What is 21 CFR Part 11 Compliance?
Title 21 CFR Part 11 is the portion of the Code of Federal Regulations (CFR) that provides standards written by the Food and Drug Administration (FDA) for the use of electronic records and electronic signatures to ensure software systems are implemented correctly and prevents falsified records.
Title 21 CFR Part 11 regulates:
- Drug Development companies
- Drug Manufacturing companies
- Quality Control departments inside of those companies
- Clinical Trials companies
For an alternative breakdown read this pdf from Perficient. There is also another great breakdown of 21 CFR Part 11 from PharmaGXP.com. Scinote has been the best example of software features fitting 21 CFR Part 11 compliance.
Title 21 CFR Part 11 Explained
21 CFR part 11 is broken up into 3 subparts:
- Subpart A – General Provisions
- § 11.1 Scope.
- § 11.2 Implementation.
- § 11.3 Definitions.
- Subpart B – Electronic Records
- § 11.10 Controls for closed systems.
- § 11.30 Controls for open systems.
- § 11.50 Signature manifestations.
- § 11.70 Signature/record linking.
- Subpart C – Electronic Signatures
- § 11.100 General requirements.
- § 11.200 Electronic signature components and controls.
- § 11.300 Controls for identification codes/passwords.
In general provisions, Subpart A tells you if this law applies to you or not, provides some definitions and purpose for this title.
What matters to you as a software engineer or UI/UX designer are Subparts B & C; these are the requirements your software has to meet. Some these requirements are already in place if you follow modern conventions however some features require major adjustments like using digital signature that follows DSS per user actions.
Subpart A – General Provisions
The scope of 21 CFR part 11 states the obvious; that it’s a piece of law that says you can use electronic records in regards to reporting to the FDA.
So if any sort of research, manufacturing, or clinical data is submitted to the FDA via its public docket No. 92S–0251 it has to follow 21 CFR part 11. Also beware that different agencies under the FDA have different submission requirements. FDA is composed of many agencies that report up to the FDA itself each one with a different purpose and regulatory responsibility.
In general, Food Manufactures, Retailers, and Transports are not a part of this regulation or compliance. Only biological, pharmaceutical, hardware medical devices manufacturers and researchers are regulated by this law. This law does not regulate software; it regulates the users of software i.e. pharmaceutical, biological, and medical device manufacturers.
21 CFR Part 11 Applies To:
- Drug Development
- Manufacturing
- Quality Control
- Clinical Trials
Or you if are a software company that sells software to pharmaceutical companies that do any of the above want you to be compliant with 21 CFR part 11, because if you are not, they are not going to buy.
21 CFR part 11 doesn’t apply to you in the list below
TDLR – if you already follow these specific chapters for manufacturing, quality control, hazard, risk assessment, or transports for food for both humans and animals you are not subject to 21 CFR part 11.
- § 101.11(d) of this chapter. Voluntary registration to be subject to the menu labeling requirements — Basically if you register as a restaurant voluntarily you are not subject to 21 CFR part 11.
- § 101.8(d) of this chapter. Voluntary provision of calorie labeling for foods sold from vending machines — Basically if you provide calorie labeling of your food in a vending machine & register via the instructions in the link, you are not subject to 21 CFR part 11.
- part 117 of this chapter cGMP Practice, Hazard Analysis, And Risk –Based Preventive Controls For Human Food. If you manufacture food for humans & have cGMP records already for this chapter part 117 then 21 CFR part 11 does not apply to you.
- part 507 of this chapter – PART 507—cGMP, Hazard Analysis, And Risk –Based Preventive Controls FOR FOOD FOR ANIMALS. Basically if you manufacture food for animals and follow cGMP & part 507 already 21 CFR part 11 does not apply to if you follow part 507.
- part 112 of this chapter Standards For The Growing, Harvesting, Packing, And Holding of Produce FOR HUMAN CONSUMPTION – Basically if you grow, harvest & pack food for humans and follow part 112, 21 CFR part 11 doesn’t apply to you.
- subpart L of part 1 of this chapter —Foreign Supplier Verification Programs for Food Importers. If you are verified as a Food Importer according to subpart L of part 1, 21 part 11 does not apply to you.
- subpart M of part 1 of this chapter Accreditation of Third-Party Certification Bodies To Conduct Food Safety Audits and To Issue Certifications. if you are company that provides audits and certificates to foreign food entities, 21 part 11 does not apply to you.
