**21 CFR Part 11 Compliance for**

##### Firebird and CDS {#firebird-and-cds .unnumbered}

#  {#section .unnumbered}

Prepared by:

BioPharm Systems, Inc.

2000 Alameda de las Pulgas, Suite 154

San Mateo, CA 94403

October 24, 2005About This Document

**Purpose**

The information presented in this document is based on 21 CFR Part 11
requirements as they apply to software applications used in regulated
environments. The present state of compliance of the Federated
Investigator Registry (Firebird) and Clinical Data System (CDS)
applications' is summarized and recommendations for additional
compliance measures are provided.

**Intended Audience**

This document is intended for all team members involved in the
development, validation, testing, integration and implementation of the
Firebird and CDS applications.

**Revision History**

+----------+---------------+-------------------+----------------------+
| #### V   | #### Date     | #                 | ####                 |
| ersion { |  Created {#da | ### Revisions Mad |  Revised By {#revise |
| #version | te-created .T | e {#revisions-mad | d-by .Table-heading} |
|  .Table- | able-heading} | e .Table-heading} |                      |
| heading} |               |                   |                      |
+==========+===============+===================+======================+
| 1.0      | 24-OCT-2005   | Approved Version  | Alice Crawford,      |
|          |               |                   |                      |
|          |               |                   | BioPharm Systems,    |
|          |               |                   | Inc.                 |
+----------+---------------+-------------------+----------------------+
| 1.01     | 01-May-2007   | CDS Information   | Alice Crawford,      |
|          |               | removed from      |                      |
|          |               | tables in         | BioPharm Systems,    |
|          |               | sections 1.3.1    | Inc.                 |
|          |               | and 1.3.2 for     |                      |
|          |               | Firebird review   |                      |
|          |               | purposes. TOC     |                      |
|          |               | page numbers      |                      |
|          |               | updated to        |                      |
|          |               | reflect above     |                      |
|          |               | change. No        |                      |
|          |               | content changes.  |                      |
+----------+---------------+-------------------+----------------------+

**Approval Signatures**

+--------------+-------------------+----------------------------------+
| ***Name***   | ***Title***       | ***Signature/Date Signed***      |
+--------------+-------------------+----------------------------------+
| Tim Vath     | Director of       | Signature on File                |
|              | Operations,       |                                  |
|              |                   |                                  |
|              | BioPharm Systems, |                                  |
|              | Inc.              |                                  |
+--------------+-------------------+----------------------------------+
|              |                   | October 24, 2005                 |
+--------------+-------------------+----------------------------------+
| Alice        | Senior            | Signature on File                |
| Crawford     | Consultant,       |                                  |
|              |                   |                                  |
|              | BioPharm Systems, |                                  |
|              | Inc.              |                                  |
+--------------+-------------------+----------------------------------+
|              |                   | October 24, 2005                 |
+--------------+-------------------+----------------------------------+

Table of Contents

[1 21 CFR Part 11 4](#cfr-part-11)

[1.1 Applicability 4](#applicability)

[1.2 21 CFR Part 11 Compliance Responsibilities
4](#cfr-part-11-compliance-responsibilities)

[1.3 21 CFR Part 11 Compliance Checklists
5](#cfr-part-11-compliance-checklists)

[1.3.1 Screening Checklist 6](#screening-checklist)

[1.3.2 Electronic Record Compliance Checklist
7](#electronic-record-compliance-checklist)

[1.3.3 Electronic Signature Compliance Checklist
14](#electronic-signature-compliance-checklist)

[2 References 20](#references)

# 21 CFR Part 11

Generally, compliance with regulatory requirements is the responsibility
of the organization that will be using a software system in a regulated
environment. However, since the Firebird and CDS applications will be
hosted by NCICB and used by a variety of system users, it is reasonable
from both an economic and efficiency perspective for NCICB to take the
necessary steps to ensure that the developmental and operational aspects
of these systems conform to applicable regulatory guidelines.

As with many governmental guidelines, several of the 21 CFR Part 11
requirements are broad in scope and sometimes ambiguous in intent. As a
result, the interpretation of such requirements can vary among
individuals and between organizations. For example, specific
requirements are outlined for audit trails of data changes, but a
precise definition of 'data' is not provided. Obviously changes to any
type of clinical patient data and case report form values must be
audited, but the tracking of other types of 'data' or settings (i.e.,
security settings, investigator information) is less clear and open to
interpretation.

## Applicability

A key aspect in determining compliance requirements is an understanding
of the applicability of 21 CFR Part 11. The following section briefly
presents the manner in which this regulation applies to software
applications:

> 21 CFR Part 11 -- Final Rule, Subpart A, Section 11.1 -- Scope (b)
> states:
>
> "This part applies to records in electronic form that are created,
> modified, maintained, archived, retrieved, or transmitted, under any
> records requirements set for in agency regulations. This part also
> applies to electronic records submitted to the agency under
> requirements of the Federal Food, Drug and Cosmetic Act and the Public
> Health Service Act, even if such records are not specifically
> identified in agency regulations. However, this part does not apply to
> paper records that are, or have been, transmitted by electronic
> means."
>
> 21 CFR Part 11 -- Final Rule, Subpart A, Section 11.1 -- Scope (e)
> states:
>
> *"Computer systems (including hardware and software), controls, and
> attendant documentation maintained under this part shall be readily
> available for, and subject to FDA inspection."*

Therefore, any record that is required to be maintained under the
Predicate Rules (e.g. Good Clinical Practices \[GCPs\], Good Laboratory
Practices \[GLPs\] and/or current Good Manufacturing Practices \[cGMPs\]
-- together referred to as the GxP's) and which a company decides to
store as an electronic record, or any electronic record that is
submitted to the FDA is subject to 21 CFR Part 11. Likewise, any
software application that meets the above criteria is subject to 21 CFR
Part 11.

## 21 CFR Part 11 Compliance Responsibilities

Compliance with 21 CFR Part 11 involves technical and developmental
controls (functionality, development documentation, testing, etc.) at
the vendor level as well as procedural and administrative controls
(SOPs, training, QA, etc.) at the user organization level. In other
words, a vendor can develop an application that meets the required
technical requirements, but it is the user's responsibility to implement
and maintain appropriate procedural and process controls associated with
the implementation, maintenance and use of the system. It is critical
that once an application is considered to be 'compliant' that measures
be taken to maintain the compliant state. Such measures typically
include scheduled SOP reviews and QA audits and inspections.

> Examples of technical and developmental controls include:

-   Functional Requirements documentation

-   Technical Design Specifications

-   Change Management documentation

-   Documentation of Electronic Signature functionality

-   Test Plans, documented Test Results and Traceability to Requirements

-   User documentation (User Guide, on-line help, etc.)

-   Validation documentation

-   Organization chart, job descriptions, training records

> Examples of organizational procedural and process controls include:

-   SOPs (system deployment/setup/installation, system validation,
    system maintenance, physical and logical security, backup and
    recovery, training, change control, electronic signature, etc.)

-   Systems documentation providing an overall description of the
    computerized systems and the relationships among hardware, software
    and physical environment

-   Quality Assurance audits and inspections

-   Training guidelines and records

-   System Inventory records

-   Validation documentation

-   Hardware and software maintenance records

## 21 CFR Part 11 Compliance Checklists

Three 21 CFR Part 11 checklists have been developed to assist in the
determination of the following issues:

-   Are the Firebird and CDS applications required to comply with the 21
    CFR Part 11 requirements?

-   Do the Firebird and CDS applications currently comply with the
    Electronic Record requirements of 21 CFR Part 11?

-   If required, do the Firebird and CDS applications currently comply
    with the Electronic Signature requirements of 21 CFR Part 11?

### Screening Checklist

Evaluation of the following questions supports the assessment that both
the Firebird and CDS applications must comply with 21 CFR Part 11
requirements.

