The webinar will cover the following topics: -Moving away from costly and inefficient legacy systems -Key GxP features and capabilities available in the cloud -Case studies of Office 365 across the life sciences landscape -What comes with a continuous Office 365 Validation Subscription? -Montrium methodology, tools, and documentation available to you

1. Why are Life Science
Companies Moving to
Office 365?
THE COMPLIANCE PLAYBOOK :
Session 1
February 19, 2019

2. 2
Today’s
Agenda
1. State of the union – Where are we now
• Benefits of the Cloud
• Adoption statistics
• Challenges faced by life sciences industry/
Benefits of cloud
2. Intro to Office 365 for life sciences
• Benefits
• Challenges
• Use Cases
• Key Features

3. House Keeping

4. 4
House
Keeping
L I V E W E B I N A R
• This webinar is being recorded and
will be made available after this
session
• Feel free to use the chatbox to
submit your questions at anytime
• Q&A will take place at the end of
the webinar
• We will send these slides to your
email at the end of the webinar

5. § Founded in 2005
§ Working Exclusively in the Life Sciences
§ Headquartered in Montreal, Canada
§ EU HQ in Brussels
§ Clients in North America, Europe & Asia
§ Experienced Professional Services Group
5
About
Montrium
Connecting People,
Processes & Technology
A B O U T T H E C O M P A N Y

6. 6
Meet Your
Speakers
Michael
Zwetkow—
VP Professional
Services and Alliances
Montrium
Oliver Pearce—
Director of
Commercialization,
Montrium

7. 7
State of the Union
Where are we now with Office 365

8. 8
The Cloud is Here
S T A T E O F T H E U N I O N
Potential reduction in
infrastructure costs
by moving to the
cloud
Life Science Cloud
market will be worth by
2020
of enterprise
infrastructure &
software will be in the
cloud by 2020
The rate at which
cloud computing will
outspend IT spending
by 2020
40%$11.2B 67%6x

9. Challenges in
the Cloud
For the Life Sciences
Compliance Challenges
§ Lack of regulatory/industry guidance specific to cloud
§ Limited visibility of cloud service provider’s quality controls
§ Inability to perform on-site audits of cloud service provider
Technical Challenges
§ Concerns over data security in a multi-tenant environment
§ Continuous changes to the application
§ Implementing effective governance given shared responsibilities

10. Where do
inefficiencies
lie?
§ Research and Development (R&D) is a complex area,
made even more complicated by the industry
regulations and security requirements at this stage of
the product lifecycle.
§ Clinical Trials can be highly disconnected, making
them difficult to navigate
§ Labelling - Ensuring the safe and effective use of a
drug is the ultimate goal, making the labeling process
one of the most crucial aspects of pharmaceutical
delivery.

11. COST SAVINGS
Cloud users have recorded a
noticeable cost savings from
using cloud-based software
and infrastructure.
FLEXIBILITY &
SCALABILITY
Cloud computing offers a
much more flexible
environment for data storage
and sharing.
IMPROVED
EFFICIENCIES
The cloud can help enable
automation for repeatable
business processes, getting
drugs to market that much
more efficiently.
MODERNIZATION
OF IT
The cloud provides previously
unobtainable IT resources readily
available
BETTER
COLLABORATION
Cloud tools provide a more
collaborative environment to work
with internal and external teams
Benefits of the Cloud
Realizing the true benefits for life science organizations

12. Introduction to Office 365
What does Office 365 have to offer the Life Sciences

13. 13
Office 365 Adoption Statistics
S T A T E O F T H E U N I O N
135 Million
Active Monthly Users
56%
Of all companies use
Office 365
17%
Of all data in Office 365
is classed as sensitive
56.3%
Growth in
usage of office
365 in 2018
167%
Increase in SharePoint
Online Adoption

14. Are you currently using Office 365 in your
organization?
• Yes, for non-GxP content
• Yes, for GxP content
• Yes, for both
• No, not currently using Office 365
POLL

15. 15
Office 365
Benefits
For Life Sciences
Organizations
Extensive Suite of
Professional Tools
Audit Reports &
Certifications Available
Features that Support
GxP Content
I N T R O D U C T I O N T O O F F I C E 3 6 5
GxP Guidance Available
for Life Sciences
Cost Effective Solution for
Life Sciences
Heavy adoption in Life
Sciences for non-GxP
Adaptable to almost any
business process
Leading Content
Management Platform

