CSVCOPProve your lab workstations stayed compliant — every day, not just for the audit
CSVCOP applies 97 individually documented Windows controls to a laboratory workstation, restores any control that drifts within 30 seconds, and keeps a written, tamper-evident record of every attempt — with no internet connection required, ever. SEK RAW Business Services is the authorised distributor for India and the United States, handling quotations, purchase orders, invoicing and renewals.
A policy setting is a promise. Nothing was keeping it.
Without CSVCOP
Group Policy describes how a workstation should be configured. It does not stop an operator from changing it back, and nothing re-checks that the setting held between one audit and the next — so "compliant" is only ever true on the day someone last looked.
With CSVCOP
A background service re-verifies all 97 controls every 30 seconds, restores anything that drifted, and writes down what changed, when, and under which account — so the workstation is provably compliant on every day, not just the day of the audit.
It stays enforced
A background service re-checks all 97 controls every 30 seconds against an encrypted master and restores anything that drifted, without waiting for the next audit to notice.
It resists tampering
Copy, cut, paste, delete, rename and drag are refused at the keyboard, the toolbar and the clipboard itself — so a redesigned menu or a different Windows language can't open a gap.
It documents everything
Every configuration change, drift event and blocked attempt is written to a protected application log, a security log and the Windows Event Log, plus printable PDF reports for the validation file.
Everything CSVCOP does, from configuration to evidence
A desktop application to decide the configuration, a Windows service that keeps it true, and a small agent in every signed-in session for the things policy alone cannot reach.
Self-healing enforcement
A Windows service running as SYSTEM, starting before sign-in.
- Re-checks every control on a 30-second cycle
- Tells your own changes from tampering by version stamp
- Restores its own master from a protected backup if deleted
Session guard
Blocks the effect, not the menu — works the same on any layout.
- Keys, toolbar buttons, drag-and-drop and the clipboard itself
- Rename closed by every route; deletes restored automatically
- Cannot be ended, suspended or tampered with by a standard user
Audit trail & reports
Three independent, protected records of everything that happens.
- Application log — sign-ins, changes, user administration
- Security log — drift events and blocked attempts, by the service
- Printable PDF configuration and activity reports
USB & removable storage
Controls 60–64 and 86, plus a per-device whitelist.
- Deny all, or deny writing only
- Portable devices controlled separately from disks
- Whitelist an exact device by its hardware identity
Access control
CSVCOP's own accounts, held to their own standard.
- Salted PBKDF2 password hashes, never stored in clear
- Rate-limited sign-in and a 20-minute idle timeout
- Re-authentication required on every Save & Apply
Offline licensing
Activation and renewal without the workstation ever going online.
- A one-way machine key identifies the PC, reveals nothing about it
- RSA-2048 signed licence, verified entirely on the workstation
- Protection is never removed when a licence expires
Restated in plain language, from a real log
The operator sees a setting that reverted itself within half a minute. The auditor sees exactly what happened — timestamped, with the account and the value found and restored.
Four steps, then it holds itself
Choose
Switch on the controls you need in Configure Controls. Each one states what it does, whom it affects and its side effects before you apply it.
Confirm
Save & Apply asks for the administrator's password again, so an unattended screen can never be used to change the lockdown.
Apply
The encrypted master is written and each control is applied at the right level — per-user policy, machine policy or security policy.
Enforce
From the next 30-second cycle the watchdog holds the state, and the session agents pick up their flags within seconds.
Mapped to § 11.10, requirement by requirement
CSVCOP supplies the workstation-level controls and the records that back them up. Your validation protocol and SOPs remain yours — this is what becomes far easier to evidence.
| Requirement | How CSVCOP helps |
|---|---|
| § 11.10(d) | Limiting access — Windows policy for the workstation, plus CSVCOP's own rate-limited administrator accounts. |
| § 11.10(e) | Audit trails — time-stamped application and security logs, written independently of the operator. |
| § 11.10(f) | Operational checks — a configuration that re-verifies itself every 30 seconds cannot silently drift between audits. |
| § 11.10(g) | Authority checks — only an authenticated CSVCOP administrator can change the lockdown, with re-authentication on every save. |
| § 11.10(h) | Device checks — removable-storage control with a per-device whitelist by hardware identity. |
| § 11.10(c) | Protection of records — masters encrypted and machine-bound; log folders writable only by SYSTEM and administrators. |
A few checkpoints your auditor is likely to ask about
| Checkpoint | Answered by |
|---|---|
| Modification and deletion of data | Session guard — keys, toolbar, drag, clipboard, rename, delete-restore |
| Access to removable storage | USB deny/read-only/whitelist controls |
| Access to the command prompt | Command prompt, PowerShell and named-program blocks |
| Change of system date and time | Time-change rights withheld from standard users |
| Access to drives | Drive visibility and access controls |
| Restrict shutdown | Shutdown menu and the underlying right, both controlled |
Send us your own auditor's checklist and we'll return it with the control numbers filled in.
One installer, no server, no domain
Windows 7 SP1 through 11, with no server or network dependency — CSVCOP runs and activates entirely on the machine, exactly the constraint most instrument PCs and air-gapped lab networks operate under.
Made for regulated workstations
21 CFR Part 11 laboratories
Pharma, biotech and diagnostics labs that need to show a workstation stayed in its validated configuration.
Instrument & shared operator PCs
One login, many operators, over years — exactly where policy alone tends to quietly drift.
Air-gapped & GxP networks
No internet needed to run, activate or renew — built for machines that are never meant to be online.
FAQ
Windows 7 SP1 through Windows 11, 32- and 64-bit, with .NET Framework 4.5 or later — already built into Windows 8 and above.
Tell SEK RAW how many workstations you need to protect
CSVCOP is licensed per workstation, for the period you choose. SEK RAW Business Services handles the quote, the paperwork and every renewal after it — for labs in India and the United States alike.
India
United States