How the FDA Module Addresses Title 21 CFR Part 11
The following tables cite each section of U.S. Code of Federal Regulations Title 21 Part 11 and list the corresponding Meridian Enterprise and FDA Module features that support that section.
Subpart B — Electronic Records
§11.10 Controls for Closed Systems
This section describes how the FDA Module for Meridian Enterprise addresses the controls that pharmaceutical companies must put in place for closed systems, which are environments in which the persons who are responsible for the content control system access. An example of a closed system would be an information system that is contained within an organization’s local area network or intranet.
These controls require that “Persons who use closed systems to create, modify, maintain, or transmit electronic records shall employ procedures and controls designed to ensure the authenticity, integrity, and, when appropriate, the confidentiality of electronic records, and to ensure that the signer cannot readily repudiate the signed record as not genuine.”
§11.30 Controls for Open Systems
| Section | Requirement Summary | Meridian Enterprise/FDA Module Support |
|---|---|---|
| §11.30 | Persons who use open systems to create, modify, maintain, or transmit electronic records shall employ procedures and controls designed to ensure the authenticity, integrity, and confidentiality of electronic records from the point of their creation to the point of receipt. Such procedures and controls shall include those identified in §11.10, as appropriate, and additional measures such as document encryption and use of appropriate digital signature standards to ensure, as necessary under the circumstances, record authenticity, integrity, and confidentiality. | The FDA Module will authenticate the user against the domain and provide object integrity. Confidentiality may be preserved in an organization by configuring varying security mechanisms including firewalls, proxy servers, and SSL. The FDA Module does not yet support the use of digital signatures. |
§11.50 Signature Manifestations
| Section | Requirement Summary | Meridian Enterprise/FDA Module Support |
|---|---|---|
| §11.50(a)(1-3) | Signed electronic records shall contain information associated with the signing that clearly indicates all of the following: (1) The printed name of the signer; (2) The date and time when the signature was created; and, (3) The meaning (such as review, approval, responsibility, or authorship) associated with the signature. |
The FDA Module enables the signing of electronic records during workflow transitions between states. Workflows are associated to particular document types by the system administrator and project folders by the workflow manager. Users can provide comments to documents under review or can delegate the review task to other authorized reviewers. The workflow transitions indicate the meaning of the signing and are logged to the audit log database, whether approved or rejected by the user. The audit log database contains the user’s name, date and time of signing, and the meaning of the signing. Each signer is required to re-authenticate themselves by entering their user ID and password at the time of the signing. The signing information, including user full name, date, time and reason, is manifested on the document. |
| §11.50(b) | The items identified in paragraphs (a)(1), (a)(2), and (a)(3) of this section shall be subject to the same controls as for electronic records and shall be included as part of any human readable form of the electronic record (such as electronic display or printout). | A server-side process creates a PDF rendition of a document prior to the signing event. The signing information is then added to the PDF rendition directly or to an additional signature page. The signature information is also logged to the audit log database and linked to the metadata. The signature page is a predefined, customizable template associated with a document type and signing event as configured by the system administrator. |
§11.70 Signature/Record Linking
| Section | Requirement Summary | Meridian Enterprise/FDA Module Support |
|---|---|---|
| §11.70 | Electronic signatures and handwritten signatures executed to electronic records shall be linked to their respective electronic records to ensure that the signatures cannot be excised, copied or otherwise transferred so as to falsify an electronic record by ordinary means. | A comprehensive audit log database provides a link between the document and the signature. The signature information in the audit log database cannot be copied, removed, or overwritten. The signature information on the PDF rendition and signature page, along with associated security measures ensures that the signature information cannot be copied, removed, or transferred. |
Subpart C – Electronic Signatures
§11.100 General Requirements
| Section | Requirement Summary | Meridian Enterprise/FDA Module Support |
|---|---|---|
| §11.100(a) | Each electronic signature shall be unique to one individual and shall not be reused by, or reassigned to, anyone else. |
The FDA Module authenticates users with the Windows domain and therefore inherits the same security model. If configured to use Meridian Enterprise user accounts, the system checks for the uniqueness of both user ID and password across all users, guaranteeing exclusivity. Accruent recommends an organization develop procedures to ensure that a user ID is only assigned to one individual, that the user sets their own password upon initial log on, and that each individual agrees not to divulge their password. |
