Implementing a Cloud based Temperature Monitoring System 

Risks of Hosting a
Temperature Monitoring Solution in the Cloud

Five Risk Mitigation Strategies

There are many risks related to hosting a GxP-compliant temperature monitoring solution in the Public Cloud. The following gives an overview of the risks and proposed mitigation measures.

Data Safety and protection

1. Implement security measures to protect data from unauthorized access.
2. Back-up data to secure data from being deleted or lost.
3. Align with privacy regulations (e.g. GDPR)

Change Management

Service Level Agreement (SLA) with clear definition of how to deal with upgrades, patches and changes:

• Classification of changes (minor, major)
• Notification, documentation and qualification of changes

Validation

1. Supplier must prove, that all hard- and software components have been validated according to the GAMP5 model including validation plan, risk analysis and validation reports.
2. IQ-documentation of the cloud software provided
3. Provide efficient tools for qualification of customer-specific hardware components:
   1. Installation Qualification (IQ): what measurement hardware has been installed?
   2. Operational Qualification (OQ): does the measurement hardware and software configuration work together as planned?

Supplier Dependency & Business Continuity

Supplier SLA should include:

1. committment that supplier takes care of the maintenance and assurance of the accuracy, consistency and completeness of data over its entire life-cycle.
2. meaningful notice period prior to service termination.
3. statement that the client remains owner of the data and that data is available for download before the service ends.
4. statement that the performance and availability of the solution is guaranteed and that the supplier monitors the availability and performance of the solution and provides reports thereof.
5. statement that the system and data is backed up regularly and recoveries are exercised and documented regularly.

Data Archiving

Before 2 years: Process Data is “fresh data” which is used for taking business decisions (e.g. MKT calculation of a stability study). For two years, the service provider must ensure that:

1. Process Data is available electronically for visualizations (e.g. zoom, overlay)
2. it must be possible to draw statistics easily (e.g. calculate MKT),
3. it must be possible to add comments in the system and generate reports (e.g. release decision),
4. it must be possible to export the data (e.g. to higher batch management system).

After two years: The service provider must ensure that Archive Data is available for at least 10 years and fulfils the following requirements:

1. clearly labeled (e.g. monthly report per sensor)
2. “human readable" form as a record (e.g. PDF/A report)
3. stored in a secure archive (e.g. in a drive that is backed up regularly to a different physical location)