HOSTING & PROCESS
SYLOGENT DEDICATED HOSTING VM VM VM VM VM VM VM VM VM VM VM VM VM VM VM HYPERVISOR HYPERVISOR HYPERVISOR DB1 active DB2 passive Clustered hypervisors that host dedicated VMs integrated with clustered Active / Passive databases utilizing a scaleable SAN. SAN Sylogent utilizes Rackspace Critical Care Support which guarantees 1 hour hardware replacement. Sylogent performs periodic failover tests. Patch management and virus protection is coordinated with Sylogent IT and Rackspace. The work is typically completed during preset scheduled maintenance periods.
SYLOGENT DEDICATED HOSTING PROD TEST TRAIN VM VM VM VM VM VM VM VM VM VM VM VM VM VM VM HYPERVISOR HYPERVISOR HYPERVISOR DB1 active DB2 passive Each client typically receives three dedicated instances of the system - Production. Testing. Training. SAN Rackspace performs nightly differential backups with weekly offsite full backups utilizing 4 week overwrite rotation.
Validation Plan ( optional ) Should be established and agreed between CLIENT and the SYLOGENT to meet regulatory requirements and expectations Sylogent will provide CLIENT a 21 CFR Part 11 Compliance Assessment document along with a Validation Certificate. As an option, CLIENT is welcome to validate the system if they prefer. Role Assignment Log Should be established and agreed between CLIENT and the SYLOGENT to meet regulatory requirements and expectations The Role Assignment is managed within the application by either Sylogent support team and or CLIENT. Additionally, CLIENT can provide Sylogent an Excel file with CLIENT users and their assigned roles that can be input into the system by either party. The system includes a User Report that can be generated at any time to verify Role Assignments. Risk Assessment for Application System Provider needs to be aware of identified risk and mitigating measures Sylogent performs a risk assessment for each application prior to development and will provide CLIENT with its AA-02-004 Risk Assessment Procedure. Specific design risks are also reviewed and addressed in validation document: This document is considered proprietary and may be viewed on-site. User Requirements Should be established on the system level and agreed between CLIENT and the SYLOGENT to meet regulatory requirements and expectations Sylogent will provide CLIENT with document [ X ] Product Requirements. CLIENT may map their user requirements to the Functional Requirements within this document, if desired. Any additional agreed upon requirements will be processed per Sylogent s FF-01-001 Change Control of Computerized Systems Procedure which Sylogent will make available to CLIENT. Data Migration Plan Must execute relevant parts of the migration plan as indicated by CLIENT Sylogent will migrate all CLIENT date from existing systems or documents as needed. Additional migration efforts need to be defined by CLIENT.
System Design Specifications Should be established on the system level and agreed between CLIENT and the SYLOGENT to meet regulatory requirements and expectations Sylogent Design Specifications for all applications are considered proprietary. An on-site visit is required to view applicable design specifications. Configuration Specification Should be established on the system level and agreed between CLIENT and the SYLOGENT to meet regulatory requirements and expectations, provider should maintain a current system configuration specification Sylogent will provide CLIENT with System Configuration Document. Upon completion, Sylogent will configure the application with settings defined in the configuration document. Any changes to the application configuration, post launch, will be managed through the FF-01-004 Change Control of Computerized Systems Procedure. Traceability Matrix Supplier should be able to demonstrate traceability of requirements and specifications to testing. Will be verified during supplier assessment. Per Sylogent s EE-01-003 Software Validation Documentation procedure, Sylogent traces from Requirement to Design Specification to Test Case. Although full documents in some cases can only be viewed on-site, Sylogent will provide CLIENT with the matrix portion of each document. Technical Installation Should exist for all CLIENT installations (GxP or otherwise) Sylogent performs qualification on all application instances. Sylogent will provide CLIENT with its EE-01-008 Installation Qualification Documentation Procedure. This includes the TEC-01-0010 Installation Protocol document that addresses technical installation. Installation Qualification Should exist for all CLIENT installations (GxP or otherwise) Sylogent performs qualification on all application instances. Sylogent will provide CLIENT with its EE-01-008 Installation Qualification Documentation Procedure. The installation qualification documentation includes the TEC-01-0011 Installation Report which will be provided to CLIENT post-launch.
