Resource
Cloud & Compliance Glossary for Life Sciences
Last reviewed: October 2026
Definitions of essential cloud computing and regulatory compliance terms — from GxP and 21 CFR Part 11 to FinOps and MLOps — written for life sciences, biotech, and pharmaceutical professionals.
TL;DR: This glossary covers 45 terms essential for navigating cloud compliance in life sciences — including GxP, HIPAA, 21 CFR Part 11, Annex 11, FinOps, DevOps, IaC, and more. Bookmark it as a reference when evaluating cloud partners or reviewing regulatory requirements.
2
21 CFR Part 11
A US FDA regulation governing electronic records and electronic signatures in pharmaceutical and biotech contexts. Requires audit trails for all data changes, access controls preventing unauthorised modifications, and validated system performance. Any cloud system storing regulated electronic records must comply.
A
Annex 11
A European GMP (Good Manufacturing Practice) guideline governing computerised systems used in pharmaceutical manufacturing. The EU equivalent of 21 CFR Part 11, covering validation, data integrity, access controls, audit trails, and backup procedures for all computerised systems in GMP environments.
AWS (Amazon Web Services)
Amazon's cloud computing platform and the leading public cloud provider globally. AWS offers 200+ managed services including compute (EC2), storage (S3), databases (RDS, DynamoDB), AI/ML (SageMaker, Bedrock), and security services. AWS holds HIPAA-eligibility and supports GxP-validated environments.
AWS Bedrock
A fully managed AWS service that provides access to foundation models (FMs) from leading AI companies including Anthropic (Claude), Meta (Llama), and Amazon (Titan). Bedrock enables life sciences companies to build generative AI applications without managing underlying model infrastructure, with enterprise-grade security controls.
AWS SageMaker
Amazon SageMaker is a fully managed machine learning platform that enables data scientists and developers to build, train, and deploy ML models at scale. In life sciences, SageMaker is used for drug discovery, clinical trial analysis, and regulatory document processing, with support for GxP validation workflows.
AWS Shared Responsibility Model
A security framework defining what Amazon Web Services secures (the physical infrastructure, hypervisor, and managed service components — 'security of the cloud') versus what the customer must secure (operating systems, applications, data, and access controls — 'security in the cloud'). Life sciences organisations must understand their obligations within this model.
AI Delivery Lifecycle (ADLC)
A four-stage method for using AI to build cloud infrastructure and code in regulated environments: Scope, Orchestrate, Stop-Before-Deploy, and Run. AI assists at each stage, but a mandatory human checkpoint reviews generated output, checks drift and conformance, and captures validation evidence before anything is deployed. ADLC is how AI-assisted engineering keeps a validated state intact.
Agentic AI
AI systems that can take actions rather than only produce text — calling tools, querying systems and executing multi-step tasks toward a goal. In regulated environments, agentic AI needs guardrails, action logging and a record of what the agent did and why, so its behaviour can be reviewed, reproduced and validated.
C
Change Control
A formal process governing modifications to validated systems, processes, or infrastructure. In regulated environments, all changes must be documented, risk-assessed, approved, and validated before implementation. Cloud infrastructure changes in GxP environments must go through change control to maintain validated state.
CI/CD (Continuous Integration / Continuous Deployment)
Software engineering practices where code changes are automatically built, tested, and deployed. In life sciences, CI/CD pipelines must be adapted for GxP compliance — incorporating automated validation testing, audit trails, and documented evidence of each deployment to satisfy regulatory requirements.
Cloud Migration
The process of moving data, applications, and infrastructure from on-premises environments (or other clouds) to a cloud platform such as AWS. In life sciences, cloud migration must include a comprehensive validation strategy, risk assessment, and data integrity verification to maintain regulatory compliance throughout the transition.
Compliance-as-Code
The practice of encoding regulatory compliance requirements as automated, machine-executable policies using tools like AWS Config, HashiCorp Sentinel, or Open Policy Agent. Enables continuous compliance monitoring and automated remediation, replacing manual audit processes. Increasingly adopted in pharma and biotech cloud environments.
CRO (Contract Research Organisation)
A company that provides outsourced research services to pharmaceutical, biotechnology, and medical device industries. CROs handle clinical trials, data management, and regulatory submissions, and are subject to the same GxP and data integrity regulations as their sponsors. Cloud environments used by CROs must be appropriately validated.
D
Data Integrity
The assurance that data is complete, consistent, and accurate throughout its lifecycle. Governed by the ALCOA+ principles (Attributable, Legible, Contemporaneous, Original, Accurate, plus Complete, Consistent, Enduring, Available). A core requirement of GxP regulations and a primary focus of FDA and MHRA regulatory inspections.
