GxP-Compliant Cloud Services

In this case study, an existing quality management system was further developed to enable the GxP-compliant use of cloud services.

Problem Statement

The customer is an internationally operating company in the field of pharmaceutical contract development and manufacturing (CDMO). Its services include comprehensive product development from the early research phase through to commercial serial production. In addition, its offering includes the manufacture of pharmaceutical active ingredients and finished medicinal products.

The company plans to increase its use of cloud services, particularly in infrastructure (IaC). It also plans to use these services later for the hosting of GxP-relevant systems. To achieve this objective, the customer required:

Analysis of the global quality management system with regard to its suitability for managing cloud services in the areas of infrastructure, Infrastructure as Code (IaC), as well as system deployment and operation
Identification and assessment of potential gaps in the existing process framework, as well as the development of practical, regulatory-compliant solutions for cloud environments
Creation and revision of policies, directives, SOPs, work instructions, and required templates for the areas of infrastructure and computerised system validation to ensure a consistent and auditable approach

Project Execution

In the first phase, the company’s existing quality management system was analysed with regard to its suitability for the use of cloud services. In addition, the quality management system was evaluated taking into account regulatory requirements and relevant industry standards. Subsequently, concrete change proposals were developed for the affected processes. These proposals were then aligned with the responsible departments. The finalised documents were then approved in accordance with the customer-specific processes. Afterwards, these documents were implemented within the company.

Results and Benefits

The project was successfully completed on schedule and within the planned budget. This was possible, as the analysis, creation, and approval activities were appropriately planned and precisely coordinated.

The revised processes of the global quality management system provide a clear, regulatory-compliant framework for the use of cloud services. They cover, in particular, Infrastructure as a Service (IaaS), Infrastructure as Code (IaC), as well as the deployment and operation of computerised systems in cloud environments. Furthermore, they define consistent requirements for planning, qualification, change and release management, monitoring, as well as incident and problem management in cloud contexts. These requirements ensure that all activities are documented consistently in a GxP-compliant manner.