11 (EMA): Requires validation of all systems impacting GxP processes

MHRA & WHO: Emphasize vendor oversight, data integrity, and shared responsibility

GAMP 5: Advocates a lifecycle approach including supplier assessment, configuration management, and risk-based validation

Shared Responsibility Model in CSV

In cloud systems, the responsibility for system validation is shared between:

Area	Responsibility
Infrastructure (IaaS)	Vendor (e.g., AWS, Azure)
Application Configuration	Customer (Pharma company)
GxP Functional Testing	Customer
Data Integrity, Audit Trail	Both Vendor and Customer
Backup/Restore Testing	Vendor (execution), Customer (oversight)

Thus, oversight of vendor controls becomes a core CSV activity.

Vendor Qualification: A Prerequisite to CSV

For GxP compliance, pharma companies must ensure vendors meet quality and regulatory expectations:

• Assess vendor’s QMS (SOPs, training, deviation management)
• Review vendor’s validation documentation (IQ/OQ scripts, test results)
• Confirm availability of audit trail, access controls, and backup mechanisms
• Obtain SSAE-18/SOC 2 Type II or ISO 27001 certifications
• Conduct remote or on-site vendor audits

Refer to PharmaRegulatory.in for downloadable cloud vendor audit templates.

Cloud CSV Validation Lifecycle

1. Validation Plan

• Define validation scope, responsibilities, and acceptance criteria
• Outline strategy for testing vendor-supplied vs. customer-configured functions

2. URS and Risk Assessment

• Document GxP functions (e.g., deviation workflows, lab result approval)
• Assess risk for each feature: likelihood x impact x detectability
• Apply controls to high-risk areas (e.g., dual signature, audit trails)

3. Configuration Specification & Design

• Capture user-defined configuration (e.g., access levels, workflows)
• Include configuration verification as part of OQ testing

4. IQ/OQ/PQ Testing Strategy

Cloud-based systems may follow a hybrid testing strategy:

• IQ: Confirm access, instance name, environment setup, version control
• OQ: Verify Part 11 features (audit trail, access control, signature), vendor config, backup validation
• PQ: Execute workflows using live scenarios (e.g., change request routing, incident closure)

Testing ALCOA+ & Audit Trail in the Cloud

• Ensure user actions are logged with timestamp and user ID
• Verify audit trails are read-only and exportable
• Check that electronic signatures require re-authentication
• Validate time zone sync, access privilege hierarchy, and record completeness

Sample Audit Trail Test Case

• Test Objective: Validate audit trail for document approval
• Test Steps:
  1. User uploads controlled document v1.0
  2. Reviewer rejects with comment → new version v1.1 created
  3. Approver approves with e-signature
  4. System logs all actions with ID, timestamp, role
• Expected Result: All events traceable via audit trail viewer

Backup, Restore & Disaster Recovery Validation

These elements are typically managed by the vendor, but must be:

• Tested annually or after major changes
• Documented with recovery time and recovery point objectives (RTO/RPO)
• Subject to customer oversight or audit reports
• Reviewed via Service Level Agreements (SLAs)

Cybersecurity Controls for Cloud-Based GxP Systems

• Two-factor authentication (2FA) for all user logins
• IP whitelisting, session timeout policies
• Role-based access control (RBAC)
• Encryption of data at rest and in transit
• Audit trail of user login/logout activities

Post-Implementation Review & Change Management

• Review vendor release notes for each update
• Trigger revalidation (PQ regression) for any GxP-impacting change
• Maintain change control log
• Ensure backup validation and audit trail continuity after changes

Documentation Package for Cloud CSV

• Validation Master Plan (VMP)
• Vendor Qualification Report
• Cloud-Specific Risk Assessment
• URS/FS/Design Specs
• Traceability Matrix
• IQ/OQ/PQ Protocols with sample data
• Audit Trail & Backup Validation Report
• CSV Summary Report
• SOPs: Vendor Oversight, Data Integrity, eSignatures, Change Control

Common Audit Gaps & Risk Areas

• No formal vendor qualification or SOP
• Lack of documented audit trail verification
• Backup testing delegated to vendor without oversight
• System updates implemented without PQ regression testing
• No control over access rights or e-signature authentication

Conclusion

Cloud-based platforms offer scalability, cost-efficiency, and speed — but require stringent validation to remain compliant in a GxP environment. By following a lifecycle approach tailored to SaaS/IaaS models, establishing shared responsibility agreements, and performing rigorous functional testing, pharma companies can confidently validate and operate cloud systems in full compliance with FDA, EMA, WHO, and ICH guidelines.

Explore tools, SOPs, and cloud CSV templates at PharmaSOP.in or learn more about vendor risk assessment and Part 11 audit strategies at PharmaValidation.in.

Recommended References

• FDA Guidance on Part 11
• EU Annex 11 – Computerised Systems
• ICH Q9 – Quality Risk Management
• WHO TRS 1019 – GxP Computer Systems
• PharmaRegulatory.in