life sciences and the cloud - veeva systems · 2015-09-16 · life sciences and the cloud: a...

Life Sciences and the

Cloud A DOCULABS WHITE PAPER

Life Sciences and the Cloud: A Doculabs White Paper

©2015 Doculabs, Inc., 200 West Monroe Street, Suite 2050, Chicago, IL 60606, (312) 433-7793, [email protected].

Reproduction in whole or in part without written permission is prohibited. Doculabs is a registered trademark. All other

vendor and product names are assumed to be trade and service marks of their respective companies.

2

Many organizations in the life sciences have reached a turning

point with respect to their document management systems.

Faced with a need to replace aging systems and a dynamic

business environment characterized by significant unknowns,

many life sciences organizations are now considering the use of

cloud solutions to meet their complex requirements for

enterprise content management (ECM).

Cloud solutions have matured greatly in recent years, as one

result of their adoption by major organizations in other

industries. Today’s cloud-based ECM solutions are capable of

meeting many of the complex business and compliance

requirements presented by the life sciences industry.

This white paper makes the case for why cloud-based ECM

deserves serious consideration by even the largest

organizations in the life sciences industry. It then describes

Doculabs’ recommended approach to evaluating cloud ECM

platforms and for identifying the applications that present the

best opportunities for cloud-based ECM in the life sciences.


3

The Shared Drive Problem

Introduction

Most life sciences organizations are at a turning point with their

document management systems, for a number of reasons.

Many of these organizations have been “all in” on traditional enterprise

content management (ECM) platforms. But these traditional ECM

platforms have become increasingly difficult to maintain because of their

age (7 to 10 years or more), or because they lack the ECM capabilities

available to organizations in other industries, or both.

Second, in 2010-2011, many life sciences organizations considered

moving to Microsoft SharePoint (or to SharePoint, augmented with third-

party add-ons), but, because of SharePoint’s lack of advanced document

management functionality and the vendor risk presented by the size and

stability of Microsoft independent software vendors (ISVs), these

organizations overwhelmingly decided to remain on their legacy solutions,

thereby deepening their commitment to their aging, outdated platforms.

Third, the organizational model for drug development has shifted rapidly

in the last 5 years—from primarily in house throughout the product life

cycle, to one that’s heavily outsourced, even for traditionally “core”

capabilities such as research and development and clinical operations.

This new model presents demands for unprecedented levels of

collaboration and information-sharing, on top of the stringent regulatory

requirements the industry has always faced.

Finally, add to all the forgoing considerations the very real fact that any

platform decision in the life sciences is likely to represent a 10-year

commitment, and the urgency of the inflection point most of these

organizations now face is not difficult to imagine.

This is the backdrop against which we need to understand cloud ECM

solutions in the life sciences: intense pressure to replace aging systems,

previous experience at having “failed” to find a replacement in

SharePoint, a dynamic business environment characterized by significant

unknowns, and the long-term nature of any platform decisions. All of

which makes the use of cloud solutions—which claim to offer ease of use,

low/no IT overhead, and rapid deployment, paired with security and

compliance on par with traditional solutions—a seemingly too-good-to-be-

true option for many life sciences organizations.

Acknowledgements

Doculabs gratefully

acknowledges the following

individuals, who reviewed draft

versions of this white paper

and provided valuable industry

perspective and insight:

Scott Erskine, AbbVie, Inc.

Steve Shimek, Allergan plc

Bill Leslie, Covance, Inc.

Brian Goldinger, Eli Lilly

and Company


4

And while no technology solution, cloud or otherwise, is a silver bullet, it’s

important to realize that cloud solutions have matured greatly in the past

few years, a fact reflected in the increasing pace of adoption of cloud

ECM solutions among Fortune 500 organizations in other industries. And

it’s Doculabs opinion that cloud solutions today meet many of the core

life sciences business and compliance requirements and are worth

serious consideration by even the largest organizations in the industry, an

opinion borne out by the recent adoption of cloud ECM by some of these

firms. But despite that, as with any software, whether on premises or off,

taking the correct approach makes all the difference in the ultimate

success of the project.

