Abstract
Pharmaceutical manufacturers are developing and using Configuration Management Databases (CMDB) to maintain inventories of the IT and automation assets used by the manufacturing and laboratory systems at their production facilities. A CMDB can provide access to accurate data, including available assets, where they are, how they are configured, and the relationships that exist between them; all of which are vital functions for lifecycle management, change management, incident management and patching. The information model typically used by the standard CMDB installation is based on the idea that all systems used by the enterprise are software based and described by a class of objects called an application. This does not always align to the needs within an operations technology (OT) environment. Therefore, the BioPhorum Cyber Security members, using their extensive combined knowledge, have collaborated to design a common information model describing a manufacturing system detailed in a shop floor/OT CMDB. The proposed model is intended to be a free, reusable, standard structure which can be adapted for specific company needs, providing a good starting point for configuration data modelers working in the OT space. Abstract
The biopharmaceutical industry is challenged to continually deliver and maintain products in a cost-effective way while retaining regulatory compliance. An Agile approach to software development supports the need for an effective and efficient business. However, use of Agile in a GxP environment has been limited due to the perceived regulatory risk. This guide provides an approach that ensures delivery of software solutions while maintaining regulatory compliance. The approach uses the conventional validation plan and validation report, while adapting the design, build and test stages to provide an Agile approach. Using this guidance enables companies to implement software systems in a GxP environment while delivering to the business the benefits of cost, speed and quality with full regulatory compliance. Abstract
This Companion document, to be used alongside its original guidance 'Guidance on the use of Agile in a GxP environment'. It provides more practical advice on how to implement agile in a GxP environment. The Companion is less about ‘what is Agile’ but more ‘how to do it’ in the biopharmaceutical arena. The Companion details five levels to full Agile working that will help companies determine what level they are currently at and what they need to do to progress to the next stage. This approach will help companies understand how to implement Agile in GxP environments more rapidly and effectively. Abstract
In pharmaceutical manufacturing plants, it is sometimes the case that there is no single place to view an inventory of manufacturing assets. Conversely there may be many data sources with manual processes required to compile a single view. This is a problem for the entire enterprise, not just manufacturing; it is a constant and ongoing balance of enterprise (IT) vs manufacturing (OT) tools, policies and proceedures. Managing this asset information can become a significant manual effort. Without trustworthy data, there is an unclear view of the cybersecurity risk that assets contribute to the manufacturing plant and enterprise. The absence of good information makes planning of patching and lifecycle management exceedingly difficult. This compels manufacturers to develop Configuration Management Databases (CMDB’s) to maintain inventories of the assets used at their production facilities. Here the BioPhorum Cyber Security members have been investigating the underlying use cases that drive the design, needs and benefits of each member’s CMDB application/s. Through a compare and share process, they have asked the questions “What are our peers doing?”. This paper starts to draw parallels and highlight differences. It gives an insight into the complex and diverse ways of setting up, maintaining, and managing a manufacturing shop floor CMDB. Abstract
With each new challenge, organizations are working to improve their response and reduce the time and effort required. Companies are all investing in routine patching where possible, reducing this activity in urgent situations, as well as investing in other mitigation options such as isolation where appropriate – more options means reduced impact. This paper provides a summary of what the members of the BioPhorum IT Cyber Security Workstream are doing.
Abstract
As the maturity of digital manufacturing plants increases, so does the risk of a cybersecurity or other digital incident. A successful phishing attack, for example, could adversely impact manufacturing operations and potentially take a facility offline for hours, days or even longer. A company's ability to minimize the risk of a digital disaster in its manufacturing plants, and quickly restore operations if one occurs, is a vital area for investment to ensure delivery of drug products to patients. To do this, biopharmaceutical manufacturers must understand the cyber resilience at their differing plants and how each site fits into the context of their overall business. Abstract
This paper characterizes this framework, and the associated mixed environments, to illustrate the drivers and success metrics for the key functions of business management of information systems, and that of plant-floor instrumentation and controls engineering. For people working in this arena, this paper will help develop an understanding of this landscape and foster a cooperative approach to implementing network resilience and cybersecurity solutions that allow more robust and secure delivery of essential drug products to the market. Abstract
Data integrity (DI) is an essential element in ensuring the reliability of data and information obtained and managed in biomanufacturing. The number of observations made regarding the integrity of data during inspections of good manufacturing practice (GMP) has been increasing, clearly signalling a need for companies to better understand the requirements and ensure confidence in their compliance. In 2016, the BPIT compliance SMEs collaborated to co-author an industry response to the IT data integrity guidelines provided by regulators to support companies in understanding the requirements and in ensuring clarity in their approach to compliance. Furthermore, the guidance in the response paper and the companion template, “Universal Data Integrity System Assessment Template in the Biopharmaceutical Industry”, supports companies by providing a shared view of which controls to implement within a company and offers best practices to manage risks. This results in a common response to regulators and achieves increased confidence in a company’s approach to compliance. The guidance outlines the controls required generally and those required specifically for three categories of IT systems in biomanufacturing – enterprise applications, local systems and equipment. Abstract
