Unless otherwise noted, the term ‘backup’ refers to the backup copies that are created during normal use and maintained for disaster recovery.
The following eight points should be noted:
- Back-up procedures must guarantee data integrity.
- Backups need to be confirmed for completeness and correctness (e.g., checksums or binary compares).
- The backup should be configured to enable reconstruction of all GMP-relevant documentation.
- Backups need to be protected from damage; e.g., environmentally controlled facilities.
- Backups need to be managed in accordance with all controls, including security.
- The physical location of the backup should be separate from the original to best enable business continuity in the event the original is lost, corrupted or breached. Depending on criticality, considerations may need to be given to use geographical locations (e.g., earthquake-prone areas may need to preserve backups in a different geography).
- The Back-Up & Restore process itself should be validated.
- And As with any validated system, changes to the backup system may drive re-validation efforts. In all cases, change control should ensure the availability and integrity of the back-up files.
