Cloud Computing: Assessment of Cloud Suppliers from an authority's point of view

Recommendation

22-24 May 2024
Copenhagen, Denmark

IT / OT Infrastructure Qualification and Operation in a GMP Environment

The trend in the pharmaceutical industry is also moving towards cloud computing. Financial but also organizational advantages speak for the cloud. At the same time, however, potential dangers and regulatory restrictions should also be taken into account. Nine experts from the pharmaceutical industry and regulatory authorities answer a comprehensive catalog of questions from the following GxP-relevant topics:

• Basics of Cloud Computing Technology
• Regulations and Expectations of Inspectors
• Customer-Supplier-Relationship
• Requirements for Cloud Service Providers (CSP)
• Requirements for Supplier Evaluation and Supplier Audits
• Requirements for Qualification / Validation

The following question is one of a series of questions that we will publish in further GMP News articles on this site in the coming weeks.

Question 14: What should the assessment of "cloud suppliers" include from an authority's point of view? - Regulations and Expectations of Inspectors

Substantial guidance for evaluating a CSP from an authority perspective is provided by EFG 11's Votum V1100202 "Anforderungen an die Aufbewahrung elektronischer Daten" (Electronic Data Retention Requirements; Document is only available in German

According to Votum V1100202, the requirements for qualifying the IT infrastructure (IAAS, PAAS), validating the application (SAAS) and ensuring availability, readability and integrity must be fulfilled by an (internal or external) service provider. Crucial is the indication that a risk to patients and/or the quality of the drug product is to be eliminated. According to the Votum, an assessment should include the following points in particular:

• Service Level Agreement (SLA)
• Qualification and validation have been verified or can be verified as part of a continuous assessment of the CSP in terms of quality attributes
• The deletion of the data after termination of the business relationship with the CSP is ensured
• The relocation of the data or the application back or to another CSP is possible

Find more Q&As on the topic "Cloud Computing" which have been answered by the expert team.

The Experts

Frank Behnisch, CSL Behring GmbH, Marburg
Klaus Feuerhelm, Formerly Local GMP Inspectorate / Regierungspräsidium Tübingen
Oliver Herrmann; Q-FINITY Quality Management, Dillingen
Eberhard Kwiatkowski, PharmAdvantageIT GmbH, Neuschoo
Stefan Münch, Körber Pharma Consulting, Karlsruhe
Yves Samson, Kereon AG, Basel
Dr. Wolfgang Schumacher, Formerly F. Hoffmann-La Roche AG, Basel
Dr. Arno Terhechte, Local GMP Inspecorate / Bezirksregierung Münster
Sieghard Wagner, Chemgineering Germany GmbH, Stuttgart