Software Design Specification. Software Development Plan. Software Development Testing. The supplier must follow an acceptable software development process. Sylogent follows its EE-01-001 Software Development Life Cycle Procedure in conjunction with its EE-01-003 Software Validation Documentation Procedure. Sylogent will provide both procedures to CLIENT. Validation documentation consists of the following documents: OQ Plan/Report o TEC-01-0001 Product Requirements o TEC-01-0002 Project Plan o TEC-01-0003 Design Specifications (on-site only) o TEC-01-0004 Technical Specifications (on-site only) o TEC-01-0005 Code Review Report (on-site only) o TEC-01-0006 Build Notes (on-site only) o TEC-01-0007 SQA Testing Protocol (partial) o TEC-01-0008 SQA Testing Report (partial) o TEC-01-0009 Release Notes o TEC-01-0012 Validation Summary Report Should exist for all CLIENT installations (GxP or otherwise) Sylogent will execute a set of test cases to verify application is configured to CLIENT Configuration Document and application is functioning as expected. Sylogent will deliver to CLIENT a report of the test case results. PQ Plan/Report Should be established on the system level and agreed between CLIENT and the SYLOGENT to meet regulatory requirements and expectations Sylogent will execute a set of test cases to verify system is performing as expected. Sylogent will deliver to CLIENT a report of the system performance results. Change Control Process During the supplier assessment, CLIENT will verify a change control process that meets regulatory expectations is in place and followed. Sylogent will provide CLIENT with its FF-01-004 Change Control of Computerized Systems Procedure.
Periodic Review Process During the supplier assessment CLIENT will verify a periodic review process on the system level that meets regulatory expectations is in place and followed. Sylogent will provide CLIENT with its II-01-006 Product Review and Improvement Procedure. Incident Management Process During the supplier assessment CLIENT will verify an incident management process on the system level that meets regulatory expectations is in place and followed. Sylogent will provide CLIENT with its II-01-002 Incident Handling Procedure. Service Level Agreement An SLA should be established between CLIENT and the supplier Sylogent will work with CLIENT to establish an appropriate SLA. SLA generally includes the following: Scope of Work and Services, Deliverables, Sylogent and Hosting Responsibilities, Customer Responsibilities, Key Contact Information, Service Requests and Notifications, Technical Support, Maintenance, Upgrades, Response Times, Standard Training Services, Exclusions, Supported Versions, Escrow. A sample of a standard SLA is attached. Training Process The supplier should have a formal training program in place and this will be verified as part of the supplier assessment. The training program should include relevant GxP topics Staff training is conducted annually and records are available on-site. Sylogent will provide CLIENT with its CC-01-001 Training Procedure. Security Administration The provider must have a thorough provisioning/de-provisioning process in place and be amicable to CLIENT auditing the process routinely. Sylogent will provide CLIENT with its Sylogent s DD-01-001 Master Security Procedure.
Retirement The supplier should have a process for system retirement as part of the life cycle approach and will be verified as part of the supplier assessment, including elimination of "CLIENT data" residing on their systems. Sylogent will provide CLIENT with its EE-01-009 Application and Instance Retirement Procedure. Data Center Qualification The supplier must have a properly qualified data center; the status of the qualification must be periodically reviewed. This will be verified as part of the supplier assessment. Sylogent will provide CLIENT with its AA-02-003 SYLOGENT Qualification Procedure. SYLOGENT Evaluation and SYLOGENT Assessment forms can viewed on-site, if desired. In addition, the ISO 27001 and SSAE16 Certifications (SOC reports) will be provided. Data Center Security The supplier must have data center security processes that ensure only authorized individuals have access to the data center. CLIENT will verify the existence of procedure governing these activities during the supplier assessment Sylogent will provide CLIENT with Sylogent s DD-01-001 Master Security Procedure and the following documents in support of the Rackspace data center: ISO 27001 and SSAE16 Certifications (SOC Reports). Disaster Recovery CLIENT must verify a disaster recovery that meets CLIENT s requirements is in place and that it is periodically tested. This will be done as part of the supplier assessment. Sylogent will provide CLIENT with its GG-01-006 Disaster Recovery and GG-01-005 Business Continuity Procedures. Back Up - Recovery The supplier should have a documented process for BU&R and have evidence of successful testing. This will be verified during the supplier assessment. Sylogent will provide CLIENT with its FF-01-004 Rackspace Data Hosting Procedure which addresses back up of client data. Sylogent will also provide CLIENT with its GG-01-003 Administration Systems Backup and Recovery Procedure (Sylogent data only and does not house client data). Data Transfer Appropriate processes for data transfer from the provider site to a CLIENT site, or for transfer from system to system within the provider site, must be established and agreed (e.g. encryption etc.). Sylogent will provide CLIENT with its DD-01-004 Data Interchange Procedure.
SYLOGENT 411 South State Street Newtown, PA 18940 +1 215.504.7000 Jack Yeager - CEO jack.yeager@sylogent.com +1 215.504.7000 x26 Dawn Albano - QC dawn.albano@sylogent.com +1 215.504.7000 x25