Common Criteria Evaluation And Validation . - CC Portal
National Information Assurance Partnership TMCommon Criteria Evaluation and Validation SchemeValidation ReportVMware Workspace ONE Boxer Email Client 5.4Report Number: CCEVS-VR-VID10840Version 1.0June 27, 2019National Institute of Standards and TechnologyInformation Technology Laboratory100 Bureau DriveGaithersburg, MD 20899National Security AgencyInformation Assurance Directorate9800 Savage Road STE 6940Fort George G. Meade, MD 20755-6940
VALIDATION REPORTVMware Workspace ONE Boxer Email Client 5.4ACKNOWLEDGEMENTSValidation TeamJenn DotsonSheldon Durrant, Senior ValidatorLinda Morrison, Lead ValidatorClare OlinChris ThorpeMITRE CorporationCommon Criteria Testing LaboratoryHerbert Markle, CCTL Technical DirectorAlex MassiChristopher RakaczkyBooz Allen Hamilton (BAH)Laurel, Marylandii
Table of Contents123456789101112131415EXECUTIVE SUMMARY . 4IDENTIFICATION .5ASSUMPTIONS AND CLARIFICATION OF SCOPE .6ARCHITECTURAL INFORMATION .8SECURITY POLICY .95.1.1Cryptographic Support .95.1.2User Data Protection . 95.1.3Identification and Authentication .95.1.4Security Management . 105.1.5Privacy . 105.1.6Protection of the TSF . 105.1.7Trusted Path/Channels . 10DOCUMENTATION. 11EVALUATED CONFIGURATION . 12IT PRODUCT TESTING . 13RESULTS OF THE EVALUATION . 16VALIDATOR COMMENTS . 18ANNEXES . 19SECURITY TARGET . 20LIST OF ACRONYMS. 21TERMINOLOGY . 22BIBLIOGRAPHY . 23
VALIDATION REPORTVMware Workspace ONE Boxer Email Client 5.41 Executive SummaryThis report documents the assessment of the National Information Assurance Partnership (NIAP)validation team of the evaluation of VMware Workspace ONE Boxer Email Client 5.4 providedby VMware. It presents the evaluation results, their justifications, and the conformance results.This Validation Report is not an endorsement of the Target of Evaluation by any agency of theU.S. government, and no warranty is either expressed or implied.The evaluation was performed by the Booz Allen Hamilton Inc. Common Criteria TestingLaboratory (CCTL) in Laurel, Maryland, United States of America, and was completed inFebruary 2019. The information in this report is largely derived from the evaluation sensitiveEvaluation Technical Report (ETR) and associated test reports, all written by Booz Allen. Theevaluation determined that the product is both Common Criteria Part 2 Extended and Part 3Conformant and meets the assurance requirements set forth in the Protection Profile forApplication Software Version 1.2 (APP PP), dated 22 April 2016 and Extended Package forEmail Clients v2.0 (EC EP), dated June 18, 2015.The Target of Evaluation (TOE) is the VMware Workspace ONE Boxer Email Client 5.4software application, installed on a mobile device platform running iOS 11 (VID10851) as wellas a mobile device host running Android 8.0 (VID10898), in the evaluated configuration. TheBoxer application containerizes enterprise data from personal data that resides on the user’smobile device. Boxer supports the use of Exchange, Office 365, Outlook, Gmail, Yahoo andCloud email services. Enterprise management support only applies to the use of Exchange. Theevaluated TOE functionality includes only the security functional behavior that is defined in theclaimed APP PP and EC EP.The TOE identified in this Validation Report has been evaluated at a NIAP approved CommonCriteria Testing Laboratory using the Common Methodology for IT Security Evaluation (Version3.1, Rev 4) for conformance to the Common Criteria for IT Security Evaluation (Version 3.1, Rev4), as interpreted by the Assurance Activities contained in the APP PP and EC EP. ThisValidation Report applies only to the specific version of the TOE as evaluated. The evaluationhas been conducted in accordance with the provisions of the NIAP Common Criteria Evaluationand Validation Scheme and the conclusions of the testing laboratory in the evaluation technicalreport is consistent with the evidence provided.The validation team provided guidance on technical issues and evaluation processes and reviewedthe individual work units of the ETR for the APP PP and EC EP Assurance Activities. Thevalidation team found that the evaluation showed that the product satisfies all of the functionalrequirements and assurance requirements stated in the Security Target (ST). Therefore, thevalidation team concludes that the testing laboratory’s findings are accurate, the conclusionsjustified, and the conformance results are correct. The conclusions of the testing laboratory in theevaluation technical report are consistent with the evidence produced.The technical information included in this report was obtained from the VMware Workspace ONEBoxer Email Client 5.4 Security Target v1.0, dated June 13, 2019 and analysis performed by theValidation Team.4
