--- title: What’s in the FDA draft guidance on Computer Software Assurance (CSA)? description: "Take a look at what's inside the FDA's new draft guidance: Computer Software Assurance for Production and Quality System Software." image: https://blog.montrium.com/hubfs/COMPUTER.png --- [![Montrium\_Logo\_smaller](https://blog.montrium.com/hs-fs/hubfs/montrium-2023/images/logo/Montrium_Logo_smaller.png?width=130&height=32&name=Montrium_Logo_smaller.png "Montrium_Logo_smaller")](https://www.montrium.com/) ← - Products Close ## Book a live demo Schedule a demo with a representative. - ## Products Our pre-configured applications enable our clients to work better and smarter. ![63f778fbb0527c09d8b57985\_Group](https://blog.montrium.com/hubfs/montrium-2023/images/header/63f778fbb0527c09d8b57985_Group.svg) ## Book on our demo today! Discover & access advanced features Request Demo #### Montrium eTMF - [eTMF Connect](https://www.montrium.com/etmf-connect) - [eTMF Connect features](https://www.montrium.com/etmf-connect-features) #### Platform Overview - [Platform Overview](https://www.montrium.com/platform-overview) - [Trust Center](https://www.montrium.com/trust-center) - [Customers](https://www.montrium.com/customers) - [Platform FAQ](https://www.montrium.com/faq#anchorFaq) #### Montrium RIM - [Regdocs Connect](https://www.montrium.com/regdocs-connect) - [RegDocs Connect Features](https://www.montrium.com/regdocs-connect-features) #### Montrium eQMS - [Quality Connect](https://www.montrium.com/quality-connect) - [Quality Connect features](https://www.montrium.com/regdocs-connect-features) #### Modules - [Document Control](https://www.montrium.com/document-control-software) - [Training Management](https://www.montrium.com/training-management-software) - [CAPA Management](https://www.montrium.com/capa-software) - [Change Control](https://www.montrium.com/change-control-software) - [Pricing](https://www.montrium.com/pricing) - Services Close ## Reach out to our team - ## Services Carefully crafted services delivered by experts ![image21089](https://blog.montrium.com/hs-fs/hubfs/montrium-2023/images/header/image21089.webp?width=233&height=170&name=image21089.webp) ## Looking for additional support? Reach out to our team today Book a consultation #### Adobe Services - [Free Adobe Acrobat Sign validation pack](https://www.montrium.com/adobe-sign-validation-pack) - [Adobe Acrobat Sign validation services](https://www.montrium.com/adobe-sign-validation-services) - Resources Close ## Book a live demo Schedule a demo with a representative. - ## Resources Our pre-configured applications enable our clients to work better and smarter. ![image21088](https://blog.montrium.com/hs-fs/hubfs/montrium-2023/images/header/image21088.webp?width=168&height=162&name=image21088.webp) ## Book on our demo today! Discover & access advanced features Request Demo #### Resources - [Blog](https://blog.montrium.com/blog) - [Webinars](https://www.montrium.com/webinars) - [Podcasts](https://www.montrium.com/podcasts) - [Resources Center](https://www.montrium.com/resource-center) - [Demo Center](https://www.montrium.com/demo-center) - [FAQ](https://www.montrium.com/faq#anchorFaq) - [Customer success stories](https://www.montrium.com/customer-success-stories) - Company Close ## Book a live demo Schedule a demo with a representative. - ## Company Our pre-configured applications enable our clients to work better and smarter. ![image-21087](https://blog.montrium.com/hs-fs/hubfs/montrium-2023/images/header/image-21087.png?width=140&height=170&name=image-21087.png) ## Book on our demo today! Discover & access advanced features Request Demo #### Company - [About](https://www.montrium.com/about) - [Events](https://www.montrium.com/events) - [Newsroom](https://www.montrium.com/newsroom) - [Customers](https://www.montrium.com/customers) - [Careers](https://www.montrium.com/careers) - [Contact Us](https://www.montrium.com/contact-us) #### Partnerships - [Partners](https://www.montrium.com/partners) - [Co-marketing partnerships](https://www.montrium.com/marketing-partners) - [Technology Partners](https://www.montrium.com/technology-partners) - [Services