User:Shawndouglas/sandbox/sublevel24 - Revision history

Shawndouglas: Replaced content with "
TOC
{{ombox | type = notice | style = width: 960px; | text = This is sublevel24 of my sandbox, where I play with features and..."

2023-08-16T20:22:37Z

Replaced content with "<div class="nonumtoc">__TOC__</div> {{ombox | type = notice | style = width: 960px; | text = This is sublevel24 of my sandbox, where I play with features and..."

← Older revision		Revision as of 20:22, 16 August 2023
Line 1:		Line 1:
	==~~5. Managed security services and quality assurance~~==		<div class="nonumtoc">__TOC__</div>
			{{ombox
			\| type = notice
			\| style = width: 960px;
			\| text = This is sublevel24 of my sandbox, where I play with features and test MediaWiki code. If you wish to leave a comment for me, please see [[User_talk:Shawndouglas\|my discussion page]] instead.<p></p>
			}}

	So far in this guide, the assumption has been made that your organization—whether a laboratory or some other business type—will either have the knowledgeable and experienced onsite personnel to assist with a cloud implementation or will acquire such people as new hires or contracted consultants. But as the age of [[cloud computing]] has progressed ever onward and more businesses have moved to the cloud, a third option has emerged: have someone else, like an MSSP, manage most of the implementation and security details for you.		==Sandbox begins below==

	===~~5.1 The provision of managed security services~~===
	Gartner defines a managed security service provider (MSSP) as an entity that "provides outsourced monitoring and management of security devices and systems," including "managed firewall, intrusion detection, virtual private network, vulnerability scanning, and anti-viral services."<ref name="GartnerManaged">{{cite web \|url=https://www.gartner.com/en/information-technology/glossary/mssp-managed-security-service-provider \|title=Managed Security Service Provider (MSSP) \|work=Gartner Glossary \|publisher=Gartner, Inc \|accessdate=28 July 2023}}</ref> Gartner continues, noting that MSSPs run their security operations through their own or third-party data centers in order to provide an "always available" service, with the ultimate intent of reducing "the number of operational security personnel an enterprise needs to hire, train, and retain to maintain an acceptable security posture."<ref name="GartnerManaged" /> In addition to reducing personnel requirements, turning to an MSSP may also improve the overall security competency of and reduce the technological complexity burdens within an organization.<ref name="IBMMSS">{{cite web \|url=https://www.ibm.com/services/managed-security \|title=Managed security services (MSS) \|publisher=IBM \|accessdate=28 July 2023}}</ref><ref name="SOTheReal20">{{cite web \|url=https://secureops.com/2020/08/26/the-real-benefits-of-an-mssp/ \|archiveurl=https://web.archive.org/web/20210514165923/https://secureops.com/2020/08/26/the-real-benefits-of-an-mssp/ \|title=The REAL Benefits of a Managed Security Service Provider (MSSP) \|publisher=SecureOPS \|date=26 August 2020 \|archivedate=14 May 2021 \|accessdate=28 July 2023}}</ref>

	One perceived downside to this approach may be the added risk of placing access to sensitive data in the hands of a third party, and indeed, there may be a few unique situations where it makes the most sense to keep security operations in-house.<ref name="TrianzHowMana21">{{cite web \|url=https://www.trianz.com/insights/managed-cloud-security-services-how-and-why-it-works \|title=How Managed Cloud Security Works, and Why You Might Want It \|publisher=Trianz \|date=29 March 2021 \|accessdate=28 July 2023}}</ref> However, this perceived downside largely comes down to a question of the trust you place in the MSSP. As was discussed in previous chapters, many cloud service providers (CSPs) recognize the importance of supporting the element of trust associated with its services, as witnessed by their trust centers and associated documentation and certifications, particularly those related to the management of sensitive data. This element of trust is also baked into the service level agreement (SLA) provided by the CSP.<ref name="TrianzHowMana21" /> In the end, just like a CSP, the level of trust you place with an MSSP will largely be based upon your business' approach to both vetting them and determining the level of accepted risk should the MSSP not be able to meet your every requirement. (These aspects are discussed in further detail in the following chapter.)

	~~====5.1.1 Managed security services in the cloud====~~
	[[File:Cloud-Security.png\|right\|400px]]Just as turning to a CSP's [[infrastructure as a service]] (IaaS) offloads much of the responsibility for supporting IT infrastructure to someone else, you can also offload a significant portion of the responsibility for supporting cloud security to someone else. As such, the vendor of managed security services (MSS)—whether it's the CSP itself or a third-party cloud-friendly MSSP—manages cloud-based security aspects such as vulnerability testing, intrusion detection, firewall management, virtual private network (VPN) management, security reporting, and technical support for your cloud implementation. As such, most of your internal IT staff can be freed to focus on other aspects of the business' IT infrastructure and operational developments.

	But turning to MSS for your cloud implementation should be about more than just staffing relief. Outsourcing security services may also have other perceived benefits to an organization, such as gaining operational and financial efficiency, increasing service availability, and avoiding technological obsolescence.<ref name="FFIEC_Out04">{{cite web \|url=https://ithandbook.ffiec.gov/media/274841/ffiec_itbooklet_outsourcingtechnologyservices.pdf \|archiveurl=https://web.archive.org/web/20220201011601/https://ithandbook.ffiec.gov/media/274841/ffiec_itbooklet_outsourcingtechnologyservices.pdf \|format=PDF \|title=Outsourcing Technology Services \|author=Federal Financial Institutions Examination Council \|publisher=FFIEC \|date=June 2004 \|archivedate=01 February 2022 \|accessdate=28 July 2023}}</ref> To be sure, managing [[cybersecurity]] in the cloud is both vital to and difficult for the average organization, particularly small organizations like independent laboratories with constrained budgets. Managing the physical and cybersecurity complexities associated with the likes of the [[Health Insurance Portability and Accountability Act]] (HIPAA), the [[General Data Protection Regulation]] (GDPR), and the Payment Card Industry Data Security Standard (PCI DSS) can be daunting, particularly given a lack of sufficient in-house expertise. Throw hybrid and multicloud deployments into the mix, and you suddenly require even more in-house expertise for development in public cloud environments like AWS and Microsoft Azure. When also considering that traditional on-premises IT security experience is not enough to manage cloud implementations, it's not difficult to imagine a scenario where an inexperienced IT staff could misconfigure a network security setting and compromise sensitive data within a cloud implementation.<ref name="TrianzHowMana21" />

