![]()
An Evaluation of Possible Consequences: Advances for Security and new Challenges for Compliance
IT
Abstract
This article covers an analysis of the cyber security aspects that were introduced in the recently published draft of Annex 11. The finalized law is expected to become effective in 2026, which leaves little time for pharmaceutical industries to prepare for the new regulation. The authors, members of the GAMP D-A-CH Special Interest Group (SIG) Cyber Security and Resilience in GxP Environments by International Society for Pharmaceutical Engineering (ISPE) and Verein Deutscher Ingenieure e. V. (VDI), wish to rise attention to the general improvements the Annex 11 gives regarding cyber security in Good Manufacturing Practice (GMP), but also to the problems that may arise because of over-specific requirements. This article quotes especially problematic passages and offers alternatives that could improve the Annex 11. In addition, explanations of the critique and the rationale behind the improvement proposals are given, thus offering the industry guidance for implementation as well as argumentative support when alternative measures are being discussed during inspections.
Correspondence:
Sascha Howey
PharmAdvantage-IT GmbH, Ohligser Str. 112, 42781 Haan
security@pharmadvantage.it
Abstract
This article covers an analysis of the cyber security aspects that were introduced in the recently published draft of Annex 11. The finalized law is expected to become effective in 2026, which leaves little time for pharmaceutical industries to prepare for the new regulation. The authors, members of the GAMP D-A-CH Special Interest Group (SIG)