+---+-----------------------------------------+---+---+-----------------+
| * | ***Question***                          | * |   |                 |
| * |                                         | * |   |                 |
| * |                                         | * |   |                 |
| I |                                         | F |   |                 |
| t |                                         | i |   |                 |
| e |                                         | r |   |                 |
| m |                                         | e |   |                 |
| * |                                         | b |   |                 |
| * |                                         | i |   |                 |
| * |                                         | r |   |                 |
|   |                                         | d |   |                 |
|   |                                         | * |   |                 |
|   |                                         | * |   |                 |
|   |                                         | * |   |                 |
+===+=========================================+===+===+=================+
|   |                                         | * | * | ***Comments***  |
|   |                                         | * | * |                 |
|   |                                         | * | * |                 |
|   |                                         | Y | N |                 |
|   |                                         | e | o |                 |
|   |                                         | s | * |                 |
|   |                                         | * | * |                 |
|   |                                         | * | * |                 |
|   |                                         | * |   |                 |
+---+-----------------------------------------+---+---+-----------------+
| 1 | Has the company decided to keep this    | X |   | Firebird will   |
|   | record as an electronic record?         |   |   | maintain        |
|   |                                         |   |   | electronic      |
|   | *Subpart A - Section 11.1 (b)*          |   |   | records.        |
+---+-----------------------------------------+---+---+-----------------+
| 2 | Is record maintenance required under    | X |   | Firebird will   |
|   | the Predicate Rules (e.g. Good Clinical |   |   | maintain        |
|   | Practices \[GCPs\], Good Laboratory     |   |   | records under   |
|   | Practices \[GLPs\] and/or current Good  |   |   | the Predicate   |
|   | Manufacturing Practices \[cGMPs\] --    |   |   | Rules.          |
|   | together referred to as the GxP's)?     |   |   |                 |
|   |                                         |   |   |                 |
|   | *Subpart A - Section 11.1 (b)*          |   |   |                 |
+---+-----------------------------------------+---+---+-----------------+
| 3 | Will the electronic record be submitted | X |   | Firebird will   |
|   | to the FDA?                             |   |   | be used to      |
|   |                                         |   |   | submit records  |
|   | If "*Yes*", then 21 CFR Part 11 **does  |   |   | to the FDA --   |
|   | apply**, proceed directly to Electronic |   |   | specifically    |
|   | Record Compliance Checklist.            |   |   | the FDA Form    |
|   |                                         |   |   | 1572 and        |
|   | *Subpart A - Section 11.1 (b)*          |   |   | supporting      |
|   |                                         |   |   | information.    |
+---+-----------------------------------------+---+---+-----------------+

### Electronic Record Compliance Checklist

Evaluation of the following questions supports the assessment that the
Firebird and CDS applications must comply with the 21 CFR Part 11
requirements for electronic records.

