View source for LIMS Selection Guide for ISO/IEC 17025 Laboratories/Choosing laboratory informatics software for better ISO/IEC 17025 compliance/Evaluation and selection

==3. Choosing laboratory informatics software for better ISO/IEC 17025 compliance==
[[File:How easy is the software to use?.png|right|340px]]While [[ISO/IEC 17025]] provides numerous benefits to a [[laboratory]], it still asks a lot of the laboratory in order to conform with the standard.<ref name="DouglasHowISO23">{{cite web |url=https://www.limswiki.org/index.php/LIMS_Q&A:How_does_ISO/IEC_17025_impact_laboratories? |title=LIMS Q&A:How does ISO/IEC 17025 impact laboratories? |work=LIMSwiki |author=Douglas, S.E. |date=January 2023 |accessdate=11 February 2023}}</ref> Today, conforming to ISO/IEC 17025 without the help of an [[information management]] system is a daunting task, especially given requirements concerning timely data retrieval and security. Labs have increasingly turned to a [[laboratory information management system]] (LIMS), not only for helping to modernize and improve the quality of the laboratory but also aiding with compliance to standards like ISO/IEC 17025.<ref>{{Citation |last=Boyar |first=Kyle |last2=Pham |first2=Andrew |last3=Swantek |first3=Shannon |last4=Ward |first4=Gary |last5=Herman |first5=Gary |date=2021 |editor-last=Opie |editor-first=Shaun R. |title=Laboratory Information Management Systems (LIMS) |url=http://link.springer.com/10.1007/978-3-030-62716-4_7 |work=Cannabis Laboratory Fundamentals |language=en |publisher=Springer International Publishing |place=Cham |pages=131–151 |doi=10.1007/978-3-030-62716-4_7 |isbn=978-3-030-62715-7 |accessdate=11 February 2023}}</ref><ref name="ApteIsYour20">{{cite web |url=https://foodsafetytech.com/column/is-your-food-testing-lab-prepping-for-an-iso-iec-17025-audit/ |title=Is Your Food Testing Lab Prepping for an ISO/IEC 17025 Audit? |author=Apte, A. |work=Food Safety Tech |date=20 October 2020 |accessdate=11 February 2023}}</ref> However, not all LIMS are built the same, and the laboratory must consider LIMS vendors who provide a solution that best helps them limit the burden of ISO/IEC 17025 compliance.

This chapter will focus on a series of considerations the lab manager or group should make towards their informatics purchase, especially in the light of the demands of ISO/IEC 17025, described in the previous chapter. Most aspects of the research and acquisition process are discussed, including specific LIMS functionality that maps to the standard's own requirements for compliance.


===3.1 Evaluation and selection===
What exactly is a LIMS anyway? Do I need one? What options are available and how do I compare them? What about a request for information (RFI), request for proposal (RFP), or request for quotation (RFQ)? These are questions laboratory professionals typically ponder upon finding themselves charged with the mission of finding software for their ISO/IEC 17025 lab. For many the task can be a daunting proposition.

You may know the [[Regulatory compliance|regulatory]], [[workflow]], and standard-driven needs of your laboratory, but perhaps you don't know much about [[Information management|data management]] solutions like LIMS—which can better empower your lab to meet those needs—leaving you intimidated by all the options. You'll first need to gauge your lab's informatics needs in order to determine which products are worth investigating further. Of course your lab's analysis requirements, reporting and data sharing constraints, instrument interfacing needs, [[Barcode|barcoding]] and tracking requirements, quality assurance processes, etc. are certainly important factors. But these systems vary in numerous ways, and other important factors exist. Of course, price is one consideration, although value is ultimately more important than a low price. Other important questions that get asked include: 

*Should we purchase software licenses or "rent" the software via a subscription-based model?
*Does the software need to be on-site, or is a [[Software as a service|SaaS]] hosted option more practical?
*Is a modular or complete system better for us?
*What is the best licensing/rental scheme for us? Should we consider site, named user, concurrent user, or workstation licenses?
*Is the company qualified and trustworthy?
*What functionality is available to help our lab remain compliant with the ISO/IEC 17025 standard?

These and other questions are addressed in this chapter.

====3.1.1 Technology considerations====
Your laboratory's workflow, instruments, data management requirements, budget, technological expertise, business goals, and [[Risk management|risk tolerances]] will all play a role in deciding what technology to invest in. The ISO/IEC 17025 lab will also be interested in how that technology not only helps with workflow requirements but also better assists the lab with meeting the requirements placed upon them by the standard.

As part of this discovery process, many questions may arise. Chief among them may be how to best match the laboratory's goals with one or more informatics solutions. Does the laboratory envision a small investment and modest goals, taking in a slow but steady flow of analytical requests, or do they envision expansive growth, expanding into multiple testing domains? If the lab is starting small but is confidently expecting to grow, technological investments early on may want to take into account future technologies that may shape data management and security processes. The lab will also want to account for how ISO/IEC 17025 compliance affects future expansion and technology needs. 

Second, what kind of work will the lab be doing, and what regulatory responsibilities will guide hardware and software investment at the lab? If your lab will be conducting extractable and leachable testing, you'll be considering [[chromatography]] and [[spectroscopy]] instruments, as well as requirements for retaining analytical results for regulators. While the ISO/IEC 17025-accredited testing lab will have varying needs for instruments depending on what sort of work they are conducting, its data management system will likely need to be sufficiently robust to meet the needs of the standard. For those labs in more regulated spaces, the system will even need to interface to government systems, or at a minimum report in the regulatory body's specific format. These and other considerations will need to be made. (We'll get more into the functionality requirements of the ISO/IEC 17025 lab in section 3.1.2.)

Third, your laboratory's budget is always important. Does the budget allow for on-site hardware and software systems, with the personnel to maintain them? Is it easier to pay up-front or find a vendor willing to work with you on leasing or rental terms? Is their more value to be had from a slightly more expensive system able to provide the functionality that makes ISO/IEC 17025 compliance more painless for the lab? (We talk about other cost considerations a bit later.) 

Finally, will the lab have someone on-site or on-call to resolve technology issues, including set-up and maintenance of software systems? If your lab will have little in the way of available tech help locally, you'll want to consider the distribution model you want to use for any installed software, i.e., you may want to consider [[software as a service]] (SaaS). An increasing number of software services are hosted using [[cloud computing]], which when done well is an increasingly reliable option.<ref name="IzrailevskyCloud18">{{cite journal |title=Cloud Reliability |journal=IEEE Cloud Computing |author=Izrailevsky, Y.; Bell, C. |volume=5 |issue=3 |pages=39–44 |year=2018 |doi=10.1109/MCC.2018.032591615}}</ref> Having someone else host the software for you typically means the hosting provider will carry a non-trivial portion of responsibility for technology maintenance and security. 

Speaking of security, you'll also want to consider the [[cybersecurity]] of not only your software solution but also your overall laboratory operations. Does your organization have a cybersecurity plan already in place, or has the decision to make one been postponed? What extra investment is required to ensure your sensitive data is secure? How do your cybersecurity goals compare to the demands of ISO/IEC 17025? (See section 3.1.3 for more on this.) Remember that how you rank your cybersecurity preparedness and implement a cybersecurity plan will also guide your technology investment decisions.<ref name="DouglasComp20">{{cite web |title=[[LII:Comprehensive Guide to Developing and Implementing a Cybersecurity Plan|''Comprehensive Guide to Developing and Implementing a Cybersecurity Plan'']] |author=Douglas, S.E. |work=LIMSwiki |date=July 2020 |accessdate=11 February 2023}}</ref>

'''3.1.1.1 Laboratory informatics options'''

Keeping the above in mind, what are the common software solutions used within an ISO/IEC 17025 laboratory? One of the more commonly discussed options is the LIMS, a laboratory informatics solution designed to assist laboratories with managing testing workflows, data, and other aspects of their operations. 

