GAMP 5 crosswalk to general IT + security + medical device frameworks. NIST CSF 2.0: GxP-system IT general controls map to GOVERN + IDENTIFY (inventory + supplier risk) + PROTECT (access controls + encryption + secure dev) + DETECT (monitoring + audit trails) + RESPOND (incident + change) + RECOVER (backup + DR + business continuity); GAMP 5 + NIST CSF together cover both pharmaceutical-specific + general-IT controls. ISO/IEC 27001:2022 + ISO/IEC 27002:2022: ISMS structure for IT general controls supporting GAMP 5 CSV; ISO 27017 cloud-specific + 27018 PII-in-cloud-specific for cloud-based GxP systems. ISO 13485:2016 + IEC 62304:2006+A1:2015: medical-device QMS + medical-device software lifecycle - applies to GAMP-5-validated systems that ALSO meet medical device criteria (e.g. clinical-decision-support software + AI/ML SaMD); hybrid pharma + medical device organizations need both. ITIL 4 (IT Infrastructure Library): service management framework complementary to GAMP 5 operational phase (change + incident + problem + configuration + release management); ITIL + GAMP 5 integration optimises both compliance + service delivery. COBIT 2019: IT governance framework for boards + executives; ensures GAMP 5 program aligned with enterprise IT governance. ENGAGEMENT: organizations should maintain GAMP 5 + NIST CSF + ISO 27001 + ITIL + COBIT crosswalks + integrate with sector-specific medical device + clinical trial frameworks (FDA 21 CFR Parts 11/820/812 + EU MDR/IVDR + ICH Q9/Q10).
The graph holds this control, the 0 it maps to, and the evidence behind each claim, over MCP and REST.