With that in mind, this white paper presents Doculabs’ approach to

evaluating cloud ECM platforms in the life sciences. It’s an approach that

we’ve used with more than a hundred clients in the last 20 years, and it

can add value even when considering on-premises solutions, because the

fundamental issues an organization needs to address to find the right

solution are substantially the same in either case.


5

The Permutations of “Cloud”

Before diving in to the challenge of cloud ECM for the life sciences, let’s

clarify what is typically meant by “cloud ECM”.

First, understand that “cloud” can refer to cloud-based applications (also

known as software as a service, or SaaS), or to cloud-based storage, or to

both—all running off premises; SaaS refers to applications running off

premises, whether cloud or otherwise. Beyond this basic definition, an

organization considering cloud ECM may choose to use the cloud for

content storage, keeping its ECM applications on premises; or to use the

cloud for ECM applications, keeping the associated content stored on

premises; or to put both the ECM storage and ECM applications in the

cloud.

The following schematic illustrates these three “flavors” of cloud ECM:

Figure 1: The Permutations of Cloud ECM

Beyond these basics, there are more complex topics, like hybrid models

(i.e. having some content in the cloud, some on premises), single versus

multi-tenant cloud environments, private vs. public cloud environments,

etc. And while these are important to consider once you’ve made a

decision to adopt cloud ECM, for purposes of defining the key challenges

life sciences firms face when considering the cloud and how they can

address them, we can put them to the side.


6

Why Is the Cloud Such an Issue for the Life

Sciences?

The question of cloud technologies is not an issue peculiar to the life

sciences. Over the last 10 years, organizations across all industries have

expressed reservations about moving to cloud technologies, and these

reservations are founded on a range of risks, nearly all of which are now

more perceived than real.

First, there are perceived risks around information integrity: i.e. concerns

that moving to cloud or to software as a service (SaaS) will entail a

loss of control over data, applications, processes, and, most

important, a reduction in security. Note that these are risks that apply

to varying degrees to all three “flavors” of cloud.

Then, there’s vendor risk: the risks associated with cloud and SaaS

providers themselves—i.e. that they are less established, smaller, and

potentially less reliable than incumbent vendors in the ECM space.

There are also the risks of organizational readiness: those risks that stem

from the fact that most organizations do not have best practices and

mature governance in place to ensure successful deployment of on

premises ECM technology, let alone cloud- or SaaS-based ECM.

Finally, there’s exit risk: i.e. concerns that once content or processes

are moved to the cloud, it will be difficult or impossible either to move

them to another provider or to pull them back in house.

If we look more closely at these perceived risks, it turns out that, with the

exception of exit risk, they are either no longer true (although they were in

the past), or proven approaches are now available to help mitigate them.

Information Integrity

Concerns over information integrity are rightly topmost for life sciences

organizations. But while these areas initially represented challenges for

the cloud, Doculabs contends that the leading cloud solutions now

present advantages over on-premises solutions in all of these areas.

In terms of delivering core document management capabilities required

by regulated businesses, the leading cloud providers allow firms to:

Secure, monitor, back up, replicate, and store data on the petabyte

scale

Leverage third-party automated, repeatable processes and protocols

Eliminate most risk of human error, accidental spoliation, hardware

failure, data breach, and natural disaster

Preserve data on Write Once, Read Many (WORM) storage

Provide datacenter-class data replication, with data stored in multiple

locations


7

A Word about FDA Validation

The need for FDA validation of computer systems adds a further layer of complexity

to the evaluation of cloud ECM for life sciences organizations. And while the topic

could on its own be the subject of an entire white paper, from the standpoint of

cloud ECM solutions, there are a few things to keep in mind.

