GAMP 5 - Good Automated Manufacturing Practice S4: Appendix S4 Patch and Update Management

Regulated companies develop an approach to security patches, hot fixes and service pack upgrades that sets out how to judge the threat level to the enterprise and, from it, the urgency of patching, allows flexibility that balances risk to the enterprise against the risk of regulated systems losing compliance, produces configuration records showing the version and patch level of a system at any point, and generates change records describing the level of testing performed, which may be general enterprise testing, application-specific tests or, from analysis of release notes, none. Because many patches address urgent vulnerabilities with known or imminent exploits, the time to evaluate and test every affected system before patching can itself increase risk, so a risk management approach considers regulatory compliance and the threat to the system and environment with clear communication; application-specific patches follow normal change management while enterprise-wide patches follow defined strategies whose criteria, approvals, roles and notification of affected parties including the help desk are set out, with more aggressive strategies reducing enterprise risk while raising application compliance risk. The quality unit approves the process for risk evaluation of patches but is generally not involved in the assessments, which are performed by subject matter experts, and does not have the final say, since enterprise risk generally takes precedence over GxP risk, with process owners and the quality unit jointly mitigating undesirable GxP risk through verification or temporary process changes; strategy selection weighs the degree of risk reduction, and low-risk patches such as disabling an unused port may need no application-level testing. Accurate configuration management records support sequential patch planning, interoperability across sites and interfaced systems, troubleshooting and demonstration that security gaps were closed and when, and record the system as it currently stands together with the dates on which each patch and upgrade went in.