ICH E6(R3) - Good Clinical Practice
ICH E6 Scope + Principles

ICH E6(R3) - Good Clinical Practice ICH-E6-Scope-Principles-R3-2025-Risk-Based-DecentralisedClinical: ICH E6 Good Clinical Practice - Scope + 13 Principles + R3 January 2025 + Risk-Based + Decentralised + Modernisation

ICH E6 Good Clinical Practice (GCP) is the international ethical and scientific quality standard for designing + conducting + recording + reporting trials that involve participation of human subjects. Developed by International Council for Harmonisation of Technical Requirements for Pharmaceuticals for Human Use (ICH) - founded 1990 + tripartite (regulators + industry) global standardisation body. ICH E6 history: E6 original 1995-1996; E6(R1) post-Step 4 editorial corrections 2009; E6(R2) Integrated Addendum (Step 4 dated 9 November 2016) - introduced quality risk management + risk-based monitoring + electronic systems; **E6(R3) Step 4 finalised 6 January 2025** - SUPERSEDES E6(R2) - completely restructured with: 5 Principles (P1-P5) emphasising risk-based + proportionate + decentralised + electronic + data integrity by design; Glossary (Section 2); IRB/IEC (Section 3); Investigator (Section 4); Sponsor (Section 5); Data Governance (Section 6); Clinical Study Report (CSR); 2 Annexes - Annex 1 Computer Systems + Annex 2 Decentralised Elements. R3 implementation: FDA + EMA + PMDA + Health Canada + Swissmedic + ANVISA + WHO + national regulators globally; staged regulatory adoption; transition from R2 ongoing 2025-2027. R3 emphasises: stakeholder cooperation + risk proportionality + critical-to-quality + technology-agnostic + decentralised trials + investigator and sponsor flexibility + participant-centric + transparent communication + lifecycle approach. Mandatory for marketing authorisation studies + Investigational New Drug (IND) submissions in ICH regions. Coordinates with FDA 21 CFR Part 50 (Informed Consent) + Part 56 (IRBs) + Part 312 (IND) + Part 314 (NDA) + Part 11 (Electronic Records and Signatures) + EMA + EU Clinical Trials Regulation 536/2014 (CTR) + PMDA + WHO Operational Guidelines + Declaration of Helsinki 2024 + ICH E8 (General Considerations) + ICH E9 (Statistical) + ICH E2A (Safety Reporting) + ALCOA+ Data Integrity principles. ICH E6 + R3 + Principles + Risk-Based + Decentralised + R2 history applies.

Maintained by Gerard BlokdykVerified against the published standard Control text last updated

What else in your programme already covers this

This control maps to 145 controls across 78 other frameworks. If you already hold one of them, the evidence you collected for it is the starting point here rather than new work.

Australia NHMRC National Statement on Ethical Conduct in Human Research · 9 controls

ISO/IEC 27557:2022 - Organisational Privacy Risk Management · 6 controls

  • 27557-1 Scope
  • 27557-3 Terms and definitions
  • 27557-6.2 Scope, context, and criteria for privacy
  • 27557-6.4 Privacy risk treatment
  • 27557-6.6 Recording and reporting
  • 27557-7.3 Risk-based privacy program implementation

Annex 11 to EU GMP - Computerised Systems · 4 controls

IEC 60601-1 - Medical Electrical Equipment Safety · 4 controls

  • 60601-1.3 Terminology and definitions
  • 60601-1.4.1 General requirements
  • 60601-1.4.2 Risk management process
  • 60601-1.5.1 General requirements for testing

APRA CPS 230 Operational Risk Management · 3 controls

  • CPS230-16 Internal Audit Review of the Business Continuity Plan
  • CPS230-37 Service Provider Management Policy
  • CPS230-46 Ongoing Risk Management of Each Material Arrangement

FedRAMP Rev 5 · 3 controls

  • FedRAMP-Boundary Authorization Boundary, SSP, SAR, POA&M documentation
  • FedRAMP-ConMon Continuous Monitoring (ConMon) and Significant Change Requests
  • FedRAMP-SupplyChain-SBOM FedRAMP supply chain risk management + SBOM (per EO 14028 + NIST 800-218 SSDF)

IAEA Nuclear Security Series - Computer Security at Nuclear Facilities (NSS-17-T Rev 1) · 3 controls