If you are looking for Accredited “Certification bodies” or companies that provide certificates for Food Safety Audits here’s the updated list if certification bodies are not accredited via these “Accreditation bodies” companies that provide accreditation avoid them because some of these accredited bodies has their own accreditation expires FYI:
https://datadashboard.fda.gov/ora/fd/tpp.htm
- subpart O of part 1 of this chapter Sanitary Transportation of Human and Animal Food. If you comply and transport food for humans and animals 21 CFR part 11 doesn’t apply to you.
- part 121 of this chapter —Mitigation Strategies to Protect Food Against Intentional adulteration. If you comply or implement strategies to protect foods against intentional adulteration, 21 CFR part 11 doesn’t apply to you.
- subpart R of part 1 of this chapter —Laboratory Accreditation for Analyses of Foods. If you comply with Laboratory Accreditation for analysing food 21 CFR part 11 doesn’t apply to you.
Breaking Down 21 CFR part 11
21 CFR part 11 § 11.2 Implementation.
All this section says is that if you have paper records you can use electronic records and signatures in lieu of paper records and handwritten signatures.
Also, records created via an electronic system can be submitted to the FDA via the public docket No. 92S–0251. If you are submitting to the FDA consult with a specific agency under the FDA.
However, the requirements of 21 CFR part 11 must be met.
21 CFR part 11 § 11.3 Definitions.
These are definitions to provide clarification.
Subpart B – Electronic Records
Electronics Records describes two systems Closed and Open Systems.
Closed system means an environment in which system access is controlled by persons who are responsible for the content of electronic records that are on the system.
Basically if the customer (a pharmaceutical company) owns the AWS, Azure, or GCP instance or a on-perm server, then they control access. If your software application is deployed on-perm or the cloud instance is ran by the pharmaceutical company they control access. So closed system situation changes the requirements of 21 CFR part 11 versus the requirements of an Open System requirements.
Open system means an environment in which system access is not controlled by persons who are responsible for the content of electronic records that are on the system.
SaaS or Software as a Service are Open Systems, if the Software Developers has control access to the cloud deployment but users who don’t have control over the access of the system its consider open system. To be consider closed system you have to give access to the users instance first, then users have to invite developers and the hard rule is that developers or anyone cannot access the system/data if not given access, otherwise hitting public facing API will be consider open system and that has different set of requirements versus the close system.
Mostly it depends because who do you consider responsible for the content? So this is a matter of interpretation. So if you provide a way for users to manage access and remove developers from the systems I would consider that a closed system, however if your SaaS product doesn’t allow users to control access the software its only managed strictly by sales engineer and developers well that is a open system because users who are responsible for putting the content do not have control of access into the software.
Software as a Service (SaaS) can be either open or closed, depending on how it’s implemented:
– If a SaaS platform is used within an organization and is only accessible to authorized users controlled by that organization, it can be considered a closed system.
– If a SaaS platform allows external parties (e.g., multiple clients or third parties) to access the data and the organization does not fully control the access, it would be considered an open system.
§ 11.10 Controls for closed systems.
So now let’s get into “Controls” and requirements for a closed system.
A person who uses a closed systems to CRUD has to ensure the authenticity, integrity, and confidentiality of the electronic records.
What does that mean? The customer/user/IT department in a closed system has to ensure authenticity, integrity, and confidentiality the Electronic Records that it’s their responsibility.
and to ensure that the signer cannot readily repudiate the signed record as not genuine.
This part of the sentence means that the process of signing a record should be secure and verifiable, making it difficult for the signer to later claim that the signature is not theirs or that they did not consent to the record.
How does the customers do this? What are software developers/software companies responsible for?
A) Validation of the system (General Principles of Software Validation)
Software Developer / UI/UX designer Translation: Customers are responsible to validate the software system they are using. However, if you are a software firm selling software to a pharmaceutical or biology industry, I implore you to provide SOC 2 audits as a way to be competitive for the market compared to other products.
B) The ability to generate accurate and complete copies of records in both human readable and electronic form suitable for inspection, review, and copying by the agency.
Software Developer / UI/UX designer Translation: If I upload something or create something in the system have a copy of what was uploaded and make sure it’s accurate. On top of that make it easy for humans to read, and exportable, for the FDA agency to copy those records. The FDA can do random audits, so make sure your software does that. The FDA does not want to parse through JSON; they want documents.
- Create an audit log and track every CRUD action.
- Provide a button to export in human readable format (html, pdf, word, csv)
C) Protection of records to enable their accurate and ready retrieval throughout the records retention period.
