Reduce time to provision, configure, and test a GxP compliance-aligned infrastructure on AWS to maintain a continuously validated state. Automate creation of an Installation Qualification (IQ/OQ) report. A 30-40% reduction in qualification times for moving regulated workloads to the AWS Cloud is typical.

Inherit global security and compliance controls with dedicated hosts/instances for patient data and tools to encrypt data at rest or in motion. Encrypt at-scale to comply with local data privacy laws such as PCI DSS, SOC, FedRAMP, NIST, ISO, HIPAA, and HITRUST.

Enable continuous monitoring and alerting with centralized audit/logging capabilities for applications running on GxP compliant infrastructure. Leverage automated traceability with real-time audit view and risk management.

What does this solution do?

While the use of Continuous Integration/Continuous Delivery (CI/CD) and automated testing tools has been available for some time, fully automated deployment of infrastructure and execution of the Installation Qualification (IQ) step is now available. The architecture below provides a reference design for automating testing that shows that the installation and configuration of software and hardware is correct.

Assuming the IQ step completes successfully, the automation can continue to the automation of Operational Qualification (OQ) and Performance Qualification (PQ).

Detailed process flow: 

1. Trigger Automatic IQOQ Report Tool: IQOQ Report Tool can be triggered in multiple ways depending on application’s requirement or customer’s preference. To trigger the creation of IQOQ Reporting tool the customer passes the details of the AWS Account - Account ID, Environment (dev/test/prod) and Region name that needs to be qualified. In addition, customers can also pass the Application ID, which is a unique identifier for set of AWS resources specified in AWS Tags, when triggering the IQOQ Reporting Tool. These parameters can either be passed through the API Gateway or by uploading an excel file in an Amazon Simple Storage Service (Amazon S3) bucket.
   
   The IQOQ Report tool would then generate a report corresponding to the Account ID, Environment, Region and Application ID Tags that are passed when triggering it.
   
   

2. The IQOQ Report tool passes the Account ID, Environment, Region and Application ID to a Resource Collector AWS Lambda function that retrieves the AWS Metadata corresponding to the parameters passed. The lambda function must have a cross account role enabled for the corresponding Account ID, Environment & Region for it to retrieve metadata parameters of different AWS resources.
   
   If the AWS resources identified are provisioned through an AWS CloudFormation Stack, then the Resource Collector Lambda function also captures the “drift” i.e., any change in current stack configuration to the one specified in the template that was used to create or update the stack.
   
   

3. The metadata of different AWS resources and the CloudFormation Drift is stored in the S3 Bucket as raw JSON output by the Resource Collector Lambda function.
   
   

4. The storage of JSON output in the previous step in the S3 Bucket triggers a Report Generator Lambda function. This lambda function reads the “Actual” values of metadata of AWS Resources as captured by the Resource Collector Lambda function as well as the “Expected” values from an Amazon DynamoDB IQOQ table that is maintained by the compliance team. If resources are provisioned through CloudFormation Stack, then the “Drift” captured by the Resource Collector Lambda function can also serve as the source of “Expected” and “Actual” values (with “Actual” values being the current stack configuration and “Expected” values being the stack configuration that was used to initially provision the AWS resources).
   
   

5. The Report Generator Lambda function then creates an IQOQ PDF report and stores it in S3 Bucket. This IQOQ PDF report contains the following:
   
   * Application Information for which IQOQ report is generated
   * Build Specifications (IQ) of the AWS Resources
   * Post Build Specifications (OQ) of the AWS Resources
   * IQOQ Table that details “Pass/Fail” results when Expected Values of IQ & OQ AWS Resources matches/do not match with Actual Values
   * Summary Table that details number of Pass/Fail IQ & OQ results
   
   

6. Successful generation of IQOQ Report trigger an Amazon SNS notification that sends an email to the compliance team detailing the location of IQOQ Report and instructions on how to download it.
   