	An optimally run set of managed security services by a knowledgeable and experienced organization able to offer and stick to clear, legally defensible service level agreements and information governance mechanisms<ref name="SmallwoodInform14">{{cite book \|title=Information Governance: Concepts, Strategies, and Best Practices \|chapter=Chapter 1: The Onslaught of Big Data and the Information Governance Imperative \|author=Smallwood, R.F. \|publisher=Wiley \|pages=3–13 \|year=2014 \|isbn=9781118218303}}</ref><ref name="O'NeillInform15">{{cite web \|url=https://www.daymarksi.com/information-technology-navigator-blog/information-governance-a-principled-framework \|title=Information Governance: A Principled Framework \|author=O'Neill, S. \|work=Daymark Blog \|date=22 October 2015 \|accessdate=28 July 2023}}</ref> makes sense for organizations without the necessary technical expertise and with significant liability should something go wrong. The complexities of running secure operations in the cloud only increase the importance of such an MSSP. Such a provider is able to<ref name="DotsonPract19">{{cite book \|title=Practical Cloud Security: A Guide for Secure Design and Deployment \|chapter=Chapter 7: Detecting, Responding to, and Recovering from Security Incidents \|author=Dotson, C. \|publisher=O'Reilly Media \|pages=139–71 \|year=2019 \|isbn=9781492037514}}</ref>:

	* monitor for, identify, assess, and react to vulnerabilities, intrusions, and other threats;
	* audit, adjust, and patch native security settings;
	* improve encryption, firewall, and anti-malware mechanisms;
	* manage and secure connected devices;
	* manage and improve identity access management; and
	* provide detailed reports about the state of organizational infrastructure.

Shawndouglas at 20:07, 26 July 2023

2023-07-26T20:07:24Z

← Older revision	Revision as of 20:07, 26 July 2023
Line 1:	Line 1:
		==5. Managed security services and quality assurance==

		So far in this guide, the assumption has been made that your organization—whether a laboratory or some other business type—will either have the knowledgeable and experienced onsite personnel to assist with a cloud implementation or will acquire such people as new hires or contracted consultants. But as the age of [[cloud computing]] has progressed ever onward and more businesses have moved to the cloud, a third option has emerged: have someone else, like an MSSP, manage most of the implementation and security details for you.

		===5.1 The provision of managed security services===
		Gartner defines a managed security service provider (MSSP) as an entity that "provides outsourced monitoring and management of security devices and systems," including "managed firewall, intrusion detection, virtual private network, vulnerability scanning, and anti-viral services."<ref name="GartnerManaged">{{cite web \|url=https://www.gartner.com/en/information-technology/glossary/mssp-managed-security-service-provider \|title=Managed Security Service Provider (MSSP) \|work=Gartner Glossary \|publisher=Gartner, Inc \|accessdate=28 July 2023}}</ref> Gartner continues, noting that MSSPs run their security operations through their own or third-party data centers in order to provide an "always available" service, with the ultimate intent of reducing "the number of operational security personnel an enterprise needs to hire, train, and retain to maintain an acceptable security posture."<ref name="GartnerManaged" /> In addition to reducing personnel requirements, turning to an MSSP may also improve the overall security competency of and reduce the technological complexity burdens within an organization.<ref name="IBMMSS">{{cite web \|url=https://www.ibm.com/services/managed-security \|title=Managed security services (MSS) \|publisher=IBM \|accessdate=28 July 2023}}</ref><ref name="SOTheReal20">{{cite web \|url=https://secureops.com/2020/08/26/the-real-benefits-of-an-mssp/ \|archiveurl=https://web.archive.org/web/20210514165923/https://secureops.com/2020/08/26/the-real-benefits-of-an-mssp/ \|title=The REAL Benefits of a Managed Security Service Provider (MSSP) \|publisher=SecureOPS \|date=26 August 2020 \|archivedate=14 May 2021 \|accessdate=28 July 2023}}</ref>

		One perceived downside to this approach may be the added risk of placing access to sensitive data in the hands of a third party, and indeed, there may be a few unique situations where it makes the most sense to keep security operations in-house.<ref name="TrianzHowMana21">{{cite web \|url=https://www.trianz.com/insights/managed-cloud-security-services-how-and-why-it-works \|title=How Managed Cloud Security Works, and Why You Might Want It \|publisher=Trianz \|date=29 March 2021 \|accessdate=28 July 2023}}</ref> However, this perceived downside largely comes down to a question of the trust you place in the MSSP. As was discussed in previous chapters, many cloud service providers (CSPs) recognize the importance of supporting the element of trust associated with its services, as witnessed by their trust centers and associated documentation and certifications, particularly those related to the management of sensitive data. This element of trust is also baked into the service level agreement (SLA) provided by the CSP.<ref name="TrianzHowMana21" /> In the end, just like a CSP, the level of trust you place with an MSSP will largely be based upon your business' approach to both vetting them and determining the level of accepted risk should the MSSP not be able to meet your every requirement. (These aspects are discussed in further detail in the following chapter.)

		====5.1.1 Managed security services in the cloud====
		[[File:Cloud-Security.png\|right\|400px]]Just as turning to a CSP's [[infrastructure as a service]] (IaaS) offloads much of the responsibility for supporting IT infrastructure to someone else, you can also offload a significant portion of the responsibility for supporting cloud security to someone else. As such, the vendor of managed security services (MSS)—whether it's the CSP itself or a third-party cloud-friendly MSSP—manages cloud-based security aspects such as vulnerability testing, intrusion detection, firewall management, virtual private network (VPN) management, security reporting, and technical support for your cloud implementation. As such, most of your internal IT staff can be freed to focus on other aspects of the business' IT infrastructure and operational developments.