+---+--------------+------------------+-------------------+-------------+
| * | **           | ***Firebird***   |                   |             |
| * | *Question*** |                  |                   |             |
| * |              |                  |                   |             |
| I |              |                  |                   |             |
| t |              |                  |                   |             |
| e |              |                  |                   |             |
| m |              |                  |                   |             |
| * |              |                  |                   |             |
| * |              |                  |                   |             |
| * |              |                  |                   |             |
+===+==============+==================+===================+=============+
|   |              | ***Current       | ***Technical***   | **          |
|   |              | State***         |                   | *Process*** |
|   |              |                  | ***Action         |             |
|   |              |                  | Items***          | ***Action   |
|   |              |                  |                   | Items***    |
+---+--------------+------------------+-------------------+-------------+
| * |              |                  |                   |             |
| * |              |                  |                   |             |
| A |              |                  |                   |             |
| r |              |                  |                   |             |
| e |              |                  |                   |             |
| p |              |                  |                   |             |
| r |              |                  |                   |             |
| o |              |                  |                   |             |
| c |              |                  |                   |             |
| e |              |                  |                   |             |
| d |              |                  |                   |             |
| u |              |                  |                   |             |
| r |              |                  |                   |             |
| e |              |                  |                   |             |
| s |              |                  |                   |             |
| a |              |                  |                   |             |
| n |              |                  |                   |             |
| d |              |                  |                   |             |
| c |              |                  |                   |             |
| o |              |                  |                   |             |
| n |              |                  |                   |             |
| t |              |                  |                   |             |
| r |              |                  |                   |             |
| o |              |                  |                   |             |
| l |              |                  |                   |             |
| s |              |                  |                   |             |
| e |              |                  |                   |             |
| m |              |                  |                   |             |
| p |              |                  |                   |             |
| l |              |                  |                   |             |
| o |              |                  |                   |             |
| y |              |                  |                   |             |
| e |              |                  |                   |             |
| d |              |                  |                   |             |
| t |              |                  |                   |             |
| o |              |                  |                   |             |
| e |              |                  |                   |             |
| n |              |                  |                   |             |
| s |              |                  |                   |             |
| u |              |                  |                   |             |
| r |              |                  |                   |             |
| e |              |                  |                   |             |
| : |              |                  |                   |             |
| * |              |                  |                   |             |
| * |              |                  |                   |             |
+---+--------------+------------------+-------------------+-------------+
| 1 | Validation   | Not yet          |                   | Firebird    |
|   | of systems   | validated.       |                   | will be     |
|   | to ensure    |                  |                   | validated   |
|   | accuracy,    |                  |                   | to ensure   |
|   | reliability, |                  |                   | accuracy,   |
|   | consistent   |                  |                   | r           |
|   | intended     |                  |                   | eliability, |
|   | purpose, and |                  |                   | consistent  |
|   | the ability  |                  |                   | intended    |
|   | to discern   |                  |                   | purpose and |
|   | invalid or   |                  |                   | the ability |
|   | altered      |                  |                   | to discern  |
|   | records?     |                  |                   | invalid     |
|   |              |                  |                   | records     |
|   | *Subpart B   |                  |                   | prior to    |
|   | -- Section   |                  |                   | release to  |
|   | 11.10 (a)*   |                  |                   | production. |
+---+--------------+------------------+-------------------+-------------+
| 2 | The ability  | Currently, the   | Assess and        |             |
|   | to generate  | following        | determine the     |             |
|   | accurate and | records can be   | manner in which   |             |
|   | complete     | generated in     | audit trail       |             |
|   | copies of    | human readable   | records can be    |             |
|   | records in   | and electronic   | accessed          |             |
|   | both human   | form:            | electronically    |             |
|   | readable and |                  | and printed.      |             |
|   | electronic   | -   FDA Form     |                   |             |
|   | form?        |     1572         | CDER recommends   |             |
|   |              |                  | that during       |             |
|   | *Subpart B   | -   FDF          | audits, copies of |             |
|   | -- Section   |                  | electronic        |             |
|   | 11.10 (b)*   | -   CV           | records be        |             |
|   |              |                  | supplied by:      |             |
|   |              | -   CTEP         |                   |             |
|   |              |     Delegate     | -   Producing     |             |
|   |              |     Form         |     copies of     |             |
|   |              |                  |     records held  |             |
|   |              | ```{=html}       |     in common     |             |
|   |              | <!-- -->         |     portable      |             |
|   |              | ```              |     formats if    |             |
|   |              | -   Uploaded     |     records are   |             |
|   |              |     Protocol     |     maintained in |             |
|   |              |     documents    |     these         |             |
|   |              |                  |     formats.      |             |
|   |              |                  |                   |             |
|   |              |                  | -   Using         |             |
|   |              |                  |     established   |             |
|   |              |                  |     automated     |             |
|   |              |                  |     conversion or |             |
|   |              |                  |     export        |             |
|   |              |                  |     methods to    |             |
|   |              |                  |     make copies   |             |
|   |              |                  |     in a more     |             |
|   |              |                  |     common format |             |
|   |              |                  |     (i.e., PDF,   |             |
|   |              |                  |     XML, SGML).   |             |
|   |              |                  |                   |             |
|   |              |                  | Whatever copying  |             |
|   |              |                  | method is used,   |             |
|   |              |                  | the copies must   |             |
|   |              |                  | preserve the      |             |
|   |              |                  | content and       |             |
|   |              |                  | meaning of the    |             |
|   |              |                  | electronic        |             |
|   |              |                  | record.           |             |
+---+--------------+------------------+-------------------+-------------+
| 3 | Protection   | The verification | Determine how     | Assess,     |
|   | of records   | of system user   | records will be   | determine   |
|   | to enable    | access, roles    | archived.         | and         |
|   | their        | and privileges   |                   | document    |
|   | accurate and | is considered an | Records can be    | the record  |
|   | ready        | integral part of | archived in       | retention   |
|   | retrieval    | the protection   | electronic format | period for  |
|   | throughout   | of records.      | to non-electronic | the         |
|   | the records  | Firebird         | media such as     | following   |
|   | retention    | provides this    | microfilm,        | records:    |
|   | period?      | protection, but  | microfiche and    |             |
|   |              | additional       | paper, or they    | -   FDA     |
|   | *Subpart B   | security testing | can be archived   |     Form    |
|   | -- Section   | needs to be      | to a standard     |     1572    |
|   | 11.10 (c)*   | performed.       | electronic file   |             |
|   |              |                  | format (i.e.,     | -   FDF     |
|   |              |                  | PDF, XML, SGML).  |             |
|   |              |                  | The content and   | -   CTEP    |
|   |              |                  | meaning of all    |             |
|   |              |                  | archived records  |    Delegate |
|   |              |                  | must be           |     form    |
|   |              |                  | maintained.       |             |
|   |              |                  |                   | ```{=html}  |
|   |              |                  | []{.mark}         | <!-- -->    |
|   |              |                  |                   | ```         |
|   |              |                  |                   | -           |
|   |              |                  |                   |  Downloaded |
|   |              |                  |                   |             |
|   |              |                  |                   |    protocol |
|   |              |                  |                   |             |
|   |              |                  |                   |   documents |
|   |              |                  |                   |             |
|   |              |                  |                   | Determine   |
|   |              |                  |                   | and         |
|   |              |                  |                   | document    |
|   |              |                  |                   | when and if |
|   |              |                  |                   | document    |
|   |              |                  |                   | records     |
|   |              |                  |                   | will be     |
|   |              |                  |                   | archived    |
|   |              |                  |                   | and the     |
|   |              |                  |                   | retrieval   |
|   |              |                  |                   | process     |
|   |              |                  |                   | associated  |
|   |              |                  |                   | with        |
|   |              |                  |                   | archived    |
|   |              |                  |                   | records.    |
|   |              |                  |                   |             |
|   |              |                  |                   | Document    |
|   |              |                  |                   | the record  |
|   |              |                  |                   | protection  |
|   |              |                  |                   | c           |
|   |              |                  |                   | apabilities |
|   |              |                  |                   | of the      |
|   |              |                  |                   | system.     |
+---+--------------+------------------+-------------------+-------------+
| 4 | Limitation   | During           | Complete          | NCICB needs |
|   | of system    | development and  | assessment of     | to prepare  |
|   | access to    | testing, servers | additional        | documented  |
|   | authorized   | on which the     | security measures | physical    |
|   | individuals? | Firebird code is | (integration of   | security    |
|   |              | stored and       | CSM, etc.). Once  | SOPs for    |
|   | *Subpart B   | individual       | assessment and    | the         |
