Records that hold up in an inspection
In life sciences it is not enough that your IT is secure. You have to be able to show it. We build and run IT so that changes, access rights and backups can be traced at any time, and we deliver the technical evidence your quality team and validation partner need.
When you keep records that FDA rules require in electronic form, or sign them electronically, Part 11 applies. It calls for validated systems, secure computer-generated audit trails, limited system access, authority checks and controls over system documentation. Much of this is set up in the IT layer underneath your applications.
FDA expects data to be attributable, legible, contemporaneous, original and accurate, and industry adds complete, consistent, enduring and available. For IT this means every user has a personal account, clocks are synchronized, records cannot be changed without a trace and data comes back after a failure.
A patch that is routine elsewhere can trigger a change assessment or requalification in a GxP environment. Updates to validated systems must be planned with your quality team and must not run on their own. At the same time the rest of the network still needs current patches.
Since February 2, 2026, FDA's Quality Management System Regulation in 21 CFR Part 820 incorporates ISO 13485:2016 by reference. Device manufacturers have to control records, software used in the quality system and changes in line with that standard. The environment where you develop, test and document your products should be secured to the same level.
What we do not do: computerized system validation in the regulatory sense, validation sign-off and quality decisions. Validation and release remain the responsibility of your quality unit and your validation partner. We provide the qualified IT foundation and the technical documentation they build on.
We took over the entire IT, redefined its direction and continue to develop it in close coordination with management.
Result: A fully automated environment designed for security and regulatory requirements, with separate admin and user accounts and a secure VPN between the sites in Germany and abroad.
In this industry the standard for IT does not depend on company size. Five users also need traceable access rights and a tested restore.
FAQ
Part 11 sets rules for electronic records and electronic signatures that FDA regulations require. For closed systems it calls for validation, accurate copies of records, protection of records for their retention period, access limited to authorized people, secure time-stamped audit trails, authority checks and control over system documentation. The IT foundation supports many of these points with personal accounts, role-based access, central logging, time synchronization and tested backups.
No. FDA's guidance on the scope of Part 11 says it applies to records that FDA regulations, the so-called predicate rules, require you to keep or submit in electronic form. Your quality unit decides which systems hold such records. We help by documenting where the data lives and how it is protected.
You do, usually with a specialized validation partner. Validation and release are the responsibility of the regulated company and its quality unit. We provide the IT side: documented infrastructure, controlled changes and technical information the validation team needs for its plans and test scripts.
Since February 2, 2026, FDA's Quality Management System Regulation aligns 21 CFR Part 820 with ISO 13485:2016. For IT this mainly affects document and record control, the validation of software used in the quality system and change control. We set up the infrastructure so that these controls can be applied and proven.
There is no GxP certificate for IT providers. What counts in an inspection is whether your systems are controlled and documented. We work with documented processes for changes, access and backups and deliver the evidence your quality team needs.
Yes, that is the usual setup. The validation partner owns the validation approach and documentation, and we provide technical details, system descriptions and test support for the infrastructure. Clear responsibilities keep the project on schedule.
Yes. One of our clients is a pharma research company with five users. Regulators apply the same expectations to small companies, so traceable access rights and a tested restore matter at any size. Ongoing managed IT starts at 5 users.
We support the IT around them: networks, workstations, accounts, backups and secure remote access for vendors. The lab instruments and their software stay with the manufacturer, and we coordinate updates with them and with your quality team.
Life sciences and pharma
Tell us where you stand and which inspection or audit is coming up next. We will tell you openly whether and how we can support you.
