White Paper - SAP Cloud ALM in Regulated Environment
This white paper outlines practices that life science customers use, including internal quality and development practices critical for GxP compliance. Preuzmite dokumentSAP Cloud ALM
in Regulated Environments
in Regulated Environments
2 / 21
Contents
Abstract .................................................................................................................................................................. 3
About SAP Cloud ALM ....................................................................................................................................... 3
SAP Cloud ALM in a regulated environment ............................................................................................. 4
Certifications and attestations ...................................................................................................................... 4
Architectural overview ..................................................................................................................................... 5
SAP Cloud ALM as a SaaS solution ................................................................................................................................................................6
Customer-managed SaaS application .........................................................................................................................................................6
Release cycles...................................................................................................................................................... 8
Quality management system of SAP Cloud ALM ..................................................................................... 9
Document management .................................................................................................................................10
Risk management .............................................................................................................................................12
Software development operations lifecycle...........................................................................................12
Compliance and security ...............................................................................................................................14
Data protection ........................................................................................................................................................................................................... 15
EU and NS2 access .................................................................................................................................................................................................. 15
Data segregation ........................................................................................................................................................................................................ 15
Data encryption .......................................................................................................................................................................................................... 15
Transfer of customers’ data to SAP ............................................................................................................................................................ 16
Secure development.............................................................................................................................................................................................. 16
IT operations and service...............................................................................................................................17
Incident management ............................................................................................................................................................................................ 17
Operational change management............................................................................................................................................................... 18
Monitoring and alerting management ...................................................................................................................................................... 19
Data backup and restore .................................................................................................................................................................................... 19
Provisioning and deprovisioning .................................................................................................................................................................. 20
Hotfixes .............................................................................................................................................................................................................................. 20
Personnel and contractor training .............................................................................................................20
Glossary ...............................................................................................................................................................21
Contents
Abstract .................................................................................................................................................................. 3
About SAP Cloud ALM ....................................................................................................................................... 3
SAP Cloud ALM in a regulated environment ............................................................................................. 4
Certifications and attestations ...................................................................................................................... 4
Architectural overview ..................................................................................................................................... 5
SAP Cloud ALM as a SaaS solution ................................................................................................................................................................6
Customer-managed SaaS application .........................................................................................................................................................6
Release cycles...................................................................................................................................................... 8
Quality management system of SAP Cloud ALM ..................................................................................... 9
Document management .................................................................................................................................10
Risk management .............................................................................................................................................12
Software development operations lifecycle...........................................................................................12
Compliance and security ...............................................................................................................................14
Data protection ........................................................................................................................................................................................................... 15
EU and NS2 access .................................................................................................................................................................................................. 15
Data segregation ........................................................................................................................................................................................................ 15
Data encryption .......................................................................................................................................................................................................... 15
Transfer of customers’ data to SAP ............................................................................................................................................................ 16
Secure development.............................................................................................................................................................................................. 16
IT operations and service...............................................................................................................................17
Incident management ............................................................................................................................................................................................ 17
Operational change management............................................................................................................................................................... 18
Monitoring and alerting management ...................................................................................................................................................... 19
Data backup and restore .................................................................................................................................................................................... 19
Provisioning and deprovisioning .................................................................................................................................................................. 20
Hotfixes .............................................................................................................................................................................................................................. 20
Personnel and contractor training .............................................................................................................20
Glossary ...............................................................................................................................................................21
3 / 21
Abstract
Life science customers must independently assess the use of SAP Cloud Application Lifecycle
Management (ALM). SAP is a technology provider of back-end business processes designed for
general availability. SAP provides this document for informational purposes only. Any information
outlined in this document may change at any time at SAP's discretion.
This document outlines SAP's efforts to support life science customers implementing SAP Cloud
ALM. Life science customers must comply with sector-specific regulatory requirements, including
laws and recommended practices per industry, or GxP. Industry-related GxP includes good
laboratory practice (GLP) for laboratories, good manufacturing practice (GMP) for manufacturing,
and good clinical practice (GCP) for clinics.
Life science customers are required to adequately assess the security and quality management
services of SAP Cloud ALM. This white paper provides information that life science customers
operating in GxP-regulated security environments may use in their side of audits or inspections.
