OP.EXP.4 Mantenimiento

Documentos de referencia

• Guías CCN-STIC:
  • Guía CCN-STIC-827 - Gestión y uso de dispositivos móviles
• ISO/IEC 27000
  • 27002:2013:
    • 11.2.4 - Mantenimiento de los equipos
    • 12.6.1 - Gestión de las vulnerabilidades técnicas
• NIST SP 800-53 rev4:
  • [CA-2] Security Assessments
  • [CA-7] Continuous Monitoring
  • [CA-8] Penetration Testing
  • [MA-2] Controlled Maintenance
  • [MA-3] Maintenance Tools
  • [MA-4] Nonlocal Maintenance
  • [MA-5] Maintenance Personnel
  • [MA-6] Timely Maintenance
  • [RA-5] Vulnerability Scanning
  • [SI-2] Flaw Remediation
  • [SI-4] Information System Monitoring
  • [SI-5] Security Alerts, Advisories, and Directives
• Otras referencias:
  • SANS - CIS Critical Security Controls - Version 6.1
    • CSC.4 - Continuous Vulnerability Assessment and Remediation
    • CSC.20 - Penetration Tests and Red Team Exercises
  • NIST SP 800-40 - Creating a Patch and Vulnerability Management Program
  • Manageable Network Plan
    • Milestone 6: Manage Your Network, Part I (Patch Management)

Guía de implantación

199. Proactivamente se deberá estar informado de los defectos anunciados por parte del fabricante o proveedor (como por ejemplo mediante suscripciones a listas de correo o RSS, consultando noticias en webs de tecnología, seguridad o fabricantes, etc.).

200. Deberá existir un procedimiento para establecer cuándo implantar los cambios y determinar su prioridad y urgencia proporcionada al riesgo que implica su no aplicación (cambios preaprobados, cambios de emergencia, etc.).

Implementación en Legit Health Plus

1. Estrategia de mantenimiento para dispositivo médico

1.1 Categorías de mantenimiento

Maintenance_Categories:
  Preventivo:
    Descripción: Mantenimiento programado para prevenir fallos
    Frecuencia: Mensual/Trimestral/Anual según componente
    Impacto_Clínico: Bajo (ventanas planificadas)
    Ejemplos:
      - Actualización de certificados SSL
      - Limpieza de logs y cachés
      - Optimización de bases de datos
      - Revisión de configuraciones de seguridad

  Correctivo:
    Descripción: Corrección de fallos identificados
    Urgencia: Variable según severidad
    Impacto_Clínico: Medio-Alto
    Ejemplos:
      - Parches de seguridad críticos
      - Corrección de bugs en algoritmos
      - Resolución de vulnerabilidades

  Evolutivo:
    Descripción: Mejoras y nuevas funcionalidades
    Planificación: Release cycles trimestrales
    Validación_Clínica: Requerida para cambios en IA
    Ejemplos:
      - Actualización de modelos de ML
      - Nuevas integraciones HIS/EMR
      - Mejoras de rendimiento

  Emergencia:
    Descripción: Intervenciones críticas inmediatas
    Tiempo_Respuesta: `<2 horas`
    Aprobación: Fast-track con notificación posterior
    Ejemplos:
      - Brecha de seguridad activa
      - Fallo crítico en diagnóstico
      - Pérdida de disponibilidad del servicio

1.2 Matriz de prioridad de mantenimiento

Severidad	Impacto Clínico	Tiempo Respuesta	Ventana Mantenimiento	Aprobación Requerida
Crítica	Diagnóstico erróneo posible	<2 horas	Inmediato	CMO + CTO
Alta	Funcionalidad degradada	<24 horas	Próxima ventana	CTO + QA Manager
Media	Sin impacto directo	<72 horas	Planificada	DevOps Lead
Baja	Mejoras cosméticas	<2 semanas	Release programado	Team Lead

2. Procedimientos de mantenimiento

2.1 Mantenimiento preventivo

# preventive_maintenance.py
import schedule
import time
from datetime import datetime, timedelta
import logging

class PreventiveMaintenanceScheduler:
    def __init__(self):
        self.logger = logging.getLogger(__name__)
        self.maintenance_tasks = []
        self.setup_schedule()

    def setup_schedule(self):
        """Configura el calendario de mantenimiento preventivo"""

