GxP (GMP/GLP/GCP)

Good Practice guidelines for regulated life-sciences - traceability, validation, change control, data integrity.


Short name	GxP
Region	International
Country or scope	International
Sector	Healthcare
In your workspace	On unless you switch it off in Compliance › Manage.

How Safeguard covers GxP

Scan requirements: 7, all decided by a scan.
Controls: the scan requirements below, plus 12 controls from Safeguard's control catalog for GxP.
Automated tests: none map to it directly. You can link any automated test to its controls yourself (how).
Policy templates: 26: 4 written for GxP and 22 from the standard set.

How each kind of coverage works, and what the readiness score counts: Compliance frameworks.

What a scan checks

Each scan of a product checks these 7 requirements against what the scan found, including the product's software inventory (SBOM).

Requirement	What Safeguard checks	Decided by
`GXP-A11-4` Computerised System Validation and Inventory	Computerised systems used in GMP activities must be validated across their lifecycle, and an up-to-date listing of relevant systems and their GMP functionality must be available; an enumerated software component inventory is the direct fulfilment of that listing duty (EU GMP Annex 11, clause 4)	Scan
`GXP-A11-3` Supplier and Service Provider Qualification	When third parties supply, install, configure or maintain computerised systems, formal agreements and supplier assessment are required; each third-party software component should therefore be attributable to a named supplier (EU GMP Annex 11, clause 3)	Scan
`GXP-A11-9` Audit Trail Anchoring	Systems should record GMP-relevant changes and deletions in secure, time-stamped audit trails; the system's own documentation must carry document identity and creation timestamps to anchor that traceability (EU GMP Annex 11, clause 9)	Scan
`GXP-A11-10` Change and Configuration Management	Changes to computerised systems must follow a defined change- and configuration-management procedure; indeterminate component versions (latest, wildcards, ranges) defeat controlled configuration management (EU GMP Annex 11, clause 10)	Scan
`GXP-A11-12` Security of Computerised Systems	Physical and logical controls must restrict system access to authorised persons and protect data from damage; cryptographic integrity evidence for deployed software components demonstrates protection against unauthorised alteration (EU GMP Annex 11, clause 12)	Scan
`GXP-ALCOA` ALCOA+ Attributability	GxP data integrity requires records to be attributable, legible, contemporaneous, original and accurate; for system records this means the creating tool or organisation must itself be recorded (FDA Data Integrity and Compliance with Drug CGMP guidance, ALCOA principles)	Scan
`GXP-CFR-211-68` Automated Equipment Software Control	Automatic and electronic equipment used in drug manufacture must be routinely calibrated and checked per a written program, with input/output verification and controlled backup; that control regime presumes the exact versions of the operating software are recorded (21 CFR § 211.68)	Scan

More controls in the catalog

The framework's Controls tab lists its scan requirements and these controls from Safeguard's control catalog. Evidence them with automated tests, uploaded evidence, policies or an attestation.

Control	Name
`GXP-DI-01`	ALCOA+ Data Integrity Principles
`GXP-DI-02`	Data Integrity Risk Assessment
`GXP-VAL-01`	User Requirements Specification (URS)
`GXP-VAL-02`	Installation Qualification (IQ)
`GXP-VAL-03`	Operational Qualification (OQ)
`GXP-VAL-04`	Performance Qualification (PQ)
`GXP-CC-01`	Change Control System
`GXP-CAPA-01`	Deviation & CAPA Management
`GXP-TR-01`	GxP Training Requirements
`GXP-SOP-01`	Standard Operating Procedures
`GXP-AUD-01`	GxP Audit Trail Requirements
`GXP-CS-01`	Computer System Validation (CSV)

Policy templates

Written for GxP:

Validation Master Plan (VMP)
Data Integrity Policy: GxP (ALCOA+)
Change Control & CAPA Procedure: GxP
GxP Training Requirements Procedure

And 22 from the standard set, adapted to GxP.