Presenta<on to EMA GCP IWG. Cloud Services - A Framework for Adop<on in the Regulated Life Sciences Industry. Agenda item

Transcription

1 Agenda item Formed in 2004 >6000 members worldwide Not- for- proﬁt organiza<on Cross- industry WGs Stakeholders with FDA, EMA & PMDA phuse.eu Presenta<on to EMA GCP IWG Cloud Services - A Framework for Adop<on in the Regulated Life Sciences Industry 30 November 2015 Tony Hewer - Senior Quality & Regulatory Aﬀairs Director, Medidata Solu<ons Inc Stephen Bamford EU Events Director, PhUSE Cloud Services - A Framework for Adop<on in the Regulated Life Sciences Industry - Slide 1

2 Agenda History Topic Background Your ques<ons Where we re at with our framework Next steps Regulated Life Sciences Industry - Slide 2

3 Background Q3-2013: PhUSE engaged by PRISME 2013/2014: Team forma<on, brainstorming, case- studies - > framework concept Q1-2014: Test concept; CSS in MD 2014/2015: Team consolida<on, framework content refinement Q4-2015: New published framework >2015: Itera<ve development Regulated Life Sciences Industry - Slide 3

4 Issues (?) iden<fied NOT technology Evolu<on of approaches, terminology, understanding, jargon A percep<on of diversified controls, roles and responsibili<es client, supplier, sub- suppliers à more complex IT supply chains Absence of standards [applicable for GxP] SIMT apps QMS fitness for purpose Brings long- standing issues to the fore privacy, legacy architectures, [truly] interna<onalized solu<ons Park these thoughts. Regulated Life Sciences Industry - Slide 4

5 Framework Tenets Living framework document wiki- like Technology has and will change rapidly; Life Science companies changing too; synergy! Bake in flexibility and technology- neutrality to processes get things right at policy level Leverage NIST and ISO no need to reinvent Embrace cloud to stay/become innova<ve in use of technology but, stay in control Regulated Life Sciences Industry - Slide 5

6 Background Technology Evolu<on CGMP Applicability To 21CFRpart11 Hardware and SoBware General Principles of SoBware Valida7on; Final Guidance for Industry and FDA Staff Computerized Systems Used in Clinical Inves7ga7ons Annex 11 Electronic Source Data in Clinical Inves7ga7ons WHY Need Speed Convenience Produc<vity WHERE WHO MAINFRAME ERA Dedicated Specialists CLIENT/SERVER ERA On Prem Key Contributors INTERNET ERA Hosted / Portals All Employees CLOUD ERA Virtualiza<on Apps Everyone Regulated Life Sciences Industry - Slide 6

7 Stylized EDC/CTMS (etc) Cloud setup G4/5 Internet Users SaaS Web Apps G4/5 Various apps of various architecture Solu<on Stack G1/3 G1 SaaS/PaaS conﬁgurable recipes PaaS standardized/programmable G1/5 G1 IaaS standardized/programmable OS s Hypervisor - V Compute & Data Storage Networks Facili<es G1 IaaS commodi<zed IaaS commodi<zed SaaS & PaaS IaaS Mul<ple, connected, resilient Cloud Services - A Framework for Adop<on in the Regulated Life Sciences Industry - Slide 7 7

8 4 Key Roles Cloud Service Customer: In the context of GxP, these are generally the organiza<ons or en<<es that purchase/use the cloud services to support their GxP- regulated ac<vi<es. They are generally billed for the cloud services they consume, and depending on the services requested (IaaS, PaaS, SaaS), their ac<vi<es, use cases and GxP requirements may vary. Cloud Service Provider: Organiza<ons or en<<es responsible for providing cloud services to customers. The ac<vi<es that the cloud providers perform will vary depending on their par<cular service offerings and can include building, deploying, opera<ng and maintaining the cloud apps, infrastructure and associated service layers. Cloud Service Broker: These are the organiza<ons or en<<es that manage the configura<on, delivery and use of cloud services on behalf of the cloud customer. For example, cloud managers may perform infrastructure change control ac<vi<es on the infrastructure built using general purpose, commercial cloud services. Cloud Auditor: A cloud auditor is a party that is qualified to conduct assessments of the cloud provider and the cloud infrastructure underlying the IaaS, PaaS, SaaS services. The auditor may be an independent third party such as a third party assessment organiza<on (3PAO) or can also be a member of the consumer, provider or manager organiza<on. Regulated Life Sciences Industry - Slide 8

9 Cloud Supply Chains Cloud Service Customer Cloud Service Provider (PaaS/SaaS) Cloud Service Provider (PaaS/SaaS) Cloud Service Broker Cloud Service Broker Cloud Service Provider (IaaS) Cloud Service Provider (IaaS) Cloud Service Auditor Cloud Service Auditor Regulated Life Sciences Industry - Slide 9

12 Ques<ons posed Who owns the data when stored on vendor s servers? Fundamentally, the Cloud Service Customer. 2. What is the autude to server farms loca<on and sharing of par<<oned server with other clients? Loca<ons are various. Data storage is, typically, detached from compute servers. Clients/studies are logically segmented. 3. What considera<ons are given to data protec<on in the countries where servers may be located? Hot topic re. Safe Harbor invalida<on. Addressable via Cloud Service Customer/Broker/Provider contracts. 4. How should the cloud data be protected from unauthorised access? Security controls and access regimes by Cloud Service Customers, Broker and Providers. Regulated Life Sciences Industry - Slide 12

