User requirement specification (URS) template

Write the user requirement specification for the GxP system you are about to buy: a controlled header, the intended use, numbered requirements with priority and GxP risk, and an approval block. One click adds the Part 11 requirements as rows with their cites. Copy the rows as CSV or print the signed-off document.

Click any field to edit. Pre-filled with a realistic example: a small lab buying a cloud electronic lab notebook.

Part 11 baseline rows in this URS

0 of 19

10 requirements: 4 business, 2 data integrity, 1 security, 3 supplier.

Every high-risk requirement has an acceptance note.

IDCite (if any)
CategoryPriorityGxP risk
RequirementAnalysts create an entry from an approved template for each test method, with required fields for sample ID, instrument ID, and reference standard and reagent lot numbers with expiry dates.Acceptance noteCreate one entry from each of the three method templates; saving is blocked until every required field holds a value.
IDCite (if any)
CategoryPriorityGxP risk
RequirementTemplate calculations (assay %, mean, % RSD) give the same results as the current validated method spreadsheet at the reported number of decimals.Acceptance noteRun 10 recorded data sets through both; every result matches at the reported precision.
IDCite (if any)
CategoryPriorityGxP risk
RequirementAnalysts attach CDS result reports (PDF) and data files up to 100 MB to an entry, and the attachment downloads unchanged.Acceptance noteUpload five files; the SHA-256 checksum of each download equals that of the upload.
IDCite (if any)
CategoryPriorityGxP risk
RequirementAny entry can be found by sample ID, batch number or analyst within 5 seconds across three years of entries.Acceptance noteSearch 20 known IDs in the test environment loaded with migrated entries; each returns in under 5 s.
IDCite (if any)
CategoryPriorityGxP risk
RequirementEntry, change and signature time stamps come from the server clock, and every display and export states the time-zone reference.Acceptance noteMove the test PC's clock by two hours; the saved time stamps follow the server; the PDF export names the time zone.
IDCite (if any)
CategoryPriorityGxP risk
RequirementEntries, attachments and audit trails are backed up daily, and a backup can be restored.Acceptance noteRestore last night's backup to the test environment; 10 sampled entries match production, audit trail included.
IDCite (if any)
CategoryPriorityGxP risk
RequirementUsers sign in through the company single sign-on, and an account disabled in the company directory can no longer sign in to the ELN.Acceptance noteDisable a test account in the directory; the next ELN sign-in attempt fails.
IDCite (if any)
CategoryPriorityGxP risk
RequirementThe supplier gives at least 30 days' notice of each release, with release notes and its own test evidence for the release.Acceptance noteClause in the quality agreement; release notes and test summary for the last two releases reviewed by QA.
IDCite (if any)
CategoryPriorityGxP risk
RequirementAt contract end, the supplier exports every entry, attachment, signature and audit trail as PDF and in a documented electronic format (XML or JSON).Acceptance noteTrial export of one project during OQ; the export opens and reads without the ELN.
IDCite (if any)
CategoryPriorityGxP risk
RequirementBefore contract signature the supplier answers our supplier quality questionnaire or accepts a remote audit.Acceptance noteCompleted questionnaire on file, reviewed and signed by QA.

New row's category

User requirement specification

Electronic lab notebook (cloud, vendor-hosted) for the QC and analytical development laboratory

Document control header
Document number	VAL-URS-007
Title	User requirement specification: Electronic lab notebook (cloud, vendor-hosted) for the QC and analytical development laboratory
Version	v1.0
Date	2026-11-02
System owner	Head of Analytical Development
Predicate rule and retention	Drug CGMP laboratory records, 21 CFR 211.194; kept at least 1 year after the expiration date of the batch (21 CFR 211.180).

1.Intended use

Analysts in the QC and analytical development laboratories record each test execution (HPLC assay, dissolution, Karl Fischer water) for release and stability testing of oral solid dose products. The analyst signs the entry and a second scientist reviews and signs it before results go to the batch record. The ELN replaces the paper notebook and is the record of origin. It does not control instruments: chromatography data stay in the CDS and arrive as attached reports.

