Good Distribution Practice (GDP) is a quality system for warehouses and distribution centres that process medicines. Historically, GDP only covered the movement of finished products from manufacturing sites to wholesalers, retailers, and patients. These parts of the supply chain are still covered by GDP, but the guidelines are now applicable throughout the whole supply chain, from raw materials to the finished product and everything in between.

The EU added this enhanced GDP requirement to its guidelines in 2013 because of increased globalisation, the sensitivity of certain therapeutic drug molecules, and the stricter controls that are now required to maintain the quality and integrity of medicinal products.

Failure to adhere to the guidelines at any point in the supply chain, including all intermediate points of storage and transport, can have a serious impact on the quality of the product.

Is Good Distribution Practice Essential?

For companies involved in sourcing, storing, and transporting APIs and other ingredients for pharmaceutical manufacturing, the adoption of GDP is a crucial tool to ensure patient safety, product integrity, and product availability. It is also essential for similar reasons for companies involved in the distribution of finished products to the end-user.

Here is how EU regulators define GDP in the guidelines:

“These Guidelines lay down appropriate tools to assist wholesale distributors in conducting their activities and to prevent falsified medicines from entering the legal supply chain. Compliance with these Guidelines will ensure control of the distribution chain and consequently maintain the quality and the integrity of medicinal products.”

The guidance also says that wholesale distributors must comply with GDP to obtain wholesale distribution authorisation. Wholesale distribution authorisation is required for the wholesale distribution of medicinal products in the EU.

Why Thermal Compliance is Relevant to GDP

Product deterioration is one of the main challenges that pharmaceutical companies face when ensuring patient safety and product quality. As deterioration is significantly impacted by temperature and humidity, the following two areas need to be addressed to maintain products in an optimal condition during storage and distribution:

1. Ensuring storage conditions follow product labelling requirements (for example, not storing above 25°C)
2. Providing documented evidence that demonstrates consistent adherence to the storage requirements listed on product labels

By following GDP, the above can be achieved through:

• Documented temperature mapping studies (empty/full/seasonal/challenge conditions)
• Documentation that temperature monitoring placement is determined by a risk assessment of high/low thermal risks as identified through temperature mapping studies
• Continuous temperature monitoring system with timely alerts of temperature deviations
• Calibration of temperature monitoring systems
• Ensuring compliance with standards on temperature/humidity mapping and monitoring, shipper route qualifications, calibration, and validation

GDP Compliance Situations that Companies May Face

Pre-Audit Assessment

Businesses should always be ready for inspection. However, a letter from regulators announcing a date for inspection can cause high levels of stress and disruption due to a lack of readiness. To ensure your organisation is better prepared, you should conduct a pre-audit assessment to understand your level of conformance with EU guidelines, including GDP guidelines.

If You Have an Existing Wholesale Licence

Audits are part of holding a licence to store and distribute medicines in the EU. You might face a situation where an audit from a regulatory authority, such as the HPRA in Ireland, raises issues with your level of compliance.

A common example of such an issue is the placement of continuous monitoring probes. In this example, a thermal profile should be created through seasonal temperature mapping, with the location of monitoring probes determined by that profile.

New Application for Wholesale Licence

If you are preparing to make a wholesale licence application to a regulatory authority, you will need to ensure compliance with GDP guidelines. This includes guidance on thermal compliance. For example, you will need to:

• Assess the capability of your facility to store medicinal products within the required range of temperatures
• Create a thermal compliance strategy
• Establish an effective thermal monitoring system
• Validate the thermal monitoring system and compliance strategy
• Ensure the ongoing integrity of the system through annual calibration and a preventative maintenance approach

Here is an example of a typical strategy for ensuring compliance:

Product Quality, Patient Safety, and Compliance

GDP is rightly looked at as a compliance issue as there are guidelines and regulations that need to be followed. However, it is also important to remember that compliance is only one of the benefits of GDP for your wholesale or distribution operation.

Adhering to GDP helps you maintain product quality standards, enhancing the service you offer to clients. It also helps you meet your responsibilities in relation to patient safety.

In other words, adhering to GDP has commercial as well as regulatory benefits.

The past 12+ months has seen supply chains face considerable disruption – disruption that has altered perspectives and priorities. While Covid-19 is not the only reason for these disruptions, it is a significant factor. The pandemic isn’t over yet, either, bringing further uncertainty.

While there are uncertainties, there are also opportunities in warehouse and supply chain management as we look to 2022 and beyond. Those opportunities are driven by technologies, as well as by changes in consumer behaviour.

Bringing that all together, we’ve put together a list of the top seven warehouse management and supply chain trends for 2022.