|   | -- Section   | computers must   | security          | production  |
|   | 11.10 (d)*   | be sufficiently  | modifications are | version of  |
|   |              | secured (i.e.    | completed, the    | Firebird.   |
|   |              | server room      | security of the   |             |
|   |              | security         | system will need  | It is       |
|   |              | measures,        | to be formally    | recommended |
|   |              | username and     | tested.           | that user   |
|   |              | password         |                   | passwords   |
|   |              | protection for   |                   | be changed  |
|   |              | each             |                   | at          |
|   |              | individual's PC, |                   | established |
|   |              | etc.) to ensure  |                   | (           |
|   |              | access only to   |                   | documented) |
|   |              | authorized       |                   | intervals.  |
|   |              | individuals.     |                   |             |
|   |              |                  |                   | It is       |
|   |              | Currently, all   |                   | recommended |
|   |              | Firebird users   |                   | that a      |
|   |              | are required to  |                   | cumulative  |
|   |              | have a login     |                   | record be   |
|   |              | name and         |                   | available   |
|   |              | password and/or  |                   | that        |
|   |              | a SAFE card to   |                   | indicates,  |
|   |              | access the       |                   | for any     |
|   |              | system.          |                   | point in    |
|   |              |                  |                   | time, the   |
|   |              |                  |                   | names of    |
|   |              |                  |                   | authorized  |
|   |              |                  |                   | personnel,  |
|   |              |                  |                   | their       |
|   |              |                  |                   | titles,     |
|   |              |                  |                   | o           |
|   |              |                  |                   | rganization |
|   |              |                  |                   | affiliation |
|   |              |                  |                   | and a list  |
|   |              |                  |                   | of their    |
|   |              |                  |                   | system      |
|   |              |                  |                   | access      |
|   |              |                  |                   | privileges. |
+---+--------------+------------------+-------------------+-------------+
| 5 | Use of       | Firebird does    | Implement audit   | Assess,     |
|   | secure,      | not have audit   | trail             | determine   |
|   | comput       | trail            | functionality.    | and         |
|   | er-generated | functionality.   |                   | document    |
|   | time-stamped |                  | Audit trail       | the types   |
|   | audit trails |                  | date/time stamps  | of changes  |
|   | to           |                  | should include    | that will   |
|   | i            |                  | the year, month,  | be audited. |
|   | ndependently |                  | day, hour and     |             |
|   | record the   |                  | minute.           | []{.mark}   |
|   | date and     |                  |                   |             |
|   | time of      |                  |                   | Audit trail |
|   | operator     |                  |                   | records     |
|   | entries that |                  |                   | should      |
|   | create,      |                  |                   | indicate    |
|   | modify AND   |                  |                   | 'Who'       |
|   | delete       |                  |                   | modified a  |
|   | electronic   |                  |                   | record,     |
|   | records?     |                  |                   | 'What' the  |
|   |              |                  |                   | change was  |
|   | *Subpart B   |                  |                   | and 'When'  |
|   | -- Section   |                  |                   | the change  |
|   | 11.10 (e)*   |                  |                   | occurred.   |
|   |              |                  |                   | 'Why' the   |
|   |              |                  |                   | change was  |
|   |              |                  |                   | made is not |
|   |              |                  |                   | necessary   |
|   |              |                  |                   | unless      |
|   |              |                  |                   | required by |
|   |              |                  |                   | other       |
|   |              |                  |                   | r           |
|   |              |                  |                   | egulations. |
|   |              |                  |                   |             |
|   |              |                  |                   | In general, |
|   |              |                  |                   | if an       |
|   |              |                  |                   | application |
|   |              |                  |                   | generates,  |
|   |              |                  |                   | retains,    |
|   |              |                  |                   | imports or  |
|   |              |                  |                   | exports any |
|   |              |                  |                   | electronic  |
|   |              |                  |                   | 'data', the |
|   |              |                  |                   | audit Trail |
|   |              |                  |                   | should      |
|   |              |                  |                   | begin the   |
|   |              |                  |                   | instant the |
|   |              |                  |                   | data        |
|   |              |                  |                   | 'enters'    |
|   |              |                  |                   | the         |
|   |              |                  |                   | a           |
|   |              |                  |                   | pplication. |
|   |              |                  |                   | For         |
|   |              |                  |                   | textural    |
|   |              |                  |                   | documents,  |
|   |              |                  |                   | the audit   |
|   |              |                  |                   | trail       |
|   |              |                  |                   | should      |
|   |              |                  |                   | begin upon  |
|   |              |                  |                   | document    |
|   |              |                  |                   | approval.   |
|   |              |                  |                   |             |
|   |              |                  |                   | For         |
|   |              |                  |                   | electronic  |
|   |              |                  |                   | signatures, |
|   |              |                  |                   | the         |
|   |              |                  |                   | execution   |
|   |              |                  |                   | of the      |
|   |              |                  |                   | signature   |
|   |              |                  |                   | must be     |
|   |              |                  |                   | audited.    |
|   |              |                  |                   |             |
|   |              |                  |                   | []{.mark}   |
|   |              |                  |                   |             |
|   |              |                  |                   | Do          |
|   |              |                  |                   | cumentation |
|   |              |                  |                   | must exist  |
|   |              |                  |                   | indicating  |
|   |              |                  |                   | what time   |
|   |              |                  |                   | zone is     |
|   |              |                  |                   | used for    |
|   |              |                  |                   | the         |
|   |              |                  |                   | imp         |
|   |              |                  |                   | lementation |
|   |              |                  |                   | of time     |
|   |              |                  |                   | stamps. All |
|   |              |                  |                   | time zone   |
|   |              |                  |                   | acronyms    |
|   |              |                  |                   | must be     |
|   |              |                  |                   | defined. If |
|   |              |                  |                   | system      |
|   |              |                  |                   | users are   |
|   |              |                  |                   | in          |
|   |              |                  |                   | different   |
|   |              |                  |                   | time zones, |
|   |              |                  |                   | only the    |
|   |              |                  |                   | one where   |
|   |              |                  |                   | the         |
|   |              |                  |                   | application |
|   |              |                  |                   | is          |
|   |              |                  |                   | maintained  |
|   |              |                  |                   | needs to be |
|   |              |                  |                   | recorded.   |
|   |              |                  |                   |             |
|   |              |                  |                   | []{.mark}   |
+---+--------------+------------------+-------------------+-------------+
| 6 | Record       | Firebird does    | Once audit trail  |             |
|   | changes do   | not have audit   | decisions are     |             |
|   | not obscure  | trail            | made, the audit   |             |
|   | previously   | functionality.   | trail needs to be |             |
|   | recorded     |                  | designed in such  |             |
|   | information? |                  | a way as to       |             |
|   |              |                  | ensure that       |             |
|   | *Subpart B   |                  | previous data is  |             |
|   | -- Section   |                  | not obscured when |             |
|   | 11.10 (e)*   |                  | a change is made. |             |
|   |              |                  | Historical data   |             |
|   |              |                  | and a             |             |
|   |              |                  | modification      |             |
|   |              |                  | trail must be     |             |
|   |              |                  | available for     |             |
|   |              |                  | review. Both old  |             |
|   |              |                  | and new values    |             |
|   |              |                  | must be recorded  |             |
|   |              |                  | in such a manner  |             |
|   |              |                  | as to allow an    |             |
|   |              |                  | auditor to        |             |
|   |              |                  | reconstruct the   |             |
|   |              |                  | entire course of  |             |
|   |              |                  | events in an      |             |
|   |              |                  | incremental and   |             |
|   |              |                  | chronological     |             |
|   |              |                  | order.            |             |
+---+--------------+------------------+-------------------+-------------+
| 7 | Retention of | Firebird does    | Archiving         | The         |
|   | audit trail  | not have audit   | functionality for | retention   |
|   | information  | trail            | audited records   | period for  |
|   | for a period | functionality.   | needs to be       | all audited |
|   | at least as  |                  | developed and     | records     |
|   | long as that |                  | implemented.      | will need   |
|   | required for |                  |                   | to be       |
|   | the subject  |                  | A retrieval       | determined  |
|   | electronic   |                  | mechanism for     | and         |
|   | records and  |                  | archived audited  | documented. |
|   | keep it      |                  | records must also |             |
|   | available    |                  | be developed and  | Business    |
|   | for agency   |                  | implemented.      | rules as to |
|   | inspection   |                  |                   | when        |
|   | and copying? |                  |                   | audited     |
|   |              |                  |                   | records can |
|   | *Subpart B   |                  |                   | be archived |
|   | -- Section   |                  |                   | need to be  |
|   | 11.10 (e)*   |                  |                   | determined. |
|   |              |                  |                   |             |
