CIP and SIP in GMP: The Guidelines That Govern Clean-in-Place and Steam-in-Place

CIP and SIP Are Validated GMP Processes, Not Just Utilities

Clean-in-place (CIP) and steam-in-place (SIP) are the automated backbone of a modern pharmaceutical or biologics facility. They let you clean and sterilize tanks, bioreactors, transfer lines and filling systems without dismantling them. Because they run at the press of a button, it is easy to treat them as plant engineering rather than as regulated quality processes. Inspectors do not see them that way. A CIP cycle is cleaning validation in action, and an SIP cycle is sterilization validation in action, and both must be qualified, validated and monitored under the same good manufacturing practice guidelines that govern any critical process.

This article sets out the guidelines that actually govern CIP and SIP for pharmaceutical and biologic manufacturers in Canada, the European Union and the United States, and what each one expects you to demonstrate. It is written for quality and validation leaders who need to know exactly what an inspector will ask to see.

What CIP and SIP Are

Direct answer: Clean-in-place is a method for cleaning the interior product-contact surfaces of equipment in situ, without disassembly, by circulating rinse water, cleaning solutions and final rinses through the system in a controlled sequence. Steam-in-place is a method for sterilizing or sanitizing that same equipment in place using saturated steam. CIP removes residue and reduces microbial load; SIP destroys the microorganisms that remain. In many biologics operations the two run back to back, so a vessel is cleaned by CIP and then sterilized by SIP before the next batch.

The Guidelines That Require Validated Cleaning and Sterilization

What it is: No single guideline is titled CIP or SIP. Instead, the obligation to validate them flows from the cleaning and sterilization requirements that sit inside each regulator's GMP framework. The table below maps the documents you will be assessed against. Read them together: a CIP or SIP file that satisfies one regulator usually satisfies the others, because the scientific expectations have converged.

What to do: Anchor every CIP and SIP system to your validation master plan, so each cycle has a defined qualification scope, acceptance criteria and a requalification trigger. Treat the guidelines above as one connected expectation, not nine separate ones.

CIP: What the Cleaning Guidelines Require

Direct answer: A CIP cycle must be validated to show that it consistently removes product residue, cleaning-agent residue and microbial contamination to a scientifically justified limit. Health Canada GUI-0028 and EU GMP Annex 15 both frame this as a lifecycle: cleaning process design and development, cleaning process qualification, and ongoing monitoring. The failure mode is well documented; our analysis of a cross-contamination Type I recall shows what happens when a cleaning process is not properly validated.

Acceptance limits: from HBEL to MACO

The most important change of the past decade is how cleaning limits are set. Since the EMA health-based exposure limit guideline took effect on 1 June 2015, the acceptance limit for a carried-over residue must be derived from a toxicology-based permitted daily exposure (PDE), not from the legacy defaults of ten parts per million or one one-thousandth of the minimum therapeutic dose used on their own. The PDE feeds the maximum allowable carryover (MACO), which is what your swab and rinse results are measured against. Health Canada GUI-0028 reflects the same health-based, risk-managed approach. Where a toxicological limit is more stringent than a traditional default, the health-based limit governs.

Visually clean remains a required check, but it is never sufficient on its own for shared product-contact equipment. Your limit calculation must also consider the cumulative effect of multiple items of equipment in a process train, because residue can accumulate down the line.

Sampling and analytical methods

GUI-0028 recognises direct surface (swab or wipe) sampling, rinse sampling and, less commonly, placebo sampling. Swab sampling targets the worst-case, hardest-to-clean locations you identified during design. Rinse sampling covers surfaces a swab cannot reach and suits the closed geometry of a CIP circuit. Whichever you use, the analytical method must be validated and the result corrected for recovery, because a swab never lifts one hundred per cent of the residue. Total organic carbon and conductivity are common rinse measurements, alongside specific assays for the active and the cleaning agent.

Design for cleanability: where the engineering standards come in

A CIP cycle can only clean what it can reach and drain. This is why hygienic design standards such as ASME BPE sit alongside the GMP guidelines. The system must achieve full spray coverage of all product-contact surfaces, drain freely with no pooling, and avoid dead legs where fluid stagnates. Product-contact surfaces are specified to a smooth, typically electropolished finish so residue and microorganisms have nowhere to lodge, and dead legs are kept as short as the design allows. Spray-device coverage is commonly demonstrated with a riboflavin coverage test, in which a fluorescent tracer is applied, the CIP cycle is run, and the surfaces are inspected under ultraviolet light for any missed area.