16. Office 365
Challenges
HIGHLY CONFIGURABLE
& CUSTOMIZABLE
NOT DESIGNED
SPECIFICALLY FOR GXP
PURPOSES
CONTINUOUSLY
EVOLVING
INABILITY TO PERFORM
ON-PREMISE VENDOR
AUDITS

17. Office 365 Case Study
Pharmaceutical
Organization
1400+
Employees
Company overview
§ Growing life science organization documents
scattered across various file shares and legacy
EDMS
§ Past experience showed them they needed a tool
that can scale as the company grows
§ Office 365 provided better quality, content,
collaboration, internal and external, records
management features
40,000
Documents per
functional group
50+ Functional
Groups

18. Office 365 Case Study
Achieve CompliancePain Points & Challenges Before Office 365
• Users confused where to put content
• Wasted money paying for the same capabilities across
multiple systems
• Expensive & difficult to apply Records Management
across the numerous solutions
• Duplication of content leading to risk and increased
cost
• Different experience for the same function in each
solution
• Collaboration was difficult
• External access was limited or nonexistent
• Metadata was too ‘heavy’; took too much time and
killing productivity
• Too many folders making navigation laborious and
confusing
• Needed to be compliant with 21 CFR Part 11
Project Goals
Optimize IT Spending
Improve Productivity
Legal Defence

19. Measures of success
ü Elimination of working files/record located in unsecured or non-regulatory
compliant locations
ü Increased collaboration
ü Implementation of good records management (RM) practice
ü Reduction of business risks tied with litigations and mismanagement of
business records
ü Better content organization, categorization and harmonization
ü Reduction of the total number of files stored and maintained
ü Increased user adoption

20. Other GxP Use Cases for Office 365
Functional Area Use Case / Business need
Quality SOP management / Training management
Data Management File transfer (extranet) with third-party vendors
Regulatory Affairs /
Medical Writing
Subject narrative collaboration and lifecycle
management
Clinical Electronic Trial Master File (eTMF) management and
archive
Records
Management
Record review and archive for various GxP records

21. Key Office
365 Features
User access control
Permissions management
Document versioning
Audit log of document events
Document metadata
Document templates
Document classification
Records retention
Information rights management
Real-time document co-authoring
Automated workflow
External sharing

22. 22
A Compliance Playbook
The Office 365 Roadmap for Life Sciences

23. Office 365
Challenges
HIGHLY CONFIGURABLE
& CUSTOMIZABLE
NOT DESIGNED
SPECIFICALLY FOR GXP
PURPOSES
CONTINUOUSLY
EVOLVING
INABILITY TO PERFORM
ON-PREMISE VENDOR
AUDITS

24. How do we address the challenges?
§ Establish well defined design and architecture
specifications
§ Use controlled processes and/or provisioning tools when
configuring site structures
§ Create development/testing environment which is a mirror
of the production environment
§ Ensure only qualified and trained users are allowed to
administer the system
§ Create robust configuration and change management
processes
HIGHLY
CONFIGURABLE

25. How do we address the challenges?
§ Identify all relevant GxP regulations based on its intended
use and the GxP process(es) supported by the system
§ Perform a gap assessment to identify technical and/or
procedural controls that need to be implemented in order
to satisfy regulatory requirements
§ Establish traceability between implemented controls and
regulatory requirements
§ Execute system validation to establish documented
evidence that the system is fit for its intended use
NOT DESIGNED
SPECIFICALLY FOR
GXP PURPOSES

26. How do we address the challenges?
§ Establish and/or adapt existing governance processes to
accommodate for smaller, but more frequent changes
§ System administration should include regular review of
Office 365 roadmap and message center and an impact
assessment of upcoming changes
§ Establish continuous regression testing and validation
using automated scripts
CONTINUOUSLY
EVOLVING

27. How do we address the challenges?
§ Establish vendor assessment approach aligned with
shared responsibility model and overall application risk
§ Evaluate regulatory requirements and identify shared
responsibilities between regulated user and Microsoft
§ Map relevant controls within independent third-party
certification and attestation audit reports, including:
§ ISO 27001
§ SOC 2 Type II
§ FedRAMP
§ Review audit reports periodically and monitor quality
metrics (KPIs)
INABILITY TO PERFORM
ON-PREMISE VENDOR
AUDITS

