GAMP 5 - Good Automated Manufacturing Practice O11: Appendix O11 Security Management

Security management comprises the organizational, process and technical measures that keep regulated systems, data and records confidential, intact and available, minimizing internal and external threats: controls against unauthorized or inadvertent access, role-based access for users and administrators with segregation of duties, manual and automated monitoring to identify and respond to vulnerabilities and intrusions, and incident and problem processes for security risks, continuously assessed against new threats and scoped by the criticality of the processes and records and whether the system faces the internet. Organizational controls include periodic information security training covering on-site and remote working, clearly communicated roles and human resource checks at engagement. An information security management system as defined by ISO 27001 defines policies and procedures for information security, human resources, risk management, classifying and handling information, identity and access management (joiners, role changes and leavers, and regular review of access), segregation of duties, change, incident and problem management, malware protection, records, supplier management, backup, archive, continuity and disaster recovery, network security, patch and vulnerability management, mobile computing and teleworking, clock synchronization, software development, asset management, classifying data, handling and disposing of media, data privacy by jurisdiction and internal audit, and may be integrated with the IT quality system. Physical and technical controls include role-based security and access, identity and access management with multifactor authentication, password controls, environment segmentation, encrypted backups, software installation restrictions, anti-phishing, network security, virtual private networks, encryption of stored and transmitted data according to risk, key management, scanning for vulnerabilities, detecting and preventing intrusions, penetration tests, firewalls and perimeter defence, endpoint protection, physical access to facilities and controlled spaces, guest and wireless networks and clear screen and desk policies. Monitoring covers intrusion, vulnerabilities, failures, unauthorized configuration changes, resource use, network failures and periodic access review with automatic alerts and tickets; cloud environments are a shared responsibility covering human resources, data protection and location, application security, configuration baseline and infrastructure code monitoring, operating system security, networks and supplier monitoring, with segregation, centralized policy management, secure interfaces, denial-of-service protection, trusted providers, service tiers that include monitoring, coordinated disaster recovery responsibilities and verified backup. A risk-based internal audit program assesses the controls, senior management periodically reviews their effectiveness and resourcing, security patches are applied by risk with low impact on the validated state, evaluated through risk assessment and staged release to test and non-GxP environments, and certifications such as ISO 27001, ISO/IEC 27017, ISO/IEC 27701 and SOC reports benchmark providers with certification boundaries understood and attestation assertions considered.