FDA-/GMP-gerechter Prozess-Transfer

PE/21022024

Highlights

 Information Technology (IT) / Operation Technology (OT) Infrastructure

Enterprise Model

 Regulatory Requirements

 IT Compliance for the IT Infrastructure

 Supporting Processes

 Virtualisation as Part of the IT Infrastructure

 Security and Cybersecurity Concepts

 Agile Infrastructure / Infrastructure as Code (IaC)

 Case Studies for Qualication

- Virtualisation Platform

- Firewall

- Central Backup Management System

Speakers

Frank Behnisch

CSL Behring

Bob McDowall

R.D.McDowall

Yves Samson

Kereon

IT / OT Infrastructure

Qualication and Operation

in a GMP Environment

22-24 May 2024, Copenhagen, Denmark

GMP Certication Programme

Certied Computer Validation Manager

Stay informed with the GMP

Newsletters from ECA

e ECA oers various free of charge

GMP newsletters for which you can sub-

scribe to according to your needs.

To subscribe, simply scan the

QR code on the right or visit

www.gmp-compliance.org/

gmp-newsletter

Programme

Objectives

 Get an overview of technologies discussed currently in the

pharmaceutical environment

 Learn what requirements are placed on the IT infrastruc-

ture and its qualication within the scope of GMP regula-

tions

 Principles outlined can be applied to Operation Technol-

ogy (OT) for production systems

 IT security and cybersecurity has now taken on a central

role; here you will learn about the importance of the IT

infrastructure in terms of an appropriate IT security

concept

 Case studies show you qualication approaches for key IT

infrastructure components

 Virtualization is a part of the IT infrastructure; learn

strategies for qualifying the virtual machine and the

virtualization platform

Background

In today’s pharmaceutical environment, the IT infrastructure is

the backbone for the application of a wide range of soware so-

lutions. e requirements for IT security are becoming increas-

ingly important. Only a robust IT infrastructure with suitable

network topologies and security concepts can guarantee the ap-

propriate security here.

Pharmaceutical regulations contain few or only indirect require-

ments for the IT infrastructure. e principles of the EU GMP

guidelines state “e application should be validated; the IT in-

frastructure should be qualied”. Here the phrase “should” cor-

responds to a “must”! Further information can be found in the

revised version of the GAMP® Good Practice Guide “IT Infra-

structure Control and Compliance” published in August 2017.

Target Audience

e event is aimed at managers from the pharmaceutical indus-

try, suppliers and service companies who plan, qualify and oper-

ate IT infrastructure in a GxP environment

Programme

IT/OT Infrastructure Model

 Overall IT/OT infrastructure enterprise model

 GAMP IT infrastructure model

 Applying GAMP soware categories

 OT specics

 Applicable to all options: on premise / data hotel / SaaS IT

Regulatory and Legal Requirements / Agreement for

IT/OT infrastructure

 GxP regulations with focus on Annex 11 and Chapter 7

 Supplier assessment and agreements for IT suppliers

- Risk management

- Quality and technical agreements and service levels

- Governance and Quality oversight

- Time synchronisation

 Brief summary of legal requirements

- e.g. GDPR, HIPAA, etc.

Eective and Ecient Compliance

 Supporting life cycle model

 Specication

 Design

 Verication

Security and Cybersecurity for a Robust IT/OT

Infrastructure

 IT infrastructure security requirements

 Cybersecurity: ransomware and malware

 Sizing / Availability / Reliability

 Basic security rules

 Network topology

 Network segregation

 IT infrastructure monitoring

 Recommendation for data archiving support

 PEN testing

Planning Virtualisation Projects

 User / Technical Requirements Specication

 Denition of the installation and deployment approach

 Risk management

 Denition of backup cycles and scenarios

 Ecient planning

 Qualication planning

 Life cycle of virtual environment

 Dierences between virtual, physical, and as-a-Service

installation and deployment

Virtualisation Platform: Overview

 Platform operation

- SANs and VMs handling

 RAID technology

Qualication of the Virtualisation Platform

 Platform design

- Requirements and constraints

- Data management

- Disaster recovery

 Qualication planning

- Specications

- Verications

Qualication Documentation

 QP – Qualication Plan

 TRS – Technical Requirements Specication

 CS – Conguration Specications

 IQ – Installation Qualication a.k.a. Conguration Testing

Design Review of IT Infrastructure

 Design Review and Risk Management purpose

 Performing Design Review

 What might go wrong?

