Saba Cloud –Validated Environment Managed Services (VEMS)...Saba Software. All ights eserved. Saba...
Transcript of Saba Cloud –Validated Environment Managed Services (VEMS)...Saba Software. All ights eserved. Saba...
Saba Cloud –Validated Environment Managed
Services (VEMS)
Saba Cloud – Validated Environment Managed Services (VEMS) | 2© 2020 Saba Software. All Rights Reserved.
Companies operating in highly regulated GxP markets such as pharmaceuticals, medical
device manufacturers, biotech companies, biologics developers, life science companies and food
manufacturers are subject to rigorous compliance requirements set forth by the regulatory bodies in the
countries in which they operate. These compliance requirements dictate (among other things) how
electronic records and related e-signatures should be maintained within validated computerized systems.
GxP refers to a set of guidelines put in place to ensure products and services are safe. It ensures that regulated industries adhere to very specific and secure processes and procedures.
Saba Cloud – Validated Environment Managed Services (VEMS) | 3© 2020 Saba Software. All Rights Reserved.
U.S. FDA – Title 21 CFR Part 11In the United States, Title 21 of the Code of Federal
Regulations (CFR) Part 11 defines the criteria under
which electronic records and signatures are
considered to be trustworthy, reliable, and equivalent
to paper records and handwritten signatures. Part 11
requires controls, including audits, system validations,
electronic signatures, and documentation for software
and systems involved in processing electronic data
that is (a) required to be maintained by the FDA
predicate rules or (b) used to demonstrate compliance
to a predicate rule. Requirements include, for example,
certain provisions of the Current Good Manufacturing
Practice regulations (21 CFR Part 211) or the Quality
System regulation (21 CFR Part 820). Specific to a
Learning Management System (LMS) or Assessment
Management System (AMS), given they are only
used in support of the implementation of regulated
industries’ Quality Systems, they may or may not need
to be validated to the same degree as, for example,
software used as components in the product design
and manufacturing processes.
EU Regulatory GuidanceIn the European Union, the latest guidance from the
European Commission’s Directorate-General for Health
and Consumers on “Annex11: Computerized Systems”
infers that manufacturers should be able to justify their
standards, protocols, acceptance criteria, procedures
and records based on their risk assessment. Together
with the stipulation that LMS/AMS applications have
an indirect impact on life sciences product quality and
consumer safety, it would stand to reason that they
should not be treated (from a risk-based perspective)
like firmware/software used in direct control of design
and manufacturing processes. Accordingly, some
manufacturers might subscribe to the notion that their
LMS/AMS validation might be exercised in a somewhat
discretionary manner, given that the competence and
reliability of a supplier can be established by assessing
the supplier’s established procedures that produce
“change tracking” records accumulated within time
sequenced documentation.
Saba ExperienceSaba, founded in 1997, decided as part of its
initial market segmentation to satisfy 21 CFR Part
11 requirements for those customers that needed
electronic signatures and as such developed its
software platform to support trustworthy and reliable
electronic records with associated audit trails. As a
result, Saba has attracted a significant portion of top
global Fortune 50 life sciences organizations as its
customers and, more importantly, has sustained them
as longterm customers. Some of these customers have
started to migrate into the cloud by moving their Saba
implementations from behind their corporate firewalls
into Saba Cloud, Saba’s SaaS offering.
Saba Cloud is a software application suite that is
rendered as “Software as a Service” (SaaS) (see Figure
1 below). As its core functionality, the application stores
user profiles and training compliance information
such as transcripts and certifications, and it meets
the relevant provisions set forth in 21 CFR Part 11
by sustaining a “closed system” by implementing
functionalities that guarantee user account uniqueness,
native password administration controls, and silent or
verbose audit trails, as well as e-signatures triggered
by end-user actions that require user confirmation to
complete tasks within application workflows. Another
requirement that the FDA imposes on its regulated
industries is that it puts the impetus on organizations
to “validate” whether software applications are
developed and tested according to “current Good
Manufacturing Practices” (CGMPs) defined by the FDA.
