Difference between revisions of "RefWork:LIMS Buyer’s Guide for Cannabis Testing Laboratories/An RFI for evaluating cannabis testing LIMS vendors"

From CannaQAWiki
Jump to navigationJump to search
(Created as needed.)
 
(One intermediate revision by the same user not shown)
Line 1: Line 1:
<div class="nonumtoc">__TOC__</div>
__NOTOC__
<div align="center">-----Return to [[RefWork:LIMS Buyer’s Guide for Cannabis Testing Laboratories|the beginning]] of this guide-----</div>
 
==5. An RFI for evaluating cannabis testing LIMS vendors==
Whether conducting the request for information (RFI) or request for proposal (RFP) process, a quality set of questions for potential [[laboratory information management system]] (LIMS) vendors to respond to provides a solid base for helping evaluate and narrow down potential vendors. The RFI in particular is good for this sort of "fact finding," acting as an ideal means for learning more about a potential [[cannabis]] testing LIMS solution and how it can solve your [[laboratory]]'s problems, or when you're not even sure how to solve those problem yet. However, the RFI should not be unduly long and tedious to complete for prospective vendors; it should be concise, direct, and honest. This means not only presenting a clear and humble vision of your own organization and its testing and informatics goals, but also asking just the right amount of questions to allow potential vendors to demonstrate their expertise and provide a clearer picture of who they are. Some take a technical approach to an RFI, using dense language and complicated spreadsheets for fact finding. However, vendors appreciate a slightly more inviting approach, with practical questions or requests that are carefully chosen because they matter to you and your laboratory.<ref name="HolmesItsAMatch">{{cite web |url=https://allcloud.io/blog/its-a-match-how-to-run-a-good-rfi-rfp-or-rfq-and-find-the-right-partner/ |title=It's a Match: How to Run a Good RFI, RFP, or RFQ and Find the Right Partner |author=Holmes, T. |work=AllCloud Blog |date=n.d. |accessdate=02 July 2021}}</ref>
 
What follows are a carefully selected set of "questions" for cannabis testing LIMS vendors posed as, well, requests for information. This collection of questions is admittedly long. Keeping with advice about maintaining a concise RFI, you may not use all of these as part of your RFI process. Remember that an RFI is not meant to answer all of your questions, but rather is meant as a means to help narrow down your search to a few quality candidates while learning more about each other.<ref name="HolmesItsAMatch" /> Feel free to narrow this list down to those questions that are most important to your laboratory as part of this fact finding mission.
 
The primary source used to compile this selection of RFI questions is the ''[[Book:LIMSpec for Cannabis Testing|LIMSpec for Cannabis Testing]]''. That specification document was designed specifically to take a regulatory-, standards-, and guidance-based approach to how laboratory informatics systems should address the needs of cannabis testing laboratories. As such, ''LIMSpec for Cannabis Testing'' turns to [[limswiki:ASTM E1578|ASTM E1578-18]] ''Standard Guide for Laboratory Informatics'' at its core, as well as more than 70 different regulations, standards, and guidance documents. Additionally, many elements from the "LIMS functionality requirements specific to cannabis testing" section of Chapter 1 are also tapped into. Other sources used to build this RFI include:
 
* Most of the sources cited in the RFI questionnaires in Appendix 3 of the upcoming ''Choosing and Implementing a Cloud-based Service for your Laboratory''
* A solicitation document by the Oklahoma State Department of Health<ref name="OMESSolicArch19">{{cite web |url=https://oklahoma.gov/content/dam/ok/en/omes/documents/Solicitation3400001663.pdf |archiveurl=https://web.archive.org/web/20210706222146/https://oklahoma.gov/content/dam/ok/en/omes/documents/Solicitation3400001663.pdf |format=PDF |title=OMES Solicitation #3400001663 |publisher=Oklahoma Office of Management and Enterprise Services |date=27 September 2019 |archivedate=06 July 2021 |accessdate=06 July 2021}}</ref>
* A ''Labcompare'' article about LIMS and cannabis testing<ref name="WongCanna19">{{cite web |url=https://www.labcompare.com/10-Featured-Articles/355198-Cannabis-Testing-LIMS-and-Regulations/ |title=Cannabis Testing, LIMS, and Regulations |author=Wong, S.; Wood, S. |work=Labcompare |date=11 January 2019 |accessdate=06 July 2021}}</ref>
 
The ordering of the RFI questionnaire is as follows:
 
:RFI introduction
:Organization basics
:LIMS: Primary cannabis testing workflow
:LIMS: Workflow and operations maintenance and support
:LIMS: Interoperability and system performance
:LIMS: Software security, data integrity, and related policies
:Cloud infrastructure, security, and related policies
:Account management and support
:License agreements, service level agreements (SLAs), and contracts
:Service implementation
:Pricing
 
 
==RFI introduction==
If you're conducting a full RFI, you're going to lead with the standard components of an RFI, including:
 
* a table of contents;
* an honest introduction and overview of your organization, its goals and problems, and the services sought to solve them;
* details on how the RFI evaluation process will be conducted;
* the calendar schedule (including times) for related events;
* how to submit the document and any related questions about it, including response format; and
* your organization's background, business requirements, and current technical environment.
 
 
==Organization basics==
 
===Primary business objectives===
Please describe the primary business objectives for your organization.
 
 
 
 
 
 
 
===Organization history===
Please give some background on your organization's history, including how long it has been offering a cannabis testing LIMS.
 
 
 
 
 
 
 
===Financial stability===
Please provide information concerning the financial stability of your organization. If your organization is public, please include relevant documents such as annual reports and supporting financial statements. If private, please include documentation that supports the representation of your organization as a stable, profitable, and sustainable one. If not profitable, please provide details about your organization's path towards profitability.
 
 
 
 
 
 
 
===Software and services offered===
Please describe the primary LIMS solution(s) offered by your organization, particularly those which may be relevant based upon our company's stated cannabis testing needs. If the software is offered as a service or the software functionality is unlocked based upon subscriber tiers, explain the different tiers of service or functionality provided and any significant exceptions and differences separating the tier levels.
 
 
 
 
 
 
 
===Details about those LIMS solutions and services===
Please provide details about:
 
* number of clients specifically using your organization's LIMS solution(s) and related services;
* how long each of those solutions and services has been offered;
* the growth rate of those solutions and services over the prior fiscal year;
* the average historical downtime, if the LIMS is offered as a cloud-based service;
* how those solutions and services or your organization overall is ranked by market researchers and media organizations; and
* any awards received for your organization's LIMS solution(s) and related services.
 
 
 
 
 
 
 
===Vision and investment in those LIMS solutions and services===
Please provide details about the vision and future direction for choosing, developing, and implementing new technologies, development methods, and security protocols as part of your organization's product development and maintenance initiative. Additionally, discuss the level of investment made by your organization towards maintaining, updating, and upgrading those LIMS solutions and services going forward.
 
 
 
 
 
 
 
===Experience and references===
Please provide details on:
 
* how many clients you provide (or have provided) LIMS solutions and services to in the cannabis testing industry;
* whether any of them are willing to act as references for your solutions and services;
* what experience your organization has in meeting the unique regulatory requirements of the cannabis testing industry;
* any examples of past issues and risks that were mitigated in prior LIMS implementation efforts;
* any examples of clients being a learning source for improving your solutions and services; and
* any whitepapers, reports, etc. authored by your organization that are relevant to clients in the cannabis testing industry.
 
 
 
 
 
==LIMS: Primary cannabis testing workflow==
 
===Sample registration and management===
Please describe how your cannabis testing LIMS helps laboratories securely and efficiently facilitate the registration, tracking, and management of cannabis and other related sample types. Describe what metadata and identifiers are supported for registered samples, including lot number, field number, client demographics, sampling point, random selection process used, and other cannabis-specific identifiers. Additionally, briefly explain any other configurable sample registration preferences available, the level of chain-of-custody tracking provided (ideally at every single step), and sample statuses supported (e.g., does the LIMS manage sample weight reconciliation as sample material moves throughout the lab?).
 
 
 
 
 
 
 
===Core laboratory testing - Basics===
Please describe how your cannabis testing LIMS facilitates the rapid and error-free testing of cannabis-related samples. Describe the types of pre-loaded state- and local-compliant cannabis testing protocols in the system, as well as their degree of configurable measurement units and substrates/matrices. Does the same level of configurability of pre-defined test protocols apply to any client-creatable test protocols? Verify that pre-loaded protocols include testing for acid and neutral forms of cannabinoids, potency testing, strain identification, water activity, moisture content, pesticides, solvents, heavy metals, microbiological contaminates, fungi, mycotoxins, and foreign matter.
 
 
 
 
 
 
 
===Core laboratory testing - Advanced===
Please describe the level of support your cannabis testing LIMS provides in regards to unique forms of sampling and testing such as representative sampling, calibration testing, quality control testing, preventative maintenance testing, stability testing, sterility testing, compatibility testing, identity testing, proficiency testing, and service-event-related testing. Is retest workflow fully supported?
 
 
 
 
 
 
 
===Review, verification, approval, and rejection===
Please explain in brief the review, verification, approval, and rejection processes for test results built into your cannabis testing LIMS. Which of those processes can be automated and customized? Also address how flexible specification limits are within the system.
 
