Difference between revisions of "User:Shawndouglas/sandbox/sublevel25"

From LIMSWiki
Jump to navigationJump to search
Line 49: Line 49:
'''The QAO in the context of these three points'''
'''The QAO in the context of these three points'''


Where does this all place the quality assurance officer in the scope of laboratory quality and information security? Whether it's managed security services, private or public cloud services, in-house networking, or a mix of all these, the modern laboratory is a technology-driven business requiring modern approaches to addressing the risks that technology carries with it. An on-site IT staff may handle many of the details associated with those efforts, but the QAO of the 2020s needs to also be familiar with how that technology works and how it impacts organizational quality initiatives. The QAO will interact with the lab's QMS, and perhaps even the ISMS if one separately exists. Ideally cybersecurity policy and procedure is already woven into the various elements of the QMS, or, worst case, the lab doesn't have much of a cybersecurity policy. This is where the QAO of today's lab must shine, "ensuring organizational quality through the regular management, monitoring, review, and auditing of documentation, record systems, data, and processes as they relate to organizational quality and compliance frameworks and initiatives." That means also understanding how managed security services and cloud services operate. It's perhaps a tall ask, but in today's competitive laboratory environment, the tech-savvy QAO is more important than ever.
Where does this all place the quality assurance officer in the scope of laboratory quality and information security? Whether it's managed security services, private or public cloud services, in-house networking, or a mix of all these, the modern laboratory is a technology-driven business requiring modern approaches to addressing the risks that technology carries with it. An on-site IT staff may handle many of the details associated with those efforts, but the QAO of the 2020s needs to also be familiar with how that technology works and how it impacts organizational quality initiatives. The QAO will interact with the lab's QMS, and perhaps even the ISMS if one separately exists. Ideally cybersecurity policy and procedure will already be woven into the various elements of the QMS, or, worst case, the lab doesn't have much of a cybersecurity policy. This is where the QAO of today's lab must shine, "ensuring organizational quality through the regular management, monitoring, review, and auditing of documentation, record systems, data, and processes as they relate to organizational quality and compliance frameworks and initiatives." That means also understanding how managed security services and cloud services operate. It's perhaps a tall ask, but in today's competitive laboratory environment, the tech-savvy QAO is more important than ever.


====5.2.2 The shared responsibility model in the scope of security management and quality assurance====
====5.2.2 The shared responsibility model in the scope of security management and quality assurance====

Revision as of 23:24, 15 August 2023

5.2 Managed security services and the laboratory

The previous chapter explored many aspects of informatics in the laboratory, emphasizing that while software and hardware systems bring many benefits to the laboratory, a thoughtful, organization-wide approach to managing the risks that that software and hardware introduces—particularly when related to cloud computing—is required. Given these complications, it's unsurprising to learn some laboratories have turned to MSSPs to help them meet regulatory requirements and maintain the security of their on-premises and cloud-based data solutions. Examples of industries with research and laboratory work served by MSSPs over the years include the gemstone testing and grading[1], energy research and supply[2], clinical and forensic toxicology[3], and healthcare industries.[4][5] In all these examples, the implication is that proprietary trade secrets, critical infrastructure, or sensitive patient data must be protected. The laboratories operating in those industries could have attempted to keep security efforts in-house, but for one reason or another they chose to outsource a significant portion of that protection to a third-party MSSP.

But why even bother with this level of security? As previous chapters have noted, regulatory requirements are a significant driver to that end; if the lab won't meet its regulatory requirements, it risks major fines at a minimum, or at worst going out of business. In fact, some 60 percent of small businesses end up closing shop within six months of a cyberattack.[6] This happens for multiple reasons, with costs related to compliance fines, breach notifications, post-breach customer protection, public relations, reputation loss, attorney's fees, litigation, and operational disruption often laying waste to the business.[7] And it happens to businesses in almost every industry.