		But turning to MSS for your cloud implementation should be about more than just staffing relief. Outsourcing security services may also have other perceived benefits to an organization, such as gaining operational and financial efficiency, increasing service availability, and avoiding technological obsolescence.<ref name="FFIEC_Out04">{{cite web \|url=https://ithandbook.ffiec.gov/media/274841/ffiec_itbooklet_outsourcingtechnologyservices.pdf \|archiveurl=https://web.archive.org/web/20220201011601/https://ithandbook.ffiec.gov/media/274841/ffiec_itbooklet_outsourcingtechnologyservices.pdf \|format=PDF \|title=Outsourcing Technology Services \|author=Federal Financial Institutions Examination Council \|publisher=FFIEC \|date=June 2004 \|archivedate=01 February 2022 \|accessdate=28 July 2023}}</ref> To be sure, managing [[cybersecurity]] in the cloud is both vital to and difficult for the average organization, particularly small organizations like independent laboratories with constrained budgets. Managing the physical and cybersecurity complexities associated with the likes of the [[Health Insurance Portability and Accountability Act]] (HIPAA), the [[General Data Protection Regulation]] (GDPR), and the Payment Card Industry Data Security Standard (PCI DSS) can be daunting, particularly given a lack of sufficient in-house expertise. Throw hybrid and multicloud deployments into the mix, and you suddenly require even more in-house expertise for development in public cloud environments like AWS and Microsoft Azure. When also considering that traditional on-premises IT security experience is not enough to manage cloud implementations, it's not difficult to imagine a scenario where an inexperienced IT staff could misconfigure a network security setting and compromise sensitive data within a cloud implementation.<ref name="TrianzHowMana21" />

		An optimally run set of managed security services by a knowledgeable and experienced organization able to offer and stick to clear, legally defensible service level agreements and information governance mechanisms<ref name="SmallwoodInform14">{{cite book \|title=Information Governance: Concepts, Strategies, and Best Practices \|chapter=Chapter 1: The Onslaught of Big Data and the Information Governance Imperative \|author=Smallwood, R.F. \|publisher=Wiley \|pages=3–13 \|year=2014 \|isbn=9781118218303}}</ref><ref name="O'NeillInform15">{{cite web \|url=https://www.daymarksi.com/information-technology-navigator-blog/information-governance-a-principled-framework \|title=Information Governance: A Principled Framework \|author=O'Neill, S. \|work=Daymark Blog \|date=22 October 2015 \|accessdate=28 July 2023}}</ref> makes sense for organizations without the necessary technical expertise and with significant liability should something go wrong. The complexities of running secure operations in the cloud only increase the importance of such an MSSP. Such a provider is able to<ref name="DotsonPract19">{{cite book \|title=Practical Cloud Security: A Guide for Secure Design and Deployment \|chapter=Chapter 7: Detecting, Responding to, and Recovering from Security Incidents \|author=Dotson, C. \|publisher=O'Reilly Media \|pages=139–71 \|year=2019 \|isbn=9781492037514}}</ref>:

		* monitor for, identify, assess, and react to vulnerabilities, intrusions, and other threats;
		* audit, adjust, and patch native security settings;
		* improve encryption, firewall, and anti-malware mechanisms;
		* manage and secure connected devices;
		* manage and improve identity access management; and
		* provide detailed reports about the state of organizational infrastructure.

Shawndouglas: Blanked the page

2022-05-05T21:24:38Z

Blanked the page

Show changes

Shawndouglas at 19:35, 5 May 2022

2022-05-05T19:35:41Z

Shawndouglas at 22:50, 4 May 2022

2022-05-04T22:50:11Z

Shawndouglas at 20:36, 4 May 2022

2022-05-04T20:36:09Z

← Older revision		Revision as of 20:36, 4 May 2022
Line 120:		Line 120:
	[https://www.wadsworth.org/regulatory/clep/clinical-labs/laboratory-standards NYSDOH CLEP Clinical Laboratory Standards of Practice, General Systems Standards]<br />		[https://www.wadsworth.org/regulatory/clep/clinical-labs/laboratory-standards NYSDOH CLEP Clinical Laboratory Standards of Practice, General Systems Standards]<br />
	[https://www.pfp-ifss.org/ifss-resources/human-and-animal-food-testing-laboratories-best-practices-manual-december-2018/ PFP Human and Animal Food Testing Laboratories Best Practices Manual]<br />		[https://www.pfp-ifss.org/ifss-resources/human-and-animal-food-testing-laboratories-best-practices-manual-december-2018/ PFP Human and Animal Food Testing Laboratories Best Practices Manual]<br />
			[https://ris.dls.virginia.gov/uploads/1VAC30/dibr/Microsoft%20Word%20-%20STD-ELV1-2016-Rev2.1_LabReqs_ANSIapp.doc-20210426142653.pdf TNI EL-V1-2016-Rev.2.1 (V1,M2 4.13.1.4)]<br />
	[https://www.who.int/medicines/areas/quality_safety/quality_assurance/expert_committee/trs_986/en/ WHO Technical Report Series, #986, Annex 2, 15.9]		[https://www.who.int/medicines/areas/quality_safety/quality_assurance/expert_committee/trs_986/en/ WHO Technical Report Series, #986, Annex 2, 15.9]
	\| style="background-color:white;" \|'''27.11''' The system’s data storage tools shall provide data backup and retrieval functions that meet or exceed industry best practices, including producing exact and complete backups that are secure and encrypted from manipulation and loss.		\| style="background-color:white;" \|'''27.11''' The system’s data storage tools shall provide data backup and retrieval functions that meet or exceed industry best practices, including producing exact and complete backups that are secure and encrypted from manipulation and loss.
Line 293:		Line 294:
	[https://www.oecd.org/chemicalsafety/testing/oecdseriesonprinciplesofgoodlaboratorypracticeglpandcompliancemonitoring.htm OECD GLP Principles 10]<br />		[https://www.oecd.org/chemicalsafety/testing/oecdseriesonprinciplesofgoodlaboratorypracticeglpandcompliancemonitoring.htm OECD GLP Principles 10]<br />
	[https://www.pfp-ifss.org/ifss-resources/human-and-animal-food-testing-laboratories-best-practices-manual-december-2018/ PFP Human and Animal Food Testing Laboratories Best Practices Manual]<br />		[https://www.pfp-ifss.org/ifss-resources/human-and-animal-food-testing-laboratories-best-practices-manual-december-2018/ PFP Human and Animal Food Testing Laboratories Best Practices Manual]<br />
			[https://ris.dls.virginia.gov/uploads/1VAC30/dibr/Microsoft%20Word%20-%20STD-ELV1-2016-Rev2.1_LabReqs_ANSIapp.doc-20210426142653.pdf TNI EL-V1-2016-Rev.2.1 (V1,M2 5.8.4)]<br />
	[https://www.ams.usda.gov/datasets/pdp/pdp-standard-operating-procedures USDA Sample Processing and Analysis Procedures for PDP 5.2]<br />		[https://www.ams.usda.gov/datasets/pdp/pdp-standard-operating-procedures USDA Sample Processing and Analysis Procedures for PDP 5.2]<br />
	[https://www.who.int/medicines/areas/quality_safety/quality_assurance/expert_committee/trs_986/en/ WHO Technical Report Series, #986, Annex 2, 12.8 and 12.16]		[https://www.who.int/medicines/areas/quality_safety/quality_assurance/expert_committee/trs_986/en/ WHO Technical Report Series, #986, Annex 2, 12.8 and 12.16]

