FDA Watch . . .Part 2: Network Standard Operating Procedures

By Eric M. Stroud
GMPNetworks, Syvax Inc.

In Part 1 of this article, we described the purpose of the Policy document and its role in setting network qualification into practice in an organization. But, the policy alone does not give complete evidence of control - Standard Operating Procedures (SOPs) are used as one way (a very good way!) to provide this evidence.

SOPs in the network realm can exist on two levels: The organization, and the devices.

Organization SOPs are often written for a regional center or a site, in order to align quality practices in that organization (consistency). These SOPs typically include:

Change Control - The process for managing changes to the network;
Monitoring - The workflow for monitoring network conditions and health, reporting metrics, and resolving problems;
Documentation - A workflow for new network documentation, edits, approvals, and how they are managed (electronically, hardcopy, or both);
Testing - The process of identifying, applying, and testing patches, upgrades, and hardware changes on a simulated network before deployment;
Periodic Review - The process of inspecting diagrams, documents, change controls, etc., over a period of time to ensure continued compliance; and,
Disaster Recovery - The activities to be followed during a disaster recovery exercise.

These SOPs should be prepared by the network organization. The approvals of these SOPs must have a quality assurance (QA) signatory, preferably, a QA role in the network organization. The training process on these SOPs (documenting, refreshers), would be the same as your other SOP processes. An admin or quality coordinator should be watching for new hires, and refresher training dates, new SOPs, and revisions to SOPs. Remember that last point - If you revise and re-issue the SOP, you need to retrain on it.

A common question is "why not just include the network in the scope of the site's regular change control". As long as there is a quality assurance role in the network's organization, it is a good practice for the network operations groups to maintain their own change control process. It is often streamlined, or may be an electronic tracking system, whereas a site's change control process may involve the use of review boards, or simply just more time for review. Network operations demand an efficient review and documentation process, sometimes, in the matter of hours, or during maintenance windows.

Data network devices warrant their own operational procedures once they are deployed. Device/Functional SOPs include: Startup/Shutdown - The specific process for the startup and shutdown of a network device Firmware Upgrades - Often model or series-specific, the process of applying and verifying an upgrade to a network device

The list of possibilities is endless here. You may wish to proceduralize the cascading of switches, 3rd party vendor management (fiber, long lines, etc.), and so on. The best practice in any SOP writing is to be concise and accurate. Always keep in mind the fast-paced nature of the business and the consequences of network outages and downtime, and the effects a procedure might have when resolving those problems.

Eric is an FDA Validation expert for GMPNetworks/Syvax Inc. Eric has over ten years experience with FDA validation for the pharmaceutical industry and has been specializing in validating IT data networks.
http://www.gmpnetworks.com