28. 1) Develop transition
plan and system
description
2) Perform vendor
assessment
3) Establish
validation framework
and validate core
features
4) Implement
governance plan
and processes
5) Define and
provision GxP site
structures
6) Execute business
process validation
based on intended
use
7) Migrate GxP
content (if required)
8) Perform routine
monitoring and
continuous
validation
Transition to
Office 365

29. Principle of Shared Responsibility
Customer Management of Risk
Data Classification and Accountability
Shared Management of Risk
Identity & Access Management
Provider Management of Risk
Physical | Networking
Cloud Customer Cloud Provider On-Prem IaaS PaaS SaaS
Data classification and
accountability
Client & endpoint protection
Identity access management
Application level controls
Network controls
Host infrastructure
Physical security

30. Regulatory
agencies are
focused on data
integrity
30
Key Compliance Considerations
Microsoft Data Integrity Responsibilities
• Establish security controls to ensure confidentiality, integrity & availability of
customer data.
• Follow industry best practices for infrastructure control, software development and
service delivery.
• Implement robust risk and quality management processes to ensure quality of
delivered products and services.
Regulated User Data Integrity Responsibilities
• Establish governance controls and operational processes covering administration
and proper use of the application.
• Conduct end-user training on proper system use.
• Manage data inputs, processing, storage and outputs for completeness, accuracy,
and timeliness, covering all aspects of ALCOA.
• Perform system validation to demonstrate fitness for intended use and regulatory
compliance.

31. Key application governance roles
Global Admin
SharePoint Admin
Site Collection Admin
Business Process
Admin
•Establish data governance policies
•Assign SharePoint Admin(s)
•Provision sites and assign Site Collection
Admin(s)
•Monitor site usage and quota
•Archive sites
•Manage site configuration
•Manage user access requests to site resources
•Perform periodic review of assigned permissions
•Assign Business Process Admin(s)
•Define business process requirements
•Train users on business process
•Ensure business process automation workflows
are operating correctly

32. Validation framework for SharePoint Online
•Site collection settings and enablement of key features with potential GxP impact (e.g. audit logs,
records declaration settings)
Configuration verification of site settings and key features
•User access control (Azure AD controls for access to SharePoint)
•Permissions management (Permission levels and SharePoint Groups)
•Audit trails (creation, modification & deletion of records)
•Document versioning
•Document metadata
•Classification and retention features (labeling and records retention)
•Record declaration document protection
•Information Rights Management (IRM)
Functional verification of key security and content management features
with potential GxP impact
•Deployed sites and libraries using pre-qualified templates or automated provisioning scripts
•Proper configuration of libraries, lists, columns and content types according to specifications
•SharePoint security group permissions and inheritance
Site deployment/provisioning process verification
•Workflow configuration
•Third party application integration
Business process verfication
•Routine monitoring of quality metrics and continuous validation to prevent configuration drift and
ensure system continues to be fit for intended use
Routine monitoring and continuous validation
PHASE 1: Validation of core
functionality to ensure suitability
for managing GxP content and
compliance with regulatory
requirements (i.e. 21 CFR Part 11)
PHASE 2: Business process
validation and user acceptance
testing to ensure fitness for
intended use
PHASE 3: Continuous validation
of site configuration and

33. 33
Accelerate your transition
Our unique value proposition

34. 34
The Compliance Toolkits for
Office 365
A C C E L E R A T E Y O U R T R A N S I T I O N T O T H E C L O U D
Microsoft Vendor
Assessment Toolkit
SharePoint Online
Validation Toolkit
SharePoint Online
Governance Toolkit
Deployment &
Migration Toolkit

35. Would you like to receive more information on
Montrium’s Compliance Toolkits for Office 365?
• Yes, could be useful
• No, thank you
POLL

36. Future Learning Opportunities
Register for the other sessions in this series

37. 37
The Compliance Playbook
F U T U R E L E A R N I N G O P P O R T U N I T I E S
Visit www.montrium.com/webinars to register
Strategies for Conducting GxP Vendor Assessments of Cloud Service ProvidersMAR 19
APR 23
MAY 21
JUN 18
Validation in Office 365 – Tools for Accelerating Validation
Maintaining Oversight for Complete Governance in Office 365
Validation in Office 365 – Continuous Validation as a Service

38. Questions?