|   |              |                  |                   | Example:    |
|   |              |                  |                   | Does an     |
|   |              |                  |                   | individual  |
|   |              |                  |                   | with        |
|   |              |                  |                   | appropriate |
|   |              |                  |                   | security    |
|   |              |                  |                   | and job     |
|   |              |                  |                   | function    |
|   |              |                  |                   | need to     |
|   |              |                  |                   | approve     |
|   |              |                  |                   | /disapprove |
|   |              |                  |                   | audited     |
|   |              |                  |                   | records     |
|   |              |                  |                   | before they |
|   |              |                  |                   | can be      |
|   |              |                  |                   | archived?   |
|   |              |                  |                   | What        |
|   |              |                  |                   | happens if  |
|   |              |                  |                   | an audited  |
|   |              |                  |                   | record is   |
|   |              |                  |                   | not         |
|   |              |                  |                   | approved?   |
+---+--------------+------------------+-------------------+-------------+
| 8 | Use of       | Operational      |                   |             |
|   | operational  | system checks    |                   |             |
|   | system       | are used where   |                   |             |
|   | checks to    | appropriate.     |                   |             |
|   | enforce      | Examples:        |                   |             |
|   | permitted    | Completion of    |                   |             |
|   | sequencing   | FDA Form 1572,   |                   |             |
|   | of steps and | ability to       |                   |             |
|   | events, as   | complete and     |                   |             |
|   | appropriate? | submit protocol  |                   |             |
|   |              | packets, etc.    |                   |             |
|   | *Subpart B   |                  |                   |             |
|   | -- Section   |                  |                   |             |
|   | 11.10 (f)*   |                  |                   |             |
+---+--------------+------------------+-------------------+-------------+
| 9 | Use of       | Authority checks | Enforce           | The         |
|   | authority    | are used to      | additional        | inactivity  |
|   | checks to    | ensure that only | security measures | timer       |
|   | ensure that  | authorized       | after security    | process     |
|   | only         | Firebird users   | assessment is     | should be   |
|   | authorized   | can access the   | complete.         | defined and |
|   | individuals  | system.          |                   | detailed in |
|   | can use the  |                  | Apply security    | the         |
|   | system,      | Authority checks | rules to the      | Firebird    |
|   | el           | are used to      | audit trail       | r           |
|   | ectronically | ensure that only | records.          | equirements |
|   | sign a       | authorized       |                   | document    |
|   | record,      | system users     | For short periods | and in the  |
|   | access the   | with a SAFE card | of inactivity,    | NCICB SOP   |
|   | operation or | and unique       | some procedure    | for the use |
|   | computer     | password can     | should protect    | of the      |
|   | system input | electronically   | against           | a           |
|   | or output    | sign a record.   | unauthorized data | pplication. |
|   | device,      | Only the logged  | entry (i.e.,      |             |
|   | alter a      | in SAFE card     | password          | The invalid |
|   | record, or   | user can         | protected         | login       |
|   | perform the  | electronically   | automatic screen  | process     |
|   | operation at | sign a Firebird  | saver).           | should be   |
|   | hand?        | record.          |                   | defined and |
|   |              |                  | Excessive invalid | detailed in |
|   | *Subpart B   | An inactivity    | login attempts    | the         |
|   | -- Section   | timer provides   | should result in  | Firebird    |
|   | 11.10 (g)*   | an automatic log | trigger intrusion | r           |
|   |              | off for          | alarms and        | equirements |
|   |              | individual       | temporary port    | document    |
|   |              | Firebird         | blocking to       | and in the  |
|   |              | sessions.        | impede mechanized | NCICB SOP   |
|   |              |                  | hacking attempts. | for the use |
|   |              |                  |                   | of the      |
|   |              |                  |                   | a           |
|   |              |                  |                   | pplication. |
+---+--------------+------------------+-------------------+-------------+
| 1 | Use of       | Firebird does    | Virus scanning    | A           |
| 0 | device       | not accept data  | functionality     | de          |
|   | checks to    | input directly   | should be         | termination |
|   | determine,   | from an external | implemented on    | should be   |
|   | as           | machine or       | all downloaded    | made and    |
|   | appropriate, | application. It  | documents.        | documented  |
|   | the validity | does, however,   |                   | as to the   |
|   | of the       | allow the        | Document size     | maximum     |
|   | source of    | download of      | restrictions need | document    |
|   | data input   | various types of | to be implemented | size that   |
|   | or operation | document files   | for downloaded    | is allowed  |
|   | instruction? | from other       | documents.        | for         |
|   |              | sources.         |                   | d           |
|   | *Subpart B   |                  | A user friendly   | ownloading. |
|   | -- Section   |                  | message will need |             |
|   | 11.10 (h)*   |                  | to be displayed   |             |
|   |              |                  | if a system user  |             |
|   |              |                  | attempts to       |             |
|   |              |                  | download a        |             |
|   |              |                  | document with a   |             |
|   |              |                  | size greater than |             |
|   |              |                  | that allowed by   |             |
|   |              |                  | the system.       |             |
+---+--------------+------------------+-------------------+-------------+
| 1 | D            | Firebird is      | Update on-line    | Information |
| 1 | etermination | utilizing the    | help:             | on the      |
|   | that persons | Secure Access    |                   | company     |
|   | who develop, | for Everyone     | -   Revisions to  | with which  |
|   | maintain, or | (SAFE) standard  |     reflect       | CTIS has    |
|   | use          | as the Identity  |     changed       | worked to   |
|   | electronic   | Assurance        |     functionality | develop the |
|   | recor        | Infrastructure   |                   | electronic  |
|   | d/electronic | for electronic   | -   Updates to    | signature   |
|   | signature    | signatures. SAFE |     reflect new   | component   |
|   | systems have | is the industry  |     functionality | of Firebird |
|   | the          | standard         |                   | should be   |
|   | education,   | sponsored by     | -   Addition of   | included in |
|   | training,    | PhRMA and was    |     flow diagrams | the         |
|   | and          | developed with   |                   | development |
|   | experience   | the              |                   | doc         |
|   | to perform   | participation of |                   | umentation. |
|   | their        | companies,       |                   |             |
|   | assigned     | associations and |                   | The         |
|   | tasks.       | regulatory       |                   | education,  |
|   |              | agencies. The    |                   | experience  |
|   | *Subpart B   | SAFE standard    |                   | and         |
|   | -- Section   | provides a       |                   | training    |
|   | 11.10 (i)*   | trusted          |                   | records for |
|   |              | infrastructure   |                   | i           |
|   |              | that delivers    |                   | ndividuals, |
|   |              | unique           |                   | who have    |
|   |              | credentials to   |                   | developed,  |
|   |              | allow remote     |                   | tested and  |
|   |              | electronic       |                   | who will    |
|   |              | authentication   |                   | maintain    |
|   |              | and the legally  |                   | Firebird    |
|   |              | enforceable      |                   | must be     |
|   |              | digital signing  |                   | current and |
|   |              | of documents.    |                   | readily     |
|   |              |                  |                   | available   |
|   |              | On-line help is  |                   | at all      |
|   |              | available for    |                   | times and   |
|   |              | system users     |                   | included in |
|   |              | during the       |                   | the         |
|   |              | performance of   |                   | development |
|   |              | their assigned   |                   | doc         |
|   |              | tasks.           |                   | umentation. |
|   |              |                  |                   |             |
|   |              |                  |                   | NCICB must  |
|   |              |                  |                   | develop and |
|   |              |                  |                   | document    |
|   |              |                  |                   | the manner  |
|   |              |                  |                   | in which    |
|   |              |                  |                   | individuals |
|   |              |                  |                   | who sign    |
|   |              |                  |                   | documents   |
|   |              |                  |                   | ele         |
|   |              |                  |                   | ctronically |
|   |              |                  |                   | will be     |
|   |              |                  |                   | trained and |
|   |              |                  |                   | monitored.  |
|   |              |                  |                   |             |
|   |              |                  |                   | A Firebird  |
|   |              |                  |                   | User Guide  |
|   |              |                  |                   | should be   |
|   |              |                  |                   | developed   |
|   |              |                  |                   | for users   |
|   |              |                  |                   | to          |
|   |              |                  |                   | reference   |
|   |              |                  |                   | in          |
|   |              |                  |                   | preparation |
|   |              |                  |                   | for and     |
|   |              |                  |                   | during the  |
|   |              |                  |                   | performance |
|   |              |                  |                   | of their    |
|   |              |                  |                   | assigned    |
|   |              |                  |                   | tasks.      |
+---+--------------+------------------+-------------------+-------------+
| 1 | E            | Functionality is |                   | NCICB must  |
| 2 | stablishment | built into the   |                   | develop and |
|   | of, and      | Firebird system  |                   | document    |
|   | adherence    | to help ensure   |                   | written     |
|   | to, written  | that the user    |                   | procedures  |
|   | procedures   | logged into the  |                   | for the     |
|   | that hold    | system is the    |                   | acc         |
|   | individuals  | only individual  |                   | ountability |
|   | accountable  | who can          |                   | of system   |
|   | and          | electronically   |                   | users who   |
|   | responsible  | sign a document  |                   | ele         |
|   | for actions  | during that      |                   | ctronically |
|   | initiated    | session.         |                   | sign system |
|   | under their  |                  |                   | documents.  |
|   | electronic   |                  |                   |             |
|   | signatures,  |                  |                   | A           |
|   | in order to  |                  |                   | documented  |
|   | deter record |                  |                   | method for  |
|   | and          |                  |                   | monitoring  |