VALIDATION REPORTVMware Workspace ONE Boxer Email Client 5.42 IdentificationThe CCEVS is a joint National Security Agency (NSA) and National Institute of Standards andTechnology (NIST) effort to establish commercial facilities to perform trusted productevaluations. Under this program, security evaluations are conducted by commercial testinglaboratories called Common Criteria Testing Laboratories (CCTLs). CCTLs evaluate productsagainst Protection Profile containing Assurance Activities, which are interpretation of CEM workunits specific to the technology described by the PP.The NIAP Validation Body assigns Validators to monitor the CCTLs to ensure quality andconsistency across evaluations. Developers of information technology products desiring asecurity evaluation contract with a CCTL and pay a fee for their product’s evaluation. Uponsuccessful completion of the evaluation, the product is added to NIAP’s Product Compliant List.Table 1 provides information needed to completely identify the product, including: The Target of Evaluation (TOE): the fully qualified identifier of the product as evaluated. The Security Target (ST), describing the security features, claims, and assurances of theproduct. The conformance result of the evaluation. The Protection Profile to which the product is conformant. The organizations and individuals participating in the evaluation.Table 1 – Evaluation eSecurity TargetEvaluationTechnical ReportCC VersionConformance ResultSponsorDeveloperCommon CriteriaTesting Lab (CCTL)CCEVS ValidatorsIdentifierUnited States NIAP Common Criteria Evaluation and ValidationSchemeVMware Workspace ONE Boxer Email Client version 5.4Protection Profile for Application Software Version 1.2 dated April22, 2016 and Extended Package for Email Clients v2.0 dated June 18,2015, including all applicable NIAP Technical Decisions and PolicyLettersVMware Workspace ONE Boxer Email Client 5.4 Security Targetv1.0, dated June 13, 2019Evaluation Technical Report for a Target of Evaluation “VMwareWorkspace ONE Boxer Email Client 5.4” Evaluation TechnicalReport v1.0 dated June 13, 2019Common Criteria for Information Technology Security Evaluation,Version 3.1 Revision 4CC Part 2 extended, CC Part 3 conformantVMwareVMwareBooz Allen Hamilton, Laurel, MarylandMITRE Validators:Jenn DotsonSheldon DurantLinda MorrisonClare OlinChris Thorpe5
VALIDATION REPORTVMware Workspace ONE Boxer Email Client 5.43 Assumptions and Clarification of Scope3.1AssumptionsThe following assumptions about the operational environment are made regarding its abilityto provide security functionality. The TOE relies upon a trustworthy computing platform for its Execution. Thisincludes the underlying platform and whatever runtime environment it provides to theTOE. The administrator of the application software is not careless, willfully negligent orhostile, and administers the software within compliance of the applied enterprisesecurity policy. The user of the application software is not willfully negligent or hostile, and uses thesoftware in compliance with the applied enterprise security policy.3.2ThreatsThe following lists the threats addressed by the TOE. T.FLAWED ADDON – Email client functionality can be extended with integrationof third-party utilities and tools. This expanded set of capabilities is made possiblevia the use of add-ons. The tight integration between the basic email client code andthe new capabilities that add-ons provide increases the risk that malefactors couldinject serious flaws into the email client application, either maliciously by anattacker, or accidentally by a developer. These flaws enable undesirable behaviorsincluding, but not limited to, allowing unauthorized access to sensitive information inthe email client, unauthorized access to the device's file system, or even privilegeescalation that enables unauthorized access to other applications or the operatingsystem. T.LOCAL ATTACK – An attacker can act through unprivileged software on thesame computing platform on which the application executes. Attackers may providemaliciously formatted input to the application in the form of files or other localcommunications. T.NETWORK ATTACK – An attacker is positioned on a communications channelor elsewhere on the network infrastructure. Attackers may engage in communicationswith the application software or alter communications between the applicationsoftware and other endpoints in order to compromise it. T.NETWORK EAVESDROP – An attacker is positioned on a communicationschannel or elsewhere on the network infrastructure. Attackers may monitor and gainaccess to data exchanged between the application and other endpoints. T.PHYSICAL ACCESS – An attacker may try to access sensitive data at rest.3.3Clarification of ScopeAll evaluations (and all products) have limitations, as well as potential misconceptions that mightbenefit from additional clarification. This text covers some of the more important limitations andclarifications of this evaluation. Note that: As with any evaluation, this evaluation only shows that the evaluated configuration meetsthe security claims made, with a certain level of assurance. The level of assurance for thisevaluation is defined within the Protection Profile for Application Software Version 1.2and Extended Package for Email Clients v2.0, including all relevant NIAP TechnicalDecisions. A subset of the “optional” and “selection-based” security requirementsdefined in the APP PP and EC EP are claimed by the TOE and documented in the ST.6
