my company are moving from a paper based QMS to electronic, a potential vendor has been identified and we have had initial discussions about their system.
from what i can see (and i’m not an expert in CSV), the in-house validation effort required for on premise is much greater than that required for the SAAS model.
The host server would be at the vendors site and i am informed that it does not use “Cloud” computing to store data.
If we go with the SAAS what is Validation impact,
-i presume as a minimum we should be running a PQ.
-does anyone have any regulatory experience with respect to “defending” the SAAS option?,
-what are the risks/benefits fo going down the SAAS route?,
i really would appreciate hearing about peoples experience with SAAS
First of all did you right a URS for this system? How did you come to the point where you choose this vendor to host your QMS?
When you say it does not use Cloud Computing not sure what you mean by this. There are many different flavors of Cloud and when it comes to using a system in a regulated environment you need to be very clear what your requirements are.
Another very important point is have you audited the vendor for their QMS and SDLC plus their hosting environment, is this regulated hosting?
If you would like more info my contact details are below, there are many different aspects that need to be considered here.
First of all did you right a URS for this system? How did you come to the point where you choose this vendor to host your QMS?
When you say it does not use Cloud Computing not sure what you mean by this. There are many different flavors of Cloud and when it comes to using a system in a regulated environment you need to be very clear what your requirements are.
Another very important point is have you audited the vendor for their QMS and SDLC plus their hosting environment, is this regulated hosting?
If you would like more info my contact details are below, there are many different aspects that need to be considered here.
Best Regards[/quote]
Hi Ger,
a URS has not been complete yet, unfortunately i have just inherited the project and corporate have chosen the vendor. I will be ensuring a URS is put before them and that they will be audited before anything gets signed off.
WRT the “cloud”, our data on this SAAS system will not be stored on a cloud, it will be on a physical server.
i would be interested in hearing your thoughts on this,
WRT the “cloud”, our data on this SAAS system will not be stored on a cloud, it will be on a physical server.
Thanks again[/quote]
I think the term Cloud is adding confusion to this discussion. A Cloud can be a physical server stored off-site at your vendors for example.
Regardless of where your info is stored i.e Externally (Off-site) or Internally (On-site) will not really change the level of validation that has to be performed. Of course if all your information is being stored off-site on an external cloud then the security aspects will have to be far more rigorous as this could be deemed to be an “Open System”.
The terms SAAS means Software As A Service, so in your case I would imagine the vendor is maintaining everything and you are just using the software.
yes the vendor will maintain everything and we access the system online, so i’m assuming (but will check) that the IQ and OQ has been established as this software is available and in-use by other companies currently, so that the PQ protocol would require our prior review and approval, and then we would run onsite. Note:it is out intention that this system be available in offices in the US and Singapore so i presume this may impact the PQ?