IT infrastructure is qualified rather than validated and, because it is dynamic and built from many standard components on a one qualification, many implementations model, it is managed to a controlled state; infrastructure software is category 1. Infrastructure as code is provisioned and deployed under configuration management with risk-based development, verification before deployment, review and authorization, templates and baseline monitoring to detect unauthorized change, with automated builds reviewed by exception and critical thinking applied where cybersecurity risk warrants more; tools such as configuration management databases, schedulers and service management tools are not validated but are installed, used and kept in a state of control. Infrastructure risks are cyberattack, unauthorized access, component failure, inadequate resource provisioning and uninformed system-wide changes, addressed by maintained controls such as patching, monitoring, resilience, training and expert oversight, and enterprise risks such as zero-day vulnerabilities may require expedited change. The quality unit's role is proportionate: an agreement between quality and IT system owners defines an IT quality framework and what it means for infrastructure to be fit for purpose, an internal IT quality function oversees IT processes and knows when to involve the quality unit, which is limited to changes with significant risk to applications or data, with responsibility for quality decisions procedurally defined. Processes in scope are security management with access control and periodic access review, minimized administrative access, cybersecurity and encryption key management, with data owners requesting additional protections; backup and recovery with defined and testable recovery point and recovery time objectives, periodic restoration verification and failures reported to the data owner; archive and restore with readability through the retention period and authorized destruction; change management at the IT process layer with standard and emergency changes and repair, maintenance and administration distinguished; configuration management with a configuration management database; disaster recovery and business continuity planned, resourced and tested with enterprise-level prioritization shared with all parties; and service desk, incident, problem, service level and asset management. Cloud infrastructure brings the same expectations with control delegated to the provider in IaaS, PaaS and SaaS, assured through supplier evaluation and contractual service level, quality and monitoring agreements with escalation, knowledge of where data resides, and consideration of supplier staff access, encryption key management, disaster recovery with agreed objectives, certifications, vulnerability scans and penetration tests, redundancy and segregation, and the fit of the deployment model to the GxP risk; continual improvement is driven by monitored key process indicators.
This control maps to 1 controls across 1 other frameworks. If you already hold one of them, the evidence you collected for it is the starting point here rather than new work.
Every mapping shown was judged rather than inferred from wording similarity, and the ones that failed review are published too. See the coverage reports and what was rejected.
The graph holds this control, the 1 it maps to, and the evidence behind each claim, over MCP and REST.