Catalogue
Lab IT
Coming soonLaboratory computing has different rules to corporate IT.
Supporting instruments, scientific PCs and validated systems in R&D and QC laboratories. Every topic teaches the IT skill and the GxP control that goes with it, graded by support line.
Not built yet
The outline below is the planned curriculum. Join the waitlist to vote for it and be told when it opens.
The three levels
L1Foundation1st line
Logs, triages and fixes known issues without breaking validated state
L2Practitioner2nd line
Builds, configures and repairs lab PCs and accounts under change control
L3Specialist3rd line
Designs standards, leads root cause, owns qualification and lifecycle
Foundation modules
Four foundation modules sit under every topic and are completed first. Each also feeds a later AINSQ service track.
F1
GxP and regulations
GMP/GLP basics, 21 CFR Part 11, EU Annex 11, system owner vs IT roles
Feeds: Computer System Validation
F2
Data integrity
ALCOA+, audit trails, raw data vs processed data, good documentation practice
Feeds: Scientific Data
F3
Validation awareness
GAMP 5 categories, IQ/OQ/PQ, test evidence, deviations, change control
Feeds: Computer System Validation
F4
Lab service skills
ITIL 4 incident/change basics, working safely in labs (PPE, gowning), talking to scientists, writing clear tickets and SOP steps
Feeds: Managed Services
Lab Health and Safety for IT staff
Taken by every learner, at every level, before any lab visit. IT staff enter labs to fix PCs and instruments, so they meet the same hazards as scientists. They also often work alone or out of hours.
| Hazard area | What IT staff must know | Where it matters |
|---|---|---|
| Lab entry and PPE | Lab coat, safety glasses, gloves, safety shoes; gowning and clean zones; no food or drink | Every visit; carrying laptops and tools into controlled areas |
| Chemical hazards (COSHH) | Read hazard symbols and safety data sheets; spill response; fume cupboards | Working on PCs beside HPLC solvents, acids and fume cupboards |
| Biological hazards | Containment levels (CL1/CL2); biosafety cabinets; hand hygiene | Supporting microscopes, Hamilton and OT-2 robots in microbiology labs |
| Decontamination | Kit leaving a lab needs a decontamination certificate before repair, swap or disposal | Hardware swaps, returns to vendor, decommissioning |
| Strong magnetic fields | NMR magnets: no metal tools, phones or cards inside the marked line; pacemaker exclusion | Supporting spectrometer workstations near NMR magnets |
| Cryogens and gases | Liquid nitrogen and helium asphyxiation risk; oxygen alarms; gas cylinder rules | NMR rooms, cold rooms, GC gas supplies |
| Lasers and optical radiation | Laser classes and warning signs; never defeat interlocks | Mastersizer, Spraytec, laser microscopes |
| Electrical and moving parts | Isolate before working; never open instrument covers (vendor job); robot interlocks and pinch points | Cabling behind instruments; robot PC swaps |
| Manual handling and DSE | Safe lifting of PCs and monitors; trolleys; display screen equipment setup | Workstation moves and installs |
| Lone and out-of-hours working | Sign-in, lone-worker procedures, permit to work, emergency exits and alarms | Patching and maintenance windows |
Site induction and local rules always take priority over this course. Key UK references: Health and Safety at Work etc. Act 1974, COSHH Regulations 2002, PUWER 1998, DSE Regulations 1992, HSE guidance on lone working.
Eight topics
Every skill is graded by the support line it serves. Hours are a starting estimate for planning, and will be adjusted after the first pilot cohort.
