Cloud Computing: How can CSPs Achieve the Annex 11 Requirement of Qualified Infrastructure?

The trend in the pharmaceutical industry is also moving towards cloud computing. Financial as well as organisational advantages make a strong case for using cloud solutions. At the same time, however, potential risks and regulatory restrictions should also be taken into account. Nine experts from the pharmaceutical industry and regulatory authorities answer a comprehensive catalog of questions from the following GxP-relevant topics:

• Basics of Cloud Computing Technology
• Regulations and Expectations of Inspectors
• Customer-Supplier-Relationship
• Requirements for Cloud Service Providers (CSP)
• Requirements for Supplier Evaluation and Supplier Audits
• Requirements for Qualification / Validation

Question 27: How can CSPs achieve the Annex 11 requirement of qualified infrastructure, considering short product cycles? Which evidence / documentation is expected? - Requirements for qualification and validation

Annex 11 of July 2011, defining the EU GMP rules for computerised systems, does not mention "cloud computing" at all. However, it defines "IT Infrastructure" in its glossary and includes this fundamental and unambiguous statement in its introduction ("Principle"): "The application should be validated; IT infrastructure should be qualified."

On the other hand, GAMP® 5 Second Edition addresses the cloud as a (potential) component of IT infrastructure. For example, appendix M11 on IT Infrastructure starts the second paragraph with "A controlled IT infrastructure is a prerequisite for ensuring that GxP applications are managed in a state of control."

This applies to cloud services and solutions, too. However, while the regulated company is still accountable, some practical and operational elements are performed by the cloud service provider (CSP) - details depend on the type of service, e.g. IaaS, PaaS, or SaaS. It is important to note that basic requirements on IT security, backup and restore, change and configuration management etc. do not change, though they are often implemented differently ("Principles remain, practices change").
Therefore, CSPs should ensure installation and operation of a qualified infrastructure with often short release cycles by commensurate process models (e.g. agile and iterative changes, virtualisation, DevOps), a high degree of automation ("development pipeline"), and complementary QA controls. This includes risk assessments and implementation of safeguards and controls for protection and detection - measures that should be self-evident for CSPs with good IT practices.

As most components used for cloud computing are highly standardized, the risk for changing and extending the configuration is typically low and simple to control, and practices can easily be transferred to other projects ("Qualify once, implement several times"). Professional, high-class CSPs meet most requirements for a qualified IT infrastructure anyway by implementing IT standards, procedures, and guidelines (e.g. based on ITIL®), even when not specialized in or focusing on GxP.
Thus, the remaining challenge for regulated companies is to sign an agreement with a CSP ensuring adherence to these requirements and regulations, and to review and verify it following the identified risks. This can be achieved through various measures like a supplier assessment and signing individual agreements for operation, availability, monitoring etc. Information provided by the CSP - whether provided individually or published in public (e.g. white papers, certificates, or reports)  - support this assessment that may be supplemented by a supplier audit.

Find more Q&As on the topic "Cloud Computing" which have been answered by the expert team.

The Experts

Frank Behnisch, CSL Behring GmbH, Marburg
Klaus Feuerhelm, Formerly Local GMP Inspectorate / Regierungspräsidium Tübingen
Oliver Herrmann; Q-FINITY Quality Management, Dillingen
Eberhard Kwiatkowski, PharmAdvantageIT GmbH, Neuschoo
Stefan Münch, Körber Pharma Consulting, Karlsruhe
Yves Samson, Kereon AG, Basel
Dr. Wolfgang Schumacher, Formerly F. Hoffmann-La Roche AG, Basel
Dr. Arno Terhechte, Local GMP Inspecorate / Bezirksregierung Münster
Sieghard Wagner, Chemgineering Germany GmbH, Stuttgart