VALIDATION REPORTVMware Workspace ONE Boxer Email Client 5.4 Consistent with the expectations of the Protection Profile, this evaluation did notspecifically search for, nor seriously attempt to counter, vulnerabilities that were not“obvious” or vulnerabilities to security functionality not claimed in the ST. The CEMdefines an “obvious” vulnerability as one that is easily exploited with a minimum ofunderstanding of the TOE, technical sophistication and resources. The functionality evaluated is scoped exclusively to the security functional requirementsspecified in the Security Target. All other functionality provided by these devices, needsto be assessed separately and no further conclusions can be drawn about theireffectiveness. In particular, the Boxer Email Client support using Office 365, Outlook,Gmail, Yahoo, and Cloud email services described in Section 1.3 of the Security Targetwere not assessed as part of this evaluation. Further information of excluded functionalitycan be found in Section 2.3 of the Security Target.In the evaluated configuration, the TOE is installed on a mobile device running iOS 11(VID10851) as well as a mobile device host running Android 8.0 (VID10898). The mobiledevice that the TOE is installed on is managed by a Mobile Device Management softwareproduct called VMware Workspace ONE Unified Endpoint Management (UEM). UEMconsists of a server and an agent that resides on the mobile device. The UEM agent is used toenroll the mobile device with the UEM server so that it can be managed by the UEM server.Also, the UEM agent consumes policy and configuration information for the device andVMware applications, such as Boxer, operating on the device, as well as providing status andpolicy information about the mobile device to the UEM server. The operating system, UEMagent, and UEM server are considered part of the operational environment.Boxer uses ActiveSync to communicate with the Exchange server and is protected using TLSv1.2. The Exchange server resides in the operational environment and is for sending andreceiving enterprise data such as email, calendar information and appointment data. Whetherinstalled on an Android or iOS device, the application validates the certificates using OCSP.The OCSP responder is also considered part of the operational environment.The TOE includes administrative guidance in order to instruct Security Administrators in thesecure installation and operation of the TOE. Adherence to this guidance is sufficient toensure that the TOE is operated in accordance with its evaluated configuration.7
VALIDATION REPORTVMware Workspace ONE Boxer Email Client 5.44 Architectural InformationNote: The following architectural description is based on the description presented in theSecurity Target.4.1TOE IntroductionThe TOE is email client software application that is installed on mobile devices as defined in theAPP PP and EC EP which state: “Applications include a diverse range of software such as officesuites, thin clients, PDF readers, and downloadable smartphone apps Email clients are userapplications that provide functionality to send, receive, access and manage email.” The TOE is anemail client that allows the user to receive, send, manage, and access enterprise email on a mobiledevice. Thus, the TOE is an email client software application.4.2Physical BoundaryThe TOE is an application software product. All hardware that is present is part of the TOE’sOperational Environment. In the evaluated configuration, the TOE is installed on a VID10851certified iOS 11 device and VID10898 certified Android 8.0 device. For testing, this evaluationused a Samsung Galaxy S8 (Android) and on an iPhone 8 (Apple).The following table lists components and applications in the environment that the TOE reliesupon in order to function properly:ComponentOCSP ResponderVMware WorkspaceONE UEM v9.4.0.0Windows Server 2012 R2Exchange serverMobile DeviceDefinitionA server deployed within the Operational Environment which confirms thevalidity and revocation status of certificates.The mobile device has the VMware Workspace ONE Intelligent Hub(UEM agent) installed and is managed by the VMware Workspace ONEUEM server (UEM server).Exchange server for sending and receiving emails to and from theOperational Environment.The hardware that runs the OS in which the application is installed on.Table 2 – IT Environment Components8
