AWS published a GxP whitepaper which details a comprehensive approach for using the AWS cloud for GxP systems. This whitepaper provides guidance for using AWS Products in the context of GxP and the content has been developed in conjunction with AWS pharmaceutical and medical device customers, as well as software partners, who are currently using AWS Products in their validated GxP systems. In order to ensure the suitability of the content, AWS took the additional step of engaging Lachman Consultant Services Inc. (Lachman Consultants) to review and contribute to the approach outlined in this whitepaper. Lachman Consultants is one of the most highly respected consulting firms on FDA and international regulatory compliance issues affecting the pharmaceutical and medical device industry today. Lachman Consultants has extensive experience working with companies specifically on matters pertaining to the establishment and development of GxP systems, including GxP guidelines in support of maintaining regulated data in a validated cloud environment. For further information on Lachman Consultants, visit www.lachmanconsultants.com.

AWS also has other security and quality certifications such as ISO 9001, ISO 27001, ISO 27017, and ISO 27018, and is compliant with NIST 800-53 under the FedRAMP compliance program.

Yes, numerous AWS customers have successfully developed, validated and operated all or part of their GxP system using AWS products. AWS regularly works with GxP customers and their auditors in planning for, developing, validating, operating, and auditing GxP systems that use AWS products as a component. Because of confidentiality agreements, we do not disclose specific company details and use cases of GxP systems in AWS.

In the United States (US), GxP regulations are enforced by the FDA and are contained in Title 21 of the Code of Federal Regulations (21 CFR). Within 21 CFR, Part 11 contains the requirements for computer systems that create, modify, maintain, archive, retrieve, or distribute electronic records and electronic signatures in support of GxP-regulated activities. Part 11 was created to permit the adoption of new information technologies by FDA-regulated life sciences organizations, while simultaneously providing a framework to ensure that the electronic GxP data is trustworthy and reliable.

There is no GxP certification for a commercial cloud provider such as AWS. AWS makes commercial-off-the-shelf (COTS) IT infrastructure products according to IT quality and security standards such as ISO 27001, ISO 27017, ISO 27018, ISO 9001, NIST 800-53 and many others. GxP-regulated life sciences organizations are responsible for purchasing and using AWS Products to develop, validate, and operate their GxP systems accordingly.