Key Systems
Definiton
Key systems are a subset of applications that matter most to CS COE. They are identified through a multi-lens assessment covering business criticality, user impact, stakeholder and regulatory importance, architecture centrality, data criticality, transformation leverage, and technical or operational fragility. A system may qualify as key through high importance in one critical dimension or through combined importance across several dimensions.
Evaluation Lenses
Business Criticality
A key system is essential to core operations, service delivery, or critical business processes. It is the primary source of truth that directly supports core Pharma R&D capabilities. It directly supports core capabilities such as study planning and execution, biological and molecular data handling, registration, decision support, scientific workflows, or portfolio delivery. Examples include workflow management systems for biological and molecular data, study registration platforms such as FISH, large molecule registration systems such as TAPIR, and decision-support data platforms such as BDS.
User Impact
A key system materially affects the productivity, experience, or effectiveness of a large or critical user group. This includes systems that are heavily relied upon by scientists, data stewards, operational teams, and other stakeholders involved in research and early development.
Stakeholder and Regulatory Importance
A key system is essential for meeting stakeholder expectations, governance requirements, compliance obligations, or formal control needs. This includes systems that support auditability, regulated processes, management oversight, reporting obligations, or external commitments. Such systems may be key even if they have a limited number of users, provided that failure or weakness would create disproportionate compliance, governance, or decision-making risk.
Qualification Criteria
A system may be classified as a key system if it meets one or more of the following criteria:
-
It is classified as critical or significant according to ITSM criteria.
-
It is assessed as high risk in the System Risk Assessment (SRA).
-
It has high architectural centrality, i.e., many applications (at least 10) depend on it, or it acts as a major integration point.
-
It is a system of record or authoritative source for critical R&D data.
A system does not need to meet all of these criteria. A strong rating in one critical dimension, or a combination of importance across multiple dimensions, may be sufficient.
Mandatory Governance Requirements for Key Systems
Once a system has been classified as a key system, the following mandatory governance requirements apply:
-
It must have a fully approved System Risk Assessment (SRA).
-
It must have a completed control assessment in line with KB5049887 IRM - SRA: Control Assessment.
-
Its ownership, lifecycle, and architectural positioning should be clearly documented and maintained.
-
Its major dependencies, integrations, and critical data relationships should be understood and traceable.
These governance requirements do not define whether a system is key; rather, they are mandatory expectations for systems that have been identified as key.
Excluded Systems
A key system does not normally include systems classified as moderate or minor according to ITSM criteria, unless they are demonstrated to be highly important through another key-system lens, such as critical data ownership, architecture dependency centrality, or regulatory or stakeholder importance.