5 Software Categories per Appendix M4. CATEGORY 1 INFRASTRUCTURE SOFTWARE: layered software providing services + foundation (operating systems + databases + virtualisation + network OS + system utilities); validation typically: appropriately qualified by vendor + IT infrastructure standard procedures; minimal lifecycle deliverables. CATEGORY 2: DEPRECATED in 1st Edition (was firmware + later folded into other categories). CATEGORY 3 NON-CONFIGURED PRODUCTS: commercial off-the-shelf (COTS) software used without configuration (e.g. standard databases + word processors + non-configured analytical instruments software); validation: vendor assessment + IQ verifying installation + OQ verifying business processes work; lifecycle deliverables proportional. CATEGORY 4 CONFIGURED PRODUCTS: COTS software with configuration but no custom code (e.g. LIMS + ERP + MES + configured EDC); validation: configuration management + URS + FS + DS for configuration + comprehensive IQ + OQ + PQ + supplier assessment; LARGEST category in practice + most resource-intensive. CATEGORY 5 CUSTOM APPLICATIONS: bespoke + in-house developed + customised software (custom interfaces + custom calculation engines + custom workflow); validation: FULL LIFECYCLE coverage + URS + FS + DS + Code Review + Testing + Qualification + Configuration Management + Change Control. AI/ML SYSTEMS: 2nd Edition treats as Category 5 or hybrid depending on ML model training + retraining frequency + adaptivity.
The graph holds this control, the 0 it maps to, and the evidence behind each claim, over MCP and REST.