Cloud Computing: Is it unnecessary for large CSPs to provide Evidence of their IT Infrastructure's Compliance?

The trend in the pharmaceutical industry is also moving towards cloud computing. Financial but also organizational advantages speak for the cloud. At the same time, however, potential dangers and regulatory restrictions should also be taken into account. Nine experts from the pharmaceutical industry and regulatory authorities answer a comprehensive catalog of questions from the following GxP-relevant topics:

• Basics of Cloud Computing Technology
• Regulations and Expectations of Inspectors
• Customer-Supplier-Relationship
• Requirements for Cloud Service Providers (CSP)
• Requirements for Supplier Evaluation and Supplier Audits
• Requirements for Qualification / Validation

The following question is one of a series of questions that we will publish in further GMP News articles on this site in the coming weeks.

Question 26: Is it unnecessary for large CSPs to provide evidence of their IT infrastructure’s compliance? - Requirements for Qualification / Validation

No. Regulations do not distinguish between "large" and "small" providers, between new and established companies, between cheap and costly offerings.

The statements in our answer to question 15 also apply to large CSPs. However: A robust and safe operation of all its cloud services and solutions is the core aspect of the CSP's business model. This is true for all CSPs but even more for large ones. Often, the regulated company can benefit from higher standards and more rigor (though it should not exercise blind faith!).

While performing a supplier assessment by an on-site audit is difficult to impossible (typically, the willingness to cooperate is reciprocally proportional to the company size), the risk is generally lower and many procedures (incl. results and deliverables) are often provided on demand or already published as white papers, certificates, or reports (e.g. Amazons "Whitepaper: Building a solid foundation for GxP-regulated workloads on AWS", Microsoft's SOC Reports or Microsoft's Compliance Reports).

Amazon Whitepaper
Microsoft SOC Report
Microsoft Compliance Reports

Find more Q&As on the topic "Cloud Computing" which have been answered by the expert team.

The Experts

Frank Behnisch, CSL Behring GmbH, Marburg
Klaus Feuerhelm, Formerly Local GMP Inspectorate / Regierungspräsidium Tübingen
Oliver Herrmann; Q-FINITY Quality Management, Dillingen
Eberhard Kwiatkowski, PharmAdvantageIT GmbH, Neuschoo
Stefan Münch, Körber Pharma Consulting, Karlsruhe
Yves Samson, Kereon AG, Basel
Dr. Wolfgang Schumacher, Formerly F. Hoffmann-La Roche AG, Basel
Dr. Arno Terhechte, Local GMP Inspecorate / Bezirksregierung Münster
Sieghard Wagner, Chemgineering Germany GmbH, Stuttgart