ISO/IEC 27004:2016 · 3 controls

  • 27004-3 Terms and definitions
  • 27004-A.2 Patching and Vulnerability Measures
  • 27004-B.1 Example measurement definitions

ISO/IEC 29100:2024 · 3 controls

  • 29100-1 Scope
  • 29100-3 Terms and definitions
  • 29100-4.1 Actors and roles

21 CFR Part 58 - Good Laboratory Practice (GLP) · 2 controls

  • 58.1 Scope
  • 58.3 Definitions

APRA CPS 234 · 2 controls

  • CPS234-16 Assessment of Related Party and Third Party Capability
  • CPS234-20 Information Asset Classification

Albania Law No. 124/2024 on Personal Data Protection · 2 controls

  • AL-DPA-1 Scope and Definitions
  • AL-DPA-3 Lawful Basis for Processing

Austria Data Protection Act (Datenschutzgesetz, DSG, amended 2018) · 2 controls

  • AT-DSG-2 Section 2 - Scope and application
  • AT-DSG-8 Section 22 - Functions and powers of the DPA

BS 65000:2014 - Guidance on Organizational Resilience · 2 controls

  • BS65000-RM-01 Resilience Journey
  • BS65000-RM-02 Integrated Approach

DAMA-DMBOK2 - Data Management Body of Knowledge (2nd Edition) · 2 controls

  • DA-1 Enterprise Data Architecture
  • DIQ-2 Data Quality Management

FFIEC Cybersecurity Assessment Tool (CAT) · 2 controls

  • CAT-D1-2 Risk management
  • CAT-ML-2 Evolving

GAMP 5 - Good Automated Manufacturing Practice · 2 controls

  • GAMP5-Lifecycle-VModel-URS-FS-DS-IQOQPQ V-Model Lifecycle - URS + FS + DS + IQ + OQ + PQ + Traceability
  • GAMP5-Risk-CriticalThinking Risk-Based Approach, Critical Thinking and 5 Key Concepts

GLBA · 2 controls

  • GLBA-Sec6801-PolicyDuty-SafeguardingStandard GLBA Section 6801 - Privacy Obligation Policy and Safeguarding Standard
  • GLBA-Subordinate-Rules-Operationalisation GLBA Operationalisation through FTC Safeguards Rule, Privacy Rule, SEC Reg S-P and Banking-Agency Guidelines

HKMA SPM · 2 controls

  • HKMA-SPM-CG-IC-AC-Governance-Control-Audit HKMA SPM Corporate Governance (CG-1/2/3/5/6), Internal Control (IC-1/5), Auditing (AC-G)
  • HKMA-SPM-OR-RR-SA-OperationalResilience HKMA SPM Operational Risk (OR-1), Operational Resilience (OR-2), Recovery Planning (RR-1), Outsourcing (SA-2)

IATF 16949:2016 - Quality Management System for Automotive Production · 2 controls

  • IATF16949-Clause10-Improvement-Nonconformity-CorrectiveAction-Problem-ErrorProof IATF 16949 Clause 10 - Improvement + Nonconformity + Corrective Action + Problem Solving + Error Proofing + Continual Improvement
  • IATF16949-Clause9-Performance-Monitoring-InternalAudit-ManagementReview IATF 16949 Clause 9 - Performance Evaluation + Monitoring + Internal Audit + Manufacturing Process Audit + Management Review

ICAO Annex 17 - Aviation Security (AVSEC) · 2 controls

  • ICAO-ANX17-Chap2-ThreatAssessment-RiskManagement-Cyber-GASeP ICAO Annex 17 Chapter 2 - Threat Assessment + Risk Management + Cyber Threats to Critical Aviation Systems (Amendment 17/18)
  • ICAO-ANX17-Chap4-Cargo-Mail-Catering-Stores-Supplies-RegulatedAgent-KnownConsignor ICAO Annex 17 Chapter 4 - Cargo + Mail + Catering + Stores + Supplies Security + Regulated Agent + Known Consignor + Supply Chain