Laboratories are not exempt from these cyberattacks and losses, whether using on-premises systems or turning to the cloud. In 2019, Canadian laboratory testing business LifeLabs suffered a cyberattack on its systems that saw the attackers steal information and request a ransom to have the data returned. While it's not clear exactly what went wrong, talk of "[f]urther strengthening our systems to deter future incidents"[8] indicates something was off about LifeLabs' computer systems, something that likely could have been prevented with properly managed security services. In 2021, clinical at-home laboratory provider Apex Laboratory announced that it had been attacked by ransomware that hit its systems, which allowed hackers to take sensitive patient information and forcefully encrypt system and other data files until a ransom was paid.[9] This kind of attack also could have been prevented—or the damage at least mitigated—with active MSS protections. And in May 2021, news broke that benevolent hacking group Sakura Samurai, as part of a "vulnerability disclosure program" through the U.S. Department of Energy's Fermilab, had tracked down multiple vulnerabilities in Fermilab's systems, which have since reportedly been corrected.[10][11] Would have a knowledgeable and experienced MSSP caught these issues before Sakura Samurai?

However, the use of an MSSP in the laboratory can't prevent all cases of inadvertently compromising sensitive information. Take for example the case of the Wyoming Department of Health, which accidentally exposed sensitive health information about COVID-19, influenza, and controlled substance analyses in late 2020. An April 2021 news report indicated that more than 164,000 Wyoming residents were affected by the accidental uploading of files containing their testing information as part of a batch file upload to a public-facing GitHub server. While GitHub itself did not cause the release, the upload of the files—which were not intended to be in the upload batch of otherwise normal software code files—to the public servers by the Department of Health did. The Wyoming Department of Health notes that "[b]usiness practices have been revised to include prohibiting the use of GitHub or other public repositories and employees have been retrained."[12]

This statement highlights that, ultimately, internal process and procedure that didn't address the use and corresponding potential risks of public-facing servers within day-to-day operations was to blame. Strictly speaking, any MSS in place could not have prevented the upload to GitHub, unless the MSSP had prior identified this type of risk and brought it to the attention of the laboratory. It's possible an MSSP could have encouraged the lab to turn to group policies or some other access control to limit internet access from laboratory computers[13], though a careful balance of managing security risk with ensuring lab tech productivity would still need to be maintained. However, in the end, this is largely a story of internal laboratory policy, not something an MSS could prevent unless previously anticipated. This naturally brings up the discussion about a laboratory's quality assurance officer and their increasingly important role in addressing cybersecurity and choosing CSPs and MSSPs for the lab.

5.2.1 The quality assurance officer

Quality assurance laboratory 140305-N-OE749-012.jpg

Imagine a medical device manufacturer (which happens to incorporate laboratories, but that's not the main point here). A medical device manufacturer works in a highly regulated industry that not just asks but demands quality from the manufactured medical devices. As many such devices are increasingly electronic—and even network-enabled—it's imperative that cybersecurity is considered in their design and use.[14] As David Jensen of MasterControl noted in 2017: "The technologies that elevate the quality of life for patients can be used by cyber actors to undermine both the manufacturing organization and the products themselves. This means cybersecurity is as much a quality issue as it is a security issue."[15]

Note that Jensen related "cybersecurity" and "quality" together, which naturally leads to a discussion of the quality management system (QMS). A QMS is "a set of related and interacting elements that organizations use to direct and control how quality policies are implemented and quality objectives are achieved."[16] Those elements include, but are not limited to, documented processes, management models, business strategies, human capital, and information technology. Not only does the QMS help guide the implementation and achievement of organizational policy and objectives for resource management and personnel, but also it prompts an organization to focus on the core elements of quality management within its products and services: planning, control, assurance, and improvement. And just as the development and use of a QMS is often driven by standards (e.g., ISO/IEC 17025:2017 and ISO 13485:2016), the QMS often drives the organization to adopt other standards as part of bringing quality to the organization. Using our medical device manufacturer as an example, their QMS may direct them to use the ANSI/CAN/UL 2900-1 standard for ensuring medical device cybersecurity protection.[17]

