What top 50 pharmaceutical companies should ask a vendor once the security certificate is on the table
When a top 50 pharmaceutical company asks, during GxP vendor qualification, whether a vendor can be trusted with regulated content, the answer splits in two.
A certificate is the right place to start. ISO/IEC 27001 and a current SOC 2 report tell a buyer the supplier runs a security program someone else has looked at. They don’t tell the buyer whether a sentence in a label, a protocol, or a CMC section can still be traced to the person who approved it. That second question is the one that protects the work.
The two questions answer to different frameworks. ISO/IEC 27001 and SOC 2 assess security controls. 21 CFR Part 11 and EU GMP Annex 11 govern electronic records and computerised systems used in regulated work. Both are necessary, as evidence from the first group does not stand in for evidence against the second.
The gap shows up in an inspection. An inspector asks who approved a line in a label, and when. If the answer depends on someone’s memory, the certificate on file does not help.
There is a simpler question, and it deserves a plain answer. When a vulnerability is in the news, buyers want to know whether the vendor is exposed. A vendor that takes the question seriously answers it in a dated statement, published with its other standing security positions where a buyer can find it later. That statement answers the exposure question. The harder question is what happens to the content after the certificate has been filed.
What the Certificate Covers
An ISO/IEC 27001 certificate is useful when its scope covers the service the buyer is actually buying, and when the supplier can show how issues are found, owned, and closed. ISO describes the standard as the requirements for establishing, implementing, maintaining, and continually improving an information security management system, and asks that certification be cited by full reference, as in “certified to ISO/IEC 27001:2022.”[1][7] The certificate attests to that management system within its stated scope. Reading the scope statement against the contracted service is the first check.
A SOC 2 report is useful when the reader checks the period, the categories in scope, and the exceptions. SOC 2 sits within the AICPA’s System and Organization Controls services, which CPAs use to report on controls at a service organization so that users can assess the risks of outsourcing a service.[2] The period shows the window the report covers. The categories show which Trust Services Criteria were in scope.[2] The exceptions show where controls did not operate as described. A report that describes a different system is a different conversation.
When the Content Changes
Then comes the question a quality or regulatory lead on the buyer’s side of the table would ask: when this content changes, what happens?
Who can see a statement, and who can change it? A shared folder is a poor place to govern a component that will appear in more than one market. Role-based access, tied to the job, is what still holds when the team changes. Annex 11 expects the creation, change, and cancellation of access authorisations to be recorded.[3]
What record does the change leave? An audit trail that names the person and the time, from authoring through review and publication, is what an inspector can use when no one in the room remembers the meeting. Part 11 calls for secure, computer-generated, time-stamped audit trails, and states that record changes shall not obscure previously recorded information.[4] If that history has to be rebuilt from email, the control was never in the lifecycle. For a component reused across labels or markets, the record also has to show which approved version went where.
How long does the record last? Part 11 requires records to be protected for accurate and ready retrieval throughout the retention period, and audit trail documentation to be kept at least as long as the records it describes.[4]
Where does the content live, and how is it protected on the way there and while it rests? Region, encryption, and the boundary of a multi-tenant service are procurement questions. They’re also quality questions. Product and safety information doesn’t become less sensitive because it is called content.
Can the customer’s own team validate the system for the way it intends to use it? Support for 21 CFR Part 11 and EU Annex 11 matters because workflow, access, and records have to be shown to work in the customer’s process, with evidence that goes beyond a description on a security page. Which regulation applies depends on the record and the market; Annex 11, for example, covers computerised systems used in GMP-regulated activities.[3] Part 11 places validation on the persons who use closed systems to create, modify, maintain, or transmit electronic records.[4] Vendor evidence can inform that work**, and ISPE’s GAMP 5 guide encourages regulated companies to leverage supplier involvement and documentation where possible.[8]** Accountability for the validated state stays with the regulated company.
The European Commission released a revised draft of Annex 11 for stakeholder consultation in July 2025, alongside a revised Chapter 4 and a new Annex 22 on artificial intelligence.[5] The consultation has since closed.[5] Teams planning Annex 11 supplier qualification should confirm the current status on the Commission’s EudraLex pages before relying on either text.
What a Strong Answer Looks Like in GxP Vendor Qualification
A vendor with a strong security footprint will put the certificate on the table and then walk access, change, approval, reuse, and retention without changing the subject. Each of those maps to a record. Access maps to role assignments and their history. Change maps to the audit trail. Approval maps to the signature and its permanent link to the record.[3] Reuse maps to which approved version of a component appears where. Retention maps to how long those records, and their audit trails, stay retrievable. That is how a regulated company avoids the answer no one wants to give an inspector: “We’re checking.”
This is the standard Docuvera publishes: ISO/IEC 27001 and SOC 2 Type 2 for the security program; role-based access; an audit trail across authoring, review, and publication; encryption in transit and at rest; and support for validation against 21 CFR Part 11 and Annex 11. The evidence sits in the trust center.
The certificate gets you in the room. The lifecycle has to answer once you are there.
Frequently Asked Questions
Editorial note
This article reflects Docuvera’s experience supporting structured content programs in regulated life sciences. Regulatory interpretations are based on the cited source materials and should be assessed against each organization’s products, intended uses, quality system, and applicable predicate requirements.
Sources
- ISO. “ISO/IEC 27001:2022 Information security, cybersecurity and privacy protection — Information security management systems — Requirements.” October 2022. iso.org
- AICPA & CIMA. “System and Organization Controls: SOC Suite of Services.” Accessed October 2026. aicpa-cima.com
- European Commission. “EudraLex Volume 4, Annex 11: Computerised Systems.” 2011 (in operation from June 30, 2011). health.ec.europa.eu
- U.S. Food and Drug Administration. “21 CFR 11.10 Controls for closed systems.” eCFR, current as of October 21, 2026. ecfr.gov
- European Commission. “Stakeholders’ Consultation on EudraLex Volume 4 — Good Manufacturing Practice Guidelines: Chapter 4, Annex 11 and New Annex 22.” July 2025. health.ec.europa.eu
- U.S. Food and Drug Administration. “Data Integrity and Compliance With Drug CGMP: Questions and Answers.” December 2018. fda.gov
- ISO. “Can I use the ISO logo?” ISO Help Center. Accessed October 2026. help.iso.org
- ISPE. “GAMP® 5 Guide, 2nd Edition: A Risk-Based Approach to Compliant GxP Computerized Systems.” July 2022. ispe.org