Shawndouglas at 17:34, 4 May 2022

2022-05-04T17:34:04Z

← Older revision		Revision as of 17:34, 4 May 2022
Line 119:		Line 119:
	[https://csrc.nist.gov/publications/detail/sp/800-53/rev-5/final NIST 800-53, Rev. 5, CP-9 and CP-10]<br />		[https://csrc.nist.gov/publications/detail/sp/800-53/rev-5/final NIST 800-53, Rev. 5, CP-9 and CP-10]<br />
	[https://www.wadsworth.org/regulatory/clep/clinical-labs/laboratory-standards NYSDOH CLEP Clinical Laboratory Standards of Practice, General Systems Standards]<br />		[https://www.wadsworth.org/regulatory/clep/clinical-labs/laboratory-standards NYSDOH CLEP Clinical Laboratory Standards of Practice, General Systems Standards]<br />
			[https://www.pfp-ifss.org/ifss-resources/human-and-animal-food-testing-laboratories-best-practices-manual-december-2018/ PFP Human and Animal Food Testing Laboratories Best Practices Manual]<br />
	[https://www.who.int/medicines/areas/quality_safety/quality_assurance/expert_committee/trs_986/en/ WHO Technical Report Series, #986, Annex 2, 15.9]		[https://www.who.int/medicines/areas/quality_safety/quality_assurance/expert_committee/trs_986/en/ WHO Technical Report Series, #986, Annex 2, 15.9]
	\| style="background-color:white;" \|'''27.11''' The system’s data storage tools shall provide data backup and retrieval functions that meet or exceed industry best practices, including producing exact and complete backups that are secure and encrypted from manipulation and loss.		\| style="background-color:white;" \|'''27.11''' The system’s data storage tools shall provide data backup and retrieval functions that meet or exceed industry best practices, including producing exact and complete backups that are secure and encrypted from manipulation and loss.
Line 291:		Line 292:
	[https://www.wadsworth.org/regulatory/clep/clinical-labs/laboratory-standards NYSDOH CLEP Clinical Laboratory Standards of Practice, General Systems Standards]<br />		[https://www.wadsworth.org/regulatory/clep/clinical-labs/laboratory-standards NYSDOH CLEP Clinical Laboratory Standards of Practice, General Systems Standards]<br />
	[https://www.oecd.org/chemicalsafety/testing/oecdseriesonprinciplesofgoodlaboratorypracticeglpandcompliancemonitoring.htm OECD GLP Principles 10]<br />		[https://www.oecd.org/chemicalsafety/testing/oecdseriesonprinciplesofgoodlaboratorypracticeglpandcompliancemonitoring.htm OECD GLP Principles 10]<br />
			[https://www.pfp-ifss.org/ifss-resources/human-and-animal-food-testing-laboratories-best-practices-manual-december-2018/ PFP Human and Animal Food Testing Laboratories Best Practices Manual]<br />
	[https://www.ams.usda.gov/datasets/pdp/pdp-standard-operating-procedures USDA Sample Processing and Analysis Procedures for PDP 5.2]<br />		[https://www.ams.usda.gov/datasets/pdp/pdp-standard-operating-procedures USDA Sample Processing and Analysis Procedures for PDP 5.2]<br />
	[https://www.who.int/medicines/areas/quality_safety/quality_assurance/expert_committee/trs_986/en/ WHO Technical Report Series, #986, Annex 2, 12.8 and 12.16]		[https://www.who.int/medicines/areas/quality_safety/quality_assurance/expert_committee/trs_986/en/ WHO Technical Report Series, #986, Annex 2, 12.8 and 12.16]

