Information Security Consulting

Consulting for information security and GxP compliance

Synchron helps organisations build an ISO/IEC 27001 information security management system. We also help pharmaceutical, laboratory and distribution organisations meet the IT side of GLP, GMP and GDP requirements. We consult as the team that builds and runs the infrastructure. This turns recommendations into technical controls that work in practice.

We have worked on the IT infrastructure, computerised system validation and evidence documentation for our customers in ISO/IEC 27001 certification audits and in GLP, GMP and GDP inspection and accreditation processes. These processes were completed successfully.

ISO/IEC 27001 consulting

ISO/IEC 27001 is the international standard that sets the requirements for an information security management system (ISMS). The current edition is ISO/IEC 27001:2022. We run the project in these steps:

1. Scope and context: we define the ISMS scope, the information assets and the interested parties.
2. Risk assessment: we assess threats and vulnerabilities and prepare the risk treatment plan.
3. Statement of applicability: we document which Annex A controls apply and why.
4. Technical controls: we implement access management, logging and monitoring, backup, encryption and physical security controls in the infrastructure.
5. Policies and procedures: we prepare the required policies, procedures and record templates.
6. Internal audit and management review: we carry out the internal audit before the certification audit and close the findings.

An accredited certification body carries out the certification audit. We give technical support during the audit.

GLP: OECD Good Laboratory Practice

The OECD Principles of GLP (as revised in 1997) set the conditions under which non-clinical health and environmental safety studies are planned, performed, monitored, recorded, archived and reported. They apply to studies of pharmaceuticals, plant protection products, cosmetics, veterinary drugs, food and feed additives and industrial chemicals. Data generated under these principles is accepted between member countries under the OECD Mutual Acceptance of Data decision.

The principles contain clear IT requirements:

• Test facility management ensures that computerised systems are suitable for their intended purpose and are validated, operated and maintained in accordance with GLP (section 1.1.2 q).
• Standard operating procedures are required for the validation, operation, maintenance, security, change control and back-up of computerised systems (section 7.4).
• Data entered directly into a computer needs an audit trail that shows all changes without obscuring the original data (section 8.3.5).
• Validation documentation for computerised systems is archived. Only authorised personnel enter the archive (sections 10.1 and 10.3).

Document No. 17 of the OECD GLP series (Application of GLP Principles to Computerised Systems, 2016) sets out a life cycle approach to the validation and operation of computerised systems. It replaced the earlier document No. 10. In GLP projects we assess laboratory software, data acquisition systems and IT infrastructure against this document.

GMP: EU GMP Annex 11 and 21 CFR Part 11

EU GMP Annex 11 is the guidance for computerised systems used in GMP-regulated activities. It came into operation on 30 June 2011. Under Annex 11 the application is validated and the IT infrastructure is qualified. In projects we cover these topics:

• Risk management: the extent of validation and data integrity controls is based on a documented risk assessment.
• Suppliers and service providers: formal agreements with third parties define their responsibilities.
• Data storage and back-up: data is secured by physical and electronic means. The integrity of back-ups and the ability to restore them are checked.
• Audit trail and change management: GMP-relevant changes and deletions are recorded. System changes follow a defined procedure.
• Security: physical and logical access controls are in place. Creation, change and cancellation of access rights are recorded.
• Business continuity and archiving: the process continues during a system breakdown. Archived data is checked for readability and integrity.

For organisations that supply the US market, 21 CFR Part 11 sets the FDA requirements for electronic records and electronic signatures. The FDA scope and application guidance recommends a risk-based approach to decisions on validation and audit trails.

GDP: Good Distribution Practice

The Guidelines on Good Distribution Practice of medicinal products for human use (2013/C 343/01) set the requirements for storage and distribution. On the IT and infrastructure side we do this work:

• Monitoring of the storage environment for temperature, light, humidity and cleanliness. Temperature mapping before use and placement of sensors at the points with the largest fluctuations (section 3.3).
• Demonstration, by validation or verification before use, that the computerised system gives accurate, consistent and reproducible results (section 3.5.1).
• An up-to-date system description, data entry only by authorised persons, regular back-ups and a data restoration procedure for system failures (sections 3.5.2–3.5.5).

Computerised System Validation (CSV)

Computerised system validation shows with documents that a system is fit for its intended use and stays fit. The second edition of the ISPE GAMP 5 guide (July 2022) emphasises a risk-based approach to GxP computerised systems and the critical thinking of subject matter experts. We plan validation along the V-model:

1. Validation plan and risk assessment: we define the GxP impact of the system and the validation scope.
2. User requirements (URS): we write traceable requirements.
3. Functional and design specifications: we review the supplier documents and fill the gaps.
4. Installation qualification (IQ): we document that hardware, software and configuration are installed to specification.
5. Operational qualification (OQ): we test functions, limits, error handling and the audit trail.
6. Performance qualification (PQ): we show that the system meets the requirements in the real business process.
7. Traceability matrix and validation report: we link each requirement to its test and report the result.

After validation we keep the system in a validated state with change control, periodic review and restore tests from back-up.

Data integrity: ALCOA+

The PIC/S guidance on data management and integrity (PI 041-1, 2021) expects records to have the ALCOA+ attributes: attributable, legible, contemporaneous, original, accurate, complete, consistent, enduring and available. We support these attributes technically with personal user accounts, time synchronisation, audit trail review, back-up and archive design.

Our process

1. Gap assessment: we compare the current state with the requirements and list the gaps.
2. Roadmap: we turn the gaps into a plan ordered by risk and priority.
3. Implementation: we build the technical controls and prepare procedures and record templates.
4. Validation and testing: we validate the systems and compile the evidence documents.
5. Audit preparation: we carry out an internal audit and give technical support during the audit.
6. Maintenance: we keep compliance with periodic review and change control.

For a gap assessment, write to us through the contact form.