|   | signature    |                  |                   | these       |
|   | fa           |                  |                   | procedures  |
|   | lsification? |                  |                   | should also |
|   |              |                  |                   | be          |
|   | *Subpart B   |                  |                   | developed   |
|   | -- Section   |                  |                   | and         |
|   | 11.10 (j)*   |                  |                   | documented. |
+---+--------------+------------------+-------------------+-------------+
| 1 | Adequate     | Currently, CTIS  |                   | Once        |
| 3 | controls     | uses VSS for     |                   | Firebird is |
|   | over the     | temporary        |                   | placed in   |
|   | distribution | storage. Once a  |                   | production, |
|   | of, access   | round of         |                   | some of the |
|   | to, and use  | development is   |                   | Firebird    |
|   | of           | completed, the   |                   | do          |
|   | d            | source code is   |                   | cumentation |
|   | ocumentation | uploaded to CVS  |                   | should be   |
|   | for system   | and tagged.      |                   | available   |
|   | operation    |                  |                   | on the      |
|   | and          | All Firebird     |                   | NCICB       |
|   | maintenance? | documents are    |                   | website     |
|   |              | stored in CVS.   |                   | (User       |
|   | *Subpart B   | Four members of  |                   | Guide,      |
|   | -- Section   | the Firebird     |                   | etc.). An   |
|   | 11.10 (k)*   | team have access |                   | individual  |
|   |              | to the project   |                   | would       |
|   |              | documentation    |                   | submit      |
|   |              | with authority   |                   | their email |
|   |              | to change the    |                   | address,    |
|   |              | documentation as |                   | name and    |
|   |              | needed. Only the |                   | institution |
|   |              | design document  |                   | to access   |
|   |              | and other        |                   | the NCICB   |
|   |              | architecture     |                   | download    |
|   |              | documents are    |                   | center. The |
|   |              | made available   |                   | user could  |
|   |              | to other         |                   | then select |
|   |              | development      |                   | the         |
|   |              | teams upon       |                   | Firebird    |
|   |              | request.         |                   | product and |
|   |              |                  |                   | 'agree'     |
|   |              | Information      |                   | with the    |
|   |              | regarding a      |                   | Firebird    |
|   |              | Change           |                   | Software    |
|   |              | Management SOP   |                   | License     |
|   |              | was unavailable. |                   | Agreement.  |
|   |              |                  |                   | At that     |
|   |              |                  |                   | point, the  |
|   |              |                  |                   | user would  |
|   |              |                  |                   | be able to  |
|   |              |                  |                   | download    |
|   |              |                  |                   | PDF         |
|   |              |                  |                   | versions of |
|   |              |                  |                   | system      |
|   |              |                  |                   | doc         |
|   |              |                  |                   | umentation. |
|   |              |                  |                   |             |
|   |              |                  |                   | Appropriate |
|   |              |                  |                   | change      |
|   |              |                  |                   | management  |
|   |              |                  |                   | procedures  |
|   |              |                  |                   | need to be  |
|   |              |                  |                   | defined and |
|   |              |                  |                   | documented. |
+---+--------------+------------------+-------------------+-------------+
| 1 | Revision and | During the       |                   | Documented  |
| 4 | change       | testing process, |                   | change      |
|   | control      | BioPharm used    |                   | control     |
|   | procedures   | TestTrack Pro to |                   | procedures  |
|   | to maintain  | document all     |                   | (SOP) and   |
|   | an audit     | system defects   |                   | detailed    |
|   | trail that   | identified. Some |                   | revision    |
|   | documents    | degree of        |                   | histories   |
|   | ti           | software fix     |                   | must be     |
|   | me-sequenced | information for  |                   | maintained  |
|   | development  | each defect was  |                   | for         |
|   | and          | also tracked as  |                   | development |
|   | modification | was the          |                   | documents   |
|   | of systems   | verification of  |                   | and         |
|   | do           | the fix.         |                   | software    |
|   | cumentation? |                  |                   | mod         |
|   |              | There is also an |                   | ifications. |
|   | *Subpart B   | internal CTIS    |                   |             |
|   | -- Section   | defect tracking  |                   |             |
|   | 11.10 (k)*   | system.          |                   |             |
+---+--------------+------------------+-------------------+-------------+
| 1 | Is this an   | The intended     |                   |             |
| 5 | open system  | model for        |                   |             |
|   | (i.e. is     | Firebird appears |                   |             |
|   | system       | to be that of an |                   |             |
|   | access NOT   | "Open" system    |                   |             |
|   | controlled   | model. (Proceed  |                   |             |
|   | by persons   | to Item 16)      |                   |             |
|   | who are      |                  |                   |             |
|   | responsible  |                  |                   |             |
|   | for the      |                  |                   |             |
|   | content of   |                  |                   |             |
|   | electronic   |                  |                   |             |
|   | records that |                  |                   |             |
|   | are on the   |                  |                   |             |
|   | system)?     |                  |                   |             |
|   |              |                  |                   |             |
|   | If "*Yes*",  |                  |                   |             |
|   | then proceed |                  |                   |             |
|   | to Item 16.  |                  |                   |             |
|   |              |                  |                   |             |
|   | If "*No*",   |                  |                   |             |
|   | then go to   |                  |                   |             |
|   | Item 17.     |                  |                   |             |
|   |              |                  |                   |             |
|   | *Subpart B   |                  |                   |             |
|   | -- Section   |                  |                   |             |
|   | 11.30*       |                  |                   |             |
+---+--------------+------------------+-------------------+-------------+
| 1 | The          |                  | To be determined  | Digital     |
| 6 | a            |                  |                   | signature   |
|   | uthenticity, |                  |                   | standards   |
|   | integrity,   |                  |                   | (use of     |
|   | and as       |                  |                   | digital     |
|   | appropriate, |                  |                   | ce          |
|   | the          |                  |                   | rtificates, |
|   | con          |                  |                   | etc.) need  |
|   | fidentiality |                  |                   | to be       |
|   | of           |                  |                   | documented  |
|   | electronic   |                  |                   | in a        |
|   | records from |                  |                   | Firebird    |
|   | the point of |                  |                   | R           |
|   | their        |                  |                   | equirements |
|   | creation to  |                  |                   | Document.   |
|   | the point of |                  |                   |             |
|   | their        |                  |                   | Additional  |
|   | receipt      |                  |                   | au          |
|   | (e.g.        |                  |                   | thenticity, |
|   | document     |                  |                   | integrity   |
|   | encryption   |                  |                   | and         |
|   | and the use  |                  |                   | conf        |
|   | of           |                  |                   | identiality |
|   | appropriate  |                  |                   | procedures  |
|   | digital      |                  |                   | need to be  |
|   | signature    |                  |                   | defined and |
|   | standards)?  |                  |                   | documented. |
|   |              |                  |                   | These       |
|   | *Subpart B   |                  |                   | procedures  |
|   | -- Section   |                  |                   | should      |
|   | 11.30*       |                  |                   | include     |
|   |              |                  |                   | what type   |
|   |              |                  |                   | of document |
|   |              |                  |                   | encryption  |
|   |              |                  |                   | and         |
|   |              |                  |                   | security    |
|   |              |                  |                   | measures    |
|   |              |                  |                   | are         |
|   |              |                  |                   | i           |
|   |              |                  |                   | ncorporated |
|   |              |                  |                   | (VPN, level |
|   |              |                  |                   | of          |
|   |              |                  |                   | encryption, |
|   |              |                  |                   | etc) to     |
|   |              |                  |                   | protect and |
|   |              |                  |                   | a           |
|   |              |                  |                   | uthenticate |
|   |              |                  |                   | electronic  |
|   |              |                  |                   | records     |
|   |              |                  |                   | from        |
|   |              |                  |                   | creation in |
|   |              |                  |                   | Firebird to |
|   |              |                  |                   | delivery to |
|   |              |                  |                   | another     |
|   |              |                  |                   | entity.     |
+---+--------------+------------------+-------------------+-------------+
| 1 | Will the     | Yes, the         |                   |             |
| 7 | system use   | Firebird system  |                   |             |
|   | electronic   | will use         |                   |             |
|   | signatures?  | electronic       |                   |             |
|   |              | signatures.      |                   |             |
|   | If "*Yes*"   | (Proceed to      |                   |             |
|   | then proceed | section 2.2.3)   |                   |             |
|   | directly to  |                  |                   |             |
|   | the          |                  |                   |             |
|   | Electronic   |                  |                   |             |
|   | Signature    |                  |                   |             |
|   | Compliance   |                  |                   |             |
|   | Checklist.   |                  |                   |             |
|   |              |                  |                   |             |
|   | If "*No*",   |                  |                   |             |
|   | compliance   |                  |                   |             |
|   | assessment   |                  |                   |             |
|   | is complete. |                  |                   |             |
|   |              |                  |                   |             |
|   | *Subpart B   |                  |                   |             |
|   | -- Section   |                  |                   |             |
|   | 11.30*       |                  |                   |             |
+---+--------------+------------------+-------------------+-------------+