        # Tareas diarias
        schedule.every().day.at("02:00").do(self.daily_maintenance)

        # Tareas semanales
        schedule.every().sunday.at("03:00").do(self.weekly_maintenance)

        # Tareas mensuales
        schedule.every(30).days.at("04:00").do(self.monthly_maintenance)

        # Tareas trimestrales
        schedule.every(90).days.at("05:00").do(self.quarterly_maintenance)

    def daily_maintenance(self):
        """Tareas de mantenimiento diario"""
        tasks = [
            self.check_disk_space(),
            self.rotate_logs(),
            self.verify_backups(),
            self.check_certificate_expiry(),
            self.monitor_api_endpoints(),
            self.validate_ai_model_performance()
        ]

        self.execute_tasks(tasks, "DAILY")

    def weekly_maintenance(self):
        """Tareas de mantenimiento semanal"""
        tasks = [
            self.database_optimization(),
            self.security_scan(),
            self.dependency_check(),
            self.performance_analysis(),
            self.clean_temporary_files(),
            self.validate_integrations()
        ]

        self.execute_tasks(tasks, "WEEKLY")

    def monthly_maintenance(self):
        """Tareas de mantenimiento mensual"""
        tasks = [
            self.full_system_backup(),
            self.vulnerability_assessment(),
            self.license_compliance_check(),
            self.capacity_planning_review(),
            self.disaster_recovery_test(),
            self.regulatory_compliance_check()
        ]

        self.execute_tasks(tasks, "MONTHLY")

    def check_certificate_expiry(self):
        """Verifica la expiración de certificados SSL/TLS"""
        certificates = [
            {"domain": "app.legit.health", "path": "/etc/ssl/certs/app.crt"},
            {"domain": "api.legit.health", "path": "/etc/ssl/certs/api.crt"}
        ]

        for cert in certificates:
            expiry_date = self.get_cert_expiry(cert["path"])
            days_until_expiry = (expiry_date - datetime.now()).days

            if days_until_expiry < 30:
                self.create_maintenance_ticket(
                    priority="HIGH",
                    title=f"Certificate expiring soon: {cert['domain']}",
                    description=f"Certificate expires in {days_until_expiry} days"
                )

    def validate_ai_model_performance(self):
        """Valida el rendimiento de los modelos de IA"""
        models = [
            "lesion_classifier_v2.3.1",
            "severity_scorer_v1.8.0",
            "dlqi_predictor_v1.2.4"
        ]

        for model in models:
            metrics = self.get_model_metrics(model)

            if metrics["accuracy"] < 0.90:  # Umbral mínimo de precisión
                self.create_alert(
                    severity="CRITICAL",
                    message=f"Model {model} performance degraded: {metrics['accuracy']}"
                )

                # Trigger retraining pipeline if needed
                if metrics["drift_score"] > 0.15:
                    self.trigger_model_retraining(model)

2.2 Gestión de parches y actualizaciones

# patch_management_policy.yml
Patch_Management_Policy:
  Classification:
    Critical_Security:
      Description: Vulnerabilidades explotables remotamente
      CVSS_Score: ">= 9.0"
      Deployment_Window: "`< 24 horas`"
      Testing_Required: "Smoke tests en staging"
      Approval: "CTO + Security Officer"

    High_Security:
      Description: Vulnerabilidades con impacto significativo
      CVSS_Score: "7.0 - 8.9"
      Deployment_Window: "`< 72 horas`"
      Testing_Required: "Full regression en staging"
      Approval: "DevOps Lead"

    Medical_Device_Updates:
      Description: Actualizaciones que afectan funcionalidad clínica
      Clinical_Impact: "Direct"
      Deployment_Window: "Planned maintenance window"
      Testing_Required: "Clinical validation required"
      Approval: "CMO + Regulatory Affairs"

    Routine_Updates:
      Description: Actualizaciones rutinarias sin impacto clínico
      Clinical_Impact: "None"
      Deployment_Window: "Weekly maintenance window"
      Testing_Required: "Automated testing suite"
      Approval: "Team Lead"

  Process:
    1_Discovery:
      - Automated vulnerability scanning (Qualys, Nessus)
      - Vendor security bulletins monitoring
      - CVE database tracking
      - Medical device safety notices (FDA MAUDE, EU EUDAMED)

    2_Assessment:
      - Risk scoring based on CVSS and clinical context
      - Dependency analysis
      - Compatibility testing
      - Regulatory impact assessment

