You’ve moved, or you’re moving, GxP applications to the cloud. The question that decides every cloud validation is simple: who validates what? This is the model that answers it across IaaS, PaaS and SaaS, so you validate what you control and inherit what the provider proves.
The cloud service model sets the line between what you validate and what you inherit. Qualify the provider once and reuse that evidence across applications, then concentrate your own testing where you genuinely own the risk: intended use, configuration, access and the integrity of your data. It is the same risk-based thinking as DRIVE, pointed at the cloud: scale testing to risk, leverage qualified evidence, and manage provider-driven change deliberately so a silent update is never your first surprise in an inspection.
Once you know where the line sits, write down each side of it. Qualify the provider once and inherit the layers it proves; spend your own testing on the layers that carry the product and patient risk.
| You always validate | You inherit, after qualifying the provider |
|---|---|
| Intended use and process fit | Physical data centres and hardware |
| Configuration and access control | Virtualisation, compute and network |
| Data integrity, ALCOA+ across the record | Platform and base OS patching (PaaS, SaaS) |
| Provider oversight and change monitoring | Application code the vendor builds (SaaS) |
On a comparable programme, more than 2,000 servers moved to a GxP-qualified cloud in six months, with provider qualification inherited across applications and Part 11 and Annex 11 controls held throughout. The speed came from not re-validating what the provider had already proven; the assurance came from writing down exactly where that line sat.