 Critical review of the IT infrastructure

 Design and monitoring of mitigation measures

IT / OT Infrastructure Qualication and Operation in a GMP Environment | 22-24 May 2024, Copenhagen, Denmark

Case Study:

Firewall Qualication

 Requirements

- Purpose

- Operation

 Risk assessment

 Conguration specication

- Denition of the security rules

- Operating parameters

 Conguration Testing (IQ)

 Functional Testing (OQ)

 Operation

- Monitoring

- Change & Conguration Management

- Incident Management

Disaster Recovery Planning

 Regulatory requirements for disaster recovery

 For virtual and physical environment

 Disaster recovery or business continuity plans?

 Disaster recovery plan and testing

- Order of application recovery with associated data

- RPO – Recovery Point Objective

- RTO – Recovery Time Objective

Case Study:

Central Backup Management System

 Requirements

 Verication

 Risk assessment

 Conguration specication

- Server / Agent / Operating parameters

 Conguration Testing (IQ)

 Functional Testing (OQ)

 Supporting SOPs

- System management

- Backup / Restore

- Disaster Recovery

 Operation

Incident and Problem Management

 Denition of incident and problem

 Incident investigation

 Collating incidents into problems and their resolution

 Linking with change control

Infrastructure as a Platform for Various Applications

 Denition of Platform

 Generic approach

 Standard changes

 Infrastructure lifecycle challenges for applications & GxP

 Specialties in automation – challenge for infrastructure in

24/7 real-time applications

Change and Conguration Management

 Regulatory requirements

 Denitions of change control and conguration manage-

ment

 Outline of a change management process

Agile Infrastructure: Leveraging to Infrastructure as

Code (IaC) for Eciency

 Denition & scope

 Toys or tool?

- 40 years evolution

 Flexibility & Agility

- From installation to provisioning

 e costs of Agility

- Rigorous planning

- Adequate tools

- Training

- Risks and benets

Speakers

Frank Behnisch

CSL Behring GmbH, Germany

Frank is Senior Manager Project Engineering at CSL Behring

GmbH in Marburg, Germany. He is member of the GAMP® D-A-

CH „steering committee“ and chairman of a GAMP® Special In-

terest Group (SIP) for “Small Systems”.

Dr Bob McDowall

R.D.McDowall Limited, Bromley, Kent, UK

Analytical chemist with over 45 years experience including 15

years working in the pharmaceutical industry and aerwards

working for the industry as a consultant. Bob is an ISO 17025 as-

sessor and he has been involved with the validation of comput-

erised systems for over 30 years and is the author of a book on

the validation of chromatography data systems. He was also a

contributor to the GAMP IT Infrastructure control & compliance

and Lab System Validation 2nd edition Good Practice Guides. He

is a core member of the GAMP Data Integrity SIG. He recently

published his book on Data Integrity and Data Governance: Prac-

tical Implementation in Regulated Laboratories.

Yves Samson, Kereon AG

Basel, Switzerland

Automation and system engineer with over 25 years experience,

including 11 years as regulated user, Yves is the founder of Kere-

on AG, Basel. He supports his customers as consultant, trainer,

and e-compliance auditor. He is member of GAMP Europe Stee-

ring Committees, chairman and co-founder of GAMP Franco-

phone. He edited the French version of GAMP 4 and GAMP 5. In

2017, Yves launched the e-Compliance Requirements Initiative

(eCRI) with the aim to help the regulated pharmaceutical indus-

try and its suppliers to address and to implement accurately,

consistently, and eectively the regulatory e-Compliance requi-

rements.

IT / OT Infrastructure Qualication and Operation in a GMP Environment | 22-24 May 2024, Copenhagen, Denmark

General terms and conditions

If you cannot attend the conference you have two options:

1. We are happy to welcome a substitute colleague at any time.

2. If you have to cancel entirely we must charge the following processing fees:

- Cancellation until 4 weeks prior to the conference 10 %,

- Cancellation until 3 weeks prior to the conference 25 %,

- Cancellation until 2 weeks prior to the conference 50 %,

- Cancellation within 2 weeks prior to the conference 100 %.

