Here to Stay. Understand the needs of different business units for security, validation, and monitoring. Frank Jacquette

Transcription

1 Now That The Cloud Is Here to Stay Understand the needs of different business units for security, validation, and monitoring Frank Jacquette Jacquette Consulting, Inc.

2 Who is this guy? Founder, CEO, janitor Jacquette Consulting Software developer by trade, validation practitioner by necessity Worked in pharmaceuticals, medical devices, animal health Disclaimers and caveats

3 My ygoal for you: don t be the Pointy-Haired Boss

4 What we ll cover Terminology and the meaning of cloud Which business units care and what they care about Questions you must ask a prospective cloud vendor Validation approach for cloud-based systems Audits involving cloud vendors

5 Terminology basics Vlidti Validation establishing documented d evidence that a process will consistently produce a product meeting its pre-determined specifications and quality attributes Qualification making sure the system behaves as expected in its actual production environment Verification making sure that the system continues to produce results as expected

6 Abusing the word cloud Cloud is not a technical term, it s a marketing term Has been used to mean many different things: Hosted infrastructure or platform (IaaS, PaaS) Hosted applications (SaaS) On-demand computing/high-performance computing Distributed computing Local servers administered by someone else

7 What cloud really means Somebody else s s problem

8 What cloud really means Somebody else s s problem until it fails.

9 The business units that t care Information technology (IT) the folks that normally manage the hardware and software systems Compliance, QA, validation the folks who make sure that the systems produce the desired results The business the users of the systems

10 IT cares about Security don t break my systems, don t steal my data, don t destroy my data Reliability gotta keep the systems running User happiness nobody likes to get yelled at

11 Compliance cares about Compliance does it fulfill regulatory requirements for a system of this kind? Accountability who is responsible for ensuring that the system does what it should? Testability how can I demonstrate that it fulfills its Testability how can I demonstrate that it fulfills its requirements?

12 The user cares about Productivity I need to do my job faster, easier, better Reliability I just expect it to be there Accessibility why do I have to carry two phones? Why can t I work from home? Why can t I use my ipad? The feeling of control nobody likes to feel powerless because of technology (Who do I call if it breaks?)

13 What everyone cares about Clarity what am I getting, how will it help me, what is expected of me Consistency I don t want to deal with something different every day Control if my job is on the line I d better be able to Control if my job is on the line, I d better be able to get problems addressed

14 The importance of questions When choosing a cloud vendor, you need answers So here are some questions you really need to ask

15 Questions: Hardware Where are my servers? Are they virtual? Do they share equipment with other customers? Can I visit my servers at any time? Can I take them if I want to? Are the servers yours or mine?

16 Questions: Security How are my servers secured against the outside world, physically and virtually? How are they secured from servers used/owned by other customers? How are they backed up? Where are my backups? Do you do recovery drills? Can I take backup copies? Do you have third parties do audits? Penetration Do you have third parties do audits? Penetration testing?

17 Questions: When Bad Things Happen What if there s a fire and your data center burns? What if there s a hurricane and the whole state loses power for days? What if the FBI shows up and seizes servers in the same room? How will I be notified if you detect a security breach or other issue? How do I access my data if your systems are down?

18 Questions: Data If you go bankrupt how do I get my data and systems? Who owns the data, you or me? How do you dispose of old equipment, especially primary or backup media? Can I sue you if you lose my data? Do you have insurance against the loss?

19 Questions: Validation How are your applications i validation-ready i d so that I, as the user, can validate them? How do you manage SOPs and other documents that support validation? How do you support system qualification? How do you manage user training records? Do you have a dedicated QA manager?

20 The Most Important t Question Do you TRUST this vendor to listen, understand, and respond competently to your concerns??

21 Questions, questions, questions I don t have the answers for you, but your cloud vendor MUST if things are going to go smoothly Unwillingness or inability to answer these questions is a BIG RED FLAG This list of questions became so long that I ve created an entire guide Send me an at frank@jacquette.com and Send me an e mail at frank@jacquette.com and I ll be happy to send it to you

22 Validation approach for cloud-based d systems A cloud-based d application i is just like any other Differences are access to and control of the vendor s environment, but that s not that different from a distant server administered by an outsourced firm Walk away from a vendor who doesn t understand and Walk away from a vendor who doesn t understand and respond to regulatory concerns

23 Vlidti Validation Is the software yours (IaaS, PaaS) or theirs (SaaS)? S)? Does the vendor offer a software validation process to use as a starting point? If they do offer a validation process, what templates or services do they provide? Use your normal validation approach with an extra dose of skepticism

24 Qualification Vlidt Validate the applications, i but qualify the environment Qualification is different because the systems are at arm s length, but you still need to demonstrate access and control Make sure that the vendor understands that change Make sure that the vendor understands that change control matters in a qualified environment

25 Verification Regardless of what the vendor provides, your organization must still perform verification How do you test? Do you have test data? Is there a separate test environment? How do you log issues with the vendor? How do you confirm that issues have been addressed?

26 Red flags The vendor doesn t get validation, thinks it s just some document signoffs or a PowerPoint deck The vendor is unwilling to grant the needed access and control The vendor argues that your requests are impractical for technical reasons

27 More red flags Your systems or data share hardware with other customers You don t have the ability to walk away (with your data) at any time The vendor is unresponsive to regulatory and business needs The vendor seems hazy on the idea of change control

28 AUDITS

29 Interpreting vendor-supplied audit results Many cloud vendors, especially IaaS and PaaS providers, like to tout vendor-supplied audit results Some results are useful, some are not Make sure the audits are relevant to your situation Sometimes they provide their own audits to try and deflect you from performing yours

30 Vendor audits (example) There are LOTS of standards d out there, but they are often misapplied SAS 70 internal financial controls of service orgs ISO 9000 quality management systems 21 CFR 11 ERES in regulated settings Auditors measure compliance with the standard, not the appropriateness of the standard

31 Interpreting ti audits Does the standard d make sense for your organization s i needs? Do the audits show a well-run environment? Do the audits show an understanding of your regulatory environment? Most importantly, will the cloud vendor allow you to send in your own audit team?

32 Performing your own audits Auditing i a cloud vendor is just like auditing i any other third party Cloud vendors will sometimes throw up smokescreens to try and prevent you from visiting their sites or seeing their operations Insist on auditing things the way you want, not the way the vendor wants

33 If you are audited d An audit that involves a cloud-based d system is just like any other audit that involves a third-party vendor Inform the vendor, get your house in order together If the vendor can t hack it, you picked the wrong vendor so you need to select the right vendor, manage them carefully, and be ready to change if necessary

34 Conclusion The cloud is just the next evolution in information technology delivery It presents some new challenges in validation, but nothing that we can t handle In the end you need a vendor that is competent, customer-focused, and familiar with regulated environments It s a lot easier to select a good vendor up front than to deal with a bad vendor down the road

35 Thanks Frank Jacquette