Data Center Audit


Quite Involved in Discussions
Hi :bigwave:
I was been assigned to audit our data center. What are the things that I need to check and verify compliance? :confused: Do I have to work on security? :frust: With regards to networking, can i audit the design of the LAN? :confused:

Thanks in advance.
Best regards,
Raffy :cool:
Elsmar Forum Sponsor
Hi Raffy,

There is a lot to dig in to: This is just what came to mind right away…

Doc requirements, and in particular control of records: Backup, Virus protection and firewalls, Access rules… 4.2. Security

Objectives. 5.4.1.

Who is responsible for the operation of systems and applications? 5.5.1.

Competence and training. 6.2.2.

Infrastructure. 6.3. Design of the LAN

Purchasing. (Software, hardware, services) 7.4.

Validation of applications they put together. 7.5.2.

Customers property (Mainly information) 7.5.4. Security

Monitoring of the systems. 8.2.3

Analysis of system performance, and actions taken as a result 8.4, 8.5.

Improvement 8.5.2.

I hope that'll keep you happy for a while?

Atul Khandekar said:

Does that include standard apps they buy?
Hi Atul,

Now there's a good question. If the application is part of your process and you can't verify the results later, I'd say yes... Didn't think about that.

You'll somehow have to make certain that the application interacts with the rest of the process in the intended way. It's no different from when you buy a machine and hook it up in a production line...

Other opinions?


Atul Khandekar

Quite Involved in Discussions
Thanx Claes.
A company may have any/all of the following:
- Number of MS Office and CAD installations
- Some ERP software such as SAP
- Company-wide intranet / Knowledge Management System / LotusNotes
- One or just a few seats each of many smaller software pakages (eg. Calibration Management System)
It would be a daunting task validating these things! How does one go about it?

Well Atul,

I'm skating on thin ice here. (Honestly, just trying to get a grip on this myself - please, someone grab me if I'm heading for open water).

In the examples you mentioned I'd think it's a simple (is it?) matter of installing the stuff and see if it works. Then, as long as nothing is altered I guess the validation would stay valid?

What I was thinking of was something like software for running production machinery or something similar... I suppose the only way to validate that would be to systematically put the relevant commands through it and see if you get the intended reaction in the other end.

More opinions anyone?


Vash Stampede

We'll I think I may add some audit stuffs that you might want to look at:
computer hardware inventory list?
multiple network interfaces in windows or in linux (as its operating system)?
disaster recovery plan? (as in how would they recovered lost files)



Quite Involved in Discussions
Hi Claes,
Thank you for adding up, its great to have your answers to the questions... :cool:
I had some follow-up questions:
Is a machine history needed for each workstations? How about an OCAP (Out-of-Control-Activity Plan)? Can I require them with using the clause under Continuous Improvement? How about FMEA?

Thanks and best regards,
Awwwww... :eek: (blushing). I bet you say that to all computer freaks ;) Thank's Raffy.

Just be sure to note that I'm thinking this through as I'm answering, thereby without a doubt missing things... I'll be using this stuff myself next time I audit our computer jockeys. A discussion here is good for the old creativity.


Machine history for each work station? I wouldn't know. That must depend on what your local procedures say.

OCAP? That could certainly fall under preventive action, and if you keep it updated, for instance by using FMEA it should prove useful for continual improvement too (You could improve what's possible to improve and stuff the impossible into the contingency plan.). As before it's down to what your procedures say, but losing your network even temporarily could be disastrous, so a contingency plan would be a good idea for anyone. I think it should fall under clause 4.2.

