Standards

I work in medical device so 21 CFR Part 820 and ISO13485 are some of my governing regulations and I am curious how you demonstrate that your cloud-based software is and maintains a validated state. I have both an ERP and a PLM system that are both cloud-based. I do not know when or how frequently the system is being updated, especially any infrastructure components. 

That depends on how you track your changes, releases, and deployments in the Design History File and the Device Master Record.


Has this cloud-based software been released to production for clinical use, or is it still in the stages of development, verification, validation, or clinical testing?


Also, does validated state refer to the application itself, or its cloud-based environment?  What are your assertions of this validated state, and how do these reflect back on your risks?


FDA has published a series of decision trees for this purpose, so I recommend a careful review of the www.fda.gov website for software as medical devices.