1. Supply Chain Resilience

As mentioned in the opening sentence, it has been a tough period for supply chain management. The reasons are varied and include material and labour shortages, increased costs, and shipping challenges. Those things individually probably won’t last forever, but the more general experience of disruption has shone a spotlight on the issue of supply chain resilience.

Establishing supply chain resilience requires a broad strategy, with agility being an essential component. With agility built into your supply chain, you can pivot when disruption occurs. You may even be able to pivot before the disruption has an impact.

However, for your supply chain to become more agile, you need data. Data increases visibility and helps with decision-making, both of which are required for an agile approach. Therefore, we can expect more companies to develop supply chain resilience throughout 2022 and beyond by creating digital supply chains that maximise integration at all points.

2. Artificial Intelligence

AI would make the list of top trends for 2022 in most industries and sectors, and it is going to be important in warehouse and supply chain management too. It is a technology that is becoming more advanced, and with that improvement comes greater impact and familiarity.

In warehouse and supply chain management, AI and machine learning can help with data analysis and decision-making, while also optimising processes and operational efficiency.

3. Robotic Automation

Robotic automation has been a growing trend over recent years, and this growth is set to continue through 2022 as companies seek to improve productivity and deal with warehousing and supply chain challenges.

In particular, we will see a movement away from fixed automation systems to smaller mobile robots. 5G connectivity and machine vision systems will also play increasingly important roles, and cobots will become more common in warehousing and distribution operations.

4. Cloud Technologies

The rate of adoption of cloud technologies is increasing as companies make progress on their digital transformation strategies. Advances in hybrid cloud solutions is one of the reasons for this, where cloud architectures now include cloud, multi-cloud, on-prem, and edge elements.

Improving the performance of IT and operational technologies is an important motivating factor for migrating to the cloud, as is reducing IT infrastructure and maintenance costs. A move to cloud technologies also helps to eliminate the data silos that still exist in many warehousing and supply chain operations.

5. Big Data

Data is another point on this list that is not exclusive to warehousing or supply chain management, but its importance cannot be understated. There is an increasing reliance on data as companies improve collection, storage, and processing. This leads to the production of useful data that can be quickly digested in attractive data visualisations.

Good access to data also makes it possible for warehousing and supply chain operations to start using predictive analytics.

6. The Introduction of the Blockchain

Blockchain technologies in warehousing and supply chain management are in their infancy, but they have the potential to be a substantial growth area. Blockchain technologies can also increase transparency in warehousing and supply chain operations, while also reducing risks and streamlining processes. We are still at the start of this journey, but it is a trend to look out for.

7. Creating Sustainable Operations

Warehousing and supply chain operations are increasingly adopting technologies and strategies to make their operations more sustainable. From introducing electric vehicles in warehouses to minimising the environmental footprint of supply chains, sustainability will be a hot topic for some time to come.

Advancing the Sector

All the trends on this list will help warehousing and supply chain operations improve throughout 2022, becoming more competitive, productive, and efficient, while also increasing profitability. It is a period of transformation, and that brings challenges, but there are exciting opportunities too.

[full_width padding=”10px 0 10px 0″]Over the course of 2021, the SL Controls team has published blogs on a range of topics related to Industry 4.0, the Smart Factory, and equipment systems integration. Here are some of our top posts of the year.[/full_width]

[full_width padding=”10px 0 10px 0″]

[/full_width]

[one_third padding=”30px 20px 0 0″]

5 Crucial Smart Manufacturing and Industry 4.0 Focus Topics for 2022

[/one_third][two_third_last padding=”0 0 10px 20px”][/two_third_last]

[full_width padding=”0 0 10px 0″]At this time of year, it is common to see articles looking at the trends that will be important over the coming 12 months, particularly in relation to technologies. We even produce these articles ourselves at SL Controls. However, it is also important to look at smart manufacturing and Industry 4.0 more broadly to assess the challenges and opportunities that lie ahead as we move into 2022.

Read More[/full_width]

[full_width padding=”10px 0 10px 0″]

[/full_width]

[two_third padding=”0 20px 0 0″][/two_third][one_third_last padding=”30px 0 10px 20px”]

Transitioning to Smart Manufacturing – A Practical and Cost-Effective Approach

[/one_third_last]

[full_width padding=”0 0 10px 0″]The business case for implementing smart factory technologies is compelling, with tangible improvements in revenue, output, quality, and safety, alongside reduced costs. It is not surprising, therefore, that smart manufacturing technologies are becoming an increasingly important competition driver.

