Biotech & Life Sciences

Biosafety in Microbiological and Biomedical Laboratories (BMBL), 6th Edition

CDC and NIH advisory guidance on biosafety practices and containment levels for laboratories working with infectious agents and toxins.

Building and Fire Codes for Laboratory Facilities

Model building and fire codes used for laboratory and research facilities, published by the ICC and NFPA and adopted by state and local governments.

California Confidentiality of Medical Information Act (CMIA)

California law (Civil Code §56 et seq.) limiting how health care providers, health plans, contractors and others use and disclose medical information.

California Consumer Privacy Act (CCPA), as amended by the CPRA

California consumer privacy law, amended by the CPRA, enforced by the Attorney General and the California Privacy Protection Agency (CalPrivacy).

Clinical Laboratory Improvement Amendments (CLIA)

Federal quality standards for US laboratories testing human specimens, administered by CMS with CDC and FDA under 42 CFR Part 493.

Clinical Laboratory Improvement Amendments (CLIA) and Clinical Genetic Testing

CLIA sets federal quality standards for clinical laboratory testing on humans, including genetic tests; CMS runs the program with FDA and CDC.

Common Rule (45 CFR Part 46) and IRB Oversight

HHS regulations at 45 CFR Part 46 protecting human research subjects and governing IRB review, overseen by the Office for Human Research Protections.

Contract Drug Manufacturing under cGMP

FDA current good manufacturing practice rules as they apply to contract drug manufacturers and to quality agreements between owners and contract …

Current Good Manufacturing Practice (CGMP) for Drugs

FDA current good manufacturing practice regulations for drug manufacturing, processing, packing and holding (21 CFR Parts 210 and 211).

Cyber Insurance Readiness

Topic entry: no single framework governs cyber insurance; insurers assess cyber risk in their own underwriting. Links regulator references.

Data Retention and Secure Destruction

Index of US federal sources on records retention and media sanitization, including HIPAA documentation rules, 21 CFR Part 11 and NIST SP 800-88.

Drug Supply Chain Security Act (DSCSA)

US law setting up electronic, interoperable tracing of prescription drug packages through the supply chain, implemented by the FDA.

ESG and Sustainability Reporting Standards

Index of sustainability disclosure standards and rules, including GRI, ISSB (IFRS S1 and S2), SASB, the EU CSRD and SEC climate rules.

EU In Vitro Diagnostic Medical Devices Regulation (EU) 2017/746 (IVDR)

EU regulation for in vitro diagnostic medical devices, applicable since 26 May 2022, with legacy-device transitions running to 2027-2029.

EU Medical Device Regulation (EU) 2017/745

EU regulation setting safety and performance requirements for medical devices placed on the EU market, adopted by the European Parliament and Council.

FDA 21 CFR Part 11: Electronic Records and Electronic Signatures

FDA regulation, 21 CFR Part 11, setting criteria under which electronic records and electronic signatures are accepted in place of paper records.

FDA Artificial Intelligence-Enabled Medical Devices

FDA guidance and resources for medical devices with AI-enabled software functions, including predetermined change control plans (PCCPs).

FDA Device Software Functions and Mobile Medical Applications

FDA guidance on which software functions and mobile apps FDA regulates as medical devices and where it applies enforcement discretion.

FDA Quality Management System Regulation (21 CFR Part 820)

FDA's Quality Management System Regulation for medical device manufacturers, effective 2026-02-02, incorporating ISO 13485:2016 by reference.

Federal Risk and Authorization Management Program (FedRAMP)

GSA's government-wide program that assesses and certifies the security of cloud services used by US federal agencies.

Financial Conflict of Interest in PHS-Funded Research (42 CFR Part 50 Subpart F)

HHS rules at 42 CFR Part 50 Subpart F on managing investigator financial conflicts of interest in PHS-funded research, including NIH awards.

General Data Protection Regulation (EU) 2016/679

EU regulation on the processing of personal data, adopted by the European Parliament and Council and enforced by national supervisory authorities.

Good Clinical Practice (ICH E6(R3))

International standard for the design, conduct and reporting of clinical trials (ICH E6(R3)), issued by FDA as final guidance in the US.

Health Industry Cybersecurity Practices (HICP), HHS 405(d) Program

Voluntary cybersecurity practices for health care organizations from the HHS 405(d) program, published on the HHS Cyber Gateway.

Health Information Technology for Economic and Clinical Health (HITECH) Act

2009 US law that strengthened HIPAA privacy, security, breach notification and enforcement; HHS OCR enforces the HIPAA rules that implement it.

Healthcare Accessibility under the ADA and Section 504

Federal disability rights rules for health care under the ADA and Section 504, enforced by the HHS Office for Civil Rights and the Department of …

HIPAA Business Associate Contracts

HHS requirements and sample provisions for HIPAA business associate contracts between covered entities and their service providers.

ICH E6(R3) Good Clinical Practice

ICH's international guideline for the ethical and scientific conduct of clinical trials, revised as E6(R3), with Annex 2 adopted in June 2026.

IEC 62304 Medical Device Software: Software Life Cycle Processes

IEC international standard for medical device software life cycle processes; the current text is the 2006 edition plus Amendment 1 (2015).

IEC 62366-1 Medical Devices: Application of Usability Engineering

IEC standard for applying usability engineering to medical devices to reduce use-related risk. Current: IEC 62366-1:2015+AMD1:2020.

