Cloud applications are being deployed within life sciences Enterprises at a rapid pace. Microsoft office 365, Microsoft dynamics 365 and the cost benefit of deployment of other such applications are driving the adoption of cloud applications for regulated systems. The question that is always asked is can cloud systems be validated? The reason for the inquiry is due to the fact that many understand how clouds are deployed and maintained over time. In an effort to keep pace with system performance, security and other related controls in the cloud, cloud providers often update their environments to keep pace. The constant updating of the cloud environment makes it challenging from a systems validation perspective. Maintaining the validated state in a cloud environment is often challenging due to this fact.
So can cloud applications be validated and what are the unique processes that must be changed to accommodate cloud validation? The short answer is yes, cloud applications can be validated. However, there are changes required to the validation strategy to ensure that the system meets its intended use and the validated state is maintained over time.
ALL CLOUD PROVIDERS ARE NOT CREATED EQUAL
When choosing a cloud provider, it is helpful to understand that all cloud providers are not created equal. To my mind they are divided into two distinct camps: (1) those who understand regulated environments and (2) those who do not understand regulated environments. The first order of business for establishing a validated system in the cloud is to select your cloud providers carefully. I usually like to look at cloud providers who have experience in regulated environments. This goes for any application that you’re using in a highly regulated environment. It is super important that your vendor understand the regulatory requirements that you have to comply with and that in their service they build in best practices to help you comply. This will go a long way during the supplier audit process to confirm that you’ve done your proper due diligence on your cloud provider.
UNDERSTANDING RESPONSIBILITIES IN A CLOUD ENVIRONMENT
It is important to understand responsibilities in a cloud environment. With packaged software applications, you have complete control over the environment. With the various cloud service models, responsibilities vary depending on the model used as shown below. For Infrastructure-as-a-Service, you manage the applications, data, runtime, middle ware and operating system. While the vendor manages virtualization, servers, storage, and networking. Please keep in mind that the principles of validation endure in the cloud. You, not the vendor, are ultimately responsible for the environment and its management. Therefore, you need to choose your cloud vendor wisely.
You can see with Platform-as-a-Service (PaaS) and Software-as-a-Service (SaaS), you have less responsibility for the management of the system. In the SaaS model, you do not control the application or infrastructure. The vendor manages the application and it underlying architecture.
The strategy for validation changes based on the cloud model deployed.
The strategy for validation changes based on the cloud model deployed.
CONTINUOUS TESTING IN THE CLOUD
Previously four on premise systems, the validation engineer in consultation with the IT team determined how often validated systems environments were reviewed and updated. If the validation engineer did not want to apply a patch or an update, they simply left the system alone. Many validation engineers due to the labor involved in updating and documenting a validated system would often leave the system in a state where no changes, patches, or updates were applied. In today’s systems due to the threats from cyber security and frequent changes to browser applications, it is not possible to leave a system unpatched. To do so may leave your validated systems environment more exposed to security threats.
Therefore, when validating in the cloud you must employ a continuous testing strategy. When I say that to validation engineers they often cringe thinking of continuously having the test a validated systems environment. This is easier than you may think if you’re using automated tools for testing. Continuous testing is simply a validation testing strategy where on a designated schedule defined by the validation engineer, a system is routinely tested to ensure that patches, and routine updates do not impact the validated state. Continuous testing is facilitated best through automation. When developing a reusable test script Library, you can easily conduct an impact analysis and determine which tests need to be rerun. Regression testing is made easy through validation test script automation. Therefore, it is strongly recommended that if you deploy systems in a cloud environment that you employ an enterprise validation management system that includes automated testing such as ValidationMaster™.
Cloud applications can be validated. The strategy changes based on the cloud model selected. Choose your partners carefully. They assume an important role in the management of critical system assets.
It is not a question of if a cloud application can be validated, it is a question of the deployment model you choose and the validation strategy that will govern deployment. Regulators are not averse to you using the cloud – its all about managing control and risk.