Validation for computer systems (i.e. software) is defined by the Food and Drug

Administration (FDA) as “confirmation by examination and provision of objective

evidence that software specifications conform to user needs and intended uses,

and that the particular requirements implemented through software can be

consistently fulfilled.” The burden this definition places on life sciences

organizations can be substantially met through the implementation of well-

established IT governance best practices frameworks such as ITIL, CMM, or ISO/IEC

20000, which help IT departments control their processes—from requirements-

gathering and system design, through software development and infrastructure

builds, QA and testing, and release into production environments, to ongoing

monitoring and remediation of production issues.

What’s required for FDA validation, over and above such industry-agnostic IT

governance frameworks, is personnel qualification, which the FDA defines as

training “conducted by qualified individuals on a continuing basis and with

sufficient frequency to assure that employees remain familiar with [current GxP]

requirements applicable to them.” And while the FDA leaves the specifics of

personnel qualification (the “how”) up to the discretion of individual firms (and

while the “how” will look different not only from firm to firm, but even within firms

depending on the process and function in question), at a minimum, it requires 1)

teaching employees which GxP requirements apply to their job function; 2) what

employees need to do to meet them; 3) ongoing checking of employees’ retention

of these concepts; and 4) remediation, if needed, with a full audit trail documenting

each of the above.

Thus, when evaluating cloud ECM, you will need to determine whether your provider

adheres to an industry-standard IT governance framework (most do) and can

provide full documentation of the framework and their adherence so you can

incorporate it into your FDA computer system validation process. In addition, you’ll

need to determine whether you’ll be able to accomplish personnel qualification with

a given provider—e.g. will you have access to all resources working on your software

to train them and monitor their understanding and compliance? Be aware that this

can get complicated, because many SaaS providers outsource their data centers to

third parties, and FDA validation of their SaaS product will require personnel

qualification of the resources in that outsourced data center—yet you may not have

access to them (or even know that your SaaS provider outsources its data center).

http://www.fda.gov/RegulatoryInformation/Guidances/ucm085281.htm

http://www.fda.gov/RegulatoryInformation/Guidances/ucm085281.htm

http://www.accessdata.fda.gov/scripts/cdrh/cfdocs/cfcfr/CFRSearch.cfm?fr=211.25


8

In terms of security and data protection, the leading cloud providers:

Typically dedicate more resources for security than in house

operations

Have data centers that are audited for Statement on Standards for

Attestation Engagements (SSAE) No. 16 and Service Organization

Control (SOC) 2 compliance

Can provide reporting on policies, communications, procedures, and

monitoring

Offer high physical security, 24/7 surveillance, biometric access, and

anti-intrusion controls

Vendor Risk

It’s true that the majority of entrants in this space are still nascent and

not ready to support the rigorous ECM requirements that life sciences

firms present. But in recent years a small number of solution providers

have matured, and we believe their solutions have now proven capable of

handling the requirements of the life sciences industry for both internal-

and external-facing applications, as well as for controlled and

uncontrolled documents.

The standard questions to ask on-premises software solution providers to

evaluate vendor risk are the same ones you want to ask providers of

cloud or SaaS solutions: ask about company history, company financial

data, the most recent annual report; then for information on number of

people employed, number of locations, and an overview of the provider’s

management organization and organization structure. You should also

want to ask about the product roadmap, i.e. where the provider plans on

taking the product, capability-wise, over the next 12, 24, and 36 months.

And then ask for references, specific to life sciences, and how long those

references have been clients.

What you’re trying to get at is not only vendor stability, but quality of

service and relevant experience. For example, what are the service level

agreements (SLAs) in place regarding disaster recovery and business

continuity? I.e. how quickly will they commit to getting your cloud ECM

system back on line with all your data in place after a disruption? What

recourse do you have if they fail to meet the SLAs (and what can you do

to keep your business running in the meantime)? Of particular concern to

the life sciences is the question of data ownership, i.e. how will the cloud

ECM provider handle your data? If, for example, another of your

provider’s clients comes under investigation by the Department of

Justice, will your data be included in the investigation simply because you

are both customers of the cloud ECM solution? What recourse will you

have to keep your data out of the other client’s dragnet, so that you can

remain up and running?


