An Industry-Leading Pharmaceutical Company Cuts Provisioning Time by 50% and Reaches 100% Compliance with Self-Service, GxP-Qualified AWS Infrastructure

An industry-leading pharmaceutical company was spinning off one of its subsidiaries into a standalone entity and needed AWS cloud infrastructure provisioned fast. Manual processes were producing delays, errors and over-provisioning concerns, against GXP standards that demand standardization, security, compliance and governance at every step.

Altimetrik rebuilt provisioning on Infrastructure as Code principles, writing design specifications for each AWS service, automating deployment and qualifying the result through formal IQ and OQ testing. The result: provisioning time halved through self-service, manual effort down 70% and full compliance enforced by launch constraint roles and policies.

Provisioning was manual, which meant delays and errors, and the controls around it were weak enough to raise over-provisioning concerns. Waiting on AWS services had become an operational constraint for teams that needed to move.

The company set four objectives: accelerate cloud infrastructure provisioning, adopt Infrastructure as Code using CloudFormation templates, meet GxP standards and give users self-service access to infrastructure.

Altimetrik devised a tailored approach, addressing the compliance and automation complexities inherent in pharmaceutical infrastructure provisioning. Design specifications became CloudFormation templates, deployed consistently across environments through automation, and the result was qualified through formal testing.

The process included

• Design Spec Development: comprehensive architectural diagrams and specifications for each AWS service, ensuring standardized and secure infrastructure configurations
• Automation: addressing automation challenges specific to the pharmaceutical industry, ensuring seamless provisioning of services to engineering and product development teams
• Installation and Operation Qualification: testing the infrastructure through IQ and OQ processes to validate functionality and compliance with regulatory standards

Our solution focused on

• Implementing Infrastructure Qualification (IQ) in AWS to ensure compliance with regulatory standards
• Developing detailed architectural diagrams and specifications for each AWS service
• Enabling self-service capabilities for provisioning infrastructure via AWS Service Catalog
• Implementing launch constraint roles and policies to ensure secure infrastructure provisioning

Compliance Requirements for Cloud Infrastructure

GXP standards are pivotal in pharmaceuticals, ensuring quality throughout the product lifecycle: GMP focuses on manufacturing processes, GLP on laboratory studies and GCP on clinical trials. To leverage cloud infrastructure while maintaining the integrity, security and regulatory compliance of operations, the following requirements and controls apply.

Validation and data protection

• Cloud infrastructure validated against GXP standards, including validation of cloud services and alignment with HIPAA, GDPR and FDA requirements
• Robust data security controls such as encryption, access controls and data anonymization to protect sensitive information stored and transmitted through cloud infrastructure
• Risk assessments, validation of data backup and recovery processes, and thorough documentation of configuration and management

Control and oversight

• Change control processes, documented changes and validation activities to ensure compliance and prevent disruptions, with the types of changes covered clarified
• Assessment and monitoring of cloud service providers’ compliance with GXP standards, including security control evaluation, audits and contractual compliance provisions
• Ongoing assurance of compliance from cloud service providers through certifications and audit reports
• Backup and disaster recovery plans to protect against data loss and ensure business continuity in line with regulatory requirements

Traceability and ongoing adherence

• Comprehensive audit trails and logging mechanisms to track access to sensitive data and detect unauthorized activities
• Employee training on cloud infrastructure use, security best practices, data handling procedures and regulatory requirements
• Detailed records of configurations, validation activities, security controls and audit findings, with regular reassessment, updated security controls and identified deficiencies addressed

Phases of Infrastructure Qualification

The Infrastructure Qualification process verifies that the cloud environment is suitable for hosting critical applications and managing sensitive data in compliance with industry regulations. It runs in five stages.

Plan

• Develop a detailed plan outlining objectives, scope and timeline of the qualification process
• Gather requirements from stakeholders: regulatory standards, industry best practices and organizational needs
• Gain insight into the cloud environment: architecture, services and configurations
• Define the scope of services qualified, considering critical applications and compliance needs

Design

• Create an architectural diagram depicting the structure and components of the qualified infrastructure service
• Create a Design Specification document outlining technical specifications, configurations and dependencies
• Generate IQ and OQ documents specifying test procedures and acceptance criteria

Build

• Translate the Design Specification into a CloudFormation template or equivalent infrastructure-as-code script
• Use automation tools and scripts to deploy the qualified service consistently across environments
• Publish the infrastructure service as a catalog item in the Service Catalog for easy provisioning and management

Test

• Execute IQ test cases to verify the infrastructure is installed correctly according to specifications
• Perform OQ tests to ensure the infrastructure operates as intended under normal operating conditions
• Validate functionality, performance, security controls and regulatory compliance
• Document test results, deviations and corrective actions for future reference and audit purposes

Maintenance

• Develop and implement maintenance procedures specific to each qualified infrastructure service
• Establish a schedule for regular maintenance: monitoring, patching, backups and upgrades
• Monitor service health, performance metrics and security alerts to proactively identify and address issues
• Update documentation, including IQ and OQ documents, to reflect changes and enhancements

Altimetrik qualified the infrastructure itself through IQ and OQ rather than automating around the controls, so speed and compliance came out of the same work instead of trading against each other.

With code-managed services published to the catalog, the client can extend the same qualified patterns to new environments as the spin-off scales, on a foundation built for reuse.