Back to Frameworks
ICH E6(R3) - Good Clinical Practice
International (ICH regions and adopting regulators)
vICH E6(R3) Step 4, adopted 6 January 2025 (Principles and Annex 1 with Appendices A to C); Annex 2 is a separate document
6 domains
54 controls
ICH E6(R3) Good Clinical Practice (Step 4, January 2025): the eleven GCP principles and Annex 1 duties for ethics committees, investigators and sponsors, covering ethics review, informed consent, delegation and oversight, safety reporting, investigational product and blinding, quality and risk management, monitoring, audits, noncompliance, data governance, computerised system validation and security, the Investigator's Brochure, protocols and essential records.
Verified
ICH E6(R3) - Good Clinical Practice is a compliance framework from International (ICH regions and adopting regulators) with 6 domains and 54 controls that map to 106 other frameworks. The largest domains are Annex 1 section 3: sponsor – ICH E6(R3) - Good Clinical Practice (18 controls), Annex 1 section 2: investigator – ICH E6(R3) - Good Clinical Practice (14 controls), Introduction and the Principles of ICH GCP – ICH E6(R3) - Good Clinical Practice (11 controls). Every control below carries what it requires and what an assessor expects to see.
Framework summaries on this platform are interpretations grounded in the published source, for educational and compliance planning purposes. They do not reproduce or replace the official standards. Refer to the authoritative source for the definitive text. Framework names and trademarks belong to their respective organisations.
Framework Domains (6)
Annex 1 section 1: institutional review board / independent ethics committee – ICH E6(R3) - Good Clinical Practice
2 controls
| Code | Title |
|---|---|
| ich-e6-r3-good-clinical-practice::1.1-1.2 | IRB/IEC reviews the protocol, consent and assent materials, IB or product information, participant information, recruitment advertising, compensation plans, safety updates and investigator qualifications within a reasonable time, documents its decisions, conducts risk-based continuing review and checks consent exceptions, minor assent and payments |
| ich-e6-r3-good-clinical-practice::1.3-1.5 | IRB/IEC has a qualified membership (recommended at least five, including a non-medical and an independent member) with only independent members voting, works to written procedures at quorate announced meetings, follows the listed procedures and retains its records |
Annex 1 section 2: investigator – ICH E6(R3) - Good Clinical Practice
14 controls
| Code | Title |
|---|---|
| ich-e6-r3-good-clinical-practice::2.1-2.2 | Investigators are qualified by education, training and experience, know the investigational product, can show realistic recruitment potential and have enough time, staff and facilities |
| ich-e6-r3-good-clinical-practice::2.10-2.11 | Manage investigational product at the site (accountability, storage, use per protocol, participant instruction, direct-to-participant delivery safeguards) under investigator oversight, follow randomisation, break the blind only per protocol and document any premature unblinding |
| ich-e6-r3-good-clinical-practice::2.12-records | Maintain and control the investigator's essential records per Appendix C, retain them for the required period or until the sponsor says they are no longer needed (whichever is longer), protect them, name the responsible custodian and provide direct access on request |
| ich-e6-r3-good-clinical-practice::2.12-source | Ensure integrity of site data: ALCOA-quality source records with traceable changes, a defined source and capture plan, timely review of data including external data, correct use of sponsor tools, accurate and consistent reported data endorsed at milestones, privacy protection and unambiguous participant codes |
| ich-e6-r3-good-clinical-practice::2.12-systems | For site-deployed systems protect data from unauthorised access, alteration or loss, give secure attributable access, tell the sponsor of access changes for its systems, meet section 4 for trial-specific systems, keep traceability and training for participant devices and report significant system incidents |
| ich-e6-r3-good-clinical-practice::2.13 | On completion inform the institution, give the IRB/IEC a summary of the outcome and send regulators any required reports |
| ich-e6-r3-good-clinical-practice::2.3 | Investigators delegate only to qualified, informed people and parties, keep a proportionate delegation record, document service provider agreements, retain responsibility and oversight, and permit monitoring, audit, inspection and IRB/IEC review |