VALIDATION REPORTVMware Workspace ONE Boxer Email Client 5.45 Security Policy5.1.1 Cryptographic SupportDepending on which OS the application is installed on, the TOE either invokes the underlyingplatform or implements its own cryptographic module to perform cryptographic services. Allcryptographic mechanisms, whether platform or application provided, use DRBG functionality tosupport cryptographic operations. Cryptographic functionality includes encryption/decryptionservices, credential/key storage, key establishment, key destruction, hashing services, signatureservices, key-hashed message authentication, and key chaining using a password-based derivationfunction.Cryptographic services for the application’s S/MIME functionality and TLS communications areprovided by the underlying platform when the application is installed on a device running theiOS. When installed on a device running the Android OS, the TOE invokes the underlyingplatform cryptographic libraries for TLS communications and implements an OpenSSLcryptographic module to perform the cryptographic functionality required to support S/MIME(consolidated Certificate number C631).OpenSSL Algorithm forS/MIMEHMAC-SHA-256,256 bit keyAES-128-CBC andAES-256-CBCSHA-256, SHA-384, SHA-512RSA (2048, SHA2-256)DRBG CTR (AES-256)AES-256-CBCFCS CKM EXT.5.3ConsolidatedCAVP Cert. #C631FCS SMIME EXT.1.2C631FCS SMIME EXT.1.3FCS SMIME EXT.1.4FCS RBG EXT.1.1FCS COP.1(1) - Encryption of Boxerspecific database used in support ofFCS STO EXT.1(1) storage of specifickeys.C631C631C631C631SFRTable 3 – Cryptographic Algorithm Table (OpenSSL)5.1.2 User Data ProtectionThe TOE uses S/MIME to digitally sign, verify, decrypt, and encrypt email messages. The TOEstores all application data in an encrypted Boxer database which is created on the mobile deviceduring installation. The TOE requires that the host platform have full disk encryption enabled tosecurely store the data. The TOE restricts its network access and provides user awareness when itattempts to access hardware resources and sensitive data stored on the host platform. The TOEdisplays notification icons that show S/MIME status. Each status is shown as a different color sothat the user can quickly identify any issues.5.1.3 Identification and AuthenticationThe TOE validates X.509v3 certificates for TLS communication to the Exchange server. X.509v3certificates are also used for signing and encrypting emails for S/MIME. The TOE application,regardless of platform, performs the certificate validation using OCSP.9
VALIDATION REPORTVMware Workspace ONE Boxer Email Client 5.45.1.4 Security ManagementThe TOE enforces the application’s enterprise policy set by the UEM administrator pushed out tothe managed devices. The TOE does not use default passwords, and automatically installs andconfigures the application to protect itself and its data from unauthorized access while alsoimplementing the recommended platform security mechanisms. Changing one’s own passwordfrom the application is the only management function that can be performed by the owner/user ofthe mobile device with the TOE installed.5.1.5 PrivacyThe TOE does not transmit any personally identifiable information (PII) over the network unlessvoluntarily sent via free text email.5.1.6 Protection of the TSFThe TOE does not support the installation of trusted or untrusted add-ons. The user is able tonavigate the platform to check the version of the TOE and also check for updates to theapplication. All updates come from the Google Play Store (Android) or Apple Store (iOS). Thedigital signature of the updates is verified by the mobile device platform prior to being installed.The TOE does not replace or modify its own binaries without user interaction. The TOEimplements anti-exploitation features, such as stack-based overflow protection, is compatiblewith security features provided by the OS, and will only use documented APIs and libraries.5.1.7 Trusted Path/ChannelsThe TOE invokes the platform to provide the trusted communication channel between the TOEand the Exchange server. Communications is protected with TLS v1.2. Communication to theExchange server uses ActiveSync to send and receive emails. The TOE, in conjunction with theplatform, supports mutual authentication using X.509v3 certificates for TLS communications.10
VALIDATION REPORTVMware Workspace ONE Boxer Email Client 5.46 DocumentationThe vendor provided the following guidance documentation in support of the evaluation: VMware Workspace ONE Boxer Email Client 5.4 Supplemental Administrative Guidance forCommon Criteria – v1.0Any additional customer documentation provided with the product, or which may be availableonline was not included in the scope of the evaluation and therefore should not be relied upon toconfigure or operate the device as evaluated.11
