How to Document
a Pharma OT Network
for IQ

The IQ Documentation Problem

The most common reason a pharma OT network IQ fails or requires re-execution is not that the network is wrong — it is that the documentation is too vague to verify. A statement like "the OT network is segregated from the corporate network by a firewall" tells you nothing that can be checked on-site. What switch model? What VLAN IDs? What IP addresses? What specific firewall rules? Without that granularity, the IQ team has no baseline to compare the as-found system against.

The solution is to write the HDS network section as if it is the checklist the IQ team will work through — because that is exactly what it becomes. Every item in the HDS Section 7 (network infrastructure) generates a corresponding IQ verification step. If something is documented, it gets verified. If it is not documented specifically enough to verify, it either does not get checked (a compliance gap) or the IQ fails because the verifier cannot confirm conformance.

The Six Documents That Make Up Network IQ Documentation

Network IQ documentation on a pharma project is not a single document — it is a set of interconnected records that together provide complete traceability from design intent through as-built implementation to verified conformance. All six feed into or reference the HDS, and all six must be consistent with each other at the time of IQ execution.

Document 1: The Network Component Register

Every network device that forms part of the validated system boundary must be listed in the HDS component register — which in the QLean Framework is a section of the HDS cross-referenced against the Engineering Lists workbook (EL-SYS-001). For each device the register must capture: equipment tag, description, manufacturer, model number, installed firmware version, hostname, management IP address, physical location (rack, panel, row), and GAMP software category if applicable.

The firmware version column is the one that catches teams out. A managed switch running firmware version 15.2(7)E3 is a different validated state from one running 15.2(7)E5. Any firmware update after IQ completion is a change to the validated system and requires change control. The component register is the baseline — it fixes the firmware version that the IQ team verified, and that version cannot change without formal change control and IQ re-verification of the affected device.

Document 2: The IP Address Register

The IP address register is a complete list of every static IP address assigned within the OT network — every server, every PLC, every HMI, every network device, every printer, and any other device with a fixed address. It lives in the Engineering Lists workbook (EL-SYS-001 Sheet 7 in the QLean Framework) and is cross-referenced in HDS Section 1.3.

The IQ team uses the IP register as the baseline for the network scan. During IQ, a network scan tool is run against each subnet, and every device found is compared against the register. A device present on the network but absent from the register is an undocumented component — an IQ finding. A device in the register but not responding on the network is either powered off (should be noted in test conditions) or missing — also a finding. The register must be complete and accurate before IQ execution begins.

Document 3: The VLAN Assignment Table

The VLAN table documents every VLAN configured on the managed switch: the VLAN ID, the VLAN name, the IP subnet assigned to that VLAN, and which switch ports are assigned to which VLAN as access ports. This is the document the IQ verifier compares against the switch running configuration using show vlan brief and show interfaces switchport.

Every row in the VLAN table generates a verification step in the IQ. The IQ verifier will pull the switch configuration, find each VLAN ID, confirm the name matches, confirm the subnet matches, and confirm the port assignments match. If the as-found switch configuration has a VLAN not in the HDS table, or a port assigned to the wrong VLAN, that is a nonconformance. The fix is either to correct the switch configuration or to issue a deviation and update the HDS — but either way it must be formally resolved before the IQ can be signed off.

What the IQ Protocol Network Section Looks Like

The IQ protocol network verification section is structured as a series of numbered test steps, each with a reference to the HDS specification it is checking, the method of verification, the expected result, and a result field (Pass/Fail/Deviation) filled in on-site. The network section is typically the longest section of the IQ because there are many discrete items to verify.

The As-Built Update Requirement

The HDS must reflect the as-built state of the system — not the design intent. On a real project, the as-designed IP addresses and VLAN assignments sometimes change during installation due to site constraints, last-minute hardware substitutions, or conflicts with existing site infrastructure. Every such change must be reflected in the HDS before the IQ is executed. An IQ that verifies a configuration different from the HDS specification produces a nonconformance, not a pass.

The practical workflow is: complete installation, capture the actual configuration of every network device, update the HDS to reflect as-built state, obtain HDS re-approval if required by change control, then execute the IQ against the approved as-built HDS. Trying to execute the IQ against a design-phase HDS that has not been updated for installation changes is the most reliable way to generate a long list of nonconformances that then need deviation reports.

What the Network Diagram Must Show for IQ

The network diagram in the HDS is not a marketing diagram — it is an engineering document. The network diagram that satisfies a pharma IQ must show every device with its tag number and IP address; every connection with the medium (copper, fibre) and protocol; every VLAN boundary clearly marked; every zone label; every firewall with its tag number; and the direction of traffic flow on conduits between zones. A diagram that shows boxes and lines without IP addresses, VLAN labels, or zone boundaries cannot be used as an IQ verification tool.

The diagram does not need to be a full network engineering drawing — a clean, clear logical topology diagram at the right level of abstraction is sufficient. What it must not be is a generic template with placeholder boxes. Every element on the diagram must correspond to a real device documented in the component register with a matching tag number.