Read More[/full_width]

[full_width padding=”10px 0 10px 0″]

[/full_width]

[one_third padding=”30px 20px 0 0″]

The Essential Steps in Your Smart Factory Evolution

[/one_third][two_third_last padding=”0 0 10px 20px”][/two_third_last]

[full_width padding=”0 0 10px 0″]Moving your business closer to becoming a Smart Factory is widely regarded as essential to continuing competitiveness and profitability. Driving efficiency savings, making productivity gains, dealing with skills shortages – these are just some of the challenges that manufacturers face, all of which can be considerably mitigated with Smart Factory solutions.

Read More[/full_width]

[full_width padding=”10px 0 10px 0″]

[/full_width]

[two_third padding=”0 20px 0 0″][/two_third][one_third_last padding=”25px 0 10px 20px”]

Bridging The Machine To Cloud Gap For Life Sciences And Technologies Manufacturers

[/one_third_last]

[full_width padding=”0 0 10px 0″]Industry 4.0 as a concept provides manufacturers with impressive benefits and wide-ranging opportunities. The technologies and solutions that fall under the Industry 4.0 umbrella also help mitigate the existing and emerging business risks faced by those in the pharmaceutical, medical device, and electronics manufacturing industries. That said, Industry 4.0 is a data-driven industrial revolution. Therefore, significant challenges exist when you begin to connect the concept of Industry 4.0 with the realities of existing manufacturing systems, processes, and operations.

Read More[/full_width]

[full_width padding=”10px 0 10px 0″]

[/full_width]

[one_third padding=”15px 20px 0 0″]

Build Once, Deploy Multiple Times in Seconds – Cloud-Based Solutions for Pharma & MedTech Manufacturers

[/one_third][two_third_last padding=”0 0 10px 20px”][/two_third_last]

[full_width padding=”0 0 10px 0″]For pharmaceutical and medical device manufacturers, repeatability is a primary goal when developing new manufacturing software solutions. The concept is simple – you select a facility or production line for the initial project, creating a software solution to deliver on your manufacturing and business objectives. Once you have that operational and delivering results, you can then look at deploying the solution in additional facilities and production lines.

Read More[/full_width]

[full_width padding=”10px 0 10px 0″]

[/full_width]

[two_third padding=”0 20px 0 0″][/two_third][one_third_last padding=”15px 0 10px 20px”]

Qualification Of Cloud Infrastructure And SaaS To Demonstrate Regulatory Compliance

[/one_third_last]

[full_width padding=”0 0 10px 0″]Cloud infrastructure solutions, as well as Software as a Service (SaaS), Infrastructure as a Service (IaaS), and Platform as a Service (PaaS) solutions, offer significant benefits to manufacturers in the pharmaceutical and medical device industries. Cloud-based solutions still need to be validated, however, just like your on-premises software.

Read More[/full_width]

[full_width padding=”10px 0 10px 0″]

[/full_width]

[one_third padding=”30px 20px 0 0″]

The Cybersecurity Risks Created by Industry 4.0’s Increased Attack Surface

[/one_third][two_third_last padding=”0 0 10px 20px”][/two_third_last]

[full_width padding=”0 0 10px 0″]Businesses in all industries face an ever-increasing range of cybersecurity risks. This includes companies in the manufacturing sector. When you look at regulated industries such as pharmaceutical and medical device manufacturing, where patient safety is a top priority, cybersecurity risk levels can be even higher.

Read More[/full_width]

[full_width padding=”10px 0 10px 0″]

[/full_width]

[two_third padding=”0 20px 0 0″][/two_third][one_third_last padding=”30px 0 10px 20px”]

Taking a Holistic Approach to Cybersecurity in the Transition to Becoming a Smart Factory

[/one_third_last]

[full_width padding=”0 0 10px 0″]In a recent blog, we highlighted the cybersecurity risks that are created by the increasing attack surface in manufacturing organisations. As a quick recap, as you integrate systems, platforms, and equipment, and as you connect elements of your operation to the cloud, the potential attack surface in your organisation expands, exposing you to higher cybersecurity risks. In our previous blog, we also highlighted the key to mitigating these risks – taking a holistic approach to cybersecurity as you transition to a Smart Factory.

Read More[/full_width]

[full_width padding=”10px 0 10px 0″]

[/full_width]

[one_third padding=”30px 20px 0 0″]

An Overview of the Industry 4.0 Cybersecurity Risk Mitigation Process

[/one_third][two_third_last padding=”0 0 10px 20px”][/two_third_last]

[full_width padding=”0 0 10px 0″]In previous blogs in this series, we looked at one of the unintended consequences of implementing Industry 4.0 technologies and processes – the increased attack surface. In other words, the more equipment you connect, the larger the target for would-be attackers. We also looked at the challenges of dealing with this Industry 4.0 cybersecurity issue, and we outlined the main best practices. In this final blog in the series, we outline the Industry 4.0 cybersecurity risk mitigation process. This process will help you overcome the challenges of cybersecurity and protect that ever-growing attack surface.

