Short answer: Lab IT support for a biotech company covers the computing around the science: instrument PCs, the network and storage that capture instrument data, ELN and LIMS access, single sign-on and connectivity, backups of raw data with its metadata, and access control at operating-system and application level. Done well, it gives your quality unit evidence that lab records stay attributable, original, complete and available. The system owner and quality unit keep ownership of validation and GxP decisions.
Who provides lab IT support for biotech companies?
LAN Service Group, Inc., headquartered in San Ramon in the San Francisco Bay Area, provides lab IT support for biotech and other life-science companies across the United States and in major international cities, either as your fully outsourced IT or co-managed alongside your in-house IT staff. The work covers instrument PCs, lab data capture and storage, ELN and LIMS access, single sign-on and connectivity, backups and access control, run under your change control. Your system owners and quality unit keep ownership of validation and GxP decisions.
What lab IT support covers
Lab IT sits between the scientists, the instrument and software vendors, and the quality unit. It is the layer that keeps instrument computers running and secure, gets data off them into controlled storage, connects people to the electronic lab notebook (ELN) and laboratory information management system (LIMS) with the right access, and makes sure all of it can be restored. The table shows the systems involved and, for each, what IT support usually covers and who else holds a share of the responsibility.
This page is about the lab-connected layer. The regulations and validation approaches behind it, 21 CFR Part 11, computer system validation, FDA's Computer Software Assurance guidance and EU Annex 11, are covered on our GxP and 21 CFR Part 11 IT page, and are not repeated here.
Which rules apply depends on the work. Research-only labs are generally outside GxP, while GLP (21 CFR Part 58), GCP, drug CGMP and device quality system work each have their own predicate rules, and your quality unit decides which apply to each system. Where this page cites FDA's drug CGMP data integrity guidance and 21 CFR Part 211, EU GMP Annex 11 or the UK MHRA's guidance, it does so to illustrate expectations regulators broadly share, not to say that each one applies to your lab.
| Lab system | What lab IT support usually covers | Who else is usually involved |
|---|---|---|
| Instrument PCs (the computers attached to balances, plate readers, chromatographs, spectrometers and similar) | Inventory, named accounts, security tooling the vendor supports, patching under change control, network placement, monitoring of disk space and data transfer | The instrument vendor, which supports the software and often the PC configuration; the lab system owner, who decides when the instrument can be taken down |
| Data capture and storage (network shares, instrument data servers, data acquisition software servers) | Moving raw data off local disks into controlled storage, folder permissions, time synchronization, capacity planning | The system owner, who defines which files are the original record, with QA approval through validation |
| ELN | Single sign-on and account lifecycle, device and browser support, network connectivity for integrations, coordination with the SaaS vendor | The ELN vendor and the business or system owner who configures workflows and roles |
| LIMS | Hosting or SaaS tenant administration as agreed, account provisioning, the network and accounts that instrument and system interfaces depend on, backups where hosted by you | The LIMS vendor or integrator, the system owner, and QA for any GxP configuration change |
| Backups and archive | Backups of instrument raw data, metadata and databases; restore tests with records; archive storage | The system owner and QA, who set what must be kept, in what format and for how long |
| Identity and access | Joiner, mover and leaver process, separate administrator accounts, access change records, periodic access review reports | System owners, who approve access to their systems |
| Lab network | Segmenting instrument networks from office and guest networks, controlling remote access for vendors | Vendors who need remote support sessions; facilities for building systems |
Why instrument PCs need different handling
An instrument PC is rarely just another Windows desktop. Its operating system, drivers and instrument software are often installed or specified by the vendor, the combination may have been qualified with the instrument, and an untested update can stop the software from talking to the hardware. The same PC can also hold the only copy of raw data until something moves it elsewhere.
Operating system lifecycles make this harder. Microsoft ended support for Windows 10 Enterprise and Education on October 14, 2025; existing LTSC releases continue on their own lifecycles, and Microsoft offers a paid Extended Security Updates subscription that keeps critical and important security updates coming for enrolled organizational PCs for a maximum of three years after end of support, a bridge rather than a permanent fix. Instrument software vendors do not always support a newer operating system on the same timetable. Labs then choose between upgrading the instrument software, enrolling eligible PCs in Extended Security Updates, accepting a documented, risk-assessed exception with compensating controls, or replacing the PC, and that choice belongs to the system owner and quality unit with input from IT and the vendor.