| ich-e6-r3-good-clinical-practice::2.4 | Before starting, hold documented, dated IRB/IEC approval of the protocol, consent materials, recruitment procedures and participant information; supply the current IB, participant information updates and status summaries; and report changes affecting conduct or increasing risk promptly |
| ich-e6-r3-good-clinical-practice::2.5 | Sign the protocol or agreement, comply with the protocol, GCP and regulation, document every deviation, explain and prevent recurrence of important ones, deviate only to remove immediate hazards and report such deviations promptly |
| ich-e6-r3-good-clinical-practice::2.6 | On premature termination or suspension, inform participants promptly and ensure appropriate therapy and follow-up, and notify the institution, sponsor, IRB/IEC and regulators as the situation requires |
| ich-e6-r3-good-clinical-practice::2.7 | Keep a qualified physician or dentist responsible for trial medical care, provide adequate care for trial-related adverse events, inform the primary physician with consent, report protocol-required events to the sponsor and all SAEs immediately with causality, and supply follow-up on deaths |
| ich-e6-r3-good-clinical-practice::2.8-content | Cover every applicable consent element (purpose, research nature, product and randomisation, procedures, expectations, risks including to partners and pregnancy, benefits or none, alternatives, injury compensation, payments and expenses, voluntariness, follow-up, data handling, record access, confidentiality and registration, new information, contacts, termination, duration, numbers and results), give copies, and handle minors and representative-consented participants appropriately |
| ich-e6-r3-good-clinical-practice::2.8-process | Run the consent process to regulation, GCP and Helsinki principles: approved materials, clear simple information, suitable media with a paper option, remote consent where appropriate with identity checks, timely new information and re-consent, no coercion or waiver language, ample time to decide, signatures, impartial witnesses and approved emergency procedures |
| ich-e6-r3-good-clinical-practice::2.9 | When participation ends early or routinely, follow the protocol including steps to retain collected data, try respectfully to learn the reason for withdrawal without undue influence, and inform participants of results and treatment received where relevant |
Annex 1 section 3: sponsor – ICH E6(R3) - Good Clinical Practice
18 controls
| Code | Title |
|---|---|
| ich-e6-r3-good-clinical-practice::3.1 | Design trials with enough supporting safety and efficacy data, quality built in around critical to quality factors, input from interested parties and operational feasibility without unnecessary complexity or burden |
| ich-e6-r3-good-clinical-practice::3.10 | Run a proportionate, risk-based quality management system with quality by design, identifying, evaluating, controlling (including pre-specified acceptable ranges such as quality tolerance limits), communicating, reviewing and reporting risks to critical to quality factors |
| ich-e6-r3-good-clinical-practice::3.11-QA | Maintain QA and QC processes and procedures; apply risk-based QA to find causes of serious noncompliance; and run independent, qualified, documented, risk-proportionate audits under written procedures, protecting audit reports and providing audit certificates when required |
| ich-e6-r3-good-clinical-practice::3.11-activities | Carry out monitoring activities across the life cycle (communication and deviation follow-up, site selection to close-out checks, investigational product checks and data checks) and report them with findings, actions and follow-up escalated and recorded |
| ich-e6-r3-good-clinical-practice::3.11-monitoring | Apply risk-based QC to data handling and monitor by independent, qualified people using a risk-based mix of site (on-site or remote) and centralised monitoring set out in a tailored monitoring plan that also covers critical processes outside sites |
| ich-e6-r3-good-clinical-practice::3.12 | Act proportionately on noncompliance, perform root cause analysis and CAPA for significant noncompliance, notify regulators and IRB/IEC of serious noncompliance, and consider ending persistently noncompliant investigators or providers |
| ich-e6-r3-good-clinical-practice::3.13 | Evaluate product safety continuously: aggregate and review safety information promptly, communicate relevant new information, submit safety updates and periodic reports, expedite SUSAR reporting against the reference safety information, report urgent issues without undue delay, agree alternative arrangements and act on immediate hazards |
| ich-e6-r3-good-clinical-practice::3.14 | Provide insurance or indemnity where required, address treatment costs for trial-related injury, and compensate participants as regulation requires |
