- There must be a written program detailing the maintenance of the computer system.
- There must be a system to control changes to the computer hardware and software including documentation.
- There must be documented checks of I/Os for accuracy. In practice, it is implied that all computer systems under the regulations must be qualified/validated.
- There must be programs to ensure the accuracy and security of computer inputs, outputs, and data.
- Computer electronic data must be controlled, and this includes record backup, security, and retention.