Partners](https://www.montrium.com/service-partners) - [Support](https://support.montrium.com) [Book a demo](https://www.montrium.com/demo) Get in touch Close ## Reach out to our team 0% - [Home](https://blog.montrium.com/) - [Blog](https://blog.montrium.com/blog) - [What’s in the FDA draft guidance on Computer Software Assurance (CSA)?](https://blog.montrium.com/blog/fda-draft-guidance-on-computer-software-assurance-csa) # What’s in the FDA draft guidance on Computer Software Assurance (CSA)? ![Gianna De Rubertis](https://blog.montrium.com/hubfs/gianna%20copy_150x150.png) Written by Gianna De Rubertis Published on October 2022 Topics Validation Quality ![](https://blog.montrium.com/hubfs/COMPUTER.png) [![post-detail](https://blog.montrium.com/hubfs/montrium-2023/images/webinar/icon-plane.svg)](https://telegram.me/share/url?url=https://blog.montrium.com/blog/fda-draft-guidance-on-computer-software-assurance-csa) [![post-detail](https://blog.montrium.com/hubfs/montrium-2023/images/webinar/icon-twitter.svg)](https://twitter.com/share?url=https://blog.montrium.com/blog/fda-draft-guidance-on-computer-software-assurance-csa) [![post-detail](https://blog.montrium.com/hubfs/montrium-2023/images/webinar/icon-messenger.svg)](fb-messenger://share/?link=https://blog.montrium.com/blog/fda-draft-guidance-on-computer-software-assurance-csa) ## Contents The FDA has released a draft guidance document entitled [Computer Software Assurance for Production and Quality System Software](https://www.fda.gov/regulatory-information/search-fda-guidance-documents/computer-software-assurance-production-and-quality-system-software). The FDA believes that the recommendations provided within the guidance will help foster innovation without compromising quality or compliance.  The draft guidance was prepared by the Center for Devices and Radiological Health (CDRH) and the Center for Biologics Evaluation and Research (CBER) in consultation with other offices. It is scoped for computers and automated data processing systems used as part of **medical device production** or the **quality system**. Nonetheless, it is anticipated that this draft guidance will propel all segments of the health and life sciences industry to boost their quality mindset and revisit how they perform computerized system validation.  Here is what we'll be taking a look at: 1. [The proposed Computer Software Assurance framework](https://blog.montrium.com/blog/fda-draft-guidance-on-computer-software-assurance-csa#proposed-computer-software-assurance-framework) 1. [Step A: Identify the intended use](https://blog.montrium.com/blog/fda-draft-guidance-on-computer-software-assurance-csa#identify-intended-use) 2. [Step B: Determine the risk-based approach](https://blog.montrium.com/blog/fda-draft-guidance-on-computer-software-assurance-csa#determine-risk-based-approach) 3. [Step C: Determine the appropriate assurance activities](https://blog.montrium.com/blog/fda-draft-guidance-on-computer-software-assurance-csa#determine-assurance-activities) 4. [Step D: Establish the appropriate record](https://blog.montrium.com/blog/fda-draft-guidance-on-computer-software-assurance-csa#establish-appropriate-record) 2. [Benefits of Computer Software Assurance](https://blog.montrium.com/blog/fda-draft-guidance-on-computer-software-assurance-csa#benefits-of-computer-software-assurance) 3. [What do you think?](https://blog.montrium.com/blog/fda-draft-guidance-on-computer-software-assurance-csa#what-do-you-think) Let's get started! ## The proposed Computer Software Assurance framework From the get-go, this draft guidance puts forth a new buzzword for the industry: Computer Software Assurance, or CSA. It describes a flexible and risk-based approach for evaluating software and establishing confidence (assurance) in the computers and automation used for production or [quality systems](https://blog.montrium.com/blog/10-benefits-quality-management-system-life-sciences) associated with medical devices.   