| ich-e6-r3-good-clinical-practice::3.15-info-mfg | Develop and update the IB (or identify basic product information), characterise and manufacture investigational products to GMP with blinding-protective coding and compliant labels, set storage and handling conditions, package against deterioration, run blinding and emergency unblinding mechanisms and have data on significant formulation changes |
| ich-e6-r3-good-clinical-practice::3.15-supply | Supply investigational product only after required approvals, with handling instructions, timely provision, records from shipment to disposition, retrieval and disposition processes, in-date stable stock and retained samples for re-testing |
| ich-e6-r3-good-clinical-practice::3.16-data | Handle data with integrity and confidentiality: risk-focused QC, pre-specified data and collection methods, validated data tools, life-cycle processes, blinding safeguards and documented unblinding, guidance to sites, no unjustified changes, timely investigator access without sponsor exclusive control, milestone endorsement, controlled pre-analysis steps, unambiguous participant codes, privacy, security and incident reporting |
| ich-e6-r3-good-clinical-practice::3.16-stats-records | Pre-specify analysis in a statistical analysis plan, control and trace programming and derivations, pre-define analysis set criteria, document and justify post-unblinding changes, retain protected statistical outputs, retain sponsor essential records, inform sites about retention and ownership changes, and secure direct access to source records in agreements and consents |
| ich-e6-r3-good-clinical-practice::3.16-systems | Keep a record of important computerised systems (use, functionality, interfaces, validation status, responsibility, access controls and security), implement section 4 requirements, maintain user and permission records aligned with investigator delegations, collect defect and incident reports, and assess site and clinical practice systems for fitness before use |
| ich-e6-r3-good-clinical-practice::3.17 | On termination or suspension inform investigators, regulators and the IRB/IEC promptly with reasons and give follow-up information; prepare clinical trial reports to ICH E3; and after unblinding make results public, tell investigators about treatments and results and give participants plain-language summaries |
| ich-e6-r3-good-clinical-practice::3.2-3.5 | Provide sufficient resources, allocate roles before trial activities begin, use qualified individuals including readily available medical expertise, and document financing in an agreement with the investigator or institution |
| ich-e6-r3-good-clinical-practice::3.6 | Document agreements with investigators, institutions, service providers and committees before activities start, secure their commitments to GCP, recording, retention and access, document transferred activities, select and oversee service providers including subcontractors, and set responsibilities among co-sponsors |
| ich-e6-r3-good-clinical-practice::3.7-3.8 | Select qualified, adequately resourced investigators (and document coordinating roles), give them the protocol and current IB with time to review, make required regulatory submissions before starting and obtain IRB/IEC details, GCP compliance statements and documented approvals |
| ich-e6-r3-good-clinical-practice::3.9 | Oversee the trial so design, conduct, processes and data give reliable results and protect participants: classify important protocol deviations, assess decisions for impact, tailor oversight to risk, escalate issues promptly and run expert, conflict-managed committees (IDMC, adjudication) under charters |
Annex 1 section 4: data governance for investigators and sponsors – ICH E6(R3) - Good Clinical Practice
6 controls
| Code | Title |
|---|---|
| ich-e6-r3-good-clinical-practice::4-blinding | Address the key data governance processes (confidentiality, computerised systems, safeguarding randomisation, dosing and blinding, supporting key decisions) and protect blinding through system design, access roles, mitigation, risk assessment and documentation and assessment of any unblinding |
| ich-e6-r3-good-clinical-practice::4.2-capture-review | Cover the data life cycle with procedures: risk-based verification of transcribed data, metadata with all captured data, controlled automated validation checks, metadata and audit trail evaluation (user logs, change history, workflow actions, no disabling, interpretable, unambiguous time stamps) and planned risk-based review of data and metadata |