The use of LIMS in ISO/IEC 17025 labs is not a novel concept.<ref name="ApteIsYour20" /><ref>{{Cite journal |last=Colangeli |first=Patrizia |last2=Ferrilli |first2=Monica |last3=Quaranta |first3=Fabrizio |last4=Malizia |first4=Elio |last5=Mbulu |first5=Rosa-Stella |last6=Mukete |first6=Esther |last7=Iipumbu |first7=Lukas |last8=Kamhulu |first8=Anna |last9=Tjipura-Zaire |first9=Georgina |last10=Di Francesco |first10=Cesare |last11=Lelli |first11=Rossella |date=2012 |title=Laboratory information management system: an example of international cooperation in Namibia |url=https://pubmed.ncbi.nlm.nih.gov/23038071 |journal=Veterinaria Italiana |volume=48 |issue=3 |pages=241–251 |issn=1828-1427 |pmid=23038071}}</ref><ref>{{Cite journal |last=Xueken, C. |year=2012 |title=Application and Research of LIMS for the Traceability of a Testing Laboratory (LIMS针对检测实验室检测可溯源性的应用与研究) |url=http://www.cqvip.com/qk/96101x/20128/43050128.html |journal=Microcomputer Applications |volume=2012 |issue=8 |pages=47–50}}</ref><ref>{{Cite journal |last=Thurston, C. |date=August 2013 |title=World’s largest GTL facility turns to LIMS for enhanced operations |url=https://www.hydrocarbonprocessing.com/magazine/2013/august-2013/bonus-report-lng-developments/world-s-largest-gtl-facility-turns-to-lims-for-enhanced-operations |journal=Hydrocarbon Processing |publisher=Gulf Publishing Company, LLC |volume=}}</ref><ref>{{Cite journal |last=Taina |first=Alina |date=2015-05 |title=Software validation with respect to requirements specified by SR EN 15189:2013 and SR EN 17025:2005. A practical approach for a medical laboratory information management system (LIMS) and a gas meter in testing laboratory |url=http://ieeexplore.ieee.org/document/7133899/ |journal=2015 9th International Symposium on Advanced Topics in Electrical Engineering (ATEE) |publisher=IEEE |place=Bucharest, Romania |pages=720–724 |doi=10.1109/ATEE.2015.7133899 |isbn=978-1-4799-7514-3}}</ref> However, little information can be found as to the percentage of today's ISO/IEC 17025 laboratories using a LIMS in their workflow. A 2017 survey of 30 ISO/IEC 17025-accredited laboratories—18 responding—by the Association of Public Health Laboratories (APHL) found that of the respondents, only 10 (56%) had any spend on a LIMS.<ref name="APHLLabCost17">{{cite web |url=https://www.aphl.org/aboutAPHL/publications/Documents/FS-2018Feb-ISO-IEC-Accreditation-Costs-Survey-Report.pdf |title=Laboratory Costs of ISO/IEC 17025 Accreditation: A 2017 Survey Report |format=PDF |author=Association of Public Health Laboratories |date=February 2018 |accessdate=11 February 2023}}</ref> This is a tiny pool of all laboratories, so it's likely not all that representative of ISO/IEC 17025-accredited lab use of a LIMS. Yet given:

#the focus on laboratory competence, impartiality, and consistent operations—and by extension, quality—by the ISO/IEC 17025 standard developers; and
#the connection of improving quality through appropriate use of an informatics solutions like a LIMS (see the next subsection)

... it's not difficult to imagine many such labs turning to a LIMS to help them towards quality and compliance goals. In addition, a LIMS or other informatics solution can help eliminate manual processes,  improve sample management, increase productivity, and improve regulatory conformance.<ref name="Astrix2020LIMS">{{cite web |url=https://astrixinc.com/wp-content/uploads/2021/03/Astrix-2020-LIMS-Market-Research-Report.pdf |format=PDF |title=Astrix 2020 LIMS Market Research Survey Report |publisher=Astrix Technology, LLC |date=March 2021 |accessdate=11 February 2023}}</ref> This, of course, lends to the ISO/IEC 17025 lab's focus on safety, quality, and compliance.

A LIMS can improve laboratory workflows and workloads while enhancing safety, quality, and compliance in a number of ways. A fragmented mix of paper-based and electronic information sources can be a detriment to the traceability of or rapid accessibility to quality control samples, standard operating procedures (SOPs), calibration data, chain of custody data, and other vital aspects of analytical, sampling, and calibration testing in the lab. A well-implemented LIMS can reduce the silos of information and data, while at the same time make that information and data more secure and readily accessible. Given the standard's demands for providing rapid proof of traceable sample movement and relevant quality control data, the LIMS acts as the central integrator and audit trail for that information.<ref name="SmithInteg19">{{cite web |url=https://foodsafetytech.com/feature_article/integrated-informatics-optimizing-food-quality-and-safety-by-building-regulatory-compliance-into-the-supply-chain/ |title=Integrated Informatics: Optimizing Food Quality and Safety by Building Regulatory Compliance into the Supply Chain |author=Smith, K. |work=Food Safety Tech |date=02 July 2019 |accessdate=11 February 2023}}</ref><ref name="McDermottHowDig18">{{cite web |url=https://foodsafetytech.com/column/how-digital-solutions-support-supply-chain-transparency-and-traceability/ |title=How Digital Solutions Support Supply Chain Transparency and Traceability |author=McDermott, P. |work=Food Safety Tech |date=31 July 2018 |accessdate=11 February 2023}}</ref><ref name="EvansTheDig19">{{cite web |url=https://foodsafetytech.com/feature_article/the-digital-transformation-of-global-food-security/ |title=The Digital Transformation of Global Food Security |author=Evans, K. |work=Food Safety Tech |date=15 November 2019 |accessdate=11 February 2023}}</ref> Because the LIMS improves traceability—including through its automated interfaces with instruments and other data systems—real-time monitoring of supply chain issues, quality control data, instrument use, and more is further enabled, particularly when paired with configurable dashboards and alert mechanisms. By extension, labs can more rapidly act on insights gained from those real-time dashboards.<ref name="SmithInteg19" /> 

This also means that the lab can react more rapidly to issues that compromise compliance with certification to not only the ISO/IEC 17025 standard but also other requirements by regulatory agencies like the FDA.<ref name="ApteIsYour20" /><ref name="PaszkoHow15">{{cite web |url=https://foodsafetytech.com/feature_article/how-lims-facilitates-iso-17025-certification-in-food-testing-labs/ |title=How LIMS Facilitates ISO 17025 Certification in Food Testing Labs |author=Paszko, C. |work=Food Safety Tech |date=26 October 2015 |accessdate=11 February 2023}}</ref><ref name="DanielsUsing17">{{cite web |url=https://foodsafetytech.com/column/using-lims-get-shape-fdas-visit/ |title=Using LIMS to Get In Shape for FDA’s Visit |author=Daniels, T. |work=Food Safety Tech |date=22 March 2017 |accessdate=11 February 2023}}</ref> Finally, many modern LIMS tailored to ISO/IEC 17025 compliance come pre-configured out of the box with analytical and quality control workflow support tools that can be further optimized to a lab's unique workflow.

However, the LIMS is not the sole information management solution for ISO/IEC 17025 laboratories. Other types of software-based information management solutions are being marketed to laboratories appearing in various industries. Some software vendors have taken to marketing the somewhat related [[laboratory execution system]] (LES), which tends to focus more on laboratory test method execution at the process level while integrating other R&D functionalities found in, for example, [[electronic laboratory notebook]]s (ELNs).<ref name="iVentionLES">{{cite web |url=https://hs.iles.cloud/en/food-and-beverages-lab-execution |title=iLES Food & Beverages Lab Execution |publisher=iVention BV |accessdate=11 February 2023}}</ref><ref name="LVSHowLIMS20">{{cite web |url=https://www.news-medical.net/whitepaper/20200416/How-LIMS-can-Improve-your-Food-and-Beverage-Testing-Lab.aspx |title=How LIMS can Improve your Food and Beverage Testing Lab |author=LabVantage Solutions |work=News Medical |date=16 April 2020 |accessdate=11 February 2023}}</ref> Other solutions like the [[quality management system]] or QMS may work hand-in-hand with a LIMS to better harmonize the loading and use of workflows and methods in the LIMS, as well as better ensure the lab's risk management principles are enacted and followed.<ref>{{Citation |last=Famili |first=Parsa |last2=Cleary |first2=Susan |date=2022-03-09 |editor-last=Huynh‐Ba |editor-first=Kim |title=Laboratory Information Management System (LIMS) and Electronic Data |url=https://onlinelibrary.wiley.com/doi/10.1002/9781119680475.ch10 |work=Analytical Testing for the Pharmaceutical GMP Laboratory |language=en |edition=1 |publisher=Wiley |pages=345–373 |doi=10.1002/9781119680475.ch10 |isbn=978-1-119-12091-9 |accessdate=11 February 2023}}</ref> The implication here, of course, is the lab will need to decide on the level of software integration of any other primary or ancillary systems is required for smoother operations, as well as whether or not a system such as a LIMS is able to accommodate. 

It's important to note that, in particular, the QMS plays an important role when discussing ISO/IEC 17025. The next subsection will examine the role of the QMS in such laboratories, in relation to quality management and the LIMS.