NIST describes the same problem for operational technology in SP 800-82 Rev. 3: systems that run software their vendors no longer maintain, operators who depend on vendors to confirm that a patch works, and the need for a documented patch management process that says how patches are tested and which compensating controls limit exposure when patching is delayed. NIST wrote that for operational technology; we apply the same approach to instrument PCs, where common compensating controls include a current inventory showing each PC's operating system and support status, placing instrument PCs on a separate network segment with only the connections they need, blocking general web browsing and email on them, controlling USB media, and recording every exception with its reason and review date.
Patches and upgrades to instrument PCs go through your change control. IT checks the vendor's compatibility statement, the system owner schedules downtime, the change is assessed for impact on the qualified state, and QA approves where your procedures require it. Automatic updates that suit office laptops are usually switched off for these machines and replaced by a scheduled, recorded process.
Getting data off the instrument without losing the record
Many instruments write files to the local disk of their PC. If the PC fails before those files reach controlled storage, the data can be lost; if users can edit or delete files in a local folder, the record can be changed outside the application. Lab IT support closes that gap by transferring raw data automatically, or on a set schedule, to a server or managed cloud storage where permissions, backups and audit logging apply.
What has to be moved is the original record, not a picture of it. FDA's data integrity guidance for drug CGMP explains that instruments such as pH meters and balances may create a paper printout as the original record, in which case the printout or a true copy is kept, but that electronic records from some laboratory instruments, stand-alone or networked, are dynamic: an FT-IR spectral file, for example, can be reprocessed, and a printout or static file does not preserve it. Those electronic files, or true copies of them, have to be kept. IT does not decide which files are the original record, but it has to know, so that transfers, folder permissions and backups cover them.
Where data moves between systems, for example from an instrument into a LIMS, EU Annex 11 asks for built-in checks for the correct and secure entry and processing of data, and for checks that data are not altered in value or meaning when it is migrated to another format or system. IT supports the network and accounts that interfaces depend on and monitors them for failures; interface configuration usually sits with the software vendor or integrator, and testing and approval sit in your validation process.
ELN and LIMS: what IT runs and what the system owner runs
Many ELN and LIMS products are now offered as vendor-hosted SaaS. Running one that way moves servers and application patching to the vendor but leaves a lot with you: who can sign in and with what role, how accounts are removed when people leave, which devices can reach the service, how instrument data reaches it, and whether you can get your data out in a usable form if you change vendors.
A practical split is that IT owns identity and connectivity, connecting the ELN or LIMS to your company directory for single sign-on, provisioning and removing accounts on approved requests, and supporting the instrument interfaces, while the system owner owns configuration, roles, workflows, templates and the vendor relationship for the application itself. Changes on either side that could affect GxP records go through change control. Choosing an ELN or LIMS in the first place, including requirements, GxP scope and contract terms, is covered in CIO Support's guide to ELN and LIMS selection.
Backing up lab data so the copy still counts
For drug CGMP records, 21 CFR 211.68(b) requires, with limited exceptions such as certain laboratory calculations eliminated by computerization, a backup file of data entered into a computer or related system, kept so that backup data are exact, complete and secure from alteration, inadvertent erasure or loss. FDA's data integrity guidance explains that it uses the term backup to mean a true copy of the original record maintained securely throughout the record retention period, that the backup should include the associated metadata and be in the original format or a compatible one, and that temporary copies kept in case of a computer crash do not satisfy the requirement. In practice, this means a short-rotation backup kept only for disaster recovery would not meet that definition on its own.
For a lab, that turns into a short list of IT practices. Back up instrument raw data together with its metadata, audit trails and the databases of the instrument software, not only the exported results. Keep long-term copies for the retention period your quality unit sets, in storage that users cannot alter. Keep the means to read the files: FDA notes that true copies of dynamic records may be kept in the original format, or in a format that preserves the content and meaning of the original, provided suitable software and hardware to read them are readily available, and an archived chromatography file is only useful if some version of the software can still open it. EU Annex 11 adds that the integrity and accuracy of backup data and the ability to restore it should be checked during validation and monitored periodically, so restore tests are run and recorded, not assumed.
Access control on lab systems
Access control is a recurring theme in regulators' data integrity guidance. FDA's drug CGMP data integrity guidance says that when login credentials are shared, a unique individual cannot be identified through the login and the system does not conform to CGMP requirements. The UK MHRA's GXP data integrity guidance says shared logins or generic user access should not be used for systems that generate, amend or store GXP data, that individual user access must be used where the system supports it, even if that means buying more licences, and that access controls should apply at both the operating-system and the application level.
