Cybersecurity Qualification (CyQ)

Posted on January 15, 2018February 11, 2018 by Valarie King-Bailey

One topic that has been top of mine for many validation engineers, chief information officers, and executive management is that of Cybersecurity. You may be asking yourself the question why are we talking about Cybersecurity and validation? Recent headlines will inform you as to why this topic should be of great interest to every validation engineer. As validation engineers we spend a lot of time stressing about risk assessments, system security, and qualification of system environments. Our job is supposed to be to validate the system to ensure its readiness for production use. Let me ask a question… How can you ensure that a system is ready for production use if it is not cyber-ready? This is why we are talking about Cybersecurity in the context of validated systems.

When it comes to computer systems in today’s highly networked environment, Cybersecurity is the elephant in the room. All networked systems may be vulnerable to cyber security threats. Businesses large and small may be subject to cyber-attacks and the exploitation of these vulnerabilities may present a risk to public health and safety if not properly addressed. Although we know these truths all too well, many validation engineers are not even discussing Cybersecurity as part of an overall validation strategy.

There is no company that can prevent all incidences of cyber-attacks but it is critically important that companies began to think seriously about how to protect themselves from persistent cyber criminals determined to inflict as much damage as possible on computer systems in either highly regulated or nonregulated environments. One thing we know about cyber criminals is they are equal opportunity offenders – everyone has a degree of vulnerability. To beat them at their game, you have to be one step ahead of them.

In the validation world, we often refer to validation testing as IQ/OQ/PQ testing. I would like to submit for your review and consideration another type of enhanced validation testing that we should be doing which is Cybersecurity qualification or as I like to refer to it “CyQ”. What is a CyQ? It is confirmation of a system’s protection controls and readiness to prevent a cyber-attack. In one of my recent blog posts, I declared that …”computer systems validation as we know it is dead!…” Now of course I mean that tongue in cheek! What I was referring to is that it is time to rethink our validation strategy based on the fact that we need to address the vulnerabilities of today’s cloud-based and on-premise systems with respect to the Cybersecurity risk imposed. We can no longer look at systems the way we did in the 1980s. Many life sciences companies are deploying cloud-based technologies, mobile systems, the Internet of things (IoT) and many other advanced technologies in the pursuit of innovation that may drive greater risk profiles in validated systems. Incorporating CyQ in your overall validation strategy is one way to address these challenges.

The national Institute of standards and technology (NIST) introduced as cyber security framework. The five elements of the framework are shown in the figure below.

As a validation engineer I have studied this framework for its applicability to validated systems. Each element of the strategy addresses a dimension of your cybersecurity profile. To conduct a CyQ assessment, you need to examine each element of the cybersecurity framework to determine your readiness in each respective category. I have developed a CyQ Excel Spreadsheet which examines each element of the framework and allows you to summarize your readiness to prevent a cyber-attack. (if you would like a copy of the CyQ Excel Spreadsheet, please contact me using the contact form and I will happily send it to you).

Remember, for validated systems, if it is not documented, it did not happen! Cybersecurity Qualification analysis must be documented. You must be ready to explain to regulators when it comes to data integrity and systems integrity, what controls you have in place to protect both the data and the systems under your management.

Another consideration in the management of cyber threats is EDUCATION. The biggest cyber breach may come from the person in the cubicle next to you! You must educate (and document) cyber training and do it on a frequent basis to keep pace.

For your next validation project, address the elephant in the room explicitly. Cyber threats are not diminishing, they are increasing. It is important to understand their origin and seriously consider how they can and will impact validated systems. We can no longer think that IQ/OQ/PQ is sufficient. While it has served its purpose in times past, we need a more effective strategy to address today’s clear and present danger to validated systems – the next cyber-attack. It could be YOUR SYSTEM. Deal with it!

Leveraging the NIST Cybersecurity Framework

Posted on May 19, 2017February 10, 2018 by Valarie King-Bailey

As a validation engineer, why should you be concerned about Cybersecurity? Good question! Today’s headlines are filled with instances of cyber attacks and data breaches impacting some of the largest corporate systems around. As validation engineers, our job is to confirm software quality and that systems meet their intended use. How can you realistically do this without paying any attention to the threat of potential cyber attacks on validated system environment.

As with every system environment, you must ensure your readiness to help prevent a cyber event from occurring. Of course, you can never fully protect your systems to the extent that a cyber attack will never be successful, but you can certainly PREPARE and reduce the probability of this risk. That’s what this article is all about – PREPAREDNESS.

The NIST Cybersecurity Framework was created through collaboration between industry and government and consists of standards, guidelines, and practices to promote the protection of critical infrastructure.