1Instrument workstationsKeeping a PC that controls or acquires data from an instrument (HPLC, GC, MS, ICP, FTIR, plate reader, NMR) working without invalidating its qualified state. Learners must know where the instrument vendor's responsibility ends and IT's begins.6 modulesL1 6hL2 12hL3 10h▾
| Module | L1 — 1st line | L2 — 2nd line | L3 — 3rd line |
|---|---|---|---|
| 1.1Lab context and GxP basics | What GxP, a validated system and a system owner are; why you never “just reboot” mid-run | Read a system's validation pack, URS and configuration spec | Define the IT support model and RACI with system owner, QA and vendor |
| 1.2Instrument-to-PC connectivity | Identify connection type (USB, serial RS-232, LAN, GPIB) and check cabling and lights | Configure static IPs, isolated instrument LAN / second NIC, COM port settings, USB-serial drivers | Design segmented instrument networks and firewall rules with OT/security teams |
| 1.3Acquisition and control software | Start/stop services, check licence server status, collect logs | Install / repair CDS and control software (Empower, Chromeleon, OpenLab, MassHunter, TopSpin) per vendor IQ steps | Plan upgrades and version compatibility matrices (OS × software × firmware) |
| 1.4Data path and storage | Confirm data is landing in the right local / network folder | Map drives, service accounts, SDMS/LIMS transfer jobs; fix failed transfers | Design data flow so raw data is never lost (local buffer, sync, backup checks) |
| 1.5Change control and patching | Recognise what needs a change record; never install unapproved software | Raise and execute change records; apply vendor-approved patches; document evidence | Own patch strategy for frozen / legacy OS, risk assessments, compensating controls |
| 1.6Incident and problem management | Log tickets with instrument ID, asset tag, run impact and screenshots | Diagnose OS vs software vs instrument faults; engage vendor service | Run root cause analysis, CAPA input, deviation support |
Tools taught
- Device Manager
- Event Viewer
- PuTTY / serial terminal
- Wireshark (basic)
- Vendor diagnostics
- ServiceNow-style ticketing
- Asset / CMDB records
Hands-on labs
- 1.Simulate an instrument PC losing connection on a dedicated NIC; restore it and record the fix.
- 2.Walk through a mock change record for a software hotfix, including pre/post evidence screenshots.
- 3.Trace a failed data transfer from acquisition PC to network share and fix the service account permission.
Assessment: Scenario quiz (L1), practical build-and-document task (L2), written RCA and support model design (L3).
2Scientific PCsBuilding and supporting high-spec analysis machines (GPU imaging, data processing, modelling, NMR processing) to a repeatable, documented standard. Unlike instrument PCs they change more often, so the focus is controlled flexibility.6 modulesL1 5hL2 10hL3 10h▾
| Module | L1 — 1st line | L2 — 2nd line | L3 — 3rd line |
|---|---|---|---|
| 2.1Hardware for science | Identify CPU, RAM, GPU, storage and peripherals; check warranty | Fit and test GPUs, RAID, high-capacity SSD; update BIOS/firmware under change | Specify standard builds per lab area (imaging, NMR, analytics) and refresh cycles |
| 2.2Imaging and deployment | Re-image a standard PC from a known image | Build golden images, driver packs, task sequences (MECM/SCCM, Intune Autopilot) | Own image lifecycle, versioning and qualification of the base build |
| 2.3Scientific software packaging | Install approved apps from the software centre | Package and deploy (MSI/MSIX, silent installs), manage licence servers (FlexLM, RLM) | Maintain the approved software catalogue and licence compliance reporting |
| 2.4Performance and GPU troubleshooting | Check resource use in Task Manager; restart hung processing jobs | Tune drivers (NVIDIA/CUDA), power plans, paging; benchmark before and after | Capacity planning; decide local GPU vs HPC/cloud for heavy workloads |
| 2.5Peripherals and AV | Connect scientific cameras, barcode scanners, label printers | Configure camera SDKs, capture cards, AV/recording kit for observation rooms | Standardise peripheral models and support contracts with vendors |
| 2.6Asset and lifecycle management | Update asset records on moves, adds, changes | Hardware swaps with data migration and decommissioning evidence | Lifecycle roadmap: end-of-support OS, secure disposal, budget forecasts |
Tools taught
- MECM/SCCM or Intune
- PowerShell
- HWiNFO / CPU-Z
- NVIDIA-SMI
- Licence server consoles
- CMDB
Hands-on labs
- 1.Build a standard imaging workstation image with GPU drivers and a packaged scientific app.
- 2.Diagnose a slow image-analysis PC using resource monitor and GPU utilisation data.