In this regard, too, Saba has well-documented internal
quality standard operating procedures (SOPs) for
software development, and we have had many of our
life sciences regulated customers audit us against our
application “Software Development Life Cycle” (SDLC)
SOPs. Saba Services can support customers with their
audit requirements for Operational and Performance
Qualification (IQ/OQ/PQ) activities pertaining to our
customers’ “Deployed Application Environments.” Saba
publishes customer facing documentation to support
Installation Qualification (IQ) for each release. Saba
Cloud application suite and its core LMS functionality is
Saba Cloud – Validated Environment Managed Services (VEMS) | 4© 2020 Saba Software. All Rights Reserved.
rendered via a shared infrastructure SaaS model as depicted in the National Institute of Standards and Technology
(NIST) abstractions. Current FDA IQ/OQ/PQ guidelines only pertain to computerized systems with infrastructure
dedicated to a single organization and hosted in-house or via an external “IaaS” provider. As of the time of this
writing, FDA guidelines have not been updated to define best practices for validating Cloud SaaS deployments,
so Saba has put forward the following proposed framework.
Pursuant to NIST definitions, SaaS on shared infrastructure, in Figure 1, implies the Cloud Consumer would entrust
the Cloud Provider to sustain the four infrastructure tiers below the Application tier as long as the Cloud Provider
internal change control procedures are assessed by third-party American Institute of Certified Public Accountants
(AICPA) accounting firms and produce annual attestations of Cloud Provider compliance to SSAE18 or similar
internal frameworks for security, confidentiality and availability. Accordingly, infrastructure (the bottom four tiers
below Application) changes are not subject to Cloud Consumer approval or review, and where a change cannot
be fully verified by the Cloud Consumer, it shall be validated with a high degree of assurance and approved by the
Cloud Provider according to established procedures.
Cloud Provider
Application
Hardware
Facility
Platform Architecture
Cloud Infrastructure
Cloud Consumer
Figure 1: Differences in Scope and Control among Cloud Services Models
Saba Cloud – Validated Environment Managed Services (VEMS) | 5© 2020 Saba Software. All Rights Reserved.
...and the stipulation that an LMS application has an indirect impact on life sciences product quality and patient safety, some life sciences organizations might agree that LMS validation activities might be viewed as somewhat discretionary, especially since an LMS is not used to perform the transactions below:
Control data supporting regulatory safety and efficacy submissions
Control or provide data for product release
Control data required in case of product recall
Control critical parameters or data used at any stage, including pre-clinical, clinical, development and manufacturing
Control adverse event or complaint recording or reporting
With the above framework in mind...
Saba Cloud – Validated Environment Managed Services (VEMS) | 6© 2020 Saba Software. All Rights Reserved.
Saba Cloud – Validated Environment Managed Service (VEMS)With the recent demand for transition into the cloud
and in keeping with our ongoing strategy and success
in leading the market, Saba has developed a new set
of services that helps our regulated GxP customers
maintain validation compliance for their Saba Cloud
SaaS environment via a comprehensive set of
Application-tier pre-go-live validation services and
post-go-live change tracking documentation. This new
program is called “Validated Environment Managed
Service” (VEMS) and is described in more detail below.
Saba Cloud VEMS is designed to help our regulated
GxP customers maintain ongoing validation
compliance for their Saba Cloud shared infrastructure
SaaS environments. Saba Cloud customers who
use discretion about validation of their LMS may
choose to defer some aspects of pre-go-live
“Initial Implementation Validation” and post-go-live
“Application Change Tracking” to the Cloud Provider.
The Saba Cloud Multi-Tenant Application Validation
model is comprised of:
• New implementation support services including
Application validation (IQ/OQ/PQ). (Refer to table
below)
• Post-go-live “Continuous Validation” of Application
changes. (Refer to table below)
Specific to post-go-live “Continuous Validation,” the
proposed deferred validation model relies on Saba
to validate all application software updates before
approval for production use. Essentially, Saba performs
“Installation Qualification” (IQ) with a high degree
of assurance according to established procedures,
providing prospective and proactive accountability.
A few months prior to a Saba Cloud VEMS Update,
the customer is provided application software
“Functionality Change” training followed by an
opportunity to review net application changes inside
a Staging site before their VEMS Non-Production and
Production Saba Cloud sites are upgraded to the latest
Saba Cloud VEMS version.