The subject matter experts of the BioPhorum IT Compliance Team developed this template in response to the need to ensure compliance with the regulatory guidance for data integrity demanded in the industry. The template was developed to assess the health of computerized systems and their electronic records from a data integrity perspective. Furthermore, it can be used to evaluate potential risks to a computerized system and its electronic records throughout the system’s lifecycle. An assessment may be conducted during requirements gathering as a part of the initial validation, during assessment of system changes, during periodic reviews and/or at the time of decommissioning. The assessment template should be fully developed in conjunction with a standard operating procedure (SOP) to manage consistent implementation and use. Since this is an example template it is not an exhaustive list of questions and should be augmented to meet each company’s specific needs. The template accompanies the “Data Integrity for IT in the Biopharmaceutical Industry” paper, which was developed in parallel to provide an industry response to regulatory guidelines highlighting risks, controls and best practices. Abstract
Biopharmaceutical industry challenges and opportunities provided the impetus for a team of subject-matter experts to develop a biomanufacturing digital vision and a digital plant maturity model (DPMM). The white paper describes the stages of maturity from simple paper-based plants through to the fully automated and integrated ‘adaptive plant’ of the future. The business and enabling capability dimensions in the maturity model are also explained. Moreover, the paper describes the benefits of applying the DPMM such as enabling an organization to evaluate the state of its technology at all manufacturing sites, those within a network or at specific ‘sister’ sites. This evaluation can provide either a global roadmap spanning all manufacturing sites (e.g. a common gap for all IT) or a roadmap for specific sites. Abstract
What does the concept of ‘digital plant’ mean in biopharmaceutical manufacturing? How can it be defined, measured and transformed? What is needed to move up the maturity curve. These are all questions that a business needs to answer to establish a practical strategy to realize the opportunities that digital offers. The biomanufacturing Digital Plant Maturity Model (DPMM) describes the stages of maturity from simple paper-based plants through to the fully automated and integrated ‘adaptive plant’ of the future. Combined with the maturity assessment tool the maturity model can help IT professionals and stakeholders establish the current digital maturity of a biopharmaceutical facility and facilitates agreement on the future state, goals and strategy to get there. This second version increases consistency by leveling scores across dimensions; simplifies the model by reducing the number of enabling dimensions; and improves its utility by resetting the vision for levels 4 and 5, aligning them with the BioPhorum Technology Roadmap. Abstract
What does the concept of ‘digital plant’ mean in biopharmaceutical manufacturing? How can it be defined, measured and transformed? What is needed to move up the maturity curve. All are questions that a business needs to answer to establish a practical strategy and realize the opportunities that digital offers. The biomanufacturing Digital Plant Maturity Model (DPMM) describes the stages of maturity from simple paper-based plants through to the fully automated and integrated ‘adaptive plant’ of the future. The maturity assessment tool can be used alongside the model. Using the characteristics provided for each dimension of the model, an assessment can be made of a plant or a network of plants against the five digital maturity levels against eight dimensions. The maturity model and provides the language and mechanism for having the right conversations with the right stakeholders and the Assessment Tool ensures a neutral assessment of the current state, and facilitates agreement on the future state. Abstract
Cloud services are being increasingly used in biomanufacturing to provide a cost effective and flexible platform for software deployment. As GxP systems increasingly move onto the cloud agreement is vital for both provider and customer responsibilities to maintain compliance. For example, how does the provider ensure the security of the underlying infrastructure? Does the provider utilize commercially available software products that are developed and tested to IT industry standards? And does the customer perform periodic reviews of their provider configurations and the systems they deploy? With a lack of clarity on questions such as these we open ourselves up to both risk and a lack of consistency across the industry. In response to this set of uncertainties the BPIT subject-matter experts (SMEs) developed a checklist of critical questions by control area designed to create clarity. As such this paper and checklist help companies gain all the benefits of hosting GxP systems in the cloud while providing the necessary level of regulatory compliance and assurance. The paper focuses on infrastructure as a service and is vendor neutral. Abstract
Most quality control labs in biomanufacturing have not yet achieved digital transformation. Lab processes are often manual which is slow and leads to errors and variability as well as long lead times. Now those traditional ways of working are further challenged by the drive towards inline monitoring and real time release testing, and by new cell and gene therapies with tiny batch sizes and short shelf-lives. The lab of the future is digital and requires much stronger IT for demand management and process automation, increasingly informed by data analytics and connected to manufacturing operations. This will be enabled by stronger IT security and operations, systems interoperability and governance, and data aggregation using common models, analytics and visualization. Huge changes in lab personnel skills and culture are needed to work with the systems and the data in these new ways. Abstract
Many biomanufacturers use a network of logistics service providers (LSPs) to deliver warehousing, transport and distribution services. Typically linked using customized, electronic, point-to-point connections. These connections can be expensive and slow to set-up and expensive to update in response to changing market demands. There is no dominant technical solution that monitors the condition and location of shipments, and that enables companies to adopt different solutions for different regions and partners. There is a need to raise the awareness of software vendors of this unmet need and the real interest of many industry stakeholders if a suitable LSP integration solution was available. This paper provides an overview of the current needs of manufacturers and their technical integration with their network of LSPs. It contains a high-level requirements specification for a common, cloud-based, integration platform, that would reduce customization and multiple point-to-point solutions. The specification is designed to help technology companies develop this services. Informal benchmarking across member companies indicates that ‘collaboration hub’ use would deliver a 50–70% saving in time and cost when linking to a new partner. These benefits would be realized by both partners making the new connection. 