GMP Risks for Microsoft Windows Server 2008 and Windows 7 Operating Systems
OS updates can significantly affect the operation of validated systems and can impact their validated status if not carefully planned and executed.
One of the impacts of the new year is that Microsoft is no longer supporting Windows 7 and Windows Server 2008 operating systems. As such, if these systems are being used for validated systems and they have not been updated, that update should be in process by now to ensure the security and reliability of those systems.
Upgrading the operating system can present challenges with regard to managing the existing data and coding these system contain as well as the practical impact of gaining access to the system and the associated down time for making the changes and performing any testing required.
Whether you are using these operating systems for facility monitoring, medical device operating systems, or GMP databases, upgrading the operating system will help keep you in compliance.
Some of the keys to the process of upgrading include the following:
- A pre-change complete system backup with a proven restore procedure
- For critical systems, an operational redundant system…just in case
- Assessing the current risk of your system and to interactions between the validated system and other systems/software
- Understanding that the upgrade includes risks of downtime, loss of data, loss of capabilities you may now depend on, and may extend past your original expectations
- Assessing the potential impact of an upgrade to the OS
- Managing and documenting the transition to ensure that continuity is maintained in functionality and access to historical data
- Applying the concept of impact driven effort to ensure a good balance of testing and documentation while controlling resource expenditures on the process
Upgrading the operating system is a non-trivial task and is likely to affect the operation of your validated system in some way that will require some down time, additional configuration and likely some updates to your written operational procedures.
Depending on the application and the “size” of the upgrade, this can be a rather trivial upgrade or may have a large impact on legacy code and/or data which could impact 21CFR11 and/or Annex 11 compliance. You may need to manage legacy data to preserve its readability if it will not be readable with the new system.
If you have a GMP system that requires upgrading and are interested in additional information, we at Sebald Consulting would be happy to help with that transition!