Access control has always been in Annex 11. What the draft adds is specificity. Accounts are personal and named. Privileges follow the principle of least privilege, with segregation of duties between those who configure a system and those who use it. Access is reviewed on a recurring basis. And remote access to critical systems from outside the controlled network requires multi-factor authentication.
Where companies usually fall short
Shared and generic accounts on the shop floor
Operator panels, older instruments and line equipment often still use a shared login. Where the equipment cannot support named users, the compensating controls need to be documented and the risk accepted at the right level, with a plan to replace it.
Administrator rights that never expire
Vendor engineers and project teams are granted elevated access for a go-live and keep it. A periodic review that actually removes access, rather than confirming it, is the fix.
Remote support without strong authentication
Supplier remote sessions into process control and MES environments are a known route for both errors and attacks. The draft's MFA expectation aligns GMP with what your security team already wants.
Making it work in practice
- Define roles once, in the system specification, and provision against them.
- Connect GMP systems to a central identity provider where the system supports it, so leavers are removed everywhere at once.
- Run access reviews from the system's own user list, not from a spreadsheet of what should be there.
- Log and review privileged activity separately from normal use.
Kestrel view
Access control is where IT security and GMP finally want exactly the same thing. Use one process for both and you halve the evidence you have to produce.
Sources and further reading
Regulatory status is stated as at 9 October 2026. Draft texts can change before they are finalised; always work from the current published version.