1. 21 CFR PART 11

2. AGENDA 21 CFR Part 11 Sections in 21 CFR Part 11 Terminology
About Part 11
Importance of Part 11
Scope of Part 11
Applications
Advantages
Validation
Predicate rule requirements
Security Procedures
Qualification &Accountability
Audit Trails
How to build the final rule of 21 CFR Part 11
Documentation
Complaince

3. what is called "21CFR11," or "FDA 21 CFR Part 11"
FDA is the acronym for the Food and Drug Administration .
FDA was established to serve and protect the interests of public health.
CFR stands for Code of Federal Regulations and refers to a document listing United States Federal Regulations.
The number "21" actually is short for "Title 21, Chapter I," and the number "11," for "Part 11" .
Title 21 concerns the area of Food and Drugs, Chapter I is the section related to FDA, and Part 11 is the sub-section of this chapter, which focuses on a specific area (i.e., Electronic Records; Electronic Signatures).
what is called "21CFR11," or "FDA 21 CFR Part 11"

4. So, the full title is truly :
"Code of Federal Regulations: Food and Drug Administration Title 21, Chapter I, Part Electronic Records; Electronic Signatures"
So, the full title is truly :

5. Sections of 21 CFR Part 11 ELECTRONIC RECORDS ELECTRONIC SIGNATURES
Secure process values and audit trails (alarms, events, operator actions, log-in/log-out, operator notes, electronic signatures)
All user actions can be configured to require signing or require signing and authorization
Protection of data through binary, compressed and check-summed records
User specific access according to authority level
Accurate time stamps are ensured using automatic Time Synchronization to a known clock source
Signature element controls unique user signature, password expiry, minimum password length, automatic log-off, automatic disabling and notification of failed login attempts
Provision for electronically copying data for archive
Ensuring unique users by retiring and not deleting accounts
Export facility providing viewing of secure records in human readable form

6. TERMINOLOGY Electronic Records:
Electronic records are "any combination of text, graphics, data, audio, pictorial, or other information representation in digital form that is created, modified, maintained, archived, retrieved, or distributed by a computer system".
Closed system:
A closed system is defined as an environment in which system access is controlled by persons who are responsible for the content of electronic records that are on the system.
Open system:
An open system means an environment in which system access is not controlled by persons who are responsible for the content of electronic records that are on the system
Electronic Signature:
An electronic signature is "a computer data compilation of any symbol or series of symbols executed, adopted, or authorized by an individual to be the legally binding equivalent of the individual's handwritten signature".
Biometrics:
“A method of verifying an individual’s identity based on measurement of the individual’s physical feature(s) or repeatable action(s) where those features and/or actions are both unique to that individual and measurable.”

7. Part 11 Origins to Present
1994 : Proposed Rule
1994: 1997 Industry responses
1997: 21 CFR Part 11, Electronic Records; Electronic Signatures, was originally issued in
Its proposed to: “Provide criteria for acceptance by the FDA, under certain circumstances, of electronic records, electronic signatures, and handwritten signatures executed to electronic records as equivalent to paper records and handwritten signatures executed on paper.”
: Guidance documents
2003: New scope and new guidance
2007: New Part 11

8. IMPORTANCE OF 21 CFR PART 11
Part 11 contains detailed guidelines on how to manage
electronic records and electronic signatures in order to maintain accuracy and security.
Part 11 is designed to help FDA-regulated companies obtain the benefits of electronic data management.
Part 11 is designed to prevent fraud while permitting the widest possible use of electronic technology.
Contains detailed guidelines that establish which electronic records and signatures can be considered equivalent to paper records and handwritten signatures.
Part 11 requires
(1) controlled access;
(2) Computer generated audit trails;
(3) electronic digital signatures

9. SCOPE OF CFR APPLICATIONS

10. APPLICATIONS
Section describes controls for closed systems, systems to which access is controlled by persons responsible for the content of electronic records on that system.
These controls designed to ensure the integrity of system operations and information stored in the system
Controls include :
(1) Validation
(2) the ability to generate accurate and complete copies of records
(3) archival protection of records
(4) use of computer-generated, time-stamped audit trails
(5) use of appropriate controls over systems documentation
(6) a determination that persons who develop, maintain, or use electronic records and signature systems have the education, training, and experience to perform their assigned tasks.

