Frameworks / Annex 11 to EU GMP - Computerised Systems / Clause 16 Annex 11 to EU GMP - Computerised Systems
Operational Phase - Release and Continuity
Annex 11 to EU GMP - Computerised Systems Clause 16: Business continuity Documented and tested procedures for alternative or manual operations must be maintained for system breakdowns.
Maintained by Gerard Blokdyk · Verified against the published standard 31 May 2026 · Control text last updated 21 May 2026 What else in your programme already covers this This control maps to 62 controls across 32 other frameworks. If you already hold one of them, the evidence you collected for it is the starting point here rather than new work.
8.3 Business continuity strategies and solutions 8.4 Business continuity plans and procedures 8.4.4 Business continuity plans ISO-22313-5.2 Policy ISO-22313-6.2 Business continuity objectives and plans to achieve them ISO-22313-6.3 Planning changes to the BCMS ISO22316-01 Organizational resilience and security - business continuity policy for building security and resilience ISO22316-14 Supply chain continuity ISO22316-15 Communication strategy during disruption 27031-7.1 IRBC Strategy 27031-7.2 Resource Requirements 27031-D Developing performance criteria ISO22317-11 Continuity strategy development ISO22317-14 Supply chain continuity ISO22317-15 Communication strategy during disruption ISO22318-13 Alternate site and resource planning ISO22318-14 Supply chain continuity ISO22318-15 Communication strategy during disruption NFPA1600-4.1 Leadership and Commitment NFPA1600-6.2 Crisis Management and Communications NFPA1600-6.4 Continuity and Recovery IM8-RES.1 Business Continuity Planning IM8-RES.2 Disaster Recovery IM8-RES.4 Resilience Testing FFIEC-11 Business continuity planning and testing FFIEC-12 Disaster recovery procedures PCI-P2PE-11 Business continuity planning and testing PCI-P2PE-12 Disaster recovery procedures PCI-PIN-11 Business continuity planning and testing PCI-PIN-12 Disaster recovery procedures PCI-SSF-11 Business continuity planning and testing PCI-SSF-12 Disaster recovery procedures CPS230-26 Critical Operations Register, Continuity Plan and Activation ASD37-35 Business continuity and disaster recovery plans (Very Good) 4.4.8 Business Continuity and Recovery BS65000-RM-02 Integrated Approach FIRST-CSIRTF-SA2-ISIM Service Area 2 - Information Security Incident Management (Intake, Analysis, Containment, Recovery, Coordination, Crisis) GAMP5-Supplier-Operations-Change-Periodic Supplier Assessment, Operational Phase, Change Control and Periodic Review GLBA-Subordinate-Rules-Operationalisation GLBA Operationalisation through FTC Safeguards Rule, Privacy Rule, SEC Reg S-P and Banking-Agency Guidelines HKMA-SPM-OR-RR-SA-OperationalResilience HKMA SPM Operational Risk (OR-1), Operational Resilience (OR-2), Recovery Planning (RR-1), Outsourcing (SA-2) ISO-15189-7.8 Continuity and emergency preparedness ISO28001-PC-04 Supply Chain Continuity Planning MAS-TRM-Reliability-Data-Centre-Chapters-7-8-RTO-RPO-BCP-DR-System-Availability-4-Hours-12-Months MAS TRM Reliability + Data Centre + Chapters 7-8 + RTO + RPO + BCP + DR + System Availability 4 Hours 12 Months NGCB-6 Incident Response, 72-Hour NGCB Notification, and Independent Investigation OSFIB13-3 Cyber Security: Identification, Protection, Detection, Response, Recovery OMANCS-7 Business Continuity, Disaster Recovery, and Resilience OPENBANK-8 Incident Detection, Response, Customer Notification, Post-Incident Review, BCM PSDTWO-2 SCA Exemptions and Risk-Based Authentication SOC-CY-A2 Disaster Recovery ISMSP-SYS-06 Business Continuity and Disaster Recovery Every mapping shown was judged rather than inferred from wording similarity, and the ones that failed review are published too. See the coverage reports and what was rejected .
Other controls in Operational Phase - Release and Continuity Query this from an agent The graph holds this control, the 62 it maps to, and the evidence behind each claim, over MCP and REST.