White Paper - SAP Digital Manufacturing in Regulated Environments; Quality & Compliance
This whitepaper provides information on how SAP approaches GxP-related compliance for SAP Digital Manufacturing and provides customers guidance on using SAP Digital Manufacturing in a GxP context. Download the DocumentPUBLIC
SAP Digital Manufacturing in Regulated
Environments
Quality and Compliance
SAP Digital Manufacturing in Regulated
Environments
Quality and Compliance
Disclaimer:
Customers intending to use SAP Digital Manufacturing in a GxP context must independently assess the use
of the SAP Digital Manufacturing product. SAP is a technology provider of business processes designed for
general availability. SAP provides this document for informational purposes only. Any information outlined in
this document may change at any time at SAP's discretion.
Customers intending to use SAP Digital Manufacturing in a GxP context must independently assess the use
of the SAP Digital Manufacturing product. SAP is a technology provider of business processes designed for
general availability. SAP provides this document for informational purposes only. Any information outlined in
this document may change at any time at SAP's discretion.
3 / 20
© 2023 SAP SE or an SAP affiliate company. All rights reserved. See Legal Notice on www.sap.com/legal-notice for use terms, disclaimers, disclosures, or restrictions related to SAP Materials for general audiences.
Contents
Abstract .............................................................................................................................. 4
1. Introduction to GxP and SAP Digital Manufacturing ................................................ 4
1.1 Understanding GxP and GAMP 5 Framework .................................................................... 4
1.2 Overview of SAP Digital Manufacturing ................................................................................ 5
1.2.1 DM Architectural Overview .................................................................................................................... 5
1.2.2 SAP Digital Manufacturing Releases .................................................................................................... 6
1.3 SaaS Shared Responsibility Model........................................................................................ 7
2. SAP Digital Manufacturing in GxP Regulated Environment .................................... 7
2.1 Certifications and Attestations .............................................................................................. 8
2.2 GxP SKU: Quality Requirement Schedule ............................................................................. 8
2.2.1 Audit ......................................................................................................................................................... 9
2.2.2 Regulatory Requirements Traceability ................................................................................................. 9
2.2.3 Infrastructure Qualification ................................................................................................................... 9
2.3 Testing Framework ................................................................................................................. 9
2.4 Service Catalog ..................................................................................................................... 10
3. SAP Digital Manufacturing Quality Management System ...................................... 10
3.1 Document Management ........................................................................................................ 11
3.2 Cloud Service Qualification.................................................................................................. 11
3.3 Risk Management ................................................................................................................. 11
3.4 Secure Software Development Operations Life Cycle (SSDOL) ........................................ 12
3.5 SAP Digital Manufacturing IT Operations and Service ....................................................... 13
3.5.1 Incident Management ........................................................................................................................... 13
3.5.2 Problem Management .......................................................................................................................... 14
3.5.3 Operational Change Management ...................................................................................................... 14
3.5.4 Monitoring Management ...................................................................................................................... 14
3.5.5 Backup and Restore ............................................................................................................................. 14
3.5.6 Provisioning and Deprovisioning ....................................................................................................... 15
3.5.7 Hotfix...................................................................................................................................................... 15
3.6 Security Management ........................................................................................................... 15
3.7 Data Protection ..................................................................................................................... 16
3.8 Personnel Training ............................................................................................................... 16
4. Next Steps .................................................................................................................. 17
5. Conclusion ................................................................................................................. 17
6. Glossary ..................................................................................................................... 17
7. History ........................................................................................................................ 20
© 2023 SAP SE or an SAP affiliate company. All rights reserved. See Legal Notice on www.sap.com/legal-notice for use terms, disclaimers, disclosures, or restrictions related to SAP Materials for general audiences.