- 3.Decommission a lab PC: data handover, secure wipe and certificate of destruction record.
Assessment: Hardware identification test (L1), image build with documented spec (L2), standard-build proposal for one lab area (L3).
3Windows & Linux environmentsAdministering both operating systems as they appear in labs: Windows on most instrument and office-side PCs, Linux on NMR spectrometers, HPC nodes and data servers. Learners must also handle legacy OS that cannot be upgraded.7 modulesL1 8hL2 14hL3 12h▾
| Module | L1 — 1st line | L2 — 2nd line | L3 — 3rd line |
|---|---|---|---|
| 3.1Windows client administration | Local accounts, profiles, mapped drives, printers, Event Viewer basics | Group Policy results, registry, services, scheduled tasks, Windows Update for Business | Hardening baselines (CIS / Microsoft security baselines) adapted for validated PCs |
| 3.2Windows Server for labs | Check file share availability and disk space | Manage file servers, NTFS/share permissions, DFS, print and licence servers | Design server roles for lab data; cluster/HA options; capacity planning |
| 3.3Linux fundamentals | Log in via SSH, navigate filesystem, read logs (journalctl, /var/log) | Users/groups, permissions, systemd services, package managers (dnf/apt), cron | Hardening (SELinux, firewalld), kernel/driver dependencies for instruments |
| 3.4Linux in the lab | Restart a hung acquisition service per runbook | Support Bruker TopSpin / spectrometer workstations, NFS/Samba mounts to Windows shares | Integrate Linux with AD (SSSD/realmd), HPC job schedulers (Slurm) basics |
| 3.5Legacy and unsupported OS | Recognise an end-of-life OS and follow its handling rules | Apply compensating controls: network isolation, USB control, offline AV scans | Risk assessment and migration plan for legacy instrument PCs |
| 3.6Scripting and automation | Run approved scripts from a runbook | Write PowerShell and Bash for health checks, log collection, inventory | Build automated compliance and patch-status reporting across the estate |
| 3.7Backup and recovery | Restore a user file from backup or shadow copy | Configure and verify backup jobs; test restores; document results | Define RPO/RTO per system class; bare-metal recovery of qualified PCs |
Tools taught
- PowerShell
- Bash
- RSAT
- gpresult
- Sysinternals
- SSH / WinSCP
- journalctl
- Veeam / Commvault style consoles
Hands-on labs
- 1.Build a Windows 11 and a Rocky/RHEL VM; join both to a test domain and share a data folder between them.
- 2.Write a PowerShell script that reports disk space, last reboot and pending updates for 10 PCs.
- 3.Perform and document a restore test of an instrument PC data folder, with evidence for QA.
Assessment: Command-line practical (L1), scripted health check plus restore evidence (L2), legacy OS risk assessment (L3).
4Active Directory & Microsoft Entra IDManaging identities so every action on a GxP system is attributable to one person, as 21 CFR Part 11 and EU Annex 11 require. Azure AD is now branded Microsoft Entra ID; both names are taught.7 modulesL1 6hL2 12hL3 12h▾
| Module | L1 — 1st line | L2 — 2nd line | L3 — 3rd line |
|---|---|---|---|
| 4.1Identity basics for labs | Users, groups, OUs; why shared logins break attributability | Naming standards for user, service and instrument accounts | Identity governance model for GxP systems with QA |
| 4.2Account lifecycle | Password resets, unlocks, verify identity before acting | Joiner / mover / leaver processing; disable vs delete; access request evidence | Periodic access reviews and segregation of duties design |
| 4.3Group Policy for lab PCs | Run gpupdate / gpresult and report what applied | Build lab-specific OUs and GPOs (screen lock exceptions, USB control, auto-logon rules) | GPO strategy that keeps validated PCs stable; GPO change control |
| 4.4Service and instrument accounts | Recognise service accounts and never reset them ad hoc | Manage service accounts, gMSA, password vaulting, dependency mapping | Policy for non-human accounts, rotation and audit |
| 4.5Entra ID and hybrid identity | Check sign-in status, MFA registration help | Entra Connect sync, conditional access basics, device join (hybrid / Entra joined) | Hybrid design, Intune compliance policies, PIM for admin roles |
| 4.6Application access and SSO | Add a user to an app access group | Integrate lab apps with AD/LDAP or SAML/OIDC SSO; Kerberos troubleshooting | Role-based access model across LIMS, ELN, CDS |
| 4.7Audit and reporting | Find a user's group membership on request | Produce access reports and sign-in logs for audits | Audit trail review process and inspection-ready evidence |
Tools taught
- ADUC
- Group Policy Management Console
- ADAC
- PowerShell ActiveDirectory and Microsoft Graph modules
- Entra admin centre
- Intune
- LAPS
Hands-on labs
- 1.Build a test domain with Lab-Instruments and Lab-Scientific OUs and apply different GPOs to each.
