Are SharePoint Online and OneDrive, FDA Part 11 compliant?

Question

Hi there

Are SharePoint Online and OneDrive, FDA Part 11 compliant?

Than you.

Answer 1

@frob

According to this official article,

Microsoft enterprise cloud services undergo regular independent third-party SOC 1 Type 2 and SOC 2 Type 2 audits and are certified according to ISO/IEC 27001 and ISO/IEC 27018 standards.

Although these regular audits and certifications do not specifically focus on FDA regulatory compliance, their purpose and objectives are similar in nature to those of CFR Title 21 Part 11, and serve to help ensure the confidentiality, integrity, and availability of data stored in Microsoft cloud services. Our qualification approach is also based on industry best practices, including the International Society for Pharmaceutical Engineering (ISPE) GAMP series of Good Practices Guides and the Pharmaceutical Inspection Cooperation Scheme (PIC/S) Good Practices for Computerized Systems in Regulated GxP Environments.

Customers can request access to the compliance reports, subject to nondisclosure agreement terms and conditions, through their Microsoft account representative, or through the Service Trust Portal. In addition, qualification guidelines for Microsoft Azure and Microsoft Office 365 provide a detailed explanation of how Microsoft audit controls correspond to the requirements of CFR Title 21 Part 11, guidance for implementing an FDA qualification strategy, and a description of areas of shared responsibility.

---

If the answer is helpful, please click "Accept Answer" and kindly upvote it. If you have extra questions about this answer, please click "Comment".
Note: Please follow the steps in our documentation to enable e-mail notifications if you want to receive the related email notification for this thread.

Answer 2

Hi @Emily Du-MSFT ,

Thank you for answering the question I am searching for long time, according to my understanding that all Microsoft 365 apps are actually compliance to FDA part 11? does it also compliant to ISO 13485 since in the standard clearly state in 4.1.6 that you have to validate the system to use it, but for FDA its not requested but better that the organisation validate their system according to their requirements? i just would like to understand can Microsoft support a medical company with documentations for validation either for FDA or ISO?