Contents
Abstract .............................................................................................................................. 4
1. Introduction to GxP and SAP Digital Manufacturing ................................................ 4
1.1 Understanding GxP and GAMP 5 Framework .................................................................... 4
1.2 Overview of SAP Digital Manufacturing ................................................................................ 5
1.2.1 DM Architectural Overview .................................................................................................................... 5
1.2.2 SAP Digital Manufacturing Releases .................................................................................................... 6
1.3 SaaS Shared Responsibility Model........................................................................................ 7
2. SAP Digital Manufacturing in GxP Regulated Environment .................................... 7
2.1 Certifications and Attestations .............................................................................................. 8
2.2 GxP SKU: Quality Requirement Schedule ............................................................................. 8
2.2.1 Audit ......................................................................................................................................................... 9
2.2.2 Regulatory Requirements Traceability ................................................................................................. 9
2.2.3 Infrastructure Qualification ................................................................................................................... 9
2.3 Testing Framework ................................................................................................................. 9
2.4 Service Catalog ..................................................................................................................... 10
3. SAP Digital Manufacturing Quality Management System ...................................... 10
3.1 Document Management ........................................................................................................ 11
3.2 Cloud Service Qualification.................................................................................................. 11
3.3 Risk Management ................................................................................................................. 11
3.4 Secure Software Development Operations Life Cycle (SSDOL) ........................................ 12
3.5 SAP Digital Manufacturing IT Operations and Service ....................................................... 13
3.5.1 Incident Management ........................................................................................................................... 13
3.5.2 Problem Management .......................................................................................................................... 14
3.5.3 Operational Change Management ...................................................................................................... 14
3.5.4 Monitoring Management ...................................................................................................................... 14
3.5.5 Backup and Restore ............................................................................................................................. 14
3.5.6 Provisioning and Deprovisioning ....................................................................................................... 15
3.5.7 Hotfix...................................................................................................................................................... 15
3.6 Security Management ........................................................................................................... 15
3.7 Data Protection ..................................................................................................................... 16
3.8 Personnel Training ............................................................................................................... 16
4. Next Steps .................................................................................................................. 17
5. Conclusion ................................................................................................................. 17
6. Glossary ..................................................................................................................... 17
7. History ........................................................................................................................ 20
4 / 20
© 2023 SAP SE or an SAP affiliate company. All rights reserved. See Legal Notice on www.sap.com/legal-notice for use terms, disclaimers, disclosures, or restrictions related to SAP Materials
for general audiences.
Abstract
This whitepaper provides information on how SAP approaches GxP-related compliance for SAP
Digital Manufacturing and provides customers guidance on using SAP Digital Manufacturing in a
GxP context.
1. Introduction to GxP and SAP Digital Manufacturing
1.1 Understanding GxP and GAMP 5 Framework
In regulated industries such as pharmaceutical drugs manufacturing, medical devices, regulated
Fast-moving Consumer Goods (FMCG), and chemicals, compliance with regulatory standards is
critical to ensuring product quality and end-user safety. Collectively referred to as GxP, these
“Good Practice” guidelines include Good Manufacturing Practices (GMP), Good Clinical Practices
(GCP), Good Laboratory Practices (GLP), and others. Each framework sets standards for specific
stages of the product lifecycle, from development to distribution.
Regulatory authorities such as the U.S. Food and Drug Administration (FDA), the European
Medicines Agency (EMA), and others, provide guidelines that govern GxP practices. In the
European Union and the UK, the General Data Protection Regulation (GDPR) and UK GDPR
(enhanced by Data Protection Act 2018) mandates strict controls on personal data processing.
In the United States, GxP compliance aligns with the Code of Federal Regulations (21 CFR).
while in European Union, it aligns with EU Annex 11. These frameworks and guidelines
underscore the importance of data protection mechanisms in regulated environments, where
SAP provides support with comprehensive technical and organizational controls.
Globally operated regulated industry organizations must harmonize with international guidelines,
such as those developed by the International Council for Harmonization (ICH), World Health
Organization (WHO), and International Organization for Standardization (ISO). Since there is no
GxP certifications for cloud providers, GxP-regulated customers are responsible for verifying
compliance across the full lifecycle of their GxP systems in the cloud. Customers operating in
GxP context are ultimately accountable to regulatory bodies for demonstrating compliance with
respective regulations.
