Source: https://www.limswiki.org/index.php/LII:LIMSpec/Security_and_Integrity_of_Systems_and_Operations
Timestamp: 2020-03-29 02:31:36
Document Index: 96664384

Matched Legal Cases: ['art 331', 'art 121', 'art 211', 'art 212', 'art 225', 'art 225', 'art 225', 'art 225', 'art 225', 'art 225', 'art 226', 'art 226', 'art 226', 'art 226', 'art 312', 'art 312', 'art 606', 'art 812', 'art 820', 'art 141', 'art 704', 'art 717', 'art 73', 'art 164', 'art 164', 'art 162', 'art 211', 'art 211', 'art 3', 'art 3', 'art 11', 'art 332', 'art 11', 'art 11', 'art 11', 'art 11', 'art 11', 'art 211', 'art 211', 'art 212', 'art 493', 'art 164', 'art 11', 'art 11', 'art 820', 'art 170', 'art 11', 'art 170', 'art 170', 'art 170', 'art 164', 'art 164', 'art 164']

LII:LIMSpec/Security and Integrity of Systems and Operations - LIMSWiki
LII:LIMSpec/Security and Integrity of Systems and Operations
Note: These categories cover what ASTM E1578-18 largely considers to be "platform and administration support functions." Notably, most of the requirements here have something to do with ensuring the security and integrity of not only the system and its functions but also the data that it houses and modifies.
ASTM E1578-18 E-17-1 31.1 System functionality should support ALCOA principles.
ASTM E1578-18 E-17-2
NIST 800-53, Rev. 4, SI-12
ASTM E1578-18 E-17-3
EPA ERLN Laboratory Requirements 4.3.4.1
EPA ERLN Laboratory Requirements 4.8.9
EPA ERLN Laboratory Requirements 4.9.9
7 CFR Part 331.17 (c)
9 CFR Part 121.17 (c)
21 CFR Part 211.180
21 CFR Part 212.110 (c)
21 CFR Part 225.42 (b-8)
21 CFR Part 225.58 (c–d)
21 CFR Part 225.102
21 CFR Part 225.110
21 CFR Part 225.158
21 CFR Part 225.202
21 CFR Part 226.42 (a)
21 CFR Part 226.58 (f)
21 CFR Part 226.102
21 CFR Part 226.115
21 CFR Part 312.57
21 CFR Part 312.62
21 CFR Part 606.160 (d)
21 CFR Part 812.140 (d)
21 CFR Part 820.180 (b)
40 CFR Part 141.722
40 CFR Part 704 Subpart A
40 CFR Part 717.15 (d)
42 CFR Part 73.17 (c)
45 CFR Part 164.105
45 CFR Part 164.316
AAFCO QA/QC Guidelines for Feed Laboratories Sec. 2.4.4 or 3.1
AAVLD Requirements for an AVMDL Sec. 4.10.1.2
AAVLD Requirements for an AVMDL Sec. 4.10.2.1
AAVLD Requirements for an AVMDL Sec. 5.4.3.2
ABFT Accreditation Manual Sec. E-33
AIHA-LAP Policies 2018 2A.7.5.1
ASCLD/LAB Supp. Reqs. for the Accreditation of Forensic Science Testing Laboratories 4.14.1.2 and 4.15.1.2
ASCLD/LAB Supp. Reqs. for the Accreditation of Forensic Science Testing Laboratories 5.9.3.6 and 5.9.7
ASTM E1578-18 E-17-4
CJIS Security Policy 5.3.4
CJIS Security Policy 5.4.6–7
CJIS Security Policy 5.5.2.1
E.U. Annex 11-7.1
E.U. Commission Directive 2003/94/EC Article 9.1
EPA 815-R-05-004 Chap. III, Sec. 15
EPA ERLN Laboratory Requirements 4.9.18
EPA ERLN Laboratory Requirements 4.11.17
NIST 800-53, Rev. 4, AT-4
NIST 800-53, Rev. 4, AU-11 and AU-11(1)
USDA Administrative Procedures for the PDP 5.4
USDA Sampling Procedures for PDP 6.5
WHO Technical Report Series, #986, Annex 2, 15.8–9
ASTM E1578-18 E-17-6
CJIS Security Policy 5.4.4
NIST 800-53, Rev. 4, AU-8 31.5 The system shall accurately reflect the system date and time in its use of electronic record time stamps.
ASTM E1578-18 E-17-7
CJIS Security Policy 5.6.1 31.6 The system shall require each and every user to be assigned a unique user ID.