    3_Testing:
      - Isolated test environment
      - Automated regression testing
      - Clinical validation (if applicable)
      - Performance benchmarking

    4_Deployment:
      - Staged rollout (canary -> staging -> production)
      - Health checks at each stage
      - Automated rollback capability
      - Real-time monitoring

    5_Verification:
      - Post-deployment validation
      - Performance metrics review
      - User feedback collection
      - Compliance documentation update

2.3 Herramientas de automatización de mantenimiento

# maintenance_automation.py
import ansible_runner
import requests
from typing import Dict, List
import yaml

class MaintenanceAutomation:
    def __init__(self):
        self.ansible_config = self.load_ansible_config()
        self.monitoring_api = "https://monitoring.legit.health/api/v1"

    def execute_maintenance_playbook(self, playbook_name: str, target_hosts: List[str]):
        """Ejecuta un playbook de Ansible para mantenimiento"""

        # Pre-maintenance checks
        if not self.pre_maintenance_checks(target_hosts):
            raise Exception("Pre-maintenance checks failed")

        # Create maintenance window in monitoring
        maintenance_id = self.create_maintenance_window(
            duration_minutes=60,
            affected_services=target_hosts
        )

        try:
            # Execute Ansible playbook
            result = ansible_runner.run(
                private_data_dir='/opt/ansible',
                playbook=f'playbooks/{playbook_name}.yml',
                inventory={'all': {'hosts': target_hosts}},
                extravars={
                    'maintenance_mode': True,
                    'backup_before_change': True,
                    'notify_users': True
                }
            )

            if result.status == 'successful':
                self.log_maintenance_success(maintenance_id, result)
            else:
                self.handle_maintenance_failure(maintenance_id, result)

        finally:
            # Close maintenance window
            self.close_maintenance_window(maintenance_id)

    def automated_patching_workflow(self):
        """Flujo automatizado de parcheo"""

        # 1. Scan for available updates
        available_updates = self.scan_for_updates()

        # 2. Classify and prioritize
        prioritized_updates = self.prioritize_updates(available_updates)

        # 3. Generate change requests
        for update in prioritized_updates:
            if update['priority'] == 'CRITICAL':
                # Fast-track critical updates
                self.create_emergency_change(update)
            else:
                # Standard change process
                self.create_standard_change(update)

        # 4. Execute approved changes
        approved_changes = self.get_approved_changes()

        for change in approved_changes:
            self.execute_patching(
                change_id=change['id'],
                target_systems=change['targets'],
                patches=change['patches']
            )

    def execute_patching(self, change_id: str, target_systems: List[str], patches: List[Dict]):
        """Ejecuta el proceso de parcheo"""

        for system in target_systems:
            # Create system snapshot
            snapshot_id = self.create_snapshot(system)

            try:
                # Apply patches
                for patch in patches:
                    self.apply_patch(system, patch)

                # Validate system health
                if not self.validate_system_health(system):
                    raise Exception(f"System health check failed for {system}")

                # Update CMDB
                self.update_cmdb(system, patches)

            except Exception as e:
                # Rollback on failure
                self.rollback_from_snapshot(system, snapshot_id)
                self.log_patching_failure(change_id, system, str(e))
                raise

3. Monitoreo y diagnóstico

3.1 Sistema de monitoreo integral

# monitoring_stack.yml
Monitoring_Components:
  Infrastructure_Monitoring:
    Tool: Prometheus + Grafana
    Metrics:
      - CPU, Memory, Disk usage
      - Network throughput and latency
      - Container health (Docker/Kubernetes)
      - Database performance
    Alerts:
      - Resource exhaustion (>80% usage)
      - Service unavailability
      - Abnormal error rates

  Application_Monitoring:
    Tool: New Relic APM
    Metrics:
      - Response times
      - Error rates
      - Transaction traces
      - Database query performance
      - AI model inference times
    Alerts:
      - Diagnostic algorithm failures
      - API endpoint degradation
      - Image processing delays

  Security_Monitoring:
    Tool: Splunk SIEM
    Events:
      - Authentication failures
      - Unauthorized access attempts
      - Configuration changes
      - Privilege escalations
    Alerts:
      - Brute force attempts
      - Data exfiltration patterns
      - Malware detection

