Datacenter Qualification from GxP perspective
In this entry we will introduce you in the DC GxP qualification.
Initially we can encounter with one of the following scenarios:
- Scenario A: DC owned by the pharma company
- Scenario B: DC owned by the external supplier
- Scenario C: Sum of both previous scenarios (A and B)
Scenario A: DC owned by the pharma company
Normally, the size of a DC depends on how big is the pharma company and its operations. In fact, in small and medium companies we can find small DCs or also called Technical rooms. The qualification will vary depending on the requirements applied in each case.
Basically, the service provided by the room is hosting. In this way, the GxP qualification should ensure:
- Physical security
The qualification of the DC network can be included or not depending on decisions or maturity of the pharma company. It will also depend on the qualification strategy applied: vertical or horizontal.
Technical, user and regulatory requirements should be covered independently the chosen strategy. Thus, the TIA-942 standard could be a major help. This standard classifies DCs in 4 categories (TIER I, TIER II, TIER III and TIER IV) depending on the architectural, electrical, mechanical and telecommunication characteristics of them.
The GxP qualification should also identify the potential risks and they should be mitigated.
Scenario B: DC owned by the external supplier
A key point in this scenario is to know that, even if the pharma company is not the owner of the DC, it is responsible of the GxP data stored in these DCs. That means the pharma company should qualify the DC too.
So, the external supplier should be assessed to ensure it complies with applicable regulatory and security requirements. Some external providers have certified DCs (TIER level) and can be audited, others provide documentation like qualification guides or SOC reports, proving the DC controls are tested periodically. The GxP qualification should be faced in one way or another depending on the provider.
Scenario C: Sum of both previous scenarios (A and B)
Finally, we can encounter with a mix of both scenarios (A and B). It will be the most complex case and it will require two qualifications: the internal one and the external DC.
All previous scenarios have a crucial factor in common that should be faced during the qualification phase, this is the Contingency Plan. In future posts we will deepen on how to manage this factor to know the different layers where it affects.