   

7. The IQOQ report can also be read by AWS Glue and queried by Amazon Athena in order to populate a real-time Amazon QuickSight dashboard. This dashboard summarizes the Installation and Operation Qualification Status for various resources.
   
   

8. In case of any error in IQOQ Report Tool functionality, an Amazon SNS notification is send to Cloud Operations Team detailing the error and possible debugging steps.
   

Learn more

Find out more information about the GxP compliance.

Learn More

Related content

TECHNICAL BLOG

Automating the Installation Qualification (IQ) Step to Expedite GxP Compliance

GxP compliance has been a part of the life sciences industry for many years and heavily influences how HCLS customers need to deliver computer systems as part of their quality management system. One key point is the need to qualify and validate computer systems. The process to create and execute a validation plan has traditionally been manual and labor-intensive. In this post, we propose an approach that can automate one of the first components of a validation plan – the Installation Qualification (IQ).

Read now »

TECHNICAL WHITEPAPER

GxP Systems on AWS Technical Whitepaper

This whitepaper provides information on how AWS approaches GxP-related compliance and security and provides customers guidance on using AWS Products in the context of GxP. The content has been developed based on experience with and feedback from AWS pharmaceutical and medical device customers, as well as software partners, who are currently using AWS Products in their validated GxP systems.

Read now »

What does this solution do?

The following diagram depicts an architecture that you can use to build a system to automate the continuous validation of your GxP controls. 

Detailed process flow:

Account Provisioning

• A1 – Infra team provisions new AWS functional account and is attached in AWS Organization Unit (OU). AWS CodePipeline triggers deployment of set of enforcement policies to the Functional Account provisioned ensuring Allow-listed services and associated enforcement are boot strapped before release to end users to ensure compliance. Each enforcement policy creates/ transforms into a CloudWatch Event and Lambda function.

• AL1 - DevOps teams develop, test and deploy Application Programmable Interfaces(APIs) which are invoked from individual Cloud custodian enforcements from Functional Accounts.

• AL2 – DevOps teams Develop, test and deploy enforcement policies to Functional Accounts.

Service Enablement

• S1 – Infra team and/ or Account Owners can enable Allow-listed services on any particular Functional Account through self-service control plane User Interface (UI).
  

• S2 - Application Load Balancer exposes an endpoint backed by service Enabler API Lambda function.

• S3 - Service Enabler API Lambda- Enables and disables an AWS Service on a Functional Account. This will also enable/ disable AWS service specific enforcements in target Functional account and records the enforcement metadata in DynamoDB datastore.
  

Enforcements Definition

• R1 - Enforcement definitions stored in a DynamoDB datastore are retrieved, displayed on control plane UI powered by AWS Amplify Dashboard. The Dashboard provides hierarchical view of account to service, Service to enforcement control mapping.
  

State of Compliance

• E1 - Enforcement policies CloudWatch Event monitors the enforcement policy changes on each service on a periodic or event-based trigger. When enforcement policies are violated, enforcement lambda take proactive or reactive actions (Alerts) on each service to keep it in compliant state.
  

• E2 - Enforcement event logs from all Functional accounts are shipped to centralized log bucket.

• E3 - The enforcement event logs are transformed into meaning insights using Glue, Athena and QuickSight.

• E4 – Infra teams can monitor state-of-compliance Insights from Enforcement Compliance dashboard near real-time .

• EA1/ EA2 – Policy violations notifications are sent to Account Owners with detailed information on the corrective and preventive actions taken.

Learn more

Find out more information about the GxP compliance.

Learn More

Related content

TECHNICAL WHITEPAPER

GxP Systems on AWS Technical Whitepaper

This whitepaper provides information on how AWS approaches GxP-related compliance and security and provides customers guidance on using AWS Products in the context of GxP. The content has been developed based on experience with and feedback from AWS pharmaceutical and medical device customers, as well as software partners, who are currently using AWS Products in their validated GxP systems.