VALIDATION REPORTVMware Workspace ONE Boxer Email Client 5.47 Evaluated ConfigurationThe evaluated configuration, as defined in the Security Target, is the VMware Workspace ONEBoxer Email Client 5.4 software application, installed on a mobile device running iOS 11(VID10851) as well as a mobile device host running Android 8.0 (VID10898). Section 4.2describes the TOE’s physical configuration as well as the operational environment components towhich it communicates. In its evaluated configuration, the TOE is configured to communicatewith the following environment components: OCSP Responder for certificate revocation checking VMware Workspace ONE UEM v9.4.0.0 for unified endpoint management (UEM) Windows Server 2012 R2 Exchange server for email Mobile Device for running the TOE software applicationTo use the product in the evaluated configuration, the product must be configured as specified inthe VMware Workspace ONE Boxer Email Client 5.4 Supplemental Administrative Guidance forCommon Criteria Version 1.0 document, dated March 20, 2019.12
VALIDATION REPORTVMware Workspace ONE Boxer Email Client 5.48 IT Product TestingThis section describes the testing efforts of the developer and the evaluation team. It is derivedfrom information contained in the Assurance Activity Report for a Target of Evaluation “VMwareWorkspace ONE Boxer Email Client 5.4” Assurance Activities Report v1.0 dated June 13, 2019.8.1Test ConfigurationThe evaluation team conducted testing at the VMware Headquarters in Atlanta, GA on an isolatednetwork. The evaluation team configured the TOE for testing according to the VMwareWorkspace ONE Boxer Email Client 5.4 Supplemental Administrative Guidance for CommonCriteria Version 1.0 (AGD) document. The evaluation team set up a test environment for theindependent functional testing that allowed them to perform the assurance activities against theTOE over the SFR relevant interfaces. The TOE was configured with specific IP addresses whenoutside the firewall and assigned another set of IP numbers when connected to the test enterprisenetwork (inside firewall).The TOE was configured to communicate with the following environment components: OCSP Responder server (Windows Server 2012 R2 (Build 9600)).o Microsoft Online Certificate Status Protocol Respondero OpenSSL 1.0.2k-fips1 VMware Workspace ONE UEM v9.4.0.0 server was (Windows Server 2012 R2 (Build9600)). Exchange server Windows Server 2012 R2 ((Build 9600)).o Exchange Server 2013 CU20; Release: March 20, 2018; Build: 15.0.1367.3 Mobile Device for running the TOE software applicationThe following test tools were installed on multiple test workstations and servers for testingpurposes: Binary Analysis ToolClamAV version 0.101.1DB Browser for SQLite version 3.10.1iOS Network Analysis ToolMemory Dump ToolMan-in-the-Middle (MITM) Packet Modification Toolpostfix version 3.3.0PuTTY version 0.70Python version 3.6.4Python version 3.7.1Wireshark version 2.6.5The following test tools were installed on the mobile device for testing purposes: iOS Keychain Dump ToolMemory Dump ToolPacket Capture Tool1Used for negative and control testing required as part of Test Cases 52, 53, and 54 as documented in theTest Plan.13
VALIDATION REPORTVMware Workspace ONE Boxer Email Client 5.4InternetInternetEnterprise NetworkEnterprise NetworkMobile DeviceMobile DeviceApple StoreGoogle StoreAmazonApple StoreGoogle StoreAmazonOpenSSL 1.0.2k-fipsOCSPOCSP ResponderUserOCSPUsed for negative and control testingrequired as part of Test Cases 52, 53,and 54 as documented in the TestOCSP ResponderPlan.UserTLSTLSExchange ServerExchange ServerVMware BoxerEmailClientMobileDeviceVMware BoxerEmailClientMobileDeviceVMware Workspace ONE Intelligent HubVMware Workspace ONE Intelligent HubHTTPSHTTPSOS (iOS 11 or Android 8.0)VMware Workspace ONEUEM(MDM Server)KeyHTTPSOS (iOS 11 or Android 8.0)VMware Workspace ONEUEM(MDM alEnvironmentAdministratorAdministratorFigure 1 - Test Configuration8.2Developer TestingNo evidence of developer testing is required in the Evaluation Activities for this product.8.3Evaluation Team Independent TestingThe test team's test approach was to test the security mechanisms of the TOE by exercising theexternal interfaces to the TOE and viewing the TOE behavior on the platform. The ST and theindependent test plan were used to demonstrate test coverage of all SFR testing assuranceactivities as defined by the APP PP and EC EP for all security relevant TOE external interfaces.TOE external interfaces that will be determined to be security relevant are interfaces that change the security state of the product, permit an object access or information flow that is regulated by the security policy, are restricted to subjects with privilege or behave differently when executed by subjectswith privilege, or invoke or configure a security mechanism.Security functional requirements were determined to be appropriate to a particular interface if thebehavior of the TOE that supported the requirement could be invoked or observed through thatinterface. The evaluation team tested each interface for all relevant behavior of the TOE thatapplied to that interface.8.4Evaluation Team Vulnerability TestingThe evaluation team reviewed vendor documentation, formulated hypotheses, performedvulnerability analysis, and documented the hypotheses and analysis in accordance with theAPP PP and EC EP requirements. Keywords were identified based upon review of the SecurityTarget and AGD. The following keywords were identified:KeywordVMwareBoxerDescriptionThis is a generic term for searching for known vulnerabilitiesproduced by the company as a whole.This is a generic term for searching for known vulnerabilities for thespecific product.14
