3 Tips for Successful IT Site Migration in Highly Regulated Industries
Companies in highly regulated industries face unique challenges when it comes to digital and IT transformations. Hurdles often include strict limits on downtime, comprehensive validation procedures and rigorous execution requirements. A minor implementation error at a manufacturing site, for example, can result in significant product loss, supply chain disruption or both.
WWT works with many customers in a variety of regulated industries, such as financial services, healthcare, life sciences, manufacturing, and oil and gas. To adequately prepare for and execute complex IT migrations in such environments, it's essential to fully understand all relevant rules and regulations.
This case study highlights three lessons we learned from planning and executing nearly 200 site migrations during a global pandemic for a multinational pharmaceutical and life sciences customer.
For more on WWT's work with this particular customer, these two divestiture and acquisition case studies detail how WWT's M&A team helped this pharmaceutical business unit acquire another life sciences business while spinning off from its parent company.
A focus on complex site migration
Site migrations were a key focus of our M&A team's program with the pharma spin-off.
A "site migration" generally refers to the transition of technological components from one IT infrastructure location to another. Migration components typically include end-user compute devices, telephony, network, print, file servers (physical and virtual) and security systems.
The pharma spin-off engaged our M&A team to migrate more than 180 combined commercial sites, manufacturing sites, and research and development (R&D) labs to an entirely new IT infrastructure footprint.
The main challenges we encountered included minimizing production downtime and cybersecurity risks.
Our experts paid special attention to high priority regulated sites, like R&D labs and manufacturing plants, because any impact on productivity could disrupt the customer's long-term research objectives. Further, any plant outages exceeding two hours could result in a significant financial impact to the customer.
Tip 1: On limiting downtime
We designed the migration or "cutover" of our customer's high priority sites to require minimal-to-no unscheduled downtime or outages. To achieve this goal, the WWT team spent months planning and subsequently executing the customer's vision to balance cost and downtime risks.
We presented the customer with three options for migrations, explained further below:
- A parallel build
- A beachhead deployment
- A direct migration
Migration option I: Parallel build
Parallel builds are the most expensive site migration approach but feature the least amount of risk. The cost driver in a parallel build is the requirement to run two networks side by side — the legacy network and the new network — to ensure all significant issues are resolved and core business operations remain unaffected.
The downside is that a parallel build can take more time to implement and is pricier from a hardware and resource perspective due to the need to operate two separate systems.
Parallel builds work best for migrating high priority sites like manufacturing plants and core business units.
Migration option II: Beachhead deployment
A beachhead deployment balances cost and risk. Under this approach, each site migration is completed as a series of events spanning several weeks (compared to a multi-month parallel build or a one-day cutover for direct migration).
In this approach, a small beachhead environment is deployed a few months before migration in which application teams can test and pre-load compute and network applications that will be pushed to production at a later date.
We proposed a dual beachhead approach, which involved one or both of the following deployment options:
- A development and test beachhead
- A production beachhead
The difference involves whether a production system is running on the beachhead.
In a development and test beachhead, applications are merely tested on the beachhead while the actual production migration occurs at final cutover. In a production beachhead, some selected applications are migrated before final cutover so they can be leveraged for production use.
Overall, a beachhead approach to site migration is less costly than a parallel build and can minimize final cutover risks through testing or partial production on the new network systems.
Migration option III: Direct migration
The direct migration method, often referred to as the "big bang" approach, is the least costly option but carries the highest risk. Because it does not require systems to run in parallel, it often results in faster, more affordable migrations. Yet the approach does come with the typical hazards associated with a single migration event. If that event is unsuccessful for any reason, business activities can be delayed.
This option is most appropriate when the migration focuses on a small system that's non-essential for core business operations. We do not typically recommend a direct migration for manufacturing or others processes that require machinery to run uninterrupted.
Key insight: Our customer chose the dual beachhead model above. This resulted in a carefully thought out and cost-conscious migration plan, which WWT later executed with great success.
