Cloud Computing: Can an automated Deployment Chain replace an IQ?

Recommendation

22-24 May 2024
Copenhagen, Denmark

IT / OT Infrastructure Qualification and Operation in a GMP Environment

The trend in the pharmaceutical industry is also moving towards cloud computing. Financial but also organizational advantages speak for the cloud. At the same time, however, potential dangers and regulatory restrictions should also be taken into account. Nine experts from the pharmaceutical industry and regulatory authorities answer a comprehensive catalog of questions from the following GxP-relevant topics:

• Basics of Cloud Computing Technology
• Regulations and Expectations of Inspectors
• Customer-Supplier-Relationship
• Requirements for Cloud Service Providers (CSP)
• Requirements for Supplier Evaluation and Supplier Audits
• Requirements for Qualification / Validation

The following question is one of a series of questions that we will publish in further GMP News articles on this site in the coming weeks.

Question 17: Can an automated deployment chain replace an IQ? If so, what information must the deployment chain provide? - Requirements for Qualification / Validation

From Annex 11, there is a requirement to qualify IT infrastructure. The way infrastructure is provided (e.g. as IaaS) also influences the process infrastructure is qualified and how it is demonstrated - keyword "documented evidence" - in order to meet the requirements and specifications.

"Traditional paper-based infrastructure qualification" was based on defined hardware and specified structures that were verified. Virtualization, automation and monitoring tools have evolved infrastructure deployment into a dynamic process, and static qualification is transforming into continuous process control, again automated via monitoring tools.

The components of infrastructure qualification such as requirement / specification, design, configuration, deployment and verification remain as the foundation. The qualification process and the accompanying monitoring merge and, if necessary, also use the same tools (DevOps).

An automated deployment chain linked with permanent monitoring would be suitable as proof of infrastructure qualification. The suitability of the tools must be demonstrated. It must also be guaranteed that errors are detected, reported and corrected.

Although infrastructure is undeniably a critical component in the context of cloud services, the information on its qualification provided by the CSP and required by the RU (Regulated User) is rudimentary and only in a few cases corresponds to a qualification of an on-premise solution. Also, the engagement of a global CSP alone is not a sufficient proof of a qualified IT infrastructure.

Find more Q&As on the topic "Cloud Computing" which have been answered by the expert team.

The Experts

Frank Behnisch, CSL Behring GmbH, Marburg
Klaus Feuerhelm, Formerly Local GMP Inspectorate / Regierungspräsidium Tübingen
Oliver Herrmann; Q-FINITY Quality Management, Dillingen
Eberhard Kwiatkowski, PharmAdvantageIT GmbH, Neuschoo
Stefan Münch, Körber Pharma Consulting, Karlsruhe
Yves Samson, Kereon AG, Basel
Dr. Wolfgang Schumacher, Formerly F. Hoffmann-La Roche AG, Basel
Dr. Arno Terhechte, Local GMP Inspecorate / Bezirksregierung Münster
Sieghard Wagner, Chemgineering Germany GmbH, Stuttgart