This presentation provides an overview of how to leverage Capgemini's Compliance as a Service Framework to migrate and run GxP Compliant SAP workloads on AWS. CaaS is a jointly developed offer between Capgemini and AWS focused on the Life Sciences sector.

1. Running GxP compliant SAP
workloads on AWS
Jason Hatch

2. 2Copyright © 2017 Capgemini. All Rights Reserved
Compliance as a Service (CaaS) on AWS | April 2017
Capgemini’s partnership with AWS
 Long-standing AWS partner, with a formal relationship since
2008
 Global partnership since 2011
 AWS Premier Consulting Partner since 2012
 AWS Managed Services Provider
 AWS Migration and SAP Competencies Partner
 Capgemini has an AWS Migration Center of Excellence in India
 Capgemini trained and certified up to an additional 1,000
people on AWS in 2016, including 25 people certified at
professional level
 Capgemini and AWS have a lighthouse account initiative
targeting major accounts in core geographies
 Capgemini continues to embed the AWS Cloud Adoption
Framework planning tool into its methodologies
 Capgemini and AWS are continually creating and launching
new, sector-specific managed business services on top of the
AWS Cloud

3. 3Copyright © 2017 Capgemini. All Rights Reserved
Compliance as a Service (CaaS) on AWS | April 2017
A major cloud service provider (CSP), such as AWS,
has better infrastructure capabilities than life
science (LS) companies. This is a core business for
the CSP, allowing it to focus on building better
technology and better controls to ensure infrastructure
stability, reliability, high availability, accessibility to
applications and data from any location that has internet
access, security, and disaster contingency capabilities.
PERFORMANCE
Configuration and qualification of new servers based
on standard server templates is much quicker than
procuring, setting up and qualifying traditional servers.
SPEED
A cloud provides an elastic environment that is sized to
fit the demand at any given time. You pay only for what
you use.
ELASTICITY
Traditional implementation, validation, and record
keeping policies, procedures, and practices may not
be feasible for technologies, such as cloud computing
TRADITIONAL PRACTICES MAY NOT FEASIBLE
NON-COMPLIANCE
The industry is under pressure to reduce cost and
focus on core competencies, while relying more
on third-party vendors to provide IT services
REDUCE COST AND FOCUS ON CORE COMPETENCIES
Multiple regulations and industry standards Impact
the way we implement, validate, and maintain
computerized systems and electronic records
MULTIPLE REGULATIONS
Third-party cloud, software, and IT service providers
may not comply with applicable regulations.
Challenges Benefits of Overcoming Challenges
Regulated Industry Cloud Challenges and Potential Benefits

4. 4Copyright © 2017 Capgemini. All Rights Reserved
Compliance as a Service (CaaS) on AWS | April 2017
Mission –
Life Science companies
must adhere to regulations
and meet expectations set
in related guidances issued
by US FDA and equivalent
international agencies when
moving workloads to the
cloud.
Education and Awareness
Ongoing communications to train on
evolving regulations, guidances, and
industry best practices
Governance
Work with third-party providers that are experienced with
regulated life science companies and meet applicable regulatory
requirements
Established policies, procedures, and practices that support
compliance in a cloud-based environment
Operations
Ensure appropriate implementation, data
migration, validation, qualification, and data
verification activities are performed and
documented during the transition to the
cloud
Comply with policies and procedures and
produce and retain quality records
Perform periodic reviews to check for non-
compliance in internal and external
operations
Key considerations to address the challenges

5. 5Copyright © 2017 Capgemini. All Rights Reserved
Compliance as a Service (CaaS) on AWS | April 2017
CaaS provides Life Sciences organizations with the compliance expertise
to ensure that the computerized GxP system is developed, validated,
and operated appropriately for the intended use of the system.
Transform GxP Compliance from on premise to the Cloud
 Adjusting responsibilities to recognize certain control is
no longer available to the customer and is now with the
Cloud Service Provider (CSP).
 Creating a solid Service Level Agreement (SLA) that
defines the required controls and the responsibilities of
the CSP.
 Defining a new approach to qualifying cloud-based
infrastructure.
 The traditional controls and associated records that apply to an in-house data center are not feasible in
a public cloud environment
 The focus of validation must shift from the traditional artifacts that demonstrated how a dedicated
platform was qualified to well-planned and documented risk identification and risk mitigation strategies
 The main areas that need to be considered are:
 Revising policies and procedures to align with the new
processes and responsibilities.
 Qualifying the new infrastructure on the cloud.
 Qualifying / validating applications that migrated to the
cloud.
 Data migration qualification / verification