Tip 2: On navigating regulatory compliance
The pharma and life sciences industries are highly regulated, as drug safety and efficacy must be rigorously reviewed. Additionally, manufacturing and R&D sites are generally overseen by governing bodies such as the Food and Drug Administration (FDA) and U.S. Department of Agriculture (USDA). Sites in these industries must also comply with applicable Good Manufacturing Practice (GMP) and Good Laboratory Practice (GLP) requirements.
Skirting quality assurance (QA) guidelines related to these regulations can result in hefty fines or other penalties for noncompliance, and both organizations and individuals can face disciplinary and legal consequences.
Documentation
Federal regulations require installation and validation documents for all site migration events, change management processes, risks, issues and back-out plans.
Our M&A team had to thoroughly document all infrastructure changes to ensure our proposed solutions met regulatory and compliance scrutiny. That meant becoming familiar with each requirement, producing the proper documentation and gaining approvals before we could initiate migration as part of the QA process.
WWT prepared the following qualification documents for each site in preparation for migration:
- Installation Qualification (IQ): A pre-approved set of instructions to build/install equipment, devices or software (signed by the installer).
- Operational Qualification (OQ): A pre-approved set of verification steps used to confirm the IQ process was completed properly (signed by the verifier).
- Performance Qualification (PQ): A pre-approved user acceptance test confirming all components work both individually and together as designed (signed by the tester and the customer's results verifier).
Creating proper documentation required all technical information to be accurate and in a mandated format that aligned with customer standards.
Key insight: A WWT dedicated QA team created, adopted and refined a process to ensure all documentation was peer reviewed and checked for formatting and consistency. This iterative process produced high quality documentation on time and in a highly repeatable fashion, making it easier to ensure compliance.
Change control
Once all QA documentation was created and approved for a given site migration, our team had to follow a "change control" process — a mechanism to ensure changes followed a defined course, were supported by proper documentation and were raised in a controlled manner.
WWT was required to produce comprehensive change requests for each migration event. Change requests included information about the implementation plan, risks and issues, impact to the business, and a back-out plan. All changes required approval from multiple stakeholders (via the customer's service management platform) to verify that planned migration activities complied with regulatory standards before implementation.
At any point during implementation or within the following five years, a government auditor can request a formal documentation review. Any violation of industry regulatory standards during this audit can result in a fine or other penalty for noncompliance.
Key insight: The first of many crucial steps to implementing our site migration strategy involved aligning with our customer on change control requirements, then educating the larger WWT team on the QA document and change strategy.
Tip 3: On the importance of post-migration hypercare
"Hypercare" refers to the elevated support delivered in the period immediately following migration that helps ensure seamless transition.
To effectively prioritize and manage issues, WWT logged all support requests in ServiceNow, the customer's service management platform, using the same method we used to track and handle issues during cutover and early life support (ELS). We designed our hypercare system to serve and stabilize the customer's regulated sites post migration.
WWT's hypercare services included:
- A five-day stabilizing period following successful exit from ELS services
- Calls directed through a contracted service desk for incident management
- Resolver groups created to address various migration related issues; the groups were broken down into four levels: L1, L2, L3, and L4 (break glass in case of emergency)
In most situations, WWT offers continued hypercare support. But in this case, we supported the customer as they transitioned to a managed service provider (MSP). The customer's MSP oversaw all migration of IT infrastructure post migration. WWT collaborated with the MSP on the transition plan and execution to minimize the customer's operational risk and ensure a seamless changeover.
Simplify your next migration
Companies in highly-regulated industries require special attention to the treatment of IT systems during site migrations. The three tips highlighted in this case study — limiting downtime, navigating regulatory compliance, and the importance of hypercare — are intended to shed light on some of the complexities involved with migrating manufacturing and R&D sites.
WWT is well-positioned to help our customers achieve true IT transformations — no matter how regulated the industry — through our end-to-end M&A services delivery offerings.
What hurdles are slowing down your IT site migrations? Let us know in the comments.