9

Organizational Readiness

Rather than simply saying that most life sciences organizations lack the

organizational readiness to implement ECM effectively, it’s useful to

break the problem down to better understand why this is the case and to

ultimately chart a course to improved organizational readiness (and,

consequently, to more effective ECM). By and large, two problems cause

life sciences firms to struggle when implementing ECM, and these

problems are only exacerbated by cloud ECM.

The first is the optimization problem that ECM in general poses for life sciences

firms. An optimization problem is a concept from mathematics and

engineering that turns out to be very useful in the context of information

management. Simply put, you’ve got an optimization problem when you

have two or more objectives you want to achieve, but you can’t achieve

them all because they conflict with each other in some way—as, for

example, the objectives of providing both wider document-sharing

capabilities and tighter document security, both of which are critical

requirements for life sciences.

Cloud-based ECM trends such as mobility and collaboration pose several

such optimization problems, but most of them boil up to one: How do we

get the benefits of the cloud, while also controlling the risks and costs?

The second problem is what we might call the roadmap problem: How do we roll

out technologies without hurting ourselves, and how do we know we’re

taking the right steps in the right order and doing it all at the right pace?

Although there is no silver bullet to solve these two problems, Doculabs

has developed an approach for how to plan and roll out new technologies

that addresses both the optimization and the roadmap problems—an

approach we’ve used successfully for more than 20 years with content

management and related technologies. And while cloud-based ECM

seems to be new, organizations have collectively been doing off-premises

ECM, or outsourced ECM, in some form since at least the 1990s, even

large-scale, production-hosted imaging, workflow, archiving, and remote

access—which means there are best and worst practices that can be

applied. It’s also the case that cloud-based ECM has now been around for

a few years and organizations are learning what works (and what doesn’t)

at a faster rate than in the 1990s and early 2000s.

Given this, Doculabs believes life sciences organizations can be very

successful in deploying cloud-based ECM by incorporating known best

practices to address the following issues:

The organization’s obligations and requirements for security and

compliance in the cloud

Prioritization of applications that are transitioned to the cloud to

ensure positive near-term impact, without potentially impacting high-

risk operations

The requirements and opportunities for managing controlled versus

uncontrolled documentation, both internal and external to the

organization


10

Exit Risk

This is certainly the most real risk of the four perceived risks of moving to

the cloud, mainly because cloud ECM hasn’t been around long enough to

know what pulling back data to switch providers or to return to on-

premises is going to look like. At Doculabs, we encourage our clients to

look to models demonstrated by two other industries to gain perspective

on what “breaking up” with their cloud ECM provider might look like.

The first model is exemplified by providers of off-site paper document

storage, including providers such as Iron Mountain, Recall, etc. These

service providers typically charge ten times more to move a box of

documents permanently to the site of another storage provider than to

continue to store that box of documents—a model that typically makes

switching costs prohibitively high in all but the most extreme

circumstances. If this model is the future for cloud ECM, then life

sciences organizations are right to hold off on adopting cloud ECM.

The second model is exemplified by the power utility market. Once a

monopoly, today it’s become much more open, with middle-man brokers

providing consumers a broader range of choice of how to buy their

energy, with low to no switching costs (and correspondingly lower prices).

If this model is the future for cloud ECM, life sciences organizations

should be less hesitant to move to cloud ECM.

Doculabs believes that the latter is the going to be the ultimate future of

cloud ECM, because no matter how lucrative those high switching costs

may be for service providers in the short term, they rely on everyone

playing the game: As soon as one provider lowers the switching costs for

buyers, the rest will have to follow suit just to remain competitive. We’ve

witnessed this dramatic shift most recently in the phone service market,

with Sprint offering to zero-out all the typical switching costs for phone

plans (contract termination penalty and cost of new phone) and all the

big telcos joining suit (however reluctantly).