  Clinical_Performance_Monitoring:
    Tool: Custom Medical Device Dashboard
    Metrics:
      - Diagnostic accuracy trends
      - False positive/negative rates
      - Processing time per diagnosis
      - User satisfaction scores
    Alerts:
      - Accuracy below threshold
      - Unusual diagnostic patterns
      - Clinical safety events

3.2 Dashboard de mantenimiento

// maintenance_dashboard.js
import React, { useState, useEffect } from "react";
import { LineChart, BarChart, PieChart } from "recharts";

const MaintenanceDashboard = () => {
  const [maintenanceMetrics, setMaintenanceMetrics] = useState({});
  const [upcomingMaintenance, setUpcomingMaintenance] = useState([]);
  const [systemHealth, setSystemHealth] = useState({});

  useEffect(() => {
    // Fetch real-time maintenance data
    fetchMaintenanceData();
    const interval = setInterval(fetchMaintenanceData, 30000); // Update every 30s
    return () => clearInterval(interval);
  }, []);

  const fetchMaintenanceData = async () => {
    const metrics = await api.getMaintenanceMetrics();
    const upcoming = await api.getUpcomingMaintenance();
    const health = await api.getSystemHealth();

    setMaintenanceMetrics(metrics);
    setUpcomingMaintenance(upcoming);
    setSystemHealth(health);
  };

  return (
    <div className="maintenance-dashboard">
      <div className="header">
        <h1>Legit Health Plus - Maintenance Dashboard</h1>
        <div className="compliance-status">MDR Compliant | FDA Listed | ISO 13485:2016</div>
      </div>

      <div className="metrics-grid">
        <MetricCard
          title="System Uptime"
          value={systemHealth.uptime}
          target="99.9%"
          status={systemHealth.uptime >= 99.9 ? "green" : "yellow"}
        />

        <MetricCard
          title="Patch Compliance"
          value={maintenanceMetrics.patchCompliance}
          target="100%"
          status={maintenanceMetrics.patchCompliance === 100 ? "green" : "red"}
        />

        <MetricCard
          title="MTTR"
          value={maintenanceMetrics.mttr}
          target="&lt;2 hours"
          unit="hours"
        />

        <MetricCard
          title="Vulnerability Score"
          value={maintenanceMetrics.vulnerabilityScore}
          target="<3.0"
          status={maintenanceMetrics.vulnerabilityScore < 3 ? "green" : "yellow"}
        />
      </div>

      <div className="charts-section">
        <div className="chart-container">
          <h3>Maintenance History (Last 30 Days)</h3>
          <LineChart data={maintenanceMetrics.history}>{/* Chart configuration */}</LineChart>
        </div>

        <div className="chart-container">
          <h3>System Component Health</h3>
          <BarChart data={systemHealth.components}>{/* Chart configuration */}</BarChart>
        </div>
      </div>

      <div className="upcoming-maintenance">
        <h3>Scheduled Maintenance Windows</h3>
        <table>
          <thead>
            <tr>
              <th>Date/Time</th>
              <th>Type</th>
              <th>Components</th>
              <th>Expected Duration</th>
              <th>Clinical Impact</th>
            </tr>
          </thead>
          <tbody>
            {upcomingMaintenance.map((maintenance) => (
              <tr key={maintenance.id}>
                <td>{maintenance.scheduledTime}</td>
                <td>{maintenance.type}</td>
                <td>{maintenance.components.join(", ")}</td>
                <td>{maintenance.duration}</td>
                <td className={`impact-${maintenance.clinicalImpact}`}>
                  {maintenance.clinicalImpact}
                </td>
              </tr>
            ))}
          </tbody>
        </table>
      </div>
    </div>
  );
};

4. Gestión de vulnerabilidades

4.1 Proceso de gestión de vulnerabilidades

# vulnerability_management.py
from typing import List, Dict
import nmap
import requests
from datetime import datetime, timedelta

class VulnerabilityManager:
    def __init__(self):
        self.scanner = nmap.PortScanner()
        self.cve_database = "https://cve.mitre.org/data/downloads/"
        self.medical_device_db = "https://www.fda.gov/medical-devices/databases/"

    def comprehensive_vulnerability_scan(self):
        """Escaneo exhaustivo de vulnerabilidades"""

        scan_results = {
            "timestamp": datetime.utcnow().isoformat(),
            "scan_type": "comprehensive",
            "findings": []
        }

