Manufacturing and process

Pharmaceutical

Pharma plants make medicines in validated batches, where every change needs approval and every record must be trustworthy. Security has to fit inside that discipline.

APIFormulationsPackaging and serialisation
Talk to an advisor For product makers

How the process runs

From molecule to released batch

Active ingredients are made, formulated into doses, tested, packed and released. Around them, utilities and cleanrooms hold conditions within GMP limits, and every step leaves an electronic record.

  1. Stage 1: API manufacture

    Active ingredients are made by chemical synthesis or fermentation.

    Control systems
    Batch DCSReactor and fermenter control
    Challenge1

  2. Stage 2: Formulation

    The API is blended, granulated, compressed or filled into doses.

    Control systems
    Granulation and compression PLCsFilling linesWeighing systems
    Challenge1

  3. Stage 3: Utilities and cleanrooms

    Purified water, HVAC and cleanrooms keep conditions within GMP limits.

    Control systems
    Purified water PLCsHVAC and BMSEnvironmental monitoring

  4. Stage 4: Quality control

    Labs test samples, and the results decide whether the batch is released.

    Control systems
    LIMSChromatography data systemsLab instruments
    Challenge2

  5. Stage 5: Packaging and serialisation

    Packs get unique serial numbers and are aggregated for traceability.

    Control systems
    Serialisation systemsVision inspectionLabellers
    Challenge3

  6. Stage 6: Batch record and release

    Electronic batch records document every step before QA releases the batch.

    Control systems
    MES and eBRHistorianAudit trails
    Challenge2
Across every stage

Attackers rarely go straight for a controller. They travel through these shared systems, so this is where we look first.

Validated computer systemsAudit trailsVendor support accessLink to ERP
Challenge4

For product makers

Building equipment for pharma plants?

Pharma equipment makers sell into validated plants, so the security features they build must also satisfy data integrity rules.

What makers build
  • Process and packaging equipment
  • Serialisation systems
  • Lab instruments and data systems
  • Environmental monitoring systems
  • MES and batch record software
What customers and regulators ask of the product
21 CFR Part 11 and EU GMP Annex 11

Customers expect audit trails, named accounts and controlled access built into the equipment.

EU Cyber Resilience Act

Equipment and software sold in the EU need CE marking under the CRA from 11 December 2027. Medical devices are outside the CRA.

IEC 62443-4-2

A certified security level shows customers what the product's security covers.

Where product makers start
EU CRA ComplianceGap to conformity assessmentIEC 62443-4-1 SDLC CertificationYour way of working, audit-proofIEC 62443-4-2 CSA CertificationThe features your product is missing

For plant owners

Where it gets hard, and how we tackle it

We start from how your process runs, fix what matters most first, and use what you already own wherever we can.

  1. 01 API manufacture02 Formulation

    Every patch is a validation change

    A change to a validated system needs change control and often re-testing. So patches wait, sometimes for years.

    How we tackle it

    We sort systems by GxP impact and agree a patch and change process with QA in advance, with compensating controls for systems that cannot be touched.

    Cybersecurity Program
  2. 04 Quality control06 Batch record and release

    Data integrity and security are the same fix

    Regulators expect records to be complete, consistent and accurate. Shared accounts, local admin rights and editable files on instruments are a data integrity finding and a security hole at once.

    How we tackle it

    One fix for both: named accounts, role-based access, protected audit trails and tested backups, mapped to 21 CFR Part 11, EU GMP Annex 11, revised Schedule M and IEC 62443.

    Gap Assessment
  3. 05 Packaging and serialisation

    Serialisation opens paths outward

    Serialisation systems exchange data with company servers and external repositories, creating routes from the packaging line to the outside world.

    How we tackle it

    We map every flow from line to enterprise to external repository, and put each one on a controlled conduit through a DMZ.

    Cybersecurity Solutions
  4. Across every stage

    A cyber incident becomes a supply problem

    NotPetya shut down production at Merck in 2017, and the company borrowed vaccine doses from a US government stockpile to meet demand. Source: Merck filing

    How we tackle it

    We rehearse recovery with QA, production and IT together: which batches are affected, which records can be trusted, and how fast you can restart.

    Incident Response TTX

Where plant owners usually start

Three ways in

01Gap AssessmentRapid maturity review02Cybersecurity ProgramPut everything in order03Awareness TrainingFor all plant & field staff

Rules and standards

What applies in pharmaceutical

  • IEC 62443International

    Zones, conduits and security levels for manufacturing and utility systems.

  • 21 CFR Part 11United States (FDA)

    Trustworthy electronic records and signatures, with audit trails and access control.

  • EU GMP Annex 11European Union

    Computerised systems used in GMP. A revision went to public consultation in 2025; the 2011 text still applies.

  • Revised Schedule MIndia

    Good manufacturing practice, with a section on computerised systems: validation and protection against unauthorised access or changes.

  • GAMP 5 (Second Edition)Industry guidance

    Risk-based validation of computerised systems, published by ISPE in 2022.

  • NIS2European Union

    Manufacturers of pharmaceutical products are in the health sector.

Talk to RelyBlue

Operating in pharmaceutical?

An honest conversation about your OT environment. No sales pressure, no fear tactics.

  • You talk to a senior advisor, never a salesperson