How do you apply CSA to a SaaS system?
Classify each component by GAMP 5 category, scale assurance activity to actual risk, and leverage vendor evidence for genuinely low-risk, unconfigured functionality — the same logic as any CSA application. The SaaS-specific addition: treat vendor evidence as time-bound, tied to a release-monitoring cadence, since a vendor deploying continuously can invalidate that evidence without telling you.
CSA lets you leverage vendor evidence instead of re-testing everything yourself. Nobody asks the follow-up question: what happens when the vendor pushes an update three days after you collected that evidence?
Regulatory Context
FDA's CSA guidance was first finalized in September 2025 and revised in February 2026 to align with the QMSR. Its formal scope is software used in medical-device production and quality management systems under 21 CFR Part 820; it does not create a universal SaaS rule for every GxP system. The underlying risk-based assurance concepts are nevertheless useful alongside GAMP 5 when teams assess cloud-hosted systems under their applicable regulations.
Scope and Terminology
Applying CSA to SaaS means treating two familiar CSA concepts with SaaS-specific precision. Vendor evidence now includes not just development and testing documentation but security certifications like SOC 2 and ISO 27001, and — critically — the vendor's release notes and change communication process. Assurance boundary refers to exactly which functions and configurations a given piece of evidence actually covers, which matters more for SaaS because the boundary can shift underneath a system that hasn't changed from the customer's side at all.
Risk Classification
| SaaS Component | GAMP 5 Category | Assurance Activity |
|---|---|---|
| Unconfigured core function (e.g. standard search, non-GxP report layout) | Category 3 | Vendor evidence + release monitoring |
| Configured workflow (e.g. document routing rule) | Category 4 | Scenario-based testing, results recorded |
| GxP-critical configured function (e.g. batch disposition, e-signature) | Category 4 | Full scripted testing regardless of hosting |
| Custom API integration or extension | Category 5 | Full SDLC documentation alongside scripted testing |
Hosting model never changes the category. A configured approval workflow carries the same risk whether it runs in your data center or a vendor's cloud — the risk lives in the configuration, not the infrastructure underneath it.
Documentation Examples
Risk Rationale — SaaS Component
Component: Standard document search filter, unconfigured core function of Vendor X's document control module.
Risk rationale: No GxP data or decision depends on search results; a failed search is immediately visible and has no downstream consequence.
Assurance activity: Vendor evidence (SOC 2 Type 2, current as of [date]) plus quarterly release note review against our GxP-critical function list.
Evidence currency: Last reviewed [date]; no relevant vendor releases since. Next review due at next quarterly cycle or upon vendor release notification, whichever comes first.
Implementation Workflow
- Inventory SaaS components and classify each by GAMP 5 category based on configuration, not hosting.
- Collect vendor evidence for components eligible to leverage it, and record what specifically it covers.
- Define the assurance activity per tier — vendor evidence, scenario-based, or scripted — with documented rationale for each.
- Establish release monitoring with the vendor, or a rapid post-deployment review process where advance notice isn't available.
- Set an evidence review cadence so currency is checked on a schedule, not left until someone happens to ask.
How GoVal Supports CSA for SaaS
GoVal tracks vendor evidence currency alongside each SaaS system's GAMP 5 risk classification, flagging when a vendor release potentially affects a GxP-critical function so reassessment happens on a defined trigger rather than by chance. Assurance activity is scoped per component and tied to a documented risk rationale, kept in the same audit-trailed record as the rest of the system's validation history.
Related Topics
Frequently Asked Questions
Does FDA's CSA guidance apply differently to SaaS systems than on-premise software? +
How should SaaS components be risk-classified for CSA purposes? +
What is the vendor evidence currency problem in CSA for SaaS? +
What assurance activities are appropriate for different SaaS risk tiers? +
How do you monitor vendor releases for CSA reassessment triggers in a SaaS system? +
What do inspectors check when reviewing CSA applied to a SaaS system? +
How does GoVal support applying CSA to SaaS systems? +
Keep vendor evidence current, not just collected once
GAMP 5 risk classification, release-triggered reassessment, and documented rationale — for SaaS, in GoVal.