Not only is the QMS vital to medical device manufacturers[15][18][19][20], but also the QMS plays an important role in most any laboratory's operations.[21][22] And in the laboratory, a quality assurance officer or manager is responsible for helping develop and maintain the laboratory's QMS, which optimally will address the importance of cybersecurity in meeting the laboratory’s goals. But the connection between a laboratory's quality assurance officer and cybersecurity is sadly not well represented in the cloud computing era. Look through the job descriptions on online job boards for quality assurance officers and you will rarely find the word "security" mentioned. Sure, the relationship between "quality" and "security" gets discussed in the context of modern software development[23], but what about within the context of a laboratory's operational quality and the people who drive it forward?

In a 2019 journal article for Lab Manager magazine, Sandia National Laboratories' chief information officer Carol Jones stated that "[c]ybersecurity is not just a technology problem; it is a people, process, and knowledge problem."[24] While this is an accurate statement, shouldn't cybersecurity also be a quality problem for a laboratory? Yes, well-trained people, vetted processes, and relevant and timely knowledge is required to ensure secure operations, but quality management and assurance—which incorporates that training, SOPs, and knowledge—should also be part of that equation. One could argue that the responsibilities of a quality assurance officer or manager are already numerous and weighty. But shouldn't that person at least have a modicum of understanding about how well-implemented IT and software security in the lab correlates to improved quality assurance outcomes?[25]

At this juncture, several questions must be asked about the quality assurance officer or manager in a laboratory operating in the 2020s:

  • What is the importance of the quality assurance officer (QAO), and do they understand cybersecurity?
  • How does the QAO help ensure quality of operations with security as a managed service?
  • How do standard operating procedures (SOPs), security audits, and other elements of a QMS positively affect quality assurance by addressing cybersecurity and cloud hosting processes?

The importance of a QAO and their security knowledge

First, the definition of what a QAO does will largely vary from company to company. However, turning to Bartram and Ballance's 1996 guide Water Quality Monitoring, the author's describe a quality assurance officer as someone "to liaise with management, to manage data archives, to conduct regular audits and reviews of the QA system, and to report on any QA issues to the program or institution manager."[26] They add that the QAO is also "responsible for regularly inspecting all aspects of the [record keeping] system to ensure staff compliance, for reporting on such inspections and audits to management, and for recommending improvements."[26] But what of a more modern definition? Turning to ISO 9000, we get a bland and non-informative definition of quality assurance itself: "part of quality management focused on providing confidence that quality requirements will be fulfilled."[27] By extension, we then get "a person responsible for providing confidence that requirements for organizational quality are fulfilled." This is a broad description, sadly. However, pulling from Bartram and Ballance, the ISO, and other sources[28][29], we could go with something like:

A quality assurance officer (QAO) is an individual responsible for ensuring organizational quality through the regular management, monitoring, review, and auditing of documentation, record systems, data, and processes as they relate to organizational quality and compliance frameworks and initiatives, while also reporting timely results, making recommendations based on those results, and assisting with training staff on approved recommendations.

Given that definition, does the average QAO need to understand at least the basics of cybersecurity? That's arguable, to be sure. After all, there are job positions such as the "cybersecurity quality and compliance officer" and the like[28], with an individual who works directly with an IT department and its cybersecurity team to ensure all mandatory laws and regulatory requirements are being adhered to, much in the same way a QAO does but on a broader organizational basis. But what about the laboratory realm? Major laboratories with significant resources may have these sorts of positions, but smaller, independent labs may not. In that case, laboratory personnel will often wear many hats, including "the tech person" or "laboratory systems engineer." (See Joe Liscouski's discussion of the "laboratory systems engineer" in his 2020 guide Laboratory Technology Planning and Management: The Practice of Laboratory Systems Engineering for more on this topic.[30]) However, given that the security surrounding an organization's electronic efforts is vital to maintaining quality operations, and also given that—hopefully—cybersecurity efforts are documented and trained upon, it's not that far a leap to suggest that the laboratory QAO should have a rudimentary understanding of IT systems and how they are secured. If cybersecurity is interwoven into the laboratory culture, including quality management, the tech-savvy QAO will be a boon to the overall quality assurance process.