DevOps
A set of practices combining software development (Dev) and IT operations (Ops) to shorten development cycles and deliver continuous, reliable software. In life sciences, DevOps must be adapted to meet GxP validation requirements, creating 'GxP DevOps' or 'validated DevOps' workflows that balance agility with regulatory compliance.
DevSecOps
An extension of DevOps that integrates security practices throughout the development and deployment pipeline. Security testing, vulnerability scanning, and policy enforcement are automated into CI/CD pipelines. Critical in regulated industries where security failures can result in data breaches of sensitive patient or research data.
Drift & Conformance
Continuous checks that a deployed system still matches its validated baseline. Drift detects changes that have crept in over time; conformance confirms configuration and behaviour still meet the documented specification. Both feed evidence into change control and audits.
E
ELN (Electronic Laboratory Notebook)
A digital replacement for paper laboratory notebooks used to record scientific experiments and observations. ELNs in regulated environments must comply with 21 CFR Part 11 and/or Annex 11, requiring audit trails, electronic signature capabilities, and validated performance. Cloud-hosted ELNs must demonstrate security and data integrity controls.
EU AI Act
The European Union's regulation governing AI systems placed on the EU market or used in the EU. It sorts systems into risk tiers with matching obligations, from transparency duties for limited-risk tools to strict requirements for high-risk uses. Life-sciences tools can fall into different tiers depending on what their output affects.
F
FinOps
A cloud financial management discipline and cultural practice that enables organisations to get maximum business value from their cloud investment through collaboration between engineering, finance, and operations teams. The FinOps Foundation defines the framework. In life sciences, FinOps is critical as compute costs can spike during R&D-intensive periods.
G
GCP (Good Clinical Practice)
An international ethical and scientific quality standard for designing, conducting, recording, and reporting clinical trials. Governed by ICH E6(R2). In a cloud context, systems managing clinical trial data must be validated to GCP standards, with appropriate access controls, audit trails, and data backups.
GDPR (General Data Protection Regulation)
EU regulation governing the processing of personal data of EU individuals, effective from 2018. In life sciences, GDPR applies to clinical trial participant data, patient records, and employee data. Cloud providers processing EU personal data must have appropriate data processing agreements and technical safeguards in place.
GLP (Good Laboratory Practice)
A quality system governing the organisational processes and conditions under which non-clinical health and environmental safety studies are planned and performed. Relevant to preclinical testing organisations. Cloud systems storing GLP study data must maintain data integrity, audit trails, and access controls consistent with GLP requirements.
GMP (Good Manufacturing Practice)
Regulations ensuring that products are consistently produced and controlled according to quality standards. In pharma, GMP covers manufacturing processes from raw materials to finished products. Cloud systems supporting GMP processes (batch records, LIMS, MES) must be validated under the appropriate GMP guidelines (e.g., EU GMP Annex 11).
GxP
A collective term for Good Practice (GxP) quality guidelines and regulations used in the life sciences industry. The 'x' stands for a placeholder covering GMP (Manufacturing), GLP (Laboratory), GCP (Clinical), and GDP (Distribution). GxP regulations require validation of computer systems, data integrity, audit trails, and documented change control.
Guardrails
Controls that constrain what an AI system may do or say — for example limiting the data it can access, blocking disallowed outputs, or requiring approval before an action is taken. Guardrails reduce the risk of an AI system producing or doing something that breaches policy or regulation.
H
HIPAA (Health Insurance Portability and Accountability Act)
A US federal law establishing national standards for protecting sensitive patient health information (PHI). HIPAA's Technical Safeguards require: access controls, audit controls, integrity controls, and transmission security for PHI. AWS is HIPAA-eligible and a Business Associate Agreement (BAA) must be signed with AWS for HIPAA-compliant deployments.
HITRUST CSF
The Health Information Trust Alliance Common Security Framework — a certifiable security framework combining requirements from HIPAA, NIST, ISO 27001, and other standards. Increasingly required by healthcare and biopharma organisations when evaluating technology vendors and cloud service providers.
I
IaaS (Infrastructure as a Service)
A cloud computing model where virtualised computing infrastructure (servers, storage, networking) is provided on demand over the internet. AWS EC2, EBS, and VPC are examples. IaaS gives the most control but requires the most management. Appropriate for workloads requiring custom operating system configuration or specialised compliance tooling.
IaC (Infrastructure as Code)
The practice of managing and provisioning cloud infrastructure through machine-readable configuration files rather than manual processes. Tools include Terraform, AWS CloudFormation, and AWS CDK. IaC enables version-controlled, repeatable, and auditable infrastructure deployments — critical for maintaining a validated state in regulated cloud environments.