 
 
 
 
 
 
===Reporting===
Keeping in mind the importance of accurate and timely results reporting for cannabis testing laboratories, please describe how your LIMS facilitates such reporting. Explain the level of customization reports, including certificates of analysis, have in the LIMS. Does the system come with pre-loaded report templates based on state and local regulations affecting the lab? Additionally, describe the level of automation applied to results reporting, including feeding results to customers via email or secure web portal. If additional reporting dashboard tools for benchmarking, variance reporting, visualization are available, highlight those as well.
 
 
 
 
 
 
 
==LIMS: Workflow and operations maintenance and support==
 
===Document and compliance management===
Please describe how your cannabis testing LIMS helps clients better manage their industry- and regulation-specific compliance documentation responsibilities and requirements. Provide details about LIMS mechanisms such as document management and storage, versioning, approval and rejection, validation, auditing, signing, and disposition in relation to better meeting those compliance efforts.
 
 
 
 
 
 
 
===Resource and inventory management===
Please describe how your cannabis testing LIMS helps clients better manage their laboratory's resources (e.g., time, training, and money) and inventory (e.g., equipment, test samples, reagents, and standards). What makes your LIMS solution stand out about resource and inventory management for cannabis testing laboratories? For example, describe special features like sample weight reconciliation, disposition management, training and certification management, configurable schedulers, and cannabis-related billing management that are important to a cannabis testing laboratory.
 
 
 
 
 
 
===Miscellaneous activity management===
Please describe in brief any additional noteworthy functionality in your cannabis testing LIMS (outside of what has been mentioned so far) that supports the operations and workflow of a cannabis testing laboratory. This includes, but is not limited to, instrument maintenance and management, calibration scheduling, batch and lot management, and alarm and alert management.
 
 
 
 
 
 
 
===Quality management===
Please describe how your cannabis testing LIMS helps clients improve the quality of their processes, data, and test results. Address critical functionality such as out-of-specification (OOS) and out-of-trend (OOT) identification, nonconformance and deviation tracking, corrective action documentation and management, and quality management system documentation and management.
 
 
 
 
 
 
 
==LIMS: Interoperability and system performance==
 
===Expected level of integration or interoperability===
Please describe how you anticipate your cannabis testing LIMS solution(s) being able to readily integrate or have base interoperability with a client's other software systems, business processes, and existing data while making it easier for the client to perform their laboratory's tasks. What is the broad approach to data exchange and integration in the LIMS, including data integration concerns you expect to arise when moving client data into your system? Include information about specific software integrations (e.g., to enterprise resource planning, seed-to-sale, or other state-specific reporting systems), as well as instrument data systems connectivity for instrument systems common to cannabis testing, including chromatography, spectroscopy, spectrometry, and polymerase chain reaction systems. If possible, provide a list of specifically supported software and instrument systems.
 
 
 
 
 
 
 
===System performance and smart systems===
Please elaborate on how your cannabis testing LIMS performs under a variety of workload conditions, from a handful of samples using several integrations to large quantities of samples using 10 or more integrations. In other words, how scalable is the system? Describe what additional smart components are available—including artificial intelligence, machine learning, predictive maintenance, and monitoring components—in the LIMS to help cannabis testing labs further improve laboratory workflow and overall system performance.
 
 
 
 
 
 
 
==LIMS: Software security, data integrity, and related policies==
 
===Internal security policy and procedures===
Please describe your internal policy and procedure (P&P) regarding security within your organization, including any standards your organization has adopted as part of that P&P. Address any ancillary security policies regarding, e.g., acceptable use of technology, remote and from-home work, and security awareness training.
 
 
 
 
 
 
 
===Software security policy and procedures===
Please describe your organization's P&P regarding implementing security and data integrity mechanisms within the software it develops, particularly in regards to your cannabis testing LIMS solution. Address any ancillary security policies regarding, e.g., system validation and commission and information privacy for the LIMS and its development and implementation. Be sure to address system characteristics such as audit trails and versioning, as well as how that and other related functionality support ALCOA principles.
 
 
 
 
 
 
 
===Administrational security configurations===
Please provide details regarding how your organization's cannabis testing LIMS allows for flexible yet robust configuration of security controls within system. Be sure to address configurable elements such as granular access controls, inactivity timeouts, password requirements, authentication rules, validation rules, etc. as they relate to the LIMS.
 
 
 
 
 
 
 
===Cybersecurity and information privacy===
Please describe how your cannabis testing LIMS helps users better meet their organizational cybersecurity requirements. Discuss any relevant communication and encryption protocols, authentication mechanisms, access prevention mechanisms, de-identification tools, etc. that are embedded into the offering. If an organization stores personal health information or other sensitive data in your LIMS, how is its reception and transmission protected using these and other mechanisms, particularly in light of the regulatory requirements affecting cannabis testing labs?
 
 
 
 
 
 
 
==Cloud infrastructure, security, and related policies==
'''Note''': This section applies only to those vendors offering their cannabis testing LIMS using the software as a service (SaaS) model, providing it via the cloud using their own cloud infrastructure or a third party's cloud infrastructure.
 
===Cloud host security policy and procedures===
Please describe the cloud host's—whether it be your organization or a third-party organization—internal policy and procedure (P&P) regarding in-house security, including any standards the organization has adopted as part of that P&P. Address any ancillary security policies regarding, e.g., acceptable use of technology, remote and from-home work, and security awareness training.
 
 
 
 
 
 
 
===Business continuity and disaster recovery policy===
Please describe the cloud host's—whether it be your organization or a third-party organization—P&P regarding business continuity and disaster recovery.
 
 
 
 
 
 
 
===Data centers and related infrastructure===
Please describe how the cloud host—whether it be your organization or a third-party organization—organizes its data centers and related infrastructure to optimally provide its cloud computing and cloud-related services. Additionally, address concerns about:
 
* whether or not the organization owns and manages the data centers;
* where those data centers are located;
* where our data will be located;
* what specifications and encryption types are used for in-transit and at-rest data;
* what level of availability is guaranteed for each data center;
* what level of redundancy is implemented within the data centers;
* what disposal and data destruction policies are in place for end-of-life equipment;
* how that redundancy limits service interruptions should a particular data center go offline;
* what level of cloud-based scalability is available to clients with growth or contraction states; and
* what qualifications and certifications apply to each data center.
 
 
 
 
 
 
 
===Physical security at data centers===
Please describe the physical security (e.g., locks, badges, physical security perimeters, surveillance systems, etc.) and continuity (e.g., fire suppression, backup power, etc.) measures put in place at the cloud host's—whether it be your organization or a third-party organization—data centers. Also address visitor procedures and how they are conducted. How are unauthorized access attempts at data centers responded to?
 
 
 
 
 
 
 
===Staffing at data centers===
Please describe the staffing procedures at these data centers, including what percentage of overall staff will actually have authorized access to client data. Clearly define any implemented classifications of staff based on level of support or data sensitivity, as well as any related certifications and training required at each support or data sensitivity level. Are contractors treated any differently? Finally, describe what background checks or screening procedures, if any, are implemented towards any organizational personnel and third-parties (e.g., contractors, service technicians) interacting with systems containing client data.
 
 
 
 
 
 
 
===Independent infrastructure review===
If the cloud host—whether it be your organization or a third-party organization—has received an independent review of its cloud infrastructure and services (e.g., SOC 2), please provide details of this review, preferably with the full report, but if not, with critical details such as who, what, when, where, scope, frequency of testing, and a summary. If the cloud host has not completed such an independent review, please provide details of any plans or ongoing efforts towards such a review.
 
 
 
 
 
 
 
===Internal infrastructure review===
If the cloud host—whether it be your organization or a third-party organization—has performed an internal review of its cloud infrastructure and services, please provide details of this review, with critical details such as who, what, when, where, scope, frequency of testing, and a summary. If the cloud host has not completed such an internal review, please provide details of any plans or ongoing efforts towards such a review. If the cloud host conducts internal "red team" or "attack-and-defense" exercises, describe them, their frequency, and how resulting information is acted upon.
 
 
 
 
 
 
 
===Auditing of your operations===
If the results of the cloud host's—whether it be your organization or a third-party organization—independent and/or internal review cannot be shared, will the cloud host allow us to—on our own or through a third party—audit cloud host operations, with the goal of determining the appropriateness of the cloud host's implemented safeguards?
 
 
 
 
 
 
 
===Auditing of client data===
Please describe how the cloud host—whether it be your organization or a third-party organization—handles requests from outside entities for client data and notifies clients when such requests are made. If subpoenas, court orders, search warrants, or other law enforcement actions were to take place, describe how the cloud host would maintain any privileged, confidential, or otherwise sensitive information as being protected. Does the cloud host have legal representation should these issues arise?
 
 
 
 
 
 
 
===Extraction of client data===
Please explain how clients may extract data from the cloud host's—whether it be your organization or a third-party organization—service (i.e., address data portability) on-demand, including particulars about data formats and transfer methods.
 
 
 
 
 
 
 
==Account management and support==
 
===Account management basics===
Please describe how accounts are established with your organization and what level of visibility clients and their authorized users will have into account details, including service metrics, security metrics, and various account logs.
 
 
 
 
 
 
 
===Support basics===
Please describe your organizational approach to client support and how that support is structured, including the processes and mechanisms for handling client inquiries and issues. Describe the communication mechanisms primarily and secondarily used for support, including mailed documentation, phone calls, electronic communication, and face-to-face communication. Explain how the escalation process for inquiries and reported issues should be handled.
 