Read now »

TECHNICAL BLOG

Automating GxP compliance in the cloud: Best practices and architecture guidelines

In this blog post, we demonstrate how life sciences customers can automate GxP compliance processes using the AWS cloud. We’ll provide some of the best practices and architecture guidelines for developers, system administrators, and security specialists who want to automate their GxP compliance processes. However, the customer is ultimately responsible for system qualification and validation, including Installation Qualification (IQ), Operational Qualification (OQ) and Performance Qualification (PQ). Customers may use these best practices, design guidelines and automated testing to automate qualification and validation processes.

Read now »

What does this solution do?

The following diagram depicts an architecture that you can use to build a system to automate the validation of your GxP controls. The centerpieces of this system are the AWS Service Catalog and AWS Landing Zone. The AWS Service Catalog provides a single location where life sciences enterprises can centrally manage their catalogs of IT services. Life sciences security administrators can control which AWS services and versions are available, limit the configuration of the available services, and delegate permissions access by developer or by role. AWS Landing Zone is a solution that helps customers more quickly setup a secure multi-account AWS environment based on AWS best practices. It provides a baseline environment with multi-account architecture, identity and access management, governance, data security, network design, and centralized logging that are integral parts of GxP solutions.

AWS Service Catalog

Detailed process flow: 

1. AWS Landing Zone allows the security administrator to automate the set-up of an environment for running secure and scalable workloads. Security admin defines an AWS Service Catalog product (for example, a GxP application) using AWS CloudFormation templates. 

2. Security admin publishes the template for developers in the AWS Service Catalog. Developers use this framework to further enhance the template based upon the application requirements.

3. Developers take the framework and modify applications to further enhance it under Git source control and use AWS CodeCommit to fully manage the private code repository.

4. Developer deploys the modified code from CodeCommit to their GxP infrastructure, using AWS Service Catalog to launch the product they need as an AWS CloudFormation stack.

5. The stack automatically provisions the necessary AWS resource based on what has been committed to the code repository as specified by the developer.

6. AWS Service Catalog is at the center of this architecture, sodevelopers can release their source code without needing to access to any underlying resources or go through security administrators.

7. Automate the testing/Installation qualification process using AWS Lambda or Python program and create a test summary/qualification report automatically in an Amazon S3 bucket .

8. All individual CloudTrail logs, VPC flow logs, and AWS Config changes are aggregated into a centralized S3 bucket in a separate AWS account.

9. The security administrator configures, monitors, and sets up automated alerts on changes and on the health of the stack via Amazon CloudWatch. 

10. When the stack is changed, change events are recorded and tracked through AWS Config. Out of compliance events are displayed in dashboard. 

11. To indicate that something may be out of compliance, CloudWatch can initiate alarms based on rules that you design. 

12. CloudTrail monitors API calls made against the AWS environment. 

13. The administrator is notified/alerted by CloudWatch Events when something changes that could causethe system to be non-compliant. 

14. Log Data is queried and converted into a human readable format like CSV using Amazon Athena, for any audit purpose. 

15. Visualize CloudTrail Logs using Amazon QuickSight.
    

Learn more

Find out more information about the GxP compliance.

Learn More

Related content

TECHNICAL WHITEPAPER

GxP Systems on AWS Technical Whitepaper

This whitepaper provides information on how AWS approaches GxP-related compliance and security and provides customers guidance on using AWS Products in the context of GxP. The content has been developed based on experience with and feedback from AWS pharmaceutical and medical device customers, as well as software partners, who are currently using AWS Products in their validated GxP systems.

Read now »

TECHNICAL BLOG

Automating GxP compliance in the cloud: Best practices and architecture guidelines

In this blog post, we demonstrate how life sciences customers can automate GxP compliance processes using the AWS cloud. We’ll provide some of the best practices and architecture guidelines for developers, system administrators, and security specialists who want to automate their GxP compliance processes. However, the customer is ultimately responsible for system qualification and validation, including Installation Qualification (IQ), Operational Qualification (OQ) and Performance Qualification (PQ). Customers may use these best practices, design guidelines and automated testing to automate qualification and validation processes.

Read now »