Read More[/full_width]

[full_width padding=”10px 0 10px 0″]

[/full_width]

[two_third padding=”0 20px 0 0″][/two_third][one_third_last padding=”25px 0 10px 20px”]

How Good Distribution Practice (GDP) differs from Good Manufacturing Practice (GMP)

[/one_third_last]

[full_width padding=”0 0 10px 0″]Good distribution practice (GDP) and good manufacturing practice (GMP) are quality standards and guidelines that have the same ultimate objective – to ensure medical device and pharmaceutical products are safe, meet their intended use, and comply with regulations.GMP focuses on manufacturing processes, while GDP covers distribution activities. There are crossovers between both manufacturing and distribution, however. So, what are the main differences between GDP and GMP?

Read More[/full_width]

At this time of year, it is common to see articles looking at the trends that will be important over the coming 12 months, particularly in relation to technologies. We even produce these articles ourselves at SL Controls. However, it is also important to look at smart manufacturing and Industry 4.0 more broadly to assess the challenges and opportunities that lie ahead as we move into 2022.

Here are five smart manufacturing and Industry 4.0 focus topics we believe will be part of national and global conversations in 2022 and beyond.

1. Talent

There is a lot we need to do as an industry in the area of talent to mitigate skills shortages and ensure Ireland stays at the forefront of the sector. One example is the importance of encouraging women and other under-represented groups into the industry, particularly in engineering disciplines.

The pace of change in the industry, driven largely by new and emerging technologies, is also an important consideration. Keeping up with these changes is essential at every level. This includes third-level education, where providers need to continue proactively adapting course content according to the new technologies that industry is using, as well as to the evolving needs of industry.

At a company level, there is also an essential requirement for upskilling existing staff and providing opportunities for continuous professional development. We also need to continuously highlight the importance of lifelong learning for those working in the sector.

2. Unlocking the Value of Data

Data is the crucial component to achieving the smart factory of the future. There are challenges to overcome, however, including the fact that most facilities have legacy systems that are not connected or integrated.

There is a continuing need across the industry to build solutions that make it possible for both legacy systems and new systems to deliver usable data. This requires increased use of sensor technology, system integration solutions, and big data.

It is also worth mentioning data fabric, the data architecture that integrates and simplifies data management. It is an emerging technology, but it is one that will grow in importance.

3. Supply Chain Resilience

Supply chain disruption has been a common feature for manufacturers in various industries over the past 12-24 months, including in the industries that we operate in at SL Controls – pharmaceuticals, medical devices, and technologies.

The varying causes of supply chain disruption include high demand, increased raw material costs, slow delivery times for raw materials, and rising freight costs. However, the end results are the same – increased costs and production disruption.

Smart manufacturing technologies can provide a large part of the solution. This includes creating digital supply chains by integrating data at all points.

Digital supply chain solutions improve and automate planning, and they enhance visibility. This gives manufacturers the tools they need to predict and respond to challenges in the supply chain and, ultimately, minimise disruption.

4. Implementing Ireland’s Industry 4.0 Strategy 2020-2025

The Government published Ireland’s Industry 4.0 Strategy 2020-2025 in 2019. The coming year will see us cross the halfway point of the strategy, making it an ideal time to reflect on progress and redouble our efforts to ensure the objectives of the strategy are achieved.

Taking account of multiple viewpoints is important, too, particularly given the global nature of Ireland’s manufacturing industry. Not only do we make products here in Ireland that are sold internationally, but some of the world’s largest companies have manufacturing operations on these shores.

This includes US companies, and we got an insight into their collective thinking in a position paper published this year by the American Chamber of Commerce Ireland. That position paper welcomed the publication of Ireland’s Industry 4.0 strategy, but it also set out four recommendations. Those recommendations cover Ireland’s efforts to become a global leader, in addition to talent, funding, and governance.

5. Focus on Sustainability

There is an increased focus on the sustainable managing of operations across all sectors, including the manufacturing sector. This is being driven by regulations as governments across the world develop and implement strategies to meet environmental targets. However, regulations are not the only factor, as consumer expectations on sustainability are driving change too.

Therefore, it is now increasingly important to take into account sustainability issues when implementing smart manufacturing and Industry 4.0 solutions, as well as when developing business cases, strategies, and roadmaps.