 
 
 
 
 
 
===Help desk and support ticketing===
Please indicate what help desk or ticketing functionality is available for clients having issues with the LIMS solution and any related services (e.g., if SaaS). Describe how clients should go about using such tools to initiate the support process. Do clients receive comprehensive downtime support in the case of solution or service downtime?
 
 
 
 
 
 
 
===Availability, provisioning, and responsiveness===
Please indicate the availability of your organization's support services, including hours offered. Also indicate who is provisioning the service, whether it's in-house or a third party, and from where the service is provisioned. Note whether or not support services change hands at any point. Finally, describe how support quality is guaranteed at all times, including any guarantees on responsiveness.
 
 
 
 
 
 
 
===Client satisfaction===
Please describe how your organization measures and reports (including frequency) client satisfaction with support, account, and overall services. Describe how deficiencies in client satisfaction are addressed and resolved within the organization.
 
 
 
 
 
 
 
===Ancillary services===
Please indicate whether or not your organization provides value-added support services, and if so what type. Can a dedicated account manager with sufficient technical knowledge be provided, and if so, at what cost?
 
 
 
 
 
 
 
==License agreements, service level agreements (SLAs), and contracts==
 
===License and SLA basics===
Please describe the details of any applicable license agreements and SLAs (e.g., if SaaS) for the various LIMS products and services you provide, including any negotiable aspects of those agreements. Provide examples. Any relevant measurements and ranges for work performed by you (e.g., response times, accuracy) should also be clearly defined and stated. Explain what the cost implications related to any differing license or service levels are. Finally, explain whether or not your organization provides clients with a 30-day proof of concept test of the LIMS and any related services to ensure your organization can prove its marketing and operational claims.
 
 
 
 
 
 
 
===SLAs for SaaS===
In the case of SaaS-related LIMS cloud agreements (if applicable) with your organization, please explain how software customization, upgrades, testing, and versioning are addressed in such agreements.
 
 
 
 
 
 
 
===Agreement failure===
Please explain how your organization monitors and measures its compliance with agreements, as well as client compliance with agreements. Describe what options are available to clients and your organization upon the other party failing to meet an agreed-upon term.
 
 
 
 
 
 
 
===Business associate agreements===
If your organization's cannabis testing LIMS is offered via the cloud, state whether or not the hosting organization—whether it be your organization or a third-party organization—will sign a business associate agreement or addendum for purposes of ensuring the hosting organization appropriately safeguards protected health information, as dictated by the Health Insurance Portability and Accountability Act (HIPAA).
 
 
 
 
 
 
 
===Contract termination===
Please describe what happens with a client and their data at contract termination. If the cannabis testing LIMS is a cloud solution, the hosting provider—whether it be your organization or a third-party organization—should be able to explain their policy on archiving, deleting, and helping transition client data from any of their systems upon contract termination, including particulars about data formats, deletion methodologies, and transfer methods. Any explanation should include the respective termination rights of both the organization and the client.
 
 




<div align="center">-----Return to [[RefWork:LIMS Buyer’s Guide for Cannabis Testing Laboratories|the beginning]] of this guide-----</div>


==4. LIMS acquisition, implementation, and support==
So you've looked at what adding a [[laboratory informatics]] solution to your [[cannabis]] testing [[laboratory]] can do for you and your [[workflow]], and you're now considering a [[laboratory information management system]] (LIMS) for your lab. This can be an intimidating step, particularly if you have little in the way of in-house expertise in integrating informatics into the lab. How expensive will it be? What are the differences between adding an on-premises solution vs. a cloud solution? How difficult will it be to learn the system? What if the implementation goes wrong, costing even more? Will we really see any added benefit to adding a LIMS to the lab? These and other questions may fearfully get asked as you and your team venture forth into unfamiliar territory. However, know that you won't be the first lab to take this step, and you won't be the last. Stable LIMS vendors with personnel representing decades of experience have assisted labs of all types with these and other questions time and time again, and the best vendors will have the added industry-specific experience to understand and tailor LIMS selection and implementation to the nuances of your lab.


That said, you won't be relying solely on a vendor to walk you through every step of the process. The cannabis testing industry inevitably places demands on the laboratory manager and its staff to know and follow the standards, regulations, and accreditation procedures associated with the industry. Your lab should have already met or is on the way to meeting those demands, nearly set to take on new challenges, including integrating a LIMS into your lab's workflow. While the vendor and related consultants can provide vital help in the overall process, a chunk of the onus will fall on you and your team. That means understanding your business' mission, goals, budget, in-house knowledge, and procedures, as well as basic information about software acquisition, implementation, and maintenance, both short- and long-term. And, of course, you'll want to know more about the significant vendors providing clear information about how their LIMS meets the needs of a cannabis testing lab. This is often achieved by either contacting vendors directly and asking for details, or by submitting a request for information (RFI; more on that later) that attempts to draw in vendors to respond with more information about their LIMS and how it solves your lab's problems. This chapter will help guide you on that journey.


===4.1 Business considerations===
===Organization termination or catastrophic loss===
[[File:Jimmy Panetta meeting with Office of the Special Inspector General for Afghanistan Reconstruction.jpg|right|350px]]Before contacting LIMS vendors, your lab should first be considering a few business matters and asking important questions about how to approach LIMS acquisition. A natural starting point is reviewing the lab's overall mission statement and business goals. How does acquiring or upgrading a LIMS help accomplish the mission and goals? As we'll see in the next section, a well-implemented LIMS provides many benefits, including improving accuracy, quality, and security of laboratory data and workflows. Your business' mission and goals likely already enshrine some of those ideals. Beyond that, your lab's acquisition team should make a few additional considerations before contacting LIMS vendors.
Please describe what would happen to a client's LIMS and associated data in the event of your organization going out of business or suffering a catastrophic loss.


1. ''Acquisition and long-term maintenance budget'': Your lab's budget is, by all rights, a huge consideration when shopping for a new or replacement cannabis testing LIMS. That budget is driven by a number of factors, some of them perhaps out of the acquisition manager's control. At the heart of budgeting for a LIMS, however, will be two questions: what do you need the LIMS to do, and how many users will be simultaneously logged into the system? These two critical factors are addressed in the next section about acquisition and licensing. Yet other questions may also need to be asked. Does the budget take into account long-term maintenance and support for the system? If you'll be hosting it locally, will you have the budget for IT support and hardware? What sort of training and data migration costs do you anticipate? This is all to say that an initial budget figure may not do justice to the realities of your situation. Some preliminary scouting of the differences between a self-hosted, license-based LIMS and a cloud-hosted, software as a service (SaaS) LIMS in relation to your current IT infrastructure and staff knowledge may be required, as well as deeper considerations into the long-term costs of system ownership.<ref name="RundleHowMuch19">{{cite web |url=https://worthwhile.com/insights/2017/09/11/software-long-term-costs/ |title=How Much Does Custom Software Cost in the Long Run? |author=Rundle, D. |work=Worthwhile |date=14 May 2019 |accessdate=07 July 2021}}</ref>


2. ''Diversification of testing services'': Previously discussed in Chapter 3, be sure to address how diversified your offered services are or may eventually be. If you are an existing lab working with environmental testing, for example, does your current laboratory informatics system have the flexibility to add cannabis-related tests, protocols, and workflows? Will you be doing the footwork to add them, or will the vendor of your system support you in that effort? If you're a start-up, will your lab be focusing solely on cannabis testing and expand into other markets later, or will your test menu be broader? In most of these cases, you'll be desiring a LIMS that is flexible enough to allow for not only the testing of cannabis materials with ease, but also the expansion of your testing services into other markets as painlessly as possible. Having the ability to create and customize [[Sample (material)|sample]] registration screens, test protocols, labels, reports, specification limit sets, measurement units, and substrates/matrices while being able to interface with practically most any instrument and software system required will go a long way towards making your multi-market workflows run as smooth as silk.


3. ''In-house knowledge'': Your lab will want to consider what in-house knowledge and experience exists concerning how laboratory informatics fits into your cannabis testing lab. Does your lab have any personnel with direct experience implementing a data management system on local hardware? In the cloud? What about configuring software to match your workflows? Some labs may find they have a wealth of analytical knowledge and experience in the lab, but not a whole lot of practical informatics experience. This lack of informatics knowledge can be made up partially by choosing a quality vendor willing to patiently work with you and your designated personnel to get it right. However, it'll be your responsibility to confirm how much hand-holding the vendor will do, and what experiences they have with prior clients. (You may want to ask potential vendors for reference clients you can speak with to gain their feedback on the implementation experience.) In some cases, it may even make sense to consider working temporarily with an informatics consultant well versed in the industry.<ref name="Rundle12Quest19">{{cite web |url=https://worthwhile.com/insights/2017/10/12/software-consultant/ |title=12 Questions to Ask Before Hiring a Software Consultant |author=Rundle, D. |work=Worthwhile |date=15 May 2019 |accessdate=07 July 2021}}</ref><ref name="Forbes15Things17">{{cite web |url=https://www.forbes.com/sites/forbestechcouncil/2017/08/02/15-things-every-business-should-consider-before-buying-enterprise-software/ |title=15 Things Every Business Should Consider Before Buying Enterprise Software |author=Forbes Technology Council |work=Forbes |date=02 August 2017 |accessdate=07 July 2021}}</ref> (See Chapter 6 for some representative examples of such consultants.)