        # 1. Network vulnerability scan
        network_vulns = self.scan_network_vulnerabilities()

        # 2. Application vulnerability scan
        app_vulns = self.scan_application_vulnerabilities()

        # 3. Dependency vulnerability scan
        dep_vulns = self.scan_dependency_vulnerabilities()

        # 4. Medical device specific vulnerabilities
        med_vulns = self.scan_medical_device_vulnerabilities()

        # 5. AI/ML model vulnerabilities
        ml_vulns = self.scan_ml_model_vulnerabilities()

        # Consolidate and prioritize
        all_vulnerabilities = network_vulns + app_vulns + dep_vulns + med_vulns + ml_vulns
        prioritized_vulns = self.prioritize_vulnerabilities(all_vulnerabilities)

        scan_results["findings"] = prioritized_vulns

        # Generate remediation plan
        remediation_plan = self.generate_remediation_plan(prioritized_vulns)

        # Create tickets for critical vulnerabilities
        for vuln in prioritized_vulns:
            if vuln["severity"] in ["CRITICAL", "HIGH"]:
                self.create_remediation_ticket(vuln)

        return scan_results, remediation_plan

    def scan_medical_device_vulnerabilities(self):
        """Escaneo específico para vulnerabilidades de dispositivos médicos"""

        vulnerabilities = []

        # Check FDA safety communications
        fda_alerts = self.check_fda_safety_alerts()

        # Check for known medical device vulnerabilities
        medical_cves = self.search_medical_device_cves()

        # Validate compliance with medical device security standards
        compliance_gaps = self.check_security_compliance()

        # Check for hardcoded credentials (common in medical devices)
        hardcoded_creds = self.scan_for_hardcoded_credentials()

        # Validate encryption of patient data
        encryption_issues = self.validate_data_encryption()

        return vulnerabilities

    def prioritize_vulnerabilities(self, vulnerabilities: List[Dict]) -> List[Dict]:
        """Prioriza vulnerabilidades según contexto clínico"""

        for vuln in vulnerabilities:
            # Base CVSS score
            base_score = vuln.get('cvss_score', 0)

            # Clinical impact multiplier
            if vuln.get('clinical_impact') == 'DIRECT':
                clinical_multiplier = 1.5
            elif vuln.get('clinical_impact') == 'INDIRECT':
                clinical_multiplier = 1.2
            else:
                clinical_multiplier = 1.0

            # Exploitability factor
            if vuln.get('exploit_available'):
                exploit_factor = 1.3
            else:
                exploit_factor = 1.0

            # Calculate priority score
            vuln['priority_score'] = base_score * clinical_multiplier * exploit_factor

            # Assign remediation timeline
            if vuln['priority_score'] >= 9:
                vuln['remediation_deadline'] = datetime.now() + timedelta(days=1)
                vuln['priority'] = 'CRITICAL'
            elif vuln['priority_score'] >= 7:
                vuln['remediation_deadline'] = datetime.now() + timedelta(days=7)
                vuln['priority'] = 'HIGH'
            elif vuln['priority_score'] >= 4:
                vuln['remediation_deadline'] = datetime.now() + timedelta(days=30)
                vuln['priority'] = 'MEDIUM'
            else:
                vuln['remediation_deadline'] = datetime.now() + timedelta(days=90)
                vuln['priority'] = 'LOW'

        return sorted(vulnerabilities, key=lambda x: x['priority_score'], reverse=True)

5. Procedimientos de recuperación

5.1 Plan de recuperación ante fallos

# disaster_recovery_plan.yml
Disaster_Recovery_Plan:
  RTO_RPO_Objectives:
    Critical_Services:
      - Service: Diagnostic Algorithm API
        RTO: 2 hours # Recovery Time Objective
        RPO: 1 hour # Recovery Point Objective
        Priority: P1
      - Service: Clinical Image Storage
        RTO: 4 hours
        RPO: 15 minutes
        Priority: P1
      - Service: User Authentication
        RTO: 1 hour
        RPO: 5 minutes
        Priority: P1

    Supporting_Services:
      - Service: Reporting Module
        RTO: 8 hours
        RPO: 1 hour
        Priority: P2
      - Service: Admin Dashboard
        RTO: 24 hours
        RPO: 4 hours
        Priority: P3

  Recovery_Procedures:
    1_Detection_and_Alert:
      - Automated monitoring alerts
      - Manual incident report
      - Health check failures

