Records that hold up in an audit
In pharma and medical devices it is not enough that your IT is secure. You also have to be able to prove it. We build and run IT so that changes, access rights and backups can be traced at any time.
In other industries a changed configuration is a quick task. Here it is a process that must be documented: who changed what and when, for what reason and with whose approval. For computerised systems in a GMP environment, this is described in Annex 11 of the EU GMP Guidelines.
An auditor does not just want to know whether you have an access concept. They ask who had access to a specific folder in March last year, and why. You can only answer that if granting and removing access rights is logged.
An update that is simply part of patch management in ordinary IT can trigger requalification here. Such updates therefore have to be planned and must not run automatically.
If a medical device contains software, or the software is itself the product, the MDR requires development according to the state of the art, taking information security into account (Annex I, Section 17). Assessing the product is a matter for you and your notified body. The environment in which you develop, test and document should, however, be secured just as well.
What we do not take on: computerised system validation in the regulatory sense and qualification documentation. Validation service providers handle that, and we deliver the IT foundation they build on.
We took over the entire IT, redefined its direction and continue to develop it in close coordination with management.
Result: A fully automated environment designed for security and NIS2 requirements, with separate admin and user accounts and a secure VPN between the sites.
In this industry the standard for IT does not depend on company size. Five users also need traceable access rights and a tested restore.
FAQ
Above all, traceability: computerised systems must be validated, changes must follow a controlled process and access must be limited to authorised people. The basis for this is Annex 11 of the EU GMP Guidelines. How we implement this technically is described on our GMP page.
The MDR is aimed mainly at the product and contains IT requirements where software is part of the product. Annex I then requires development according to the state of the art, including information security, and manufacturers must set minimum requirements for hardware, networks and IT security for operation. We secure the environment in which you develop and document, while assessing the product remains with you and your notified body.
Many do, because the manufacture of medicinal products and of medical devices is among the sectors covered by NIS2. Whether you are actually affected also depends on headcount and turnover. Our NIS2 check gives you an initial assessment. The binding assessment is a legal question.
No. Certification applies to the processes and systems of the operating company, not to the IT service provider. We deliver IT that does not get in the way of your documentation obligations.
Yes, that is the usual setup. We provide technical information and documentation, and your validation service provider handles the regulatory assessment.
Yes. Our smallest pharma client has five users, and the effort depends on your environment, not on the number of employees.
The IT side, yes: network, access, backup and security. The manufacturer remains responsible for the specialist application itself, and we coordinate with them.
Pharma & Medical Devices
Tell us where you stand and which audit is coming up next. We will tell you openly whether and how we can support you.
