Tools supporting the computerized system life cycle, IT processes and infrastructure, which do not directly support GxP business processes or records, are category 1 and are managed by good IT practice inside an established IT management framework, ITIL for example, rather than by computerized system validation, while EU Annex 11 requires documented assessments of the adequacy of automated test tools and test environments supported by appropriate controls; software that migrates or converts GxP records does require validation whereas a tool that masks test data does not, and test, monitoring and security tools need a basic risk assessment and normal IT practice with their records preserved. Selection is a desktop assessment of whether the tool fits the process and the experts using it, unless the use is business critical, with attention to access to data and handover where tools are shared with a supplier. Risk assessment considers whether the tool is an industry standard, what data and records it holds and its integrity controls, its operational lifetime and support, verified download locations for open source, configuration and manual steps, monitoring of alerts, the impact of failure on operational systems, effects on performance and cybersecurity risks. Good practice includes an inventory such as a configuration management database recording where tools are deployed, the GxP-supporting records they hold and retention periods, a single owner for each tool, installation and configuration under version and change control, life cycle management with supported versions, security through patching, authorized sources and least privilege, controls for the integrity, security and availability of records that support the validated status including cloud-hosted tools without the full controls applied to primary GxP records, approvals traceable to defined roles without regulated electronic signature requirements, and a preference for keeping records in the tools rather than exporting them into controlled documents, with summary reports used in validation reports and process owners prepared to show tool-held information at inspection, possibly through preconfigured reports.
This control maps to 1 controls across 1 other frameworks. If you already hold one of them, the evidence you collected for it is the starting point here rather than new work.
Every mapping shown was judged rather than inferred from wording similarity, and the ones that failed review are published too. See the coverage reports and what was rejected.
The graph holds this control, the 1 it maps to, and the evidence behind each claim, over MCP and REST.