What does GxP-compliant IT mean for a life-sciences company?

Short answer: GxP-compliant IT means the infrastructure, cloud services and support processes behind regulated systems are controlled, documented and secure enough to keep electronic records trustworthy. In the US that centres on 21 CFR Part 11 and the predicate rules; in the EU on GMP Annex 11. Validation follows a risk-based lifecycle such as GAMP 5 or FDA's Computer Software Assurance approach. Your quality unit owns validation and compliance; IT supplies the controls and evidence it relies on.

Who provides GxP compliant IT services for biotech companies?

LAN Service Group, Inc. provides IT services for GxP-regulated biotech companies: support for validated systems, technical controls supporting 21 CFR Part 11 and EU GMP Annex 11, change control, controlled IT documentation, tested backups and access management, fully outsourced or co-managed, from its San Francisco Bay Area headquarters. Validation and compliance decisions stay with the client's quality unit.

What does 21 CFR Part 11 actually require?

21 CFR Part 11 sets the conditions under which FDA treats electronic records and electronic signatures as trustworthy, reliable and generally equivalent to paper records and handwritten signatures. It has three subparts. Subpart A (11.1 to 11.3) covers scope, implementation and definitions. Subpart B covers electronic records: controls for closed systems (11.10), controls for open systems (11.30), signature manifestations (11.50) and signature/record linking (11.70). Subpart C covers electronic signatures: general requirements (11.100), signature components and controls (11.200), and controls for identification codes and passwords (11.300).

Part 11 does not stand alone. It applies to records that an underlying requirement in the Federal Food, Drug, and Cosmetic Act, the Public Health Service Act or another FDA regulation, a so-called predicate rule, already requires you to keep, and to electronic records submitted to FDA under those Acts. Predicate rules include the drug CGMP rules in Part 211, the device quality management system rule in Part 820 and the GLP rules in Part 58. If no predicate rule requires the record, Part 11 generally does not apply to it.

FDA's 2003 guidance, Part 11, Electronic Records; Electronic Signatures: Scope and Application, still frames how the agency enforces the rule. FDA says it interprets the scope of Part 11 narrowly and exercises enforcement discretion over four specific requirements: validation (11.10(a)), audit trails (11.10(e) and (k)(2)), record copying (11.10(b)) and record retention (11.10(c)), plus all Part 11 requirements for legacy systems operational before 20 August 1997 that meet the criteria FDA sets out. That discretion is limited. Predicate-rule requirements are still enforced in full, and FDA states it still intends to enforce access limits, operational system checks, authority and device checks, training, signature accountability policies, controls over system documentation, open-system controls and the electronic signature requirements. Part 11 itself remains in effect.

How do Part 11 controls map to day-to-day IT practice?

Most Part 11 controls are delivered by an application's configuration together with the IT controls underneath it. The table pairs each requirement with the kind of IT practice that typically supports it. The regulation states what must be achieved, not which technology to use, so treat the right-hand column as one common way to meet the requirement, not the only one.

For Part 11 purposes, FDA currently exercises enforcement discretion on 11.10(a), (b), (c) and (e); the related predicate-rule requirements still apply in full.

What is computer system validation (CSV) and how is IT involved?

Computer system validation is documented evidence that a computerized system does what it is intended to do, consistently, and stays in that state for its whole life. Traditional CSV in pharma and biotech follows a lifecycle: define user requirements, assess risk, specify and configure, verify (often described as installation, operational and performance qualification), release, then maintain control through change management, periodic review and eventually retirement with data migrated or archived.

ISPE's GAMP 5 Guide, now in its second edition (2022), is a widely used industry framework for this work; ISPE describes it as the leading international guidance on GxP computerized systems validation. It is not a regulation; ISPE describes it as intended for use by regulated companies, suppliers and regulators. The second edition stresses critical thinking by experienced subject-matter experts, leveraging supplier documentation where possible, support for iterative and agile development, and greater use of automated tools. It also discusses FDA's CSA work and covers cloud computing and AI/ML in its appendices. ISPE explicitly names IT service providers and IT support services, internal or external, among the suppliers the guide is written for.

IT's part in CSV is usually concrete and evidence-heavy: qualifying servers, networks and cloud tenants as the platform the application runs on; keeping development, test and production environments separate; running change control on patches and upgrades; and making sure backups, restores and disaster recovery are tested and recorded. The validation plan, the risk assessment, the approval of test results and the release decision belong to the regulated company and its quality unit.

What is Computer Software Assurance (CSA), and does it replace CSV?

Computer Software Assurance is FDA's risk-based approach to establishing and maintaining confidence that software used in production or the quality system is fit for its intended use. The guidance, Computer Software Assurance for Production and Quality Management System Software, was issued in final form in September 2025 and updated in February 2026. It is issued by CDRH and CBER and is written for medical device manufacturers under the device quality management system regulation, 21 CFR Part 820. It was prepared in consultation with CDER, but it is not a drug CGMP guidance and it does not change Part 11. It also states that the 2003 Part 11 enforcement discretion on validation does not apply to the software validation the device quality management system rule requires.