Whether the shift in the cloud ECM market happens through a single

player forcing everyone’s hand or a collective realization that lower

switching costs benefit everyone in the long run, in the next 3 years, the

exit risk of cloud ECM will be as much a matter of perception as the other

three risks we’re looking at in this white paper.


11

How to Take the First Steps toward the Cloud

For organizations considering the cloud as part of an upgrade or

replacement of their major applications, we recommend the following

four-step approach. The end result is to prioritize the use of cloud

technologies in lower-risk areas, subsequently attacking the higher-risk

areas as the organization’s use of cloud technologies matures.

1. Identify business objectives and opportunities.

As you begin to identify opportunities for cloud ECM, look to your

organization’s defined set of corporate objectives. In life sciences, these

are likely to be items such as speeding time to market in rest of world,

improving operational excellence and throughput in quality and

manufacturing, or improving collaboration with and oversight of contract

research organizations (CROs).

2. Build a focused assessment of your organization’s current state for ECM.

Most life sciences organizations already have a mix of legacy ECM tools,

Microsoft SharePoint, and niche providers for core capabilities such as

research and development, electronic trial master file (eTMF)

submissions, and quality. It’s important to develop as complete an

understanding as possible of these existing ECM solutions to ground your

consideration of whether to move to cloud-based ECM.

But just because you’re considering cloud ECM technology, it’s important

not to fall into the trap of thinking ECM is primarily about technology,

because it’s not. At most, technology is one-third of the problem. Just as

important are the people who use the system, the processes (what the

people do with the system), and the content (what’s being managed with

the system). So be sure to build a strong IT-business partnership—not just

for the duration of the technology selection, but for the implementation

and long-term use of the system.

So when you assess your ECM current state, make sure you take all four

criteria (technology, people, process, content) into account. The

methodology for doing this is as follows:

First, inventory the important systems and identify the business

processes, as well as the categories of business processes (controlled

versus uncontrolled, internal- versus external-facing) that they support.

Consider in particular how individual business processes contribute to

the achievement of the corporate objectives you defined in Step 1

(above).

Then interview the various user groups (the people) to identify their

issues with the current state—i.e. where the technology capabilities fall

short in supporting the business processes and where, in particular,

users identify needs for information access via devices such as smart

phones or tablets.


12

Next, consider the content. Map the important systems and business

process categories and issues against a matrix that distinguishes

between controlled and uncontrolled documents and the enterprise

needs from both the internal and external perspectives. For example, for

Research and Development processes, map out the tools currently being

used to manage controlled and uncontrolled document categories, for

access by both internal and external users, as shown in the following

figure:

Figure 2: Sample Matrix, Mapping the Current State

For each quadrant, consider the following: the division of labor between

IT and users, the capabilities currently used, the configurations, the types

of devices (such as smart phones, tablets, wearables), and the types of

users and user scenarios.


13

3. Identify your cloud-based ECM opportunities.

Just as every business process wasn’t a “fit” for on-premises ECM, not

every process will make sense for cloud ECM. Review the processes

you’ve plotted against the matrix and use the following criteria to identify

potential candidates to move to the cloud:

Low to high value and risk

Internal versus external (participation)

Sharing versus not sharing (participation)

Low to high with respect to process management and system

integration requirements

Once you’ve made your list of candidate processes, prioritize them, based

on their respective abilities to support the business objectives you

identified back in Step 1.

At this point, you have the information you need to make a go/no-go

decision on cloud ECM, which basically comes down to this question: Are

the cloud-based ECM opportunities you’ve identified worth the cost and

effort of moving off current systems and onto cloud-based ECM? At this

point, we aren’t talking about a hard-dollar cost benefit analysis, but more

of a directional, gut-feel exercise—which, if it’s positive, will lead to more

detailed analysis and consideration down the road.