###  Electronic Signature Compliance Checklist

The current CDS application is not required to comply with 21 CFR Part
11 Electronic Signature requirements. Evaluation of the following issues
demonstrates the current level of Firebird compliance with the 21 CFR
Part 11 Electronic Signature requirements.

+---+-------------+------------------+----------------+----------------+
| * | ***Issue*** | ***Firebird***   |                |                |
| * |             |                  |                |                |
| * |             |                  |                |                |
| I |             |                  |                |                |
| t |             |                  |                |                |
| e |             |                  |                |                |
| m |             |                  |                |                |
| * |             |                  |                |                |
| * |             |                  |                |                |
| * |             |                  |                |                |
+===+=============+==================+================+================+
|   |             | ***Current       | ***Technical   | ***Process     |
|   |             | State***         | Action Item*** | Action Item*** |
+---+-------------+------------------+----------------+----------------+
| 1 | Do signed   | Currently, the   | Incorporate    | Document       |
|   | electronic  | following        | missing        | electronic     |
|   | records     | documents are    | elements of    | record         |
|   | contain     | available for    | required       | information    |
|   | information | electronic       | information in | requirements   |
|   | associated  | signature:       | each           | in Functional  |
|   | with the    |                  | electronically | Requirements   |
|   | signing     | -   FDA Form     | signed record. | document.      |
|   | that        |     1572         |                |                |
|   | clearly     |                  |                |                |
|   | indicate:   |     -   Includes |                |                |
|   |             |         the      |                |                |
|   | 1)  The     |         meaning  |                |                |
|   |     printed |                  |                |                |
|   |     name of |       associated |                |                |
|   |     the     |         with the |                |                |
|   |     signer  |                  |                |                |
|   |             |       signature, |                |                |
|   | 2)  The     |                  |                |                |
|   |     date    |      'Signature' |                |                |
|   |     and     |         and Date |                |                |
|   |     time    |                  |                |                |
|   |     when    |     -   Does not |                |                |
|   |     the     |         include  |                |                |
|   |             |         Printed  |                |                |
|   |   signature |         Name or  |                |                |
|   |     was     |         time     |                |                |
|   |             |         stamp of |                |                |
|   |    executed |                  |                |                |
|   |             |        signature |                |                |
|   | 3)  The     |                  |                |                |
|   |     meaning | -   FDF          |                |                |
|   |     (such   |                  |                |                |
|   |     as      |     -   Includes |                |                |
|   |     review, |                  |                |                |
|   |             |     'Signature', |                |                |
|   |   approval, |         Date and |                |                |
|   |     resp    |         Printed  |                |                |
|   | onsibility, |         Name     |                |                |
|   |     or      |                  |                |                |
|   |             |     -   Does not |                |                |
|   | authorship) |         include  |                |                |
|   |             |         'stated' |                |                |
|   |  associated |         meaning  |                |                |
|   |     with    |                  |                |                |
|   |     the     |       associated |                |                |
|   |             |         with the |                |                |
|   |   signature |                  |                |                |
|   |             |        signature |                |                |
|   | *Subpart B  |         or time  |                |                |
|   | -- Section  |         stamp of |                |                |
|   | 11.50 (a)*  |                  |                |                |
|   |             |       signature. |                |                |
|   |             |         Meaning  |                |                |
|   |             |         of       |                |                |
|   |             |                  |                |                |
|   |             |        signature |                |                |
|   |             |                  |                |                |
|   |             |       'implied.' |                |                |
|   |             |                  |                |                |
|   |             | ```{=html}       |                |                |
|   |             | <!-- -->         |                |                |
|   |             | ```              |                |                |
|   |             | -   CV Summary   |                |                |
|   |             |                  |                |                |
|   |             |     -   Includes |                |                |
|   |             |                  |                |                |
|   |             |      'Signature' |                |                |
|   |             |         and Date |                |                |
|   |             |         and      |                |                |
|   |             |         Printed  |                |                |
|   |             |         Name     |                |                |
|   |             |                  |                |                |
|   |             |     -   Does not |                |                |
|   |             |         include  |                |                |
|   |             |         'stated' |                |                |
|   |             |         meaning  |                |                |
|   |             |                  |                |                |
|   |             |       associated |                |                |
|   |             |         with the |                |                |
|   |             |                  |                |                |
|   |             |        signature |                |                |
|   |             |         or time  |                |                |
|   |             |         stamp of |                |                |
|   |             |                  |                |                |
|   |             |       signature. |                |                |
|   |             |         Meaning  |                |                |
|   |             |         of       |                |                |
|   |             |                  |                |                |
|   |             |        signature |                |                |
|   |             |                  |                |                |
|   |             |       'implied.' |                |                |
|   |             |                  |                |                |
|   |             | ```{=html}       |                |                |
|   |             | <!-- -->         |                |                |
|   |             | ```              |                |                |
|   |             | -   CTEP         |                |                |
|   |             |     Investigator |                |                |
|   |             |     Data Form    |                |                |
|   |             |                  |                |                |
|   |             |     -   Includes |                |                |
|   |             |                  |                |                |
|   |             |     'Signature', |                |                |
|   |             |         Date and |                |                |
|   |             |         stated   |                |                |
|   |             |         meaning  |                |                |
|   |             |                  |                |                |
|   |             |       associated |                |                |
|   |             |         with the |                |                |
|   |             |                  |                |                |
|   |             |        signature |                |                |
|   |             |                  |                |                |
|   |             |     -   Does not |                |                |
|   |             |         include  |                |                |
|   |             |         time     |                |                |
|   |             |         stamp of |                |                |
|   |             |                  |                |                |
|   |             |        signature |                |                |
|   |             |                  |                |                |
|   |             | *Note:* To       |                |                |
|   |             | 'view' the time  |                |                |
|   |             | stamp for the    |                |                |
|   |             | electronic       |                |                |
|   |             | documents, the   |                |                |
|   |             | user has two     |                |                |
|   |             | options:         |                |                |
|   |             |                  |                |                |
|   |             | -   Either click |                |                |
|   |             |     on the       |                |                |
|   |             |     signature    |                |                |
|   |             |     and view the |                |                |
|   |             |     contents of  |                |                |
|   |             |     the          |                |                |
|   |             |     signature,   |                |                |
|   |             |     or           |                |                |
|   |             |                  |                |                |
|   |             | -   Use the      |                |                |
|   |             |                  |                |                |
|   |             |    \'Signature\' |                |                |
|   |             |     tab on the   |                |                |
|   |             |     left side    |                |                |
|   |             |     (in Acrobat  |                |                |
|   |             |     Reader)      |                |                |
+---+-------------+------------------+----------------+----------------+
| 2 | Are the     | Refer to Item 1. | Include time   | Review and     |
|   | items       |                  | stamp of       | consider       |
|   | mentioned   | Currently, time  | digital        | elaborating on |
|   | in item 1   | stamp of the     | signature in   | the stated     |
|   | included as | signature is not | the electronic | 'Meaning' of   |
|   | a part of   | available in the | display and    | the electronic |
|   | any human   | electronic       | printout of    | signature in   |
|   | readable    | display or       | the digitally  | the electronic |
|   | form of the | printout of the  | signed         | documents.     |
|   | electronic  | electronic       | documents.     |                |
|   | record      | record.          |                |                |
|   | (e.g.,      |                  |                |                |
|   | electronic  | The stated       |                |                |
|   | display or  | 'Meaning' of the |                |                |
|   | printout)?  | electronic       |                |                |
|   |             | signature is     |                |                |
|   | *Subpart B  | assumed in some  |                |                |
|   | -- Section  | instances.       |                |                |
|   | 11.50 (b)*  |                  |                |                |
+---+-------------+------------------+----------------+----------------+
| 3 | Are         | The use of the   | If a decision  | When a         |
|   | electronic  | SAFE standard    | is made to do  | handwritten    |
|   | signatures  | prevents the     | so, insert     | 'wet'          |
|   | and         | falsification of | 'linking'      | signature is   |
|   | handwritten | an electronic    | information on | used on an     |
|   | signatures  | record by        | electronically | electronically |
|   | executed to | ordinary means.  | signed         | generated      |
|   | electronic  |                  | documents.     | document,      |
|   | records     |                  |                | there must be  |
|   | linked to   |                  |                | a 'link' to    |
|   | their       |                  |                | the electronic |
|   | respective  |                  |                | record. One    |
|   | electronic  |                  |                | way in which   |
|   | records to  |                  |                | to accomplish  |
|   | ensure that |                  |                | this is to     |
|   | the         |                  |                | identify the   |
|   | signature   |                  |                | unique         |
|   | cannot be   |                  |                | electronic     |
|   | excised,    |                  |                | record by      |
|   | copied, or  |                  |                | including      |
|   | otherwise   |                  |                | information    |
|   | transferred |                  |                | such as        |
|   | to falsify  |                  |                | creation date, |
|   | an          |                  |                | file name,     |
|   | electronic  |                  |                | etc. on the    |
|   | record by   |                  |                | printed        |
|   | ordinary    |                  |                | document. An   |
|   | means?      |                  |                | auditor must   |
|   |             |                  |                | be able to     |
|   | *Subpart B  |                  |                | trace a 'wet'  |
|   | -- Section  |                  |                | signed         |
|   | 11.70*      |                  |                | document back  |
|   |             |                  |                | to the         |
|   |             |                  |                | original       |
|   |             |                  |                | electronic     |
|   |             |                  |                | record.        |
+---+-------------+------------------+----------------+----------------+
| 4 | Is each     | *Unknown - Refer |                | This           |
|   | electronic  | to SAFE specific |                | information    |
|   | signature   | credentialing    |                | needs to be    |
|   | unique to   | procedures to    |                | documented     |
|   | one         | verify this      |                | appropriately. |
|   | individual  | requirement.*    |                |                |
|   | and not     |                  |                |                |
|   | reused by,  |                  |                |                |
|   | or          |                  |                |                |
|   | reassigned  |                  |                |                |
|   | to, anyone  |                  |                |                |
|   | else?       |                  |                |                |
|   |             |                  |                |                |
|   | *Subpart C  |                  |                |                |
|   | -- Section  |                  |                |                |
|   | 11.100 (a)* |                  |                |                |
+---+-------------+------------------+----------------+----------------+
| 5 | Has the     | A formal         | Perform an     | Document the   |
|   | o           | credentialing    | operational    | formal         |
|   | rganization | process is being | pilot to test  | credentialing  |
|   | verified    | developed to     | the formal     | process to be  |
|   | the         | ensure that the  | credentialing  | used for SAFE  |
|   | identity of | identity of each | process        | card           |
|   | the         | individual       | associated     | qualification  |
|   | individual  | issued a SAFE    | with the       | and            |
|   | before it   | card is          | creation of    | distribution.  |
|   | e           | certified        | the identity   |                |
|   | stablished, | appropriately.   | assurance      |                |
|   | assigned,   |                  | i              |                |
|   | certified,  |                  | nfrastructure. |                |
|   | or          |                  |                |                |
|   | otherwise   |                  |                |                |
|   | sanctioned  |                  |                |                |
|   | an          |                  |                |                |
|   | i           |                  |                |                |
|   | ndividual's |                  |                |                |
|   | electronic  |                  |                |                |
|   | signature,  |                  |                |                |
|   | or any      |                  |                |                |
|   | element of  |                  |                |                |
|   | such        |                  |                |                |
|   | electronic  |                  |                |                |
|   | signature?  |                  |                |                |
|   |             |                  |                |                |
|   | *Subpart C  |                  |                |                |
|   | -- Section  |                  |                |                |
|   | 11.100 (b)* |                  |                |                |
+---+-------------+------------------+----------------+----------------+
| 6 | Has the     | *Unknown --      |                | If not already |
|   | o           | refer question   |                | performed, NCI |
|   | rganization | to SAFE/NCI      |                | must certify   |
|   | certified   | team*            |                | to the Agency  |
|   | to the      |                  |                | that the       |
|   | Agency that |                  |                | electronic     |
|   | the         |                  |                | signatures in  |
|   | electronic  |                  |                | their system,  |
|   | signatures  |                  |                | used on or     |
