Cloud Computing: Cloud Models in the GxP environment

Recommendation

11-13 October 2023

Computerised System Validation: Maintaining Control of Operation - Live Online Training
Including new requirements on Data Integrity

The trend in the pharmaceutical industry is also moving towards cloud computing. Financial but also organizational advantages speak for the cloud. At the same time, however, potential dangers and regulatory restrictions should also be taken into account. Nine experts from the pharmaceutical industry and regulatory authorities answer a comprehensive catalog of questions from the following GxP-relevant topics:

Basics of Cloud Computing Technology
Regulations and Expectations of Inspectors
Customer-Supplier-Relationship
Requirements for Cloud Service Providers (CSP)
Requirements for Supplier Evaluation and Supplier Audits
Requirements for Qualification / Validation
The following question is the first of a series of questions that we will publish in further GMP News articles on this site in the coming weeks.

Question 2: What cloud models are there and where do they have applications in the GxP environment? - Topic Basics of Cloud Computing Technology

Basically, the classification of cloud models is not uniformly regulated. A so-called "Deployment Model" has been formulated by NIST (National Institute of Standards and Technology), which describes a widely used classification (The NIST Definition of Cloud Computing, Special Publication 800-145, Sept. 2011) :

• Private Cloud: In a private cloud, the cloud infrastructure is operated for one institution only. It can be organized and managed by the institution itself or by a third party and can be located in the data center of the institution itself or in a third-party institution.
• Public Cloud: We speak of a public cloud if the services can be used by the general public or a large group, such as an entire industry sector; these services are provided by the respective cloud service provider in its facilities/data centers.
• Community Cloud: In a community cloud, the cloud infrastructure is shared by several institutions that have similar interests (e.g., regarding security, compliance). Such a cloud can be operated by one of these institutions or a third party.
• Hybrid Cloud: If several cloud infrastructures, which are independent of each other, are shared via standardized interfaces, this is called a
  hybrid cloud.

While in a private cloud, where provider and user are usually identical, the user has complete control over the services used, in a public
cloud the user transfers control to the cloud service provider. However, the definitions above do not cover all variants of cloud services, leading to further definitions such as "virtual private cloud", etc. Another common distinction of cloud models is the classification by "Service Models" (SaaS, PaaS, IaaS) - see question 1.

Basically, all "Deployment Models" or "Service Models" are also used in the GxP-regulated industry. Here, the selection of the cloud model is primarily based on the criticality of the GxP process supported by the cloud service and the data processed in the process. For example, tools to support the training process, so-called Learning Management Systems (LMS), are often licensed as public cloud. In contrast, very critical applications, such as the management of trial master files, are at most run in the framework of a community cloud service.

Regardless of the criticality of processes and data, the particular characteristics of the supported process support the use of community
or private cloud offerings: The more specialized a process is - e.g., maintaining a trail master file - the smaller and more specialized
the group of potential subscribers becomes.

The answers to question No 1 regarding Cloud Computing can be found here

The Experts

Frank Behnisch, CSL Behring GmbH, Marburg
Klaus Feuerhelm, Formerly Local GMP Inspectorate / Regierungspräsidium Tübingen
Oliver Herrmann; Q-FINITY Quality Management, Dillingen
Eberhard Kwiatkowski, PharmAdvantageIT GmbH, Neuschoo
Stefan Münch, Körber Pharma Consulting, Karlsruhe
Yves Samson, Kereon AG, Basel
Dr. Wolfgang Schumacher, Formerly F. Hoffmann-La Roche AG, Basel
Dr. Arno Terhechte, Local GMP Inspecorate / Bezirksregierung Münster
Sieghard Wagner, Chemgineering Germany GmbH, Stuttgart