4. ''In-house buy-in of LIMS adoption'': Ensure executive management is fully on-board with LIMS acquisition and use, as well as any reasons given for how the LIMS will support the lab's stated mission and goals. Like a commitment to [[cybersecurity]], a laboratory that has leadership buy-in of a business goal-supported information management system will find it easier to "institutionalize" its adoption and use as a priority, as well as receive financial support for the system and its maintenance. And if employees see strong buy-in from leadership, they may be more inclined to put in the effort to learn how to use the system and use it to its fullest potential.<ref name="NARUCCyber18">{{cite web |url=https://pubs.naruc.org/pub/8C1D5CDD-A2C8-DA11-6DF8-FCC89B5A3204 |format=PDF |title=Cybersecurity Strategy Development Guide |author=Cadmus Group, LLC |publisher=National Association of Regulatory Utility Commissioners |date=30 October 2018 |accessdate=07 July 2021}}</ref><ref name="AshfordGetThe15">{{cite web |url=https://hbr.org/2015/01/get-the-boss-to-buy-in |title=Get the Boss to Buy In |author=Ashford, S.J.; Detert, J.R. |work=Harvard Business Review |date=January 2015 |accessdate=07 July 2021}}</ref>


5. ''Pre-planning for vendor interaction'': Pre-plan what your approach to any vendor you talk with will be. Determine what important questions should be asked both internally and with each and every vendor you make first contact with. Does the vendor communicate clearly, listen to what you have to say, and give you an opportunity to ask questions? What are their contract procedures, and does a given contract provide a clear upgrade path in the future? How strong is the vendor's short- and long-term product roadmap, and does it match with your long-term goals? Can the vendor complete a security audit of the solution? Will the vendor give you a full-feature demonstration of the software using data similar to your cannabis testing business? Is the vendor open to providing active client references for you to to contact? How ready is the vendor to respond to regulatory changes that affect the use of their cannabis testing solution?<ref name="Forbes15Things17" /><ref name="SchomakerRead19">{{cite web |url=https://www.inteltech.com/blog/20-questions-to-ask-when-buying-erp-software/ |title=Read This Before You Sign on the Dotted Line! 20 Questions to Ask When Buying ERP Software |author=Schomaker, L. |work=Intelligent Technologies Incorporated Blog |date=13 June 2019 |accessdate=07 July 2021}}</ref>




===4.2 Acquisition and licensing===
==Service implementation==
[[File:Insitu ICOMC2.jpg|right|400px]]As you and your lab contact vendors and begin discussions about their solutions, there are two primary questions to ask at the outset:


1. What do I want their LIMS to do for me?
===Implementation basics===
Please describe your approach to implementing your on-premises or cloud-based cannabis testing LIMS for clients. You should address:


2. How does their solution fit into our previously discussed budget?
* the standard timeframe for implementation and onboarding (overall average or last 10 customers);
* whether or not a dedicated point of contact will be maintained throughout implementation, to the end of the contract;
* what resources clients will require to support the implementation and throughout the contract's duration;
* what client processes and procedures your organization has found to be vital to optimal implementation and operation;
* what device and database integrations are supported in an implementation;
* whether or not unsupported devices and databases can be added for support;
* how the impact or disruption of client resources is minimized during implementation; and
* what your normalization and fine-tuning procedures are.


The answer to the first question is largely the same as most other kinds of labs. The system should provide clearly definable benefits to how you operate your cannabis testing laboratory. As discussed, these expected benefits should tie in with your overall business mission and goals. What follows are a few examples of the benefits any well-developed LIMS can provide to a lab. Whenever you go through the discovery process with a vendor, you'll be asking how their system provides these and other benefits through its functionality. A quality LIMS can provide<ref name="McLelland98">{{cite web |url=http://www.rsc.org/pdf/andiv/tech.pdf |archiveurl=https://web.archive.org/web/20131004232754/http://www.rsc.org/pdf/andiv/tech.pdf |format=PDF |title=What is a LIMS - a laboratory toy, or a critical IT component? |author=McLelland, A. |publisher=Royal Society of Chemistry |page=1 |date=1998 |archivedate=04 October 2013 |accessdate=07 July 2021}}</ref><ref name="SciCompRisksBens">{{cite journal |title=Industry Insights: Examining the Risks, Benefits and Trade-offs of Today’s LIMS |journal=Scientific Computing |author=Joyce, J.R. |issue=January/February 2010 |pages=15–23 |year=2010}}</ref>:


* increased accuracy: the minimization or elimination of transcription and other errors;
* streamlined processes: ensuring each process step in a protocol/method is completed in the proper order, with all requirements met, updating sample statuses automatically;
* automation: integration with instruments, allowing for automatic uploading of samples and returning of results;
* regulatory and standards compliance: functionality that aids with compliance, including reporting results to state and local authorities;
* data security: role-based, configurable, secure access to data, processes, reporting, etc.;
* flexible reporting: reporting tools that allows for the design and generation of certificates of authority and other reports to lab- and regulation-based specs;
* instant data retrieval: query tools for finding data instantly according to any criteria (date range, test, product type, etc.); and
* configurability and cost-effectiveness: a user-configurable system (as opposed to hard-coded, requiring development for any modifications) that is flexible enough to adapt to rapid changes in test volume and type over time, without breaking the bank.


Addressing the second question concerning budget is more difficult, as a cannabis testing LIMS comes in all kinds of price ranges. How are you supposed to judge if the system, as priced, is appropriate for your lab and its budget? Know that there are some basic cost realities associated with LIMS acquisition<ref name="CSolsHowMuch17">{{cite web |url=https://www.slideshare.net/CSolsInc/how-much-does-a-lims-cost-licensing-and-beyond-pittcon-2017-tech-talk |title=How Much Does a LIMS Cost? Licensing and Beyond |author=Rosenberg, H.J. |work=SlideShare |date=28 March 2017 |accessdate=07 July 2021}}</ref><ref name="CSolsSaving18">{{cite web |url=https://www.csolsinc.com/blog/saving-costs-with-lims/ |title=Saving Costs with LIMS |publisher=CSols, Inc |date=25 October 2018 |accessdate=07 July 2021}}</ref>, which will help you understand where the vendor price comes from, and how it figures into your lab's budget.


:1. Vendor pricing is generally based on how many will be using the LIMS. This can be measured in concurrent users (how many will be using the LIMS at any one time) or named users (the number of total users who will ever use the LIMS, by name). Additionally, cannabis testing LIMS vendors increasingly offer the option of a cloud-hosted subscription, which of course has the advantage of not requiring  your own IT department, and allowing labs to defray cost over time, with little or no actual license fee. Think about your usage strategy and choose the pricing format that makes the most sense for you.


:2. Most costs are related to the work involved with installing, configuring, and migrating data to the LIMS. Try to choose a solution that has what you need out of the box, as much as possible. The more customized or unique options you ask for up-front, the more it tends to cost, as extra items are a function of the time it takes developers to add them.


:3. "User-configurable" beats "vendor-configurable" on cost-effectiveness. Many LIMS vendors offer a free or low-cost option, but don't be fooled. They are in business to make money, and they are counting on the fact that you'll need to pay them to make things work, add necessary functionality, and provide support and training. If you can find a vendor who offers a genuinely user-configurable LIMS, and whose manuals and other support materials are clearly helpful and available so that you can adjust things the way you want, when you want, then that will go a long way toward budget efficiency and longevity.


:4. Additional interfaces and reporting requirements cost money. If necessary, consider phasing in any additional instrument and software interfaces over time, as revenue eases cash flow. You can go live with your LIMS operations more quickly, entering results manually until you can afford to interface your instruments one-by-one. This goes for reports as well; a simple reporting module that meets regulatory requirements will do. You can make your reports and [[Certificate of analysis|certificates of analysis]] (COAs) more attractive later.
===Completion and handoff===
Please describe what steps are taken to ensure the implementation is complete, as well as how the software or service is handed off to the client afterwards. If your organization provides training and documentation at handoff, describe how this training and documentation is administered, and at what additional cost, if any.


Ideally, your budget has room for roughly $40- to $80,000 minimum (including setup, training, interfaces, etc.) for a decent, bang-for-your-buck professional LIMS, with $300 to $900 per month (depending on number of users) for ongoing subscriptions. At around five concurrent users, the economics start to favor purchasing perpetual licenses rather than paying for a subscription. Purchased licenses will also entail ongoing annual or monthly costs as well (e.g., maintenance, support, warranty for updates etc.) Subscriptions (if available) are generally aimed at smaller labs. If you will be growing and scaling up, it may be a great way to get started, but make sure you have the option to switch to perpetual licenses later.