| ich-e6-r3-good-clinical-practice::4.2-later | Correct errors in an attributed, justified, source-supported and timely way; transfer and migrate data through validated or reconciled processes; finalise data sets for analysis under documented procedures; archive data and metadata retrievably and protected; and destroy them only when no longer required |
| ich-e6-r3-good-clinical-practice::4.3-operations | Release trial-specific systems to a site only after all its approvals, keep contingency procedures against data loss or inaccessibility, run help desk support with periodic review and criticality-based defect resolution, and control user access with role-based, promptly revoked, periodically reviewed and documented permissions |
| ich-e6-r3-good-clinical-practice::4.3-use-security | Define computerised system responsibilities, brief developers on purpose and requirements, involve intended users in design, document procedures for use, train users, and manage security across the life cycle with user management, breach prevention and detection controls, backup and tested disaster recovery |
| ich-e6-r3-good-clinical-practice::4.3-validation | Own validation status across the life cycle with a risk-based approach that shows completeness, accuracy, reliability and consistent performance, validating before use, after risk-assessed changes, configurations, customisations, interfaces and critical functions, with periodic review, retained documentation and justified unresolved issues |
Appendices A to C: Investigator's Brochure, protocol and essential records – ICH E6(R3) - Good Clinical Practice
3 controls
| Code | Title |
|---|---|
| ich-e6-r3-good-clinical-practice::A | Ensure an up-to-date Investigator's Brochure (or justified product information alternative) with reference safety information, reviewed at least annually, presented objectively and non-promotionally with medical input, containing the minimum content set |
| ich-e6-r3-good-clinical-practice::B | Write protocols and amendments containing the required content: general and background information, objectives, design, participant selection, discontinuation and withdrawal, treatments, efficacy and safety assessments, statistics, data handling, quality, ethics and other required sections |
| ich-e6-r3-good-clinical-practice::C | Manage essential records: identify which are essential by risk and relevance, keep them identifiable, version controlled and approved, hold them in TMF and ISF repositories with a location record, file them promptly, retain them complete, readable and directly accessible with traceable changes, use certified copies, share appropriately and keep them for the required period |
Introduction and the Principles of ICH GCP – ICH E6(R3) - Good Clinical Practice
11 controls
| Code | Title |
|---|---|
| ich-e6-r3-good-clinical-practice::P1 | Run trials ethically under Declaration of Helsinki principles, GCP and the law, with participants' rights, safety and well-being placed above science and society, timely safety review, justified risk-benefit, representative populations, qualified medical responsibility and protected confidentiality |
| ich-e6-r3-good-clinical-practice::P10 | Make roles and responsibilities clear and documented, keep overall responsibility when transferring or delegating activities, define them in agreements and oversee them |
| ich-e6-r3-good-clinical-practice::P11 | Manufacture investigational products under applicable GMP, preserve their quality, use them per protocol, keep handling and labelling consistent with treatment assignment and blinding, label them as regulations require and control their full handling cycle |
| ich-e6-r3-good-clinical-practice::P2 | Base participation on freely given, documented informed consent (or legally acceptable representative consent and minor assent) from a clear process suited to the trial, with deferred consent in emergencies as the IRB/IEC approves |
| ich-e6-r3-good-clinical-practice::P3 | Submit the trial to independent IRB/IEC review, conduct it under the approved protocol and undergo periodic IRB/IEC review |
| ich-e6-r3-good-clinical-practice::P4 | Make trials scientifically sound, supported by adequate nonclinical and clinical data and current knowledge, and review new scientific information periodically for needed modifications |
| ich-e6-r3-good-clinical-practice::P5 | Have trials designed and conducted by individuals qualified by education, training and experience for each task |
| ich-e6-r3-good-clinical-practice::P6 | Build quality into trial design and conduct: treat quality as fitness for purpose, identify critical to quality factors prospectively, and prevent, detect and correct serious noncompliance |
| ich-e6-r3-good-clinical-practice::P7 | Keep processes proportionate to risks to participants and the importance of the data, focus on risks beyond usual care, manage risks to critical factors proactively and avoid unnecessary complexity and burden |