CONCEPT HEIDELBERG reserves the right to change the materials, instructors,

or speakers without notice or to cancel an event.

If the event must be cancelled, registrants will be notied as soon as possible

and will receive a full refund of fees paid. CONCEPT HEIDELBERGwill not be re-

sponsible for discount airfare penalties or other costs incurred due to a cancel-

lation. Terms of payment: Payable without deductions within 10 days aer re-

ceipt of invoice.

Important: is is a binding registration and above fees are due in case of can-

cellation or non-appearance. If you cannot take part, you have to inform us in

writing. e cancellation fee will then be calculated according to the point of

time at which we receive your message.

In case you do not appear at the event without having informed us, you will have

to pay the full registration fee, even if you have not made the payment yet. Only

aer we have received your payment, you are entitled to participate in the con-

ference (receipt of payment will not be conrmed)! (As of July 2022).

German law shall apply. Court of jurisdiction is Heidelberg.

nal Data. Concept Heidelberg will use my data for the processing of this order,

for which I hereby declare to agree that my personal data is stored and pro-

cessed. Concept Heidelberg will only send me information in relation with this

order or similar ones. My personal data will not be disclosed to third parties (see

also the privacy policy at https://www.gmp-compliance.org/privacy-policy). I

note that I can ask for the modication, correction or deletion of my data at any

time via the contact form on this website.

If the bill-to-address deviates from the specica-

tions on the right, please ll out here:

____________________________________

CONCEPT HEIDELBERG

P.O. Box 101764

Fax +49(0) 62 21/84 44 34

D-69007 Heidelberg

GERMANY

Reservation Form (Please complete in full)

IT / OT Infrastructure Qualication and Operation, 22-24 May 2024, Copenhagen, Denmark

Title, rst name, surname

Department Company

Important: Please indicate your company’s VAT ID Number Purchase Order Number, if applicable

City ZIP Code Country

Phone / Fax

E-Mail (Please ll in)

Date

Wednesday, 22 May 2024, 09.00 – 17.15 h

(Registration and coee 08.30 h - 09.00 h)

ursday, 23 May 2024, 08.30 h – 17.15 h

Friday, 24 May 2024, 08.30 h – 12.15 h

All times mentioned are CEST

Venue

Radisson Blu Scandinavia Hotel

Amager Boulevard 70

2300 Copenhagen S, Denmark

Phone: +45 (0)33 96 50 00

Email: guest.copenhag[email protected]

Fees (per delegate, plus VAT)

ECA Members € 2,090

APIC Members € 2,190

Non-ECA Members € 2,290

EU GMP Inspectorates € 1,045

Including: Conference documentation, lunch and social event

on the rst day, lunch on the second day, all refreshments. e

conference fee is payable in advance aer receipt of invoice.

Accommodation

CONCEPT HEIDELBERG has reserved a limited number of rooms

in the conference hotel. You will receive a room reservation

form/POG when you have registered for the course. Reservation

should be made directly with the hotel. Early reservation is rec-

ommended.

Registration

Via the attached reservation form, by e-mail or by fax message.

Or you register online at www.gmp-compliance.org.

Conference language

e ocial conference language will be English.

Presentations/Certicate

e presentations for this event will be available for you to

download and print before and aer the event. Please note that

no printed materials will be handed out on site and that there

will not be any opportunity to print the presentations on site.

Aer the event, you will automatically receive your certicate of

participation.

Social Event

In the evening of the rst

couse day, you are cordially

invited to a social event.

is is an excellent oppor-

tunity to share your experi-

ences with colleagues from

other companies in a re-

laxed atmosphere.

Organisation and Contact

ECA has entrusted Concept Heidelberg with the organisation of

this event.

CONCEPT HEIDELBERG

P.O. Box 10 17 64

69007 Heidelberg, Germany

Phone +49(0)62 21/84 44-0

Fax +49(0)62 21/84 44 34

info@concept-heidelberg.de | www.concept-heidelberg.de

For questions regarding content please contact:

Dr Andreas Mangel (Operations Director) at

+49(0)62 21/84 44 41, or at mangel@concept-heidelberg.de

For questions regarding organisation please contact:

Mr Rouwen Schopka (Organisation Manager) at

+49(0)62 21/84 44 13, or at schopka@concept-heidelberg.de

PE/21022024