Define Raw Instrument Export Masters

01 / CONTEXT

Define the control decision

One instrument run may produce native files, vendor-project folders, CSV exports, transformed tables and local downloads. Record which raw output is authoritative, who owns it, where it resides and when acquisition ended before applying restrictions.

02 / PROCEDURE

Run the control sequence

1. 01

   Record the instrument, run identifier, operator and acquisition time without exposing research data.

2. 02

   Name the authoritative raw-export folder and native file types.

3. 03

   Separate raw masters from analysis, conversion and presentation copies.

4. 04

   Confirm required vendor software and supported storage behavior.

5. 05

   Publish the review, retention and recovery owners.

03 / EVIDENCE

Preserve proof without research data

A defensible control record identifies the export owner, acquisition source, authoritative path, expected file types, permitted accounts, restriction mode, manifest, checksum evidence, recovery owner and next review date. It should not contain sample, patient, participant, result or credential information. Use fabricated exports during every technical test.

Recheck the arrangement after changes to Windows, instrument software, storage, Folder Protect, permissions, service accounts or laboratory roles. Confirm both usability and recovery: an authorized technician should read the released export, an unauthorized account should not alter the master, and the recovery owner should restore a separately held copy without depending on the protected folder. Preserve unexpected behavior before changing controls.

Keep the claim narrow. Local restrictions may reduce accidental writing, deletion or access on a tested Windows path, but they do not encrypt data, validate scientific results, administer identities, create instrument audit trails, provide version history or replace backup. Escalate those requirements to the system and accountable owner designed to meet them.

Ask a second technician to follow the written procedure without verbal help. Record whether that person can identify the raw master, create a working copy, recognize the recorded release, interpret denied access and find the recovery owner. This usability check reveals ambiguous paths, hidden service-account dependencies and undocumented knowledge before an instrument, storage or staff change. Correct the procedure, repeat the test with fabricated data and retain only minimal evidence.

04 / BOUNDARY

State what the control cannot prove

A protected folder does not establish scientific validity, provenance, completeness, authenticity or regulatory status.

Validate the exact Windows account, instrument application, storage path and current product release. If encryption, centralized workflow, immutable history, identity governance, scientific audit trails or regulated retention are required, select systems designed for those jobs rather than broadening a desktop restriction claim.

05 / SOURCES

Primary references

• FDA: Data integrity guidance
• NIST SP 800-53 Rev. 5

References support specific controls and do not imply endorsement.