Purchase and Install JIRA for GxP (Part 11) Compliance

Question

We are a small company looking for a solution that meets Part 11 security requirements.  Has anyone accomplished this?  I know a lot of pharmaceutical companies have done this.  I am strong user and intermediate administrator but I have not been involved with setting it up (and documenting) in a way to meet these requirements.  To start, do we need to purchase the Premium version or will the Standard version suffice?  What add-ons are you using?  How are you documenting that JIRA is compliant with the regulations.

Yuliia_Borivets__SaaSJet_ · Answer

Hi @Jim Test Account

You need to consider a lot of stuff when complying with Part 11 in Jira. In most cases, you'll have to combine built-in functionality with some plugins from the Marketplace. Jira offers an audit log for some system changes:

Auditing in Jira

Audit log events in Jira

For changes within the issues list made by users (including deleted ones) and export, you can try the Issue History plugin. It's developed by my team.

Additionally, you'll need the e-signature fields plugin.

Also, this article can be helpful:

Jira for CFR 21 Part 11 compliance: how to get audit trail for FDA inspection

Aaron Morris_49u8f7 · Answer

Hi @Jim Test Account -- I realize this post is a few months old already...is this still something you're exploring?  I have a lot of experience configuring Jira for Part-11 compliance, and so I might be able to help you out.

Some quick answers:

* Jira Standard is fine.  No need for Premium as far as Part 11 is concerned.
* Many Part 11 requirements (access controls, audit trails, etc.) overlap with other regulations--especially financial industry regulations--and so you can reference Atlassian's compliance resources for documentation:
https://www.atlassian.com/trust/compliance
* Electronic Signatures -- Part 11 compliant signatures are not available off-the-shelf.  You'll need an add-on for this if your workflows require signatures.  There are a few products available for this in the Marketplace.  I've personally used the signature apps from Digital Rose and Tx3/Tricentis.
* Workflow configurations -- You'll probably also need to implement workflow controls to limit field editability, commenting, deleting, etc. by workflow state and by user role.  All these configurations are supported off-the-shelf without additional apps from the marketplace.