2.Requirements

Priority: Must, Should or Could. GxP risk: High where a failure could harm product quality, patient safety or record integrity; otherwise Not high.

2.1 Business

ID	Requirement	Priority and risk	Acceptance note
URS-001	Analysts create an entry from an approved template for each test method, with required fields for sample ID, instrument ID, and reference standard and reagent lot numbers with expiry dates.	Must High	Create one entry from each of the three method templates; saving is blocked until every required field holds a value.
URS-002	Template calculations (assay %, mean, % RSD) give the same results as the current validated method spreadsheet at the reported number of decimals.	Must High	Run 10 recorded data sets through both; every result matches at the reported precision.
URS-003	Analysts attach CDS result reports (PDF) and data files up to 100 MB to an entry, and the attachment downloads unchanged.	Must High	Upload five files; the SHA-256 checksum of each download equals that of the upload.
URS-004	Any entry can be found by sample ID, batch number or analyst within 5 seconds across three years of entries.	Should Not high	Search 20 known IDs in the test environment loaded with migrated entries; each returns in under 5 s.

2.2 Data integrity

ID	Requirement	Priority and risk	Acceptance note
URS-005	Entry, change and signature time stamps come from the server clock, and every display and export states the time-zone reference.	Must High	Move the test PC's clock by two hours; the saved time stamps follow the server; the PDF export names the time zone.
URS-006	Entries, attachments and audit trails are backed up daily, and a backup can be restored.	Must High	Restore last night's backup to the test environment; 10 sampled entries match production, audit trail included.

2.3 Security

ID	Requirement	Priority and risk	Acceptance note
URS-007	Users sign in through the company single sign-on, and an account disabled in the company directory can no longer sign in to the ELN.	Should Not high	Disable a test account in the directory; the next ELN sign-in attempt fails.

2.4 Supplier

ID	Requirement	Priority and risk	Acceptance note
URS-008	The supplier gives at least 30 days' notice of each release, with release notes and its own test evidence for the release.	Must High	Clause in the quality agreement; release notes and test summary for the last two releases reviewed by QA.
URS-009	At contract end, the supplier exports every entry, attachment, signature and audit trail as PDF and in a documented electronic format (XML or JSON).	Must High	Trial export of one project during OQ; the export opens and reads without the ELN.
URS-010	Before contract signature the supplier answers our supplier quality questionnaire or accepts a remote audit.	Should Not high	Completed questionnaire on file, reviewed and signed by QA.

3.Approval

Signing approves this URS as the basis for supplier selection, the traceability matrix and testing.

Signature 01

Role: Head of Analytical Development (system owner)
Printed name: blank
Meaning: Authorship
Date and time: YYYY-MM-DD hh:mm UTC

Signature 02

Role: QC laboratory supervisor (user representative)
Printed name: blank
Meaning: Review
Date and time: YYYY-MM-DD hh:mm UTC

Signature 03

Role: IT business partner
Printed name: blank
Meaning: Review
Date and time: YYYY-MM-DD hh:mm UTC

Signature 04

Role: Head of Quality Assurance
Printed name: blank
Meaning: Approval
Date and time: YYYY-MM-DD hh:mm UTC

VAL-URS-007 v1.0. 10 requirements. A printed copy is for reference; check the version in force before use.

Fig. 01

A blank requirement sheet on a clipboard, the page a URS starts from.

What the rule says

Annex 11 § 4.4: EU GMP: user requirements describe the system's required functions, rest on a documented risk assessment, and stay traceable through the life-cycle.
§ 11.10(a): Validate the system for accuracy, reliability, consistent intended performance and the ability to spot invalid or altered records.
§ 11.10(e): A secure, computer-generated, time-stamped audit trail; changes never hide earlier data; the trail is kept as long as the record.
§ 11.10(d), (g): Access limited to authorized people, with checks on who may use the system, sign, or alter a record.
§ 11.50: A signed record shows the printed name, the date and time, and the meaning of each signature, on screen and on paper.
§ 11.70: Signatures are linked to their records so they cannot be cut, copied or moved.
§ 11.200(a)(1): Signatures without biometrics use at least two distinct components, such as an ID code and a password.
§ 11.300: Unique ID and password pairs, checked or aged periodically, with misuse attempts reported at once.

