When IT goes down, preparation decides.
In the January/February 2024 issue of ISPE Pharmaceutical Engineering, Frank Henrichmann, Oliver Herrmann, Maximilian Stroebe and Marcus Schwabedissen use a case study to show what matters in disaster recovery in a GxP-regulated environment - and why a cyberattack is not just an IT problem but a question of product quality, patient safety and data integrity.
Disaster recovery is a quality task.
As digitalization advances, pharmaceutical business and decision processes depend on IT systems and data being continuously available - criminal activity, political unrest and environmental risks make disaster recovery and business continuity planning indispensable. Using a hypothetical case study - a successful ransomware attack on a mid-sized pharmaceutical company - the article walks through the typical pitfalls and shows how to restore operations and compliance, with the quality function becoming the "enabler" that creates robust documentation for accountable releases.
Ransomware as a time bomb.
Cyberattacks have been rising for years; ransomware and phishing are the biggest threats to the industry. The central question is not how to achieve 100 % security - there is no such thing - but how a backup stays reliable:
GAMP 5 Second Edition and the ISO standards.
The preparedness paradox.
People tend to believe disasters only happen to others ("Why would anyone attack us?") - the article calls this pattern the "preparedness paradox". Its building blocks and consequences:
Three disciplines, one lifecycle.
The three disciplines are closely intertwined and are managed across the entire system and data lifecycle - as a continuously maintained capability, not a one-off project. In an emergency, work runs in parallel and documentation is less controlled than in normal operation: a risk- and judgment-based approach is indispensable.
Written from practice.
The article comes from a QFINITY author team - Frank Henrichmann (Senior Executive Consultant), Oliver Herrmann (Founder and CEO) and Marcus Schwabedissen (COO and Senior Executive Consultant) - together with Maximilian Stroebe (PhD, Senior Manager, Janssen Vaccines & Prevention, A J&J Company). It was a Finalist for the ISPE Article of the Year 2024 (Roger F. Sherwood Award) and is an in-house publication - QFINITY's own position, written by practitioners who have supported disaster recovery scenarios in the GxP environment.
From emergency to lived practice.
Is your disaster recovery more than a backup?
We work with you, risk-based, to determine whether plans, roles and recovery paths hold in an emergency. Free initial consultation, about 30 minutes, directly with one of the authors.
Arrange an initial consultation
