GAMP Categories

http://www.spectroscopyonline.com/understanding-and-interpreting-new-gamp-5software-categories?id=&sk=&date=&%0A%09%09%09&pageID=3
http://computersystemsvalidation.blogspot.com/search/label/GAMP%205
The GAMP categories were originally introduced to provide an initial assessment as
to the validation requirements / deliverables.
GAMP: GOOD AUTOMATED MANUFACTURING PROCESS:
The GAMP (Good Automated Manufacturing Practice) guide version 5 was released
in March 2008 amd Version 1 was released in 1994.

GAMP classification addresses a built-in risk assessment. The least risky and most
widely available software is in category 1 (operating systems, databases, office
software, and other widely available software). This is widely available software that
can be used by anyone and in any industry. As we progress through down the
categories , generally the software becomes more specialized in its function (from a
general office application to software that can control a spectrometer to acquire and
process data then report the results). As we go down the list there is the increasing
ability of the users to change the operation of software and process the results . In
category 5 is a unique solution that is conceived, specified, written, tested, and
maintained by the users or the organization; here is the greatest risk.
Category 1: Greatly Expanded Scope Infrastructure Software

Category 1 has undergone a radical change and expansion from simply operating
systems, that had been constant in GAMP versions 1 to 4, to infrastructure software.
This category provides the computing environment for running both regulated and
nonregulated applications within an organization. It is broken down into two
subcategories:
a) Established or commercially available layered software: It includes
-Operating Systems
- databases
- programming languages
- middleware
- office software
- ladder logic interpreters (for manufacturing systems)
- statistical programming tools and spreadsheet packages.
The key issue is that many of these software tools are the base products for the
applications used in the laboratory or they are the foundation layer for the
laboratory applications to operate under.
b) Infrastructure software tools:
Infrastructure software is a type of enterprise software or program specifically
designed to help business organizations perform basic tasks such as
workforce support, business transactions and internal services and processes.
Ex database programs, email and other communication software and security
applications.
Infrastructure software is also known as integration software or middleware.
Infrastructure software is used to ensure that people and systems within an
organization can connect and do their jobs properly and ensure the efficient
execution of business processes, share information, as well as manage touch points
with suppliers and customers. This type of software is not necessarily marketing
related or used for business transactions such as selling products and services, but
is more operations related, ensuring that business applications and processes can
keep running effectively.
These programs are divided into two classes: system software and application
software. While system software consists of low-level programs that interact with
computers at a basic level, application software resides above system software and
includes database programs, word processors, spreadsheets, etc
The different types of application software are:

Application Suite: Has multiple applications bundled together. Related functions,

features and user interfaces interact with each other.
Enterprise Software: Addresses an organization's needs and data flow in a huge
distributed environment.
Enterprise Infrastructure Software: Provides capabilities required to support
enterprise software systems.
Information Worker Software: Addresses individual needs required to manage and
create information for individual projects within departments.
Content Access Software: Used to access contents and addresses a desire for
published digital content and entertainment.
Educational Software: Holds contents adopted for use by students.
Media Development Software: Addresses individual needs to generate and print
electronic media for others to consume.

Note that category 1 also includes office software such as word processing,
spreadsheet, database, and presentation applications. Now before you rush off
thinking that Excel templates and macros do not need to be validated, think again,
as the guide notes that "applications developed using these packages" are excluded
from category 1 and these can be category 3, 4, or 5, respectively (1), depending on
their complexity.

Note also the phrasing of the subcategory "established or commercially

In GAMP 4 there were five software categories. These have been revised in GAMP5
to four categories as detailed below:
Category 1 Infrastructure software including operating systems, Database
Managers, etc.
Category 2: Firmware
Firmware is a software program permanently etched into a hardware device such as
a keyboards, hard drive, BIOS, or video cards. It is programmed to give permanent
instructions to communicate with other devices and perform functions like basic
input/output tasks. Firmware is typically stored in the flash ROM (read only memory)
of a hardware device. It can be erased and rewritten.

Firmware was originally designed for high level software and could be changed
without having to exchange the hardware for a newer device. Firmware also retains
the basic instructions for hardware devices that make them operative. Without
firmware, a hardware device would be non-functional.
Techopedia explains Firmware

Originally, firmware had read-only memory (ROM) and programmable read-only

memory (PROM). It was designed to be permanent. Eventually PROM chips could be
updated and were called erasable programmable read-only memory (EPROM). But
EPROM was expensive, time consuming to update and challenging to use. Firmware
eventually evolved from ROM to flash memory firmware; thus, it became easier to
update and user friendly.