ISO/IEC 27011:2024 · 2 controls

  • 27011-1 Scope
  • 27011-3 Terms and definitions

ISO/IEC 27014:2020 · 2 controls

  • 27014-1 Scope
  • 27014-3 Terms and definitions

ISO/IEC 29147:2018 · 2 controls

  • 29147-3 Terms and definitions
  • 29147-9.2 Contact mechanisms and scope

ISO/IEC 30111:2019 · 2 controls

  • 30111-3 Terms and definitions
  • 30111-5.1 Organizational policy

NIST Special Publication 800-34 Revision 1, Contingency Planning Guide for Federal Information Systems · 2 controls

  • NISTSP34-1 Contingency Planning Policy, Programme, and Plan Coordination
  • NISTSP34-2 Business Impact Analysis (BIA): Critical Resources, Recovery Priorities

OWASP DevSecOps Maturity Model (DSOMM) · 2 controls

  • DSOMM-1 Culture, Organization, Education, and Governance
  • DSOMM-2 Implementation Practices, Secure Coding, and Threat Modelling

PCAOB AS 2201 - Audit of Internal Control Over Financial Reporting (ICFR) · 2 controls

  • ASTWO-7 Deficiency Evaluation, Material Weakness, and Communication
  • ASTWO-8 ICFR Opinion, Basis, Definition, Limitations, Combined vs Separate Reports

Pakistan Personal Data Protection Bill 2023 · 2 controls

  • PAKPDPB-7 NCPDP, Registration, Records, Processor Contracts, DPO
  • PAKPDPB-8 Enforcement, Penalties, Complaints, Retention, Training

Science Based Targets Initiative (SBTi) - Net-Zero Standard · 2 controls

  • C1 Organizational Boundary
  • C3 Scope 1 and 2 Coverage

21 CFR Part 211 - Current Good Manufacturing Practice · 1 control

  • CFR211-A-3 Section 211.3 - Definitions

AML/CTF Act 2006 (Australia) · 1 control

  • AMLCTF-82 Part A Compliance

API 1164 · 1 control

  • API1164-21 TSA Pipeline Security Directive Alignment

AS9100D - Aerospace Quality Management System · 1 control

  • AS9100D-8.1 Operational Planning and Control

ASIS SPC.1-2009 - Organizational Resilience Standard · 1 control

  • 4.4.1 Resources, Roles, Responsibility, and Authority

AWWA Cybersecurity Guidance for the Water Sector (American Water Works Association) · 1 control

  • AWWA-1.1 Security Policy and Governance

Aged Care Quality Standards 2019 (repealed edition) · 1 control

  • ACQS-8-4 Risk Management

Azerbaijan Law on Personal Data (2010) · 1 control

  • AZ-DPA-2 Article 2 - Basic Concepts

Barbados Data Protection Act 2019 · 1 control

CISA Cross-Sector Cybersecurity Performance Goals (CPG) 2.0 · 1 control

  • CPG-6.B Supply Chain Incident Reporting

COBIT 2019 · 1 control

  • COBIT-BAI02 Managed requirements definition

Connecticut Data Privacy Act (CTDPA) · 1 control

  • CTDPA-1 Definitions

DFARS 252.204-7012 - Safeguarding Covered Defense Information · 1 control

  • 7012(a) Definitions

EU Clinical Trials Regulation (CTR 536/2014) · 1 control

FATF Recommendation 16 - Payment Transparency (Travel Rule) · 1 control

  • R.16-VATR.Unhosted Unhosted (self-hosted / non-custodial) wallet transfers - 2024 Targeted Update

FBI CJIS Security Policy · 1 control

  • CJIS-19 Supply Chain Risk Management

FDA Quality Management System Regulation (QMSR) · 1 control

  • QMSR-ISO13485-Sec5 Management responsibility (ISO 13485:2016 Section 5 - incorporated via §820.10)

FTC GLBA Safeguards Rule (16 CFR Part 314) · 1 control

  • FTC-Safeguards-Scope-Defs Scope, Definitions and Financial Institution Applicability (16 CFR 314.1, 314.2)

FedRAMP High · 1 control

  • CA-9 Internal System Connections

FedRAMP Moderate · 1 control

  • CA-9 Internal System Connections

Florida Digital Bill of Rights (FDBR) · 1 control

  • FDBR-Scope-Defs Scope, Applicability Thresholds and Definitions (Fla. Stat. 501.701, 501.702, 501.703, 501.704)

