FDA 21 CFR Part 11 Part11.CSV: Computer system validation + risk-based approach (21 CFR §11.10(a) + 2003 FDA Scope and Application Guidance + 2023 CSA draft)

Section 11.10(a) requires VALIDATION of closed systems to ensure accuracy + reliability + consistent intended performance + the ability to discern invalid or altered records. Validation is operationalised through: (a) Computer System Validation (CSV) lifecycle including URS (User Requirements Specification) + FS (Functional Specification) + DS (Design Specification) + IQ (Installation Qualification) + OQ (Operational Qualification) + PQ (Performance Qualification) + risk assessment + traceability matrix + validation summary report + ongoing validation maintenance; (b) GAMP 5 framework (ISPE Good Automated Manufacturing Practice) categorising systems as Category 1 (infrastructure software) through Category 5 (custom software) with proportionate validation rigour; (c) ICH Q9 (Quality Risk Management) + ICH Q10 (Pharmaceutical Quality System) risk-based approaches; (d) FDA 2003 SCOPE AND APPLICATION GUIDANCE (the 'enforcement discretion' guidance) clarifying that Part 11 requirements should be implemented based on RISK + CRITICALITY + intended use - not strictly across all systems; (e) FDA 2023 COMPUTER SOFTWARE ASSURANCE (CSA) DRAFT GUIDANCE proposing a modernised approach focused on critical thinking + risk + intended use + appropriate testing - reducing the prescriptive testing burden of traditional CSV; (f) Software Bill of Materials (SBOM) expectations for medical device + production software per the Cures Act 524B + the FDA 2024 pre-market cybersecurity guidance. The CSV-to-CSA transition is the most significant modernisation of Part 11 implementation in the past decade.