GAMP 5 - Good Automated Manufacturing Practice M4: Appendix M4 Categories of Software and Hardware

Software and hardware components are categorized by increasing complexity, novelty and likelihood of residual defects as a high-level preliminary risk assessment feeding risk and supplier assessment; categories 3 to 5 form a continuum, most systems combine components of several categories, and the category is one factor only, with life cycle activities scaled to GxP impact, novelty and complexity, with critical thinking behind them. Category 1 is infrastructure software, tools and IT services: layered software such as operating systems, databases, middleware and spreadsheet packages, infrastructure tools such as monitoring, scheduling, security and configuration tools, and tools supporting life cycle and IT processes; identity and version are recorded and verified at installation, high-impact tools such as password management are risk assessed, and infrastructure is controlled and managed. Category 2 is not used. Category 3 standard system components are off-the-shelf products not configurable to the business process or offering only factory-provided parameter ranges: a simplified life cycle for limited or moderate impact, supplier assessment scaled to risk and intended leveraging, requirements focused on intended use, all changes including supplier patches controlled, procedures and training, configuration choices recorded and verified, and calibration where software and hardware are interdependent. Category 4 configured components enable user-specific business processes and workflows: configuration choices are captured and managed, risk turns on the quality of the configuration and on new versions, supplier default-configuration testing may not cover the applied configuration so the regulated company verifies it with business process maps, data flow diagrams and risk-based testing, and custom macros or scripts are handled as category 5. Custom applications and components in category 5 carry high inherent risk with no user experience, calculation and logic errors that can persist undetected, supplier assessment focused on the supplier QMS for new development, reviews of design and source code, coding standards and full life cycle information. Hardware category 1 standard components are documented with manufacturer, version and serial number and verified as installed and connected under configuration management and change control; hardware category 2 custom components additionally need a design specification, acceptance testing, a risk-based and usually audited supplier assessment, compatibility verification and defined configuration.