11. Section 11.30 Controls for Open Systems
Must develop procedures and controls that ensure authenticity, integrity, and confidentiality of electronic records and comply with all other parts of Section 11.10
Must use additional measures (e.g. document encryption, digital signature standards) to ensure authenticity, integrity, and confidentiality.
Section 11.70: Signature/Record Linking
Electronic signature and handwritten signatures must be linked to ensure signatures cannot be excised, copied, transferred or falsified

12. Section 11.50
It requires signature manifestations to contain information associated with the signing of electronic records.
Signed electronic records must include :
printed name of the signer
date and time of signature
the purpose of the signature (e.g. review, approval etc.)
Each of these must be readable by display or printout.
Section
Must be unique to an individual and not reassigned
Identity of individual must be verified by organization
Must certify electronic signature system to the agency prior to or at the time of use of the system
Certification must be submitted in paper form and, upon agency request, provide certification that signature is legally binding

13. SECTION 11.200 :Electronic Signature Components and Controls
Non-Biometric signatures must:
Contain at least two different identification components (e.g. User ID and Password)
Single sign-on with multiple tasks: Use all identification components at first, with partial identification for each task thereafter
Multiple sign-on without continuous access requires all identification components to be used each time
Be used only by the owner
Ensure use by other individuals is precluded and does not occur without collaboration by at least two other individuals
Biometric signatures must ensure use by the owner

14. SECTION 11.300: Controls for Identification Codes/Passwords
Persons using electronic signatures must use controls to ensure security and integrity should include:
Assuring that no two individuals have the same combination of identification code and password
Periodic check, recall, or revision of identification code and password
Loss management and replacement procedures
Testing of devices (i.e. tokens or cards) that produce or maintain identification codes or passwords to ensure proper function and unaltered state.
Unauthorized use safeguards
Report attempts in urgent & immediate manner
Security unit
Management, as appropriate

15. Electronic Batch records can eliminate mountains of paper work, speed processing and allow for statistical and trend analyses.
NDA’s and other submissions can be submitted electronically in place of paper submission.
Increases the speed of information exchange.
Cost savings from reduced need for storage space.
Manufacturing process streamlining.
Job creation in industries involved in electronic record and electronic signature technologies.
ADVANTAGES

16. The computerized system shall be validated in accordance with the Corporate Standards and regulatory requirements to ensure:
Accuracy
Reliability
Consistent Intended Performance
Ability to discern invalid or altered records
Evidence of validation (e.g., validation plan, validation summary, installation/operational/performance qualifications)
Validation

17. Predicate Rule Requirements
Provide governance for most regulatory activities within a life sciences organization
Predicate Rules include:
ICH E6 Good Clinical Practices (parts 310,312, 314)
Good Laboratory Practices (21 CFR Part 58)
Good Manufacturing Practices (21 CFR Part 210 & 211)
Quality System Practice (21 CFR Part 820)

18. Risk Based Approach to Part 11
The legal, regulatory and practical implications of electronic records. Good electronic records are solid in:
authenticity
reliability
trustworthiness
integrity
accessibility as needed
BENEFITS OF 21 CFR PART 11:
Everything from faster time-to-market for new drugs to reduced cost of mandated recalls can result from the implementation of Part 11 systems.
Risk Based Approach to Part 11

19. Security procedures and controls shall be designed and implemented to include:
Physical system access shall be limited to authorized individuals.
Operational system checks shall enforce the proper sequencing of steps in a process.
Logically access the System.
Electronically sign a record.
Access the operation or computer system input or output device.
Alter a record.
Perform a specific operation.
Device or terminal checks shall determine validity of the source of input or operation.

20. Qualification & Accountability
Determination that the following persons have the education, training, and experience to perform their assigned tasks:
Developer(s) of the computerized system
Maintainer of the computerized system
User(s) of the computerized system
ACCOUNTABILITY:
Establishment of, and adherence to,written policies and/or procedures that hold individuals accountable and responsible for actions initiated under their electronic signatures, in order to deter
records and signatures falsification.
Qualification & Accountability

21. Procedures and controls shall be designed and implemented for audit trails to:
Be Sure
Be Computer Generated
Be time- and date-stamped
Record creation of electronic records
Record modification of electronic records
Record deletion of electronic records
Ensure that changes to electronic records shall not obscure previously recorded information
Ensure that audit trail records shall be maintained for at least as long as the retention of the underlying
Ensure that audit trail records shall be available for FDA review and copying
Audit Trails

22. How to build 21 CFR Part 11 System
Understand system requirements
Design good data model
Define security roles
Enforce password change
Build Audit Trail for all tables:
Create history table for all tables
Use database insert, update, delete triggers to build history records
Record user, server date and time
Define your Electronic Record
Define approval process of Electronic Record
Build a mechanism to record versioning for your Electronic Records
Select your framework
Automate your development
Performance tuning
How to build 21 CFR Part 11 System

23. Establishment and use of appropriate controls over the documentation for system operation and maintenance, to include:
Distribution of documentation
Access to documentation
Use of documentation
Revision and change control procedures to maintain an audit trail that documents the time-sequences development and modification of the systems documentation
Documentation

24. Part 11 compliance begins with the company having an understand CFR Part 11 and becoming educated about the specific regulations and requirements.
The initial steps towards CFR Part 11 compliance includes :
Defining a set of objectives for achieving compliance
Communicating the implications of Part 11 for people involved and ensure the commitment to resolve non- compliance
Creating an interpretation of Part 11
These basic steps create an awareness of CFR Part 11 compliance within an organization and prepare the organization for changes expected due to CFR Part 11.
Compliance with Part 11

25. THANK YOU