Software Developer / UI/UX designer Translation: You need to provide the ability to retrieve record data. On top of that customers need to ensure you have security measures in place to protect the electronic records from unauthorized access. Throughout the records retention period means forever, until the firm gone.
D) Limiting system access to authorized individuals.
Software Developer / UI/UX designer Translation: Have a feature like RBAC Role Based Access Control to Limit the access to only authorized individuals.
E) Use of secure, computer-generated, time-stamped audit trails to independently record the date and time of operator entries and actions that create, modify, or delete electronic records. Record changes shall not obscure previously recorded information.
Software Developer / UI/UX designer Translation: You cannot edit the audit trail or audit log. You can edit the record, but that edit itself is documented inside of the audit log.
If I change “Apple” to “Orange” the audit trail documents that change in its own log.
E.1) Such audit trail documentation shall be retained for a period at least as long as that required for the subject electronic records and shall be available for agency review and copying.
Software Developer / UI/UX designer Translation: The Audit Trial has to exist for many years or forever basically.
F) Use of operational system checks to enforce permitted sequencing of steps and events, as appropriate.
Software Developer / UI/UX designer Translation: It’s the user’s responsibility to do this when appropriate, but usually software developers write test code, and input validation. They’re not hard requirements.
G) Use of authority checks to ensure that only authorized individuals can use the system, electronically sign a record, access the operation or computer system input or output device, alter a record, or perform the operation at hand.
Software Developer / UI/UX designer Translation: User Sign In workflows, 2FA, CORS, customers IT departments usually handle this also through applications like OTKA.
H) Use of device (e.g., terminal) checks to determine, as appropriate, the validity of the source of data input or operational instruction.
Software Developer / UI/UX designer Translation: Customer is responsible for making sure the device they are using is valid. Not hacked or compromised.
i) Determination that persons who develop, maintain, or use electronic record/electronic signature systems have the education, training, and experience to perform their assigned tasks.
Software Developer / UI/UX designer Translation: Customer has to ensure that the user has the correct education, training, and experience.
Offer training to your customers.
j) The establishment of, and adherence to, written policies that hold individuals accountable and responsible for actions initiated under their electronic signatures, in order to deter record and signature falsification.
Software Developer / UI/UX designer Translation: Customers should have policies in place that hold individuals accountable.
K) Use of appropriate controls over systems documentation including:
K.1 ) Adequate controls over the distribution of, access to, and use of documentation for system operation and maintenance.
Software Developer / UI/UX designer Translation: If it’s an on-prem deployment the distribution of was made from a Software Vendor to Customer via a financial transaction. So the customer has controls on the distribution of the software within their own organization if they brought a license of your software.
Access to the software is managed through the Login workflow built into the application.
Use of documentation for operation & maintenance. As a software vendor or software developer provide documentation for your software because that is a requirement. If the customer buys your software without documentation that is the fault of the customer/user/person.
K.2) Revision and change control procedures to maintain an audit trail that documents time-sequenced development and modification of systems documentation.
Software Developer / UI/UX designer Translation: You need to use git, github or gitlab to have a process that tracks and has audit log or history of tracking changes and releases of the software. It would also be good idea to document your process for software revisions and change control procedures for software development.
§ 11.30 Controls for open systems.
Persons who use open systems to create, modify, maintain, or transmit electronic records shall employ procedures and controls designed to ensure the authenticity, integrity, and, as appropriate, the confidentiality of electronic records from the point of their creation to the point of their receipt. Such procedures and controls shall include those identified in § 11.10, as appropriate,
Software Developer / UI/UX designer Translation: The customer/user/person is responsible to have the controls in place from the close system above.
and additional measures such as document encryption and use of appropriate digital signature standards to ensure, as necessary under the circumstances, record authenticity, integrity, and confidentiality.
Software Developer / UI/UX designer Translation: In the words of “document encryption” if I upload a document it should be encrypted in the database.
Software Developer / UI/UX designer Translation: In the words “appropriate digital signature standards” when users login in they will need to be given DSS signature as an ID that tracks their actions and is unique to that user. When they CRUD records/data they will need a digital signature.
Suggestion: Use keycloak to handle these signatures?
What is a digital signature standard? It’s a set of algorithms defined in 1994 by the federal government NIST to create ID. Digital Signature Standard (DSS) is a Federal Information Processing Standard specifying a suite of algorithms that can be used to generate digital signatures established by the U.S. National Institute of Standards and Technology (NIST) in 1994.
