IT Administration for GxP Environments: Secure System Management

The main purpose is to ensure data integrity (ALCOA+), product safety, and patient safety through control of the IT infrastructure and GxP-relevant systems. This includes protection against unauthorized changes, data loss, and system failures.

The most important regulatory requirements come from:

• EU GMP Guideline Annex 11 (Computerised Systems)
• US FDA 21 CFR Part 11 (Electronic Records; Electronic Signatures)
• GxP principles (e.g., traceability, documentation)

These require, among other things, access controls, audit trails, and validated processes for system operation.

Administrative access must be strictly role-based and permission-based. The principle of least privilege applies. Administrators should:

• Use separate accounts for daily tasks and administrative activities.
• Use strong authentication (e.g., two-factor authentication/2FA).
• Perform access via secure protocols and secured management networks (where possible).

PAM describes the management and monitoring of all accounts with elevated privileges (e.g., system administrators). In the GxP environment, PAM must ensure that: The use of admin passwords is documented and time-limited. All actions of the administrators are recorded (session recording) and traceable (audit trail).

Every planned change to GxP-relevant systems (hardware, software, configuration) must be subject to a formal change control process. This process must ensure that:

• The change is assessed on a risk-based approach.
• The impacts on validation and data integrity are evaluated.
• The change is authorized, documented, and tested before it goes into production.

The backup and recovery processes must be qualified or validated. It must be ensured that: All GxP data (including metadata and audit trails) are backed up regularly. The recovery of data (restore) is regularly tested and documented to ensure availability and integrity in case of emergency.

Yes. While the specific GxP software is validated, the underlying IT infrastructure (servers, networks, operating systems) must be qualified. The qualification (IQ/OQ) ensures that the infrastructure is robust and capable of operating the GxP systems safely and reliably.

Remote access, e.g., for external service providers or administrators working from home, poses a high risk. It must be protected by the following measures:

• Strong encryption (VPN).
• Two-factor authentication (2FA).
• Time-limited approval of access.
• Detailed logging and monitoring of all remote activities.

For external service providers, a Quality Assurance Agreement or Service Level Agreement (SLA) must be concluded that clearly defines the GxP responsibilities. The GxP-regulated customer (owner) retains ultimate responsibility for data integrity and must audit the service provider and regularly monitor their processes.

Documentation is essential. All administrative processes, configurations, permissions, backups, maintenance, incidents, and change control must be comprehensibly defined and recorded in Standard Operating Procedures (SOPs) and protocols in order to demonstrate GxP compliance at all times.