CSV to CSA: a practical guide for small biotech
FDA finalized its Computer Software Assurance (CSA) guidance in September 2025 and reissued it in February 2026 as Computer Software Assurance for Production and Quality Management System Software, aligned with the QMSR (21 CFR Part 820). Since February 2, 2026, device validation requirements sit in the QMSR, which incorporates ISO 13485. For a small biotech team running SaaS GxP systems such as Veeva Vault, CSA is a chance to spend validation effort where risk is real and stop producing paperwork nobody reads.
What CSA is
CSA is a risk based way to establish confidence that software works for its intended use. The guidance formally addresses production and quality system software for device makers, but biotech and pharma teams widely apply its risk based principles to computer system validation.
CSV and CSA compared
| Topic | Traditional CSV | CSA |
|---|---|---|
| Starting point | Test everything, document everything | Intended use and risk to patients and product quality |
| Testing | Mostly scripted | Scripted for high risk functions; unscripted or ad hoc testing where risk is low |
| Vendor evidence | Often repeated | Leveraged where it is adequate |
| Records | Large test packages | Records sized to the risk |
Risk tiers and testing approaches
Start with intended use. A function that could affect product quality or patient safety gets scripted testing with documented evidence. A lower risk function can rely on unscripted testing, exploratory testing and the vendor's own testing, with a short record of what was done and the result.
What Part 11 still requires
CSA does not remove 21 CFR Part 11. Audit trails, unique logins, electronic signatures and record controls still apply. CSA changes how much testing you document, not those controls.
Updating your SOPs
- Rewrite the validation SOP around intended use and risk.
- Update the risk assessment template so it drives the testing approach.
- Define when unscripted testing is acceptable and what record it needs.
- Say how vendor documentation is assessed and used.
- Carry the same logic into change control and release impact assessments.
QFS offers a fixed price CSA Risk Assessment and CSV and CSA validation, and Veeva Vault validation.