French Sapin II Law (Law No. 2016-1691) · 1 control

  • Sapin2-Pillar1-Code-of-Conduct Pillar 1 - Anti-Corruption Code of Conduct

GLI-33 - Gaming Laboratories International Event Wagering Systems · 1 control

  • GLI33-EventWagering-System-Architecture GLI-33 Event Wagering System Architecture, Wager Engine, Odds Engine and Risk Management

German Supply Chain Due Diligence Act (LkSG) · 1 control

IATA Operational Safety Audit (IOSA) Standards Manual · 1 control

  • IATA-IOSA-Section1-ORG-Organization-ManagementSystem-SMS IATA IOSA Section 1 - ORG Organization and Management System + Safety Management System (SMS) + Safety Policy + Hazard ID + Quality

IEC 62351 - Power Systems Communication Security · 1 control

  • 62351-2 Glossary of terms

ISO/IEC 23837:2023 · 1 control

  • 23837-1.1 Scope

ISO/IEC 27007:2020 · 1 control

  • 27007-5.2 Audit Programme Objectives

ISO/IEC 27031:2011 · 1 control

  • 27031-5.1 IRBC Policy

ISO/IEC 27050-1:2019 · 1 control

  • 27050-1.4 Terms and definitions

ISO/IEC 27400:2022 · 1 control

  • 27400-3 Terms and definitions

ISO/IEC 29115:2013 - Entity Authentication Assurance Framework · 1 control

  • 29115-3 Terms and definitions

ISO/IEC 29134:2023 · 1 control

  • 29134-3 Terms and definitions

Illinois Biometric Information Privacy Act (BIPA) · 1 control

  • BIPA-SEC5-1 Biometric Identifier Definition

India Account Aggregator Framework (RBI) · 1 control

  • RBI-AA-Ecosystem-FIPs-FIUs-Interoperability-Onboarding-Sahamati-DPI-IndiaStack RBI AA Ecosystem - Financial Information Providers (FIPs) + Financial Information Users (FIUs) + Interoperability + Sahamati SRO Onboarding + DPI India Stack + Cross-Sector Regulators

Italy Personal Data Protection Code (Legislative Decree No. 196/2003, amended 2018) · 1 control

  • ItalyCodice-DataSubjectRights-Limitations-Deceased-Minors-14-Years-Italian-2undecies-2duodecies-2terdecies Italy Codice Data Subject Rights + Article 2-undecies Limitations + Article 2-duodecies Deceased Persons Rights + Article 2-terdecies Minors Rights (14 Years Consent Age) + GDPR Articles 15-22 + Italian Civil Procedure Remedies

MITRE D3FEND · 1 control

OWASP ASVS · 1 control

  • OWASPASVS-1 Architecture, Design and Threat Modelling (V1)

PCI DSS 4.0 · 1 control

  • 2.2.2 2.2.2 Vendor default accounts managed

Protective Security Policy Framework (PSPF) Release 2026 · 1 control

  • PSPF24-1 Security Culture, Governance, Risk Management

SWIFT CSCF · 1 control

  • SWIFTCSCF-1 Restrict Internet Access and Protect Critical Systems (Objective 1)

Singapore AI Governance Framework · 1 control

  • AIGF-1.1 Risk Management and Internal Controls

TEFCA - Trusted Exchange Framework and Common Agreement · 1 control

  • TEFCAREC-1 Common Agreement Conformance and Onboarding

UAE Virtual Asset Regulatory Authority (VARA) Regulations · 1 control

  • CRM-3 Risk Management Framework

UK Defence Standard 05-138 - Cyber Security for Defence Suppliers · 1 control

US Foreign Corrupt Practices Act (FCPA) · 1 control

  • 15 U.S.C. § 78dd-2(h) Definition of Domestic Concern

USMCA Chapter 19 - Digital Trade (United States-Mexico-Canada Agreement) · 1 control

  • USMCADIGITAL-1 Cross-Border Data Flows and Localisation

Vietnam Law on Cybersecurity (No. 116/2025/QH15) · 1 control

  • VIETNAMCYBER-2 Prohibited Acts (Access, Interception, Forgery, Content)

Every mapping shown was judged rather than inferred from wording similarity, and the ones that failed review are published too. See the coverage reports and what was rejected.

Query this from an agent

The graph holds this control, the 145 it maps to, and the evidence behind each claim, over MCP and REST.

MCP endpointAll ICH E6(R3) - Good Clinical Practice controls