The International Society for Pharmaceutical Engineering (ISPE) has collaborated with
regulatory authorities and industry experts to develop the Good Automated Manufacturing
Practices (GAMP 5) framework. GAMP 5: A Risk-Based Approach to Compliant GxP
Computerized Systems provides guidelines for managing software lifecycle based on good
practices. The GAMP guidelines under GAMP 5 and GAMP Good Practice Guide: IT
Infrastructure Control and Compliance cover cloud-based Infrastructure and software delivery
models, including SaaS.
GAMP 5 guidance encourages regulated companies to maximize supplier involvement
throughout the system life cycle, leveraging the supplier's knowledge, experience, and
documentation where possible. This requires a satisfactory supplier assessment to establish
trust in SAP’s processes and controls. A thorough supplier assessment is essential to verify that
SAP Digital Manufacturing, develops and manages according to a Quality Management System
that follows documented procedures and standards.
This whitepaper provides customers an overview of SAP practices and capabilities supporting
usage of SAP Digital Manufacturing in a GxP context. This information can be used to gain deeper
© 2023 SAP SE or an SAP affiliate company. All rights reserved. See Legal Notice on www.sap.com/legal-notice for use terms, disclaimers, disclosures, or restrictions related to SAP Materials
for general audiences.
Abstract
This whitepaper provides information on how SAP approaches GxP-related compliance for SAP
Digital Manufacturing and provides customers guidance on using SAP Digital Manufacturing in a
GxP context.
1. Introduction to GxP and SAP Digital Manufacturing
1.1 Understanding GxP and GAMP 5 Framework
In regulated industries such as pharmaceutical drugs manufacturing, medical devices, regulated
Fast-moving Consumer Goods (FMCG), and chemicals, compliance with regulatory standards is
critical to ensuring product quality and end-user safety. Collectively referred to as GxP, these
“Good Practice” guidelines include Good Manufacturing Practices (GMP), Good Clinical Practices
(GCP), Good Laboratory Practices (GLP), and others. Each framework sets standards for specific
stages of the product lifecycle, from development to distribution.
Regulatory authorities such as the U.S. Food and Drug Administration (FDA), the European
Medicines Agency (EMA), and others, provide guidelines that govern GxP practices. In the
European Union and the UK, the General Data Protection Regulation (GDPR) and UK GDPR
(enhanced by Data Protection Act 2018) mandates strict controls on personal data processing.
In the United States, GxP compliance aligns with the Code of Federal Regulations (21 CFR).
while in European Union, it aligns with EU Annex 11. These frameworks and guidelines
underscore the importance of data protection mechanisms in regulated environments, where
SAP provides support with comprehensive technical and organizational controls.
Globally operated regulated industry organizations must harmonize with international guidelines,
such as those developed by the International Council for Harmonization (ICH), World Health
Organization (WHO), and International Organization for Standardization (ISO). Since there is no
GxP certifications for cloud providers, GxP-regulated customers are responsible for verifying
compliance across the full lifecycle of their GxP systems in the cloud. Customers operating in
GxP context are ultimately accountable to regulatory bodies for demonstrating compliance with
respective regulations.
The International Society for Pharmaceutical Engineering (ISPE) has collaborated with
regulatory authorities and industry experts to develop the Good Automated Manufacturing
Practices (GAMP 5) framework. GAMP 5: A Risk-Based Approach to Compliant GxP
Computerized Systems provides guidelines for managing software lifecycle based on good
practices. The GAMP guidelines under GAMP 5 and GAMP Good Practice Guide: IT
Infrastructure Control and Compliance cover cloud-based Infrastructure and software delivery
models, including SaaS.
GAMP 5 guidance encourages regulated companies to maximize supplier involvement
throughout the system life cycle, leveraging the supplier's knowledge, experience, and
documentation where possible. This requires a satisfactory supplier assessment to establish
trust in SAP’s processes and controls. A thorough supplier assessment is essential to verify that
SAP Digital Manufacturing, develops and manages according to a Quality Management System
that follows documented procedures and standards.
This whitepaper provides customers an overview of SAP practices and capabilities supporting
usage of SAP Digital Manufacturing in a GxP context. This information can be used to gain deeper