'''3.1.1.2 LIMS, quality management, and the QMS'''

In order to be most successful—while meeting the requirements of standards and regulatory pressures—a laboratory must focus on a culture of quality.<ref>{{Cite journal |last=Kennedy, T.M.; Kennedy, J.L.; Donaldson, R.M. et al. |year=2022 |title=A Call for Action to Maintain a Culture of Quality in the Clinical Laboratory |url=https://www.scivisionpub.com/pdfs/a-call-for-action-to-maintain-a-culture-of-quality-in-the-clinical-laboratory-2116.pdf |format=PDF |journal=Genetics & Molecular Medicine |volume=4 |issue=1 |pages=1–2 |doi=10.33425/2689-1077.1013}}</ref> A QMS is one means for a laboratory to put additional focus on quality, and ISO/IEC 17025:2017—at least in spirit—promotes the adoption of a QMS. At issue is that while Section 8 of ISO/IEC 17025:2017 addresses the laboratory's management system, it never directly calls it a "quality management system" or QMS; in fact, the word "quality" only appears once in this section. However, the implication is that the standard is addressing quality with its requirements for a management system, i.e., a QMS<ref name="ISO17025_17" />:

<blockquote>The laboratory shall establish, document, implement, and maintain a management system that is capable of supporting and demonstrating the consistent achievement of the requirements of this document and assuring the quality of the laboratory results.</blockquote>

This discussion about the (quality) management system requirements of ISO/IEC 17025:2017—and the QMS itself—is important in the context of a LIMS, as related discussion of the role of a LIMS in better managing a lab's quality system has been occurring for at least several decades.<ref name="SteeleTheImp99">{{Cite journal |last=Steele |first=T. W. |last2=Laugier |first2=Alain |last3=Falco |first3=Fran&#x000E7;ois |date=1999-03-03 |title=The impact of LIMS design and functionality on laboratory quality achievements |url=http://link.springer.com/10.1007/s007690050324 |journal=Accreditation and Quality Assurance |volume=4 |issue=3 |pages=102–106 |doi=10.1007/s007690050324 |issn=0949-1775}}</ref><ref>{{Cite journal |last=Çağındı |first=Özlem |last2=Ötleş |first2=Semih |date=2004-12 |title=Importance of laboratory information management systems (LIMS) software for food processing factories |url=https://linkinghub.elsevier.com/retrieve/pii/S0260877404000846 |journal=Journal of Food Engineering |language=en |volume=65 |issue=4 |pages=565–568 |doi=10.1016/j.jfoodeng.2004.02.021}}</ref> As early as 1999, the "contribution that both system design and functionality" of a LIMS can have on a lab's efforts towards "building quality" was being discussed by researchers.<ref name="SteeleTheImp99" /> Additionally, as Hull ''et al.'' noted in 2011, a LIMS that allows the lab to track and control anything affecting the quality of its operations is critical to successfully developing, implementing, and revising a QMS. "[T]here is more than just the end product or result that needs to be tracked and controlled," the authors add. "All of the intermediate products and resources play a significant role in producing the final product, and each of these needs to be included in the LIMS."<ref name="HullTrack11">{{Cite journal |last=Hull |first=Carl |last2=Wray |first2=Bruce |last3=Winslow |first3=Ford |last4=Vilicich |first4=Mark |date=2011-11-01 |title=Tracking and Controlling Everything that Affects Quality is the Key to a Quality Management System |url=http://www.eurekaselect.com/openurl/content.php?genre=article&issn=1386-2073&volume=14&issue=9&spage=772 |journal=Combinatorial Chemistry & High Throughput Screening |language=en |volume=14 |issue=9 |pages=772–780 |doi=10.2174/138620711796957125}}</ref>

With that, Hull ''et al.''<ref name="HullTrack11" />, as with their predecessors<ref name="SteeleTheImp99" />, highlight the importance of practical and consistent LIMS functionality to the efforts of maintaining quality in the lab. As such, with:

#laboratory adoption of ISO/IEC 17025:2017 increasing steadily since 2010, according to the International Laboratory Accreditation Cooperation (ILAC),<ref name="ILACFacts21">{{cite web |url=https://ilac.org/about-ilac/facts-and-figures/ |title=About ILAC > Facts & Figures |publisher=ILAC |date=2021 |accessdate=11 February 2023}}</ref> as a means to demonstrate "that [labs] operate competently and generate valid results"<ref name="ISO17025_17" /> (i.e., focus on quality); and
#LIMS vendors needing to improve their efforts with addressing a lab's need for tracking and controlling quality within its [[workflow]]<ref name="HullTrack11" />

... today's laboratories seeking to improve quality and meet ISO/IEC 17025 requirements with the help of a LIMS must be mindful of not only what ISO/IEC 17025 demands of the lab, but also what LIMS functionality is required to help the lab be more compliant. A software-based QMS alone won't be as useful as a LIMS or LIMS+QMS combo in managing the requirements of the standard. The next section examines more precisely the functionality required of a LIMS to better manage the necessary compliance, in turn bringing other positive benefits to the lab.

====3.1.2 Features and functions for ISO/IEC 17025 compliance====
It's clear that a laboratory's quality goals can and should be tied to standards like ISO/IEC 17025<ref name="DouglasWhatImport23">{{cite web |url=https://www.limswiki.org/index.php/LIMS_Q&A:What_is_the_importance_of_ISO/IEC_17025_to_society? |title=LIMS Q&A:What is the importance of ISO/IEC 17025 to society? |author=Douglas, S.E. |work=LIMSwiki |date=January 2023 |accessdate=11 February 2023}}</ref>, and compliance to the standard is better accomplished with the help of a laboratory informatics solution like a LIMS. However, the LIMS needs to have a bit more than generic functionality in order to best assist the lab with its goals.

What follows, in Table 1, is a demonstration of how a modern LIMS requirements specification like [[LII:LIMSpec 2022 R2|LIMSpec]] ties to the requirements of ISO/IEC 17025. LIMSpec is a robust [[laboratory informatics]] requirements specification document that has evolved significantly over the years, and we can turn to LIMSpec to better visualize what the critical requirements of a LIMS are in regards to better complying with ISO/IEC 17025. With the current version of LIMSpec having at its core standards such as [[ASTM E1578|ASTM E1578-18]] ''Standard Guide for Laboratory Informatics''<ref name="ASTME1578_18">{{cite web |url=https://www.astm.org/e1578-18.html |title=ASTM E1578-18 Standard Guide for Laboratory Informatics |publisher=ASTM International |date=23 August 2019 |accessdate=11 February 2023}}</ref> and ISO/IEC 17025 ''General requirements for the competence of testing and calibration laboratories''<ref name="ISO17025_17">{{cite web |url=https://www.iso.org/standard/66912.html |title=ISO/IEC 17025:2017 General requirements for the competence of testing and calibration laboratories |publisher=International Organization for Standardization |date=November 2017 |accessdate=11 February 2023}}</ref>, the LIMSpec makes for a durable requirements document that, when used to acquire an informatics solution, can better help a laboratory choose appropriate functionality based upon current standards, regulations, guidance, and more. 

In particular—rather than looking at the entire LIMSpec, which is described in greater detail later—this section will specifically look at the touch points of ISO/IEC 17025 with LIMSpec and highlight their importance. In addition to Table 1 listing the specific ISO/IEC 17025 section number and the associated LIMSpec requirement, an attempt has been made to explain in clearer terms the impact of the requirement on the lab towards better complying with ISO/IEC 17025.

