Validation procedures of Atlassian tools as a requirement from FDA for medical device product

Question

Did someone received from atlassian the validation documents for validation their products .

1. Jira version 8.x
2. Crucible
3. FishEye
4. Confluence

5. Bitbucket
The reason for this request is because
Non-Product Software Validation is a requirement of the Quality System Regulation, 21 CFR Part 820, 21CFR Part 11, and ISO/IEC 62304. Validation requirements apply to software used in medical devices, software that is itself a medical device, software used in testing and production of the medical device, and software used in implementation or support of the quality management system.

I will appreciate a respo0nse

Best Regards
Iris Sharfer
Software Quality assurance Engineer
FLEX DESIGN, ISRAEL
iris.sharfer@flex.com

Brian L Pate · Answer

Hi Iris,

Not sure if you found what you were looking for but keep in mind that FDA is very flexible with the software validation approach for non-product software.  The level of rigor and documentation expectation can vary widely based on intended use of the tool.  As you also probably know, this is also true of ISO 13485:2016.  If a vendor supplies you with test documentation, it likely can form a foundation for the software validation plan and approach depending on its quality.

IEC 62304 is not applicable to non-product software though.

There are methods that one could possibly use for a cloud based tool that may be updated frequently.  The key is intended use of the tool and impact of the update on previous software validation activities and documentation.

Brian Pate

Manoel Ramon · Answer

I do not see problem you running validation in a JIRA installed in your local service because you can control that is patched. Now the cloud version I also have concerns.