6. 6Copyright © 2017 Capgemini. All Rights Reserved
Compliance as a Service (CaaS) on AWS | April 2017
GxP Compliance in the Cloud: A shared responsibility to ensure compliance
• Infrastructure control, security,
monitoring, performance and
provisioning
• Data protection and redundancy
customized to client needs.
• Regional application and data
restrictions, as required
• Cloud management tools
• Client cloud interface tools and 24/7
technical support
• Network configuration management,
access control, data security tools and
encryption
• Private/dedicated connections, as
needed
• Definition, enforcement and
management of use access policies
• Short and long term compliance
strategy and plan
• Updates to standard AWS controls to
meet quality, compliance, and
business objectives
• Suggested improvements to validation
process for cloud
• Complete CSV services
• Updated policies and SLC/CSV-related
procedures for cloud
• Templates for server design and
qualification
• Life Sciences SMEs
• Adherence to compliant system life
cycle
• Compliance objectives and validation
master plan
• Compliance objectives and requirements
Functional and technical requirements
• SLAs with AWS
• Identification of compliance gaps between
policies and procedures and cloud-based
environment
• Validation approach
• Application and data migration strategy
• Stakeholder training
AWS Capgemini Client
Capgemini
AWS Client

7. 7Copyright © 2017 Capgemini. All Rights Reserved
Compliance as a Service (CaaS) on AWS | April 2017
Capgemini’s Compliance as a Service (CaaS) on AWS
Our CaaS offer supports the initial set-up and ongoing activities needed to ensure a
validated, industry-compliant cloud environment for running life science workloads.
Core
Competencies
Strategy Assessment
Cloud
Compliance
Other
Services
 Testing
 Requirements Mgmt.
 Risk Assessment and
Mitigation
 Vendor Assessment
 Infrastructure qualification
 Validation of applications
 Compliance assessments
 Change management
 Risk management
 Lean Compliance
 Compliance in the Cloud
 Training & Coaching
CaaS Cloud
Offerings
 CaaS for on-going AWS Cloud
Compliance Needs
 AWS Cloud for LS Training Package
.PPT deck that can be used to train all audiences
within the organization Periodic Reviews and Audits conducted by industry
experts specializing in U.S.-based regulations
Validation accelerators (e.g., templates, checklist, test plans, reports)
Quality Coaching / Compliance Monitoring / Advisory Services

8. 8Copyright © 2017 Capgemini. All Rights Reserved
Compliance as a Service (CaaS) on AWS | April 2017
Three Use Cases for Running GxP Compliant Workloads on AWS
 Homogenous Migration
 Both operating system and database are the
same in Source and Target System
 Automated Migration performed with block level
copy processes
 Rebuild/Clone of Common Usage Pattern (App
Server, Web Server)
 Replication and failover (HANA
 Heterogeneous System Migration
 At least one of the following is changed during
the copy:
 Operating system
 Database system
 HANA Migration with DMO
 New System Builds with LifeScience
Path
Syste
m
Copy
OS 1 DB 1
Source Server
OS 1
OS 1 DB 1
Target Server
OS 1
Source Server
Syste
m
Migrati
on
OS 1 DB 1 OS 1 DB 1
Target Server
Syste
m
Migrati
on
OS 1 DB 1 OS 1 DB 2

9. 9Copyright © 2017 Capgemini. All Rights Reserved
Compliance as a Service (CaaS) on AWS | April 2017
Migration Roadmap with Validation
Plan
Plan the
migration Waves
Design
Design the applications
Target Architecture
Migration Factory
Setup the Migration Factory
and the required toolset
Provisioning
Setup the Cloud infrastructure
required middleware
Outcome
Deployment
Deploy the new application
and switch service
Security
Validate the full security
context and data classification
Testing
Test the environment and
tooling integration
Computer
System Validation

10. 10Copyright © 2017 Capgemini. All Rights Reserved
Compliance as a Service (CaaS) on AWS | April 2017
Our LifeSciencesPath solution for SAP has Validation built into the
deployment Model

11. 11Copyright © 2017 Capgemini. All Rights Reserved
Compliance as a Service (CaaS) on AWS | April 2017
Contact us
Name: Jason Hatch
Email: Jason.Hatch@capgemini.com
North American Solution Lead
Name: Kaushik De
Email: kaushik.de@capgemini.com
Cloud GTM Lead
Image

12. About Capgemini
With more than 190,000 people, Capgemini is present in over 40 countries
and celebrates its 50th Anniversary year in 2017. A global leader in
consulting, technology and outsourcing services, the Group reported 2016
global revenues of EUR 12.5 billion. Together with its clients, Capgemini
creates and delivers business, technology and digital solutions that fit their
needs, enabling them to achieve innovation and competitiveness. A deeply
multicultural organization, Capgemini has developed its own way of working,
the Collaborative Business Experience™, and draws on Rightshore®, its
worldwide delivery model.
www.capgemini.com
The information contained in this presentation is proprietary. © 2017 Capgemini. All rights reserved. Rightshore® is a trademark belonging to Capgemini.