212886_en-US

liliconcom

Validation of JMP Clinical

We are working with a JMP Clinical customer that operates in an FDA-regulated environment. They posed the following question: can JMP C generate audit trails (or is it 21 CFR Part 11 compliant)?

I found this useful post on Validation of JMP Clinical but couldn't find an explicit answer to the above question.

 

The same customer also had concerns regarding security testing. Another question: was any security testing (penetration testing) performed on JMP C?

I will update the post with what we've found unless someone wants to chime in here!

 

Any/all help would be appreciated!

 

Thanks,

Jeff

Re: Validation of JMP Clinical

Thanks Chris!

Regarding security and penetration testing (compiled by Geoff M):

 

Here is the official response from SAS:

We have a white paper that describes our software security program in SAS R&D.  This may help:

https://www.sas.com/content/dam/SAS/en_us/doc/whitepaper1/sas-software-security-framework-107607.pdf

Also, internally all teams are required to follow the software security policy and perform PLSRs for their ship events.  This all maps directly to what is described in white paper.  I assume these products have completed their PLSRs, but have copied Brenna incase you need help looking that up or have general questions about the PLSR process.

 

Here is the informal response from JMP R&D:

We run Black Duck and Checkmarx security scans. 

 

 

Additional interpretation from Jeff P:

I believe the question from the customer is because of a misunderstanding about the architecture of JMP Clinical. 

"did the vendor perform any security testing (penetration testing) on JMP Clinical? can they please share the results with us?"

JMP Clinical is self-contained, desktop-based software. It is not multi-user, web or network based and doesn’t open any ports or other opportunities for penetration.

 

As a result the answer to the question is, no, we didn’t perform any penetration testing on JMP Clinical because it is self-contained, desktop-based software. It is not multi-user, web or network based, and doesn’t open any ports or other opportunities for penetration.

---

 

Long post but hope this helps folks in the future with similar JMP C security questions!

 

Re: Validation of JMP ClinicalHi Jeff,

The question about 21 CFR Part 11 is answered within the Quality Statement of JMP. There is a link to SAS's response which basicall says no and cannot be. It is an exploratory tool and an open system. This applies to all JMP Products.

As far as penetration testings. Please post Geoff and Jeff's response here.

Thanks,