Shawndouglas at 23:32, 3 May 2022

2022-05-03T23:32:56Z

← Older revision		Revision as of 23:32, 3 May 2022
Line 120:		Line 120:
	[https://www.wadsworth.org/regulatory/clep/clinical-labs/laboratory-standards NYSDOH CLEP Clinical Laboratory Standards of Practice, General Systems Standards]<br />		[https://www.wadsworth.org/regulatory/clep/clinical-labs/laboratory-standards NYSDOH CLEP Clinical Laboratory Standards of Practice, General Systems Standards]<br />
	[https://www.who.int/medicines/areas/quality_safety/quality_assurance/expert_committee/trs_986/en/ WHO Technical Report Series, #986, Annex 2, 15.9]		[https://www.who.int/medicines/areas/quality_safety/quality_assurance/expert_committee/trs_986/en/ WHO Technical Report Series, #986, Annex 2, 15.9]
	\| style="background-color:white;" \|'''27.11''' The system’s data storage tools shall provide data backup and retrieval functions that meet or exceed industry best practices, including producing exact and complete backups that are secure from manipulation and loss.		\| style="background-color:white;" \|'''27.11''' The system’s data storage tools shall provide data backup and retrieval functions that meet or exceed industry best practices, including producing exact and complete backups that are secure and encrypted from manipulation and loss.
	\|-		\|-
	\| style="padding:5px; width:500px;" \|[https://www.astm.org/e1578-18.html ASTM E1578-18 E-13-12]		\| style="padding:5px; width:500px;" \|[https://www.astm.org/e1578-18.html ASTM E1578-18 E-13-12]

Shawndouglas at 22:34, 3 May 2022

2022-05-03T22:34:39Z

Shawndouglas at 22:19, 3 May 2022

2022-05-03T22:19:54Z

← Older revision		Revision as of 22:19, 3 May 2022
Line 51:		Line 51:
	[https://www.epa.gov/sites/production/files/documents/erln_lab_requirements.pdf EPA ERLN Laboratory Requirements 4.9.5 and 4.9.14]<br />		[https://www.epa.gov/sites/production/files/documents/erln_lab_requirements.pdf EPA ERLN Laboratory Requirements 4.9.5 and 4.9.14]<br />
	[https://www.iso.org/standard/66912.html ISO/IEC 17025:2017 8.4.2]<br />		[https://www.iso.org/standard/66912.html ISO/IEC 17025:2017 8.4.2]<br />
			[https://www.wadsworth.org/regulatory/clep/clinical-labs/laboratory-standards NYSDOH CLEP Clinical Laboratory Standards of Practice, General Systems Standards]<br />
	[https://www.oecd.org/chemicalsafety/testing/oecdseriesonprinciplesofgoodlaboratorypracticeglpandcompliancemonitoring.htm OECD GLP Principles 3.4]<br />		[https://www.oecd.org/chemicalsafety/testing/oecdseriesonprinciplesofgoodlaboratorypracticeglpandcompliancemonitoring.htm OECD GLP Principles 3.4]<br />
	[https://www.oecd.org/chemicalsafety/testing/oecdseriesonprinciplesofgoodlaboratorypracticeglpandcompliancemonitoring.htm OECD GLP Principles 10]<br />		[https://www.oecd.org/chemicalsafety/testing/oecdseriesonprinciplesofgoodlaboratorypracticeglpandcompliancemonitoring.htm OECD GLP Principles 10]<br />
Line 75:		Line 76:
	\| style="background-color:white;" \|'''27.5''' The system should feature a reliable, effective, and supported data storage system.		\| style="background-color:white;" \|'''27.5''' The system should feature a reliable, effective, and supported data storage system.
	\|-		\|-
	\| style="padding:5px; width:500px;" \|[https://www.astm.org/e1578-18.html ASTM E1578-18 C-6-6]<br />[https://www.astm.org/e1578-18.html ASTM E1578-18 E-13-6]<br />[https://clsi.org/standards/products/quality-management-systems/documents/qms22/ CLSI QMS22 2.2.3.3]		\| style="padding:5px; width:500px;" \|
			[https://www.astm.org/e1578-18.html ASTM E1578-18 C-6-6]<br />
			[https://www.astm.org/e1578-18.html ASTM E1578-18 E-13-6]<br />
			[https://clsi.org/standards/products/quality-management-systems/documents/qms22/ CLSI QMS22 2.2.3.3]<br />
			[https://www.wadsworth.org/regulatory/clep/clinical-labs/laboratory-standards NYSDOH CLEP Clinical Laboratory Standards of Practice, General Systems Standards]
	\| style="background-color:white;" \|'''27.6''' The system should be able to interface directly with a third-party reporting tool.		\| style="background-color:white;" \|'''27.6''' The system should be able to interface directly with a third-party reporting tool.
	\|-		\|-
Line 113:		Line 118:
	[https://www.iso.org/standard/66912.html ISO/IEC 17025:2017 8.4.2]<br />		[https://www.iso.org/standard/66912.html ISO/IEC 17025:2017 8.4.2]<br />
	[https://csrc.nist.gov/publications/detail/sp/800-53/rev-5/final NIST 800-53, Rev. 5, CP-9 and CP-10]<br />		[https://csrc.nist.gov/publications/detail/sp/800-53/rev-5/final NIST 800-53, Rev. 5, CP-9 and CP-10]<br />
			[https://www.wadsworth.org/regulatory/clep/clinical-labs/laboratory-standards NYSDOH CLEP Clinical Laboratory Standards of Practice, General Systems Standards]<br />
	[https://www.who.int/medicines/areas/quality_safety/quality_assurance/expert_committee/trs_986/en/ WHO Technical Report Series, #986, Annex 2, 15.9]		[https://www.who.int/medicines/areas/quality_safety/quality_assurance/expert_committee/trs_986/en/ WHO Technical Report Series, #986, Annex 2, 15.9]
	\| style="background-color:white;" \|'''27.11''' The system’s data storage tools shall provide data backup and retrieval functions that meet or exceed industry best practices, including producing exact and complete backups that are secure from manipulation and loss.		\| style="background-color:white;" \|'''27.11''' The system’s data storage tools shall provide data backup and retrieval functions that meet or exceed industry best practices, including producing exact and complete backups that are secure from manipulation and loss.
Line 283:		Line 289:
	[https://www.iso.org/standard/66912.html ISO/IEC 17025:2017 6.3.4]<br />		[https://www.iso.org/standard/66912.html ISO/IEC 17025:2017 6.3.4]<br />
	[https://www.iso.org/standard/66912.html ISO/IEC 17025:2017 7.4.4]<br />		[https://www.iso.org/standard/66912.html ISO/IEC 17025:2017 7.4.4]<br />
			[https://www.wadsworth.org/regulatory/clep/clinical-labs/laboratory-standards NYSDOH CLEP Clinical Laboratory Standards of Practice, General Systems Standards]<br />
	[https://www.oecd.org/chemicalsafety/testing/oecdseriesonprinciplesofgoodlaboratorypracticeglpandcompliancemonitoring.htm OECD GLP Principles 10]<br />		[https://www.oecd.org/chemicalsafety/testing/oecdseriesonprinciplesofgoodlaboratorypracticeglpandcompliancemonitoring.htm OECD GLP Principles 10]<br />
	[https://www.ams.usda.gov/datasets/pdp/pdp-standard-operating-procedures USDA Sample Processing and Analysis Procedures for PDP 5.2]<br />		[https://www.ams.usda.gov/datasets/pdp/pdp-standard-operating-procedures USDA Sample Processing and Analysis Procedures for PDP 5.2]<br />