The draft guidance also outlines a framework for how software can be [validated](https://blog.montrium.com/experts/the-truth-about-software-validation-in-the-life-sciences) and how CSA can help maintain the validated state throughout the software lifecycle. Eventually (once it becomes effective), the guidance will replace Section 6 of the “[General Principles of Software Validation](https://www.fda.gov/regulatory-information/search-fda-guidance-documents/general-principles-software-validation)” final guidance (issued in 2002).  Reinforced with practical examples, the draft guidance describes a four-step approach underpinned by [risk-based techniques](https://blog.montrium.com/blog/no-frustration-implementation-why-the-pros-use-risk-based-validation) and testing activities.   ### Step A: Identify the intended use Based on your understanding of how the software will be used, decide if the software even needs to be validated at all. Conduct an assessment of the intended use (and document your decision-making process) to decide whether a software is used **Directly** as part of, or to **Support**, production or the quality system. Such software will need to be validated (*go to Step B*). If a software does not support or is not used as part of production or the quality system, it does not need to be validated. As a software might have more than one intended use, it may be sensible to examine the individual features, functions, and operations to facilitate decision making.  ### Step B: Determine the risk-based approach For software that supports or is part of the production or quality system, conduct an assessment (and document your analysis) to identify factors that may impact or prevent the software from performing as intended. These may be interpreted as **process risks** (could impact the production or quality system) or **medical device risks** (could cause the medical device to cause injury). The assessment should focus on identifying those risks that may result in a quality problem that foreseeably leads to or manifests itself in compromised safety. As the FDA is primarily concerned with the software features, functions, and operations that present the greatest risk, it is recommended to classify the perceived risks in a binary manner – “high risk” vs. “not high risk”. It is then possible to select appropriate Computer Software Assurance activities which are commensurate with the recognized risks (*go to Step C*).  ### Step C: Determine the appropriate assurance activities The rigor of CSA activities, including testing, should be proportionate to the perceived risk. Greater risks generally mean greater rigor (more collection of objective evidence). Conversely, lower risks generally mean less rigor (less collection of objective evidence).  The draft guidance puts a significant focus on testing. Different testing techniques (**Unscripted** vs. **Scripted** testing) can be practiced, and each will yield a different level of objective evidence (*go to Step D*). Suitable type(s) and/or combinations of testing methods should be selected based on the analyzed risk of failure of the software features and functions being tested.   Assurance activities need not be limited to testing, as testing alone is often insufficient to demonstrate fitness for intended use. When figuring out which assurance activities are appropriate, consider whether additional mechanisms are in place to reduce the risk of quality problems (e.g. process controls, use of monitoring tools, procedures, vendor testing activities). These mechanisms can be leveraged to reduce the overall effort invested.  ### Step D: Establish the appropriate record Practicing Computer Software Assurance does not absolve you of the obligation to produce objective (documented) evidence, but it does mean you can adjust the amount of documentation produced to just the right amount (not more, not less) to establish assurance of intended use. Different formats (other than traditional documents) are acceptable, as long as the approach satisfies the content and legal documentation requirements. The documentation needs to show that the software has been assessed, and the objective evidence should be sufficient to demonstrate that the software (as a whole or broken down by specific feature, function, or operation) performs as intended. The record of CSA activities should therefore focus on capturing information related to assurance and should include: intended use, risk prioritization, summary of testing (description of testing, issues found, statement of acceptability of results, traceability to who conducted/reviewed the assessment and when).   ## Benefits of Computer Software Assurance To those familiar with principles of validation for GxP computerized systems, it’s evident that Computer Software Assurance applies a risk-based framework that is reminiscent of [GAMP 5](https://blog.montrium.com/blog/gamp-5-second-edition-what-you-should-know). At Montrium, our system development lifecycle is designed to follow GAMP 5 principles and is consistent with the CSA draft guidelines. Organizations who use [Quality Connect](https://www.montrium.com/quality-management/) can be assured the software was developed and is delivered following best practices.  [![Montrium Quality Connect](https://blog.montrium.com/hs-fs/hubfs/1220803_CTA%20Banner_4_970x100_102921.jpg?width=800&height=82&name=1220803_CTA%20Banner_4_970x100_102921.jpg)](https://www.montrium.com/quality-management/) Being risk-based means that the rigor of activities can be scaled accordingly such that effort does not exceed what is necessary to address the risk. In turn, this results in more efficient and cost-effective use of resources that implicitly yields higher-quality outcomes.  ## What do you think? The draft guidance is currently available for comment purposes only (not for implementation). If you have any comments or suggestions for the FDA, you can [submit them online](https://www.regulations.gov/docket/FDA-2022-D-0795). The FDA will consider comments submitted by November 14, 2022 before issuing the final version of the guidance.  ### Want to stay in the loop about regulatory developments, GxP computerized systems, and much, much more? Subscribe to updates from Montrium and we'll deliver expert analyses right to your inbox 👇 [![Subscribe to updates from Montrium](https://blog.montrium.com/hs-fs/hubfs/4%20-%20CTAs/CTA_%20Montrium%20Subscribe%20to%20Updates.jpg?width=1920&height=1080&name=CTA_%20Montrium%20Subscribe%20to%20Updates.jpg)](https://info.montrium.com/sign-up-to-montrium-blog?hsCtaTracking=d51d0a42-6906-4aa5-afa8-c8253493b098%7C60d26f32-dad4-47f5-84a9-25548aafd2be)   ![Gianna De Rubertis](https://blog.montrium.com/hubfs/gianna%20copy_150x150.png) Gianna De Rubertis Gianna is the Director of the Professional Services team and is responsible for in-house verification projects as well as validation services provided to external clients. She has extensive validation experience, which includes validation of manufacturing equipment, utilities, and computerized systems (including ERP, EDMS, and eSignature solutions). Gianna has also developed a solid understanding of the various regulations which apply to the pharmaceutical, biotech and device industries. ## Get our best content delivered straight to your inbox ![subscribe-top](https://20882350.fs1.hubspotusercontent-na1.net/hubfs/20882350/Montrium-2023/Blog/Images/subscribe-top.svg) ## You may also like [![](https://blog.montrium.com/hubfs/NO-FRUSTRATION%20SOFTWARE%20IMPLEMENTATION%20(1)-1.png) - Validation No-frustration implementation: Why the pros use risk-based validation Read It](https://blog.montrium.com/blog/no-frustration-implementation-why-the-pros-use-risk-based-validation) [![](https://blog.montrium.com/hubfs/The%2013%20most%20common%20questions%20about%20risk-based%20TMF%2c%20answered.png) - Validation - Quality - Regulations & Standards EU GMP Annex 11 update: What changed after 14 years Read It](https://blog.montrium.com/blog/eu-gmp-annex-11-update-changed-14-years) [![](https://blog.montrium.com/hubfs/DG%20Planning%20-%20Adobe%20Sign%20campaign%20-%20Page%201%20(6).jpeg) - Validation The roadmap to validating Adobe Acrobat Sign for 21 CFR Part 11 Read It](https://blog.montrium.com/blog/roadmap-to-validating-adobe-acrobat-sign-for-21-cfr-part-11) [![](https://blog.montrium.com/hubfs/NEW%20(1).png) - Regulations & Standards GAMP® 5 Second Edition: What you should