By Divya Kathuria, Jim Lyle, and Robert Corvino
Summary
Cloud automation uses specialized software to automate the manual work of managing cloud infrastructure and applications, reducing administrative overhead and enabling continuous integration and deployment. For regulated life sciences companies, the real prize is automated, continuous testing: as cloud vendors release frequent updates, automated qualification keeps GxP systems in a validated, compliant state without the cost of repeated manual re-execution. This article covers what cloud automation is, when automated testing pays off, and how to plan for the development investment and ongoing maintenance it requires.
Having applications on the cloud provides a standard for common interfaces among cloud applications, and an overall improvement in network performance
Cloud automation is the practice of using specialized software tools and methodologies to automate some or all of the manual tasks associated with managing and operating cloud-based IT infrastructure and applications. IT organizations and software development teams can leverage cloud automation in public, private, and hybrid cloud environments to reduce administrative overhead and achieve workflow targets like continuous integration and continuous deployment.1
See Part 1 of this blog series for a description of private, public, and hybrid clouds, and why companies move to the cloud.
Cloud automation software tools can be configured to automatically control the installation, configuration, management, and testing of cloud computing systems, enabling businesses to make the best use of their cloud-based resources. Having applications on the cloud offers several conveniences for your IT team, including a defined standard for common interfaces among cloud applications, and an overall improvement in network performance.
As organizations continue to rely on the cloud for critical applications and services, the role of cloud automation as a time-saver and enabler of effective cloud management practices will become more apparent in IT organizations. For example, several processes can run concurrently and unattended; there is no need to wait for one to finish before starting another. While this is possible with on-premises infrastructure, it is costly to set up and maintain the computing resources to make it possible. The cloud lets you do it from your desktop. Also, since many cloud application vendors release changes to their customers on a frequent basis, automated, ongoing software testing can help ensure that regulated systems remain in a state of compliance.
Why this matters for GxP systems: When a SaaS vendor pushes updates daily, weekly, or monthly, every change is a potential trigger for re-qualification. Automated, continuous testing turns that recurring compliance burden into a repeatable, evidence-generating process, helping keep validated systems compliant and aligned with expectations such as 21 CFR Part 11 for electronic records and signatures.
Considerations for Automated Testing
One of the first things to consider for automated testing is the frequency of releases or updates. Daily, weekly, or monthly updates needing operational qualification (OQ) or performance qualification (PQ) re-execution are excellent candidates for automated testing solutions because they save time and money over manual efforts.
Second, look for one testing effort that can be leveraged for multiple users. As a follow-on, specific use case tests can be developed to supplement the core testing. USDM’s tools work well with web-based platform GUIs, although some internal document model structures require more crafting effort than others.
A document management system would normally be considered an indirect system, with less associated risk in relation to the development, manufacturing, and distribution of medicines and medical devices. However, a customer’s use case for this system could possibly result in a higher risk-determination, requiring a more frequent or continuous end-to-end test suite execution with real-time incident reporting. USDM’s tools and methods can address these higher-risk use cases.
A risk-based approach decides where automated testing earns its keep: high-frequency updates and higher-risk use cases are where continuous, automated qualification delivers the most value.
This risk-based mindset aligns closely with Computer Software Assurance (CSA), which focuses validation effort where patient safety and product quality risk is highest, rather than applying uniform, document-heavy testing to every system regardless of risk.
Before taking on an automated testing tool (ATT) effort, know that tests require a significant initial development investment and require ongoing maintenance, so make sure they have a long “shelf life.” The ATT life cycle also requires ongoing monitoring, troubleshooting, review, and approval to remain operational and compliant. An ATT effort for regulated companies must include strategies and formal SOPs for ATT validation, administration, maintenance, use, incident and change management, reporting, and quality review.
Planning an Automated Testing Tool (ATT) Effort
- Assess release frequency. Daily, weekly, or monthly updates that demand OQ/PQ re-execution are the strongest candidates for automation.
- Determine risk. Indirect systems may need lighter testing, but a higher-risk use case can justify continuous end-to-end suites with real-time incident reporting.
- Maximize reuse. Build a core testing effort that serves multiple users, then layer on use-case-specific tests.
- Plan for shelf life. Tests require significant upfront development and ongoing maintenance, so target systems where the investment pays back over time.
- Govern the life cycle. Establish formal SOPs for ATT validation, administration, maintenance, use, incident and change management, reporting, and quality review.
Keeping these efforts compliant over time is a discipline in itself. A structured approach to validation lifecycle management helps teams maintain the documentation, change control, and review cadence that an ATT program depends on. And because automated testing exercises and reports on regulated data, sustaining data integrity across cloud systems remains a core requirement throughout the testing life cycle.
If you’re ready to enjoy the cost-saving benefits of automated tests, continuous testing, and solutions for day-to-day repetitive tasks, USDM Life Sciences has created its automated testing tool for Cloud AssuranceTM to automate the daily testing of GxP requirements. As cloud footprints expand, pairing automated testing with strong life sciences cybersecurity practices helps protect the systems and data those tests rely on.
Cloud 101 Blog Series
In Part 1 of this Cloud 101 blog series, we introduced the three cloud service models with examples, and provided links to digital transformation resources.
In Part 2, we talk about vendor management and scaling to the cloud.
In Part 3, we address several constraints from which your company will have to break free before it can embrace the cloud.
FAQ: Cloud Automation and Automated Testing for GxP Systems
What is cloud automation?
Cloud automation is the practice of using specialized software tools and methodologies to automate some or all of the manual tasks involved in managing and operating cloud-based IT infrastructure and applications. It applies across public, private, and hybrid cloud environments to reduce administrative overhead and support workflow targets like continuous integration and continuous deployment.
Why do regulated life sciences companies need automated testing in the cloud?
Many cloud application vendors release changes to their customers frequently. Automated, ongoing software testing helps ensure that regulated systems remain in a state of compliance after each update, rather than relying on costly, time-consuming manual re-execution of qualification tests.
Which systems are the best candidates for automated testing?
Systems with frequent releases — daily, weekly, or monthly updates that require operational qualification (OQ) or performance qualification (PQ) re-execution — are excellent candidates because automation saves time and money over manual efforts. A single testing effort that can be leveraged for multiple users further improves the return on investment.
Does a higher-risk use case change the testing approach?
Yes. A document management system might normally be considered an indirect system with lower associated risk. But a specific customer use case could result in a higher risk determination, requiring more frequent or continuous end-to-end test suite execution with real-time incident reporting.
What does it take to maintain an automated testing tool (ATT) effort?
Automated tests require a significant initial development investment and ongoing maintenance, so they should target systems with a long shelf life. The ATT life cycle also requires continuous monitoring, troubleshooting, review, and approval, plus formal SOPs covering validation, administration, maintenance, use, incident and change management, reporting, and quality review.
Ready to automate the daily testing of your GxP requirements? USDM Life Sciences built its automated testing tool for Cloud AssuranceTM to keep your cloud systems continuously compliant. Contact us to learn how we can make this happen for you.