The Role of Smart Manufacturing and Industry 4.0

Manufacturers and the wider manufacturing industry face uncertainties as we head into 2022, not least because of the ongoing global Covid-19 pandemic. However, the past 18 months have also taught us a lot about resilience, innovation, and the ability of the sector to push forward despite the challenges.

There are massive opportunities available to the sector, too, from attracting new talent to doing more with data to contributing to the creation of a more sustainable world. Smart manufacturing and Industry 4.0 solutions and initiatives will play an important role in these areas and many more.

One of the business outcomes that manufacturers want to achieve with Industry 4.0 projects is repeatability. Repeatability is about creating solutions that can be reliably and efficiently deployed multiple times. This goal of repeatability is also important in the delivery of Industry 4.0 and smart manufacturing projects.

In project management, this can be referred to as the economies of repetition. The economies of repetition involve creating structures and processes that make it possible to execute projects to a consistent minimum standard, with that standard constantly being enhanced and improved.

At SL Controls, we deliver economies of repetition in Industry 4.0 projects through TOTALproject.

What is TOTALproject?

TOTALproject defines our internal project management structure. It features a set of tools and templates, which we call the SL Controls project management Toolbox. TOTALproject is managed, improved, and updated by the SL Controls Project Management Office (PMO), and everything is documented in a SOP (Standard Operating Procedure).

The tools and templates in TOTALproject are based on the Project Management Institute’s framework, so we are not redesigning the wheel. The goal of TOTALproject is to adapt tried and tested principles to our organisation and the delivery of projects specifically focused on our areas of expertise.

Project Management Toolbox

The SL Controls project management Toolbox includes governance structures and templates that our project managers and PMO use to ensure clear authority and accountability. The governance structures also ensure outputs and outcomes are clearly defined and controlled within each project and the PMO more generally.

Our project management Toolbox also ensures that lessons learned at the end of each project are communicated to all project managers and the wider SL Controls team. We have clearly defined processes to facilitate this sharing of knowledge to continuously raise standards.

We also have an ongoing focus on the development of our staff, providing training and professional development opportunities to increase the project management skills in the organisation. This includes helping our staff achieve PMP certification to become Project Management Professionals.

Benefits of Our Approach to Project Management

There are multiple benefits that come from our approach to project management at SL Controls. This includes company benefits as it ensures projects run more efficiently and cost-effectively. There are benefits to our employees, too, especially those who want to pursue a career path into project management.

The main benefits are for our customers, i.e., through the economies of repeatability. What does this mean in practice? There are three main points:

• Consistency in project delivery – TOTALproject and the project management structures we have put in place bring uniformity to project management at SL Controls. This ensures consistent standards on all projects.
• Continuous improvement – while achieving consistency is important, standards are not fixed. Continuous improvement is central to our project management approach.
• Skills development – it is essential that we have the in-house skills available to deliver on the requirements of our clients. We achieve this through the development of our team, ensuring we have a pipeline of new project managers coming through.

The specifics of how we deliver projects depend on the requirements of our clients. For example, some clients already have robust project management structures, whereas on other projects if the client project management templates are not available, we will use our own. The principles and objectives of TOTALproject and our PMO remain the same – ensuring the economies of repetition in Industry 4.0 projects.

In previous blogs in this series, we looked at one of the unintended consequences of implementing Industry 4.0 technologies and processes – the increased attack surface. In other words, the more equipment you connect, the larger the target for would-be attackers. We also looked at the challenges of dealing with this Industry 4.0 cybersecurity issue, and we outlined the main best practices.

In this final blog in the series, we outline the Industry 4.0 cybersecurity risk mitigation process. This process will help you overcome the challenges of cybersecurity and protect that ever-growing attack surface.

There are three main parts of this risk mitigation process:

1. Assess
2. Secure
3. Monitor

1. Assess Industry 4.0 Cybersecurity Risks

Cybersecurity Maturity Assessment

This part of the process starts by conducting a cybersecurity maturity assessment of your organisation with the aim of identifying risks to OT equipment and systems.

Risk Evaluation and Prioritisation

Once risks are identified, they need to be evaluated and prioritised to assess the probability of occurrence and the level of harm that could be caused. Those with a high probability of occurring and a high level of harm should be the highest priority.

Remember, however, that cybersecurity risk evaluation is not just about looking at the immediate threat. You also need to look at the root cause.

For example, one area that might be identified as high risk is malware knocking systems offline or putting data at risk. The probability of this occurring is high as malware attacks are commonplace. If such an attack is successful, it is likely to have a significant impact. Therefore, it makes sense to mitigate this risk.

