22-24 February 2023
The trend in the pharmaceutical industry is also moving towards cloud computing. Financial but also organizational advantages speak for the cloud. At the same time, however, potential dangers and regulatory restrictions should also be taken into account. Nine experts from the pharmaceutical industry and regulatory authorities answer a comprehensive catalog of questions from the following GxP-relevant topics:
Basics of Cloud Computing Technology
Regulations and Expectations of Inspectors
Requirements for Cloud Service Providers (CSP)
Requirements for Supplier Evaluation and Supplier Audits
Requirements for Qualifcation / Validation
The following question is the first of a series of questions that we will publish in further GMP News articles on this site in the coming weeks.
Basically, the classification of cloud models is not uniformly regulated. A so-called "Deployment Model" has been formulated by NIST (National Institute of Standards and Technology), which describes a widely used classification (The NIST Definition of Cloud Computing, Special Publication 800-145, Sept. 2011) :
While in a private cloud, where provider and user are usually identical, the user has complete control over the services used, in a public
cloud the user transfers control to the cloud service provider. However, the definitions above do not cover all variants of cloud services, leading to further definitions such as "virtual private cloud", etc. Another common distinction of cloud models is the classification by "Service Models" (SaaS, PaaS, IaaS) - see question 1.
Basically, all "Deployment Models" or "Service Models" are also used in the GxP-regulated industry. Here, the selection of the cloud model is primarily based on the criticality of the GxP process supported by the cloud service and the data processed in the process. For example, tools to support the training process, so-called Learning Management Systems (LMS), are often licensed as public cloud. In contrast, very critical applications, such as the management of trial master files, are at most run in the framework of a community cloud service.
Regardless of the criticality of processes and data, the particular characteristics of the supported process support the use of community
or private cloud offerings: The more specialized a process is - e.g., maintaining a trail master file - the smaller and more specialized
the group of potential subscribers becomes.
The answers to question No 1 regarding Cloud Computing can be found here
Frank Behnisch, CSL Behring GmbH, Marburg
Klaus Feuerhelm, Formaly Local GMP Inspectorate / Regierungspräsidium Tübingen
Oliver Herrmann; Q-FINITY Quality Management, Dillingen
Eberhard Kwiatkowski, PharmAdvantageIT GmbH, Neuschoo
Stefan Münch, Körber Pharma Consulting, Karlsruhe
Yves Samson, Kereon AG, Basel
Dr. Wolfgang Schumacher, Formely F. Hoffmann-La Roche AG, Basel
Dr. Arno Terhechte, Local GMP Inspecorate / Bezirksregierung Münster
Sieghard Wagner, Chemgineering Germany GmbH, Stuttgart