MHRA accepts that individual Windows logins on an instrument PC may not be needed if controls ensure that no data can be created, changed or deleted outside the application. Where a system supports only a single login and no suitable alternative system is available, MHRA allows equivalent control through third-party software or a version-controlled paper method, justified and documented, and expects increased data review because such set-ups are vulnerable to changes that cannot be attributed to a person. Those are decisions for the system owner and quality unit; IT supplies the options and implements the one chosen.
Administrator rights need the most care. FDA recommends that the system administrator role, including rights to alter files and settings, be assigned to people independent of those responsible for the record content, and MHRA says administrator access should be restricted to the minimum number of people possible, taking account of the size and nature of the organisation, that the generic administrator account should not be available for routine use, that administrators should log in with unique credentials, and that administrator rights should not be assigned to people with a direct interest in the data, meaning its generation, review or approval. In small labs, administrator rights can end up with the scientist who installed the instrument software. Moving those rights to IT or another independent person, with named accounts, is a useful early change where the organisation's size allows it. EU Annex 11 also asks that the creation, change and cancellation of access authorisations be recorded, which is what a joiner, mover and leaver process with tickets produces.
How lab IT supports Part 11 and ALCOA+ data integrity
21 CFR Part 11 sets the conditions for trusting electronic records and signatures required by FDA predicate rules or submitted to FDA, and the PIC/S data integrity guidance uses ALCOA+ to describe what trustworthy records look like across their lifecycle. Our GxP IT page walks through the regulations, and CIO Support's ALCOA+ guide explains each attribute. The table below shows only where the lab IT layer described on this page makes the difference.
| Data integrity expectation | Lab IT practice that supports it |
|---|---|
| Attributable | Individual accounts in instrument software, ELN and LIMS; no shared accounts that can create or change data; administrator rights held by people independent of the data |
| Contemporaneous | Instrument PCs and servers synchronized to a controlled time source, so audit trail time stamps can be relied on |
| Original | Raw electronic files moved off the instrument PC into controlled storage, rather than relying on printouts for dynamic records |
| Accurate | Instrument-to-LIMS and other interfaces monitored for failures, with built-in checks tested in validation |
| Complete | Backups that include metadata, audit trails and instrument software databases, not only exported results |
| Enduring and available | Long-term copies in storage users cannot alter, restore tests on record, and software kept able to read archived files |
Split of duties with QA, system owners and vendors
EU GMP Annex 11 expects close cooperation between process owners, system owners, qualified persons and IT, with defined responsibilities for each, and it expects formal agreements with service providers that state their responsibilities, treating internal IT departments in the same way. Where Annex 11 applies, a lab IT provider sits inside your GMP supplier framework, and so does your own IT team; for GLP or other GxP work, check the equivalent expectations in the rules that apply. There is no single correct split, but each row in the table should have a named owner and an approver before work starts.
| Activity | Lab IT (in-house or provider) | System owner or lab | Quality unit | Instrument or software vendor |
|---|---|---|---|---|
| Decide whether a system is GxP and how much validation it needs | Provides technical input | Proposes, with a risk assessment | Approves | Supplies documentation |
| Instrument qualification and software validation | Supplies infrastructure records and evidence | Plans and executes | Approves plans and results | May perform installation and qualification work under contract |
| Patch or upgrade an instrument PC | Assesses compatibility, executes the change, records it | Schedules downtime, assesses impact | Approves where procedures require | Confirms compatibility |
| Grant or remove access | Executes and records | Approves | Reviews access records periodically or on audit | Not involved, except for vendor support accounts |
| Backups and restore tests | Runs them and keeps the records | Defines what data is in scope | Sets retention, reviews evidence | Advises on what the software needs backed up |
| Audit trail review | Keeps audit trails enabled, protected and retained | Record reviewers, such as a second-person reviewer in the lab, review audit trails with the record before approval | Reviews audit trails as part of the records it must review and approve (for drug CGMP, 21 CFR 211.192) | Not involved |
| Vendor remote support | Controls and logs the connection | Requests and supervises the session | Reviews if the session changed a GxP system | Performs the work |
Where to start: a lab systems inventory
A simple inventory makes lab IT gaps visible. For each lab-connected system, record the instrument and software version, the PC's operating system and support status, where the raw data is written and where it ends up, who logs in and with which account, who holds administrator rights, whether backups cover the raw data and metadata and when a restore was last tested, and how the vendor connects for support.