The above, together with open access to
Sabaproduced application validation records, serves
as both reactive and retrospective accountability that
our customers can demonstrate to regulators at any
time. Moreover, the proposed model enables our
customer project teams to reduce their reliance on
in-house validation support resources, hence
eliminating the risk of losing application support (from
vendor/supplier) due to inability to update their LMS as
a result of IT and quality control resource scarcity.
Saba Cloud – Validated Environment Managed Services (VEMS) | 7© 2020 Saba Software. All Rights Reserved.
APPLICATION CHANGE TRACKING PHASE
Monthly Fee; Co-terminus With SaaS Subscription
• Formal processes track application functionality changes via change management request and approval records which are maintained within Saba’s release planning system of record
• A few months leading up to each Saba Cloud update
− Application “What’s New” training delivered to customers
− VEMS subscribers are afforded a 10 week validation period of the latest Saba Cloud Update prior to upgrade of VEMS Non-Production and Production sites
• Pursuant to each update to Saba Cloud, Saba performs summary “Change Documentation,” using Saba GDP-based change tracking forms, which include evidentiary summary of:
− Application “Release Notes”
− 21 CFR Part 11 product compliance test results
− Saba Cloud VEMS Validation Summary
• Saba facilitates periodic requests for operational verifications, including third-party annual attestations for SaaS platform and operational compliance to Trust Services Principles (TSP) for security, confidentiality and availability, which include third-party reviews of Saba’s Operating Controls
IMPLEMENTATION PHASE
Fixed-fee Consulting Service
• Pre-go-live Audit: Saba facilitates requests to verify application software SDLC, product release methodology, and production support operations
• Validation Package Creation: Performed by Saba Consulting and Customer Team, utilizing Saba “Good Documentation Practices” (GDP)
− Application Configuration Blueprint document suite (includes Traceability Matrix linking Requirements, Configuration Specifications and UAT scripts)
− IQ Documentation: Executed by Saba Cloud Ops, using Saba
− IQ templates and GDP
• OQ/PQ Documentation:
− Documented evidence that software components and integrated system perform as required and expected (including UAT execution/sign-offs by customer project team)
• Saba Professional Services provides optional Release Validation services to assist customers in re-validating OQ/PQ with each new software release
Saba Cloud – Validated Environment Managed Services (VEMS) | 8© 2020 Saba Software. All Rights Reserved.
✓ Rigorous Saba SDLC processes
✓ Standardized validation criteria
✓ Verified by independent third party
✓ Access to meticulous documentation
✓ Lower overall operating cost
✓ Significantly reduced customer resource requirements
✓ Benefits of the Cloud with the flexibility to stage and validate
✓ Addresses risk of losing application support from Cloud Provider
Value to VEMS Subscribers
© 2020 Saba Software Inc. All rights reserved. Saba, the Saba logo, and the marks relating to Saba products and services referenced herein are either trademarks or registered trademarks of Saba Software, Inc. or its affiliates. All other trademarks are the property of their respective owners.
(+1) 877.SABA.101 | www.saba.com 02/20
Your success starts here!
24/7 customer support
Collaborative online customer community
Value-added strategic services
Regular user group meetings
Standard or customized implementation services
Dedicated customer success rep
The Saba Experience:
Saba Partner Marketplace
Recruiting & Onboarding
Performance & Coaching
Learning & Skill Development
People Insight & Analytics
At Saba, we know that the success of any organization starts with its people.
At Saba, we know that every organization has the potential
to be a great place to work, and no matter what your
business does, or who you serve, or what you sell, success
starts with your people. But in today’s diverse, mobile, social
world, successful organizations must deliver an experience
at work that’s more connected, and more personal than
ever before. And the most successful do this with Saba.
Because we combine the science of talent with intelligent
technology to deliver a “just-for-me” talent experience for
every individual - in the moments that matter most. With
powerful tools and insights talent leaders need to prove the
experience makes an impact on business success.
So from attracting candidates who are the perfect fit, to
designing paths for personal growth, to creating a culture
that nurtures the unique talents of every individual, Saba
helps you give your people and teams the message: Work
to your strengths. Work like you envision. Work like it’s
personal. Work like you.
About Saba
Ready to learn more? Connect with us!