There are levels of firmware:

Low Level Firmware: This is found in ROM, OTP/PROM and PLA structures. Low level
firmware is often read-only memory and cannot be changed or updated. It is
sometimes referred to as hardware.
High Level Firmware: This is used in flash memory for updates that is often
considered as software.
Subsystems: These have their own fixed microcode embedded in flash chips, CPUs
and LCD units. A subsystem is usually considered part of the hardware device as
well as high level firmware.
BIOS, modems and video cards are usually easy to update. But firmware in storage
devices usually gets overlooked; there are no standardized systems for updating
firmware. Fortunately, storage devices do not need to be updated often.
Category 3 Non configurable software including, commercial off the shelf software
(COTS), Laboratory Instruments / Software.

Category 4 Configured software including, LIMS, SCADA, DCS, CDS, etc.

Category 5 Bespoke software

Category 2 from GAMP 4 has been removed. This related to firmware. At the time

that GAMP4 was issued firmware was considered to be used for simple instruments.
However as technology has advanced the it has been recognised that complex
software can be embedded (firmware) within systems.

CATEGORY 3: renamed from standard software ( GAMP4) to NONCONFIGURED

SOFTWARE (GAMP5)
software that is used as installed falls into category 3 and may also
include software that is configurable (category 4) but is used either
unconfigured or with the standard defaults provided by the software
supplier.=>=> category 3 software is also configured, but for the
environment (run-time configuration).
RUN TIME CONFIGURATION:
a) Upon installation of category 3 application, the software is capable of
operating and automating the business process without any
modification and it cannot be changed in this respect. This type of
application is also called canned software or commercial-off-the-shelf
software (COTS), or even off-the-shelf software (OTS).
b) Defines items in the software to enable the system to operate within
the installed environment. Ex: users and user types for authorized
individuals, entry of the department or company name into report
headers, selection of units to present or report data, default data
storage location (either a local or network directory), and the default
printer.
Thus the key characteristic of software in this category is that run
time configuration does not change the automation of the business
process or the collection and analysis of the data and records
generated by the software.( This is in contrast with category 4
software, in which the actual operation of the software to support the
business process is changed to match the laboratory business
process.)

THEREFORE THE SAME SOFTWARE CAN FALL INTO CATEGORY 3 OR

CATEGORY 4 = depending on whether the default settings are used
( III) or if the application is configured (IV).
CATEGORY 4: CONFIGURED Products
he major difference between category 3 and 4 software, as mentioned
earlier, is the ability to modify the function of the software to match a
business process. The user has the means and knowledge to change
the functionality of the device in a way that changes the results
outputted by the device. As a direct consequence, this triggers
increased validation effort. There are many ways to achieve this but
the essence is to take standard software modules that provide the
basic functionality to automate a process and change it by
configuration tools. These tools are provided by the vendor of the

product, hence configuration rather than using an external language to

write custom code that is attached to the product. However, these
tools can vary in their nature from simple configuration buttons that
turn a feature on or off to graphical drag-and-drop to a modular
"configuration" language that typically writes large blocks of software;
hence, custom code, which raises the debate of
configuration versus customization.
HITESH NOTES:
GAMP 1 Infrastructure Software: Does the system fall under established or
commercially available layered software or Infrastructure software tools?
applications are developed to run under the control of established or
commercially available layered software. This includes operating system,
database managers, programming languages, statistical programming
tools and spreadsheet packages and/or also including tools as network
monitoring software, batch job scheduling tools, security software, antivirus and configuration management tools.
GAMP3- Non Configured Products: Is this a commercially available
standard software package providing an off the shelf solution to a
business or manufacturing process?
a system that cannot be configured to conform to business processes and
systems that are configurable but only default configuration is used. Ex:
Firmware applications, COTS instruments, etc.,)
GAMP Category 4 Configured Products : system software can be
configured to meet the specific needs of the business process. This
involves configuring predefined software modules, but software code
cannot be altered. Ex: LIMS, SCADA, ERP, DCS, etc.
Is the System or Application a configurable software product that provides
a standard interface and functions that enable configuration of user
specific business process?
GAMP Category 5 Custom Applications
Is the System or Application custom developed software, or a custom
extension to an existing system?
the system or application is a custom developed software, or a custom
extension to an existing system. These are complex systems that often
have layers of software with one system including components of several
software categories. Ex: Custom DCS module blocks, Custom
programming language, Spreadsheet with custom macro etc