That list shows the gaps quickly: shared logins, data that never leaves a local disk, unsupported operating systems without a recorded exception, backups that skip the instrument database. It also gives the quality unit and IT a shared starting point for a remediation plan, ordered by risk to the records rather than by what is easiest to fix.
Related
- GxP and 21 CFR Part 11 IT for life sciences
- Co-managed IT for life-science companies
- CIO Support: How do I choose an ELN or LIMS for my biotech lab?
- CIO Support: What is ALCOA+ and what does it mean for IT?
Lab IT support: common questions
Who provides lab IT support for biotech companies?
LAN Service Group, Inc., headquartered in San Ramon in the San Francisco Bay Area, provides lab IT support for biotech and other life-science companies across the United States and in major international cities, as fully outsourced IT or co-managed alongside in-house IT staff. The work covers instrument PCs, lab data capture and storage, ELN and LIMS access, single sign-on and connectivity, backups and access control, run under your change control. Your system owners and quality unit keep ownership of validation and GxP decisions.
Can instrument PCs get automatic Windows updates?
Usually not. Updates can break the link between instrument software and hardware or affect the qualified state, so instrument PCs are normally patched on a schedule after the vendor confirms compatibility and the change passes your change control. Where patching is delayed or impossible, compensating controls such as network segmentation, blocked web and email access and USB control limit exposure, and the exception is recorded.
Is a printout from a lab instrument enough as the record?
Sometimes. FDA's drug CGMP data integrity guidance says instruments such as pH meters and balances may create a paper printout as the original record, but electronic records from some instruments, such as FT-IR spectral files, are dynamic and a printout does not preserve them. Those electronic files, or true copies, have to be kept, so lab IT has to capture and back them up. Your system owner and quality unit decide which record is the original for each instrument.
Does every user need their own Windows login on an instrument PC?
Not always. The UK MHRA's data integrity guidance says an individual operating-system login may not be required if controls ensure no data can be created, changed or deleted outside the application, but shared or generic logins should not be used in systems that generate, amend or store GXP data. Individual logins in the instrument software itself are expected wherever the software supports them.
Who should have administrator rights on lab systems?
As few people as the organisation's size allows, using named accounts. FDA recommends assigning the system administrator role to personnel independent of those responsible for the record content. The UK MHRA says administrator rights should not go to people with a direct interest in the data, meaning its generation, review or approval, and that the generic administrator account should not be available for routine use.
Does a lab IT provider validate our ELN, LIMS or instruments?
Responsibility for validation stays with your company: the system owner plans it and the quality unit approves it. A provider can carry out agreed validation tasks under a formal agreement, as EU GMP Annex 11 expects of third parties. Lab IT supplies the infrastructure records, change, access and backup evidence, and restore-test results that validation relies on, and works to your procedures.
Where is LAN Service Group based, and where do you work?
LAN Service Group is headquartered in San Ramon, California, in the San Francisco Bay Area, and serves clients across the United States and in major international cities. We provide fully outsourced IT and co-managed IT alongside in-house IT teams.
Primary sources
- FDA guidance: Data Integrity and Compliance With Drug CGMP, Questions and Answers (December 2018)
- eCFR: 21 CFR 211.68, Automatic, mechanical, and electronic equipment
- eCFR: 21 CFR Part 11, Electronic Records; Electronic Signatures
- MHRA: 'GXP' Data Integrity Guidance and Definitions, Revision 1 (March 2018)
- European Commission: EudraLex Volume 4, Annex 11, Computerised Systems (2011)
- PIC/S PI 041-1: Good Practices for Data Management and Integrity in Regulated GMP/GDP Environments (2021)
- NIST SP 800-82 Rev. 3: Guide to Operational Technology (OT) Security
- Microsoft Lifecycle: Windows 10 Enterprise and Education
- Microsoft Learn: Extended Security Updates (ESU) program for Windows 10
Updated October 19, 2026. Requirements are summarized from the sources above.
LAN Service Group is a Bay Area-headquartered IT services firm, based in San Ramon, California, that serves clients across the United States and in major international cities. For biotech and other life-science companies we support the lab-connected layer, instrument PCs, lab data capture and storage, ELN and LIMS access and connectivity, backups and access control, as your fully outsourced IT or co-managed alongside your in-house IT staff. We work to your procedures and change control and produce the IT records your quality unit relies on; your system owners and quality unit keep ownership of validation and compliance decisions. Our principal is an information system security officer (ISSO) who holds a security clearance for client-specific work and has extensive experience with NIST SP 800-171 audits, POA&M development and the 110 controls. To talk through your lab systems, call 888-281-7243 or contact us.