13 Ques<ons posed What considera<on is given to back up and restora<on? What are the minimum expecta<ons for this? Cloud Service Providers are highly geared to provide for data resilience to support the requirements of [other] Cloud Service Providers, Cloud Service Brokers and Cloud Service Customers. 6. What are essen<al components for considera<on in contracts with a cloud service provider? Data ownership Clarity of roles and responsibili<es Ongoing, opera<onal due- diligence by Cloud Service Customer/Broker of Cloud Service Brokers/Providers along supply chain. SLAs. Regulated Life Sciences Industry - Slide 13

14 Ques<ons posed What risks do you believe there are in using cloud? See earlier slide; not technology more about mindset and QS robustness and fitness. 8. How is it guaranteed that documents and data stored in the cloud are archived and ready for inspec<on for at least 25 years aver the end of the clinical trial (as required by ar<cle 58 of the European Clinical Trial Regula<on)? Focus must be on con<nued informa<on accessibility and durability. Cloud Service Providers can facilitate. 9. How can sponsors audit cloud solu<ons? Define and audit along the supply chain. 10. What about change control? Obviously important; change tends to increase down the technology stack. Providers are highly automated. Regulated Life Sciences Industry - Slide 14

15 Our Framework Presently formed as a guidance document Focused on cloud as a technology evolu<on What ll be the next era IoT? IaaS, PaaS and SaaS construct Customer/Broker/Provider/Audit construct Facilita<ng compliance with GxP predicate rules etc States of control A vehicle for changing approaches around Organiza<on and En<ty Interac7ons QS s Future- proofing [for technology and business advancement] Regulated Life Sciences Industry - Slide 15

16 Our Framework Acknowledgements Background/Introduc<on Execu<ve Summary Cloud Services An Introduc<on Essen<al Characteris<cs of Cloud Services Cloud Service Models in the Tradi<onal GxP Computerized System Context IT Supply Chain in the Cloud Era GxP Considera<ons for Cloud Service Customers and Cloud Service Brokers SDLC Policy - Cloud Specific Guidance Supplier Management Policies Informa<on Risk Management, Privacy and Data Protec<on Policies Cloud Security Glossary Appendices Quality Responsibili<es Matrix Quality Agreement Considera<ons System Security Plan Example References Cloud Services A Framework for Adoption in the Regulated Life Sciences Industry Last Update: 13-Oct-2015 This document has been developed by the Pharmaceutical User Software Exchange (PhUSE) Working Group on Cloud Adoption and is subject to ongoing consultation and feedback from all relevant stakeholders. You may submit comments and suggestions regarding this document to avid@nnit.com (Anders Vidstrup, NNIT A/S) and/or thewer@mdsol.com (Tony Hewer, Medidata Solutions Inc.). Pharmaceutical User Software Exchange Cloud Adoption Working Group 1 Regulated Life Sciences Industry - Slide 16

17 Next Steps More socializa<on Progress [Wiki] publica<on [by PhUSE] Ongoing, itera<ve refinement and expansion Open collabora<on/view- sharing Deeper dive follow- on? Regulated Life Sciences Industry - Slide 17

18 Thank you for your aoenpon QuesPons? Cloud Services - A Framework for Adop<on in the Regulated Life Sciences Industry - Slide 18

19 Benefits Scalability On- demand usage - > Fixed cost reduc<on Fault tolerance High availability Commodi<za<on of compu<ng, storage and networking Speed (of deployment) Measureable Regulated Life Sciences Industry - Slide 19

20 Cloud- based Systems in Drug/Biologic Development >12 years Discovery Laboratory / Safety Clinical / Efficacy Manufacturing + Distribu<on Post- Marke<ng GXP- regulated Genomics HPC Computa<onal Chemistry Lead Compound Selec<on Transla<onal sciences ELN SDMS LIMS DWH + Analy<cs CTMS EDC/CDMS Pharmacovigilance Ethics Commiyees DWH + Analy<cs ERP MES Supply Chain DWH + Analy<cs Website hos<ng Social media Medical affairs/pv CRM Outcomes analysis DWH + Analy<cs GXP Quality Systems, Document & Drawing Management, esubmissions, Recordkeeping IT Infrastructure: Security, Data Center, Networking, Enterprise Applica<ons Regulated Life Sciences Industry - Slide 20

21 Cloud- based Systems + Medical Device/App Development <2 years Discovery Laboratory / Feasibility Clinical / Valida<on Manufacturing + Distribu<on Post- Marke<ng GXP- regulated Mechanism of ac<on CAD Computa<on Fluid Dynamics Finite Element Analysis CAD ELN DHF/PLM Prototyping Test Suites DWH + Analy<cs CAD CTMS EDC/CDMS DHF/PLM Test Suites Ethics Commiyees DWH + Analy<cs ERP MES DMR/PLM Supply Chain DWH + Analy<cs MDDS CRM Social media Medical affairs Outcomes Analysis DWH + Analy<cs Quality Systems, Document & Drawing Management, Configura<on Management, esubmissions, Recordkeeping IT Infrastructure: Security, Data Center, Networking, Enterprise Applica<ons Regulated Life Sciences Industry - Slide 21

22 Responsibili<es Laboratory, Clinical, or Manufacturing Process Customers AWS Step 1 Step 2 Step 3 Manual I/O Human User Interface Automated I/O Device Controller Interface GxP Applica<on GxP Data Sovware- defined Infrastructure AWS Account Automated I/O Instrument Sensor Interface Amazon IAM Amazon VPC Amazon EC2 Amazon S3 Amazon RDS Other AWS Products... Regulated Life Sciences Industry - Slide 22