← Older revision		Revision as of 19:35, 5 May 2022
Line 19:		Line 19:
	[https://clsi.org/standards/products/quality-management-systems/documents/qms22/ CLSI AUTO15 2.0]<br />		[https://clsi.org/standards/products/quality-management-systems/documents/qms22/ CLSI AUTO15 2.0]<br />
	[https://clsi.org/standards/products/quality-management-systems/documents/qms22/ CLSI QMS22 2.2.2.5]<br />		[https://clsi.org/standards/products/quality-management-systems/documents/qms22/ CLSI QMS22 2.2.2.5]<br />
	[https://www.epa.gov/sites/production/files/documents/erln_lab_requirements.pdf EPA ERLN Laboratory Requirements 4.9.16]		[https://www.epa.gov/sites/production/files/documents/erln_lab_requirements.pdf EPA ERLN Laboratory Requirements 4.9.16]<br />
			[https://www.gmp-compliance.org/guidelines/gmp-guideline/who-guidance-on-good-data-and-record-management-practices WHO Technical Report Series, #996, Annex 5, 4.12]
	\| style="background-color:white;" \|'''26.3''' The system should be capable of receiving test results from instrument data systems and verifying those results for completeness and readability.		\| style="background-color:white;" \|'''26.3''' The system should be capable of receiving test results from instrument data systems and verifying those results for completeness and readability.
	\|-		\|-
Line 54:		Line 55:
	[https://www.oecd.org/chemicalsafety/testing/oecdseriesonprinciplesofgoodlaboratorypracticeglpandcompliancemonitoring.htm OECD GLP Principles 3.4]<br />		[https://www.oecd.org/chemicalsafety/testing/oecdseriesonprinciplesofgoodlaboratorypracticeglpandcompliancemonitoring.htm OECD GLP Principles 3.4]<br />
	[https://www.oecd.org/chemicalsafety/testing/oecdseriesonprinciplesofgoodlaboratorypracticeglpandcompliancemonitoring.htm OECD GLP Principles 10]<br />		[https://www.oecd.org/chemicalsafety/testing/oecdseriesonprinciplesofgoodlaboratorypracticeglpandcompliancemonitoring.htm OECD GLP Principles 10]<br />
	[https://www.ams.usda.gov/datasets/pdp/pdp-standard-operating-procedures USDA Administrative Procedures for the PDP 5.5]		[https://www.ams.usda.gov/datasets/pdp/pdp-standard-operating-procedures USDA Administrative Procedures for the PDP 5.5]<br />
			[https://www.gmp-compliance.org/guidelines/gmp-guideline/who-guidance-on-good-data-and-record-management-practices WHO Technical Report Series, #996, Annex 5, 11.16 and Appendix 1]
	\| style="background-color:white;" \|'''27.3''' The system shall provide a means to choose—based on date and type of data—electronic data and metadata to archive.		\| style="background-color:white;" \|'''27.3''' The system shall provide a means to choose—based on date and type of data—electronic data and metadata to archive.
	\|-		\|-
Line 70:		Line 72:
	[https://www.oecd.org/chemicalsafety/testing/oecdseriesonprinciplesofgoodlaboratorypracticeglpandcompliancemonitoring.htm OECD GLP Principles 10]<br />		[https://www.oecd.org/chemicalsafety/testing/oecdseriesonprinciplesofgoodlaboratorypracticeglpandcompliancemonitoring.htm OECD GLP Principles 10]<br />
	[https://www.ams.usda.gov/datasets/pdp/pdp-standard-operating-procedures USDA Administrative Procedures for the PDP 5.2.1]<br />		[https://www.ams.usda.gov/datasets/pdp/pdp-standard-operating-procedures USDA Administrative Procedures for the PDP 5.2.1]<br />
	[https://www.ams.usda.gov/datasets/pdp/pdp-standard-operating-procedures USDA Administrative Procedures for the PDP 5.5]		[https://www.ams.usda.gov/datasets/pdp/pdp-standard-operating-procedures USDA Administrative Procedures for the PDP 5.5]<br />
			[https://www.gmp-compliance.org/guidelines/gmp-guideline/who-guidance-on-good-data-and-record-management-practices WHO Technical Report Series, #996, Annex 5, 11.16 and Appendix 1]
	\| style="background-color:white;" \|'''27.4''' The system shall provide a guaranteed means to retrieve and restore archived data and metadata that is readable and accurate.		\| style="background-color:white;" \|'''27.4''' The system shall provide a guaranteed means to retrieve and restore archived data and metadata that is readable and accurate.
	\|-		\|-
Line 123:		Line 126:
	[https://ris.dls.virginia.gov/uploads/1VAC30/dibr/Microsoft%20Word%20-%20STD-ELV1-2016-Rev2.1_LabReqs_ANSIapp.doc-20210426142653.pdf TNI EL-V1-2016-Rev.2.1 (V1,M2 4.13.1.4)]<br />		[https://ris.dls.virginia.gov/uploads/1VAC30/dibr/Microsoft%20Word%20-%20STD-ELV1-2016-Rev2.1_LabReqs_ANSIapp.doc-20210426142653.pdf TNI EL-V1-2016-Rev.2.1 (V1,M2 4.13.1.4)]<br />
	[https://www.wada-ama.org/en/resources/world-anti-doping-program/international-standard-laboratories-isl WADA International Standard for Laboratories (ISL) 5.2.3.5]<br />		[https://www.wada-ama.org/en/resources/world-anti-doping-program/international-standard-laboratories-isl WADA International Standard for Laboratories (ISL) 5.2.3.5]<br />
	[https://www.who.int/medicines/areas/quality_safety/quality_assurance/expert_committee/trs_986/en/ WHO Technical Report Series, #986, Annex 2, 15.9]		[https://www.who.int/medicines/areas/quality_safety/quality_assurance/expert_committee/trs_986/en/ WHO Technical Report Series, #986, Annex 2, 15.9]<br />
			[https://www.gmp-compliance.org/guidelines/gmp-guideline/who-guidance-on-good-data-and-record-management-practices WHO Technical Report Series, #996, Annex 5, Appendix 1]
	\| style="background-color:white;" \|'''27.11''' The system’s data storage tools shall provide data backup and retrieval functions that meet or exceed industry best practices, including producing exact and complete backups that are secure and encrypted from manipulation and loss.		\| style="background-color:white;" \|'''27.11''' The system’s data storage tools shall provide data backup and retrieval functions that meet or exceed industry best practices, including producing exact and complete backups that are secure and encrypted from manipulation and loss.
	\|-		\|-

