21 CFR Part 11 Compliance Checklist for SaaS/ Cloud Applications

If your organization is switching over to paperless records and computerized systems to keep track of all data accumulated during the manufacture, testing, and release of a product, or if have a computerized system or electronic records on-site, you must comply with the regulatory requirements for Electronic Records and Electronic Signatures (ERES). The requirements are outlined in the US Code of Federal Regulations (CFR) Part 11.

Our 2-Day Virtual Seminar 21 CFR Part 11 Compliance for SaaS/Cloud Applications explores proven techniques for reducing costs, usually by two-thirds, associated with implementing, and maintaining computer systems in regulated environments.

• If you are evaluating a new computer system and are unsure if it's in compliance or not, the checklist below will help you before you commit to purchasing or signing a contract.
• If you already have a computer system and are not sure if it is compliant with the regulatory requirements, this checklist will help you understand if a remediation action is needed or if you are already in compliance.
• The checklist is also beneficial for anyone that uses computer systems to perform their job functions, for professionals working in the health care, clinical trial, biopharmaceutical, and medical device sectors.
• It is essential for software vendors, auditors, and quality staff involved in GxP applications.

The following table outlines the requirements regarding compliance to Electronic Records; Electronic Signatures 21 CFR Part 11. Use this as a checklist for compliance.

21 CFR PART 11 AREA	DESCRIPTION	COMPLIANCE
SUBPART B--ELECTRONIC RECORDS		YES	NO
11.10 - Controls for closed systems.	Persons who use closed systems to create, modify, maintain, or transmit electronic records shall employ procedures and controls designed to ensure the authenticity, integrity, and, when appropriate, the confidentiality of electronic records, and to ensure that the signer cannot readily repudiate the signed record as not genuine
11.30 - Controls for open systems	Persons who use open systems to create, modify, maintain, or transmit electronic records shall employ procedures and controls designed to ensure the authenticity, integrity, and, as appropriate, the confidentiality of electronic records from the point of their creation to the point of their receipt. Such procedures and controls shall include those identified in 11.10, as appropriate, and additional measures such as document encryption and use of appropriate digital signature standards to ensure, as necessary under the circumstances, record authenticity, integrity, and confidentiality.
11.50 - Signature manifestations	(a) Signed electronic records shall contain information associated with the signing that clearly indicates all of the following: The printed name of the signer; The date and time when the signature was executed; and The meaning (such as review, approval, responsibility, or authorship) associated with the signature. (b) The items identified in paragraphs (a)(1), (a)(2), and (a)(3) of this section shall be subject to the same controls as for electronic records and shall be included as part of any human readable form of the electronic record (such as electronic display or printout).
11.70 - Signature/record linking	Electronic signatures and handwritten signatures executed to electronic records shall be linked to their respective electronic records to ensure that the signatures cannot be excised, copied, or otherwise transferred to falsify an electronic record by ordinary means.
11.100 - General requirements.	(a) Each electronic signature shall be unique to one individual and shall not be reused by, or reassigned to, anyone else. (b) Before an organization establishes, assigns, certifies, or otherwise sanctions an individual's electronic signature, or any element of such electronic signature, the organization shall verify the identity of the individual. (c) Persons using electronic signatures shall, prior to or at the time of such use, certify to the agency that the electronic signatures in their system, used on or after August 20, 1997, are intended to be the legally binding equivalent of traditional handwritten signatures. The certification shall be submitted in paper form and signed with a traditional handwritten signature, to the Office of Regional Operations (HFC-100), 5600 Fishers Lane, Rockville, MD 20857 Persons using electronic signatures shall, upon agency request, provide additional certification or testimony that a specific electronic signature is the legally binding equivalent of the signer's handwritten signature.
11.200 - Electronic signature components and controls.	(a) Electronic signatures that are not based upon biometrics shall: Employ at least two distinct identification components such as an identification code and password. (i)When an individual executes a series of signings during a single, continuous period of controlled system access, the first signing shall be executed using all electronic signature components; subsequent signings shall be executed using at least one electronic signature component that is only executable by, and designed to be used only by, the individual. (ii)When an individual executes one or more signings not performed during a single, continuous period of controlled system access, each signing shall be executed using all of the electronic signature components. Be used only by their genuine owners; and Be administered and executed to ensure that attempted use of an individual's electronic signature by anyone other than its genuine owner requires collaboration of two or more individuals. (b) Electronic signatures based upon biometrics shall be designed to ensure that they cannot be used by anyone other than their genuine owners.
11.300 - Controls for identification codes/passwords.	Persons who use electronic signatures based upon use of identification codes in combination with passwords shall employ controls to ensure their security and integrity. Such controls shall include: Maintaining the uniqueness of each combined identification code and password, such that no two individuals have the same combination of identification code and password. Ensuring that identification code and password issuances are periodically checked, recalled, or revised (e.g., to cover such events as password aging). Following loss management procedures to electronically deauthorize lost, stolen, missing, or otherwise potentially compromised tokens, cards, and other devices that bear or generate identification code or password information, and to issue temporary or permanent replacements using suitable, rigorous controls. Use of transaction safeguards to prevent unauthorized use of passwords and/or identification codes, and to detect and report in an immediate and urgent manner any attempts at their unauthorized use to the system security unit, and, as appropriate, to organizational management. Initial and periodic testing of devices, such as tokens or cards, that bear or generate identification code or password information to ensure that they function properly and have not been altered in an unauthorized manner.