topic Re: Cloud, SaaS and Computer System Validation in SAP for Life Sciences Discussions

Cloud, SaaS and Computer System Validation

Former Member — Thu, 24 Jan 2013 15:50:03 GMT

Dear Compliant Consultants,

I was wondering if any of you already had some experience with the validation of Cloud based applications?

How was dit incorperated in the CSV policy and how did the validation master plan looked like.

Looking forward to your replies.

Kind regards,

Ruud Nieuweboer

Re: Cloud, SaaS and Computer System Validation

oliver_nuernberg — Thu, 07 Nov 2013 18:31:39 GMT

Hi,

sorry for commenting on this so late (I just came back into the Life Sciences Space).

I don't have a real answer ...yet. So I would like to repost this to the community.

Are you lookign at specific business processes. I belive that it makes a difference whether you need to validate a cloud system managing batch characteristics vs. a learning management systems that "only" holds learning records. Even though both processes are subject to validation the latter is probably much less risky and therefore easier to start with.

Oliver

Re: Cloud, SaaS and Computer System Validation

Former Member — Fri, 08 Nov 2013 08:32:11 GMT

Hi Oliver,

Thanks for commenting and getting this topic back on the 'map'.

Maybe I had to be more specific. But the question is related to ERP systems/ processes that are GxP relevant.

Regs,

Ruud

Re: Cloud, SaaS and Computer System Validation

oliver_nuernberg — Fri, 08 Nov 2013 08:49:25 GMT

Hi Ruud,

Probably the biggest obstacle to run a GMP process in a cloud environment is the fact that the provider will patch and upgrade the systerm at pre-defined intervals. With ByD for example, the systems are getting hotfixes every 2 weeks and are upgraded every quarter ...no exceptions! So a company running a process that must be validated (a) doesn't know exactly what was changed and (b) would need to re-validate after every patch or at least after every upgrade. Even though these patches and upgrade procedures are thoroughly tested I don't believe that this will suffice for keeping the system validated.

An option would be to run the system in a private cloud, where the customer can define (within certain limits) when patches and upgardes are applied.

Please keep us posted where your investigations take you!

Oliver

Re: Cloud, SaaS and Computer System Validation

Former Member — Fri, 08 Nov 2013 09:09:40 GMT

Hi Oliver,

That's of course one of the big discussions about real Cloud Solutions like ByD. But if you look at topics like storing data in the cloud e.g. the serialization area, where you'd like to track and trace the full supply chain.

There are a bunch of questions that need to be answered around data integrity.. Interesting though!

I will post my findings here

Kind regards,

Ruud

Re: Cloud, SaaS and Computer System Validation

Former Member — Thu, 05 Dec 2013 17:22:07 GMT

Hi Ruud, Oliver:

Cloud compliance is achievable and is in a similar state of re-definition that occurred for previous technology changes (relational databases, client server architectures, web-based technologies, virtual systems, etc.). CSV practice re-definition is also occurring as it did in the past (risk based validation, GAMP revisions, etc.).

USDM is supporting several major life science clients and application providers, and SaaS providers to achieve and maintain FDA (ICH) compliance.

Also, we have worked with SAP on validation initiatives and offer a validation accelerator pack for SAP. We will now expand the VAP to support the UDI and Federal Serialization regulations.

Can I reach out to you privately to expand on this discussion?

Jim

Jmacdonell@usdm.com

Re: Cloud, SaaS and Computer System Validation

oliver_nuernberg — Fri, 06 Dec 2013 10:10:30 GMT

Hi Ruud,

I got questions like this a lot lately (especially in the context of serialization), sentences like "These data are too sensitive to store them in the cloud!" or "I won't store my data in the internet where everybody can see them!". These are statements you should really think about! But on the other side.....check out how SAP manages it's Data Center (http://www.sapdatacenter.com). Maybe your data are better protected in SAP's data center than in your own?

And in this context you should also ask yourself not only whether your data in the cloud are protected against unauthorized access but also whether the data will always (!!) be accessible for you (!!). So is authorized access guaranteed for all time at all time? So, ask this:

Will the cloud company be around in 5 years? If a classic software provider goes out of business, you still own the software. If your cloud provider caves your cloud Solution will be gone.
Where is the company located and where will your data be stored? Are you actually allowed to store your data at that data center? E.g. person related data of EU employees are not allowed to be stored outside of the EU. Check also which laws apply at these locations. Governments might have access to the data by law, e.g. in case of crime investigations.
Who is backing the cloud company? Is it publicly traded or private equity and in the latter case who has a share? You don't want to end up running a solution at a provider that is actually controlled by your biggest competitor through a private equity investment.

