Frameworks / Annex 11 to EU GMP - Computerised Systems / Clause 9 Annex 11 to EU GMP - Computerised Systems
Operational Phase - Data Management
Annex 11 to EU GMP - Computerised Systems Clause 9: Audit trails Time-stamped audit trail records of all GMP-relevant changes and deletions must be maintained with documented reasons.
Maintained by Gerard Blokdyk · Verified against the published standard 31 May 2026 · Control text last updated 21 May 2026 What else in your programme already covers this This control maps to 86 controls across 57 other frameworks. If you already hold one of them, the evidence you collected for it is the starting point here rather than new work.
BSI-28 Audit event logging and storage BSI-29 Audit record review and analysis BSI-31 Audit log protection and retention IACS-UR-E26-Detect-Logging-Monitoring-Audit-Alerting IACS UR E26 Detect Goal - Logging + Network Monitoring + Audit Trail + Alerting + SIEM IACS-UR-E27-Logging-Forensics-EventCapture IACS UR E27 - Equipment Logging + Forensic Readiness + Event Capture + Tamper Detection AWWA-4.4 Audit Logging and Monitoring Part11.AuditTrail Audit trail requirements - secure computer-generated time-stamped (21 CFR §11.10(e)) CAT-D3-2 Detective controls FISMA-NIST-800-53-RMF-800-171-FIPS Operationalisation via NIST 800-53 + 800-37 RMF + 800-171 + FIPS 199 + FIPS 200 FTC-Safeguards-9-Elements 9 Safeguard Elements - Access, Inventory, Encryption, Secure-Dev, MFA, Disposal, Change-Mgmt, Monitoring, Pen-Test (16 CFR 314.4(c)) FedRAMP-ConMon Continuous Monitoring (ConMon) and Significant Change Requests GHG-Suite-Corporate-Principles GHG Protocol Suite, Corporate Standard and 5 Reporting Principles GGAP-IFA-AllFarmBase-Mgmt-Workers-Env-Trace GLOBALG.A.P. IFA v6 All Farm Base (AF): Management, Workers, Environment, Traceability and Food Safety GhCSA-Implementation-Roadmap Implementation Roadmap - Organizational Roles, Tooling and Metrics HITECH-Coord-HIPAA-Privacy-Security-Cures-ONC HITECH Coordination with HIPAA Privacy Rule + HIPAA Security Rule (Verified Separately) + 21st Century Cures Act + ONC 62351-14 Cyber security event logging ISO27799-05 Audit trail for ePHI access ISO-25012-4.11 Traceability 27011-8.4 Logging and monitoring ISO27043-24 Logging and monitoring ISO21434-24 Logging and monitoring MDS2-Audit-Logging-AUDT-Integrity-IGAU-Cybersecurity-Risk-CYBR-Monitoring MDS2 Audit Controls + AUDT + Integrity + IGAU + Cybersecurity Risk + CYBR + Continuous Monitoring MTCS-Logging-Monitoring-Compliance-Audit-SLA-Configuration-SIEM-SOAR-Cloud-Monitoring-CSPM MTCS Logging + Monitoring + Compliance + Audit + SLA + Configuration + SIEM + SOAR + CSPM NAIC-2 Information Security Program (ISP) - Section 4 NISTPF-8 Protect-P Information Protection Processes (PR.PO-P) NISTSP115-2 Review Techniques - Documentation, Logs, Rulesets, Configurations NISTSP123-5 Server Operations - Patching, Malware, Logging, Backup NISTSP137-4 Security Status Reporting and Risk Score Aggregation NISTSP144-8 Monitoring, Incident Response, Exit Strategy, and Compliance NISTSP145-8 Governance, Reporting, and Stakeholder Education on Cloud Definition NISTSP61-4 Detection and Analysis: Sources, Triage, Categorisation, Prioritisation NISTSP63R4-8 Operational Audit, Session Management, Recovery, and Cross-cutting Controls NISTSP66-6 Technical Safeguards: Access Control, Audit Controls, Integrity, Person Authentication NISTSP82-6 OT Audit, Monitoring, Anomaly Detection, and OT-Specific SOC NISTSP88-7 Verification, Audit, Training, and Environmental/Safety Controls NISTSP92-5 Log Analysis: Correlation, Baselining, Anomaly Detection, Alerting, Manual Review ORANWG11-7 Logging, Monitoring, Incident Response, and Denial-of-Service Resilience DSOMM-3 Build, Deployment, Infrastructure Hardening, and Secrets Management OWASPSAMM-5 Operations: Incident Management, Environment Management, Operational Management OSSFSC-7 Webhook Authentication, Contributors Diversity, Aggregate Score PASONE-4 Technical Security: CDE Configuration, BIM Tools, Encryption, Aggregation, Mobile Working PICSGMP-4 Chapter 4: Documentation - System, Record-Keeping, Data Integrity PTESPHASE-3 Threat Modeling SHAREASSESS-4 Vulnerability Management, Patching, Application Security SUPCHAIN-2 Source Integrity - Branch Protection, Code Review, Two-Person Rule CISABD-1 Take Ownership of Customer Security Outcomes ISMSP-SYS-03 Security Monitoring and Log Management TSAPIPE-2 OT/IT Network Segmentation and Access Control Every mapping shown was judged rather than inferred from wording similarity, and the ones that failed review are published too. See the coverage reports and what was rejected .
Other controls in Operational Phase - Data Management Query this from an agent The graph holds this control, the 86 it maps to, and the evidence behind each claim, over MCP and REST.