{| 
 | style="vertical-align:top;" |
{| class="wikitable collapsible" border="1" cellpadding="10" cellspacing="0" width="70%"
 |-
  | colspan="3" style="text-align:left; padding-left:20px; padding-top:10px; padding-bottom:10px;" |'''Table 1.''' ISO/IEC 17025:2017's parts that relate to and drive LIMSpec requirements, as well as plain-language explanation of the implications for laboratories.
 |-
  ! style="color:brown; background-color:#ffffee; width:220px;" |ISO/IEC 17025:2017 part(s)
  ! style="color:brown; background-color:#ffffee;" |Associated LIMSpec requirement
  ! style="color:brown; background-color:#ffffee;" |In plain terms ...
 |- 
  | style="padding:10px;" |ISO/IEC 17025:2017 7.3.3
  | style="padding:10px; background-color:white;" |'''1.9''' The system shall be able to define the collection and sampling details for registered samples or specimens, including container size and type, number of containers, collection date and time, temperature, name of the collector, lot number, storage location, preservation method, collection methods used (standard and nonstandard), sampling methods used, safety concerns, and retention period.
  | style="padding:10px; background-color:white;" |'''Complete capture of a registered sample's data and metadata''': A laboratory can better comply with ISO/IEC 17025 requirements if the lab's LIMS allows the lab to completely capture the details of incoming samples or specimens (herein referred to as simply "sample" or "samples"). There are numerous data and metadata aspects of sample or specimen collection, and the LIMS should be flexible enough to capture any necessary details as part of entry into the system.
 |-   
  | style="padding:10px;" |ISO/IEC 17025:2017 7.4.2
  | style="padding:10px; background-color:white;" |'''1.13''' The system shall assign each sample registered in the system a unique identifier using methodologies such as an ID with an incrementing integer or a user-defined naming format.
  | style="padding:10px; background-color:white;" |'''Unique sample identifiers''': A laboratory can better comply with ISO/IEC 17025 requirements if the lab's LIMS allows a unique and perpetual identifier to be assigned to each sample, including any sub-samples collected from the main sample.
 |-   
  | style="padding:10px;" |ISO/IEC 17025:2017 7.4.3
  | style="padding:10px; background-color:white;" |'''1.16''' The system should provide a means to document any undesirable or unexpected characteristics of a submitted sample.
  | style="padding:10px; background-color:white;" |'''Free-form reception-based sample data''': A laboratory can better comply with ISO/IEC 17025 requirements if the lab's LIMS allows an authorized user to enter free-form data as it relates to a registered sample, including the state of the sample upon arrival and what, if anything, was wrong with the sample when received.
 |-   
  | style="padding:10px;" |ISO/IEC 17025:2017 7.4.2
  | style="padding:10px; background-color:white;" |'''2.8''' The system should allow for the accurate identification of a physical sample or specimen in the system via barcode or RFID technology.
  | style="padding:10px; background-color:white;" |'''Barcode and RFID support''': A laboratory can better comply with ISO/IEC 17025 requirements if the lab's LIMS provides a means of issuing a unique barcode or some other scannable identifier—typically for improving automation or workflows—to a sample or sub-sample, all while linking the complete sample record to that barcode or scannable identifier such that it can be reviewed upon scanning by an authorized individual or acted upon by an automated system.
 |-   
  | style="padding:10px;" |ISO/IEC 17025:2017 7.7.2
  | style="padding:10px; background-color:white;" |'''2.11''' The system shall allow samples, specimens, and tests to be created and used specifically for capturing data related to unique forms of sampling and testing such as representative sampling, calibration testing, quality control testing, preventative maintenance testing, stability testing, sterility testing, remediated testing, compatibility testing, identity testing, proficiency testing, and service-event-related testing.
  | style="padding:10px; background-color:white;" |'''Preloaded and configurable sample types and analytical test methods''': A laboratory can better comply with ISO/IEC 17025 requirements if the lab's LIMS is flexible enough to support, at a bare minimum, a sufficiently wide variety of sample types and test methods, particularly those mandated by standards and regulations. More optimally, the LIMS will come preconfigured to a wide array of sample types and test methods, while allowing authorized users to easily and efficiently add new sample types and test methods to meet regulatory and laboratory business goals.
 |-   
  | style="padding:10px;" |ISO/IEC 17025:2017 6.2.6<br />ISO/IEC 17025:2017 7.7.1<br />ISO/IEC 17025:2017 7.8.1.1
  | style="padding:10px; background-color:white;" |'''4.4''' The system shall provide one or more levels of review, as well as interpretation and documentation of results—whether entered manually or via an automated process—before release.
  | style="padding:10px; background-color:white;" |'''Multi-level review of test results''': A laboratory can better comply with ISO/IEC 17025 requirements if the lab's LIMS can programmatically require an analytical test result to be held in the system, unable to move on through the workflow until one or more levels of review and approval have been made, whether it be by authorized human or automated process.
 |-   
  | style="padding:10px;" |ISO/IEC 17025:2017 7.5.1<br />ISO/IEC 17025:2017 7.8.1.1<br />ISO/IEC 17025:2017 7.8.2.1<br />ISO/IEC 17025:2017 7.8.3.1
  | style="padding:10px; background-color:white;" |'''6.5''' The system shall substantiate the status of verified results by using tools like a certificate of analysis, which shall include details like unique identifiers; analysis procedures used; reference intervals; environmental conditions; who provided the results; additional comments, opinions, and interpretations and who provided them; and applicable times and dates.
  | style="padding:10px; background-color:white;" |'''Support for certificates of analysis or similar verification documents''': A laboratory can better comply with ISO/IEC 17025 requirements if the lab's LIMS is pre-configured to build out certificates of analysis (COAs) and other results verification documents. The COA and other verification documents will ideally be populated with data and metadata relevant to meeting specific industry or regulatory needs, in a format that is consistent and legally durable for its recipient.
 |-   
  | style="padding:10px;" |ISO/IEC 17025:2017 7.8.8
  | style="padding:10px; background-color:white;" |'''6.9''' The system shall clearly identify a changed, amended, or re-issued report as being such, and clearly identify any change of information and reason for change in such a report.
  | style="padding:10px; background-color:white;" |'''Support for changed, amended, or re-issued reports''': A laboratory can better comply with ISO/IEC 17025 requirements if the lab's LIMS places a demand on analytical reports changed, amended, or re-issued in the LIMS such that they can't be issued without making readily apparent to the recipient what was changed and why it was changed.
 |-   
  | style="padding:10px;" |ISO/IEC 17025:2017 5.3<br />ISO/IEC 17025:2017 5.5<br />ISO/IEC 17025:2017 8.3.2
  | style="padding:10px; background-color:white;" |'''7.1''' The system shall be capable of creating, managing, and securely holding a variety of document types, while also allowing for the review and approval of those documents using version and release controls.
  | style="padding:10px; background-color:white;" |'''Document management, with versioning and release controls''': A laboratory can better comply with ISO/IEC 17025 requirements if the lab's LIMS provides robust support for the creation, upload, management, and retaining of a diverse array of document types in the LIMS. The lab also benefits when the LIMS supports versioning of documents and provides approval and release controls to authorized users.
 |-   
  | style="padding:10px;" |ISO/IEC 17025:2017 (throughout)
  | style="padding:10px; background-color:white;" |'''7.2''' The system shall have the ability to readily provide authorized access to electronic documents such as standard operating procedures, quality manuals, laboratory management plans, instrument manuals, employee medical records, material safety data sheets, information exchange agreements, confidentiality agreements, and other applicable documents to designated personnel and officials.
  | style="padding:10px; background-color:white;" |'''Controlled document access''': A laboratory can better comply with ISO/IEC 17025 requirements if the lab's LIMS not only provides robust document management support, but also is able to provide rapid access to housed documents for authorized users and officials. (This is usually supported by role-based access; see '''34.4'''.)
 |-   
  | style="padding:10px;" |ISO/IEC 17025:2017 7.5.2<br />ISO/IEC 17025:2017 8.3.2
  | style="padding:10px; background-color:white;" |'''7.3''' The system shall be able to clearly provide the most current version of a document and archive prior versions.
  | style="padding:10px; background-color:white;" |'''Provision of the most current document version''': A laboratory can better comply with ISO/IEC 17025 requirements if the lab's LIMS limits access to only the most currently approved version of a document, unless the user is authorized to specifically view older archived versions of the document. If so, the LIMS shall clearly denote that it's an older, archived version.
 |-   
  | style="padding:10px;" |ISO/IEC 17025:2017 6.5<br />ISO/IEC 17025:2017 7.2.1.3<br />ISO/IEC 17025:2017 7.3.1–2
  | style="padding:10px; background-color:white;" |'''7.5''' The system shall allow the creation, approval, rejection, and management of sampling and test methods performed at the laboratory, capturing details about the test method, method reference, specifications, assigned limits, holding times, etc. as required by a reference method or regulation.
  | style="padding:10px; background-color:white;" |'''Robust sampling and test method development''': A laboratory can better comply with ISO/IEC 17025 requirements if the lab's LIMS is flexible enough to allow authorized users to create, approve, reject, and manage changes to sampling and test methods in the system, including the addition of all necessary descriptive data and metadata as required by a reference method or regulation. Some of that descriptive data may be free-form, and the LIMS should support that. (Tangentially related to '''2.11'''.)
 |-   
  | style="padding:10px;" |ISO/IEC 17025:2017 6.2.6<br />ISO/IEC 17025:2017 7.2.2.1<br />ISO/IEC 17025:2017 7.2.2.4
  | style="padding:10px; background-color:white;" |'''7.6''' The system shall provide a means for recording validation information for modified existing or new in-house test methods, either as a method itself or through some other means. Validation information such as procedures used, specifications, performance characteristics, and results obtained shall be allowed as input.
