So, your firm has been trying to determine how to leverage a cloud-based solution for enterprise content management (ECM), thinking about what you need to do beforehand, and so on. In a complex and heavily regulated industry where information is so vital, like the life sciences industry, there are numerous concerns when implementing a cloud-based ECM solution and migrating your existing content. It pays to take the time to do this right and determine whether this is the right step to take including obtaining the necessary buy-in from your Legal, Quality, and Regulatory stakeholders.
If your life sciences firm is planning on shifting to a cloud-based ECM solution to obtain the benefits of cloud (e.g., lower total cost of ownership, scalability to increase capacity and performance globally as your usage changes over time), the following considerations should help you and your team determine the best course of action and most appropriate cloud environments for your precious data.
1. Determine Any Obstacles to a Cloud ECM Implementations
There are many obstacles for firms thinking about implementing cloud ECM solutions. These include:
- Obtaining buy-in from Legal, Quality, and Regulatory stakeholders / company policies or regulations that prevent the use of cloud solutions or limit where the data can be located
- Ensuring the system is maintained in a validated state as upgrades are pushed down
- Ensuring the vendor is compliant with your interpretation of applicable regulations
- Providing a transparent user experience across your cloud and on-premise applications and any content archives for static or inactive content
- Adherence to retention rules
- Backup of critical data
- Fragmentation of the content systems in place
- Integration with access portals and other on-premise applications behind your firewall
- Management of content lifecycles that extend to external users or involve system integrations
- Searching and eDiscovery across various sources of content.
At the moment, a sizeable number of organizations in other industries are using cloud applications for records management purposes. Many life sciences firms are now considering leveraging cloud software-as-a-service (SaaS) applications for ECM and records management in regulated areas as success has been demonstrated in other industries and non-regulated areas. Appraisal programs, big data, contract management, expense claim scanning, learning management, and recruitment programs are also becoming much more common in the cloud. The landscape doesn’t include a great many firms migrating all their content to the cloud, though, particularly in fields like life sciences, where top-secret data is critical to the firm’s ongoing operations.
2. Assess Organizational Security Concerns
When selecting and implementing a cloud-based ECM solution, it’s important to understand how the cloud ECM solution vendor will ensure your assets are secure in a multi-tenant cloud environment. Additionally, in the life sciences industry with the current trend of partnering with service providers to provide key business functions (e.g., contract research / lab / manufacturing organizations), managing access to the information within the ECM solution will also be critical. Each of these service providers should only be able to work with the content that relates to their specific contract.
3. Ensure Information Architecture and Governance are in Place
Once you have selected a cloud-based ECM solution, you will want to address weaknesses in your information governance policies and define your information architecture before implementing your new ECM solution and migrating content from an onsite system to the cloud. Additionally, you will want to map your information architecture to industry standards such as the DIA Reference Models to facilitate greater interoperability between your business partners, health authorities, and service providers.
4. Managing Risk and Compliance
Work with your stakeholders to decide which content is suitable to be managed in the cloud ECM system and when based on risk, company policies, legal and regulatory requirements. Depending on the criticality and sensitivity of the content and level of user comfort with cloud-based solutions, some user groups may decide to wait until later project phases to begin creating and moving content to the new cloud solution. We recommend your initial release or pilot focus on lower risk content and business areas to demonstrate success before expanding your user base to include more critical or regulated areas. Of course, some content may not be suitable for certain cloud environments given your company policies, legal and regulatory requirements.
In the life sciences industry, it would be unwise to manage critical research data and content in a multi-tenant cloud environment without first ensuring the essential requirements around security, compliance, performance, backup and disaster recovery are met by the vendor and requiring the vendor to pass a vendor audit. Just as you would do for any service provider in the life sciences regulated space, we recommend periodic announced and unannounced audits of cloud ECM solution provider practices and data centers to ensure the system is being maintained in a compliant fashion in line with your company’s interpretation of applicable regulations such as 21 CFR Part 11. Additionally, it will be key for you to understand how the ECM solution is updated by the vendor to ensure it’s maintained in a validated state per your business requirements.
Depending on your firm’s policies and level of comfort with cloud solutions, information that must be kept private may be suitable for a single-tenant, hosted cloud environment or an on-premise cloud where you can take advantage of scalability and other benefits of cloud-based solutions while minimizing the risk of intrusion. For some life sciences firms, the ideal solution is a hybrid system that combines a cloud environment for some information and an onsite repository for other content. Although, as cloud solutions become more prevalent in the world of consumer IT and professional IT solutions and as success is demonstrated, we are seeing a trend in life science and other firms being interested in implementing cloud ECM solutions even in the regulated space to reap the benefits of cloud mentioned above.
5. Consider Hybrid Cloud Solutions
Some firms are already using Software as a Service (SaaS) or cloud services for electronic content management purposes, and many more will likely consider doing so in the near future. More firms are planning hybrid cloud solutions to align with their company policies, regulations, and manage risk, though, since they consider a great deal of their data inappropriate for public cloud environments. By keeping an onsite content system, private cloud and/or public cloud in place simultaneously, each set of information can be stored, accessed, used, updated, shared and disposed of with the most appropriate methods possible. Being able to access and collaborate on content is typically the biggest concern when planning a cloud ECM implementation. Moving to a hybrid cloud setup offers an ideal solution for many life sciences firms facing this dilemma.
Final Tips to Consider
Understanding how to implement a cloud-based ECM solution takes a fair amount of research, skill, knowledge, planning and strategizing, and it can’t be accomplished alone. There are several considerations to make before finalizing any plans, including the consolidation of subsidiary sites, the costs for managing content in each office and department, data center costs (if applicable), the depreciation of equipment and remote and mobile data access. A risk assessment and vendor audit should also be undertaken to minimize security concerns as much as possible. Also, consider moving only the most sharable content or the content that needs to be collaborated on the most to the cloud or taking a phased approach with lower risk content first to demonstrate success before moving more critical intellectual property or regulated to the cloud. Finally, hybrid models may work best in the life sciences, since they ensure that the most sensitive data is always kept secure.