Cloud Computing: IT Infrastructure Qualification by a SAAS Provider

The trend in the pharmaceutical industry is also moving towards cloud computing. Financial but also organizational advantages speak for the cloud. At the same time, however, potential dangers and regulatory restrictions should also be taken into account. Nine experts from the pharmaceutical industry and regulatory authorities answer a comprehensive catalog of questions from the following GxP-relevant topics:

• Basics of Cloud Computing Technology
• Regulations and Expectations of Inspectors
• Customer-Supplier-Relationship
• Requirements for Cloud Service Providers (CSP)
• Requirements for Supplier Evaluation and Supplier Audits
• Requirements for Qualification / Validation

Question 28: Does a SaaS provider have to qualify the IT infrastructure used to provide services in the same way that a drug manufacturer or pharmaceutical company would have to? - Requirements for Qualification / Validation

Generally speaking, the requirements of the EU GMP guidelines and its annexes apply to the qualification of infrastructure in the GMP environment. Annex 11: The software should be validated and the IT infrastructure should be qualified.
However, essential guidance can in particular be found in the AIM of EFG 11 (Aide-Mémoire of EFG 11 - supervision of computerised systems) and in Votum V1100202 - Requirements for the storage of electronic data. According to ZLG, a "Votum" is an opinion issued by an expert working group on a matter that is open to interpretation or requires clarification. Both documents only in German available.

AIM of EFG 11: The qualification of IT infrastructure is a clearly stated requirement of Annex 11. Responsibility for this lies with the system owners (usually IT departments). Where cloud service providers (CSPs) or other service providers supply the infrastructure, this does not affect the requirement itself. Whether the CSP has qualified its infrastructure and whether the qualification process is described in its quality management system must be verified as part of the qualification of the service provider and the ongoing monitoring by the RU.

The SaaS provider must therefore qualify its infrastructure in accordance with EU-GMP Annex 11 and Annex 15.

Find more Q&As on the topic "Cloud Computing" which have been answered by the expert team.

The Experts

Frank Behnisch, CSL Behring GmbH, Marburg
Klaus Feuerhelm, Formerly Local GMP Inspectorate / Regierungspräsidium Tübingen
Oliver Herrmann; Q-FINITY Quality Management, Dillingen
Eberhard Kwiatkowski, PharmAdvantageIT GmbH, Neuschoo
Stefan Münch, Körber Pharma Consulting, Karlsruhe
Yves Samson, Kereon AG, Basel
Dr. Wolfgang Schumacher, Formerly F. Hoffmann-La Roche AG, Basel
Dr. Arno Terhechte, Local GMP Inspecorate / Bezirksregierung Münster
Sieghard Wagner, Chemgineering Germany GmbH, Stuttgart