  | style="padding:10px; background-color:white;" |'''Validation of sampling and test methods''': A laboratory can better comply with ISO/IEC 17025 requirements if the lab's LIMS requires newly added or modified sampling and test methods to be properly validated before being put into use, while requiring the entry of all necessary specifics of the validation process for verification by authorized individuals.
 |-   
  | style="padding:10px;" |ISO/IEC 17025:2017 6.2.2<br />ISO/IEC 17025:2017 6.2.3<br />ISO/IEC 17025:2017 6.2.5<br />ISO/IEC 17025:2017 6.2.6
  | style="padding:10px; background-color:white;" |'''7.7''' The system shall maintain training and certification records for personnel and allow the assignment of available training paths and certifications to specific personnel, such that only trained, certified, and experienced personnel are able to perform assigned tasks.
  | style="padding:10px; background-color:white;" |'''Support for training and certification records''': A laboratory can better comply with ISO/IEC 17025 requirements if the lab's LIMS has a mechanism for adding training and certification records for personnel and contractors, and associating those records with those individuals. Those records must have internal flags that can be tied to one or more actions in the system, such that only users with those flags (associated with the training and certification records) can perform those system actions or be scheduled for certain laboratory activities.
 |-   
  | style="padding:10px;" |ISO/IEC 17025:2017 8.3.2
  | style="padding:10px; background-color:white;" |'''7.10''' The system shall be capable of uniquely identifying documents created in and added to the system.
  | style="padding:10px; background-color:white;" |'''Support for unique document identifiers''': A laboratory can better comply with ISO/IEC 17025 requirements if the lab's LIMS automatically attaches a unique identifier to documents created in and uploaded to the system, including new versions of existing documents.
 |-   
  | style="padding:10px;" |ISO/IEC 17025:2017 7.9
  | style="padding:10px; background-color:white;" |'''8.2''' The system shall allow authorized personnel to document complaints and problems reported to the laboratory or production facility.
  | style="padding:10px; background-color:white;" |'''Complaint and problem management''': A laboratory can better comply with ISO/IEC 17025 requirements if the lab's LIMS has a mechanism that allows authorized users to enter, in a consistent fashion, formal complaints and problems originating from within or related to the laboratory. Ideally, the LIMS will also allow the appropriate and authorized management of existing complaints and problems entered into the system such that proof can be made of not only who filed the complaint but also who marked the complaint as resolved.
 |-   
  | style="padding:10px;" |ISO/IEC 17025:2017 6.2.2<br />ISO/IEC 17025:2017 6.2.3<br />ISO/IEC 17025:2017 6.2.5<br />ISO/IEC 17025:2017 6.2.6
  | style="padding:10px; background-color:white;" |'''8.8''' The system shall map available system tasks (such as approved test methods) or sample types (such as select agents and toxins) to available training paths and certifications, such that only trained, certified, and experienced personnel are able to perform assigned tasks.
  | style="padding:10px; background-color:white;" |'''Support for mapping professional requirements to existing system tasks, sample types, and methods''': A laboratory can better comply with ISO/IEC 17025 requirements if the lab's LIMS has a means to generically link a training or certification type to a performable system action, a sample type, or a method (as well as other things). As such, a user with that training and certification would be permitted to perform activities related to the action, sample, or method. (Tangentially related to '''7.7'''.)
 |-   
  | style="padding:10px;" |ISO/IEC 17025:2017 6.4.7<br />ISO/IEC 17025:2017 6.4.8
  | style="padding:10px; background-color:white;" |'''10.7''' The system shall allow for the configuration of calibration and maintenance frequency and time frames for—as well as the manual and automatic scheduling of calibration or maintenance of—equipment, instruments, and systems. Available intervals should include days, weeks, months, and years.
  | style="padding:10px; background-color:white;" |'''Support for scheduled, frequency-based calibration and maintenance''': A laboratory can better comply with ISO/IEC 17025 requirements if the lab's LIMS supports manual and automated scheduling of calibration and maintenance activities at a designated and relatively granular frequency, preferably notifying assigned individuals in advance of such activities.
 |-   
  | style="padding:10px;" |ISO/IEC 17025:2017 6.4.4<br />ISO/IEC 17025:2017 6.4.9
  | style="padding:10px; background-color:white;" |'''10.9''' The system shall clearly identify any instrument that is out-of-calibration, beyond its preventative maintenance due date, or under investigation and prevent it from being selected for use.
  | style="padding:10px; background-color:white;" |'''Instrument lock-out''': A laboratory can better comply with ISO/IEC 17025 requirements if the lab's LIMS is capable of locking out a linked instrument and preventing its use in any system activities when certain criteria have been met. Common criteria includes not having been calibrated by a due date, not having been maintained by a due date, or an authorized user designating the instrument as unusable or under investigation, though the LIMS will preferably be flexible enough to allow for the addition of other criteria.
 |-   
  | style="padding:10px;" |ISO/IEC 17025:2017 6.4.8
  | style="padding:10px; background-color:white;" |'''10.10''' The system shall be able to show all instances of scheduled calibration, preventative maintenance, and service dates for an instrument.
  | style="padding:10px; background-color:white;" |'''Consistent, retrievable calibration and maintenance records''': A laboratory can better comply with ISO/IEC 17025 requirements if the lab's LIMS consistently and securely maintains a complete record of calibration, maintenance, and service for an instrument—including dates, times, entities involved, and the results of the activities—and makes them retrievable to authorized users.
 |-   
  | style="padding:10px;" |ISO/IEC 17025:2017 6.4.13 <br />ISO/IEC 17025:2017 6.5
  | style="padding:10px; background-color:white;" |'''10.11''' The system shall be able to link a calibration activity to certified reference material or designated measurement processes.
  | style="padding:10px; background-color:white;" |'''Calibration activity linkages''': A laboratory can better comply with ISO/IEC 17025 requirements if the lab's LIMS can require, when appropriate, the addition of or linking to a certified reference material or appropriate measurement process when an authorized user or automated component records a new calibration action in the LIMS, such that the calibration activity can be further verified as appropriate.
 |-   
  | style="padding:10px;" |ISO/IEC 17025:2017 6.4.8<br />ISO/IEC 17025:2017 6.4.13
  | style="padding:10px; background-color:white;" |'''10.13''' The system shall be able to uniquely identify each instrument and any associated components and maintain that and other information—such as manufacturer, model number, serial number, and calibration and maintenance history—within the system.
  | style="padding:10px; background-color:white;" |'''Unique identification of instruments''': A laboratory can better comply with ISO/IEC 17025 requirements if the lab's LIMS provides a means to uniquely and clearly identify a connected (or even disconnected) instrument, such that it can't be confused with another similar instrument. Along with the unique identifier, the addition of further information about the instrument and its origins needs to be allowed so that it can easily be referenced by authorized users.
 |-   
  | style="padding:10px;" |ISO/IEC 17025:2017 6.4.4–5<br />ISO/IEC 17025:2017 6.4.13
  | style="padding:10px; background-color:white;" |'''10.15''' The system shall be capable of chronologically logging details for scheduled and unscheduled calibration and maintenance activities for each instrument, including calibration status, calibration standard, date and time of calibration or maintenance, work performed, who conducted it, and signatures of those verifying the completed activities.
  | style="padding:10px; background-color:white;" |'''Calibration and maintenance audit trail''': A laboratory can better comply with ISO/IEC 17025 requirements if the lab's LIMS maintains a secure, chronological audit trail of both scheduled and unscheduled calibration, maintenance, and service activities for each uniquely registered instrument. Like other audit trails, vital data such time, date, entities involved, results, and signatures will need to be included to best ensure the quality of instrument-related analytical results. (Tangentially related to '''10.10'''.)
 |-   
  | style="padding:10px;" |ISO/IEC 17025:2017 7.2.1.7<br />ISO/IEC 17025:2017 7.2.2.1<br />ISO/IEC 17025:2017 7.10.2<br />ISO/IEC 17025:2017 8.7
  | style="padding:10px; background-color:white;" |'''16.3''' The system shall be able to record instances of identified nonconformance and method deviation, as well as the actions required to restore the process to conformity. In the case of a planned deviation, the system shall require documentation, justification, proof of validation, adjusted reference intervals, and authorization for the deviated process.
  | style="padding:10px; background-color:white;" |'''Nonconformance and deviation tracking''': A laboratory can better comply with ISO/IEC 17025 requirements if the lab's LIMS is sufficiently robust to automatically and manually allow for the recording of instances of nonconformance and deviation from methods. That nonconformance and deviation may be either intentional or unintentional, yet the LIMS should be flexible enough to manage both, requiring additional details for the logged nonconformance and deviation, including whether or not the action was restored to conformity, as well as—if intentional—the full details of the planned deviation. Typical details involve the who, what, why, and how of it, but the LIMS must be flexible enough to allow for additional details to be captured, when necessary, for laboratory inspection or audit purposes.
 |-   
  | style="padding:10px;" |ISO/IEC 17025:2017 7.7.1
  | style="padding:10px; background-color:white;" |'''18.1''' The system should allow authorized users to configure the generation of statistical trending and control charts.
