Industry Brief: Pharma and Life Sciences Cyber Risk Priorities

Why pharma and life sciences is different

A life-sciences company holds three kinds of valuable things. The first is knowledge that took years and large budgets to produce. The second is records whose integrity regulators examine, from batch records to trial data. The third is health information about patients and trial participants. Few sectors combine all three.

Almost none of this is held alone. Contract research organizations, contract manufacturers, distributors, patient-support hubs and academic collaborators each hold part of a program. Accountability, however, tends to stay with the sponsor.

Regulatory exposure also varies by location. Under the EU NIS2 Directive, the health sector in the high-criticality list includes research and development of medicinal products and the manufacture of basic pharmaceutical products and preparations. Large entities are classed as essential and medium-sized ones as important. National transposition varies, so check how each member state where you operate has applied it.

Five priorities at a glance

1. Research IP: protect by program, not by site

An advisory published by the UK National Cyber Security Centre and endorsed by CISA described a campaign by APT29 against organizations involved in COVID-19 vaccine development in Canada, the United States and the United Kingdom. The advisory assessed the targeting as highly likely intended to steal information and intellectual property relating to the development and testing of vaccines. It also noted that the group predominantly targets government, diplomatic, think-tank, healthcare and energy organizations, and described custom malware, WellMess and WellMail, not previously associated with the group.

The advisory concerns one therapeutic area, but the logic is general. A state or competitor with an interest follows the value of a pipeline, not the size of the company holding it. That is interpretation, though it explains why a mid-sized biotech with one strong asset can be as attractive as a large manufacturer.

The decision is to identify programs by value, using stage, indication and partnership terms, and to concentrate controls on the systems where each program’s data lives: electronic lab notebooks, laboratory information systems, data platforms, shared drives and partner portals. Review who outside the project team can reach that data, and assume collaborators’ accounts are targeted as well.

2. Patient and trial data wherever it sits

As reported by BleepingComputer, Cencora, a drug distributor that also runs patient-support services for manufacturers, disclosed that unauthorized parties had accessed its systems and taken personal data. Its investigation found full names, addresses, health diagnoses, medications and prescriptions had been exposed. The data was held in connection with patient-support programs. Eleven drug companies then filed near-identical breach notices with the California Attorney General, each tying its exposure to the Cencora incident.

The facts above are reported. What follows is interpretation: when a hub or service provider is breached, each sponsor has to assess and notify for its own program, so accountability stays with the company whose patients they are. The sponsor learns of the event, and decides what to say, under the provider’s timeline.

Where GDPR applies, the controller must notify the supervisory authority within 72 hours of becoming aware of a breach, where feasible, and a processor must alert the controller without undue delay. Map the data flow for each program: collection sites, laboratories, CROs, hub vendors and analytics providers, noting what data each holds. Pseudonymize wherever the work allows. Write notification time into every contract, and rehearse a notification with the largest partners so the first time is not a real one.

3. The partner chain: use the qualification process you already have

EU GMP Annex 11 already expects formal agreements between the manufacturer and any third party that provides, configures, validates, maintains or hosts a computerized system or its data, with the third party’s responsibilities stated clearly. It treats supplier competence and reliability as key selection factors, makes the need for an audit a matter of risk assessment, and expects supplier quality information to be available to inspectors on request.

Quality functions in regulated manufacturers already qualify suppliers on that basis. In many companies security runs a parallel questionnaire cycle that gets less attention and duplicates the effort. The better route is to build security evidence into the supplier qualification that quality already operates, and to tier partners on three factors: the data they hold, how critical they are to GxP operations, and what access they have into your environment.

Ask partners for proof of the controls that matter for the data they hold, such as access control, logging, incident notification and sub-contractor handling, instead of a generic attestation.

4. GxP integrity: a cyber failure is a data-integrity event

The regulatory texts read like security requirements written by quality people. Under 21 CFR Part 11, anyone using closed systems to create, modify, maintain or transmit electronic records must apply controls to ensure authenticity and integrity: access limited to authorized individuals, secure, computer-generated, time-stamped audit trails recording operator actions that create, modify or delete records, and authority checks on who may sign or alter records. EU GMP Annex 11 asks for logical access controls proportionate to system criticality, records of access authorizations being created, changed or canceled, audit trails that are available and regularly reviewed, tested business continuity for critical processes, backups checked for restorability, and assessment of all incidents, with root-cause analysis for critical ones.

Our judgment is that the practical consequence is that a compromise of a validated system raises a second question beyond scope: can the data still be trusted? An attacker, or an administrator with excessive rights, who can alter a record without a trustworthy audit trail turns an intrusion into a quality problem. Recovery then needs evidence of integrity, not just restored service.

Two decisions follow. First, give the CISO and the head of quality shared ownership of privileged access to validated systems, audit-trail review and incident assessment, so that neither team learns of a problem from the other after the fact. Second, agree an emergency change route in advance. Change control built for planned releases can delay urgent security patches on validated systems, and the time to argue about that is not during an exploited vulnerability. Include laboratory instruments and manufacturing equipment run by computerized systems, because they fall under the same expectations.

5. Collateral destructive events

NotPetya hit Merck through accounting software supplied by a Ukrainian company. Merck said the malware caused more than $1.4 billion in losses. Its insurers argued that a war or hostile-action exclusion applied. A New Jersey appellate court held that the exclusion did not bar the claim, because it applies to military action, and the court did not reach an attack on a nonmilitary commercial software provider.

Two lessons sit in that single case. The operational one: a trusted supplier’s update path can deliver destructive malware that was not aimed at you, so recovery planning that starts from the IT estate alone will miss the plants and laboratories that depend on it. The financial one: the coverage question went to court, and policy wording on state-backed and hostile acts differs between policies and keeps changing, so a favorable ruling for one company is not a guarantee for another.

Run the scenario. Lose ERP, manufacturing execution and quality-control systems together. Establish the manual fallback for each, the recovery order, and the point at which supply to patients is affected. Then walk the scenario through your insurance with the broker and finance, reading the exclusions against it.

Decisions for leadership

1. Name the crown-jewel programs and ring-fence the systems that hold their data, with reviewed access for collaborators.

2. Map patient and trial data flows for each program, including hubs and CROs, and set notification times in contract.

3. Build security evidence into supplier qualification and tier partners by data held, GxP criticality and access.

4. Give the CISO and head of quality shared ownership of privileged access, audit-trail review and incident assessment on validated systems.

5. Agree an emergency change route for security patches on validated systems before it is needed.

6. Run the loss-of-core-systems scenario with finance and the broker, and test restores with integrity evidence.

What to track

Five measures show whether these decisions are holding:

• Crown-jewel programs with a named owner and a recent access review.

• Partners holding patient or trial data with a tested notification path.

• Validated systems whose audit-trail review is visible to security as well as quality.

• Time to approve an emergency security change on a validated system.

• Date and result of the last restore test that included an integrity check.

Sources

• Advisory: APT29 targets COVID-19 vaccine development. UK National Cyber Security Centre, endorsed by CISA.

• Cencora data breach exposes US patient info from 11 drug companies. BleepingComputer.

• Warlike-action exclusion didn’t protect insurer in Merck’s cyberattack claim, appeals court says. ABA Journal.

• 21 CFR Part 11, Electronic Records; Electronic Signatures. Electronic Code of Federal Regulations.

• EU GMP Annex 11: Computerized Systems. European Commission.

• GDPR Article 33: Notification of a personal data breach to the supervisory authority. GDPR text, gdpr-info.eu.

• NIS2 Guide. National Cyber Security Centre, Ireland.