| §11.100(b) | Before an organization establishes, assigns, certifies or otherwise sanctions an individual's electronic signature, or any element of such electronic signature, the organization shall verify the identity of the individual. | Accruent recommends an organization develop procedures to ensure that user IDs are assigned to the correct individuals with appropriate security. |
| §11.100(c)(1-2) |
Persons using electronic signatures shall, prior to or at the time of such use, certify to the agency that the electronic signatures in their system, used on or after August 20, 1997, are intended to be the legally binding equivalent of traditional handwritten signatures. (1) The certification shall be submitted in paper form, and signed with a traditional handwritten signature, to the Office of Regional Operations (HFC- 100), 5600 Fishers Lane, Rockville, MD 20857. (2)Persons using electronic signatures shall, upon agency request, provide additional certification or testimony that a specific electronic signature is the legally binding equivalent of the signer's handwritten signature. |
Accruent recommends an organization develop procedures to notify the agency of their intention to use electronic signatures, and to ensure that users understand that their electronic signatures are considered equivalent to traditional handwritten signatures. The FDA Module signing event provides the signer with a notice indicating that their electronic signature is considered equivalent to a traditional handwritten signature. The notice can be configured by the system administrator and should be in accordance with an organizations related procedures. |
§11.200 Electronic Signature Components and Controls
§11.300 Controls for Identification Codes/Passwords
| Section | Requirement Summary | Meridian Enterprise/FDA Module Support |
|---|---|---|
| §11.300(a) | Persons who use electronic signatures based upon use of identification codes in combination with passwords shall employ controls to ensure their security and integrity. Such controls shall include: Maintaining the uniqueness of each combined identification code and password, such that no two individuals have the same combination of identification code and password. |
When the system is configured to use user IDs and passwords that are authenticated against the operating system controls, the corporate domain policies configured for network access will be applied against access to the secure Meridian Enterprise vault. The operating system will ensure that no two individuals have the same combination of identification code and password. Accruent recommends an organization develop procedures to ensure the uniqueness of each combined identification code and password. |
| §11.300(b) | Ensuring that identification code and password issuances are periodically checked, recalled, or revised, (for example, to cover such events as password aging). |
Accruent recommends an organization develop procedures to ensure that user ID and password issuance are periodically checked, recalled, and revised. When both the user ID and password are authenticated against the operating system controls, policies can be employed to force password expiration after a specified period of time. User accounts may also be cleared or have passwords reset by the system administrator which force the user to change their password upon re‑authentication to the system. |
| §11.300(c) | Following loss management procedures to electronically deauthorize lost, stolen, missing, or otherwise potentially compromised tokens, cards, and other devices that bear or generate identification code or password information, and to issue temporary or permanent replacements using suitable, rigorous controls. |
Accruent recommends an organization develop procedures for loss management. Through the operating system, accounts may be cleared or passwords reset, forcing the user to change the password upon re‑authentication. |
| §11.300(d) | Use of transaction safeguards to prevent unauthorized use of passwords and/or identification codes, and detect and report in an immediate and urgent manner any attempts at their unauthorized use to the system security unit, and, as appropriate, to organizational management. |
All access attempts are logged to the FDA Module audit log database, along with user ID, full name, date and time of access attempt, and whether the attempt was successful. The system can be configured to email a system administrator upon a designated number of failed log on attempts. The FDA Module requires that each user log on with a user ID and password to gain access to the system. Individual users and groups can be granted access to the systems objects, such as vaults and folders by the Meridian Enterprise system administrator. The user ID and password are authenticated against the operating system controls. The operating system tools can be configured to send an email notification to a system administrator upon invalid log on attempts or upon account lockout. Therefore, the same corporate rules and procedures defined and configured for network access will be applied against access to the secure Meridian Enterprise vault. |
| §11.300(e) | Initial and periodic testing of devices, such as tokens or cards, that bear or generate identification code or password information, to ensure that they function properly and have not been altered in an unauthorized manner. | This requirement is not applicable to the FDA Module or the Meridian Enterprise system. |