SIP: What the Sterilization Guidelines Require

Direct answer: An SIP cycle must be validated to show that it delivers a reliable, lethal dose of saturated steam to every internal surface of the equipment, including the coldest and hardest-to-reach points. In the European Union this sits under Annex 1 and its contamination control strategy; in Canada under GUI-0119 (the Canadian Annex 1) and the terminal sterilization validation principles in GUI-0074; in the United States under 21 CFR 211.113, which requires validation of all sterilization processes. The science is the same across all three. Even where a product is not sterile, the equivalent contamination control expectations for non-sterile products still demand controlled, effective sanitization.

Lethality: F0, saturated steam and cold spots

Moist heat sterilization works only with saturated steam. Superheated or wet steam does not transfer heat the way the process requires, so steam quality is a validated input, not an assumption. The pharmacopoeial reference condition for moist heat is 121 degrees Celsius for 15 minutes, and the lethality a cycle actually delivers is expressed as F0, the equivalent time at 121 degrees Celsius. The widely used overkill approach designs the cycle to deliver a large margin of spore destruction, commonly an F0 of at least 12 minutes, so that even a highly resistant contaminant would be destroyed. The controlling risk is cold spots: trapped air and condensate stop steam from reaching the required temperature, so the cycle must remove air, drain condensate through steam traps and sloped lines, and prove the temperature at every identified cold location.

Biological and physical monitoring

Validation pairs physical measurement with a biological challenge. Thermocouples map temperature at the cold spots, while biological indicators containing spores of Geobacillus stearothermophilus, a microorganism chosen for its resistance to moist heat, confirm that lethality was achieved where it is hardest to reach. Cycle qualification is normally run on repeated, successful cycles, with routine release based on the validated physical parameters once steam penetration has been demonstrated. GUI-0074 aligns these expectations with the relevant ISO standards, and the same principles extend to sterilizing filters, hoses and other equipment sterilized in place.

How CIP and SIP Fit the Validation Lifecycle

What to do: CIP and SIP are qualified like any other system, through installation, operational and performance qualification, and then kept in a validated state. Annex 15 frames qualification and validation as a lifecycle, and the coming Annex 15 revision that extends to active substance manufacturers reinforces the same risk-based expectations. Installation qualification confirms the spray devices, instruments, slopes and steam supply are built as designed. Operational qualification challenges the cycle parameters. Performance qualification proves the cleaning limit or the sterilization lethality is met repeatedly. After that, change control, periodic review and ongoing monitoring keep the cycle valid, and any modification to the load, the soil, the detergent or the equipment triggers an assessment for requalification.

Because CIP and SIP are automated, their records are electronic, which puts them squarely inside data integrity expectations. Cycle recipes, alarms, and time, temperature and conductivity traces are GMP records. Confirm that audit trails are enabled and reviewed, as we set out in our guide to audit trail review, so a validated cycle is also a defensible one.

CIP and SIP Validation Readiness Checklist

Use this checklist to test a CIP or SIP system against the guidelines before an inspector does.

• Cleaning limits are derived from a health-based exposure limit (PDE) and expressed as a MACO, not from a legacy default alone.
• Worst-case, hardest-to-clean locations are identified and are the ones you swab, with a validated, recovery-corrected method.
• Dirty hold time and clean hold time are defined and validated, with microbial and endotoxin control in mind.
• Spray-device coverage is demonstrated (for example by riboflavin testing) and the system is confirmed to drain freely.
• The SIP cycle uses saturated steam of confirmed quality, with air removal and condensate drainage designed in.
• F0 and the cold-spot temperature map are documented, and biological indicators confirm lethality where it is hardest to reach.
• Both cycles are qualified through IQ, OQ and PQ, with a defined number of runs justified by risk.
• Electronic cycle records have audit trails enabled and reviewed, and change control triggers requalification when anything material changes.

Common Mistakes to Avoid

• Relying on visually clean alone. A visual check is required but does not replace a health-based residue limit and validated analytical testing.
• Ignoring recovery. Swab and rinse results are meaningless without a recovery study, because sampling never lifts all of the residue.
• Treating F0 as proof on its own. F0 is only meaningful once steam penetration and cold-spot temperatures are proven; air pockets and condensate defeat it.
• Forgetting hold times. An unbounded dirty or clean hold time lets microorganisms grow, so both must be defined and validated.
• Citing a retired guideline. In Canada, GUI-0074 replaced GUI-0010 for moist heat sterilization in 2024. Referencing the old number signals a stale quality system.