ASTM E1578-18 E-17-8
CJIS Security Policy 5.4.5
NIST 800-53, Rev. 4, AU-9
CJIS Security Policy 5.4.2
NIST 800-53, Rev. 4, AU-5
NIST 800-53, Rev. 4, SI-4 31.8 The system shall be capable of identifying instances of audit processing failure (e.g., write errors, general failure of the audit tool, etc.), sending alerts or notifications to appropriate personnel in such cases.
ASTM E1578-18 S-1-1 32.1 The system shall provide tools to enter and manage user-configurable lookup or master data.
ASTM E1578-18 S-1-2 32.2 The system shall allow authorized users to configure the specification limits for sample and instrument tests.
45 CFR Part 162.1002
USDA Sampling Procedures for PDP 6.3.2 32.3 The system shall allow system nomenclature to be configured to use specific data code sets—such as the International Classification of Diseases or the Healthcare Common Procedure Coding System—or mandated terminology to support regulatory requirements.
ASTM E1578-18 S-1-3 32.4 The system should allow authorized personnel to configure the review and approval of multiple tests at the sample, batch, project, and experiment levels.
ASTM E1578-18 S-1-4 32.5 The system should allow warning and material specification limits to be entered and configured so as to allow their comparison against entered results and determinations for determining whether the results meet those specifications or limits.
21 CFR Part 211.100 (b)
21 CFR Part 211.160 (a) 32.6 The system should provide a configurable means of allowing the system to automatically save after each entry to help meet ALCOA, CGMP, and other requirements to contemporaneously record data into records.
40 CFR Part 3.10
40 CFR Part 3.2000
ASTM E1578-18 S-1-5 32.7 The system should provide a configurable (based on sample, test, or both) means of permitting electronic signatures for both entered results and approved reports.
ASTM E1578-18 S-1-6 32.8 The system should be capable of providing a complete list of all tests loaded in the system, the amount of material required for each test, and to which location the samples are to be sent for testing.
ASTM E1578-18 S-1-7 32.9 The system shall support configurable laboratory workflows based on appropriate laboratory process and procedure.
ASTM E1578-18 S-1-8 32.10 The system shall allow authorized personnel to assign status values for purposes of tracking sample progress or other portions of laboratory workflow.
ASTM E1578-18 S-1-9 32.11 The system should allow authorized personnel to perform revision control of lookup or master data.
ASTM E1578-18 S-1-10 32.12 The system should provide a means for importing lookup or master data.
AIHA-LAP Policies 2018 2A.7.8.4
ASTM E1578-18 S-1-11
EPA ERLN Laboratory Requirements 4.11.6
USDA Data and Instrumentation for PDP 9.1
ASTM E1578-18 S-1-12 32.14 The system should allow calculated limits to be created and managed based on test results and relevant metadata.
ASTM E1578-18 S-1-13
EPA ERLN Laboratory Requirements 3.2.6
EPA ERLN Laboratory Requirements 4.9.11 32.15 The system should provide a clear alert or notification upon entry of out-of-specification results.
ASTM E1578-18 S-1-14 32.16 The system shall allow authorized personnel to update static and dynamic data.
ASTM E1578-18 S-1-15 32.17 The system should allow workflow events and status changes to trigger one or more user-defined actions.
ASTM E1578-18 S-1-17
CJIS Security Policy 5.7.1
NIST 800-53, Rev. 4, AC-6(1)
NIST 800-53, Rev. 4, CM-7
ASTM E1578-18 S-1-18 32.19 The system should allow administrators to programmatically customize system modules or build calculations within the application.
ASTM E1578-18 S-1-19 32.20 The system should provide a multiuser interface that can be configured to local user needs, including display language, character sets, and time zones.
21 CFR Part 11.100 (a)
ASTM E1578-18 S-1-20
NIST 800-53, Rev. 4, CM-5(1)
7 CFR Part 332.11
21 CFR Part 11.10 (d)
AAVLD Requirements for an AVMDL Sec. 4.10.1.3–4
AAVLD Requirements for an AVMDL Sec. 5.4.4.1
ASCLD/LAB Supp. Reqs. for the Accreditation of Forensic Science Testing Laboratories 5.4.7.2.1
ASTM E1492-11 4.2.4
ASTM E1578-18 S-1-16
ASTM E1578-18 S-1-21
CJIS Security Policy 5.5.2
E.U. Annex 11-12
EPA 815-R-05-004 Chap. IV, Sec. 8.6
EPA 815-R-05-004 Chap. VI, Sec. 8.6
EPA ERLN Laboratory Requirements 4.1.14–15
EPA ERLN Laboratory Requirements 4.9.4 and 4.9.14
ISO/IEC 17025:2017 7.11.3
NIST 800-53, Rev. 4, CM-5 and CM-5(1)
USDA Administrative Procedures for the PDP 5.2.4
Technical Report Series, #986, Annex 2, 15.9
CJIS Security Policy 5.5.2.2–3
NIST 800-53, Rev. 4, AC-2(11)
ASTM E1578-18 S-1-22
NIST 800-53, Rev. 4, IA-2(10) 32.24 The system should support single sign-on such that a user can log in once and access all permitted functions and data.