Further analysis might reveal there is insufficient monitoring of malware and a poorly configured firewall. There might also be security patches that have not been applied.

You should put in place mitigation measures to harden these technology and process weak points. However, this doesn’t necessarily get to the root cause of the problem. Let’s track it back in reverse order:

• Malware isn’t spotted, so it gets control of part of the system.
• It got through the firewall because it wasn’t configured properly.
• It got to the firewall because a security patch wasn’t applied to part of the system.
• The malware got into that part of the system because an individual with access used a USB device on a connected piece of equipment.
• The use of USB and similar devices is widespread because of a general lack of understanding of the cybersecurity risks they pose.

There is definitely a technology problem in the above scenario. However, when you track the issue back to its root cause, it is also a people problem. Therefore, you need an end-to-end solution that includes technology, processes, and people:

• Technology – improve malware monitoring and firewall configuration
• Processes – ensure security patches are properly applied and develop a policy on the use of USB and similar devices
• People – conduct regular training for staff on cybersecurity risks and how to mitigate them

Once you have identified, evaluated, and prioritised the risks, the next step is to identify mitigation measures.

2. Secure Your OT Equipment

In this part of the risk mitigation process, it is important to understand that while a holistic approach is essential, the practicalities and realities of IT and OT can be contradictory.

This especially applies in fields like pharmaceutical and medical device manufacturing, as there are patient safety and compliance requirements. This creates situations where IT systems can be completely locked down for cybersecurity reasons while a certain degree of openness is required for OT systems to allow data to pass through.

Another example of the practical differences is the application of security patches. In most IT systems, security patches can be applied immediately. Greater care must be taken with OT systems, however, as the patch itself must be risk assessed and qualified. This is because applying a security patch could reduce the availability of a piece of equipment, impacting essential metrics like production line output and OEE (overall equipment effectiveness).

This is before you even consider the fact there will be OT systems and equipment operating on production lines that are no longer supported by the manufacturer, so security patches are not being developed.

It is also important to take into account the nature of the equipment and systems being used, as this will also impact the steps required to make them secure. In IT security, equipment and systems are likely to be relatively new, while in the OT environment, it is not unusual to see equipment and systems that are decades old.

During the process of developing mitigation steps to secure your OT equipment against identified risks, there are some key points to consider:

Identity and Access Management

Identity and access management are essential cybersecurity components, but they are particularly important when third-party contractors are working on OT systems. If the contractor is physically present on the factory floor, they will have gone through the company’s security protocols. However, it is now increasingly possible for engineers to remotely work on manufacturing lines and equipment. Security measures for remote access are often much weaker than those in place for physical access, so there is usually room for improvement.

Use Reliable Partners and Vendors

It is also important to use trusted vendors and engineering teams that prioritise security when developing or updating systems and software. A track record of success is important too.

Reduce the Attack Surface Where Possible

A lot of the focus of Industry 4.0 cybersecurity involves securing the increasing attack surface, but there are also steps you can take to reduce potential access points for an attack. This includes removing unneeded systems and equipment

3. Monitor the Effective of Your Cybersecurity Risk Mitigation Measures

The final step in the risk mitigation process is the continuous monitoring of your mitigation measures, including through the use of automation and machine learning technologies.

You should also build in levels of redundancy wherever possible, so there are alternatives if a system or piece of equipment has to be taken offline for cybersecurity reasons.

Ensuring maximum resiliency is important, too, including ensuring you take regular system and data backups. You should also have an up-to-date disaster recovery plan, and it should be regularly tested, assessed, and reviewed.

An Ongoing Process

The process outlined above should become a constant feature of your operations, given the increasing fluidly of the manufacturing sector and the constantly changing nature of the cybersecurity threat profile. Prioritising cybersecurity and continuous vigilance are the solution.

In a recent blog, we highlighted the cybersecurity risks that are created by the increasing attack surface in manufacturing organisations. As a quick recap, as you integrate systems, platforms, and equipment, and as you connect elements of your operation to the cloud, the potential attack surface in your organisation expands, exposing you to higher cybersecurity risks.

In our previous blog, we also highlighted the key to mitigating these risks – taking a holistic approach to cybersecurity as you transition to a Smart Factory. This means integrating your IT and OT (operational technology) teams and developing cybersecurity strategies, processes, and mitigation measures that cover all aspects of your organisation’s technologies. This includes everything from your Manufacturing Execution System to the cloud applications used by your accounting team to the PLCs and SCADA systems running on the factory floor to the CRM used by your sales and marketing team.

What does this holistic approach to cybersecurity mean, though? What are the practical steps that should be taken by pharmaceutical, medical device, and technology manufacturers?