- 2.Run a joiner-mover-leaver scenario end to end and produce the access evidence pack.
- 3.Configure a conditional access policy for a lab app in a free Entra ID tenant.
Assessment: Account-handling scenarios (L1), OU/GPO build with gpresult evidence (L2), access review and role-model design (L3).
5R&D SecurityProtecting research IP and GxP data on systems that often cannot run standard security tooling or take patches on time. Learners balance security controls against instrument vendor support and validated state.7 modulesL1 6hL2 14hL3 14h▾
| Module | L1 — 1st line | L2 — 2nd line | L3 — 3rd line |
|---|---|---|---|
| 5.1R&D threat landscape | Phishing, USB-borne malware, ransomware on lab PCs; how to report a security event | Common attacks on OT/lab devices; unsupported OS exposure | Threat modelling for labs; IP theft and insider risk scenarios |
| 5.2Endpoint protection on lab PCs | Check AV/EDR status; never disable it to “make an instrument work” | Vendor-approved AV exclusions, EDR in audit mode, application allow-listing (AppLocker / WDAC) | Endpoint security standard per system class with vendor sign-off |
| 5.3Removable media and data transfer | Follow USB rules; use approved transfer kiosks | Configure device control, media scanning stations, secure file transfer | Data loss prevention policy for research data and IP |
| 5.4Vulnerability and patch risk | Report missing patches seen on dashboards | Run scans (Nessus / Qualys / Defender TVM); triage by exposure and GxP impact | Risk-based remediation plan; compensating controls for unpatchable systems |
| 5.5Privileged access | Use separate admin accounts only when needed | LAPS, just-in-time admin, remote access via jump hosts | Privileged access model; vendor remote access approval and monitoring |
| 5.6Security incident response | Isolate the device (unplug network) per runbook and escalate | Collect evidence, logs and timelines; coordinate with SOC | Lead lab-specific incident response; assess data integrity impact with QA |
| 5.7Standards and compliance | Know the basics of ISO 27001 and company policy | Map lab controls to NIST CSF 2.0, IEC 62443 and Annex 11 security clauses | Prepare for security audits; write the lab security baseline |
Tools taught
- Microsoft Defender for Endpoint
- AppLocker / WDAC
- Nessus or Qualys
- LAPS
- SIEM basics (Sentinel / Splunk)
- BitLocker
Hands-on labs
- 1.Apply an AppLocker allow-list to a test instrument PC and prove the control software still runs.
- 2.Scan a test lab VLAN, rank the findings by risk and GxP impact, and propose compensating controls.
- 3.Tabletop exercise: ransomware on a chromatography PC, from first report to data integrity assessment.
Assessment: Security awareness scenarios (L1), scan-and-remediate report (L2), lab security baseline design (L3).