The QAO and managed security services

Where does a QAO and an MSS intersect in the lab? Judging by the previous statement that the QAO may need to review organizational documentation and training material regarding cybersecurity—and even audit or assess personnel on their use of that documentation and training—we can see deduce that a QAO may be required to audit the effectiveness of any implemented MSS, or at least the documentation and processes related to the MSS. Again, it's likely in mid- to large size organizations this responsibility will fall upon the shoulders of an IT lead or IT quality officer. However, these resources may not be readily available in some laboratory settings. If those resources aren't available, the QAO may be required to know more than they expected about what managed security services entail. They won't need to be MSS experts, but as the nature of computing in the laboratory continues to evolve, having laboratory staff with relevant knowledge of automation, data management systems, and even the cloud is increasingly vital.[30]

The QMS and cybersecurity

In 2019, scientific and business consultancy Brevitas brought up the challenges of addressing cybersecurity in laboratories and other settings, noting evolving guidance that strives to address the business policies, security controls, informatics systems, and security monitoring required to better ensure the integrity and security of electronic records and data. They are one of a handful of consultancies that have publicly tied these types of standard-driven cybersecurity measures directly to the QMS[31]:

The challenge is in ensuring that these measures are effectively integrated into the existing processes outlined in the organization’s quality management system (QMS). Consideration needs to be given to first integrating cybersecurity into risk and/or criticality assessments, then downstream into system security testing during qualification and/or validation activities. As the technological landscape evolves, organizations must be more effective in their implementation of cybersecurity measures to ensure the safety of their electronic records and data. These measures must be considered as part of the QMS for all activities involved in the lifecycle of a computerized system.

As has been previously mentioned, this type of philosophy is already woven into the fabric of medical device regulation and standardization, with 21 CFR 820 on quality system regulation, ISO 13485:2016 on quality management systems, and ANSI/CAN/UL 2900 on ensuring medical device security driving how medical device cybersecurity is addressed in the manufacturer's quality management system.[20][32][33][34][35] And it may be even easier for medical device manufacturers—as well as other laboratory types—to compile, organize, disseminate, and train upon cybersecurity risk analysis data and procedural documentation with the help of an electronic QMS.[15] However, we can turn to some other businesses who have included security standards in their quality management system. Technology consultancy Konsolute has discussed why it chose to integrate ISO 27001 on information security management (and the information security management system or ISMS) into its business processes and the development of its electronic QMS, noting benefits of improved compliance, lower security risk, improved financial savings, improved reputation, and more new business.[36]

As it turns out, the ISMS and ISO 27001 have a bit in common with the QMS and ISO 9001, primarily with the goal of improving quality within the organization. Here again we see the link between a focus on cybersecurity and ensuring quality within an organization.[37][38] Senior associate Nikita Patel of Schellman & Company highlighted this association in 2017, saying that an organization "achieving this dual certification of an ISO 9001 and ISO 27001 can prove incredibly useful—in doing so, an organization can simultaneously demonstrate an organization’s ability and commitment to information security risk management, while also validating their dedication to the optimal delivery of their quality products and services."[38] From addressing anything from scoping, leadership, human resources support, and document management to internal auditing, measurement and monitoring, management review, and continual improvement, both the ISMS, focused on information security, and QMS, focused on organizational quality, improve the overall quality of an organization and its efforts.