Algorithms that are approved circa 2023:
- RSA digital signature algorithm is specified in the Internet Engineering Task Force Request for Comments (IETF RFC)
- Elliptic Curve Digital Signature Algorithm (ECDSA)
- Edwards Curve Digital Signature Algorithm (EdDSA)
Old signatures like Digital Signature Algorithm (DSA) is no longer specified in this standard but used to verify previously generated digital signatures.
You can read the PDF here. make sure it’s updated by checking the NIST website.
https://www.geeksforgeeks.org/digital-signature-standard-dss/
§ 11.50 Signature manifestations.
A) Signed electronic records shall contain information associated with the signing that clearly indicates all of the following:
(A.1) The printed name of the signer;
(A.2) The date and time when the signature was executed; and
(A.3) The meaning (such as review, approval, responsibility, or authorship) associated with the signature.
(B) The items identified in paragraphs (a)(1), (a)(2), and (a)(3) of this section shall be subject to the same controls as for electronic records and shall be included as part of any human readable form of the electronic record (such as electronic display or printout).
Software Developer / UI/UX designer Translation: When the user CRUDs anything there needs be a record or audit log.
- The person’s name
- The date & time
- The meaning associated with signature. For example “Upload” or “Review”
- Digital Signature DSS ID / Certificate
Then this information has to be part of the audit log that is human readable.
§ 11.70 Signature/record linking.
Electronic signatures and handwritten signatures executed to electronic records shall be linked to their respective electronic records to ensure that the signatures cannot be excised, copied, or otherwise transferred to falsify an electronic record by ordinary means.
Software Developer / UI/UX designer Translation:
Every user’s action like CRUD, you are going need these details described in signature manifest i.e. the Audit Log and their corresponding DSS ID or certification signature.
So the action is linked directly to the user.
Subpart C – Electronic Signatures
§ 11.100 General requirements.
A) Each electronic signature shall be unique to one individual and shall not be reused by, or reassigned to, anyone else.
Software Developer / UI/UX designer Translation: So if you generate DSS signature it has to be linked to a profile and shall not be reused to other profiles, or reassigned to anyone else. Which is just common sense because if a hacker or a bad user copies the signature of another user to their own profile to make it seem as though that user manipulated or stole data. Allowing that functionality to happen allows persons to falsify information, which is a bad idea.
B ) Before an organization establishes, assigns, certifies, or otherwise sanctions an individual’s electronic signature, or any element of such electronic signature, the organization shall verify the identity of the individual.
Software Developer / UI/UX designer Translation: The customer’s company need to verify the identity of the individual; otherwise, they cannot be given an electronic signature.
Persons using electronic signatures shall, prior to or at the time of such use, certify to the agency that the electronic signatures in their system, used on or after August 20, 1997, are intended to be the legally binding equivalent of traditional handwritten signatures.
(1) The certification shall be signed with a traditional handwritten signature and submitted in electronic or paper form. Information on where to submit the certification can be found on FDA’s web page on Letters of Non-Repudiation Agreement.
(2) Persons using electronic signatures shall, upon agency request, provide additional certification or testimony that a specific electronic signature is the legally binding equivalent of the signer’s handwritten signature.
Software Developer / UI/UX designer Translation: Basically, the customer or company is responsible for training and certification of employees to have electronic signature training. This is really common in pharmaceutical companies.
So for instance, I interned at Sanofi a long time ago and they make you go through a training module to learn about electronic signatures. You then sign off that you watched the course in which you obtain a certification. This makes your electronic signature legally binding in the same way as a handwritten signature.
§ 11.200 Electronic signature components and controls.
A) Electronic signatures that are not based upon biometrics shall:
- Employ at least two distinct identification components such as an identification code and password.
i) When an individual executes a series of signings during a single, continuous period of controlled system access, the first signing shall be executed using all electronic signature components; subsequent signings shall be executed using at least one electronic signature component that is only executable by, and designed to be used only by, the individual.
Software Developer / UI/UX designer Translation: If your software application does not use biometrics it has to follow these three bullet points:
- Use an identification code and password.
- The user has to sign in at least once, the electronic signature component (identification and password) has to be used at least once. Then the user can perform a series of steps.
- That sign-in has to be used only by the individual.
ii) When an individual executes one or more signings not performed during a single, continuous period of controlled system access, each signing shall be executed using all of the electronic signature components.
