Secure Communications + Cryptography ICP-1 Objectives, Powers and Responsibilities of the Supervisor IATA-IOSA-Section1-ORG-Organization-ManagementSystem-SMS IATA IOSA Section 1 - ORG Organization and Management System + Safety Management System (SMS) + Safety Policy + Hazard ID + Quality 62351-2 Glossary of terms IEEE1686-Section5.5-5.6-5.7-5.8-Firmware-ConfigSW-TimeSync-DataAtRest IEEE 1686 Section 5.5-5.8 - Firmware Quality + Configuration Software Security + Time Synchronisation + Data Protection at Rest + Patch + Malware + Hardening + Vulnerability IMO-MSC-FAL-Identify-AssetInventory-ThreatsVulnerabilities-CyberRiskAssessment-RolesResponsibilities IMO MSC-FAL Identify Function - OT/IT Asset Inventory + Threats + Vulnerabilities + Cyber Risk Assessment + Roles and Responsibilities + Crew + CSO + DPA ISO-14064-1-5.1 Organizational boundaries ISO28001-PI-01 Personnel Security Screening ISO30401-18 Innovation and change management ISO27003-4.3 Determining the scope of the information security management system 27007-5.2 Audit Programme Objectives ISO27043-04 Roles and responsibilities definition 27050-1.4 Terms and definitions 29115-3 Terms and definitions 29134-3 Terms and definitions ISO21434-04 Roles and responsibilities definition ITAR-Scope-AECA-22USC2778-22CFR120-130-DDTC-USML-21Categories-DefenseArticle-Service-TechnicalData ITAR Scope + Arms Export Control Act (22 USC 2778) + 22 CFR Parts 120-130 + Directorate of Defense Trade Controls (DDTC) + United States Munitions List (USML) 21 Categories + Defense Article/Service/Technical Data Definitions ITU-Scope-Constitution-Convention-Radio-Regulations-WRC-Quadrennial-Treaty-Art1-Definitions ITU Constitution + Convention + Radio Regulations Scope + Article 1 Definitions + Article 2 Nomenclature + WRC World Radiocommunication Conference Quadrennial Treaty Process + Member States + Sector Members BIPA-SEC5-1 Biometric Identifier Definition NERCCIP-5 System Security Management + Configuration Change Management and Vulnerability Assessments (CIP-007 + CIP-010) PQC-4 FIPS 205 SLH-DSA Implementation - Stateless Hash-Based Digital Signature NISTPF-8 Protect-P Information Protection Processes (PR.PO-P) NISTSP115-1 Scope, Methodology, and Assessment Planning NISTSP137-1 ISCM Strategy, Governance, and Volatility Assessment NISTSP61-2 Computer Security Incident Response Team (CSIRT) Structure and Staffing NISTSP63R4-1 Digital Identity Risk Management and IAL/AAL/FAL Assurance Level Selection NISTSP88-1 Media Sanitization Policy, Roles, and Decision Framework NISTSP92-1 Log Management Programme, Policy, Roles, and Operational Runbooks NRFCS-1 Retail Cybersecurity Governance, Policy, and Regulatory Change Management AUNDB-A3 Eligible Data Breach Determination and Serious Harm Threshold OCCHS-1 Scope, Applicability, and Definitions of Heightened Standards OWASPSAMM-1 Governance: Strategy, Policy, Compliance, Education, Champions OMANCS-5 Network, Endpoint, System Development, and Configuration Security OSSFSC-1 Branch Protection, Code Review, and Repository Governance 2.2.2 2.2.2 Vendor default accounts managed PTESPHASE-1 Pre-Engagement Interactions and Scoping PHILCC-1 Computer Crime Offences (Illegal Access, Interference, Misuse of Devices) PSPF24-1 Security Culture, Governance, Risk Management RCEPEC-1 Online Personal Information Protection (12.13) EHDSREG-1 Mandatory Requirements for EHR Systems (Articles 14-29) RIDTPPA-1 Scope, Applicability, Definitions SHAREASSESS-1 Information Governance and Risk SUPCHAIN-1 Build Integrity - Source, Build, Provenance SOC-CY-S3 Change Management CISABD-1 Take Ownership of Customer Security Outcomes SCA-S2 Interpretation and Definitions IM8-RES.2 Disaster Recovery PIPA-Data-Subject-Rights-Access-Correction-Erasure-Portability-Automated-Decisions-Articles-35-37-2 Korea PIPA Data Subject Rights + Access + Correction + Erasure + Portability + Article 35-37 SWE-2 Relationship to GDPR FADP-5 Definitions (Article 5) UKGDPRREG-1 Subject Matter, Scope, Principles (Articles 1-11) OB-OPS.2 Performance Standards UK-TSA-NET-01 Security Architecture 15 U.S.C. § 78dd-2(h) Definition of Domestic Concern W3CVCDM-1 Three-Party Ecosystem (Issuer, Holder, Verifier) WCAGREC-3 Principle 3: Understandable SO2.2 Digital health architecture blueprint Every mapping shown was judged rather than inferred from wording similarity, and the ones that failed review are published too. See the coverage reports and what was rejected .
Other controls in Operational Phase - Change and Configuration Query this from an agent The graph holds this control, the 372 it maps to, and the evidence behind each claim, over MCP and REST.