21 CFR Part 11.200 (a)
ASTM E1578-18 E17-5 and S-3-1
CJIS Security Policy 5.6.1
EPA ERLN Laboratory Requirements 4.9.4
NIST 800-53, Rev. 4, AC-2(7) and AC-3
NIST 800-53, Rev. 4, IA-2, IA-5, and IA-8
NIST 800-53, Rev. 4, MA-4
21 CFR Part 11.300 (a)
NIST 800-53, Rev. 4, IA-4 and IA-5
21 CFR Part 11.300 (b)
NIST 800-53, Rev. 4, IA-5 and IA-5(1)
CJIS Security Policy 5.6.3.1
NIST 800-53, Rev. 4, AC-2(3)
NIST 800-53, Rev. 4, IA-4 and IA-5(1)
NIST 800-53, Rev. 4, PS-4
CJIS Security Policy 5.5.2.2
NIST 800-53, Rev. 4, AC-10 32.29 The system shall allow the administrator or authorized personnel to configure the allowance or prevention of multiple concurrent active sessions for one unique user.
CJIS Security Policy 5.5.4
NIST 800-53, Rev. 4, AC-8 32.30 The system shall allow the administrator or authorized personnel to configure approved system use (e.g., "you are accessing a restricted information system," "system use indicates consent to being monitored, recorded, and audited") and other types of notifications to appear before or after a user logs in to the system. These notifications should remain on the screen until acknowledged by the user.
21 CFR Part 11.300 (d)
CJIS Security Policy 5.5.3
NIST 800-53, Rev. 4, AC-7
ASTM E1578-18 S-3-1 32.33 The system shall require at least one unique identification component for additional electronic signings (beyond initial login) during a single, continuous session.
21 CFR Part 211.188 (b-11)
21 CFR Part 211.194 (a-7 and a-8)
21 CFR Part 212.50 (c-10)
ASTM E1578-18 S-3-1
CJIS Security Policy 5.6.3.2
NIST 800-53, Rev. 4, IA-5
42 CFR Part 493.1231
45 CFR Part 164.514
ASTM E1578-18 S-1-25
CJIS Security Policy 5.5.1
NIST 800-53, Rev. 4, AC-3
ASTM E1578-18 S-1-24
21 CFR Part 11.50
E.U. Annex 11-14 32.38 When the system generates a complete and accurate copy of an electronically signed record, it shall also display the printed name of the signer, the date and time of signature execution, and any applicable meaning associated with the signature. This shall be applicable for both electronically displayed and printed copies of the electronic record.
ASTM E1578-18 S-1-26 32.39 The system should provide a means to migrate static data into the system.
NIST 800-53, Rev. 4, IA-5(1) and IA-5(4) 32.40 The system should provide a means for automatically authenticating if a user's proposed password meets the length, complexity, minimum number of changed characters, and other requirements as configured by the administrator or another authorized system user.
NIST 800-53, Rev. 4, IA-6 32.41 The system should provide a means for obscuring authentication feedback as it is entered into the system, e.g., displaying asterisks rather than the typed password or displaying actual typed feedback for a distinctly short period of time before obscuring it.
ASTM E1578-18 S-2-1
CJIS Security Policy Appendix G.8
NIST 800-53, Rev. 4, SA-4(3) 33.1 The vendor should be able to demonstrate the use of software development standards, secure coding practices, formal change control, and software revision control within its development practices. The vendor should also document its staff's skills and certifications.
ASTM E1578-18 S-2-2
NIST 800-53, Rev. 4, SA-4(2) 33.2 The vendor should be willing to provide access to source code through a suitable escrow.
ASTM E1578-18 S-2-3 33.3 The system should be able to document a summary and evaluation of enterprise performance markers and processes.
ASTM E1578-18 S-2-4
ISO/IEC 17025:2017 7.11.5
NIST 800-53, Rev. 4, SA-4(1), SA-4(2), and SA-5 33.4 The system should be well documented by the vendor in comprehensive training material for all aspects of system use, including administration, operation, and troubleshooting.