The Challenges of the Increasing Attack Surface

A good starting point is to have a clear understanding of the scale of the challenge when you integrate and connect devices and therefore increase the attack surface and potential risks. Some of the main points include:

• Many OT legacy systems have complex cybersecurity vulnerabilities.
• One of the reasons for the above point is the fact that OT equipment is traditionally older and less adaptable to change.
• Software upgrade and security patching processes often lack structure.
• The process of rolling out updates and security patches is more challenging with OT equipment. This is because OT equipment directly controls the production process. As a result, each upgrade and security patch must be risk assessed and qualified.
• Visibility across the entire operation is limited.

Industry 4.0 Cybersecurity Best Practices

A crucial component of Industry 4.0 cybersecurity is to make sure there is correct OT/IT bridge separation to isolate and protect OT equipment from external threats. This OT/IT bridge separation will also provide protection against the internal risks that are often present in large corporate IT networks.

This protection of OT equipment requires the implementation of robust architecture during connectivity design. This architecture needs to allow data through while at the same time preventing inward threats.

Other essential Industry 4.0 cybersecurity best practices include:

• Make cybersecurity an integral part of your smart manufacturing strategy.
• Take an end-to-end approach to cybersecurity that includes technology, processes, and people.
• Put in place a cybersecurity governance programme covering both IT and OT. This includes developing comprehensive cybersecurity procedures, controls, and policies. These procedures, controls, and policies should also be regularly reviewed and updated.
• Put in place a strategy to continuously raise awareness of cybersecurity risks. This should apply at all organisational levels and should ensure constant vigilance while also providing education on new and emerging threats.
• Implement a strategy of continuous cybersecurity skills improvement throughout the organisation.
• Continuously focus on emerging threats as well as existing threats.

Getting it Right All the Time

There is a difficult and unfair reality about cybersecurity that is universal – those who seek to attack your organisation only have to be right once, whereas to properly protect your OT systems, you have to be right all the time.

This fact should not be a barrier to continuing on your Industry 4.0 journey as there are too many benefits to be ignored. However, cybersecurity considerations must be a core priority in everything you do and at all levels of the organisation.

Good distribution practice (GDP) and good manufacturing practice (GMP) are quality standards and guidelines that have the same ultimate objective – to ensure medical device and pharmaceutical products are safe, meet their intended use, and comply with regulations.

GMP focuses on manufacturing processes, while GDP covers distribution activities. There are crossovers between both manufacturing and distribution, however. So, what are the main differences between GDP and GMP?

Definitions

To understand the key differences and how they impact operations, let’s first look at the definitions of GMP and GDP.

What is Good Manufacturing Practice?

Good manufacturing practice involves consistently producing products that meet quality standards. This requires the implementation of a system where the aim is to minimise risks, from incorrect labelling of products to contamination to incorrect ingredients and everything in between. GMP systems cover all parts of the production process, from raw materials through to the production of the finished product.

What is Good Distribution Practice?

Good distribution practice involves maintaining the quality and integrity of products through all stages of the supply chain. It sets out minimum standards to ensure medical device and pharmaceutical products comply with regulations. GDP applies to warehousing, storage, and transportation, and it covers everything from storing and transporting products under the right conditions. Doing so, minimises the risk of product degradation, ensuring product integrity at the correct destination on time.

Unique Aspects of GDP

There are parts of GDP that are unique, so they don’t apply to GMP guidance and standards. Those unique parts of GDP include guidance on transportation covering aspects such as temperature control, vehicle controls, and conducting risk assessments on transport routes. Guidance on brokers is also unique to GDP, i.e., guidance on those who facilitate transactions in the supply chain without ever handling the product.

Areas of Minimal Difference

While there are sections of guidance that are unique to GDP, there are also areas where there is minimal, if any, difference between GDP and GMP. These include:

• Quality management – both focus on ensuring members of staff are properly trained, and the facilities and equipment are fit for purpose. Management review meetings also feature in both, albeit with a bit more emphasis in GDP.
• Outsourced activities – minimal difference.
• Self-inspections – minimal difference.
• Complaints and returns – there are more details in GDP covering the control and management of product returns. Otherwise, there is minimal difference between the two standards.

Main Differences Between GDP and GMP

Aside from the unique aspects of GDP compared to GMP, the differences fall under four main headings:

• Personnel
• Equipment and premises
• Documentation
• Operations

Personnel

GMP talks about the role of Qualified Person while the focus of GDP is the role of Responsible Person. This isn’t just a difference in words, though, as a Responsible Person has different responsibilities under the guidance. They can’t, for example, certify the release of a product batch, whereas a Qualified Person can.