What a user requirement specification is

A user requirement specification (URS) is the buyer's list of what a system must do for its intended use, written before the system is chosen. Each requirement gets an ID, so it can be traced to a supplier answer, a risk, a test and a result. It is the first document of computer system validation, and the one every later document points back to.

EU GMP Annex 11 says it plainly: “User Requirements Specifications should describe the required functions of the computerised system and be based on documented risk assessment and GMP impact. User requirements should be traceable throughout the life-cycle” (§ 4.4). FDA's software validation guidance, written for device software, makes the same point from the other end: “It is not possible to validate software without predetermined and documented software requirements.”

Common misreading

“Part 11 requires a URS.” Part 11 never names one. It requires validation for “consistent intended performance” (§ 11.10(a)), and you cannot show intended performance without writing the intended use down. The URS is how most labs do that.

Here is what is required and what is practice in the template above:

Part of the URS	Where it comes from	Weight
A written URS at all	EU GMP Annex 11 § 4.4 names it. Part 11 never uses the term; FDA's software validation guidance says requirements must be documented first.	EU GMP guidance; FDA guidance
An intended use statement	§ 11.10(a) asks for validation of "consistent intended performance"; FDA's validation guidance asks requirements to state the intended use.	Part 11, read with FDA guidance
Requirement IDs a trace can follow	Annex 11 § 4.4: "traceable throughout the life-cycle". The ID format is yours.	EU GMP guidance; format is practice
Must, Should, Could	A house convention for supplier selection.	Practice
High or Not high GxP risk	Borrowed from FDA's CSA guidance, written for device makers' production and quality software.	FDA guidance (devices); practice elsewhere
Acceptance notes	A head start for the test scripts; nothing names them.	Practice
Signatures with a meaning	§ 11.50 when the URS is signed electronically; a printed and inked URS needs only your document SOP.	Part 11, if signed electronically

Many labs take the document set from GAMP 5, ISPE's industry guide (second edition, July 2022). It is guidance, not law; our plain guide to GAMP 5 covers what it adds.

How to use this URS template

01Write the intended use first, under Header and sign-off: who uses the system, for which records, which decisions rest on it, and what it will not do. Every requirement should trace back to a sentence here.
02Name the predicate rule. It sets how long the records are kept, which Part 11 leaves to that rule.
03Replace the example rows with your own process needs. Write one need per row, as something a tester can watch happen.
04Click Add the Part 11 baseline once you know the system will hold records a predicate rule requires. Delete or narrow the rows that do not apply, and say why in the acceptance note.
05Set priority and GxP risk on every row. High-risk rows get scripted tests later, so they need an acceptance note now.
06Send the Must rows to the shortlisted suppliers and ask for a written answer per ID. Then print the document for signature, or copy the CSV into your traceability matrix.

The example is a small lab replacing paper notebooks with a cloud ELN. If you are still choosing between vendors, our Part 11 ELN comparison reads what each one publishes against the same rows as the baseline.

Writing requirements a tester can check

A requirement is good when two people reading it would run the same test and agree on the result. Write one need per row, say what the system or the supplier does, and give a number where there is one. The supplier answers each Must row in writing, and that answer becomes evidence later.

Written vaguely	Written so it can be tested
The ELN must be user-friendly.	An analyst trained for one hour completes an HPLC assay entry from the template without help.
The system must be Part 11 compliant.	The 19 Part 11 baseline rows, each with its cite, and a written supplier answer per row.
Fast search.	Any entry found by sample ID within 5 seconds across three years of entries.
Secure audit trail.	No user role, administrators included, can edit or switch off the audit trail.

The five categories keep the list readable. Business rows are your process. Part 11 rows come from the rule. Data integrity rows cover time stamps, backups and copies beyond the Part 11 text. Security covers sign-in and accounts. Supplier rows cover what the vendor must do: release notice, an exit export, and a quality questionnaire or audit (Annex 11 § 4.5: “The supplier should be assessed appropriately”).