Cloud computing, including software as a service (SaaS), is a cloud service category. Beyond the
standard GxP complexities, it introduces additional considerations as it becomes an increasingly
vital technical solution across various industry sectors. Customers seek highly scalable, reliable,
and secure solutions. Due to its efficiency and value, cloud computing is steadily receiving a higher
priority.
This white paper outlines practices that life science customers use, including internal quality and
development practices critical for GxP compliance. The following outlines each party's focus on
GxP requirements.
About SAP Cloud ALM
SAP Cloud ALM is an offering for application lifecycle management (ALM). It’s intended for
customers who use multi-cloud and hybrid solutions by SAP.
SAP Cloud ALM helps customers to implement and operate intelligent cloud and hybrid business
solutions.
Customers benefit from an out-of-the-box, native cloud solution, designed as the central entry
point to manage their SAP landscape with content-driven guided implementation and highly
automated operations. The key value of SAP Cloud ALM is that it can help to:
• Experience optimal support experience.
• Minimize effort to adopt and operate the suite of Cloud ERP, complemented by human
experience management (HXM), SAP Intelligent Spend and Business Network (ISBN), and
customer experience (CX).
• Reduce total cost of implementation and end-to-end operation.
• Consolidate all the solutions that help customers to implement SAP solutions faster and
operate them better.
Abstract
Life science customers must independently assess the use of SAP Cloud Application Lifecycle
Management (ALM). SAP is a technology provider of back-end business processes designed for
general availability. SAP provides this document for informational purposes only. Any information
outlined in this document may change at any time at SAP's discretion.
This document outlines SAP's efforts to support life science customers implementing SAP Cloud
ALM. Life science customers must comply with sector-specific regulatory requirements, including
laws and recommended practices per industry, or GxP. Industry-related GxP includes good
laboratory practice (GLP) for laboratories, good manufacturing practice (GMP) for manufacturing,
and good clinical practice (GCP) for clinics.
Life science customers are required to adequately assess the security and quality management
services of SAP Cloud ALM. This white paper provides information that life science customers
operating in GxP-regulated security environments may use in their side of audits or inspections.
Cloud computing, including software as a service (SaaS), is a cloud service category. Beyond the
standard GxP complexities, it introduces additional considerations as it becomes an increasingly
vital technical solution across various industry sectors. Customers seek highly scalable, reliable,
and secure solutions. Due to its efficiency and value, cloud computing is steadily receiving a higher
priority.
This white paper outlines practices that life science customers use, including internal quality and
development practices critical for GxP compliance. The following outlines each party's focus on
GxP requirements.
About SAP Cloud ALM
SAP Cloud ALM is an offering for application lifecycle management (ALM). It’s intended for
customers who use multi-cloud and hybrid solutions by SAP.
SAP Cloud ALM helps customers to implement and operate intelligent cloud and hybrid business
solutions.
Customers benefit from an out-of-the-box, native cloud solution, designed as the central entry
point to manage their SAP landscape with content-driven guided implementation and highly
automated operations. The key value of SAP Cloud ALM is that it can help to:
• Experience optimal support experience.
• Minimize effort to adopt and operate the suite of Cloud ERP, complemented by human
experience management (HXM), SAP Intelligent Spend and Business Network (ISBN), and
customer experience (CX).
• Reduce total cost of implementation and end-to-end operation.
• Consolidate all the solutions that help customers to implement SAP solutions faster and
operate them better.
4 / 21
SAP Cloud ALM is included in customers’ cloud subscriptions that contain SAP Enterprise Support,
cloud edition, and in SAP Enterprise Support.
For more information, see SAP Cloud ALM (SAP Support Portal) and SAP Cloud ALM (SAP Help
Portal).
SAP Cloud ALM in a regulated environment
Life science customers are subject to strict regulatory surveillance. They are required to prepare
themselves to demonstrate their compliance efforts with regulators. Although life science
customers are solely responsible for assuring compliance with GxP laws and practices, SAP
ensures that GxP guidelines are followed to demonstrate minimal viable compliance.
