23 CAR § 355-1410. Downloading of interface element control programs

(a) If supported, a system may utilize writable program storage technology to update interface element software if all of the following requirements are met: (1)(A) Writable program storage functionality must be, at a minimum, password-protected, and should be at a supervisor level. (B) The system can continue to locate and verify versions currently running but it cannot load code that is not currently running on the system without user intervention; (2)(A) A nonalterable audit log must record the time/date of a writable program storage download and some provision must be made to associate this log with which version or versions of code was downloaded, and the user who initiated the download. (B) A separate download audit log report would be ideal; and (3)(A) All modifications to the download executable or other file or files must be submitted to the test laboratory for approval. (B) The laboratory will assign signatures to any relevant executable code and file or files that should be verified by a regulator in the field. (C) Additionally, all downloadable files must be available to a regulator to verify the signature; and (4) The system must have the ability to verify the program on demand for regulatory audit purposes. (b)(1) The above refers to loading of new system executable code only. (2) Other program parameters may be updated as long as the process is securely controlled and subject to audit. (3) The parameters will have to be reviewed on an individual basis.