| (a) Validation of systems to ensure accuracy, reliability, consistent intended performance, and the ability to discern invalid or altered records. |
FirstDocis developed in accordance with the CSC LSQMSadvantage™, an ISO 9001:2000 certified Quality Management System.QMSadvantage and FirstDoc have been audited by many pharmaceutical clients. As part of a formal vendor audit, CSC can provide evidence that FirstDoc is developed and tested in accordance with QMSadvantage.FirstDoc has been validated by many clients. CSC offers a validation package (consisting of validation plan, traceability matrix, and IQ/OQ/PQ protocol templates and OQ protocols) with each release of the FDRD, FDQ&M, and FDTMF products. |
FirstPoint is developed in accordance with the CSC LS QMSadvantage™, an ISO 9001:2000 certified Quality Management System. QMSadvantage™ has been audited by many pharmaceutical clients. As part of a formal vendor audit, CSC can provide evidence that FirstPoint is developed and tested in accordance with QMSadvantage™.FirstPoint is “validation ready” for its clients upon completion of installation and configuration. Full IQ, OQ validation scripts, a PQ template and supporting services available from CSC for interested clients. |
Validation is ultimately the responsibility of the client as validation can only be performed in the environment in which the software will be used, and against specifications defined by system users.NextDocs offers a validation toolkit to streamline the validation process.The toolkit includes a sample validation master plan and traceability matrix, ready-to-run scripts for IQ and OQ, summary report templates, and sample PQ scripts.NextDocs also has standard professional services packages that include assistance with validation planning, PQ script preparation, and managing PQ script execution and documentation activities. |
| (b) The ability to generate accurate and complete copies of records in both human readable and electronic form suitable for inspection, review, and copying by the agency. Persons should contact the agency if there are any questions regarding the ability of the agency to perform such review and copying of the electronic records. |
Documentum will satisfy this requirement in conjunction with a company’s records management policy. Features of Documentum that support generation of accurate and complete copies in human readable form include the generation of PDF renditions and the ability to view and print these renditions in accordance with a system’s defined security rules.Additional support for this requirement is provided by FirstDoc’s automatic PDF rendition generation feature. Each time the content of a document is modified and the modifications checked in, FirstDoc generates a PDF rendition from an approved rendition generation station if the format supports transformation to PDF. Automatic transformation to PDF ensures that all documents will be readable in the foreseeable future. |
FirstPoint satisfies thisrequirement by managingaccurate and complete copies of files in human readable form with the tight integration with the Microsoft Office Suite of products andthe generation of PDF renditions and the system generated and maintained metadata. The system also provides human readable audit trails and reports. The ability to view and print these files and associated metadatais managedin accordance with a system’s defined security rules.All relevant recordsare maintained in their native file format within a robust MS SQL database and MS SharePoint environment. FirstPoint generates a PDF rendition from an approved rendition generation station, if the format supports transformation to PDF. Automatic transformation to PDF ensures that all documents will be readable into the foreseeable future. |
Actual generation of records is a client responsibility. NextDocs facilitates generating copies of records by:
- Viewing records in native electronic format with any computer running one of several supported browsers.
- Allowing records to be exported by dragging and dropping to any desired file system location
- Providing sophisticated controlled, uncontrolled and clean copy printing capabilities
|
| (c) Protection of records to enable their accurate and ready retrieval throughout the records retention period. |
- Documents may be retained in the system throughout their retention period, or an archiving process developed to store them outside the system. Documentum’s built-in archiving capability can be used to migrate content offline while maintaining metadata in the docbase.
- FirstDoc uses Documentum’s robust security, which limits the capability for modifying and deleting records to designated users. FirstDoc automatically applies security to Approved documents that prevents them from being deleted or modified.
- The FirstDoc product also includes an optional Records Management module which implements retention policies and allows deletion of records which have reached the end of their retention periods in accordance with a standard process.
|
Documentsmay be retained in the system throughout their retention periodthrough the use of a built-inlifecycle management system.FirstPoint applies robust security across the entirelifecycle, which prevents and limits approved or historical records from being deleted or modified except by specifically designated users. A document restore feature is available to the system administrator that allows for the retrieval of deleted records.All FirstPoint content is retained for retrieval until some business rule criteria has been meet to trigger the destruction. Records retention fun includes the ability to purge specific cycles of minor or major versions at the Library Level and purge working comments and draft comments after a specified retention period. |
NextDocs systems automatically “lock down” official versions of documents so that they cannot be deleted or modified without following system configurable change control procedures. |
| (d) Limiting system access to authorized individuals. |
- The underlying Documentum application implements a secure username and encrypted password (generally the network password) to limit access to authorized individuals.