6Networking for labsKeeping instruments, lab PCs, IoT devices and data servers connected, segmented and reliable. Labs mix corporate LAN, isolated instrument networks, Wi-Fi devices and high-volume data transfer to storage and cloud.7 modulesL1 8hL2 14hL3 12h▾
| Module | L1 — 1st line | L2 — 2nd line | L3 — 3rd line |
|---|---|---|---|
| 6.1Network fundamentals | OSI/TCP-IP, IP addressing, DNS, DHCP; ping, ipconfig, tracert | Subnetting, VLANs, routing basics, DHCP reservations for instruments | Lab addressing plan and IPAM standards |
| 6.2Physical layer and cabling | Identify ports, patch leads, wall points; check link lights | Patching, cable testing, PoE for cameras and sensors, port documentation | Lab network design for new builds and lab moves |
| 6.3Segmentation and isolation | Know which devices sit on isolated instrument networks | Configure dual-NIC isolation, VLAN assignment, switch port security | Zone design (Purdue / IEC 62443 style), firewall rule sets with security team |
| 6.4Wireless and IoT | Connect approved devices to the right SSID | Configure 802.1X / certificate Wi-Fi, BLE and IoT device onboarding | IoT network strategy for smart devices and prototype labs |
| 6.5Network storage and data transfer | Check mapped drives and share reachability | Troubleshoot SMB/NFS performance, large file transfers, MTU and latency | Design high-throughput paths for imaging, NMR and HPC data |
| 6.6Remote and cloud connectivity | Help users with VPN connection | Vendor remote access, site-to-site VPN, proxy and firewall requests | Hybrid connectivity to Azure / AWS (ExpressRoute, Direct Connect), zero-trust access |
| 6.7Monitoring and troubleshooting | Log network faults with device, port and time | Packet capture with Wireshark; switch logs; SNMP monitoring | Root cause of intermittent faults; capacity and resilience planning |
Tools taught
- ping / tracert / nslookup
- Wireshark
- Cisco IOS basics
- Packet Tracer or GNS3
- Cable tester
- PRTG / SolarWinds style monitoring
- Advanced IP Scanner
Hands-on labs
- 1.In Packet Tracer, build a lab with corporate, instrument and IoT VLANs plus firewall rules between them.
- 2.Capture and diagnose a slow SMB transfer from an imaging PC to a file server.
- 3.Onboard an instrument with a DHCP reservation, DNS record and documented switch port.
Assessment: Addressing and troubleshooting quiz (L1), Packet Tracer build (L2), segmented lab network design (L3).
7Quantum skillsLab IT needs quantum skills for two jobs: supporting scientists who use cloud quantum computers for chemistry and materials research, and moving lab systems to post-quantum cryptography. NIST published the first PQC standards (FIPS 203, 204, 205) in August 2024; the UK NCSC asks organisations to finish discovery by 2028, migrate priority systems by 2031 and complete migration by 2035.6 modulesL1 4hL2 10hL3 14h▾
| Module | L1 — 1st line | L2 — 2nd line | L3 — 3rd line |
|---|---|---|---|
| 7.1Quantum computing fundamentals | Qubits, superposition, entanglement and why quantum differs from classical, in plain language | Gates, circuits, noise and error mitigation; where quantum helps R&D (molecular simulation, optimisation) | Assess realistic use cases and timelines for the business; hybrid quantum-classical workflows |
| 7.2Quantum cloud platforms | Know the main platforms and how researchers request access | Set up accounts, quotas and cost controls on IBM Quantum, Azure Quantum, Amazon Braket | Governance for quantum cloud use: data classification, cost, vendor risk |
| 7.3Quantum software environments | Install Python and Jupyter for a researcher | Build and support Qiskit, Cirq, PennyLane and simulator environments (conda, containers, GPU simulators) | Standard reproducible quantum dev environment; integration with HPC |
| 7.4Post-quantum cryptography basics | Why “harvest now, decrypt later” threatens long-lived R&D data | ML-KEM, ML-DSA and SLH-DSA; hybrid TLS; what changes for certificates and VPNs | PQC migration roadmap aligned to NCSC 2028 / 2031 / 2035 milestones |
| 7.5Cryptographic inventory | Record which systems use certificates, VPNs or encryption | Discover crypto use (TLS scans, certificate inventories, instrument vendor questionnaires) | Prioritise systems by data lifetime and risk; crypto-agility requirements in new purchases |
| 7.6Quantum sensing and new instruments | Awareness of quantum sensors and quantum-enabled lab instruments | Support the PCs, drivers and data pipelines for these instruments | Evaluate readiness, data volumes and validation needs for quantum-enabled kit |
Tools taught
- Python
- Jupyter
- Qiskit
- IBM Quantum Platform
- Azure Quantum
- Amazon Braket
- OpenSSL 3.5+ (PQC algorithms)
- Certificate scanning tools
Hands-on labs
- 1.Run a Bell-state circuit on a simulator, then on a free IBM Quantum device, and compare the noisy results.