← Older revision		Revision as of 22:50, 4 May 2022
Line 80:		Line 80:
	[https://www.astm.org/e1578-18.html ASTM E1578-18 E-13-6]<br />		[https://www.astm.org/e1578-18.html ASTM E1578-18 E-13-6]<br />
	[https://clsi.org/standards/products/quality-management-systems/documents/qms22/ CLSI QMS22 2.2.3.3]<br />		[https://clsi.org/standards/products/quality-management-systems/documents/qms22/ CLSI QMS22 2.2.3.3]<br />
	[https://www.wadsworth.org/regulatory/clep/clinical-labs/laboratory-standards NYSDOH CLEP Clinical Laboratory Standards of Practice, General Systems Standards]		[https://www.wadsworth.org/regulatory/clep/clinical-labs/laboratory-standards NYSDOH CLEP Clinical Laboratory Standards of Practice, General Systems Standards]<br />
			[https://www.wada-ama.org/en/resources/world-anti-doping-program/international-standard-laboratories-isl WADA International Standard for Laboratories (ISL) 5.2.3.5]
	\| style="background-color:white;" \|'''27.6''' The system should be able to interface directly with a third-party reporting tool.		\| style="background-color:white;" \|'''27.6''' The system should be able to interface directly with a third-party reporting tool.
	\|-		\|-
Line 121:		Line 122:
	[https://www.pfp-ifss.org/ifss-resources/human-and-animal-food-testing-laboratories-best-practices-manual-december-2018/ PFP Human and Animal Food Testing Laboratories Best Practices Manual]<br />		[https://www.pfp-ifss.org/ifss-resources/human-and-animal-food-testing-laboratories-best-practices-manual-december-2018/ PFP Human and Animal Food Testing Laboratories Best Practices Manual]<br />
	[https://ris.dls.virginia.gov/uploads/1VAC30/dibr/Microsoft%20Word%20-%20STD-ELV1-2016-Rev2.1_LabReqs_ANSIapp.doc-20210426142653.pdf TNI EL-V1-2016-Rev.2.1 (V1,M2 4.13.1.4)]<br />		[https://ris.dls.virginia.gov/uploads/1VAC30/dibr/Microsoft%20Word%20-%20STD-ELV1-2016-Rev2.1_LabReqs_ANSIapp.doc-20210426142653.pdf TNI EL-V1-2016-Rev.2.1 (V1,M2 4.13.1.4)]<br />
			[https://www.wada-ama.org/en/resources/world-anti-doping-program/international-standard-laboratories-isl WADA International Standard for Laboratories (ISL) 5.2.3.5]<br />
	[https://www.who.int/medicines/areas/quality_safety/quality_assurance/expert_committee/trs_986/en/ WHO Technical Report Series, #986, Annex 2, 15.9]		[https://www.who.int/medicines/areas/quality_safety/quality_assurance/expert_committee/trs_986/en/ WHO Technical Report Series, #986, Annex 2, 15.9]
	\| style="background-color:white;" \|'''27.11''' The system’s data storage tools shall provide data backup and retrieval functions that meet or exceed industry best practices, including producing exact and complete backups that are secure and encrypted from manipulation and loss.		\| style="background-color:white;" \|'''27.11''' The system’s data storage tools shall provide data backup and retrieval functions that meet or exceed industry best practices, including producing exact and complete backups that are secure and encrypted from manipulation and loss.
Line 296:		Line 298:
	[https://ris.dls.virginia.gov/uploads/1VAC30/dibr/Microsoft%20Word%20-%20STD-ELV1-2016-Rev2.1_LabReqs_ANSIapp.doc-20210426142653.pdf TNI EL-V1-2016-Rev.2.1 (V1,M2 5.8.4)]<br />		[https://ris.dls.virginia.gov/uploads/1VAC30/dibr/Microsoft%20Word%20-%20STD-ELV1-2016-Rev2.1_LabReqs_ANSIapp.doc-20210426142653.pdf TNI EL-V1-2016-Rev.2.1 (V1,M2 5.8.4)]<br />
	[https://www.ams.usda.gov/datasets/pdp/pdp-standard-operating-procedures USDA Sample Processing and Analysis Procedures for PDP 5.2]<br />		[https://www.ams.usda.gov/datasets/pdp/pdp-standard-operating-procedures USDA Sample Processing and Analysis Procedures for PDP 5.2]<br />
			[https://www.wada-ama.org/en/resources/world-anti-doping-program/international-standard-laboratories-isl WADA International Standard for Laboratories (ISL) 5.3.4 and 5.3.11]<br />
	[https://www.who.int/medicines/areas/quality_safety/quality_assurance/expert_committee/trs_986/en/ WHO Technical Report Series, #986, Annex 2, 12.8 and 12.16]		[https://www.who.int/medicines/areas/quality_safety/quality_assurance/expert_committee/trs_986/en/ WHO Technical Report Series, #986, Annex 2, 12.8 and 12.16]
	\| style="background-color:white;" \|'''30.11''' The system should allow for environmental control and monitoring of equipment (such as incubators and freezers) and send notifications when necessary with recommendations for immediate and corrective action. The system should also maintain a log of all such monitored equipment and their associated status changes.		\| style="background-color:white;" \|'''30.11''' The system should allow for environmental control and monitoring of equipment (such as incubators and freezers) and send notifications when necessary with recommendations for immediate and corrective action. The system should also maintain a log of all such monitored equipment and their associated status changes.

