Cloud Computing: Documents for a smooth migration to the cloud

The trend in the pharmaceutical industry is also moving towards cloud computing. Financial but also organizational advantages speak for the cloud. At the same time, however, potential dangers and regulatory restrictions should also be taken into account. Nine experts from the pharmaceutical industry and regulatory authorities answer a comprehensive catalog of questions from the following GxP-relevant topics:

• Basics of Cloud Computing Technology
• Regulations and Expectations of Inspectors
• Customer-Supplier-Relationship
• Requirements for Cloud Service Providers (CSP)
• Requirements for Supplier Evaluation and Supplier Audits
• Requirements for Qualification / Validation

The following question is one of a series of questions that we will publish in further GMP News articles on this site in the coming weeks.

Question 25: What documents are required for the Pharmaceutical Entrepreneur to plan for a smooth migration to the cloud? - Customer-Supplier-Relationship.

Ten years ago, the conservative pharmaceutical industry rejected the use of cloud technology in the GxP sector due to major concerns about the security and confidentiality of the data. The use of cloud-based applications (SaaS) and infrastructure (IaaS) is now the order of the day, i.e. more and more systems are being migrated accordingly. In order to ensure that such a migration is structured by avoiding errors, it is advisable for the pharmaceutical company to define the migration process in an SOP that describes roles, responsibilities and procedures. First, it is necessary to clearly outline the migration project, with clear definitions of the pros and cons of Cloud. The project manager (process owner) should submit the requirements elaborated in the team (requirement specification, request for proposal, RfP) to the possible service providers in order to prepare appropriate offers, including ongoing expenses and license costs.

After the elimination of the non-eligible providers, a so-called "short list" is drawn up from the offers, which forms a basis for further planning. The top candidates on the list are first compared by means of a questionnaire and, if necessary, inspected on site (pre-audit). From these, the most interesting companies (approx. 1-3) are selected, where an on-site audit is carried out to qualify the service provider. 
This results in the "ideal" contractual partner with whom a contract could be concluded. Particular emphasis should be placed on the Quality Agreement (also called: Statement of Work) attached to the contract, where at least the following points are to be defined:

• Roles & Responsibilities
• Quality System Requirements
• Audits and Regulatory Inspection Support
• Personnel and Training
• Change Management
• SDLC Methodology details
• Non-Conformance and CAPA
• Data Governance / Data Privacy
• Security / Encryption
• Validation Deliverables
• RTO / RPO

The final migration to the cloud should be preceded by an intensive pilot phase; during that time future users will have the opportunity to test the application (SaaS) in order to identify weak areas (on the basis of the user requirements and their practical experience. When planning for the migration, the pharmaceutical company should consider whether company-specific customization makes sense and is really needed, as it will be a significant cost factor for all later versions (releases). In such cases, standard validation documents from the service provider may not suffice, and extensive, time-consuming work may be required. If extensive customization cannot be avoided, a locally installed application may be preferred.

Find more Q&As on the topic "Cloud Computing" which have been answered by the expert team.

The Experts

Frank Behnisch, CSL Behring GmbH, Marburg
Klaus Feuerhelm, Formerly Local GMP Inspectorate / Regierungspräsidium Tübingen
Oliver Herrmann; Q-FINITY Quality Management, Dillingen
Eberhard Kwiatkowski, PharmAdvantageIT GmbH, Neuschoo
Stefan Münch, Körber Pharma Consulting, Karlsruhe
Yves Samson, Kereon AG, Basel
Dr. Wolfgang Schumacher, Formerly F. Hoffmann-La Roche AG, Basel
Dr. Arno Terhechte, Local GMP Inspecorate / Bezirksregierung Münster
Sieghard Wagner, Chemgineering Germany GmbH, Stuttgart