ISO 13485:2016 Medical Devices Quality Management Systems

International standard from ISO setting quality management system requirements for organizations involved in the medical device life cycle.

ISO 14001 Environmental Management Systems

ISO 14001:2026 is the ISO standard specifying requirements for an environmental management system, with guidance for use.

ISO 14971:2019 Medical Devices: Application of Risk Management to Medical Devices

ISO international standard for risk management across the life cycle of medical devices, including in vitro diagnostic devices; third edition 2019.

ISO 28000 Security and Resilience: Security Management Systems

ISO 28000:2022 is the ISO standard specifying requirements for a security management system, including aspects relevant to the supply chain.

ISO 9001 Quality Management Systems: Requirements

ISO international standard setting requirements for a quality management system. Current edition: ISO 9001:2026.

ISO/IEC 27001 Information Security Management Systems

ISO/IEC 27001:2022 is the ISO and IEC standard specifying requirements for an information security management system (ISMS).

ISO/IEC 27017 Information Security Controls Based on ISO/IEC 27002 for Cloud Services

ISO/IEC guidance on information security controls for cloud service providers and customers, based on ISO/IEC 27002. Current edition: 2026.

ISO/IEC 27018:2025 Protection of PII in Public Clouds

ISO/IEC guidelines for protecting personally identifiable information in public clouds where the provider acts as a PII processor. 2025 edition.

Medical Device Single Audit Program (MDSAP)

MDSAP lets one recognized auditing organization audit a device maker for the FDA, Health Canada, TGA, ANVISA and Japan's MHLW and PMDA.

Medicare Clinical Trial Policy (NCD 310.1)

CMS national coverage determination 310.1 on Medicare payment for routine costs in qualifying clinical trials.

NCI Best Practices for Biospecimen Resources

National Cancer Institute best practices for biospecimen resources: governance, collection, processing, storage, retrieval and dissemination of …

New York SHIELD Act (General Business Law §§899-aa, 899-bb)

New York law setting data security safeguards and breach notice rules for private information of New York residents, enforced by the Attorney General.

NIH Guidelines for Research Involving Recombinant or Synthetic Nucleic Acid Molecules

NIH biosafety requirements for research with recombinant or synthetic nucleic acid molecules at institutions that receive NIH support for such …

NIST Cybersecurity Framework (CSF) 2.0

NIST guidance for managing cybersecurity risk, organized into six functions: Govern, Identify, Protect, Detect, Respond and Recover.

NIST SP 800-53 Rev. 5 Security and Privacy Controls

NIST catalog of security and privacy controls for information systems and organizations, developed under FISMA. Current: Rev. 5, Release 5.2.0.

OSHA General Industry Standards (29 CFR 1910)

US Department of Labor OSHA safety and health standards for general industry workplaces, codified at 29 CFR Part 1910.

OSHA Laboratory Standard (29 CFR 1910.1450)

OSHA standard on occupational exposure to hazardous chemicals in laboratories, requiring a Chemical Hygiene Plan, training and exposure controls.

Outbreak Investigation and Infection Control

Topic entry for outbreak investigation and infection control, pointing to CDC outbreak resources and related OSHA, CMS and state requirements.

Pharmacy Licensing and DEA Registration

State pharmacy board licensure and DEA controlled substance registration under 21 CFR Part 1301 for pharmacies, practitioners and researchers.

PHS Policy and Animal Welfare Act Requirements for Animal Research (IACUC)

Federal oversight of research animal care and use: NIH OLAW administers the PHS Policy and USDA APHIS enforces the Animal Welfare Act.

Professional Liability Insurance Regulation (State Insurance Regulators and NAIC)

U.S. professional liability insurance is regulated by the states; NAIC, governed by the state insurance regulators, publishes model laws.

Public Health Reporting and Surveillance

State-mandated reporting of notifiable diseases by providers and labs to health departments, which share case data with CDC through NNDSS.

Research Data Management and FAIR Principles

Research data management and sharing practices, including the FAIR principles and the NIH Data Management and Sharing Policy for NIH-funded work.

Resource Conservation and Recovery Act (RCRA) Hazardous Waste Regulations

EPA's hazardous waste program under RCRA, which regulates hazardous waste from generation through transport, treatment, storage and disposal.

Resource Conservation and Recovery Act (RCRA) Hazardous Waste Regulations

US EPA rules under the Resource Conservation and Recovery Act for hazardous waste generation, transportation, treatment, storage and disposal.

SOC 2 (System and Organization Controls 2)

AICPA examination of service organization controls under the Trust Services Criteria: security, availability, processing integrity, confidentiality, …

Texas Medical Records Privacy Act (Health and Safety Code Chapter 181)

Texas Health and Safety Code Chapter 181, Medical Records Privacy, sets state rules for protected health information held by covered entities.

U.S. Export Controls: EAR and ITAR

U.S. export controls: the EAR, administered by Commerce's Bureau of Industry and Security, and the ITAR, administered by the State Department's DDTC.

U.S. National Pandemic Influenza Strategy and HHS Pandemic Influenza Plan

Federal pandemic influenza planning documents, including the National Strategy for Pandemic Influenza and the HHS Pandemic Influenza Plan, indexed by …

Vendor and Third-Party Risk Management

Index of US federal sources on managing vendor and supply chain security risk, including HIPAA business associate rules and NIST SP 800-161.