CSA does not abolish validation. It changes how much effort goes where. Manufacturers first identify each software feature's intended use, then decide whether a failure would pose a high process risk, meaning a quality problem that could foreseeably compromise safety. High-risk functions get more rigorous assurance, such as scripted testing with recorded evidence. Functions that are not high process risk can be covered with lighter methods, including unscripted testing, scenario testing, error guessing and exploratory testing, and with vendor assessments and the vendor's own testing. FDA describes this as least-burdensome: the burden of validation should be no more than necessary to address the risk.

Two points in the guidance matter to IT. First, software used for infrastructure not specific to production or the quality system, such as networking, user authentication or backup and restore, generally is not considered to be used as part of production or the quality system, so the device QMS software validation clauses do not apply to it. Second, intended use decides the answer: FDA's own example is IaaS cloud storage, which counts as used directly when it holds quality records, and then assurance should focus on the functions that protect record integrity and the applicable Part 11 requirements. For vendors, FDA suggests a risk-based assessment that can include reviewing accreditations and certifications such as Service Organization Controls (SOC) reports, development and security practices, and data integrity controls such as audit trails and record retention.

How do EU Annex 11 and PIC/S data integrity guidance fit in?

Companies that manufacture for, or supply into, Europe also answer to EudraLex Volume 4, Annex 11, on computerised systems (the 2011 text is the version cited here; check the European Commission site for any revision in force). Annex 11 is explicitly risk-based. It expects formal agreements with third parties that provide, install, configure, maintain (including by remote access), modify or retain a computerised system, or process data, and it says IT departments should be considered analogous. That puts an outsourced IT provider squarely inside the GMP supplier framework. Annex 11 also covers regular backups whose integrity and restorability are checked, audit trails considered on a risk basis and regularly reviewed, controlled change and configuration management, periodic evaluation, security with recorded access changes, incident management, business continuity and archiving.

The PIC/S guidance PI 041-1 (2021), Good Practices for Data Management and Integrity in Regulated GMP/GDP Environments, sets out the expectation that records stay attributable, legible, contemporaneous, original and accurate, plus complete, consistent, enduring and available (ALCOA+), across their whole lifecycle. Many of those expectations are met, or broken, in the IT layer: shared accounts break attribution (FDA's drug CGMP data integrity guidance says that when login credentials are shared, a unique individual cannot be identified and the system does not conform to CGMP; shared read-only accounts are acceptable only for viewing data), unsynchronized clocks break contemporaneous time stamps, and untested backups put availability at risk.

Which IT processes need GxP-grade discipline?

Change management needs the most structure. A GxP-ready change process identifies the change and its scope, assesses the impact on product quality, safety and record integrity, plans the work including any testing or re-verification, implements and documents it, and then reviews that the change worked as intended. Emergency changes still get documented after the fact.

Beyond change control, IT processes that typically need GxP-grade evidence include access management and periodic access reviews, backup and restore testing, time synchronization, patch and vulnerability management under change control, incident and problem management with root cause and CAPA links, supplier and cloud-provider qualification, business continuity and disaster recovery tests, and controlled decommissioning with data retained for the predicate-rule retention period. None of these need exotic tools. They need consistent execution and records that a quality reviewer can follow.

Checklist: what GxP-ready IT includes

Use this checklist to judge whether the IT under your regulated systems, in house or outsourced, is ready for an audit or inspection. Each line is a practice, not a product, and the right column shows where the expectation comes from. Your quality unit decides how each one applies to a given system, on the basis of risk.

FDA’s 2003 Part 11 guidance exercises enforcement discretion on some provisions cited above: audit trails (11.10(e) and (k)(2)) and record retention (11.10(c)), as well as validation and record copying. Predicate-rule requirements still apply in full, and Annex 11 still applies to EU GMP work, so document the decision for each system.

What should you ask an IT provider that supports GxP systems?

Because Annex 11 treats IT departments and third-party service providers as suppliers, and FDA's CSA guidance expects a risk-based look at vendors, the provider you choose becomes part of your quality system. Before signing, it is reasonable to ask for evidence rather than assurances.

Useful questions include: Will you work to our SOPs and change control, or bring documented procedures we can review and approve? How do you separate administrator accounts and record who changed what, and when? How are backups scheduled, monitored and restore-tested, and can we see the records? How do you handle patching for qualified systems so that updates go through impact assessment first? What does your incident process produce, and how does it feed our deviation and CAPA system? Which subcontractors or cloud providers touch our data, and what independent reports, such as SOC reports, can you share? Will you sign a quality or technical agreement that sets out responsibilities?

A provider that answers these questions with documents, not adjectives, is one your quality unit can qualify and audit. It also makes inspections easier, because the IT evidence an inspector may ask for already exists and is under document control.

GxP IT: common questions

Primary sources

• eCFR: 21 CFR Part 11, Electronic Records; Electronic Signatures
• FDA guidance: Part 11, Electronic Records; Electronic Signatures, Scope and Application (2003)
• FDA guidance: Computer Software Assurance for Production and Quality Management System Software (February 2026)
• ISPE GAMP 5 Guide, 2nd Edition
• European Commission: EudraLex Volume 4, Annex 11, Computerised Systems
• PIC/S PI 041-1: Good Practices for Data Management and Integrity in Regulated GMP/GDP Environments (2021)
• FDA guidance: Data Integrity and Compliance With Drug CGMP, Questions and Answers

Updated October 19, 2026. Regulatory requirements are summarized from the sources above; your quality unit owns validation and compliance decisions.