GxP risk has two values on purpose. FDA's CSA guidance uses “high process risk” and “not high process risk”, high being “when its failure to perform as intended may result in a quality problem that foreseeably compromises safety”. That guidance is written for device makers; drug and GLP labs often borrow the idea. The CSA validation scope planner turns that risk call into the right amount of testing per feature.

How the URS feeds the traceability matrix and testing

The validation master plan says how the lab validates systems in general. The URS says what this one system must do. Every later document hangs off its IDs: the traceability matrix lists each URS ID beside its risk, its test and the result, and the IQ, OQ and PQ protocols hold the tests themselves. A requirement with no test, or a test with no requirement, shows up as a gap in the matrix.

Here is the pre-filled ELN URS traced forward, with the Part 11 baseline added. The risk column decides how much testing each row earns:

URS ID	Need	GxP risk	Test	Where
URS-002	Template calculations match the validated spreadsheet	High	Scripted: 10 recorded data sets through both, results compared	OQ
URS-005	Time stamps from the server clock, zone shown	High	Scripted: move the PC clock, save, export	OQ
URS-007	Company single sign-on; disabled accounts locked out	Not high	Configuration record checked, then one disabled-account attempt	IQ, then OQ
URS-004	Find an entry by sample ID within 5 s	Not high	Unscripted: 20 searches on migrated data, result noted	PQ
URS-008	30 days' release notice with test evidence	High	No test script: quality agreement clause reviewed by QA	Supplier assessment
URS-023	Name, date and time, and meaning on every signature (§ 11.50, a baseline row)	High	Scripted: sign with each meaning, check screen and PDF	OQ

Copy as CSV puts the ID, requirement, category, priority, risk, acceptance note and cite in one row each, which is the left half of a traceability matrix. Some rows never get a test script: a supplier row is met by an agreement, and a procedure row by an approved SOP and training records. The matrix still lists them, with the document as the evidence. Our guide to computer system validation for small labs walks the whole pack from URS to validation report.

Where the Part 11 baseline comes from

Each baseline row restates one control from 21 CFR Part 11 in the eCFR's own words. Part 11 binds the people who use the system, so some rows are met by the software, some by your procedures, and some by both. Section by section, the Part 11 requirements guide explains what an inspector asks to see for each.

Cite	What the row asks for	Met by
§ 11.10(a)	Validation, incl. spotting altered records	System and procedure
§ 11.10(b)	Complete copies, readable and electronic	System
§ 11.10(c)	Retrieval for the whole retention period	System and procedure
§ 11.10(d)	Access limited to authorized people	System and procedure
§ 11.10(e)	Computer-generated, time-stamped audit trail	System
§ 11.10(e)	Changes never hide the old value; trail kept as long as the record	System
§ 11.10(f)	Steps enforced in the permitted order	System
§ 11.10(g)	Authority checks to use, sign or alter	System
§ 11.10(h)	Device checks on the source of input	System
§ 11.10(i)	Trained, qualified people	Procedure
§ 11.10(j)	Written accountability policy for e-signatures	Procedure
§ 11.10(k)	Control of system documentation and its changes	Procedure
§ 11.50	Name, date and time, and meaning on every signature	System
§ 11.70	Signature linked to its record	System
§ 11.200(a)(1)	Two distinct signature components	System
§ 11.200(a)(1)(i)–(ii)	Components per signing, in and out of a session	System
§ 11.300(a)–(b)	Unique ID and password pairs, checked or aged	System and procedure
§ 11.300(d)	Lockout and alert on attempted misuse	System and procedure
§ 11.300(c), (e)	Tokens and cards: deauthorize and test	Procedure

Not in the baseline

§ 11.30 adds controls such as encryption and digital signatures for open systems. If a vendor hosts the system outside your control, run the open vs closed system check and add § 11.30 rows if it comes out open. § 11.100 is not a URS row either: verifying signers' identity and sending FDA the certification letter are your company's steps, not the software's.