ISO 27001
An international standard specifying requirements for an Information Security Management System (ISMS). ISO 27001 certification demonstrates that an organisation has implemented a comprehensive, systematic approach to managing information security risks. Increasingly required by life sciences enterprise buyers when selecting cloud and IT service providers.
L
LIMS (Laboratory Information Management System)
Software used to manage laboratory data, samples, workflows, and reporting. In regulated environments, LIMS must be validated under 21 CFR Part 11 or Annex 11. Cloud-hosted LIMS solutions offer scalability and disaster recovery advantages but require validation of the cloud hosting environment as part of the LIMS validation package.
M
MLOps (Machine Learning Operations)
A set of practices that combines ML, DevOps, and data engineering to deploy and maintain ML models in production reliably and efficiently. In life sciences, MLOps must incorporate model versioning, validation documentation, and change control to meet regulatory expectations for AI/ML systems used in regulated processes.
Model Validation
The documented process of demonstrating that an AI or machine-learning model performs as intended for its defined use, consistently and reproducibly. It covers training data, methodology, testing and performance criteria, and is required before a model influences a regulated decision.
P
PaaS (Platform as a Service)
A cloud computing model where a managed platform is provided for developing and deploying applications, without managing the underlying infrastructure. AWS Elastic Beanstalk and AWS Lambda are PaaS examples. Reduces operational overhead but limits infrastructure control — relevant consideration for regulated workloads requiring specific configuration evidence.
R
Reserved Instances
AWS pricing model allowing customers to commit to using specific instance types for 1 or 3 years in exchange for discounts of up to 72% versus on-demand pricing. Best suited to predictable, always-on workloads such as databases, LIMS systems, and ELN platforms. Part of a FinOps strategy for life sciences organisations.
Retrieval-Augmented Generation (RAG)
A technique that grounds a language model's answers in an organisation's own documents. Relevant content is retrieved from a controlled source and supplied to the model with the question, so responses cite real material rather than relying on training data alone. RAG is widely used for regulated document sets where source traceability matters.
S
SaaS (Software as a Service)
A cloud software delivery model where applications are hosted by the provider and accessed via the internet. Examples include Veeva Vault, Microsoft 365, and Salesforce. For life sciences SaaS, customers must conduct vendor qualification, review the provider's validation documentation, and establish data processing agreements aligned with regulatory requirements.
SOC 2 Type II
An auditing standard developed by the AICPA assessing a service organisation's controls around security, availability, processing integrity, confidentiality, and privacy. A SOC 2 Type II report covers a period of time (typically 6–12 months) and is commonly required by enterprise life sciences buyers when evaluating cloud and software service providers.
Spot Instances
Unused AWS EC2 capacity available at up to 90% discount versus on-demand pricing. Spot Instances can be interrupted with 2-minute notice. Ideal for fault-tolerant, stateless workloads such as batch genomics processing, ML training jobs, and parallel data analysis. Not appropriate for production databases or continuously running regulated systems.
Stop-Before-Deploy
The mandatory human checkpoint in our AI Delivery Lifecycle. AI-generated infrastructure and code pause here for review, drift and conformance checks against the validated baseline, and capture of validation evidence. Nothing proceeds to a regulated environment until a named person has reviewed and approved it.
Scope 3 (cloud)
Indirect greenhouse-gas emissions from an organisation's value chain, including purchased cloud services. Cloud compute generates Scope 3 emissions through the energy data centres consume. Measuring compute hours, instance types and energy per workload lets organisations report the carbon impact of their cloud alongside its cost.
T
Terraform
An open-source Infrastructure as Code (IaC) tool by HashiCorp that enables cloud infrastructure to be defined in declarative configuration files and deployed consistently across environments. Widely used in life sciences for managing AWS infrastructure with version control and audit trails — enabling repeatable, validated infrastructure deployments.
V
Validation (Computer System Validation / CSV)
A documented process demonstrating that a computer system consistently produces results meeting predetermined specifications and quality attributes. Required for computerised systems in GxP environments. Validation documentation includes User Requirements Specification (URS), Functional Specification (FS), Installation Qualification (IQ), Operational Qualification (OQ), and Performance Qualification (PQ).
VPC (Virtual Private Cloud)
A logically isolated section of the AWS cloud where you can launch resources in a virtual network you define. VPCs provide network-level security through subnets, route tables, and security groups. In regulated environments, VPC architecture is a core component of the security and isolation controls required under GxP, HIPAA, and ISO 27001.
Need Help Navigating Compliance in the Cloud?
skyPurple Cloud specialises in GxP, HIPAA, and 21 CFR Part 11-compliant AWS deployments for life sciences.