Software Developer / UI/UX designer Translation: If the user executes an action like upload and then logs out then comes back to log in and uploads again then that is a discontinuous period of controlled system access. Those are two separate sessions, so the user has to use the identification code and password again. So for each upload a signature was required. In the first bullet point you can have a system in which you use a signature once and they can do a series of steps.
2. Be used only by their genuine owners; and
Software Developer / UI/UX designer Translation: The sign in identification can only be used by genuine owners. This is the customer’s responsibility.
3. Be administered and executed to ensure that attempted use of an individual’s electronic signature by anyone other than its genuine owner requires collaboration of two or more individuals.
Software Developer / UI/UX designer Translation: Surprisingly the 21 CFR part 11 allows users to sign into a user’s account if there is a collaboration of two or more individuals within a company. They can even use their electronic signature.
b) Electronic signatures based upon biometrics shall be designed to ensure that they cannot be used by anyone other than their genuine owners.
Software Developer / UI/UX designer Translation: It’s the customer’s responsibility to make sure genuine owners are using biometrics and validate the biometric system. However, the design or software implementation is the responsibility of the software developer.
§ 11.300 Controls for identification codes/passwords.
Persons who use electronic signatures based upon use of identification codes in combination with passwords shall employ controls to ensure their security and integrity. Such controls shall include:
Software Developer / UI/UX designer Translation: Customers who use Sign in / Login systems like identification code and password are responsible to employ these controls below.
a) Maintaining the uniqueness of each combined identification code and password, such that no two individuals have the same combination of identification code and password.
Software Developer / UI/UX designer Translation: Your user profile cannot allow two individuals to share the same user ID or password.
b) Ensuring that identification code and password issuances are periodically checked, recalled, or revised (e.g., to cover such events as password aging).
Software Developer / UI/UX designer Translation: This is the customer’s responsibility to reset their password every 30 to 90 days. However, you can
implement an automated feature that requires users to change their passwords every 90 days, with system-generated alerts for upcoming password expirations and enforced updates for continued access.
Additionally, establish a routine security protocol to periodically review and, if necessary, revoke or update user identification codes and passwords to safeguard against unauthorized access.
Again, this is not a hard requirement for your software; just a nice quality of life feature to help you make a sale.
c) Following loss management procedures to electronically deauthorize lost, stolen, missing, or otherwise potentially compromised tokens, cards, and other devices that bear or generate identification code or password information, and to issue temporary or permanent replacements using suitable, rigorous controls.
Software Developer / UI/UX designer Translation: Again, implement a recovery password workflow.
However, deauthorized or lost hardware devices are definitely the responsibility of the customer.
d) Use of transaction safeguards to prevent unauthorized use of passwords and/or identification codes, and to detect and report in an immediate and urgent manner any attempts at their unauthorized use to the system security unit, and, as appropriate, to organizational management.
Software Developer / UI/UX designer Translation: Implement a feature that notifies the users that passwords have been compromised via in-app notification or email. Keycloak could be a good system to do that.
e) Initial and periodic testing of devices, such as tokens or cards, that bear or generate identification code or password information to ensure that they function properly and have not been altered in an unauthorized manner.
Software Developer / UI/UX designer Translation: Users just sign in to see if their password works. Again, not the software developer’s responsibility.
As a experienced software developer for the front-end and back-end you should have functionality in place already that validates sign ins, so when you sign in, the input boxes validate the sign in.
Conclusion
Here’s a list of software features you need implemented to be compliant:
- Generate accurate and complete copies of records. Provide export button for those records.
- Records are to be readily retrieved throughout the record’s retention period forever.
- Limiting system access to authorized individuals. Role-based access control (RBAC).
- The Audit Log records every CRUD action and each event must detail the requirements for 21 CFR part 11 shown below:
- The person’s name
- The date & time
- The meaning associated with signature. For example “Upload” “Review”
- Digital Sigurate ID / Certificate
- The Audit Log lives indefinitely
- Users Sign In workflows include user sign-up, sign-in, and log-out.
- Have release notes, have control procedures like git/github and Documentation of software.
- When software updates the Audit Log needs to make note of that.
- Document encryption or database encryptions
- Use of Digital Signature standards for user profile and user’s actions
- Every user’s action CRUD has to be signed with DSS
- One signature per User Profile
- Use an Identification code and password on Sign-in.
- Have a sign-in step for every session.
- User profile cannot allow two individuals to share the same user ID or password.
- Password recovery UX
- If someone logs in from somewhere else in the world notify me of that via in-app notification and email.
Essential links
Guidance for Industry Part 11, Electronic Records; Electronic Signatures — Scope and Application