| ich-e6-r3-good-clinical-practice::P8 | Describe the trial in a clear, concise, scientifically sound and feasible protocol with explicit objectives and equally clear execution plans |
| ich-e6-r3-good-clinical-practice::P9 | Generate reliable results through fit-for-purpose information, systems and validated computerised systems, robust record management, secure retention of essential records and transparency through registration and results posting |
Your Compliance Coverage
If you comply with ICH E6(R3) - Good Clinical Practice, you already cover:
EU Clinical Trials Regulation (CTR 536/2014)
11%
7 controls mapped
Compare →Aged Care Quality Standards 2019 (repealed edition)
8%
5 controls mapped
Compare →FDA Quality Management System Regulation (QMSR)
8%
5 controls mapped
Compare →+ 103 more: Florida Digital Bill of Rights (FDBR) (8%), TEFCA - Trusted Exchange Framework and Common Agreement (6%)
See all 106 mapped frameworks ↓Maps to 106 other frameworks
63 total controls
EU Clinical Trials Regulation (CTR 536/2014)
7 source controls mapped|20 target controls covered
11%
Aged Care Quality Standards 2019 (repealed edition)
5 source controls mapped|4 target controls covered
8%
FDA Quality Management System Regulation (QMSR)
5 source controls mapped|6 target controls covered
8%
Florida Digital Bill of Rights (FDBR)
5 source controls mapped|2 target controls covered
8%
TEFCA - Trusted Exchange Framework and Common Agreement
4 source controls mapped|2 target controls covered
6%
IEC 60601-1 - Medical Electrical Equipment Safety
4 source controls mapped|5 target controls covered
6%
GAMP 5 - Good Automated Manufacturing Practice
4 source controls mapped|2 target controls covered
6%
SWIFT CSCF
3 source controls mapped|4 target controls covered
5%
NIST Special Publication 800-34 Revision 1, Contingency Planning Guide for Federal Information Systems
3 source controls mapped|3 target controls covered
5%
Australia NHMRC National Statement on Ethical Conduct in Human Research
3 source controls mapped|14 target controls covered
5%
Barbados Data Protection Act 2019
3 source controls mapped|4 target controls covered
5%
FTC GLBA Safeguards Rule (16 CFR Part 314)
3 source controls mapped|3 target controls covered
5%
German Supply Chain Due Diligence Act (LkSG)
3 source controls mapped|3 target controls covered
5%
AS9100D - Aerospace Quality Management System
3 source controls mapped|2 target controls covered
5%
ISO/IEC 27014:2020
3 source controls mapped|3 target controls covered
5%
IATF 16949:2016 - Quality Management System for Automotive Production
3 source controls mapped|3 target controls covered
5%
Albania Law No. 124/2024 on Personal Data Protection
3 source controls mapped|4 target controls covered
5%
DAMA-DMBOK2 - Data Management Body of Knowledge (2nd Edition)
3 source controls mapped|3 target controls covered
5%
ISO/IEC 27011:2024
3 source controls mapped|6 target controls covered
5%
AWWA Cybersecurity Guidance for the Water Sector (American Water Works Association)
3 source controls mapped|3 target controls covered
5%
HITECH Act
3 source controls mapped|3 target controls covered
5%
COSO Internal Control - Integrated Framework (2013)
3 source controls mapped|2 target controls covered
5%
UAE Virtual Asset Regulatory Authority (VARA) Regulations
2 source controls mapped|2 target controls covered
3%
Privacy Act 1988 (Australia)
2 source controls mapped|3 target controls covered
3%
OWASP DevSecOps Maturity Model (DSOMM)
2 source controls mapped|3 target controls covered
3%
OWASP ASVS
2 source controls mapped|2 target controls covered
3%
NATO AQAP 2110 - Quality Assurance Requirements for Design, Development, and Production
2 source controls mapped|2 target controls covered
3%
MITRE D3FEND
2 source controls mapped|2 target controls covered
3%
Law No. 172-13 on the Protection of Personal Data
2 source controls mapped|1 target controls covered
3%
India DPDP Act
2 source controls mapped|1 target controls covered
3%
API 1164
2 source controls mapped|2 target controls covered
3%
SQF Code Edition 9 - Safe Quality Food
2 source controls mapped|2 target controls covered
3%
Switzerland New Federal Act on Data Protection (nFADP/nDSG, 2023)
2 source controls mapped|5 target controls covered
3%
Bahrain PDPL
2 source controls mapped|4 target controls covered
3%
Singapore AI Governance Framework
2 source controls mapped|3 target controls covered
3%
PCI DSS 4.0
2 source controls mapped|3 target controls covered
3%
Federal Decree-Law No. 45 of 2021 on the Protection of Personal Data (UAE PDPL)
2 source controls mapped|3 target controls covered
3%
Family Educational Rights and Privacy Act (FERPA)