'''Additional considerations'''


In addition to those two primary questions, you'll want to make a few more acquisition-related considerations when working with vendors. First, can the vendor provide a full demonstration of their software, addressing your own requirements at the same time? You likely are familiar with all of your lab's or potential lab's processes and methods, as well as the regulations that drive them, but that doesn't mean you necessarily have a full understanding of how a cannabis testing LIMS fits in to those processes and methods. That's where a knowledgeable and prepared vendor steps in. A quality developer already generally understands your kind of lab but will ask you a lot of questions about exactly how you do things. It's the exceptions that need catering to. Sitting in on a live, interactive demo that can be recorded—so you can review and share it with others later—is a great context for exploring how the LIMS performs the functions your lab requires. Being live, you can also see just how it performs in real time, and you can ask as many hypotheticals as you like. That kind of scenario can go a long way towards giving you a real feel for its suitability. Additionally, both you and the vendor can gain a concept of budget and how the LIMS fits with it, based on what your lab does, what you want the LIMS to do, and how it is implemented.<ref name="HammerHowTo19">{{cite web |url=https://www.striven.com/blog/erp-software-demo |title=How to Get the Most Value from an ERP Software Demo |author=Hammer, S. |work=The Takeoff |date=27 June 2019 |accessdate=07 July 2021}}</ref>


Second–after the demo—you should consider developing your requirements list or specification. By proceeding with this after the demo, a common error is avoided: too often labs think the first thing they must do is create a requirements list, then sit back and let the LIMS vendors tell them how they meet it. As mentioned earlier, even though they understand their processes, most labs don't have as strong a grasp on the informatics portion. Participating in a demo before creating the requirements list—or having only a minimal yet flexible requirements list during the demo—is a great way to later plug in the LIMS features you have seen demonstrated to your lab's processes and needs.<ref name="HammerHowTo19" /> After all, how can you effectively require cannabis testing LIMS functions if you don't fully know what such a LIMS is capable of? As for making or expanding your requirements list or specification, you may wish to turn to the ''[[Book:LIMSpec for Cannabis Testing|LIMSpec for Cannabis Testing]]'', a specification document designed specifically to help vendors and buyers with the system requirements of a cannabis testing LIMS.


At this point you are much more equipped to create a requirements list or specification, which later becomes the contractual product set and scope of work (SOW) that represents the implementation of the LIMS you select.


===4.3 Implementation, maintenance, and warranty===
[[File:State Public Health Laboratory in Exton Tests for COVID-19.jpg|left|375px]]After you've selected the vendor and solution you want to work with, based on careful comparison of requirements specifications, your lab will be working on getting the solution implemented. There are two main keys to successful implementation: having an accurate SOW, as well as high team availability.


First, it should be absolutely clear in both your and the vendor's minds exactly what the delivered LIMS should look like. This is typically accomplished with a mutually agreed-upon SOW document. If possible, ask for a validation script that addresses each function and process addressed in the SOW. Read through it and make sure you agree with each test, ensuring that it is an effective measure of the LIMS function it purports to validate. If not, work with the vendor to modify it to your satisfaction. Remember, vendors are required to meet exactly what the contracted requirements are, no more or no less. If they are worded poorly, the delivered item may not match what you envisioned. Be as detailed as you can. This is also where a recorded copy of the demo you participated in comes in handy. As such, you can always use language like "per the demo" or "as demonstrated in the demo" to ensure there is no question how a feature is supposed to work for you.
===Multi-site implementations===
Please describe the process used when implementing a LIMS solution or service to a client with many geographically dispersed facilities.


Second, ensure the availability of your own implementation team. Far too many LIMS implementations drag on way past what is needed simply because the lab doesn't keep up with the process. Yes, it can at times be difficult to allocate extra time towards bringing on the new LIMS, but your team truly needs to make the time. The initial energy and impetus of the project—which in the age of cloud computing can merely take days—can disappear quickly once delays set in. Interest wanes and a once-great initiative becomes a nagging burden. The single greatest thing you can do to avoid this is allocate the right personnel to focus on successfully getting the system in place on-time and on- or under-budget. That means consistent and clear communication with the vendor's project manager, executing the required training and any configuration tasks your lab is responsible for, and signing off when tasks are complete. You may be surprised how often unsuccessful implementations are actually hinged upon the buyer not doing enough.


The implementation of a cannabis testing LIMS can be quite simple for a standard off-the-shelf instance. The minimum scenario involves one to five users, no customization, no configurations beyond standard setup (e.g., adding the lab name, logo, demographics, and any departments; authenticated users; contacts), a simple interface, and around two hours of training (online, recorded for reference). And if the solution is cloud-hosted there is no need to invest in servers, firewalls, and networking, meaning the LIMS itself can be in place and running in a few days. The rest is up to you and the availability of your personnel; figure something like a week to three weeks to go live, a little more if your schedule is tight. However, a larger, more comprehensive implementation, with many components to roll out, may occur in several phases over a period of one to three months.


All implementation phases and their deliverables have price tags associated with them. Your total cost is a function of the license fee or subscription, plus the work the vendor performs. Potential phases include (in order):


* Project management: The LIMS vendor will provide a project manager to coordinate with you and make sure all deliverables are implemented on-time and according to the contract. The cost of this is a function of their hours, which begin at the initial meeting (kickoff) and end once your system goes live and all deliverables have been met.


* Kickoff meeting: This is the initial get-together between your project manager and theirs. Review the SOW and the plan to implement it, and clarify resource and time commitments and responsibilities, making sure the schedule works for everybody.


* System installation: In the case of an onsite installation, your system administrator and the LIMS vendor's technical representatives will need to work closely to ensure this is done properly. If the vendor is hosting it for you, the system should be spun up and available for you to log into typically within a day or two.


* Gap analysis: This is the identification or verification of the requirements gap between the system "as installed" and the system "as fully functional" according to the contract. There should not be any surprises here. If there are unwelcome surprises from the vendor, they should rectify them promptly and at no extra charge.
===Updates and releases===
Please describe the expected frequency and approach to providing and implementing security updates and versioned releases for your LIMS.


* Work plan (system acceptance test plan): This is the deliverable that spells out essentially what was discussed in the kickoff meeting, with the gap analysis factored in. The work plan is the goalpost towards which you both work to get to a fully functional, contractually complete system. It should include all tasks, including your verification and sign-off of each deliverable.


* LIMS administrator training: Whether a small and simple setup or something more complex, this phase is critical. If at all possible, receive the training online and record it. That way you can refer to it as often as you need to, and also use it to train new administrators. Additionally, it's a lot cheaper than paying the vendor to train you onsite.


* Configuration and customization: This is really the bulk portion of implementation. It includes the standard configuration of your cannabis testing LIMS, plus any extras: instrument interfaces, software interfaces, custom certificates of analysis and other report types, screen modifications, new fields, requested additional tests, custom notifications and alerts, web portal configuration, and any additional training.


* System validation and acceptance: This should occur throughout the implementation as you sign off on each completed task. As such, the final acceptance of the complete system is simply a matter of final overall review and sign-off. A more comprehensive validation involves test scripts for each function, and you will need to go through each, noting pass/fail and any comments. If more work is needed to bring things up to full acceptance level, the vendor (or you, if it was your responsibility) should apply whatever resources necessary to swiftly bring the items to acceptance level.


* User training: Like administrator training, user training is essential for a professional, dedicated system like a LIMS. And in the same way, online training by job function is the most effective method, enabling recorded sessions to be referred back to by the trainees and used for follow-up and additional staff training.


* Go-live support: A successful launch is further guaranteed if the vendor's support staff is readily available during the initial "go-live" period. This may be a few days, a several weeks, or a month, depending on attributes like system complexity, number of users, sample volume, etc.


* Maintenance and support: This recurring item can be included with your monthly or annual subscription if your LIMS is a cloud-hosted solution. Otherwise, if you purchase licenses (the vendor may still offer cloud-hosting as an option later, if you want), then this is a separate annual fee. See the next subsection for more.
==Pricing==


'''Maintenance, warranty, and support'''
===Pricing basics===
Please describe how your company's pricing and payment models meet industry standard practices (e.g., payment per actual services consumed, per GB of storage, per server, per annual subscription, per user etc.). Provide pricing estimates and examples based upon the various services provided using a current published catalog, standard market pricing, and/or web enabled price calculators. Explain how any metered services are clearly reported and billed. Ensure all costs are accurately reflected, including any:


You may have heard other people's stories about an enterprise-class software deployment gone wrong. But they often go right, thanks to knowledgeable, well-prepared staff with experience in getting new software up and running in a business. The tricky part, of course, is finding a developer who both makes a quality product and is skillful in helping you get it implemented into your unique workflow. But getting your lab up and running with a LIMS isn't the stopping point. The vendor you chose should, ideally, also provide clear guidance up-front on what maintenance of your system should look like, as well as what their warranty and support services are. Something may goes wrong after go-live, even if it's months down the road, and it's good to know the vendor will have your back when it happens. In particular, downtime can be exceedingly detrimental to your testing business, affecting not only immediate customer satisfaction but also your reputation.  
* underlying "implied" costs,  
* initial "stand up" costs,  
* ongoing maintenance or subscription costs,  
* renewal-related price increases
* data download costs, and  
* termination costs.


That said, it's usually wise to include a maintenance and support plan as part of your acquisition, at least for the first few years of service, so that critical updates and upgrades get implemented when required. Having a package that includes support hours also helps your users become more comfortable and proficient with the system, especially early on. Cost usually is around 15-20% of the original license fee annually. If the LIMS is a cloud-hosted software as a service (SaaS) system, then these are typically rolled in with the annual or monthly subscription (and are typically less costly anyway, since it's easier for the vendor to access and work with the system). The plan should include a specific number of support hours (check how many), and it should include updates and upgrades (maintenance), as well as unlimited free fixes of any bugs (warranty). Warranties may vary considerably from vendor to vendor, however, so ensure you fully understand what is warrantied with your LIMS acquisition and implementation.