Frequently Asked Questions

Which guidelines require CIP and SIP to be validated?

There is no standalone CIP or SIP regulation. The requirement flows from cleaning and sterilization guidelines: 21 CFR 211.67 and 211.113 in the United States, EU GMP Annex 15 and Annex 1 with the EMA health-based exposure limit guideline in the European Union, and Health Canada GUI-0028, GUI-0074 and GUI-0119 in Canada. Engineering standards such as ASME BPE and ISO 17665 support the design and sterilization science.

What is the difference between CIP and SIP?

CIP (clean-in-place) cleans the product-contact surfaces of equipment in situ by circulating rinses and cleaning solutions, and is governed by cleaning validation. SIP (steam-in-place) sterilizes or sanitizes that equipment in place with saturated steam, and is governed by sterilization validation. CIP reduces residue and bioburden; SIP destroys the microorganisms that remain. They are often run one after the other.

How are CIP cleaning limits calculated?

Since the EMA health-based exposure limit guideline took effect on 1 June 2015, cleaning limits are derived from a toxicology-based permitted daily exposure (PDE) rather than from the legacy 10 ppm or 1/1000 dose defaults used on their own. The PDE is converted into a maximum allowable carryover (MACO), which your recovery-corrected swab and rinse results are measured against, together with a visually clean check and microbial limits.

What is F0 in an SIP cycle?

F0 is the lethality a moist heat cycle delivers, expressed as the equivalent number of minutes at 121 degrees Celsius. The pharmacopoeial reference condition is 121 degrees Celsius for 15 minutes, and the common overkill design targets an F0 of at least 12 minutes to give a large margin of spore destruction. F0 is only valid once steam penetration and cold-spot temperatures are demonstrated, and biological indicators confirm the result.

Which biological indicator is used for steam sterilization?

Spores of Geobacillus stearothermophilus are the standard biological indicator for moist heat and steam-in-place sterilization, because the organism is highly resistant to moist heat. Indicators are placed at the cold spots identified during temperature mapping so that a successful kill there gives confidence in the whole load.

Did Health Canada retire the moist heat sterilization guide?

Yes. On 12 November 2024, Health Canada replaced GUI-0010 (Process Validation: Moist Heat Sterilization for Pharmaceuticals) and two related documents with a single guide, GUI-0074, Guide to validation of terminal sterilization process of drugs, which covers moist heat, gaseous and irradiation sterilization and aligns with ISO standards. Cite GUI-0074 in current procedures.

How MFLRC Can Help

MF License and Regulatory Consultants provides pharmaceutical validation services that make CIP and SIP defensible under Health Canada, FDA and EU-GMP inspection. We build cleaning validation programmes on health-based exposure limits, calculate MACO and design worst-case swab and rinse sampling with recovery studies, develop and qualify SIP cycles with F0 and cold-spot mapping, and write the qualification protocols, validation master plan and SOPs that hold together across the lifecycle. Our audit and gap-assessment work then shows where a cycle, a limit or a record would not survive an inspection.

Whether you are qualifying a new bioreactor skid or remediating an inspection finding, our quality assurance and validation team can help you get the science and the documentation right.

Conclusion

CIP and SIP look like plant engineering, but to a regulator they are cleaning validation and sterilization validation running in real time. The guidelines that govern them, from 21 CFR 211.67 and 211.113 to EU Annex 15 and Annex 1 and Health Canada GUI-0028, GUI-0074 and GUI-0119, have converged on the same expectations: health-based cleaning limits, validated sampling, saturated steam, proven lethality at every cold spot, and a lifecycle that keeps each cycle in a validated state. Build your CIP and SIP files to those expectations and you turn a potential inspection weakness into evidence of a mature quality system.

Sources and References

• Health Canada, Cleaning validation guide (GUI-0028)
• Health Canada, Guide to validation of terminal sterilization process of drugs (GUI-0074)
• Health Canada, Annex 1 to the GMP guide, Manufacture of sterile drugs (GUI-0119)
• EMA, Guideline on setting health-based exposure limits for shared facilities (EMA/CHMP/CVMP/SWP/169430/2012)
• FDA, 21 CFR 211.67, Equipment cleaning and maintenance (eCFR)
• FDA, 21 CFR 211.113, Control of microbiological contamination (eCFR)