VALIDATION REPORTVMware Workspace ONE Boxer Email Client 5.4KeywordWorkspace ONE UEM(version 9.4.0.0)OpenSSLAndroid: (version1.0.2p)WebViewPolaris Office (version4.0.7.4)WKWebViewDescriptionThis is a generic term for searching for known vulnerabilities for theMDM used to remotely manage the TOE application.This is a generic term for searching for known vulnerabilities for thecryptographic library used by the TOE application.This is a generic term for searching for known vulnerabilities for theemail document (HTML) viewer used by the TOE application(Android).This is a generic term for searching for known vulnerabilities for theemail attachment viewer used by the TOE application (Android).This is a generic term for searching for known vulnerabilities for theemail document (HTML) and attachment viewer used by the TOEapplication (iOS).These keywords were used individually and as part of various permutations and combinations tosearch for vulnerabilities on public vulnerability sources (updated June 11, 2019). The followingpublic vulnerability sources were searched: Common Vulnerabilities and details.com/vulnerability-search.phpNIST National Vulnerabilities Database (can be used to access CVE and US-CERTdatabases identified curity /Vendor Vulnerability ttp://www.cxsecurity.com/Upon the completion of the vulnerability analysis research, the team had identified severalgeneric
Jun 27, 2019 · VMware Workspace ONE Boxer Email Client 5.4 4 1 Executive Summary This report documents the assessment of the National Information Assurance Partnership (NIAP) validation team of the evaluation of VMware Workspace ONE Boxer Email Client 5.4 provided by VMware. It presents the evaluation re
Cleaning validation Process validation Analytical method validation Computer system validation Similarly, the activity of qualifying systems and . Keywords: Process validation, validation protocol, pharmaceutical process control. Nitish Maini*, Saroj Jain, Satish ABSTRACTABSTRACT Sardana Hindu College of Pharmacy, J. Adv. Pharm. Edu. & Res.
Dipl.-Ing. Becker EN ISO 13849-1 validation EN ISO 13849-2: Validation START Design consideration validation-plan validation-principles documents criteria for fault exclusions faults-lists testing is the testing complete? Validation record end 05/28/13 Seite 4 Analysis category 2,3,4 all
“Common criteria vs. ISO 27001” jean-yves.bernard@thalesgroup.com 10th ICCC, Tromsø, 22-24 September 2009 lørdag 29. august 2009. Thales ITSEF 2009 2 Common criteria vs. ISO 27001 Plan How to use an ISO/IEC 27001:2005 certified Information Security Management System (ISMS) in a common criteria evaluation. Development environment in a CC evaluation (DVS) Developer point of view Evaluator .
Pharmaceutical Engineers (ISPE) GAMP 5. Our validation service is executed in accordance with GxP standards producing a validation library that features the following documents: Validation and Compliance Plan The Validation and Compliance Plan (VCP) defines the methodology, deliverables, and responsibilities for the validation of Qualer.
heard. These goals relate closely to the Validation principles. Validation Principles and Group Work The following eleven axioms are the Validation Principles as revised in 2007. I have tried to find various ways of incorporating the principles into teaching Group Validation and by doing so, anchoring group work to theory. 1.
Validation of standardized methods (ISO 17468) described the rules for validation or re-validation of standardized (ISO or CEN) methods. Based on principles described in ISO 16140-2. -Single lab validation . describes the validation against a reference method or without a reference method using a classical approach or a factorial design approach.
ØExtent of validation and key parameters should be specified and justified in validation plan: e.g. accuracy, precision, stability etc. ØSpecific validation requirements and acceptance criteria may need to be established for each analyte Food and Drug administration. Bioanalytical method validation Guidance for industry.
The protocol on the validation study should include the follow-ing points in the validation study: 1) the purpose and scope of the analytical method, 2) the type of analytical method and validation characteristics, 3) acceptance criteria for each validation character-istics. Consideration on the following points will be useful to pre-