- FirstDoc augments Documentum security by providing automatic application of a client’s defined security scheme. Users cannot modify security outside of the rules defined by the client.
- FirstPoint provides a secure username and encrypted password for all users in addition to the network access/password system.
- FirstPoint augments the SharePoint basic Library level security by allowing permission sets to be applied based on any metadata in the system. This allows for content to have a more granular security model based on role, site, project, product etc, and allows for confidential documents to have a restricted access permission set.
- FirstPoint also provides application level rights to system and business administration function such as setting up workflow and other business rules templates.
|
In general, an SOP is needed to define the roles and responsibilities for the administration and maintenance of the groups and users for the system and/or network permissions. |
Access to NextDocscan be controlled by configuration. Securitycan be configured to use Active Directory or Active Directory Lightweight Directory Services accounts or accounts created within SharePoint. Internal users with on-premises deploymentscan access NextDocs applications through single sign-on without requiringadditional system login unless performing a signature related action in the system.Alternatively, if a client’s Part 11 interpretation requires explicit sign-onto access the system, single sign-oncan be disabled. Internal users with hosted deployments access NextDocs applications by providing a user name and password.External users access NextDocs applications by providing a user name and password. Depending on a client’s security set-up, Virtual Private Network (VPN) access may be required as well. |
| (e) Use of secure, computer-generated, time-stamped audit trails to independently record the date and time of operator entries and actions that create, modify, or delete electronic records. Record changes shall not obscure previously recorded information. Such audit trail documentation shall be retained for a period at least as long as that required for the subject electronic records and shall be available for agency review and copying. |
- FirstDoc uses the Documentum audit trail capability augmented by audit trail entries produced for custom FirstDoc events. Example events include checkin, save, destroy, status change and user acknowledgements, such as review and approval outcome — including electronic signature. Since the audit trail must be maintained for the life of the record, Documentum’s Purge Audit Trail capability should not be used unless the audit trail has been migrated offline as controlled by a client’s SOP. Note: This assumes that the approved record is the electronic record. Audit trail entries for draft, minor versions of records can be deleted using the FirstDoc purge minor version functionality if the clients’ policies dictate.
- FirstDoc provides thecapability for authorized users to change document metadata on approved records. In this case, an audit trail entry captures the previously recorded values so they are not obscured.
- SharePoint records all events that occur on documents, the time and date of the and the username of individual (or system account) performing the action.
- FirstPoint also provides a preconfigured, system generated audit trail report for each document that records the date/time of all critical events that occur during the entire of the document or record from creation, review and approval.
The username of the individual (or system account) who invoked each action during the history of the document is also shown in the audit trail report.
Information pertaining to previous document will continue to be displayed in the audit trail report, even as new versions of the document are created.
- The audit trail report is presented as a single viewable and printable file.
- The audit trail report is systematically generated, and cannot be overwritten or otherwise modified by any user.
|
|
NextDocs records:
- Record modification events including check-in and check-out.
- Move, copy, delete and undelete events.
- Electronic/Digital Signature events.
- Lifecycle promotions and demotions
- Workflow events
- Permission changes
- Record viewing (configurable).
Audit trail entries include event, user name and server-based time/date stamp. Local time/date stamps can also be configured if desired.
Audit trail records are retained indefinitely unless manually purged from the system.
NextDocs also provides access to and copying of the audit trail. The audit trail can be saved to Excel with a single click for advanced sorting, filtering and analysis.
|
| (f) Use of operational system checks to enforce permitted sequencing of steps and events, as appropriate. |
These checksare implemented within a number of system functions. They include client-defined control over:
- Enforcing the use of approved templates only in creating documents
- Limiting property values to predefined dictionary lists wherever possible
- Requiring entry of mandatory attributes
- Enforcing storage in a pre-defined hierarchy (cabinet/folder structure)
- Enforcing a defined document lifecycle and approval process
- Ensuring that all required electronic signatures are obtained (if electronic signatures are used)
|
These checks areimplemented within a number of system functions. They include client control over:
- The use of approved templates in creating documents/records.
- Predefined metadata dictionary lists which structure dependent valid choices.
- Enforcement of mandatory metadata fields where required.