In general, make sure to familiarize yourself with Cloud Solutions (there is way too much nonsense out there), e.g. by scanning the Cloud Computing Space in SCN ( http://scn.sap.com/community/cloud ). You'll find great content , e.g. the Myth Buster series by ...e.g. http://scn.sap.com/community/cloud/blog/2013/11/13/cloud-myth-busting-myth-5-business-in-the-cloud-is-not-proven .

Have fun.

Oliver

Re: Cloud, SaaS and Computer System Validation

Former Member — Fri, 06 Dec 2013 13:11:06 GMT

Hi Oliver,

Indeed, maybe the mind set must also change. Is it feasible for a SME customer to secure their data, so it can't be tampered with? I wonder...

If regulatory bodies will see Cloud as a phenomenon that is to stay, they will sure demand answers to what you state above. I think Hybrid and private cloud constructions are even easier to validate then we currently presume, although I'm not familiar with the techniques behind cloud storage, a hard drive is still a hard drive

I think the validation of the Amazon's of this world is feasible, but how do we validate the communication between a Cloud system? As of today it seems that all communications can be tampered with..

Whenever a answer comes to a question, regarding this topic, new questions arise. It's very interesting though!

Thanks for sharing your thoughts!

Kind regs,

Ruud

Re: Cloud, SaaS and Computer System Validation

oliver_nuernberg — Fri, 06 Dec 2013 14:15:53 GMT

Hi Ruud,

good question:


....how do we validate the communication between a Cloud system?

... I don't know (its one of the things I try to figure out), so let me ask you this: How do you validate the communication between a supplier's on-premise system and a customer's on-premise system, e.g. via EDI or calling a web-service when the comunication contains a q-certificate or serial numbers that are being communicated to e.g. the Tureky MoH.

In all cases you have communcation going through a cable or via a satellite and that can be tampered with. So is this really a cloud specific issue?

Gosh... I was hoping for some answers and get more and more questions .....
Oliver

Re: Cloud, SaaS and Computer System Validation

Former Member — Wed, 18 Dec 2013 09:36:08 GMT

Hi James,

I think if we expand this discussion here, it would be highly appreciated by the members. I've taken a look at USDM's track record and I believe your input could be valuable!

@Oliver, do you agree?

Topics could be:

Use cases in a GxP environment*

Risk-based approach
Specific responsibilities of the cloud service provider
Specific responsibilities of the cloud customer
Separation of GxP vs. non GxP

Where do the regulatory bodies stand?*

Inspection Trends EMA – Annex 11
Inspection Trends FDA
Inspection Trends other countries

Regs,

Ruud

*Topics from Cloud Computing and Outsourcing in a GxP Environment by ECA

Re: Cloud, SaaS and Computer System Validation

oliver_nuernberg — Thu, 19 Dec 2013 07:14:43 GMT

Hi Ruud, James,

good point...I also would like to have this dicsussion continued with input from different angles.

We had a discussion lately about the scope of a validation project of a cloud solution compared to a on-premise solution. Overall the tasks seem to be the same, it was just a question on who has to execute the task. In a cloud scenario more tasks are on the provider side and therefore subject of an audit. This impacts especially Infrastructure Qualification and Security/Privacy. There might be a few additional tasks for cloud solutions though.....

What do you think?

Oliver

Re: Cloud, SaaS and Computer System Validation

oliver_nuernberg — Wed, 08 Jan 2014 09:52:39 GMT

....one more update on this topic (and I keep digging).

We (i.e. SAP) actually have a validated SaaS offering for SuccessFactors LMS (Learning Management Solution). Check out the "validated SaaS Brochure". In my view this approach might very nicely aslo fit other cloud apps.

(You may also want to check out the latest version of the "Part 11 Whitepaper" for the Business Suite)

Oliver

Re: Cloud, SaaS and Computer System Validation

Former Member — Mon, 25 Aug 2014 09:56:37 GMT

Hi,

We've wrote a blog about Cloud Validation and compliancy, check it out:

Compliant in the Cloud: An outlook on the adoption and validation

Let me know what you think.

Regs,

Ruud

Re: Cloud, SaaS and Computer System Validation

yuko_uesako — Thu, 06 Nov 2014 02:32:58 GMT

Hi Ruud,

Sorry for interruption.

I recently joined into the world of Life Science, and it was very interesting to read the discussions above.

I was really hoping to read the blog you mentioned, but the link shows an error "document not found".

Would you please repost the blog ?

Thank you.

Yuko

Re: Cloud, SaaS and Computer System Validation

Former Member — Thu, 06 Nov 2014 10:28:47 GMT

Hi Yuko,

Welcome Hereby!

Compliant in the Cloud: An outlook on the adoption and validation

Kind regards,

Ruud

Re: Cloud, SaaS and Computer System Validation

Former Member — Tue, 21 Jul 2015 20:48:09 GMT

This message was moderated.