DMS

What is a DMS?

A DMS (Document Management System) is software that lets an organisation create, review, approve, distribute, retain and finally destroy documents in a controlled way, so that everyone always works with the correct, valid version. For each document, a DMS records who wrote it, who approved it, from when it applies and what changed in every revision. It is an important building block of a QMS, a GMP environment or an ISO-certified management system. In industry, a DMS manages not only procedures and work instructions but also the technical documentation of plants, such as IO lists, loop diagrams and alarm matrices.

Note: in the energy sector, DMS also stands for Distribution Management System, the software grid operators use to monitor and switch their distribution network. This article is about document management.

🧠 What does a DMS do?

A DMS supports full control over documents:

• Version control - every change gets a new version number; earlier versions remain retrievable and comparable
• Check-in and check-out - while someone edits a document, nobody else can change the same version
• Approval workflows - review and sign-off according to, for example, the four-eyes principle, with the department owner or QA as final approver
• Access management and permissions - who may read, edit, approve or destroy
• Distribution and read acknowledgement - staff receive a task or notification and confirm they have read the new version
• Audit trail - complete logging of changes, signatures and views, with timestamps
• Search and classification - metadata such as document type, department, plant and status make documents quick to find
• Retention and disposal - a retention period per document type and controlled destruction once it expires

🔄 What is the lifecycle of a document?

A DMS enforces a fixed lifecycle, so a document can never jump unnoticed from draft to effective.

Every substantive change should go through change management: assess the impact first, then revise the document.

📚 Which documents does a DMS manage?

Source code and configurations of PLCs and SCADA projects are usually kept not in a DMS but in a specialised version control system. The DMS then holds the approved specifications and test reports that belong to those versions.

📏 Which standards and regulations set requirements for document control?

In pharma, EU GMP Chapter 4 requires batch documentation to be kept for one year after the expiry of the batch or at least five years after certification by the Qualified Person, whichever is longer. In July 2025 the European Commission published draft revisions of Chapter 4 and Annex 11; until they are final, the 2011 versions apply. In the Netherlands the tax retention obligation also applies: seven years for the business administration and ten years for data on real estate.

🔗 How does a DMS relate to other systems?

In GxP environments, the MES ideally retrieves the effective work instruction directly from the DMS. That way an operator can never work from a superseded version.

🔐 How do you secure a DMS in an IT/OT environment?

Technical documentation is valuable to an attacker. Network drawings, IP address plans and commissioning reports show exactly how a plant is built. A DMS holding OT documentation therefore deserves the same care as the OT network itself:

• Role-based permissions - RBAC and least privilege: a supplier sees only the documents for its own installation
• Strong authentication - MFA for administrators, external parties and access from outside
• Encryption - encryption of storage and connections, especially for a cloud DMS
• Recoverability - Ransomware encrypts document stores too; an immutable backup and an offline copy of emergency procedures and drawings keep you working during an incident
• Suppliers - agreements on access and confidentiality as part of supplier security

For organisations covered by NIS2 and the Dutch Cybersecurity Act, a controlled DMS is also evidence: policies, risk assessments and an incident response plan must be current and demonstrably approved.

🛠️ How do you implement a DMS?

Implementing a DMS is mainly an organisational project. A proven sequence:

1. Inventory document types and owners - which documents exist, where they are stored today and who is responsible
2. Define retention periods - per type in a retention schedule, based on legislation and your own needs
3. Design numbering and metadata - a fixed structure, for example document type, department and plant
4. Configure workflows - review, approval and periodic review per document type; many organisations choose a review interval of two to three years
5. Migrate and clean up - transfer only valid documents with a named owner
6. Validate where needed - in GxP environments risk-based according to GAMP 5, with attention to audit trail and data integrity
7. Train and go live - then switch off the old network drives, otherwise two versions of the truth remain

🖥️ Which DMS software is available?

The benefit of any good DMS is the same: a single source of truth, always current versions, fast retrieval and audits you pass without searching. The choice depends mainly on sector and regulation.

In addition, many QMS packages include their own cloud-based DMS module.

❓ Frequently asked questions

What is the difference between a DMS and a QMS?

A DMS manages documents: versions, approval, distribution and retention. A QMS is the complete quality management system, which also covers deviations, CAPA, audits and complaints. The DMS is often a module within QMS software.

Is SharePoint a DMS?

SharePoint offers the core functions of a DMS, such as version control, check-out, metadata and approval workflows. For GxP use, the configuration must be validated and the audit trail and electronic signatures must demonstrably comply. That is why pharmaceutical companies often choose a specialised DMS such as MasterControl or Veeva Vault.

How long must you retain documents in a DMS?

The retention period depends on the document type and the applicable regulation. In the Netherlands, tax law requires seven years for the business administration, and EU GMP requires batch documentation to be kept until one year after expiry or at least five years after certification, whichever is longer. A DMS records these periods per document type and controls their destruction.

Does a DMS need to be validated?

A DMS that manages GMP-relevant documents or records is a computerised system and must be validated under EU GMP Annex 11; for products on the US market, 21 CFR Part 11 applies as well. The depth of that validation follows from a risk assessment, usually according to GAMP 5. Outside regulated sectors, formal validation is not mandatory.

What does DMS mean in the energy sector?

In the energy sector, DMS stands for Distribution Management System: software that grid operators use to monitor their distribution network, locate faults and carry out switching operations. Such a DMS receives data from IEDs in substations. It has nothing to do with a Document Management System.

Does technical OT documentation belong in a DMS?

Yes, approved OT documentation such as IO lists, loop diagrams and network drawings belongs in a DMS with version control and approval. That way technicians and suppliers work with the current state of the plant. PLC code and configuration files usually live in a separate version control system, referenced from the DMS.

📌 In summary

A DMS controls the entire lifecycle of documents, from draft to destruction, and provides the evidence that auditors expect under ISO 9001, GMP and 21 CFR Part 11. In IT/OT environments it should also hold technical plant documentation, with the same attention to access control and backups as the OT network itself.

A DMS is a digital system for managing, approving and distributing documents in a controlled way - essential for quality management, compliance and knowledge retention.