To get a copy of the NIST Cyber Security Framework publication, click here. If you are not familiar with the NIST Cyber Security Framework, you can view an overview video and get a copy of the Excel spreadsheet.

Remember the old addage, “…if its not documented, it did’nt happen…”? You must document controls, processes and strategies to ensure that you are able to defend your readiness assessment for cybersecurity. The NIST Cyber Security Framework is designed to help organizations view cybersecurity in a systematic way as part of your overall risk management strategy for validated systems. The Framework consists of three parts:

Framework Core – a set of cybersecurity activities, outcomes, and informative references that are common across your validated systems environments. The Framework Core consists of (5) concurrent and continuous Functions which are: (1) Identify, (2) Protect, (3) Detect, (4) Respond, (5) Recover as shown in the figure below.
Framework Profile – help align your cybersecurity activities with business requirements, risk tolerances, and resources
Framework Implementation Tiers – a method to view, assess, document and understand the characteristics of your approach to managing cybersecurity risks in validated systems environments. This is assessment is part of your Cybersecurity Qualification (CyQ). Life sciences companies should characterize their level of readiness from Partial (Tier 1) to Adaptive (Tier 4). You can use what ever scale you like in your assessment.

Most companies are adept at RESPONDING to cyber events rather than preventing them. This Framework, as part of your overall integrated risk management strategy for validation. We recommend for validation engineers that you DOCUMENT your strategy to confirm your due diligence with respect to cybersecurity. In my previous blog post, I recommended that in addition to conducting IQ, OQ, PQ, and UAT testing that you also conduct a CyQ readiness assessment.

Cyber threats are a clear and present danger to companies of all sizes and types. As validation engineers, we need to rethink our validation strategies and adapt to changes which can have significant impact on our validated systems environments. Whether you are in the cloud or on-premise, cyber threats are real and may impact you. This problem is persistent and is not going away anytime soon. Readiness and preparedness is the key. Some think that issues concerning cybersecurity are only the perview of the IT team – THINK AGAIN! Cybersecurity is not only an IT problem, it is an enterprise problem that requires an interdisciplinary approach and a comprehensive governance commitment to ensure that all aspects of your validation processes and business processes are aligned to support effective cybersecurity practices.

If you are responsible for software quality and ensuring the readiness of validated you need to be concerned about this matter. The threats are real. The challenges are persistent. The need for greater diligence is upon us. Check out the NIST Cyber Security Framework. Get your cyber house in order.

Computer Systems Validation As We Know It Is DEAD

Posted on April 24, 2017February 4, 2018 by Valarie King-Bailey

Over the past 10 years, the software industry has experienced radical changes. Enterprise applications deployed in the cloud, the Internet of Things (IoT), mobile applications, robotics, artificial intelligence, X-as-a-Service, agile development, cybersecurity challenges and other technology trends force us to rethink strategies for ensuring software quality. For over 40 years, validation practices have not changed very much. Suprisingly, many companies still conduct computer systems validation using paper-based processes. However, the trends outlined above challenge some of the current assumptions about validation. I sometimes hear people say “… since I am in the cloud, I don’t have to conduct an IQ…” or they will say, “… well my cloud provider is handling that…”

Issues related to responsibility and testing are changing based on deployment models and development lifecycles. Validation is designed to confirm that a system meets its intended use. However, how can we certify that a system meets its intended use if it is left vulnerable to cyber threats? How can we maintain the validated state over time in production if the cloud environment is constantly changing the validated state? How can we adequately test computer systems if users can download an “app” from the App Store to integrate with a validated system? How can we ensure that we are following proper controls for 21 CFR Part 11 if our cloud vendor is not adhering to CSA cloud controls? How can we test IoT devices connected to validated systems to ensure that they work safely and in accordance with regulatory standards?

You will not find the answers to any of these questions in any regulatory guidance documents. Technology is moving at the speed of thought yet our validation processes are struggling to keep up.

These questions have led me to conclude that validation as we know it is DEAD. The challenges imposed by the latest technological advances in agile software development, enterprise cloud applications, IoT, mobility, data integrity, privacy and cybersecurity are forcing validation engineers to rethink current processes.

Gartner group recently announced that firms using IoT grew from 29% in 2015 to 43 % in 2016. They project that by the year 2020, over 26 billion devices will be IoT-devices. it should be noted that Microsoft’s Azure platform includes a suite of applications for remote monitoring, predictive maintenance and connected factory monitoring for industrial devices. Current guidance has not kept pace with ever-changing technology yet the need for quality in software applications remains a consistent imperative.

So how should validation engineers change processes to address these challenges?

