For the whole retention period GxP records and data are protected, physically or logically, from being reached, changed or erased without authority or by accident; archiving is considered at system design, the strategy considers how records will be accessed and used during retention, archiving preserves content and meaning including electronic signatures, audit trails and other metadata, roles, procedures and regulatory requirements including any archivist role are defined, stored records are checked initially and periodically for accessibility, durability, readability and completeness, and regulators have reasonable access within a reasonable time; archiving is distinct from backup and cloud archive storage is acceptable. Processes are documented and verified, a documented approach ensures access through retention including the effect of application, database and technology upgrades, check frequency is set by risk considering formats, media and access method, and signature attributability is maintained. The process owner ensures procedures and technologies, the quality unit ensures they are followed and the system owner maintains the systems needed for access. A documented retention policy defines record types, formats and periods, an archive strategy sets requirements for an organization, site, department or archive, and a data archiving plan defines roles including external organizations, triggers whether event or frequency driven, process, scope, tools, media and location, searchability, initial and periodic verification and synchronization with system upgrades; third-party archive services are assessed and monitored by risk, facility and environmental controls limit media degradation with fire-resistant, off-site and geographically separated storage considered and privacy requirements informing location, records are searchable individually and collectively, media, appliances and cloud archives are evaluated for controls such as refresh and duplication with cloud agreements defining retention, restoration and integrity requirements, destruction at the end of retention is approved by the data owner and the quality unit, plus legal where appropriate, using secure methods unless a legal hold applies, and automated archiving is specified and verified to archive on schedule or trigger, ensure completeness and accuracy, keep the archive secure and consider the availability of devices and software. Retrieval is documented with authorization, search capability, retrieval of the associated audit trail and verification that the correct records were retrieved; copying or migrating records to another format is documented and verified for accessibility, accuracy, completeness and searchability; retaining historical records in an existing system requires securing them from processing, maintaining, licensing and securing the system, retaining access knowledge and hardware and software availability, with virtualization reducing the risks of aging systems; and records archived by a third party are returned under contract in an accessible, searchable and where required processable form.
This control maps to 1 controls across 1 other frameworks. If you already hold one of them, the evidence you collected for it is the starting point here rather than new work.
Every mapping shown was judged rather than inferred from wording similarity, and the ones that failed review are published too. See the coverage reports and what was rejected.
The graph holds this control, the 1 it maps to, and the evidence behind each claim, over MCP and REST.