- 2.Build a reproducible Qiskit environment in a container and document it as a standard build.
- 3.Produce a crypto inventory for a mock lab (5 systems), rank them for PQC migration and justify the order.
Assessment: Concepts quiz (L1), environment build plus first circuit (L2), PQC migration roadmap for one lab site (L3).
8Lab instruments and applicationsStarts at L2The vendor software and instrument PCs that lab IT actually supports, grouped by lab. This topic starts at L2: learners must already have Topics 1–4. Instrument names are examples from AINSQ lab areas; each site swaps in its own list.4 modulesL2 24hL3 16h▾
| Module | L1 — 1st line | L2 — 2nd line | L3 — 3rd line |
|---|---|---|---|
| 8.1Common skills for every instrument system | — | Architecture, install and qualification, licensing, users and Part 11 controls, data and backup, drivers and compatibility, vendor management | Choose deployment models, review IQ/OQ protocols, design role matrices with QA, maintain compatibility matrices and service contracts |
| 8.2Analytical lab | — | Chromeleon CDS, Mettler Toledo LabX, analytical balances, Malvern Panalytical Mastersizer and Spraytec, PerkinElmer Spectrum IR | Version upgrades and data migration, CDS domain design, SQL Server strategy, LIMS interface design, archive design |
| 8.3Microbiology lab | — | Microscopy (Zeiss ZEN, Leica LAS X, Nikon NIS-Elements, Evident cellSens), Hamilton liquid handlers (VENUS), Videometer, Opentrons OT-2 | Size storage for image data, change control for method updates, govern Python protocol version control and validation |
| 8.4Measurement Science lab | — | TA Instruments TRIOS (DSC, TGA, DMA, rheometers), TAM IV, FLIR thermal cameras, NI DAQ and LabVIEW, pH meters | Multi-instrument estate management, patch and power-loss strategy for multi-week runs, high-speed data network design, LabVIEW version control |
Tools taught
- Vendor installers and IQ guides
- SQL Server management tools
- GigE / camera SDKs
- Licence and dongle managers
- Git for protocol version control
Hands-on labs
- 1.Connect a balance to LabX in a test environment, run a weighing, and trace the result from instrument to database to export file.
- 2.Write and simulate a simple Opentrons Python protocol, then document it under version control as a controlled method.
- 3.Set up a GigE camera on a dedicated NIC with jumbo frames, record a test capture and measure the data rate.
Assessment: L2 installs one vendor application end to end with IQ evidence; L3 writes a support plan (backup, upgrade, access, vendor contacts) for one lab's instrument estate.
Suggested learning path
- 1Lab Health and Safety, then foundation modules F1–F4
- 2Topic 3 (Windows & Linux), Topic 6 (Networking), Topic 4 (AD/Entra)
- 3Topics 1 and 2, where the lab context comes together
- 4Topic 8 (Lab instruments and applications, from L2) and Topic 5 (R&D Security)
- 5Topic 7 (Quantum) as an L2/L3 specialism, taken last
Certifications to signpost
L1 Foundation
- CompTIA A+
- ITIL 4 Foundation
- Microsoft 365 Fundamentals (MS-900)
L2 Practitioner
- CompTIA Network+
- Microsoft Endpoint Administrator (MD-102)
- Linux Foundation LFCS or Red Hat RHCSA
L3 Specialist
- Microsoft Identity and Access Administrator (SC-300)
- ISPE GAMP 5 training
- CompTIA Security+
- ISA/IEC 62443 Cybersecurity Fundamentals Specialist
- Cisco CCNA
- IBM Certified Associate Developer – Quantum Computation using Qiskit
Certification codes change often — check each vendor's site before relying on one.