2 source controls mapped|3 target controls covered
3%
GLOBALG.A.P. Integrated Farm Assurance (IFA) Standard v6
2 source controls mapped|2 target controls covered
3%
Iceland Data Protection and Processing of Personal Data Act (Act No. 90/2018)
2 source controls mapped|3 target controls covered
3%
Annex 11 to EU GMP - Computerised Systems
2 source controls mapped|5 target controls covered
3%
FFIEC Cybersecurity Assessment Tool (CAT)
2 source controls mapped|3 target controls covered
3%
IEC 62351 - Power Systems Communication Security
2 source controls mapped|2 target controls covered
3%
FDA 21 CFR Part 11
2 source controls mapped|3 target controls covered
3%
FedRAMP Rev 5
2 source controls mapped|3 target controls covered
3%
Vietnam Law on Cybersecurity (No. 116/2025/QH15)
2 source controls mapped|2 target controls covered
3%
UK Defence Standard 05-138 - Cyber Security for Defence Suppliers
2 source controls mapped|2 target controls covered
3%
Pakistan Personal Data Protection Bill 2023
2 source controls mapped|3 target controls covered
3%
Italy Personal Data Protection Code (Legislative Decree No. 196/2003, amended 2018)
2 source controls mapped|3 target controls covered
3%
Austria Data Protection Act (Datenschutzgesetz, DSG, amended 2018)
2 source controls mapped|5 target controls covered
3%
ISO/IEC 27400:2022
2 source controls mapped|3 target controls covered
3%
CISA Cross-Sector Cybersecurity Performance Goals (CPG) 2.0
2 source controls mapped|2 target controls covered
3%
Azerbaijan Law on Personal Data (2010)
2 source controls mapped|3 target controls covered
3%
HL7 FHIR Security Framework
1 source controls mapped|2 target controls covered
2%
OWASP Top 10:2025
1 source controls mapped|1 target controls covered
2%
21 CFR Part 58 - Good Laboratory Practice (GLP)
1 source controls mapped|1 target controls covered
2%
21 CFR Part 211 - Current Good Manufacturing Practice
1 source controls mapped|3 target controls covered
2%
FSSC 22000 - Food Safety System Certification
1 source controls mapped|1 target controls covered
2%
GS1 Global Standards - Supply Chain Traceability and Data Security
1 source controls mapped|3 target controls covered
2%
BSI IT-Grundschutz
1 source controls mapped|3 target controls covered
2%
FISMA
1 source controls mapped|1 target controls covered
2%
Ghana Cybersecurity Act
1 source controls mapped|1 target controls covered
2%
GHG Protocol
1 source controls mapped|1 target controls covered
2%
USMCA Chapter 19 - Digital Trade (United States-Mexico-Canada Agreement)
1 source controls mapped|1 target controls covered
2%
Protective Security Policy Framework (PSPF) Release 2026
1 source controls mapped|1 target controls covered
2%
PCAOB AS 2201 - Audit of Internal Control Over Financial Reporting (ICFR)
1 source controls mapped|2 target controls covered
2%
India Account Aggregator Framework (RBI)
1 source controls mapped|1 target controls covered
2%
Connecticut Data Privacy Act (CTDPA)
1 source controls mapped|1 target controls covered
2%
COBIT 2019
1 source controls mapped|1 target controls covered
2%
ISO/IEC 29100:2024
1 source controls mapped|3 target controls covered
2%
US Foreign Corrupt Practices Act (FCPA)
1 source controls mapped|1 target controls covered
2%
ISO/IEC 23837:2023
1 source controls mapped|1 target controls covered
2%
ISO/IEC 30111:2019
1 source controls mapped|2 target controls covered
2%
Illinois Biometric Information Privacy Act (BIPA)
1 source controls mapped|1 target controls covered
2%
DFARS 252.204-7012 - Safeguarding Covered Defense Information
1 source controls mapped|1 target controls covered
2%
ISO/IEC 27557:2022 - Organisational Privacy Risk Management
1 source controls mapped|6 target controls covered
2%
ISO/IEC 27050-1:2019
1 source controls mapped|1 target controls covered
2%
ISO/IEC 29147:2018
1 source controls mapped|2 target controls covered
2%
Science Based Targets Initiative (SBTi) - Net-Zero Standard
1 source controls mapped|2 target controls covered
2%
ISO/IEC 27004:2016
1 source controls mapped|3 target controls covered
2%
ISO/IEC 29115:2013 - Entity Authentication Assurance Framework
1 source controls mapped|1 target controls covered
2%
ASIS SPC.1-2009 - Organizational Resilience Standard
1 source controls mapped|1 target controls covered
2%
ISO/IEC 29134:2023
1 source controls mapped|1 target controls covered
2%
ISO/IEC 27007:2020
1 source controls mapped|1 target controls covered
2%
FedRAMP High
1 source controls mapped|1 target controls covered
2%
FedRAMP Moderate
1 source controls mapped|1 target controls covered
2%
ISO/IEC 27031:2011
1 source controls mapped|1 target controls covered
2%
FATF Recommendation 16 - Payment Transparency (Travel Rule)
1 source controls mapped|1 target controls covered
2%