===4.4 LIMS solutions for cannabis testing labs===
The previous chapter examined informatics in the cannabis lab, as well as specific functionality considerations of a cannabis testing LIMS. And in this chapter we've looked at the acquisition and implementation process itself. At this point, you may be asking what LIMS options are actually out there. After all, there are hundreds of vendors out there vying for your dollars. But how many of them explicitly describe how their LIMS meets the needs of the cannabis testing industry?


Table 1 lists 19 solutions that have been found to be publicly marketed—via a vendor website—as specifically offering features that support the cannabis testing laboratory. This means the vendor isn't simply saying their solution serves the cannabis testing industry and leaving it at that. Their websites have been found to explain in more detail how their solution meets those industry needs.


{|
| STYLE="vertical-align:top;"|
{| class="wikitable" border="1" cellpadding="5" cellspacing="0" width="80%"
|-
  | style="background-color:white; padding-left:10px; padding-right:10px;" colspan="2"|'''Table 1.''' Known LIMS solutions publically marketed as addressing the needs of cannabis testing labs
|-
  ! style="background-color:#e2e2e2; padding-left:10px; padding-right:10px;"|LIMS solution
  ! style="background-color:#e2e2e2; padding-left:10px; padding-right:10px;"|Developer
|-
  | style="background-color:white; padding-left:10px; padding-right:10px;"|[[ApolloLIMS]]
  | style="background-color:white; padding-left:10px; padding-right:10px;"|Common Cents Systems, Inc.
|-
  | style="background-color:white; padding-left:10px; padding-right:10px;"|[[Bika LIMS]]
  | style="background-color:white; padding-left:10px; padding-right:10px;"|Bika Lab Systems (Pty) Ltd and<br />the SENAITE Foundation
|-
  | style="background-color:white; padding-left:10px; padding-right:10px;"|[[CannabLIS]]
  | style="background-color:white; padding-left:10px; padding-right:10px;"|Cannabliss New England, LLC
|-
  | style="background-color:white; padding-left:10px; padding-right:10px;"|[[CannaLIS]]
  | style="background-color:white; padding-left:10px; padding-right:10px;"|Specialty Testing Solutions Ca, LLC
|-
  | style="background-color:white; padding-left:10px; padding-right:10px;"|[[CannaQA LIMS]]
  | style="background-color:white; padding-left:10px; padding-right:10px;"|LabLynx, Inc.
|-
  | style="background-color:white; padding-left:10px; padding-right:10px;"|[[CGM LABDAQ]]
  | style="background-color:white; padding-left:10px; padding-right:10px;"|CompuGroup Medical AG
|-
  | style="background-color:white; padding-left:10px; padding-right:10px;"|[[CloudLIMS|CloudLIMS and FreeLIMS]]
  | style="background-color:white; padding-left:10px; padding-right:10px;"|CloudLIMS.com, LLC
|-
  | style="background-color:white; padding-left:10px; padding-right:10px;"|[[Confident Cannabis LIMS]]
  | style="background-color:white; padding-left:10px; padding-right:10px;"|CC Software, LLC
|-
  | style="background-color:white; padding-left:10px; padding-right:10px;"|[[Element LIMS]]
  | style="background-color:white; padding-left:10px; padding-right:10px;"|Promium, LLC
|-
  | style="background-color:white; padding-left:10px; padding-right:10px;"|[[HORIZON LIMS]]
  | style="background-color:white; padding-left:10px; padding-right:10px;"|HORIZON Lab Systems, LLC
|-
  | style="background-color:white; padding-left:10px; padding-right:10px;"|[[LabWare GROW]]
  | style="background-color:white; padding-left:10px; padding-right:10px;"|LabWare, Inc.
|-
  | style="background-color:white; padding-left:10px; padding-right:10px;"|[[LabFlow]]
  | style="background-color:white; padding-left:10px; padding-right:10px;"|AINZ Corp.
|-
  | style="background-color:white; padding-left:10px; padding-right:10px;"|[[LIMS ABC]]
  | style="background-color:white; padding-left:10px; padding-right:10px;"|BGASoft, Inc.
|-
  | style="background-color:white; padding-left:10px; padding-right:10px;"|[[Lockbox LIMS]]
  | style="background-color:white; padding-left:10px; padding-right:10px;"|Third Wave Analytics, Inc.
|-
  | style="background-color:white; padding-left:10px; padding-right:10px;"|[[Matrix Gemini]]
  | style="background-color:white; padding-left:10px; padding-right:10px;"|Autoscribe Informatics, Inc.
|-
  | style="background-color:white; padding-left:10px; padding-right:10px;"|[[Omega LIMS]]
  | style="background-color:white; padding-left:10px; padding-right:10px;"|Khemia Software, Inc.
|-
  | style="background-color:white; padding-left:10px; padding-right:10px;"|[[QBench]]
  | style="background-color:white; padding-left:10px; padding-right:10px;"|Junction Concepts, Inc.
|-
  | style="background-color:white; padding-left:10px; padding-right:10px;"|[[QLIMS]]
  | style="background-color:white; padding-left:10px; padding-right:10px;"|OnQ Software Pty. Ltd.
|-
  | style="background-color:white; padding-left:10px; padding-right:10px;"|[[reLIMS]]
  | style="background-color:white; padding-left:10px; padding-right:10px;"|Carobar Business Solutions, LLC
|-
|}
|}


There may in fact be other vendors out there whose solution meets the needs of a cannabis testing laboratory, but it will ultimately be up to you to either discover them or draw such vendors in to explain how their solution meets your needs. This is where the value of the previously mentioned RFI comes in. Several approaches can be taken with an RFI, by publishing it in strategic locations on the internet to be found by vendors, or even sending it directly to vendors you've scouted ahead of time. In the end, the RFI isn't meant to be a means of grabbing every single detail about a vendor's cannabis testing LIMS but rather a means to further filter your vendor options down to a handful of companies who may be able to meet your lab's specific needs.


The next chapter discusses the value of the RFI and lists a wide variety of possible questions you may want to pose in your RFI, with many of those questions being based off the ''[[Book:LIMSpec for Cannabis Testing|LIMSpec for Cannabis Testing]]''.


==References==
==References==
{{Reflist|colwidth=30em}}
{{Reflist|colwidth=30em}}


<div align="center">-----Go to [[RefWork:LIMS Buyer’s Guide for Cannabis Testing Laboratories/An RFI for evaluating cannabis testing LIMS vendors|the next chapter]] of this guide-----</div>
 
<div align="center">-----Go to [[RefWork:LIMS Buyer’s Guide for Cannabis Testing Laboratories/Final thoughts and resources|the next chapter]] of this guide-----</div>


==Citation information for this chapter==
==Citation information for this chapter==
'''Chapter''': 4. LIMS acquisition, implementation, and support
'''Chapter''': 5. An RFI for evaluating cannabis testing LIMS vendors


'''Edition''': Summer 2021
'''Edition''': Summer 2021
Line 190: Line 553:
'''Title''': ''LIMS Buyer’s Guide for Cannabis Testing Laboratories''
'''Title''': ''LIMS Buyer’s Guide for Cannabis Testing Laboratories''


'''Author for citation''': Shawn E. Douglas, Alan Vaughan
'''Author for citation''': Shawn E. Douglas


'''License for content''': [https://creativecommons.org/licenses/by-sa/4.0/ Creative Commons Attribution-ShareAlike 4.0 International]
'''License for content''': [https://creativecommons.org/licenses/by-sa/4.0/ Creative Commons Attribution-ShareAlike 4.0 International]


'''Publication date''': July 2021
'''Publication date''': August 2021


<!--Place all category tags here-->
<!--Place all category tags here-->

Revision as of 15:12, 21 August 2021

-----Return to the beginning of this guide-----

5. An RFI for evaluating cannabis testing LIMS vendors

Whether conducting the request for information (RFI) or request for proposal (RFP) process, a quality set of questions for potential laboratory information management system (LIMS) vendors to respond to provides a solid base for helping evaluate and narrow down potential vendors. The RFI in particular is good for this sort of "fact finding," acting as an ideal means for learning more about a potential cannabis testing LIMS solution and how it can solve your laboratory's problems, or when you're not even sure how to solve those problem yet. However, the RFI should not be unduly long and tedious to complete for prospective vendors; it should be concise, direct, and honest. This means not only presenting a clear and humble vision of your own organization and its testing and informatics goals, but also asking just the right amount of questions to allow potential vendors to demonstrate their expertise and provide a clearer picture of who they are. Some take a technical approach to an RFI, using dense language and complicated spreadsheets for fact finding. However, vendors appreciate a slightly more inviting approach, with practical questions or requests that are carefully chosen because they matter to you and your laboratory.[1]

What follows are a carefully selected set of "questions" for cannabis testing LIMS vendors posed as, well, requests for information. This collection of questions is admittedly long. Keeping with advice about maintaining a concise RFI, you may not use all of these as part of your RFI process. Remember that an RFI is not meant to answer all of your questions, but rather is meant as a means to help narrow down your search to a few quality candidates while learning more about each other.[1] Feel free to narrow this list down to those questions that are most important to your laboratory as part of this fact finding mission.

