# Deploy Plan > Create deployment plans for validated GxP environments including validation impact assessment, pre-deployment checklists, deployment steps with rollback criteria, post-deployment verification, and GxP documentation. - Skill: `nroze22/deploy-plan` (Agent Skill) - Install (CLI): `npx skillmds@latest add nroze22/deploy-plan` - Raw SKILL.md: https://api.skillmd.com/api/skills/nroze22/deploy-plan/raw - Safety review: pending - Works with: Claude Code, Claude.ai, OpenAI Codex - Category: DevOps & Infra - Author: nroze22 (https://skillmd.com/u/nroze22) - Updated: 2026-09-17 - Page: https://skillmd.com/skills/nroze22/deploy-plan --- # Deployment Plan for Validated Environments ## Purpose Create deployment plans for releasing software changes to Talosix validated EDC production environments. Deployments to GxP systems require formal planning, validation impact assessment, documented execution, and post-deployment verification to maintain the validated state. ## When to Use - Any deployment to production GxP environments - Deployments to staging/pre-production environments used for validation - Infrastructure changes affecting validated systems - Database changes (schema, data migration) - Configuration changes to production - Emergency hotfix deployments ## Deployment Plan Document Structure ### Header ``` DEPLOYMENT PLAN Document ID: DP-[RELEASE]-[SEQ] Release: [Release identifier / version] System: [System name] Target Env: [Production / Staging / DR] Planned Date: [DATE] Planned Window: [START TIME - END TIME, TIMEZONE] Author: [Name, Role] Technical Lead: [Name] QA Approver: [Name] System Owner: [Name] Related Documents: - Change Request: CR-[ID] - Validation Protocol: [ID] (if applicable) - Release Notes: [ID] ``` ### Section 1: Release Summary ``` Release Version: [X.Y.Z] Changes Included: | Change ID | Description | Type | Risk Level | |-----------|------------|------|------------| | CR-XXX | [Brief description] | Feature/Fix/Config | High/Med/Low | Changes Excluded / Deferred: | Change ID | Description | Reason for Deferral | |-----------|------------|-------------------| ``` ### Section 2: Validation Impact Assessment Evaluate each change against validation criteria: ``` | Change ID | Affects Validated Function | Revalidation Required | Test Scope | Validation Docs Updated | |-----------|--------------------------|----------------------|-----------|----------------------| ``` #### Validation Impact Categories **No Impact** - Change does not affect any validated functionality. - Cosmetic changes with no data handling impact - Internal refactoring with identical external behavior (confirmed by regression testing) **Minor Impact** - Change affects validated functionality but within existing validated scope. - Regression testing required - Existing test cases re-executed - No new validation documentation required **Major Impact** - Change extends or modifies validated functionality. - New or updated validation protocols required - New test cases required - Traceability matrix update required - Validation summary report addendum required **Critical Impact** - Change affects core GxP functions (audit trail, e-signatures, access controls, data integrity). - Full validation protocol execution required - Independent QA verification required - Regulatory notification assessment required ### Section 3: Pre-Deployment Checklist Complete all items before deployment begins: ``` Approvals: [ ] Change request approved by CCB [ ] Deployment plan approved by QA [ ] Deployment plan approved by System Owner [ ] Deployment window confirmed (no conflicts with active studies) [ ] Study teams notified of planned downtime [ ] Client notification sent (if required) Technical Readiness: [ ] All code changes merged to release branch [ ] Release build created and tagged in version control [ ] Build artifacts verified (checksums match) [ ] Release notes finalized [ ] Database migration scripts reviewed and tested [ ] Configuration changes documented Testing Readiness: [ ] All validation testing complete in staging/pre-prod [ ] Validation test results reviewed and approved [ ] Regression testing complete [ ] No open critical or high defects [ ] UAT sign-off obtained (if applicable) [ ] Performance testing complete (if applicable) Environment Readiness: [ ] Production environment health verified [ ] Database backup completed and verified [ ] Application backup completed [ ] Configuration backup completed [ ] Monitoring alerts acknowledged or silenced for window [ ] Support team on standby Rollback Readiness: [ ] Rollback procedure documented and reviewed [ ] Rollback tested in staging (for major releases) [ ] Rollback decision criteria defined [ ] Rollback authorization chain confirmed [ ] Database rollback scripts prepared and tested Documentation Readiness: [ ] Deployment runbook prepared [ ] Post-deployment verification checklist prepared [ ] Communication templates prepared (success / rollback) ``` ### Section 4: Deployment Steps Document each step with precision: ``` Step | Time | Action | Responsible | Verification | Notes -----|------|--------|-------------|--------------|------ 1 | T+0:00 | Begin deployment window; confirm team readiness | Deploy Lead | Roll call complete | 2 | T+0:05 | Set system to maintenance mode | SysAdmin | Maintenance page displayed | Users see maintenance notice 3 | T+0:10 | Verify all active sessions closed | SysAdmin | Zero active sessions | Wait up to 5 min for sessions to close 4 | T+0:15 | Execute production database backup | DBA | Backup file verified, checksum recorded | 5 | T+0:25 | Execute database migration scripts | DBA | Scripts complete without error; row counts verified | 6 | T+0:35 | Deploy application release | Deploy Lead | Deployment tool shows success | 7 | T+0:40 | Update application configuration | SysAdmin | Config values verified | 8 | T+0:45 | Execute smoke tests | QA | All smoke tests pass | GO/NO-GO decision point 9 | T+0:50 | Execute post-deployment verification | QA | All verification checks pass | 10 | T+1:00 | Remove maintenance mode | SysAdmin | Application accessible | 11 | T+1:05 | Verify system accessible to users | QA | Login and basic navigation confirmed | 12 | T+1:10 | Send deployment complete notification | Deploy Lead | Notification sent | 13 | T+1:15 | Monitor system for 30 minutes | SysAdmin | No errors in logs | 14 | T+1:45 | Close deployment window | Deploy Lead | Deployment log completed | ``` For each step, also note: - Estimated duration - What constitutes success - What constitutes failure and triggers rollback consideration ### Section 5: Rollback Criteria and Procedure #### Rollback Decision Criteria Rollback is triggered if any of the following occur: ``` Automatic Rollback Triggers (no discussion needed): - Data corruption detected - Audit trail not functioning - Electronic signatures not functioning - System inaccessible after deployment - Database migration failure Judgment-Based Rollback Triggers (Deploy Lead + QA decision): - Smoke test failures in non-critical areas - Performance degradation beyond threshold - Unexpected error patterns in logs - Partial functionality loss ``` #### Rollback Authorization ``` Standard Release: Deploy Lead can authorize rollback Critical Systems: Deploy Lead + QA + System Owner authorization required (verbal authorization acceptable, documented within 24h) ``` #### Rollback Steps ``` Step | Action | Responsible | Verification -----|--------|-------------|------------- R1 | Announce rollback decision | Deploy Lead | Team acknowledged R2 | Set system to maintenance mode | SysAdmin | Maintenance page displayed R3 | Execute database rollback | DBA | Database restored; data verification R4 | Restore application to previous version | Deploy Lead | Previous version deployed R5 | Restore configuration to previous state | SysAdmin | Configuration verified R6 | Execute smoke tests on restored system | QA | All smoke tests pass R7 | Remove maintenance mode | SysAdmin | System accessible R8 | Send rollback notification | Deploy Lead | Stakeholders notified R9 | Document rollback in deployment log | Deploy Lead | Log complete R10 | Schedule root cause analysis | QA | Meeting scheduled within 24h ``` ### Section 6: Post-Deployment Verification #### Immediate Verification (within deployment window) ``` Core GxP Functions: [ ] User login with correct credentials succeeds [ ] User login with incorrect credentials fails [ ] Role-based access controls enforce correctly [ ] Audit trail records actions with correct metadata [ ] Electronic signature captures all required fields [ ] Data entry saves correctly [ ] Edit checks fire as configured [ ] Query workflow functions [ ] Data export produces correct output [ ] Reports generate correctly System Health: [ ] Application logs show no errors [ ] Database connections stable [ ] Response times within acceptable range [ ] Background jobs/schedulers running [ ] Integration endpoints responding [ ] Monitoring tools showing healthy status ``` #### Extended Verification (24-48 hours post-deployment) ``` [ ] Overnight batch processes completed successfully [ ] Automated backup completed successfully [ ] No user-reported issues [ ] Error log review (no new error patterns) [ ] Performance metrics within normal range [ ] Audit trail completeness check (sample review) [ ] Integration data flow verification ``` #### Validation-Specific Verification If the release required validation testing: ``` [ ] Validation test cases executed in production (if required by protocol) [ ] Test results documented and reviewed [ ] Deviations documented (if any) [ ] Validation summary report updated [ ] Traceability matrix updated [ ] Validated state confirmed by QA ``` ### Section 7: Communication Plan ``` | When | What | To Whom | Method | Template | |------|------|---------|--------|----------| | Pre-deploy (48h) | Planned maintenance notice | All users, study teams | Email | COMM-001 | | Pre-deploy (1h) | Deployment starting notice | Internal team | Chat/call | COMM-002 | | Post-deploy (success) | Deployment complete, release notes | All users, study teams | Email | COMM-003 | | Post-deploy (rollback) | Rollback notice | All users, study teams, management | Email + call | COMM-004 | | Post-deploy (24h) | Extended verification results | Internal team | Email | COMM-005 | ``` ### Section 8: GxP Deployment Record After deployment, complete the formal record: ``` Deployment Record: Deployment Plan ID: DP-[ID] Actual Start Time: [TIME] Actual End Time: [TIME] Outcome: Successful / Rolled Back / Partial Steps Completed: [List or reference deployment log] Deviations from Plan: [Document any deviations] Post-Deployment Verification: - Immediate verification: Pass / Fail - Extended verification: Pass / Fail / Pending Validation Status: - Validated state maintained: Yes / No - Validation documentation updated: Yes / No / N/A - Traceability matrix updated: Yes / No / N/A Signatures: - Deployed by: [Name, Date] - Verified by (QA): [Name, Date] - Approved by (System Owner): [Name, Date] ``` ## Deployment Types ### Standard Release Full deployment plan with complete checklist. Minimum 5 business days lead time for preparation and approval. ### Emergency Hotfix Abbreviated deployment plan. Same structure but: - Expedited approval (minimum 2 approvers: System Owner + QA) - Reduced testing scope (focused on fix + regression of affected area) - Full documentation completed within 5 business days post-deployment - Post-implementation review required ### Configuration-Only Change Simplified deployment plan for non-code changes: - Configuration change documented - Before/after values recorded - Verification that change is effective - No application deployment required ### Infrastructure Change Deployment plan focused on: - Infrastructure component identification - Impact on hosted applications - IQ re-execution if applicable - Network and connectivity verification - Performance baseline comparison ## Metrics Track deployment metrics: - Deployment success rate (target: >95%) - Rollback frequency (target: <5%) - Mean deployment duration - Post-deployment issues reported within 48h - Time from change approval to production deployment ## Regulatory References - FDA 21 CFR Part 11 - System validation maintenance - EU Annex 11 - Section 10: Change Management - ISPE GAMP 5 - Operational Change and Configuration Management - ICH E6(R2) - GCP (system maintenance and validation) - ITIL Release and Deployment Management (adapted for GxP)