French Sapin II Law (Law No. 2016-1691)
1 source controls mapped|1 target controls covered
2%
GLBA
1 source controls mapped|2 target controls covered
2%
HKMA SPM
1 source controls mapped|2 target controls covered
2%
IAEA Nuclear Security Series - Computer Security at Nuclear Facilities (NSS-17-T Rev 1)
1 source controls mapped|3 target controls covered
2%
IATA Operational Safety Audit (IOSA) Standards Manual
1 source controls mapped|1 target controls covered
2%
APRA CPS 234
1 source controls mapped|2 target controls covered
2%
AML/CTF Act 2006 (Australia)
1 source controls mapped|1 target controls covered
2%
APRA CPS 230 Operational Risk Management
1 source controls mapped|3 target controls covered
2%
FBI CJIS Security Policy
1 source controls mapped|1 target controls covered
2%
BS 65000:2014 - Guidance on Organizational Resilience
1 source controls mapped|2 target controls covered
2%
ICAO Annex 17 - Aviation Security (AVSEC)
1 source controls mapped|2 target controls covered
2%
GLI-33 - Gaming Laboratories International Event Wagering Systems
1 source controls mapped|1 target controls covered
2%
Law on Personal Data Protection (Official Gazette No. 42/2020)
1 source controls mapped|1 target controls covered
2%
Vermont Data Privacy and Online Surveillance Act
1 source controls mapped|2 target controls covered
2%
Russia Federal Law on Personal Data (152-FZ)
1 source controls mapped|1 target controls covered
2%
US Consumer Product Safety Act (CPSC) Manufacturer and Importer Duties
1 source controls mapped|1 target controls covered
2%
ASD Strategies to Mitigate Cyber Security Incidents
1 source controls mapped|1 target controls covered
2%
Hungary Act CXII of 2011 on Informational Self-Determination and Freedom of Information (Info Act)
1 source controls mapped|1 target controls covered
2%
Coverage is not the same as your position
This page shows what ICH E6(R3) - Good Clinical Practice overlaps with in general. Where your organisation actually stands, against the standard you are going for and the certifications you already hold, is a different question. Same graph and the same recorded refutations, scoped to you rather than to a pair.
The Compliance Position Diagnostic, $5,000 fixed, ten business daysWhat is ICH E6(R3) - Good Clinical Practice and who does it apply to?
ICH E6(R3) - Good Clinical Practice is a compliance framework from International (ICH regions and adopting regulators) with 6 domains and 54 controls. ICH E6(R3) Good Clinical Practice (Step 4, January 2025): the eleven GCP principles and Annex 1 duties for ethics committees, investigators and sponsors, covering ethics review, informed consent, delegation and oversight, safety reporting, investigational product and blinding, quality and risk management, monitoring, audits, noncompliance, data governance, computerised system validation and security, the Investigator's Brochure, protocols and essential records. It is used by organisations to establish and maintain compliance with industry standards and regulatory requirements.
What does ICH E6(R3) - Good Clinical Practice actually require?
ICH E6(R3) - Good Clinical Practice has 54 controls organised across 6 domains. The largest domains are Annex 1 section 3: sponsor – ICH E6(R3) - Good Clinical Practice (18 controls), Annex 1 section 2: investigator – ICH E6(R3) - Good Clinical Practice (14 controls), Introduction and the Principles of ICH GCP – ICH E6(R3) - Good Clinical Practice (11 controls). Each control defines specific requirements that organisations must implement to achieve compliance.
If I already comply with another framework, how much of ICH E6(R3) - Good Clinical Practice do I already cover?
ICH E6(R3) - Good Clinical Practice maps to 106 other compliance frameworks. The top mapping partners are EU Clinical Trials Regulation (CTR 536/2014) (11% coverage), Aged Care Quality Standards 2019 (repealed edition) (8% coverage), FDA Quality Management System Regulation (QMSR) (8% coverage). Use our comparison tool to explore control-level mappings between frameworks.
How do I implement ICH E6(R3) - Good Clinical Practice?
Start your ICH E6(R3) - Good Clinical Practice compliance journey by running a self-assessment on our platform to identify your current compliance posture. Our AI advisory can answer specific questions about ICH E6(R3) - Good Clinical Practice requirements, and cross-framework mapping helps you leverage existing controls from other frameworks you may already comply with. Create a free account to access all 54 controls and track your progress.
Start Your Compliance Journey
Create a free account to run self-assessments, get AI advisory, and track your compliance progress across 1,120 frameworks.
Get Started Free →Free forever, no credit card required