The primary source used to compile this selection of RFI questions is the LIMSpec for Cannabis Testing. That specification document was designed specifically to take a regulatory-, standards-, and guidance-based approach to how laboratory informatics systems should address the needs of cannabis testing laboratories. As such, LIMSpec for Cannabis Testing turns to ASTM E1578-18 Standard Guide for Laboratory Informatics at its core, as well as more than 70 different regulations, standards, and guidance documents. Additionally, many elements from the "LIMS functionality requirements specific to cannabis testing" section of Chapter 1 are also tapped into. Other sources used to build this RFI include:

  • Most of the sources cited in the RFI questionnaires in Appendix 3 of the upcoming Choosing and Implementing a Cloud-based Service for your Laboratory
  • A solicitation document by the Oklahoma State Department of Health[2]
  • A Labcompare article about LIMS and cannabis testing[3]

The ordering of the RFI questionnaire is as follows:

RFI introduction
Organization basics
LIMS: Primary cannabis testing workflow
LIMS: Workflow and operations maintenance and support
LIMS: Interoperability and system performance
LIMS: Software security, data integrity, and related policies
Cloud infrastructure, security, and related policies
Account management and support
License agreements, service level agreements (SLAs), and contracts
Service implementation
Pricing


RFI introduction

If you're conducting a full RFI, you're going to lead with the standard components of an RFI, including:

  • a table of contents;
  • an honest introduction and overview of your organization, its goals and problems, and the services sought to solve them;
  • details on how the RFI evaluation process will be conducted;
  • the calendar schedule (including times) for related events;
  • how to submit the document and any related questions about it, including response format; and
  • your organization's background, business requirements, and current technical environment.


Organization basics

Primary business objectives

Please describe the primary business objectives for your organization.




Organization history

Please give some background on your organization's history, including how long it has been offering a cannabis testing LIMS.




Financial stability

Please provide information concerning the financial stability of your organization. If your organization is public, please include relevant documents such as annual reports and supporting financial statements. If private, please include documentation that supports the representation of your organization as a stable, profitable, and sustainable one. If not profitable, please provide details about your organization's path towards profitability.




Software and services offered

Please describe the primary LIMS solution(s) offered by your organization, particularly those which may be relevant based upon our company's stated cannabis testing needs. If the software is offered as a service or the software functionality is unlocked based upon subscriber tiers, explain the different tiers of service or functionality provided and any significant exceptions and differences separating the tier levels.




Details about those LIMS solutions and services

Please provide details about:

  • number of clients specifically using your organization's LIMS solution(s) and related services;
  • how long each of those solutions and services has been offered;
  • the growth rate of those solutions and services over the prior fiscal year;
  • the average historical downtime, if the LIMS is offered as a cloud-based service;
  • how those solutions and services or your organization overall is ranked by market researchers and media organizations; and
  • any awards received for your organization's LIMS solution(s) and related services.




Vision and investment in those LIMS solutions and services

Please provide details about the vision and future direction for choosing, developing, and implementing new technologies, development methods, and security protocols as part of your organization's product development and maintenance initiative. Additionally, discuss the level of investment made by your organization towards maintaining, updating, and upgrading those LIMS solutions and services going forward.




Experience and references

Please provide details on:

  • how many clients you provide (or have provided) LIMS solutions and services to in the cannabis testing industry;
  • whether any of them are willing to act as references for your solutions and services;
  • what experience your organization has in meeting the unique regulatory requirements of the cannabis testing industry;
  • any examples of past issues and risks that were mitigated in prior LIMS implementation efforts;
  • any examples of clients being a learning source for improving your solutions and services; and
  • any whitepapers, reports, etc. authored by your organization that are relevant to clients in the cannabis testing industry.



LIMS: Primary cannabis testing workflow

Sample registration and management

Please describe how your cannabis testing LIMS helps laboratories securely and efficiently facilitate the registration, tracking, and management of cannabis and other related sample types. Describe what metadata and identifiers are supported for registered samples, including lot number, field number, client demographics, sampling point, random selection process used, and other cannabis-specific identifiers. Additionally, briefly explain any other configurable sample registration preferences available, the level of chain-of-custody tracking provided (ideally at every single step), and sample statuses supported (e.g., does the LIMS manage sample weight reconciliation as sample material moves throughout the lab?).




Core laboratory testing - Basics

Please describe how your cannabis testing LIMS facilitates the rapid and error-free testing of cannabis-related samples. Describe the types of pre-loaded state- and local-compliant cannabis testing protocols in the system, as well as their degree of configurable measurement units and substrates/matrices. Does the same level of configurability of pre-defined test protocols apply to any client-creatable test protocols? Verify that pre-loaded protocols include testing for acid and neutral forms of cannabinoids, potency testing, strain identification, water activity, moisture content, pesticides, solvents, heavy metals, microbiological contaminates, fungi, mycotoxins, and foreign matter.




Core laboratory testing - Advanced

Please describe the level of support your cannabis testing LIMS provides in regards to unique forms of sampling and testing such as representative sampling, calibration testing, quality control testing, preventative maintenance testing, stability testing, sterility testing, compatibility testing, identity testing, proficiency testing, and service-event-related testing. Is retest workflow fully supported?




Review, verification, approval, and rejection

Please explain in brief the review, verification, approval, and rejection processes for test results built into your cannabis testing LIMS. Which of those processes can be automated and customized? Also address how flexible specification limits are within the system.




Reporting

Keeping in mind the importance of accurate and timely results reporting for cannabis testing laboratories, please describe how your LIMS facilitates such reporting. Explain the level of customization reports, including certificates of analysis, have in the LIMS. Does the system come with pre-loaded report templates based on state and local regulations affecting the lab? Additionally, describe the level of automation applied to results reporting, including feeding results to customers via email or secure web portal. If additional reporting dashboard tools for benchmarking, variance reporting, visualization are available, highlight those as well.




LIMS: Workflow and operations maintenance and support

Document and compliance management

Please describe how your cannabis testing LIMS helps clients better manage their industry- and regulation-specific compliance documentation responsibilities and requirements. Provide details about LIMS mechanisms such as document management and storage, versioning, approval and rejection, validation, auditing, signing, and disposition in relation to better meeting those compliance efforts.




Resource and inventory management

Please describe how your cannabis testing LIMS helps clients better manage their laboratory's resources (e.g., time, training, and money) and inventory (e.g., equipment, test samples, reagents, and standards). What makes your LIMS solution stand out about resource and inventory management for cannabis testing laboratories? For example, describe special features like sample weight reconciliation, disposition management, training and certification management, configurable schedulers, and cannabis-related billing management that are important to a cannabis testing laboratory.




Miscellaneous activity management

Please describe in brief any additional noteworthy functionality in your cannabis testing LIMS (outside of what has been mentioned so far) that supports the operations and workflow of a cannabis testing laboratory. This includes, but is not limited to, instrument maintenance and management, calibration scheduling, batch and lot management, and alarm and alert management.




Quality management

Please describe how your cannabis testing LIMS helps clients improve the quality of their processes, data, and test results. Address critical functionality such as out-of-specification (OOS) and out-of-trend (OOT) identification, nonconformance and deviation tracking, corrective action documentation and management, and quality management system documentation and management.




LIMS: Interoperability and system performance

Expected level of integration or interoperability

Please describe how you anticipate your cannabis testing LIMS solution(s) being able to readily integrate or have base interoperability with a client's other software systems, business processes, and existing data while making it easier for the client to perform their laboratory's tasks. What is the broad approach to data exchange and integration in the LIMS, including data integration concerns you expect to arise when moving client data into your system? Include information about specific software integrations (e.g., to enterprise resource planning, seed-to-sale, or other state-specific reporting systems), as well as instrument data systems connectivity for instrument systems common to cannabis testing, including chromatography, spectroscopy, spectrometry, and polymerase chain reaction systems. If possible, provide a list of specifically supported software and instrument systems.




System performance and smart systems

Please elaborate on how your cannabis testing LIMS performs under a variety of workload conditions, from a handful of samples using several integrations to large quantities of samples using 10 or more integrations. In other words, how scalable is the system? Describe what additional smart components are available—including artificial intelligence, machine learning, predictive maintenance, and monitoring components—in the LIMS to help cannabis testing labs further improve laboratory workflow and overall system performance.




LIMS: Software security, data integrity, and related policies

Internal security policy and procedures

Please describe your internal policy and procedure (P&P) regarding security within your organization, including any standards your organization has adopted as part of that P&P. Address any ancillary security policies regarding, e.g., acceptable use of technology, remote and from-home work, and security awareness training.




Software security policy and procedures

Please describe your organization's P&P regarding implementing security and data integrity mechanisms within the software it develops, particularly in regards to your cannabis testing LIMS solution. Address any ancillary security policies regarding, e.g., system validation and commission and information privacy for the LIMS and its development and implementation. Be sure to address system characteristics such as audit trails and versioning, as well as how that and other related functionality support ALCOA principles.




Administrational security configurations

Please provide details regarding how your organization's cannabis testing LIMS allows for flexible yet robust configuration of security controls within system. Be sure to address configurable elements such as granular access controls, inactivity timeouts, password requirements, authentication rules, validation rules, etc. as they relate to the LIMS.