SAP summarizes specific GxP-relevant information for SAP Cloud ALM, as follows:
• Technical and procedural measures and controls
• SAP’s institutional knowledge to develop and operate SAP Cloud ALM in a controlled state
• How to ensure the confidentiality, integrity, and availability of customers' data
Such information enables life science customers to assess their compliance with GxP.
To make this information more accessible, this white paper consolidates and further highlights GxP-
relevant aspects, like the quality management system (QMS) for SAP Cloud ALM, software
development and operations lifecycle (SDOL), and IT operations and services.
Certifications and attestations
SAP Cloud ALM follows the SDOL process given by SAP.
As per corporate requirement for software security, it is mandatory to fulfill the Secure SDOL
requirements.
SAP’s innovation lifecycle and the SDOL is certified in ISO 9001 and ISO 27001. SAP Cloud ALM
follows these processes and controls for its development.
Both certificates are available in the SAP Trust Center (ISO 9001 quality management system and
ISO 27001 information security management system). More information about the SDOL is available
in the document The Secure Software Development Lifecycle at SAP.
SAP Cloud ALM is included in customers’ cloud subscriptions that contain SAP Enterprise Support,
cloud edition, and in SAP Enterprise Support.
For more information, see SAP Cloud ALM (SAP Support Portal) and SAP Cloud ALM (SAP Help
Portal).
SAP Cloud ALM in a regulated environment
Life science customers are subject to strict regulatory surveillance. They are required to prepare
themselves to demonstrate their compliance efforts with regulators. Although life science
customers are solely responsible for assuring compliance with GxP laws and practices, SAP
ensures that GxP guidelines are followed to demonstrate minimal viable compliance.
SAP summarizes specific GxP-relevant information for SAP Cloud ALM, as follows:
• Technical and procedural measures and controls
• SAP’s institutional knowledge to develop and operate SAP Cloud ALM in a controlled state
• How to ensure the confidentiality, integrity, and availability of customers' data
Such information enables life science customers to assess their compliance with GxP.
To make this information more accessible, this white paper consolidates and further highlights GxP-
relevant aspects, like the quality management system (QMS) for SAP Cloud ALM, software
development and operations lifecycle (SDOL), and IT operations and services.
Certifications and attestations
SAP Cloud ALM follows the SDOL process given by SAP.
As per corporate requirement for software security, it is mandatory to fulfill the Secure SDOL
requirements.
SAP’s innovation lifecycle and the SDOL is certified in ISO 9001 and ISO 27001. SAP Cloud ALM
follows these processes and controls for its development.
Both certificates are available in the SAP Trust Center (ISO 9001 quality management system and
ISO 27001 information security management system). More information about the SDOL is available
in the document The Secure Software Development Lifecycle at SAP.
5 / 21
Architectural overview
SAP Cloud ALM is SAP's cloud-based application lifecycle management offering.
There is an automated onboarding process for SAP Cloud ALM that customers can trigger from SAP
for Me. This creates one global account with a subaccount for the SAP Cloud ALM subscription.
SAP Cloud ALM is built on SAP Business Technology Platform (BTP), in a Cloud Foundry
environment. The software stack enables programming services with the Cloud Application
Programming (CAP) Model of SAP BTP.
SAP Cloud ALM currently contains more than 80 microservices, which are implemented in Java.
SAP uses a domain-driven design to model the microservices.
The implementation stack of each microservice.
CAP model. Each SAP Cloud ALM microservice has this high-level integration architecture.
Architectural overview
SAP Cloud ALM is SAP's cloud-based application lifecycle management offering.
There is an automated onboarding process for SAP Cloud ALM that customers can trigger from SAP
for Me. This creates one global account with a subaccount for the SAP Cloud ALM subscription.
SAP Cloud ALM is built on SAP Business Technology Platform (BTP), in a Cloud Foundry
environment. The software stack enables programming services with the Cloud Application
Programming (CAP) Model of SAP BTP.
SAP Cloud ALM currently contains more than 80 microservices, which are implemented in Java.
SAP uses a domain-driven design to model the microservices.
The implementation stack of each microservice.
CAP model. Each SAP Cloud ALM microservice has this high-level integration architecture.