CONTENTS

List of TablesList of FiguresPreface

1 Introduction 1

2 Infrastructure Lifecycle ApproachRecommendation and ConceptualizationDesignDesign ReviewsDevelopment and IntegrationImplementationRelease for UseOperational LifeRetirementRetaining Project and Qualification-Related DeliverablesChapter 2 Summary

3 Infrastructure Qualification OverviewWhat is Infrastructure?What is Infrastructure Qualification?Why Qualify the Computer Infrastructure?Introduction to the Infrastructure Qualification ProcessAll Together

4 FDA EnforcementIntroductionFDA Computer Systems EnforcementGanes Chemicals (483 — 1999)Eli Lilly & Company (483 — 2001)

iii

Prelims 25/7/06 1:49 pm Page iii

www.pda.org/bookstore

Pharmacia Corporation (483 — 2000 and Warning Letter — 2001)Novartis Pharma GmbH (483 — 2002)Skele Tech (483 — 2003)Company Unknown (483 — 20904)Company Unknown (Warning Letter — 2004)International Pharm & Biotech Labs (EIR — June 2003)

5 Regulatory RequirementsIntroductionPotential Regulatory ConsequencesUS FDA Regulatory RequirementsEU Regulatory Guidance

6 21 CFR Part 11IntroductionLAN/WANServer Hardware and Service ComponentsSystem-level Software

7 Procedural Controls

8 Computer Infrastructure SecurityPhysical SecurityNetwork SecurityOther Key Security Elements

OSI Model Security ServicesAuthentication

Protection of Records and Audit TrailsProtection of RecordsAudit Trails

9 Infrastructure Qualification PlanningIntroductionQualification Project PlanProject Schedule

10 Qualification TestingIntroductionQualification Testing Lifecycle

Test PlanProtocolSummary (Analysis) Report

CommissioningSample Qualification Testing/Commissioning Test Cases

System-level SoftwareApplication ServersService ComponentsLAN/WAN

Infrastructure Qualification in the FDA Regulated Industryiv

Prelims 25/7/06 1:49 pm Page iv

www.pda.org/bookstore

Miscellaneous EquipmentNetwork Centers

11 Qualification Testing System-level SoftwareIntroductionServer and Controllers Operating Systems

Qualification Testing Practices for Operating SystemsPart 11 Areas of Interest

Network Operating SystemsQualification Testing Practices for Operating SystemsQualification Testing Practices for FirmwarePart 11 Areas of Interest

Security, Diagnostic and Monitoring ToolsQualification Testing Practices for Standard Software PackagesPart 11 Areas of Interest

Desktop ImagesScripts

Qualification Testing Practices for ScriptsPart 11 Areas of Interest

File and Database ManagementMiddleware

Part 11 Areas of Interest

12 Qualification Testing Application Servers and Service ComponentsInstallation QualificationOperational Qualification

13 Qualification Testing LAN DevicesSwitchRouterQualification of Other LAN Devices

HubGatewaysRepeatersBridgesBrouter

14 Qualification Testing WAN DevicesExternal RouterWAN LinksFirewallVPN SwitchesLoad Balancing DevicesIntrusion Detection Devices

15 Qualification Testing WAN/LAN System

Contents v

Prelims 25/7/06 1:49 pm Page v

www.pda.org/bookstore

16 Qualification Testing the Storage Area NetworksIntroductionQualification StrategyPart 11

17 Qualification Wireless ServicesWLAN Devices

Access PointVPN ServerLAN Switch

WLAN System Qualification

18 Qualification Testing Network CentersIntroductionQualification TestingInstallation QualificationOperational Qualification

19 Qualification Testing Database ManagerIntroductionDatabase Server — Single or ClusterDatabase Server SoftwareCritical Database Server IssuesPart 11 ConsiderationsQualification Testing

20 Change ManagementIntroductionType of ChangeChange Management ProcessEmergency ChangesPart 11 and Infrastructure Related Change

21 Training

22 Remediation ProjectIntroductionInfrastructure EvaluationCorrective Action Planning

InterpretationImpact AssessmentTrainingSuppliers Qualification Program

RemediationRemediation Project Report

23 Maintaining the State of QualificationIntroduction

Infrastructure Qualification in the FDA Regulated Industryvi

Prelims 25/7/06 1:49 pm Page vi

www.pda.org/bookstore