We are assisting a company with the transfer of their training application to the cloud. They are in the regulated space so we must be sure that we are co-ordinating this the correct way.
This is the migration plan we have so far, any input or assistance would be fantastic:
Change Control (Initial Quality Driver)
Data Migration Plan + Report (CC Closeout Deliverable)
Generate Procedures for:
a. Secure Portal Deployment (VM)
b. Secure Portal Deployment (Physical Servers)
c. DB Startup, Shutdown and Transportation Procedure
d. Web Server Installation / Configuration Procedure
e. Problem, Reporting, Escalation and Call Out (Revision of SOP2300)
f. Procedure for configuring items such as RAM, Disk Space etc in the VM environment.
g. Mechanism for communicating changes with clients at certain junctures, e.g. failure, movement, upgrade, maintenance etc.
Overall Procedure for Secure Portals Build Procedures (All Environments)
a. Include Step-By-Step instructions on a per environment basis. This will reference suite of aforementioned procedures.
Are you really in the cloud or is this just a hosted application? If you’re really in the cloud, you really don’t have much control on where (specific server, even specific location) the application is hosted, what the configuration of the server is (although you may be able to specify minimum requirements, including security), etc. Items d, f, and g below may be challenging if you’re really in the cloud. Of course, if it’s a hosted service then you can specify down to the last bit what you want.
Since you’re transmitting and storing data remotely, you may want to add things like checksum verification before database write and encrypting data transmitted.
I’m curious as to why you need to update your SOP on problem, reporting, etc.
We’re dealing with this to some degree with one of our clients as well. Very interesting paradigm shift happening. Maybe we can compare war stories afterwards.
