The qualification of IT structures in GxP environments must guarantee that they meet the defined requirements (technical, regulatory, and functional) to support any GxP application and business needs.
The infrastructure qualification is a guarantee for the optimal operation of all IT resources of the company, while also allowing compliance with sector regulations relating to security, privacy, and data protection.
IT infrastructure qualification is the process to obtain and demonstrate that the IT infrastructure has been installed according to the established specifications and that its operation is within the recommended limits when used according to its instructions.
When an infrastructure is qualified, it is being guaranteed that the installation has been performed according to its specifications and that its operation is adequate under normal conditions of use.
It is common to use the term validate or qualify to refer to the same process of checking and verifying the operation of a company's IT resources. Although they are complementary concepts, validation applies to computerized systems that implement GxP processes, while qualification refers to the IT infrastructure used by the company that supports these computerized systems.
Therefore, qualification complements the validation of GxP processes, as it allows recording and verifying that an IT infrastructure has been installed, configured, and operated in compliance with established requirements, and functioning properly.
Qualification by itself cannot be considered nor does it constitute a validation.
Mainly, there are two strategies that can be used to qualify our IT infrastructure:
Regardless of the chosen strategy, the stages of qualifying an IT infrastructure are:
In this phase, a global and detailed vision of the project is provided, identifying those responsible for operations and the documents required to be issued for IT infrastructure qualification.
In the planning stage of infrastructure qualification, it is necessary to define what operating requirements must be met. The existing security measures and regulatory standards must also be taken into account to properly establish the qualification tests that will be performed later.
An analysis of the risks associated with each of the requirements that must be met must be carried out in order to adjust tests and eliminate or reduce them in the OQ phase.
The two verifications and tests that must be performed on the IT infrastructure and that must be carried out in the following order are:
Installation Qualification or IQ (Installation Qualification) aims to verify that the design of the IT infrastructure architecture is truly what has been installed and that said installation has been carried out successfully. To do this, checks such as component characterization, access control, and other verifications must be performed.
These tests can also include backup and restore tests or technical documentation and licensing.
At the conclusion of the various qualification tests, a report must be made gathering all performed activities and obtained results. In these records, deviations obtained when performing tests will be gathered, as well as any other relevant related data.
A schedule must also be implemented to perform periodic reviews and verify that the IT infrastructure continues to function and that the qualification state is maintained. Current regulations can set the frequency with which these infrastructure qualification reviews must be performed.
IT infrastructure qualification complements computerized system validation, which helps the GxP application function correctly.
An IT infrastructure qualification in regulated companies requires standardized documentation gathering test results to serve as a quality guarantee.
With the adoption of new technologies such as cloud computing, artificial intelligence, or the use of smart devices (internet of things), IT infrastructure qualification acquires even greater importance to ensure that all equipment, systems, and devices function according to their specifications, guaranteeing that the level of quality and security always remains above the established and regulated minimum.
At AMBIT we have been experts for over 15 years in the development of IT strategies and solutions for your company. We are consultants and integrators across multiple domains, and if you want to learn more about the solutions we can offer you, do not hesitate to contact us.