- Enforcing a defined document lifecycle requiring a specific, defined review and approval process via document workflow
- Enforcing the review and approval of the PDF rendition of the document, since that is generally considered to be the approved electronic record
- Ensuring that all required electronic signatures or electronic approvals are obtained using systematic participant selection and voting rules.
|
These checksare implemented ina number of areas. Some examples include:
- Ensuring that documents follow a defined lifecycle
- Ensuring that workflows are used when needed to move a document through its lifecycle
- Ensuring that documents are properly set up to display digital signatures before they can be signed
- Ensuring that all required signatures are collected before a document is approved
- Ensuring that documents meet requirements such as having a valid PDF rendition before becoming approved or effective
- Ensuring that all required metadata is entered for a document
- Enforcing the use of approved templates for authoring
- Limiting pick lists to appropriate values when creating or modifying document properties
|
| (g) Use of authority checks to ensure that only authorized individuals can use the system, electronically sign a record, access the operation or computer system input or output device, alter a record, or perform the operation at hand. |
These checksare implemented within a number of system functions. They include client-defined control over authorization for:
- Document creation
- Document access (delete, write, read, etc.) (via ACL security)
- Changing status
- Initiating and participating in the review and approval process
- Signing documents (if electronic signatures are used)
- Establishing document relations including change request relationships
- Performing various types of business administration functions including dictionary maintenance, training record control, etc.
|
A series of authority checksare implemented within system functions. They include the following client defined controls:
- Network access with unique ID and password controlled at the operating system level.
- The SharePoint permission model controls document security at the Library (a collection of documents) and for draft versus approved documents.
- FirstPoint enhances this security model which allows additional security layers to be implemented based on document metadata. This is useful for documents required restricted, confidential controls.
- Documents that are part of a workflow process receive enhanced security in that only those selected participants have access to the in progress document.
- System configuration, maintenance and other types of business administration functions are accessed only by those individuals with specific access rights.
|
These checksare implemented ina number of areas. Some examples include limiting the following to authorized users:
- Modifying a document’s content or properties
- Initiating or participating in workflows
- Applying digital/electronic signatures
- Modifying system configurations
- Generating controlled or uncontrolled copy prints
- Modifying essential information, such as study investigators
- Approving requests for system access
|
| (h) Use of device (e.g., terminal) checks to determine, as appropriate, the validity of the source of data input or operational instruction. |
This requirement in general does not apply to FirstDoc since the system does not have any functionality where information is valid only when entered from specific terminals. If a specific client has this requirement, CSC will address the requirement for that client. |
This requirement in general does FirstPoint since the system does not have any functionality where information is valid only when entered only from specific terminals. If a specific client has this requirement, CSC will address the requirement for that client. |
This requirement does not apply to NextDocs since the system does not have any functionality where information is valid only when entered from specific terminals. |
| (i) Determination that persons who develop, maintain, or use electronic record/electronic signature systems have the education, training, and experience to perform their assigned tasks. |
- CSC maintains resumes and training records on all team members.
- CSC provides training to key client team members including business users, business administrators, and system administrators.
- Upon request, CSC can provide developer training to non-CSC developers employed by the client.
- CSC maintains resumes and training records for all its team members.
- CSC will also help generate training records to track any training it provides to the client’s personnel.
|
|
NextDocs maintains resumes and training records s to provide evidence that our employees who develop and deploy our software are trained and qualified to do so.NextDocs also provides client-specific training documentation to help our clients comply with this requirement. We also offer end user training, train-the-trainer training and administrator training. |
| (j) The establishment of, and adherence to, written policies that hold individuals accountable and responsible for actions initiated under their electronic signatures, in order to deter record and signature falsification. |
N/A |
This requirement is not applicable at a system level but requires a procedure to be implemented by the client. |
Client responsibility |
| (k) Use ofappropriate controls over systems documentation including:(1) Adequate controls overthe distribution of, access to, and use of documentation for system operation and maintenance.(2) Revision and change control procedures to maintain an audit trail that documents time-sequenced development and modification of systems documentation. |
Electronic audit trail for the appropriate document types must be enabled if documentation is maintained in electronic format. |
- CSC will provide the client copies or access to system documentation corresponding to the licensing agreement and version of the product.
- CSC maintains a strict version and change control methodology for its product, product related documentation and training materials.
|
NextDocs’s documentationis maintained in our configuration management system and available for review during audits.However, ultimately it is the client’s responsibility to control system documentation in their environment.NextDocs’ release notes describe the names and versions of documentation that apply to each product release. In addition, each client receives documentation specific to their NextDocs implementation. |
| § 11.30 Controls for Open Systems. Same as § 11.10 plus document encryption and use of appropriate digital signature standards to ensure, as necessary under the circumstances, record authenticity, integrity, and confidentiality. |
- If the system is judged to be an open system, it would require encryption and digital signature standards. This is not part of FirstDoc and can be contracted as an option if needed.
|
CSC believes the FirstPoint products are a closed system so section 11.30 is not applicable. |
NextDocs systems that are hosted may be considered open based on the specific circumstances and the client’s 21 CFR Part 11 interpretation. The use of digital signature is available in all NextDocs products to fulfill the additional requirements imposed on open systems. |
|
|
|
|
|
|
|