The QAO in the context of these three points

Where does this all place the quality assurance officer in the scope of laboratory quality and information security? Whether it's managed security services, private or public cloud services, in-house networking, or a mix of all these, the modern laboratory is a technology-driven business requiring modern approaches to addressing the risks that technology carries with it. An on-site IT staff may handle many of the details associated with those efforts, but the QAO of the 2020s needs to also be familiar with how that technology works and how it impacts organizational quality initiatives. The QAO will interact with the lab's QMS, and perhaps even the ISMS if one separately exists. Ideally cybersecurity policy and procedure will already be woven into the various elements of the QMS, or, worst case, the lab doesn't have much of a cybersecurity policy. This is where the QAO of today's lab must shine, "ensuring organizational quality through the regular management, monitoring, review, and auditing of documentation, record systems, data, and processes as they relate to organizational quality and compliance frameworks and initiatives." That means also understanding how managed security services and cloud services operate. It's perhaps a tall ask, but in today's competitive laboratory environment, the tech-savvy QAO is more important than ever.

5.2.2 The shared responsibility model in the scope of security management and quality assurance

Before we move on to choosing an MMSP, we need to briefly mention the shared responsibility model and how it relates to both the MSSP's (and CSP’s) services and assuring quality within the laboratory. Back in Chapter 2, we discussed the shared responsibility model, occasionally referred to as the "shared security model." We said the shared responsibility model is useful because it clarifies elements of responsibility for information security between the laboratory and the CSP in regards to provided cloud services. A trusted CSP should be able to make both levels of responsibility clear at every step of the way, from early contract discussions to late-stage changes to customer services. The CSP remains responsible for certain levels of the IT infrastructure and software, while the laboratory remains responsible for the security of the guest OS, account security, firewall settings, and more. This delineation of responsibility varies from provider to provider, but optimally the information is related clearly to the lab by each.

When it comes to MSSPs and the cloud, they are capable of further reducing the burden of responsibility the laboratory has in regards to not only their cloud services but also any networked on-premises systems. An MSSP can take on the responsibility of the guest OS, network configuration, firewall settings, and server-side encryption, as well as a select portion of client-side data encryption, data integrity authentication, application hardening, and network traffic monitoring and protection.[39][40] This frees the laboratory from even more security detail, providing monetary, quality, and time investment benefits. As noted earlier, however, the laboratory is not completely free from worrying about security. A company culture of cybersecurity and quality must continue to be driven by strong management buy-in, well-documented business and quality policies, well-considered and -enforced operational policies, and regular quality training.

That said, how does the shared responsibility model affect the work of the QAO and laboratory's overall efforts to ensure security in the cloud, particularly with an MSSP? Primarily, shared responsibility says that the laboratory can't take a "set it and forget it" approach to security, even with a CSP and MSSP taking a significant portion of the responsibility off the laboratory's hands. Going back to the Wyoming Department of Health and its accidental upload of patient data to a public server, neither a cloud provider nor an MSSP could do much in this situation. We don't know the circumstances and technology surrounding their incident, but let's imagine that the public health lab was using a CSP and an MSSP. Certainly, the CSP would have no real say in how the lab uploaded content to a server outside its domain. The MSSP largely would have no blame either, as they likely wouldn't even be aware of the public server being uploaded to. No, that would be an internal policy issue, a solid example of how the laboratory would still have a shared stake in the responsibility of security at the lab.

From that example, we'd have to turn to the work of laboratory staff and management, including the QAO. Again, imagining a scenario where the lab was using both a CSP and an MSSP, a number of questions would arise, primary among them being "were they fully aware of and committed to the security responsibility they shared with their service providers?" That level of responsibility would include engaging in cybersecurity discussions among management and key IT personnel, having frank discussions about risk, and bringing in outside help where expertise was lacking. It would also include having a thorough understanding of how lab workers do their job, including learning about any public servers they were using. And it would also, ideally, involve discussion about that laboratory workflow with the MSSP. With all these elements, the likelihood of foreseeing the risk associated with uploading data to public servers from laboratory computers would be optimistically high. Finally, if we add the element of either a laboratory QAO or "cybersecurity quality and compliance officer," one could imagine the scenario turning out differently for the Department of Health. In the end, however, it would have still required knowledgeable personnel, a strong laboratory-wide focus on cybersecurity, and a committed QAO familiar with the importance of the shared responsibility model—and at least the basics of information security—to help ensure the quality of laboratory operations and the information security required of them.