4. Define your vision for the cloud.

Assuming the opportunities you’ve identified justify a move to cloud-

based ECM, the next step is to create a future state vision of where you’d

like to be in 3 to 5 years, prioritized based on the criteria from Step 3.

For example, a low-value and low-risk area for the current state above

would be to expand the use of cloud document management for

uncontrolled documents internally, i.e. to the participation of internal

users only. Your next step might be to identify opportunities for external

participation on uncontrolled documents—for example, public relations

materials created in conjunction with external community groups or

charities. Next, you might move to opportunities for sharing controlled

documents externally—for example, the exchange of trial documentation

with global CROs. Finally, you could move to opportunities for sharing

controlled documents internally—for example, between U.S. regulatory

operations and affiliates as part of the drug submission process.


14

The future state version of your matrix for Research and Development

might look something like this:

Figure 3: Sample Matrix, Mapping the Future State

At this point, with your vision for cloud ECM in place, you can begin to

flesh out the projects needed to achieve that vision and to lay them

against a timeline into a program roadmap that will guide your

organization in its efforts.


15

The Final Word

If other highly regulated, document-intensive industries are any

indication, the adoption of cloud and SaaS ECM will be widespread in the

life sciences by 2020. Fortune 500 organizations across financial

services, insurance, energy, high-tech manufacturing, and other

industries are well down the road to making use of cloud and SaaS ECM

technology and capabilities, not to mention some of the largest life

sciences organizations which have made the move. And, to reiterate a

point made earlier in this white paper, some core cloud and SaaS

technology and capabilities aren’t new; they’ve been in use for 15 to 20

years (or more).

While life sciences firms have been rightly conservative about cloud and

SaaS ECM, it’s time they relinquished their characteristic “wait-and-see”

stance, in favor of a “figure-it-out” perspective. The question is no longer

“Could we go to the cloud,” but “Should we go to the cloud, and, if so,

how?” Those firms that do include cloud-based ECM solutions as part of

their 2020 roadmaps will begin the next decade with significant strategic

and tactical advantages over their slower-moving peers. Those that

continue to sit on the sidelines, however, will find themselves having to

play rapid (and costly) catch-up, only to be late entrants who’ve lost out

on the benefits of earlier entry.

While there is no technology silver bullet (cloud or otherwise) that

completely addresses the ECM needs of life sciences organizations, it’s

increasingly clear that there are enormous opportunities for these

companies to rationalize their existing ECM capabilities on fewer systems,

while also taking advantage of cloud technologies. The information and

recommendations in this white paper are a good starting point as you

weigh these opportunities and consider the steps to take toward cloud

and SaaS ECM.

About Doculabs

Doculabs, Inc., is a strategy consulting firm. Our clients rely on us to help

them improve the way they manage information. Our services include

development of strategic roadmaps and business cases, program

management design, and content migration assistance.

Our consultants are experts in helping clients manage the wide range of

business content, including Office documents, web content, email,

customer communications, and corporate records, to help organizations

improve operations, lower costs, increase revenue, and reduce risk.

Doculabs has in-depth expertise in information management across a

range of industries, including life sciences, manufacturing, financial

services, insurance, and energy. Our recommendations are based on our

experience and our empirical data from hundreds of consulting

engagements over more than 20 years. As trusted advisors that do not

sell technology solutions, we provide services and recommendations that

are completely objective.

In our 20-year history, Doculabs has helped many life sciences

organizations manage key information to improve their processes and

their decisions and ensure effective regulatory compliance.

For more information about Doculabs, or for further information on the

business problems discussed in this white paper, visit the web site

atwww.doculabs.com or call (312) 433-7793.

life sciences and the cloud - veeva systems · 2015-09-16 · life sciences and the cloud: a...

Documents