21 CFR Part 11.10 (a)
21 CFR Part 820.70 (i)
E.U. Annex 11-11
ISO/IEC 17025:2017 7.11.2
OECD GLP Principles 4.1
E.U. Annex 11-4 33.6 The documentation associated with system validation shall discuss all applicable steps of the life cycle, justify applied methods and standards, and include change control records and observed deviations during validation, if applicable.
45 CFR Part 170.315 (d-5)
CJIS Security Policy 5.5.5
NIST 800-53, Rev. 4, AC-11
ASTM E1578-18 S-3-2 34.2 The system should provide a means for modifying personnel data in a batch.
ASTM E1578-18 S-3-3 34.3 The system should support the storage of standard and industry-specific data formats.
ASTM E1578-18 S-3-7
CJIS Security Policy 5.5.2.4
ISO 15189:2012 5.10.2
NIST 800-53, Rev. 4, IA-2 and IA-8
NIST 800-53, Rev. 4, PS-4 and PS-5
USDA Administrative Procedures for the PDP 5.5.1.2
ASTM E1578-18 S-3-8 34.5 The vendor should provide maintenance agreements and support services for its applications and services.
ASTM E1578-18 S-3-9
E.U. Annex 11-3.3
NIST 800-53, Rev. 4, SA-16
AAVLD Requirements for an AVMDL Sec. 5.4.4.3
ABFT Accreditation Manual Sec. D-5–D-8
CJIS Security Policy 5.8.1
NIST 800-53, Rev. 4, MA-5
NIST 800-53, Rev. 4, PE-3, PE-3(1), PE-6, PE-6(1), and PE-6(4)
CJIS Security Policy 5.5.1 34.8 The system shall be able to tag and document an individual, group, and system account as having been validated for regulatory purposes, and remind the administrator or authorized personnel on a configurable schedule when the account should be validated again.
ASTM E1578-18 S-3-10
ASTM E1578-18 S-3-11
CJIS Security Policy 5.10.4.1
EPA ERLN Laboratory Requirements 4.9.13
NIST 800-53, Rev. 4, SI-2(5)
ASTM E1578-18 S-3-12 34.11 The system shall provide a means for migrating data to a new release upon system upgrade.
ASTM E1578-18 S-3-13 34.12 The system should be expedient with the retrieval of stored items.
21 CFR Part 11.10 (b)
E.U. Annex 11-8.1 34.13 The system shall allow the printing of stored electronic records in a complete, accurate, and human-readable format.
ASTM E1578-18 S-3-14 34.14 The system should provide some sort of support for use on mobile technologies, particularly for the purpose of receiving notifications and monitoring processes.
ASTM E1578-18 S-3-15
NIST 800-53, Rev. 4, CM-3(2)
NIST 800-53, Rev. 4, SI-2
45 CFR Part 170.315 (d-9)
ASTM E1578-18 S-4-1
CJIS Security Policy 5.6.4
CJIS Security Policy 5.8.2.1
CJIS Security Policy 5.10.1.2
CJIS Security Policy Appendix G.6
NIST 800-53, Rev. 4, AC-17(2)
ASTM E1578-18 S-4-2
NIST 800-53, Rev. 4, SC-13 and SC-28(1)
CJIS Security Policy 5.6.2.2.1
NIST 800-53, Rev. 4, IA-2, IA-2(1–4), and IA-8
45 CFR Part 170.202
45 CFR Part 170.315 (h) 35.4 The system should support Office of the National Coordinator for Health Information Technology (ONC) transport standards and protocols for the reception and distribution of personal health information.
NIST 800-53, Rev. 4, IA-7 35.5 The system should provide a means for authenticating an individual seeking to access any embedded cryptographic module within the system, as well as the individual's role in performing services within the module.
NIST 800-53, Rev. 4, SC-15 35.6 The system should prevent connected collaborative computing devices (e.g., cameras, microphones, interactive whiteboards) from being activated without explicit permission from the end user, and it should provide a clear indication of any activation to the end user.
45 CFR Part 164 Subpart E
ASTM E1578-18 S-5-1 36.1 The system shall comply with privacy protection compliance like that found in HIPAA provisions.
45 CFR Part 164 Subpart C
ASTM E1578-18 S-5-2
45 CFR Part 164.514 36.3 The system shall allow authorized individuals to de-identify select data in the system, including but not limited to names, geographic locations, dates, government-issued identification numbers, telephone numbers, email addresses, full-face photos, and other personal identifiers.
NIST 800-53, Rev. 4, AC-6
Retrieved from "https://www.limswiki.org/index.php?title=LII:LIMSpec/Security_and_Integrity_of_Systems_and_Operations&oldid=36393"
This page was last modified on 20 September 2019, at 18:12.