ICH E6(R3) - Good Clinical Practice 4.3-use-security: Define computerised system responsibilities, brief developers on purpose and requirements, involve intended users in design, document procedures for use, train users, and manage security across the life cycle with user management, breach prevention and detection controls, backup and tested disaster recovery

What does 4.3-use-security require?

Responsibilities of the sponsor, investigator and others for each computerised system should be clear and documented; developers working on the responsible party's behalf should know the system's purpose and applicable regulations; and representatives of intended participants and health care professionals should be involved in design where relevant. Documented procedures should govern appropriate system use for data collection, handling and management, and users should be trained. Data and record security should be managed throughout the life cycle with controls including user administration and continuing measures that prevent, detect and limit breaches (considering authentication and password rules, firewalls, antivirus, patching, monitoring and penetration testing), adequate backups, and procedures for security, backup and disaster recovery that are periodically tested.