Cybersecurity and information privacy

Please describe how your cannabis testing LIMS helps users better meet their organizational cybersecurity requirements. Discuss any relevant communication and encryption protocols, authentication mechanisms, access prevention mechanisms, de-identification tools, etc. that are embedded into the offering. If an organization stores personal health information or other sensitive data in your LIMS, how is its reception and transmission protected using these and other mechanisms, particularly in light of the regulatory requirements affecting cannabis testing labs?




Cloud infrastructure, security, and related policies

Note: This section applies only to those vendors offering their cannabis testing LIMS using the software as a service (SaaS) model, providing it via the cloud using their own cloud infrastructure or a third party's cloud infrastructure.

Cloud host security policy and procedures

Please describe the cloud host's—whether it be your organization or a third-party organization—internal policy and procedure (P&P) regarding in-house security, including any standards the organization has adopted as part of that P&P. Address any ancillary security policies regarding, e.g., acceptable use of technology, remote and from-home work, and security awareness training.




Business continuity and disaster recovery policy

Please describe the cloud host's—whether it be your organization or a third-party organization—P&P regarding business continuity and disaster recovery.




Data centers and related infrastructure

Please describe how the cloud host—whether it be your organization or a third-party organization—organizes its data centers and related infrastructure to optimally provide its cloud computing and cloud-related services. Additionally, address concerns about:

  • whether or not the organization owns and manages the data centers;
  • where those data centers are located;
  • where our data will be located;
  • what specifications and encryption types are used for in-transit and at-rest data;
  • what level of availability is guaranteed for each data center;
  • what level of redundancy is implemented within the data centers;
  • what disposal and data destruction policies are in place for end-of-life equipment;
  • how that redundancy limits service interruptions should a particular data center go offline;
  • what level of cloud-based scalability is available to clients with growth or contraction states; and
  • what qualifications and certifications apply to each data center.




Physical security at data centers

Please describe the physical security (e.g., locks, badges, physical security perimeters, surveillance systems, etc.) and continuity (e.g., fire suppression, backup power, etc.) measures put in place at the cloud host's—whether it be your organization or a third-party organization—data centers. Also address visitor procedures and how they are conducted. How are unauthorized access attempts at data centers responded to?




Staffing at data centers

Please describe the staffing procedures at these data centers, including what percentage of overall staff will actually have authorized access to client data. Clearly define any implemented classifications of staff based on level of support or data sensitivity, as well as any related certifications and training required at each support or data sensitivity level. Are contractors treated any differently? Finally, describe what background checks or screening procedures, if any, are implemented towards any organizational personnel and third-parties (e.g., contractors, service technicians) interacting with systems containing client data.




Independent infrastructure review

If the cloud host—whether it be your organization or a third-party organization—has received an independent review of its cloud infrastructure and services (e.g., SOC 2), please provide details of this review, preferably with the full report, but if not, with critical details such as who, what, when, where, scope, frequency of testing, and a summary. If the cloud host has not completed such an independent review, please provide details of any plans or ongoing efforts towards such a review.




Internal infrastructure review

If the cloud host—whether it be your organization or a third-party organization—has performed an internal review of its cloud infrastructure and services, please provide details of this review, with critical details such as who, what, when, where, scope, frequency of testing, and a summary. If the cloud host has not completed such an internal review, please provide details of any plans or ongoing efforts towards such a review. If the cloud host conducts internal "red team" or "attack-and-defense" exercises, describe them, their frequency, and how resulting information is acted upon.




Auditing of your operations

If the results of the cloud host's—whether it be your organization or a third-party organization—independent and/or internal review cannot be shared, will the cloud host allow us to—on our own or through a third party—audit cloud host operations, with the goal of determining the appropriateness of the cloud host's implemented safeguards?




Auditing of client data

Please describe how the cloud host—whether it be your organization or a third-party organization—handles requests from outside entities for client data and notifies clients when such requests are made. If subpoenas, court orders, search warrants, or other law enforcement actions were to take place, describe how the cloud host would maintain any privileged, confidential, or otherwise sensitive information as being protected. Does the cloud host have legal representation should these issues arise?




Extraction of client data

Please explain how clients may extract data from the cloud host's—whether it be your organization or a third-party organization—service (i.e., address data portability) on-demand, including particulars about data formats and transfer methods.




Account management and support

Account management basics

Please describe how accounts are established with your organization and what level of visibility clients and their authorized users will have into account details, including service metrics, security metrics, and various account logs.




Support basics

Please describe your organizational approach to client support and how that support is structured, including the processes and mechanisms for handling client inquiries and issues. Describe the communication mechanisms primarily and secondarily used for support, including mailed documentation, phone calls, electronic communication, and face-to-face communication. Explain how the escalation process for inquiries and reported issues should be handled.




Help desk and support ticketing

Please indicate what help desk or ticketing functionality is available for clients having issues with the LIMS solution and any related services (e.g., if SaaS). Describe how clients should go about using such tools to initiate the support process. Do clients receive comprehensive downtime support in the case of solution or service downtime?




Availability, provisioning, and responsiveness

Please indicate the availability of your organization's support services, including hours offered. Also indicate who is provisioning the service, whether it's in-house or a third party, and from where the service is provisioned. Note whether or not support services change hands at any point. Finally, describe how support quality is guaranteed at all times, including any guarantees on responsiveness.




Client satisfaction

Please describe how your organization measures and reports (including frequency) client satisfaction with support, account, and overall services. Describe how deficiencies in client satisfaction are addressed and resolved within the organization.




Ancillary services

Please indicate whether or not your organization provides value-added support services, and if so what type. Can a dedicated account manager with sufficient technical knowledge be provided, and if so, at what cost?




License agreements, service level agreements (SLAs), and contracts

License and SLA basics

Please describe the details of any applicable license agreements and SLAs (e.g., if SaaS) for the various LIMS products and services you provide, including any negotiable aspects of those agreements. Provide examples. Any relevant measurements and ranges for work performed by you (e.g., response times, accuracy) should also be clearly defined and stated. Explain what the cost implications related to any differing license or service levels are. Finally, explain whether or not your organization provides clients with a 30-day proof of concept test of the LIMS and any related services to ensure your organization can prove its marketing and operational claims.




SLAs for SaaS

In the case of SaaS-related LIMS cloud agreements (if applicable) with your organization, please explain how software customization, upgrades, testing, and versioning are addressed in such agreements.




Agreement failure

Please explain how your organization monitors and measures its compliance with agreements, as well as client compliance with agreements. Describe what options are available to clients and your organization upon the other party failing to meet an agreed-upon term.




Business associate agreements

If your organization's cannabis testing LIMS is offered via the cloud, state whether or not the hosting organization—whether it be your organization or a third-party organization—will sign a business associate agreement or addendum for purposes of ensuring the hosting organization appropriately safeguards protected health information, as dictated by the Health Insurance Portability and Accountability Act (HIPAA).




Contract termination

Please describe what happens with a client and their data at contract termination. If the cannabis testing LIMS is a cloud solution, the hosting provider—whether it be your organization or a third-party organization—should be able to explain their policy on archiving, deleting, and helping transition client data from any of their systems upon contract termination, including particulars about data formats, deletion methodologies, and transfer methods. Any explanation should include the respective termination rights of both the organization and the client.




Organization termination or catastrophic loss

Please describe what would happen to a client's LIMS and associated data in the event of your organization going out of business or suffering a catastrophic loss.




Service implementation

Implementation basics

Please describe your approach to implementing your on-premises or cloud-based cannabis testing LIMS for clients. You should address:

  • the standard timeframe for implementation and onboarding (overall average or last 10 customers);
  • whether or not a dedicated point of contact will be maintained throughout implementation, to the end of the contract;
  • what resources clients will require to support the implementation and throughout the contract's duration;
  • what client processes and procedures your organization has found to be vital to optimal implementation and operation;
  • what device and database integrations are supported in an implementation;
  • whether or not unsupported devices and databases can be added for support;
  • how the impact or disruption of client resources is minimized during implementation; and
  • what your normalization and fine-tuning procedures are.




Completion and handoff

Please describe what steps are taken to ensure the implementation is complete, as well as how the software or service is handed off to the client afterwards. If your organization provides training and documentation at handoff, describe how this training and documentation is administered, and at what additional cost, if any.




Multi-site implementations

Please describe the process used when implementing a LIMS solution or service to a client with many geographically dispersed facilities.




Updates and releases

Please describe the expected frequency and approach to providing and implementing security updates and versioned releases for your LIMS.




Pricing

Pricing basics

Please describe how your company's pricing and payment models meet industry standard practices (e.g., payment per actual services consumed, per GB of storage, per server, per annual subscription, per user etc.). Provide pricing estimates and examples based upon the various services provided using a current published catalog, standard market pricing, and/or web enabled price calculators. Explain how any metered services are clearly reported and billed. Ensure all costs are accurately reflected, including any:

  • underlying "implied" costs,
  • initial "stand up" costs,
  • ongoing maintenance or subscription costs,
  • renewal-related price increases
  • data download costs, and
  • termination costs.




References


-----Go to the next chapter of this guide-----

Citation information for this chapter

Chapter: 5. An RFI for evaluating cannabis testing LIMS vendors

Edition: Summer 2021

Title: LIMS Buyer’s Guide for Cannabis Testing Laboratories

Author for citation: Shawn E. Douglas

License for content: Creative Commons Attribution-ShareAlike 4.0 International

Publication date: August 2021