First, consider how your systems are developed and deployed. The V-model assumes a waterfall approach yet most software today is developed using Agile methodologies. It is important to take this into consideration in your methodologies.

Secondly, I strongly recommend adding two SOPs to your quality procedures – a Cybersecurity SOP for validated computer systems and a Cloud SOP for validated systems. You will need these two procedures to provide governance for your cloud processes. (If you do not have a cloud or cybersecurity SOP please contact me and I will send you both SOPs.)

Third, I believe you should incorporate cybersecurity qualification (CyQ) into your testing strategy. In addition to IQ/OQ/PQ, you should be conducting a CyQ readiness assessment for all validated systems. A CyQ is an assessment to confirm and document your readiness to protect validated systems against a cyber attack. It also includes testing to validate current protections for your validated systems. It is important to note that regulators will judge you on your PROACTIVE approach to compliance. This is an important step in that direction.

Forth, you should adopt lean validation methodologies. Lean validation practices are designed to eliminate waste and inefficiency throughout the validation process while ensuring sustained compliance.

Finally, the time has come for automation. To keep pace with the changes in current technology as discussed above, you MUST include automation for requirements management, validation testing, incident management and validation quality assurance (CAPA, NC, audit management, training, et al). I recommend consideration of an Enterprise Validation Management system such as ValidationMaster™ to support the full lifecycle of computer systems validation. ValidationMaster™ allows you to build a re-usable test script library and represents a “SINGLE SOURCE OF TRUTH” for all of your validation projects. Automation of the validation process is no longer a luxury but a necessity.

Advanced technology is moving fast. The time is now to rethink your validation strategies for the 21st century. Validation as we know it is dead. Lean, agile validation processes are demanded to keep pace with rapidly changing technology. As you embrace the latest cloud, mobile and IoT technologies, you will quickly find that the old ways of validation are no longer sufficient. Cyber criminals are not going away but you need to be ready. Step into LEAN and embrace the future!

Validation Testing: Understanding The Why and How

Posted on March 15, 2017February 11, 2018 by Valarie King-Bailey

For today’s on-premise and cloud-based systems, validation testing is a required process to ensure that systems are of sufficient quality and operate according to their intended use. Validation testing is typically done at the end of the development process after all verification has been completed. IEEE defines validation as the process of evaluating software to determine whether it satisfies the specific defined requirements. Therefore validation testing must be traced to pre-defined requirements.

The goals of validation are pretty clear:

Discover errors/anomalies in software prior to production
Confirm that system meet their intended use
Confirm that regulatory requirements in the software are met
Provide due diligence (documented evidence) for regulators
Deliver justification for use of a system

I have had the priviledge of working with many life sciences companies over the years and I have seen it all – from ad hoc testing processes to those that are well-defined and mature in their optimization and effectiveness. Most testing processes are at level one where the processes are chaotic and not well-defined.

Automated validation testing processes are essential in today’s life sciences companies where we all are being asked to do more with less. It is essential that we establish automated processes to accelerate productivity, eliminate waste and ensure greater to ensure software quality.

The less time spent on the mechanics of test script development, the more time can be dedicated to ensuring software quality.

The software testing capability maturity model should be on your radar. Establishing automated testing should be a goal for every validation engineer. It is important to understand how to achieve Level 5 and what it takes from a process perspective to achieve greater testing governance and sustained compliance.

ESTABLISHING A REUSABLE TEST SCRIPT LIBRARY

When conducting validation, the most laborious part of the process is testing. Validating today’s COTS software applications involves testing the same “out-of-the-box” features over and over again. Many validation engineers continue to draft test scripts again and again to support this process. What if you could establish a “reusable test script library” for your validation projects that would allow you to conduct regression testing quickly and easily without major rewrite for your applications? What if you could centrally store this repository for all of your applications so you had a single source of truth for all of your validation projects? What if you could ensure that your validation test library was “auditable” and could be shared with regulators during audits as part of your objective evidence requirements? What if each test script had its own audit trail and was traced to its respective requirements for automatic traceability?

The ability to effective establish and manage a reusable test script library and a single source of truth for all of your validation projects is made possible with the ValidationMaster™ Enterprise Validation Management system.

The system allows you to create, track and manage a reusable test script library quickly and easily. All of your validation assets are in a single location for reference and reuse. Intelligence can be quickly gleaned from the system to drive continuous improvement and compliance. For fully automated scripts that require no human intervention to run, the system has the ability to automate test script execution and reporting of actual results. This helps to facilitate continuous testing in the cloud and ensure that your systems are maintained in a validated state.

Validation testing is here to stay. AUTOMATION IS THE KEY! It is a necessity not a luxury to automate your validation processes. Join us for one of our Automated Testing online web briefings to learn more.