  1. ↑ VirtualArmour International (8 April 2019). "VirtualArmour Expands Managed Cybersecurity Services with Global Gemological Organization". Intrado GlobeNewswire. https://www.globenewswire.com/news-release/2019/04/08/1799042/0/en/VirtualArmour-Expands-Managed-Cybersecurity-Services-with-Global-Gemological-Organization.html. Retrieved 28 July 2023. 
  2. ↑ PreScouter (October 2017). "Managed Cybersecurity Service Providers for Electric Utilities" (PDF). American Public Power Association. https://www.publicpower.org/system/files/documents/cybersecurity-service_providers_guide.pdf. Retrieved 28 July 2023. 
  3. ↑ "Case Study: Managed Detection Response for Toxicology Laboratory". Frontier Technologies, Inc. 2020. Archived from the original on 14 April 2021. https://web.archive.org/web/20210414070225/https://ftiusa.com/case-studies/case-study-managed-detection-response-for-toxicology-laboratory/. Retrieved 28 July 2023. 
  4. ↑ "Healthcare Managed Security Services Forum". Cylera. November 2020. https://resources.cylera.com/healthcare-managed-security-services-forum. Retrieved 28 July 2023. 
  5. ↑ "Putting Information Exchange to Work for Healthcare". ANXeBusiness Corp. http://anxebiz.anx.com/content/industries/healthcare. Retrieved 28 July 2023. 
  6. ↑ Galvin, J. (7 May 2018). "60 Percent of Small Businesses Fold Within 6 Months of a Cyber Attack. Here's How to Protect Yourself". Inc.com. https://www.inc.com/joe-galvin/60-percent-of-small-businesses-fold-within-6-months-of-a-cyber-attack-heres-how-to-protect-yourself.html. Retrieved 28 July 2023. 
  7. ↑ "BLOG: Cost of Cyber Crime to Small Businesses". Virginia SBDC Blog. Virginia SBDC. 30 May 2017. Archived from the original on 27 December 2020. https://web.archive.org/web/20201227041535/https://www.virginiasbdc.org/blog-cost-of-cyber-crime-to-small-businesses/. Retrieved 28 July 2023. 
  8. ↑ "Canadian Lab Test Firm LifeLabs Pays Ransom After Data Breach". Security. BNP Media. 26 December 2019. https://www.securitymagazine.com/articles/91467-canadian-lab-test-firm-lifelabs-pays-ransom-after-data-breach. Retrieved 28 July 2023. 
  9. ↑ Arghire, I. (4 January 2021). "Apex Laboratory Says Patient Data Stolen in Ransomware Attack". Security Week. https://www.securityweek.com/apex-laboratory-says-patient-data-stolen-ransomware-attack. Retrieved 28 July 2023. 
  10. ↑ Kirk, J. (7 May 2021). "US Physics Laboratory Exposed Documents, Credentials". Bank Info Security. https://www.bankinfosecurity.com/us-physics-laboratory-exposed-documents-credentials-a-16536. Retrieved 28 July 2023. 
  11. ↑ Willis, R. (6 May 2021). "Fermilab Hack, April/May 2021". Robert Willis Hacking. https://robertwillishacking.com/fermilab-hack-april-may-2021/. Retrieved 28 July 2023. 
  12. ↑ Flack, B. (27 April 2021). "Wyoming Department of Health Announces Data Breach of Thousands of Wyoming Residents". SweetwaterNow. Archived from the original on 27 April 2021. https://web.archive.org/web/20210427221317if_/https://www.sweetwaternow.com/wyoming-department-of-health-announces-data-breach-of-thousands-of-wyoming-residents/. Retrieved 28 July 2023. 