  | style="padding:10px; background-color:white;" |'''Statistical trending and control charts''': A laboratory can better comply with ISO/IEC 17025 requirements if the lab's LIMS allows users to easily configure settings for and generate statistical trending and control charts, which help the lab more rapidly detect and correct systematic analytical bias and optimize laboratory procedures.<ref>{{Cite journal |last=Sanchez |first=Juan M. |date=2021-05-11 |title=Use of Control Charts and Scientific Critical Thinking in Experimental Laboratory Courses: How They Help Students to Detect and Solve Systematic Errors |url=https://pubs.acs.org/doi/10.1021/acs.jchemed.0c00885 |journal=Journal of Chemical Education |language=en |volume=98 |issue=5 |pages=1822–1828 |doi=10.1021/acs.jchemed.0c00885 |issn=0021-9584}}</ref>
 |-   
  | style="padding:10px;" |ISO/IEC 17025:2017 8.8.2
  | style="padding:10px; background-color:white;" |'''19.7''' The system shall allow for the documentation and management of internal and external audit activities, while allowing samples, methods, tests, results, reports, documents, and more to be clearly associated with that corresponding audit activity.
  | style="padding:10px; background-color:white;" |'''Internal and external audit management''': A laboratory can better comply with ISO/IEC 17025 requirements if the lab's LIMS provides a means for setting up, documenting, and managing the lab's internal and external audit activities within the LIMS. By extension, the lab would also benefit if the LIMS is able to link a wide variety of other entries in the LIMS to specific audit activities, including samples, methods, tests, and more.
 |-   
  | style="padding:10px;" |ISO/IEC 17025:2017 8.4.2
  | style="padding:10px; background-color:white;" |'''27.3''' The system shall provide a means to choose—based on date and type of data—electronic data and metadata to archive.
  | style="padding:10px; background-color:white;" |'''Support for data and metadata archiving''': A laboratory can better comply with ISO/IEC 17025 requirements if the lab's LIMS has robust methods of allowing internal data and metadata to be archived, having both an automated method based upon creation data or data type and a manually performed method usable by authorized users.
 |-   
  | style="padding:10px;" |ISO/IEC 17025:2017 8.4.2
  | style="padding:10px; background-color:white;" |'''27.4''' The system shall provide a guaranteed means to retrieve and restore archived data and metadata that is readable and accurate.
  | style="padding:10px; background-color:white;" |'''Support for rapid and accurate retrieval of archived data and metadata''': A laboratory can better comply with ISO/IEC 17025 requirements if the lab's LIMS allows authorized users to rapidly and accurately retrieve and restore data and metadata in a readable fashion, such that the lab can effectively act upon that data or metadata, especially in the case of an audit.
 |-   
  | style="padding:10px;" |ISO/IEC 17025:2017 8.4.2
  | style="padding:10px; background-color:white;" |'''27.11''' The system’s data storage tools shall provide data backup and retrieval functions that meet or exceed industry best practices, including producing exact and complete backups that are secure and encrypted from manipulation and loss.
  | style="padding:10px; background-color:white;" |'''Secure backup and retrieval''': A laboratory can better comply with ISO/IEC 17025 requirements if the lab's LIMS provides manual and automated means of backing up exact copies of data and metadata—including complete databases—while ensuring that backed up data is secure (through encryption, access control, etc.), retrievable, and readable by authorized users, especially for circumstances where data loss has occurred.
 |-   
  | style="padding:10px;" |ISO/IEC 17025:2017 6.3.3<br />ISO/IEC 17025:2017 6.3.4
  | style="padding:10px; background-color:white;" |'''30.9''' The system should allow for other types of facility monitoring (such as alarm, light, lock, and door statuses) and send notifications when necessary with recommendations for immediate and corrective action. The system should also maintain a log of all such monitored systems and their status changes.
  | style="padding:10px; background-color:white;" |'''Facility monitoring''': A laboratory can better comply with ISO/IEC 17025 requirements if the lab's LIMS can connect to, monitor, and send alerts concerning sensors attached to facility infrastructure like alarms, lights, locks, and doors. Additionally, the system should be able to keep an accurate log of the status changes of such facility infrastructure.
 |-   
  | style="padding:10px;" |ISO/IEC 17025:2017 6.3.3<br />ISO/IEC 17025:2017 6.3.4<br />ISO/IEC 17025:2017 7.4.4
  | style="padding:10px; background-color:white;" |'''30.11''' The system should allow for environmental control and monitoring of equipment (such as incubators and freezers) and send notifications when necessary with recommendations for immediate and corrective action. The system should also maintain a log of all such monitored equipment and their associated status changes.
  | style="padding:10px; background-color:white;" |'''Environmental monitoring''': A laboratory can better comply with ISO/IEC 17025 requirements if the lab's LIMS can connect to, monitor, and send alerts concerning equipment such as incubators, lab refrigerators, and lab freezers. Additionally, the system should be able to keep an accurate log of the status changes of such equipment.
 |-   
  | style="padding:10px;" |ISO/IEC 17025:2017 8.4.2
  | style="padding:10px; background-color:white;" |'''31.4''' The system shall have a mechanism to securely retain data in the system for a specific time period and enable protections that ensure the accurate and ready retrieval of that data throughout the records retention period.
  | style="padding:10px; background-color:white;" |'''Data retention''': A laboratory can better comply with ISO/IEC 17025 requirements if the lab's LIMS has a complete data retention system, allowing automated and manual retention of data and metadata. The lab will benefit if authorized users can configure retention periods for specific data and item types, as well as promptly and accurately retrieve archived data and metadata for review as needed.
 |-   
  | style="padding:10px;" |ISO/IEC 17025:2017 4.2.1<br />ISO/IEC 17025:2017 7.11.3
  | style="padding:10px; background-color:white;" |'''32.22''' The system shall provide a security interface usable across all modules of the system that secures data and operations and prevents unauthorized access to data and functions.
  | style="padding:10px; background-color:white;" |'''Robust system security''': A laboratory can better comply with ISO/IEC 17025 requirements if the lab's LIMS has robust and configurable security mechanisms appropriately in place across system functions and modules as a means of preventing unauthorized access to data, metadata, and functions. This can be achieved in a number of ways, through role-based access control, password control, and more. (Tangentially related are '''7.2''', '''8.8''', '''34.4''', and '''34.7'''.)
 |-   
  | style="padding:10px;" |ISO/IEC 17025:2017 7.11.5
  | style="padding:10px; background-color:white;" |'''33.4''' The system should be well documented by the vendor in comprehensive training material for all aspects of system use, including administration, operation, and troubleshooting.
  | style="padding:10px; background-color:white;" |'''User manuals and training documentation''': A laboratory can better comply with ISO/IEC 17025 requirements if the lab's LIMS comes with comprehensive instructions and training material regarding the effective use of the LIMS, how to maintain/administrate it, and how to solve problems should they arise. This is the responsibility of the LIMS vendor and should be a consideration of the lab acquiring a LIMS.
 |-   
  | style="padding:10px;" |ISO/IEC 17025:2017 7.11.2
  | style="padding:10px; background-color:white;" |'''33.5''' The system shall be validated initially and periodically, with those validation activities being documented, to ensure the accuracy, consistency, and reliability of system performance and its electronic records.
  | style="padding:10px; background-color:white;" |'''LIMS validation''': A laboratory can better comply with ISO/IEC 17025 requirements if the lab's LIMS is properly validated by the LIMS vendor, initially, and revalidated periodically, especially after significant updates and customization to the LIMS. This is true for any lab, but it remains especially true in regulated industries, where the accuracy, consistency, and reliability of system performance is mission-critical.<ref name="MaxwellUsing03">{{cite web |url=http://www.scientificcomputing.com/using-workflows-in-lims-to-reduce.aspx |archiveurl=https://web.archive.org/web/20090807034051/http://www.scientificcomputing.com/using-workflows-in-lims-to-reduce.aspx |title=Using Workflows in LIMS to Reduce Customization |author=Maxwell, G. |work=Scientific Computing |date=01 November 2003 |archivedate=07 August 2009 |accessdate=11 February 2023}}</ref>
 |-   
  | style="padding:10px;" |ISO/IEC 17025:2017 7.8.7.1<br />ISO/IEC 17025:2017 7.11.3<br />ISO/IEC 17025:2017 8.3.2
  | style="padding:10px; background-color:white;" |'''34.4''' The system shall support the ability to define, record, and change the level of access for individual users to system groups, roles, machines, processes, and objects based on their responsibilities, including when those responsibilities change. The system should be able to provide a list of individuals assigned to a given system group, role, machine, process, or object.
  | style="padding:10px; background-color:white;" |'''Secure granular access''': A laboratory can better comply with ISO/IEC 17025 requirements if the lab's LIMS is able to control access to LIMS data and functions at a granular level, providing the flexibility to define, record, and change individual access levels at the group, role, machine, method, sample, or object level. This granular level of access control better ensures those individuals qualified to perform specific tasks in the system are able, while others are not. The lab also benefits when the LIMS is able to readily provide a listing of users assigned to each of those granular levels.
 |-   
  | style="padding:10px;" |ISO/IEC 17025:2017 7.11.3
  | style="padding:10px; background-color:white;" |'''34.7''' The vendor shall restrict logical access to database storage components to authorized individuals. If providing a hosted service, the vendor should also restrict physical access to database storage components to authorized individuals. (In the case of an on-site solution, the buyer is responsible for limiting physical access to database storage components to meet 21 CFR Part 11, HIPAA, and CJIS guidelines.)
  | style="padding:10px; background-color:white;" |'''Logical and physical access control''': A laboratory can better comply with ISO/IEC 17025 requirements if the lab's LIMS restricts logical access (i.e., access via remotely/virtually interacting with hardware and software tools and databases) to critical components to only authorized users. Though physical access for a local install is the responsibility of the lab, the lab running a cloud-hosted LIMS from a vendor will still want to thoroughly vet the LIMS vendor concerning their own policies and practices related to physical access to hardware and software systems as part of complying with ISO/IEC 17025.
 |-  
|}
|}