← Older revision		Revision as of 22:34, 3 May 2022
Line 215:		Line 215:
	\| style="background-color:white;" \|'''30.4''' The system should be able to reschedule samples, change test assignments, and perform other laboratory activities based on voice command input.		\| style="background-color:white;" \|'''30.4''' The system should be able to reschedule samples, change test assignments, and perform other laboratory activities based on voice command input.
	\|-		\|-
	\| style="padding:5px; width:500px;" \|[https://www.astm.org/e1578-18.html ASTM E1578-18 E-16-5]<br />[https://csrc.nist.gov/publications/detail/sp/800-53/rev-5/final NIST 800-53, Rev. 4, MA-6(2)]		\| style="padding:5px; width:500px;" \|[https://www.astm.org/e1578-18.html ASTM E1578-18 E-16-5]<br />[https://csrc.nist.gov/publications/detail/sp/800-53/rev-5/final NIST 800-53, Rev. 5, MA-6(2)]
	\| style="background-color:white;" \|'''30.5''' The system should support predictive maintenance routines for laboratory instruments and equipment.		\| style="background-color:white;" \|'''30.5''' The system should support predictive maintenance routines for laboratory instruments and equipment.
	\|-		\|-
Line 224:		Line 224:
	\| style="background-color:white;" \|'''30.7''' The system should allow AI to algorithmically infer from past learning how to customize without explicit instruction system parameters such as aggregation, transformation, and reporting of data.		\| style="background-color:white;" \|'''30.7''' The system should allow AI to algorithmically infer from past learning how to customize without explicit instruction system parameters such as aggregation, transformation, and reporting of data.
	\|-		\|-
	\| style="padding:5px; width:500px;" \|[https://www.astm.org/e1578-18.html ASTM E1578-18 E-16-8]<br />[https://clsi.org/standards/products/quality-management-systems/documents/qms22/ CLSI QMS22 2.1.2.1]<br />[https://www.iso.org/standard/56115.html ISO 15189:2012 5.10.3]<br />[https://csrc.nist.gov/publications/detail/sp/800-53/rev-5/final NIST 800-53, Rev. 4, SI-4(5) and SI-4(7)]		\| style="padding:5px; width:500px;" \|[https://www.astm.org/e1578-18.html ASTM E1578-18 E-16-8]<br />[https://clsi.org/standards/products/quality-management-systems/documents/qms22/ CLSI QMS22 2.1.2.1]<br />[https://www.iso.org/standard/56115.html ISO 15189:2012 5.10.3]<br />[https://csrc.nist.gov/publications/detail/sp/800-53/rev-5/final NIST 800-53, Rev. 5, SI-4(5) and SI-4(7)]
	\| style="background-color:white;" \|'''30.8''' The system should monitor laboratory operation parameters (such as capacity utilization and data integrity risks) and send notifications when necessary with recommendations for immediate and corrective action. The system should also maintain a log of all such monitored operational parameters and their status changes.		\| style="background-color:white;" \|'''30.8''' The system should monitor laboratory operation parameters (such as capacity utilization and data integrity risks) and send notifications when necessary with recommendations for immediate and corrective action. The system should also maintain a log of all such monitored operational parameters and their status changes.
	\|-		\|-
Line 254:		Line 254:
	[https://www.iso.org/standard/66912.html ISO/IEC 17025:2017 6.3.3]<br />		[https://www.iso.org/standard/66912.html ISO/IEC 17025:2017 6.3.3]<br />
	[https://www.iso.org/standard/66912.html ISO/IEC 17025:2017 6.3.4]<br />		[https://www.iso.org/standard/66912.html ISO/IEC 17025:2017 6.3.4]<br />
	[https://csrc.nist.gov/publications/detail/sp/800-53/rev-5/final NIST 800-53, Rev. 4, MP-2]<br />		[https://csrc.nist.gov/publications/detail/sp/800-53/rev-5/final NIST 800-53, Rev. 5, MP-2]<br />
	[https://csrc.nist.gov/publications/detail/sp/800-53/rev-5/final NIST 800-53, Rev. 4, PE-6(1)]<br />		[https://csrc.nist.gov/publications/detail/sp/800-53/rev-5/final NIST 800-53, Rev. 5, PE-6(1)]<br />
	[https://www.ams.usda.gov/datasets/pdp/pdp-standard-operating-procedures USDA Administrative Procedures for the PDP 5.2.1]<br />		[https://www.ams.usda.gov/datasets/pdp/pdp-standard-operating-procedures USDA Administrative Procedures for the PDP 5.2.1]<br />
	[https://www.ams.usda.gov/datasets/pdp/pdp-standard-operating-procedures USDA Sample Processing and Analysis Procedures for PDP 5.2]<br />		[https://www.ams.usda.gov/datasets/pdp/pdp-standard-operating-procedures USDA Sample Processing and Analysis Procedures for PDP 5.2]<br />