  13. ↑ Paul (3 June 2019). "How To Restrict Internet Access Using Group Policy (GPO)". The Sysadmin Channel. https://thesysadminchannel.com/how-to-restrict-internet-access-using-group-policy-gpo/. Retrieved 03 June 2019. 
  14. ↑ Nayyar, S. (22 December 2020). "The Unique Threats Posed By Medical IoT Devices And What To Do About Them". Forbes. https://www.forbes.com/sites/forbestechcouncil/2020/12/22/the-unique-threats-posed-by-medical-iot-devices-and-what-to-do-about-them/. Retrieved 28 July 2023. 
  15. ↑ 15.0 15.1 15.2 Jensen, D. (3 June 2017). "How an Electronic Quality Management System Helps With Cybersecurity". MasterControl. Archived from the original on 23 May 2021. https://web.archive.org/web/20210523211209/https://www.mastercontrol.com/gxp-lifeline/how-an-electronic-quality-management-system-helps-with-cybersecurity/. Retrieved 28 July 2023. 
  16. ↑ Shoemaker, D.; Sigler, K. (2014). Cybersecurity: Engineering a Secure Information Technology Organization. Cengage Learning. pp. 62–63. ISBN 9781285169903. https://books.google.com/books?id=b1s8AwAAQBAJ&pg=PA62. 
  17. ↑ Wirth, A.; Gates, C.; Smith, J. (2020). Medical Device Cybersecurity for Engineers and Manufacturers. Artech House. pp. 23–24. ISBN 9781630818159. https://books.google.com/books?id=oawCEAAAQBAJ&pg=PA23. 
  18. ↑ Therapeutic Goods Administration (March 2021). "Medical device cyber security guidance for industry" (PDF). Commonwealth of Australia. https://www.tga.gov.au/sites/default/files/medical-device-cyber-security-guidance-industry.pdf. Retrieved 28 July 2023. 
  19. ↑ "Risk Management Best Practices for Cybersecurity Compliance". AssurX Blog. AssurX, Inc. 30 January 2017. https://www.assurx.com/risk-management-cybersecurity-compliance/. Retrieved 28 July 2023. 
  20. ↑ 20.0 20.1 "Cybersecurity & Quality Management System Integration". Apraciti. https://apraciti.com/cybersecurity-quality-management-system-integration/. Retrieved 28 July 2023. 
  21. ↑ World Health Organization (2011). Laboratory Quality Management System Handbook. World Health Organization. ISBN 9789241548274. https://www.who.int/publications/i/item/9789241548274. 
  22. ↑ United States Geological Survey. "Quality Management System for USGS Laboratories". United States Geological Survey. https://www.usgs.gov/office-of-science-quality-and-integrity/quality-management-system-usgs-laboratories. Retrieved 28 July 2023. 
  23. ↑ Worrall, J. (18 August 2020). "Why Quality & Security Both Matter in Software". DarkReading. https://www.darkreading.com/vulnerabilities-threats/why-quality-security-both-matter-in-software. Retrieved 28 July 2023. 
  24. ↑ Tulsi, B.B. (4 September 2019). "Greater Awareness and Vigilance in Laboratory Data Security". Lab Manager. https://www.labmanager.com/greater-awareness-and-vigilance-in-laboratory-data-security-776. Retrieved 28 July 2023. 
  25. ↑ Hamidovic, H. (2012). "Fundamental Concepts of IT Security Assurance". ISACA Journal 2: 45–9. https://www.isacajournal-digital.org/isacajournal/2012vol2?article_id=1078418&pg=45. 
  26. ↑ 26.0 26.1 Bartram, J.; Ballance, R., ed. (2020). Water Quality Monitoring: A practical guide to the design and implementation of freshwater quality studies and monitoring programmes. CRC Press. p. 218. ISBN 9780419223207. https://books.google.com/books?id=5PQCEAAAQBAJ&pg=PA218. 