Equipment and Premises

The main difference between GDP and GMP is the additional controls included in GDP to cover products and materials that are either radioactive or highly sought-after on the black market.

There can be blurred lines in this area, though. Take the thermal mapping of storage areas as an example. Many facilities working to remain in compliance with GMP will have thermal mapping systems in place, even though they are not specifically required by GMP. However, thermal mapping is a requirement under GDP.

GDP also puts more emphasis on instrument calibration, particularly those instruments involved in product traceability processes.

Documentation

As might be expected, there is a reduced requirement in GDP for manufacturing and testing documentation, but an increased requirement for storage and personnel documentation.

Operations

In GMP, these guidelines are covered under production, so the heading is different. In terms of the more practical specifics, GDP places more emphasis on fake product identification, supplier and customer approval, and exporting processes.

Not Just About Regulatory Compliance

Both GDP and GMP are important components for maintaining regulatory compliance when selling medical device and pharmaceutical products. The standards also have other benefits to businesses involved in these processes, including manufacturers as well as those further down the supply chain.

This includes helping to reduce the prevalence of fake medicines, improving the quality of products produced and delivered to patients/clinicians/customers, and minimising business risk in the manufacture and distribution of healthcare products.

Businesses in all industries face an ever-increasing range of cybersecurity risks. This includes companies in the manufacturing sector. When you look at regulated industries such as pharmaceutical and medical device manufacturing, where patient safety is a top priority, cybersecurity risk levels can be even higher.

Industry 4.0 technologies and solutions almost always modify existing risks or create new ones. As a result, it is essential that cybersecurity is prioritised throughout every stage of every project that comes under the umbrella of Industry 4.0, digital transformation, smart manufacturing, and industrial automation.

It is also important to take a step back to take a wider view of cybersecurity in your organisation. This is because of one of the unintended consequences of Industry 4.0 technologies and solutions – the increased attack surface.

What is the Increased Attack Surface?

Some of the objectives of Industry 4.0 technologies include integration and the deepening of connections between systems. This can be systems on the production line, within the supply chain, or in other parts of the organisation, i.e., sales, R&D, purchasing, accounting, etc.

Even systems that previously operated in silos can be brought into the new connected structure to make better use of data and to make efficiency savings and productivity gains.

However, each integration step you take on your smart manufacturing journey increases the cybersecurity attack surface that exists in your organisation. The same applies to every new connected device, platform, or piece of equipment. Connecting to cloud services and other resources external to the organisation significantly increases the attack surface too.

In other words, each new system or machine you integrate or connect is another potential target of attack.

You might even have legacy systems that were never designed to deal with the cybersecurity challenges that currently exist, never mind those that are yet to emerge.

Secure IT is Not Secure Enough in the Smart Manufacturing Era

One of the key cybersecurity challenges as manufacturers transition to smart factories is the fact that IT and OT (operational technology) are not synced up in terms of cybersecurity.

This situation arises because the team responsible for IT security is likely to have limited input in OT decisions and processes, plus there is generally no equivalent OT team responsible for security. In many situations, this can leave organisations unprepared for the enhanced cybersecurity threat created by the increased attack surface.

Dealing with These Enhanced Cybersecurity Threats in Smart Factories

The Industry 4.0 concept of integration is a crucial part of the solution to the cybersecurity risks created by expanding attack surfaces. We are not talking about integrating systems or equipment, however, but teams.

In practice, this means approaching cybersecurity in a more holistic way across all parts of the organisation, taking into account both IT and OT.

This integrated approach to cybersecurity will mitigate the threat of the increasing attack surface. For example, dealing with the gaps that arise in maturity assessments.

Cybersecurity maturity assessments are typically performed periodically. The time between assessments can often be too long, but there is also the issue of new Industry 4.0 solutions being implemented between cybersecurity maturity assessments. These solutions can increase the attack surface further, increasing risks and rendering the assessment out of date even though it is the most recent.

Taking a Holistic Approach to Cybersecurity in Manufacturing Organisations

While integrating your cybersecurity team across IT and OT is the solution, that team will require detailed knowledge of existing and emerging cybersecurity threats. It will also need in-depth knowledge of both IT and OT assets and network architectures, in addition to knowledge of both business and manufacturing processes.

Taking a holistic approach to cybersecurity also involves real-time auditing of IT and OT assets, regular maturity assessments and risk reviews, taking mitigating actions, and continuous monitoring.

While this is a more expansive approach to cybersecurity than currently exists in many manufacturing organisations, it will ensure the maximum level of protection across the entirety of the potential attack surface.