We can simplify Table 1 down to the following functionality as being important to a lab attempting to conform to ISO/IEC 17025, organized by workflow descriptors:

'''Test, sample and result management'''

*Complete capture of a registered sample's data and metadata
*Unique sample identifiers
*Free-form reception-based sample data
*Barcode and RFID support
*Preloaded and configurable sample types and analytical test methods
*Robust sampling and test method development


'''Quality, security, and compliance'''

*Multi-level review of test results
*Validation of sampling and test methods
*Support for mapping professional requirements to existing system tasks, sample types, and methods
*Instrument lock-out
*Consistent, retrievable calibration and maintenance records
*Calibration activity linkages
*Calibration and maintenance audit trail
*Nonconformance and deviation tracking
*Statistical trending and control charts
*Internal and external audit management
*Secure backup and retrieval
*Facility monitoring
*Environmental monitoring
*Data retention
*Robust system security
*LIMS validation
*Secure granular access
*Logical and physical access control


'''Operations management and reporting'''

*Document management, with versioning and release controls
*Controlled document access
*Provision of the most current document version
*User manuals and training documentation
*Support for unique document identifiers
*Support for training and certification records
*Complaint and problem management
*Unique identification of instruments
*Support for scheduled, frequency-based calibration and maintenance
*Support for data and metadata archiving
*Support for rapid and accurate retrieval of archived data and metadata
*Support for certificates of analysis or similar verification documents
*Support for changed, amended, or re-issued reports


====3.1.3 Cybersecurity considerations====
[[File:Measuring cybersecurity.png|right|700px]]From law firms<ref name="SobowaleLaw17">{{cite web |url=http://www.abajournal.com/magazine/article/managing_cybersecurity_risk/ |title=Law firms must manage cybersecurity risks |author=Sobowale, J. |work=ABA Journal |publisher=American Bar Association |date=01 March 2017 |accessdate=11 February 2023}}</ref> to automotive manufacturers<ref name="WatneyAddress17">{{cite web |url=https://www.rstreet.org/wp-content/uploads/2018/04/118-1.pdf |format=PDF |title=Addressing new challenges in automotive cybersecurity |author=Watney, C.; Draffin, C. |work=R Street Policy Study No. 118 |publisher=R Street Institute |date=November 2017 |accessdate=11 February 2023}}</ref>, the need to address cybersecurity is increasingly apparent. In 2018, the Center for Strategic & International Studies estimated that cybercrime causes close to $600 billion in damages to the global economy every year<ref name="LewisEcon18">{{cite web |url=https://www.csis.org/analysis/economic-impact-cybercrime |title=Economic Impact of Cybercrime |author=Lewis, J.A. |publisher=Center for Strategic & International Studies |date=21 February 2018 |accessdate=11 February 2023}}</ref>, though due to underreporting of crimes, that number may be much higher. That number also likely doesn't take into account lost business, fines, litigation, and intangible losses<ref name="SBDCC_BlogCost17">{{cite web |url=https://www.virginiasbdc.org/blog-cost-of-cyber-crime-to-small-businesses/ |archiveurl=https://web.archive.org/web/20200705061737/https://www.virginiasbdc.org/blog-cost-of-cyber-crime-to-small-businesses/ |title=BLOG: Cost of Cyber Crime to Small Businesses |work=Virginia SBDC Blog |publisher=Virginia SBDC |date=30 May 2017 |archivedate=05 July 2020 |accessdate=11 February 2023}}</ref> In the end, businesses of all sizes average about $200,000 in losses due to a cybersecurity incident<ref name="HiscoxHiscox19&quot;">{{cite web |url=https://www.hiscox.com/documents/2019-Hiscox-Cyber-Readiness-Report.pdf |format=PDF |title=Hiscox Cyber Readiness Report 2019 |publisher=Hiscox Ltd |date=April 2019 |accessdate=11 February 2023}}</ref>, and nearly 60 percent of small and midsize businesses go bankrupt within six months because of it.<ref name="Galvin60_18">{{cite web |url=https://www.inc.com/joe-galvin/60-percent-of-small-businesses-fold-within-6-months-of-a-cyber-attack-heres-how-to-protect-yourself.html |title=60 Percent of Small Businesses Fold Within 6 Months of a Cyber Attack. Here's How to Protect Yourself |author=Galvin, J. |work=Inc.com |date=07 May 2018 |accessdate=11 February 2023}}</ref>

ISO/IEC 17025 laboratories are no exception, regardless of business size. Even tiny labs whose primary digital footprint is a WordPress website advertising their lab are at risk, as hackers could still spread malware, steal user data, add the website to a bot network, hack the site for the learning experience, or even hack it just for fun.<ref name="GrimaTop19">{{cite web |url=https://www.wpwhitesecurity.com/why-malicious-hacker-target-wordpress/ |title=Top reasons why WordPress websites get hacked (and how you can stop it) |author=Grima, M. |publisher=WP White Security |date=15 June 2022 |accessdate=11 February 2023}}</ref><ref name="MoenWhatHack16">{{cite web |url=https://www.wordfence.com/blog/2016/04/hackers-compromised-wordpress-sites/ |title=What Hackers Do With Compromised WordPress Sites |author=Moen, D. |work=Wordfence Blog |publisher=Defiant, Inc |date=19 April 2016 |accessdate=11 February 2023}}</ref><ref name="TalalevWebsite19">{{cite web |url=https://patchstack.com/articles/website-hacking-statistics/ |title=Website Hacking Statistics You Should Know in 2022 |author=Talaleve, A. |publisher=Patchstack |date=22 February 2022 |accessdate=11 February 2023}}</ref> Even more importantly are those labs performing digital data management tasks that handle sensitive proprietary manufacturer data, requiring additional cybersecurity considerations.

ISO/IEC 17025:2017 doesn't use the word "cybersecurity," but it does address the proper control of data, in its section 7.11. In particular, section 7.11.3 and 7.11.4 make it clear that the LIMS should be protected, whether hosted locally or hosted, in the cloud, by a third-party provider.<ref name="ISO17025_17" /> Importantly, the standard notes that the LIMS should have sufficient mechanism to protect its contents from unauthorized access, as well as from tampering and unexpected loss. It adds that the LIMS should "be maintained in a manner that ensures the integrity of the data and information" and promptly record any nonconformance or breaches of security, as well as any corrective actions taken.<ref name="ISO17025_17" /> These are most certainly cybersecurity concerns, which must be properly addressed by the ISO/IEC 17025 lab.

Laboratories attempting to conform to ISO/IEC 17025 can integrate cybersecurity thinking into its laboratory informatics product selection in several ways. First, the organization should have a cybersecurity plan in place, or if not, it should be on the radar. This is a good resource to tap into in regards to deciding what cybersecurity considerations should be made for the software. Can the software help your organization meet your cybersecurity goals? What regulatory requirements for your lab are or are not covered by the software?<ref name="DouglasComp20">{{cite web |title=[[LII:Comprehensive Guide to Developing and Implementing a Cybersecurity Plan|''Comprehensive Guide to Developing and Implementing a Cybersecurity Plan'']] |author=Douglas, S.E. |work=LIMSwiki |date=July 2020 |accessdate=11 February 2023}}</ref> Another tool to consider—which may have been used in any prior cybersecurity planning efforts—is a cybersecurity framework. Many, but not all, cybersecurity frameworks include a catalog of security controls. Each control is "a safeguard or countermeasure prescribed for an information system or an organization designed to protect the confidentiality, integrity, and availability of its information and to meet a set of defined security requirements."<ref name="NISTSecurity19">{{cite web |url=https://csrc.nist.gov/glossary/term/security_control |title=security control |work=Computer Security Resource Center |publisher=National Institute of Standards and Technology |date=2019 |accessdate=11 February 2023}}</ref> These controls give the implementing organization a concrete set of configurable goals to apply to their overall cybersecurity strategy. Other frameworks may be less oriented to security controls and more program-based or risk-based. Choosing the best frameworks will likely depend on multiple factors, including the organization's industry type, the amount of technical expertise within the organization, the budget, the organizational goals, the amount of buy-in from key organizational stakeholders, and those stakeholders' preferred approach.<ref name="DouglasComp20" />

Finally, having an organizational cybersecurity plan that incorporates one or more cybersecurity frameworks gives the laboratory ample opportunity to apply stated goals and chosen security controls to the evaluation and selection process for its informatics software. In particular, a user requirements specification (URS) that incorporates cybersecurity considerations will certainly help a laboratory with meeting regulatory requirements while also protecting its data systems. A USR that is pre-built with cybersecurity controls in mind—such as LIMSpec, discussed later—makes the evaluation process even easier.