Thread starter Similar threads Forum Replies Date
A What are Practical data center best practices IEC 27001 - Information Security Management Systems (ISMS) 0
M Informational US – National Evaluation System for Health Technology Coordinating Center (NESTcc) Solicits Public Comments for Data Quality and Methods Frameworks Medical Device and FDA Regulations and Standards News 0
P Conference Table power-data center Lean in Manufacturing and Service Industries 2
DuncanGibbons Technical Data Package vs Digital Product Definition APQP and PPAP 0
Z Putting back excluded rows/data points in a control chart Using Minitab Software 0
F General Data Protection Regulation (GDRP) CE Marking (Conformité Européene) / CB Scheme 6
Z Minitab - Updating Graph with specific data points Using Minitab Software 2
E PEMS Hazards - IEC 60601 Clause 14.6 - Internal data use - Pressure sensor IEC 60601 - Medical Electrical Equipment Safety Standards Series 3
K Transform variable data into attribute data Reliability Analysis - Predictions, Testing and Standards 24
R Clinical evaluation without clinical data - MDR Article 61(10) EU Medical Device Regulations 6
H Capability Data for Paint Thickness on Painted Parts Statistical Analysis Tools, Techniques and SPC 10
D BS EN 62304 - Medical-Relevant Data C.5 - Definition of IEC 62304 - Medical Device Software Life Cycle Processes 5
T Submitting MR Compatibility Data for 510(k) Cleared Device Other Medical Device and Orthopedic Related Topics 2
S Quality manager considering data science Quality Manager and Management Related Issues 19
U Do we need clinical trial data for Class IIa medical device under MDR EU Medical Device Regulations 7
S Average and standard deviation of Cumulative Data Statistical Analysis Tools, Techniques and SPC 5
V IS/ISO/IEC 17025:2017 Clause 7, sub clause 7.11 Control of data and information management ISO 17025 related Discussions 1
Watchcat CERs Literature Databases - Searching for data to evaluate EU Medical Device Regulations 16
D Transformation of Data Normality Failed Using Minitab Software 11
J Sample size for creating a data base as a reference to a tested variable Other Medical Device and Orthopedic Related Topics 6
M GUDID data deficiency communication - IS THIS A SCAM? ISO 13485:2016 - Medical Device Quality Management Systems 29
H Question about implications of performing Firmware upgrade via MDDS - Medical Device Data Systems 21 CFR Part 820 - US FDA Quality System Regulations (QSR) 2
R Demonstrate how sufficient levels of access to data is achieved - Claims of equivalence EU Medical Device Regulations 3
R Material safety data sheet (MSDS) related clause in IATF 16949 manual IATF 16949 - Automotive Quality Systems Standard 17
CPhelan Using clinical trial safety data for evidence for CE marking EU Medical Device Regulations 7
M Informational US FDA – MDR Data Files – Alternative Summary Report Data Since 1999 Available Medical Device and FDA Regulations and Standards News 0
CPhelan Do you require MDSAP for CE Marking of a Medical Device or is ISO13485:2016 with clinical data sufficient? CE Marking (Conformité Européene) / CB Scheme 5
M Data analysis Design of Experiments Using Minitab Software 3
S Seeking efficient method to manage install base data Manufacturing and Related Processes 0
V Every good documentation practice observation is an data integrity issue US Food and Drug Administration (FDA) 7
M Informational Eudamed Data Exchange Guidelines Medical Device and FDA Regulations and Standards News 0
M Informational EU – Eudamed Data exchange services and entity models introductions Medical Device and FDA Regulations and Standards News 4
M Informational EU – M2M Data Exchange available services for accessing MDR EUDAMED data available for Economic Operator (EO) organisations Medical Device and FDA Regulations and Standards News 0
V What is the criteria to cite an good documentation practices observation as an data integrity related issue US Food and Drug Administration (FDA) 6
D Do we need normal data for gage r&r studies? Gage R&R (GR&R) and MSA (Measurement Systems Analysis) 5
M Automatic Data Gathering Requirements and Privacy Implications Medical Information Technology, Medical Software and Health Informatics 0
R Over read of physiological data by technicians EU Medical Device Regulations 0
L How to evaluate the process capability of a data set that is non-normal (cannot be transformed and does not fit any known distribution)? Capability, Accuracy and Stability - Processes, Machines, etc. 12
M Informational EU – EUDAMED UDI Device Data Dictionary + data sets Medical Device and FDA Regulations and Standards News 0
F Mig Welded Components - IMDS International Material Data System RoHS, REACH, ELV, IMDS and Restricted Substances 1
L SPC - Methods to collect data IATF 16949 - Automotive Quality Systems Standard 7
M Informational MDCG 2019-4 Timelines for registration of device data elements in EUDAMED Medical Device and FDA Regulations and Standards News 0
M Informational FDA Panel: Too early to pull textured breast implants over cancer risk, need more data Medical Device and FDA Regulations and Standards News 0
M Informational Health Canada begins release of clinical data Medical Device and FDA Regulations and Standards News 0
M (How To) Getting Data From Vision Machine To Reporting Software Misc. Quality Assurance and Business Systems Related Topics 0
S Minitab - Factor Analysis: Label on second series of data for Biplot Using Minitab Software 4
J ISO 13485 8.4 Analysis of Data - Procedure example ISO 13485:2016 - Medical Device Quality Management Systems 1
MrTetris GDPR - Purposes and duration of data collection Other ISO and International Standards and European Regulations 8
MrTetris GDPR - General Data Protection Regulation - Only applicable to EU data? Other ISO and International Standards and European Regulations 6
M Informational USFDA Final Rule – Human Subject Protection; Acceptance of Data From Clinical Investigations for Medical Devices Medical Device and FDA Regulations and Standards News 0

Similar threads

Top Bottom