    2_Assessment:
      - Determine scope of failure
      - Identify affected components
      - Estimate recovery time
      - Notify stakeholders

    3_Recovery_Execution:
      Database_Failure:
        - Switch to standby replica
        - Restore from latest backup if needed
        - Replay transaction logs
        - Validate data integrity

      Application_Failure:
        - Rollback to previous version
        - Deploy from backup image
        - Restore configuration
        - Run health checks

      AI_Model_Corruption:
        - Load previous validated model version
        - Verify model checksums
        - Run validation dataset
        - Clinical verification required

    4_Validation:
      - System functionality tests
      - Data integrity checks
      - Clinical validation (if AI/diagnostic components affected)
      - Performance benchmarks

    5_Documentation:
      - Incident report (R-024-008)
      - Root cause analysis
      - Lessons learned
      - Update DR procedures

6. Métricas e indicadores de mantenimiento

# maintenance_metrics.py
class MaintenanceMetrics:
    def calculate_kpis(self):
        """Calcula KPIs de mantenimiento"""

        kpis = {
            # Disponibilidad
            "system_availability": self.calculate_availability(),
            "uptime_percentage": self.calculate_uptime(),

            # Rendimiento de mantenimiento
            "mtbf": self.calculate_mtbf(),  # Mean Time Between Failures
            "mttr": self.calculate_mttr(),  # Mean Time To Repair
            "mttd": self.calculate_mttd(),  # Mean Time To Detect

            # Gestión de parches
            "patch_compliance_rate": self.calculate_patch_compliance(),
            "critical_patch_deployment_time": self.avg_critical_patch_time(),
            "patch_success_rate": self.calculate_patch_success_rate(),

            # Vulnerabilidades
            "open_vulnerabilities": self.count_open_vulnerabilities(),
            "avg_vulnerability_age": self.calculate_vuln_age(),
            "vulnerability_remediation_rate": self.calculate_remediation_rate(),

            # Cumplimiento
            "maintenance_window_compliance": self.calculate_window_compliance(),
            "sla_compliance": self.calculate_sla_compliance(),
            "regulatory_compliance_score": self.calculate_regulatory_compliance()
        }

        return kpis

    def generate_monthly_report(self):
        """Genera informe mensual de mantenimiento"""

        report = {
            "period": datetime.now().strftime("%Y-%m"),
            "executive_summary": self.generate_executive_summary(),
            "kpis": self.calculate_kpis(),
            "maintenance_activities": self.get_maintenance_activities(),
            "incidents": self.get_incident_summary(),
            "upcoming_maintenance": self.get_planned_maintenance(),
            "recommendations": self.generate_recommendations(),
            "compliance_status": {
                "mdr": "Compliant",
                "fda": "Compliant",
                "iso_13485": "Compliant",
                "ens": "Compliant"
            }
        }

        return report

7. Integración con otros controles ENS

• OP.EXP.1: Actualización del inventario tras mantenimiento
• OP.EXP.2: Verificación de configuraciones post-mantenimiento
• OP.EXP.3: Actualización de baselines de configuración
• OP.EXP.5: Coordinación con gestión de cambios
• OP.EXP.7: Registro de incidentes durante mantenimiento

8. Consideraciones específicas para dispositivo médico

Validación post-mantenimiento

• Verificación de funcionalidad clínica obligatoria
• Pruebas de precisión diagnóstica con dataset de validación
• Confirmación de integridad de modelos de IA
• Documentación en DHF de todos los cambios

Comunicación con usuarios clínicos

• Notificación anticipada de ventanas de mantenimiento
• Guías de contingencia durante indisponibilidad
• Informes post-mantenimiento con cambios relevantes
• Canal dedicado para feedback clínico

9. Referencias y documentación relacionada

• T-024-008: Procedimiento de gestión de incidentes
• T-024-009: Plan de recuperación ante desastres
• T-024-010: Guía de gestión de vulnerabilidades
• GP-005: Control de cambios
• GP-013: Gestión de la ciberseguridad
• R-TF-013-002: Registro de gestión de riesgos

Signature meaning

The signatures for the approval process of this document can be found in the verified commits at the repository for the QMS. As a reference, the team members who are expected to participate in this document and their roles in the approval process, as defined in Annex I Responsibility Matrix of the GP-001, are:

• Author: Team members involved
• Reviewer: JD-003, JD-004
• Approver: JD-001