know Read It](https://blog.montrium.com/blog/gamp-5-second-edition-what-you-should-know) [![](https://blog.montrium.com/hubfs/Blog/Prepare-to-be-Onboarded.jpg) - Quality Prepare to be On-boarded: Prepping Your Internal Teams for New SaaS Software Read It](https://blog.montrium.com/blog/prepare-to-be-on-boarded-prepping-your-internal-teams-for-new-saas-software) [![](https://blog.montrium.com/hubfs/Blog/Conducting-Demonstrations.jpg) - RegOps Software Vendor Selection: The Pitfalls and Successes of Vendor Demos Read It](https://blog.montrium.com/blog/software-vendor-selection-conducting-demonstrations) [![](https://blog.montrium.com/hubfs/CTA_Blog_insidemontrium_ideallinkedinsize.jpg) - Trial Master Files Putting the User First: How to Make Life Science Software More Effective Read It](https://blog.montrium.com/blog/how-to-make-life-science-software-more-effective) [![](https://blog.montrium.com/hubfs/Blog/During-Onboarding.jpg) - Quality 5 Essential Steps That Successful Companies Take During SaaS Software Onboarding Read It](https://blog.montrium.com/blog/prepare-to-be-on-boarded-crucial-steps-to-take-during-saas-software-on-boarding) [![](https://blog.montrium.com/hubfs/Blog/Questions_in_Demo.jpg) - RegOps 17 Questions to Ask in a Regulatory EDMS Software Demonstration Read It](https://blog.montrium.com/blog/17-questions-to-ask-in-a-regulatory-edms-software-demonstration) [![](https://blog.montrium.com/hubfs/Montrium%20blog_24_15%20of%20the%20most%20valuable%20features_COVER_1320x580px.webp) - Trial Master Files 15 of the Most Valuable eTMF Software Features Read It](https://blog.montrium.com/blog/etmf-software-features-you-should-be-looking-for) ## Get our best content delivered straight to your inbox [![Montrium\_White\_Logo\_smaller](https://blog.montrium.com/hs-fs/hubfs/montrium-2023/images/logo/Montrium_White_Logo_smaller.png?width=130&height=32&name=Montrium_White_Logo_smaller.png "Montrium_White_Logo_smaller")](https://www.montrium.com/) #### Montrium eTMF - [eTMF Connect](https://www.montrium.com/etmf-connect) - [eTMF Connect features](https://www.montrium.com/etmf-connect-features) #### Montrium RIM - [RegDocs Connect](https://www.montrium.com/regdocs-connect) - [RegDocs Connect features](https://www.montrium.com/regdocs-connect-features) #### Montrium QMS - [Quality Connect](https://www.montrium.com/quality-connect) - [Quality Connect features](https://www.montrium.com/quality-management-software-features) #### Platform overview - [Platform overview](https://www.montrium.com/platform-overview) - [Pricing](https://www.montrium.com/pricing) - [Montrium FAQ](https://www.montrium.com/faq#anchorFaq) - [Trust center](https://www.montrium.com/trust-center) #### Resources - [Demo center](https://www.montrium.com/demo-center) - [Resource center](https://www.montrium.com/resource-center) - [Podcasts](https://www.montrium.com/podcasts) - [Webinars](https://www.montrium.com/webinars) - [Blog](https://blog.montrum.com/blog) #### Montrium by industry - [Non-profit](https://www.montrium.com/montrium-by-industry/non-profit) - [Medical device](https://www.montrium.com/montrium-by-industry/medical-devices) - [CRO](https://www.montrium.com/montrium-by-industry/cros) - [Pharma/Biotech](https://www.montrium.com/montrium-by-industry/pharma-biotech) #### Adobe Acrobat Validation - [Adobe Acrobat validation services](https://www.montrium.com/adobe-sign-validation-services) - [Free Adobe Acrobat validation pack](https://www.montrium.com/adobe-sign-validation-pack) #### Montrium by team - [Clinical operations](https://www.montrium.com/clinical-operations) - [Regulatory affairs](https://www.montrium.com/regulatory-affairs) - [Quality and compliance](https://www.montrium.com/quality-and-compliance) - [IT & security](https://www.montrium.com/it-and-security) #### Company - [About](https://www.montrium.com/about) - [Newsroom](https://www.montrium.com/newsroom) - [Events](https://www.montrium.com/events) #### Contacts 507 Place d'Armes,Suite 1500 Montreal, QC H2Y 2W8,Canada +1.514.223.9153  [info@montrium.com](mailto:info@montrium.com) Montrium Europe SPRL,Boulevard de Waterloo77 1000 Bruxelles, Belgium +32.2.808.3008 [info@montrium.com](mailto:info@montrium.com) #### Socials [Follow us on Facebook](https://twitter.com/Montrium) [Follow us on Instagram](https://www.facebook.com/Montrium/) [Follow us on Instagram](https://www.linkedin.com/company/montrium) Montrium Inc. All rights reserved, 2026 [Terms and Conditions](https://www.montrium.com/terms-conditions) [Privacy Legacy](https://www.montrium.com/privacy-policy) ```json { "@context" : "https://schema.org", "@type" : "BlogPosting", "author" : { "@type" : "Person", "name" : "Gianna De Rubertis", "url" : "https://blog.montrium.com/blog/author/gianna-de-rubertis" }, "dateModified" : "2023-07-31T14:45:04.406Z", "datePublished" : "2022-10-17T16:59:38.000Z", "headline" : "What’s in the FDA draft guidance on Computer Software Assurance (CSA)?", "image" : [ "https://blog.montrium.com/hubfs/COMPUTER.png" ], "mainEntityOfPage" : { "@id" : "https://blog.montrium.com/blog/fda-draft-guidance-on-computer-software-assurance-csa", "@type" : "WebPage" }, "publisher" : { "@type" : "Organization", "logo" : { "@type" : "ImageObject", "url" : "https://blog.montrium.com/hubfs/montrium_logo_2023_gradient.png" }, "name" : "Montrium" } } ``` ```json { "@context" : "https://schema.org", "@id" : "https://blog.montrium.com/blog/fda-draft-guidance-on-computer-software-assurance-csa/#breadcrumbs", "@type" : "BreadcrumbList", "itemListElement" : [ { "@type" : "ListItem", "item" : "https://www.montrium.com", "name" : "Home", "position" : 1 }, { "@type" : "ListItem", "item" : "https://blog.montrium.com/blog", "name" : "Montrium Blog", "position" : 2 }, { "@type" : "ListItem", "item" : "https://blog.montrium.com/blog/fda-draft-guidance-on-computer-software-assurance-csa", "name" : "What’s in the FDA draft guidance on Computer Software Assurance (CSA)?", "position" : 3 } ] } ``` ```json { "@context" : "https://schema.org", "@id" : "https://blog.montrium.com/blog/fda-draft-guidance-on-computer-software-assurance-csa/#blogposting", "@type" : "BlogPosting", "about" : [ { "@type" : "Thing", "name" : "Validation" } ], "articleSection" : "Validation", "author" : { "@type" : "Person", "description" : "Gianna is the Director of the Professional Services team and is responsible for in-house verification projects as well as validation services provided to external clients. She has extensive validation experience, which includes validation of manufacturing equipment, utilities, and computerized systems (including ERP, EDMS, and eSignature solutions). Gianna has also developed a solid understanding of the various regulations which apply to the pharmaceutical, biotech and device industries.", "image" : { "@type" : "ImageObject", "url" : "https://info.montrium.com/hubfs/gianna%20copy_150x150.png" }, "jobTitle" : "", "name" : "Gianna De Rubertis", "sameAs" : [ "" ], "url" : "http://www.montrium.com" }, "dateModified" : "2023-07-31T14:45:04-05:00", "datePublished" : "2022-10-17T16:59:38-05:00", "description" : "Take a look at what's inside the FDA's new draft guidance: Computer Software Assurance for Production and Quality System Software.", "headline" : "What’s in the FDA draft guidance on Computer Software Assurance (CSA)?", "image" : { "@type" : "ImageObject", "height" : "627", "url" : "https://info.montrium.com/hubfs/COMPUTER.png", "width" : "1200" }, "inLanguage" : "en-US", "isPartOf" : { "@id" : "https://blog.montrium.com/blog/#blog", "@type" : "Blog" }, "keywords" : [ "Validation", "Quality" ], "mainEntityOfPage" : { "@id" : "https://blog.montrium.com/blog/fda-draft-guidance-on-computer-software-assurance-csa", "@type" : "WebPage" }, "name" : "What’s in the FDA draft guidance on Computer Software Assurance (CSA)?", "publisher" : { "@id" : "https://company.montrium.com/#organization", "@type" : "Organization", "logo" : { "@type" : "ImageObject", "height" : 641, "url" : "https://cdn.prod.website-files.com/6384d2343a69e90062fc1181/697d0f2f1a3f5f635cde4595_Montrium%20Logo%20-%20Purple.png", "width" : 3689 }, "name" : "Montrium" }, "timeRequired" : "PT6M", "url" : "https://blog.montrium.com/blog/fda-draft-guidance-on-computer-software-assurance-csa", "wordCount" : 1088 } ```