  27. ↑ "ISO 9000:2015(en) Quality management systems — Fundamentals and vocabulary". ISO. 2015. https://www.iso.org/obp/ui/#iso:std:iso:9000:ed-4:v1:en. Retrieved 28 July 2023. 
  28. ↑ 28.0 28.1 Genesis IT&T (10 May 2021). "Cybersecurity Quality and Compliance Officer - 6 Month Contract". Seek. Archived from the original on 28 July 2023. https://web.archive.org/web/20210524220443/https://www.seek.com.au/job/52226409?type=standard. Retrieved 28 July 2023. 
  29. ↑ "Quality Control Officer - What They Do". Zippia. https://www.zippia.com/quality-control-officer-jobs/what-does-a-quality-control-officer-do/. Retrieved 28 July 2023. 
  30. ↑ 30.0 30.1 Liscouski, J. (December 2020). "Laboratory Technology Planning and Management: The Practice of Laboratory Systems Engineering". 
  31. ↑ "Cybersecurity Response". Brevitas. 2019. https://brevitas.us/cybersecurity-response/. Retrieved 28 July 2023. 
  32. ↑ Lincoln, J.E. (17 April 2017). "Cybersecurity - Buzzword or Serious Safety Concern?". IVT Network. Archived from the original on 25 May 2021. https://web.archive.org/web/20210525165934/https://www.ivtnetwork.com/article/cybersecurity-buzzword-or-serious-safety-concern. Retrieved 28 July 2023. 
  33. ↑ Heyl, J. (October 2017). "Overview of UL 2900 - Medical Device Cybersecurity Workshop" (PDF). UL. https://www.cybersecuritysummit.org/wp-content/uploads/2017/10/4.00-Justin-Heyl.pdf. Retrieved 28 July 2023. 
  34. ↑ "UL 2900: A Cybersecurity aid for industry and regulators" (PDF). UL. 2019. https://fda.report/media/123068/UL2900-Cybersecurity-Aid.pdf. Retrieved 28 July 2023. 
  35. ↑ "ISO 13485:2016 Medical devices — Quality management systems — Requirements for regulatory purposes". ISO. March 2016. https://www.iso.org/standard/59752.html. Retrieved 28 July 2023. 
  36. ↑ "Cybersecurity of the future: Why we include ISO 27001 as standard in our Quality Management System". Konsolute. 30 April 2021. https://www.konsolute.com/blog/iso-27001-cybersecurity-quality-management/. Retrieved 28 July 2023. 
  37. ↑ "Information Security Management System (ISMS)". CVG Strategy. 2020. https://cvgstrategy.com/information-security-management-system/. Retrieved 28 July 2023. 
  38. ↑ 38.0 38.1 Patel, N. (16 October 2017). "ISO 9001 and 27001 – The Relationship". Schellman Blog. Schellman & Company. Archived from the original on 28 February 2021. https://web.archive.org/web/20210228030103/https://www.schellman.com/blog/iso-9001-and-27001-the-relationship. Retrieved 28 July 2023. 
  39. ↑ Wang, K. (14 October 2020). "Shared Responsibility in the Cloud: Reduce Your Security Burden With a Managed Security Service Provider (MSSP)". Cloudticity Blog. Cloudticity. https://blog.cloudticity.com/shared-responsibility-cloud-managed-service-provider-security. Retrieved 28 July 2023. 
  40. ↑ Savir, L. (23 November 2024). "How a Managed Service Provider Can Harden Security Across Your Business and Save on Costs". AllCloud Blog. https://allcloud.io/blog/how-a-managed-service-provider-can-harden-security-across-your-business-and-save-on-costs/. Retrieved 28 July 2023. 
Retrieved from "https://www.limswiki.org/index.php?title=User:Shawndouglas/sandbox/sublevel25&oldid=52832"