====3.1.4 Regulatory compliance considerations====
Consider approaching the question of regulatory compliance from the standpoint of adopting standards, in this case ISO/IEC 17025. Consider first that the risks and consequences of performing a task poorly drives regulation and, more preferably<ref name="CiocoiuTheRole10">{{cite book |chapter=Chapter 1. The Role of Standardization in Improving the Effectiveness of Integrated Risk Management |title=Advances in Risk Management |author=Ciocoui, C.N.; Dobrea, R.C. |editor=Nota, G. |publisher=IntechOpen |year=2010 |isbn=9789535159469 |doi=10.5772/9893}}</ref><ref name="JPMorganData18">{{cite web |url=https://www.jpmorganchase.com/content/dam/jpmc/jpmorgan-chase-and-co/documents/call-to-action.pdf |format=PDF |title=Data Standardization: A Call to Action |publisher=JPMorgan Chase & Co |date=May 2018 |accessdate=11 February 2023}}</ref>, standardization, which in turn moves the "goalposts" of quality and security among organizations. In the case of regulations, those organization that get caught not conforming to the necessary regulations tend to suffer negative consequences, providing some incentive for them to improve organizational processes and procedures. 

One of the downsides of regulations is that they can at times be "imprecise" or "disconnected"<ref name="JPMorganData18" /> from what actually occurs within the organization and its information systems. Rather than focusing heavily on regulatory conformance, well-designed standards may, when adopted, provide a clearer path of opportunity for organizations to improve their operational culture and outcomes, particularly since standards are usually developed with a broader consensus of interested individuals with expertise in a given field.<ref name="CiocoiuTheRole10" /> In turn, the organizations that adopt well-designed standards like ISO/IEC 17025 likely have a better chance of conforming to the regulations they must, and they'll likely have more interest in maintaining and improving the goalposts of quality and security in the lab.

Additionally, reputable software developers of laboratory informatics software will not only adopt their own industry standards for software development but also understand how the ISO/IEC 17025 and LIMS requirements intersect. In turn, the developed software should meet regulations and standards, help the laboratory comply with its regulations and standards, and be of reliably good quality. 

If you're a potential buyer of a laboratory informatics solution, it may be that you know a bit about your laboratory's workflow and have at least a remedial understanding of how ISO/IEC 17025 influences how that workflow is conducted, but you're not entirely informed about all the details of how a LIMS can help your lab better conform to the standard, along with other regulations and standards. Turning to a URS such as LIMSpec—which was developed around laboratory regulations and standards, including ISO/IEC 17025—and reviewing the various statements contained within may be necessary to help further inform you. Additionally, as you investigate various informatics options, you can then use the requirements in the URS as a base for your laboratory's own requirements list. Using the categories and their subdivisions, you can then add those requirements that are unique to your laboratory and industry that are not sufficiently covered by the base URS. As you review the various options available to you and narrow down your search, your own list of requirements can be used as both as a personal checklist and as a requirements list you hand over to the vendor you query. And since your URS is based off the standards and regulations affecting your lab, you can feel more confident in your acquisition and its integration into your laboratory workflow.

====3.1.5 System flexibility====
Before selecting a solution, your laboratory should also have internal discussions about how diversified its offered services are, as well as what the future may bring to the lab. If, for example, your lab is currently configured for one type of testing, does your existing laboratory informatics system—or the ones you may be considering—have the flexibility to add other types of testing, protocols, and workflows? Will you be doing the footwork to add them, or will the vendor of your system support you in that effort? If you're a start-up, will your lab be focusing solely on a specific type of testing and expand into other types of analytical work later, or will your test menu need to be much broader right from the start? In most of these cases, you'll desire a LIMS that is flexible enough to allow for not only running the specific tests you need now, but also sufficiently expandable for any future testing services your lab may conduct in the mid- and long-term. Having the ability to create and customize [[Sample (material)|sample]] registration screens, test protocols, labels, reports, specification limit sets, measurement units, and substrates/matrices while being able to interface with practically most any instrument and software system required will go a long way towards making your expanding test menu and workflows integrates as smoothly as possible.

Such a system will typically be marketed as being highly user-configurable, giving labs a relatively painless means to adapt to rapid changes in test volume and type over time. However, once you've internally addressed current and anticipated future growth, your lab will want to learn what explicitly makes any given vendor's system user-configurable. How easy is it to configure the system to new tests? Add custom reports? What knowledge or skills will be required of your lab in order to make the necessary changes, i.e., will your staff require programming skills, or are the administrator and advanced user functions robust enough to make changes without hard-coding? These and other such questions should be fully addressed by the vendor in order to set your mind at ease towards a system's stated flexibility. Ultimately, you want the system to be flexible enough to change with the laboratory—and industry—itself, while minimizing overall costs and reducing the time required to make any necessary modifications.

====3.1.6 Cost considerations====
First, you'll want to be clear on what will be included in the sales agreement. Whether through an estimate or statement of work (SOW), it is important it includes exactly what is expected, being as specific as possible, since this will be the entire contractual obligation for both you the buyer and them the vendor. Note that line items may differ slightly from system to system, according to what features and functions are included by default with each vendor's solution and which, if any, are additional. Also keep in mind that any hourly amount in the the estimate or SOW is usually a best estimate; however, if sufficient attention to detailed requirements has been given, then it should be quite accurate, and in fact the final cost may even be below the quoted cost if you prioritize your own obligations so that the vendor's hours are used sparingly and efficiently. 

The estimate or SOW should optimally include:

*licensing or subscription rates;
*required core items to meet federal, state, and local regulations;
*additional optional items and totals; and
*required services (implementation, maintenance and support, optional add-ons).

There are two primary ways to price a laboratory informatics solution: a one-time license fee or a subscription rate (cloud-hosted SaaS). If you have your own dedicated IT department and staff, you may prefer the former (although many system administrators are just as happy to let it be hosted elsewhere rather than add to their workload). Otherwise, a SaaS subscription may well be the better and more cost-effective way to go (since the primary IT cost is simply internet access). This item will be part of your up-front cost and, in the case of subscription, it will also figure into your first year and ongoing costs; otherwise only associated maintenance, support, and warranty (MSW) will figure in. Typically, your first year's subscription costs will be due at signing. More often, the vendor may require three months or even the first year up front, so be prepared to factor that into up-front costs. However, it still is almost always less expensive at the outset (and over time, if you factor in IT costs and annual MSW) than paying for a license fee.

In addition to the two types of software pricing, there are also sub-types. Generally these are based on the number of users (or, in some cases, "nodes," which are simply any entities that access the informatics system, including other systems, instruments, etc.). How these are counted can vary.

*Named users: This method bases pricing on the actual individual users of the system, even if they only log in sporadically. Users may not use each other's logins (this is a no-no regardless of pricing structure, for good laboratory practice and other regulatory reasons).
*Concurrent users: This bases pricing on the maximum number of users who will be logged in at any given time. You can define an unlimited number of named users in the system, each with their own login credentials. However, only the number of concurrent users specified in the license or subscription may be logged in at any one time. For example, you may have 10 staff, but due to work processes, shifts, etc., only up to six might ever be logged in simultaneously. Whereas this would require a named user license for 10, it would only require a concurrent user license for six.
*Unlimited users: In the case of very large labs (typically 30 to 50 and up), the license or subscription may simply be a flat fee that allows any number of users.

The line items in the estimate or SOW should reflect these nuances, as well as whether the listed costs are monthly or annual (for subscription services), hourly (typically for support and training), or a fixed one-time cost. Additionally, be cautious with fixed costs, as they typically represent one of two possible scenarios:

#Final fixed cost: In this case, the cost has been figured by the vendor so as to cover their worst-case hourly labor total. If a line item (e.g., an interface) is not "worst case," then you are overpaying.
#"Expandable" fixed cost: This is as bad as final fixed cost, and maybe even worse because it's almost a case of "bait-and-switch," popping up as a surprise. The initial "fixed cost" number is low, and additional hourly services are needed to actually deliver the item. This will have been provided for somewhere in the small print.

The bottom line is that everything in a laboratory informatics solution is really either licensing or hourly services. Just be careful if they are portrayed as anything else.

It is important to be clear which category each line item falls under when figuring costs: up-front (due upon signing), annual, or ongoing (e.g., SaaS subscription). It is useful to clearly lay out each and compute initial costs, as well as first-year and subsequent years' costings. For example, your initial obligation may be as little as your first year's subscription plus the first 40 hours of services. Different vendors have different policies, however, and you may be required to pay for your first full year's subscription and all services, or some other combination. Normally, though, any instrument interface or other service charges aren't due until the they are implemented, which may be a few weeks or even a month down the road. This may depend on your budget, complexity of the SOW, and urgency. Your first year's expenses will include everything, including initial license fees; all setup and training; any interfaces and additional configurations or customization; and first annual MSW. (If this isn't included in the SaaS subscription, then it usually commences on full system delivery). Afterwards, your subscription and MSW will be the only ongoing expenses (included as one in this example), unless you choose to have additional interfaces or other services performed at any time.