|   | in their    |                  |                | after August   |
|   | system,     |                  |                | 20, 1997, are  |
|   | used on or  |                  |                | intended to be |
|   | after       |                  |                | the legally    |
|   | August 20,  |                  |                | binding        |
|   | 1997, are   |                  |                | equivalent of  |
|   | intended to |                  |                | traditional    |
|   | be the      |                  |                | handwritten    |
|   | legally     |                  |                | signatures.    |
|   | binding     |                  |                |                |
|   | equivalent  |                  |                | This is a      |
|   | of          |                  |                | one-time       |
|   | traditional |                  |                | electronic     |
|   | handwritten |                  |                | signature      |
|   | signatures? |                  |                | certification  |
|   |             |                  |                | for the        |
|   | *Subpart C  |                  |                | organization   |
|   | -- Section  |                  |                | as a whole.    |
|   | 11.100 (c)* |                  |                | The intent is  |
|   |             |                  |                | to certify     |
|   |             |                  |                | that the       |
|   |             |                  |                | company        |
|   |             |                  |                | considers      |
|   |             |                  |                | electronic     |
|   |             |                  |                | signatures of  |
|   |             |                  |                | their          |
|   |             |                  |                | employees,     |
|   |             |                  |                | agents and     |
|   |             |                  |                | r              |
|   |             |                  |                | epresentatives |
|   |             |                  |                | to be the      |
|   |             |                  |                | legally        |
|   |             |                  |                | binding        |
|   |             |                  |                | equivalent of  |
|   |             |                  |                | the associated |
|   |             |                  |                | traditional    |
|   |             |                  |                | hand-written   |
|   |             |                  |                | signatures.    |
|   |             |                  |                | The            |
|   |             |                  |                | certification  |
|   |             |                  |                | must be        |
|   |             |                  |                | submitted in   |
|   |             |                  |                | paper to the   |
|   |             |                  |                | Office of      |
|   |             |                  |                | Regional       |
|   |             |                  |                | Operations.    |
|   |             |                  |                | The            |
|   |             |                  |                | certification  |
|   |             |                  |                | must be signed |
|   |             |                  |                | with a         |
|   |             |                  |                | traditional    |
|   |             |                  |                | handwritten    |
|   |             |                  |                | signature. The |
|   |             |                  |                | certification  |
|   |             |                  |                | must be        |
|   |             |                  |                | submitted      |
|   |             |                  |                | prior to or at |
|   |             |                  |                | the time       |
|   |             |                  |                | electronic     |
|   |             |                  |                | signatures are |
|   |             |                  |                | used.          |
|   |             |                  |                |                |
|   |             |                  |                | This           |
|   |             |                  |                | completion of  |
|   |             |                  |                | this           |
|   |             |                  |                | certification  |
|   |             |                  |                | needs to be    |
|   |             |                  |                | documented     |
|   |             |                  |                | appropriately  |
|   |             |                  |                | and available  |
|   |             |                  |                | for            |
|   |             |                  |                | inspection.    |
+---+-------------+------------------+----------------+----------------+
| 7 | Do          | Each             | Determine      | The            |
|   | electronic  | investigator     | whether        | identification |
|   | signatures  | that has been    | additional     | components of  |
|   | not based   | issued a SAFE    | identification | the electronic |
|   | upon        | card must enter  | components are | signature      |
|   | biometrics  | a unique PIN     | needed for     | process must   |
|   | employ at   | prior to each    | identification | be documented  |
|   | least two   | electronic       | purposes.      | in the         |
|   | distinct    | signing          |                | Requirements   |
|   | ide         | instance.        |                | Document and   |
|   | ntification |                  |                | in any         |
|   | components  | In addition, to  |                | electronic     |
|   | such as an  | login to the     |                | signature      |
|   | ide         | Firebird         |                | documentation. |
|   | ntification | application, the |                |                |
|   | code and    | investigator     |                |                |
|   | password?   | must either      |                |                |
|   |             | enter their      |                |                |
|   | *Subpart C  | Firebird login   |                |                |
|   | -- Section  | and password OR  |                |                |
|   | 11.200      | their unique     |                |                |
|   | (a)(1)*     | SAFE PIN to      |                |                |
|   |             | login to the     |                |                |
|   |             | application.     |                |                |
|   |             |                  |                |                |
|   |             | In the latter    |                |                |
|   |             | instance, it     |                |                |
|   |             | might not be     |                |                |
|   |             | considered to be |                |                |
|   |             | two distinct     |                |                |
|   |             | identification   |                |                |
|   |             | components since |                |                |
|   |             | the same PIN is  |                |                |
|   |             | being entered    |                |                |
|   |             | each time.       |                |                |
+---+-------------+------------------+----------------+----------------+
| 8 | When an     | At present, each |                |                |
|   | individual  | time an          |                |                |
|   | executes a  | investigator     |                |                |
|   | series of   | executes a       |                |                |
|   | signings    | digital signing  |                |                |
|   | during a    | instance, they   |                |                |
|   | single,     | must logged into |                |                |
|   | continuous  | the application  |                |                |
|   | period of   | appropriately    |                |                |
|   | controlled  | and enter their  |                |                |
|   | system      | SAFE PIN that is |                |                |
|   | access,     | designed to be   |                |                |
|   | does the    | used only by     |                |                |
|   | first       | that specific    |                |                |
|   | signing     | individual.      |                |                |
|   | executed    |                  |                |                |
|   | use all     |                  |                |                |
|   | electronic  |                  |                |                |
|   | signature   |                  |                |                |
|   | components  |                  |                |                |
|   | and do      |                  |                |                |
|   | subsequent  |                  |                |                |
|   | signings    |                  |                |                |
|   | executed us |                  |                |                |
|   | at least    |                  |                |                |
|   | one         |                  |                |                |
|   | electronic  |                  |                |                |
|   | signature   |                  |                |                |
|   | component   |                  |                |                |
|   | that is     |                  |                |                |
|   | only        |                  |                |                |
|   | executable  |                  |                |                |
|   | by, and     |                  |                |                |
|   | designed to |                  |                |                |
|   | be used     |                  |                |                |
|   | only by,    |                  |                |                |
|   | the         |                  |                |                |
|   | individual? |                  |                |                |
|   |             |                  |                |                |
|   | *Subpart C  |                  |                |                |
|   | -- Section  |                  |                |                |
|   | 11.200      |                  |                |                |
|   | (a)(1)(i)*  |                  |                |                |
+---+-------------+------------------+----------------+----------------+
| 9 | When an     | When an          |                |                |
|   | individual  | investigator     |                |                |
|   | executes    | executes one or  |                |                |
|   | one or more | more signings    |                |                |
|   | signings    | not performed    |                |                |
|   | not         | during a single, |                |                |
|   | performed   | continuous       |                |                |
|   | during a    | period of        |                |                |
|   | single,     | controlled       |                |                |
|   | continuous  | system access,   |                |                |
|   | period of   | all of the       |                |                |
|   | controlled  | electronic       |                |                |
|   | system      | signature        |                |                |
|   | access,     | components are   |                |                |
|   | does each   | required.        |                |                |
|   | signing     |                  |                |                |
|   | executed    |                  |                |                |
|   | use all of  |                  |                |                |
|   | the         |                  |                |                |
|   | electronic  |                  |                |                |
|   | signature   |                  |                |                |
|   | components? |                  |                |                |
|   |             |                  |                |                |
|   | *Subpart C  |                  |                |                |
|   | -- Section  |                  |                |                |
|   | 11.200      |                  |                |                |
|   | (a)(1)(ii)* |                  |                |                |
+---+-------------+------------------+----------------+----------------+
| 1 | Are         | Functionality is |                | Document       |
| 0 | electronic  | built into the   |                | electronic     |
|   | signatures  | Firebird system  |                | signature      |
|   | not based   | to help ensure   |                | usage          |
|   | upon        | that the user    |                | guidelines for |
|   | biometrics  | logged into the  |                | investigators  |
|   | used only   | system is the    |                | (and their     |
|   | by their    | only individual  |                | support        |
|   | genuine     | who can          |                | staff). There  |
|   | owners?     | electronically   |                | should         |
|   |             | sign a document  |                | probably be    |
|   | *Subpart C  | during that      |                | some type of   |
|   | -- Section  | session.         |                | document that  |
|   | 11.200      |                  |                | they 'wet      |
|   | (a)(2)*     | It is the        |                | sign' to       |
|   |             | responsibility   |                | indicated      |
|   |             | of the           |                | their          |
|   |             | investigator to  |                | acceptance of  |
|   |             | ensure that      |                | responsibility |
|   |             | his/her unique   |                | for their      |
|   |             | SAFE             |                | credentials.   |
|   |             | identification   |                |                |
|   |             | number (PIN)     |                |                |
|   |             | remains secure   |                |                |
|   |             | and known only   |                |                |
|   |             | to him/her.      |                |                |
|   |             |                  |                |                |
|   |             | It is the        |                |                |
|   |             | responsibility   |                |                |
|   |             | of NCICB to      |                |                |
|   |             | appropriately    |                |                |
|   |             | train SAFE card  |                |                |
|   |             | users as to      |                |                |
|   |             | their            |                |                |
|   |             | responsibilities |                |                |
|   |             | and the use of   |                |                |
|   |             | electronic       |                |                |
|   |             | signatures.      |                |                |
+---+-------------+------------------+----------------+----------------+
| 1 | Are         | Functionality is |                | Electronic     |
| 1 | electronic  | built into the   |                | signature      |
|   | signatures  | Firebird system  |                | guidelines and |
|   | not based   | to help ensure   |                | re             |
|   | upon        | that the user    |                | sponsibilities |
|   | biometrics  | logged into the  |                | should be      |
|   | a           | system is the    |                | documented     |
|   | dministered | only individual  |                | appropriately. |
|   | and         | who can          |                |                |
|   | executed to | electronically   |                |                |
|   | ensure that | sign a document  |                |                |
|   | attempted   | during that      |                |                |
|   | use of an   | session. An      |                |                |
|   | i           | investigator     |                |                |
|   | ndividual's | would need to    |                |                |
|   | electronic  | provide the      |                |                |
|   | signature   | necessary        |                |                |
|   | by anyone   | information for  |                |                |
|   | other than  | any signature    |                |                |
|   | its genuine | event to proceed |                |                |
|   | owner       | by another       |                |                |
|   | requires    | individual.      |                |                |
|   | co          |                  |                |                |
|   | llaboration |                  |                |                |
|   | of two or   |                  |                |                |
|   | more        |                  |                |                |
|   | i           |                  |                |                |
|   | ndividuals? |                  |                |                |
|   |             |                  |                |                |
|   | *Subpart C  |                  |                |                |
|   | -- Section  |                  |                |                |
|   | 11.200      |                  |                |                |
|   | (a)(3)*     |                  |                |                |
+---+-------------+------------------+----------------+----------------+
| 1 | Are         | Not Applicable   |                |                |
| 2 | electronic  |                  |                |                |
|   | signatures  |                  |                |                |
|   | based upon  |                  |                |                |
|   | biometrics  |                  |                |                |
|   | designed to |                  |                |                |
|   | ensure that |                  |                |                |
|   | they cannot |                  |                |                |
|   | be used by  |                  |                |                |
|   | anyone      |                  |                |                |
|   | other than  |                  |                |                |
|   | their       |                  |                |                |
|   | genuine     |                  |                |                |
|   | owners?     |                  |                |                |
|   |             |                  |                |                |
|   | *Subpart C  |                  |                |                |
|   | -- Section  |                  |                |                |
|   | 11.200 (b)* |                  |                |                |
+---+-------------+------------------+----------------+----------------+
| W |             |                  |                |                |
| h |             |                  |                |                |
| e |             |                  |                |                |
| n |             |                  |                |                |
| u |             |                  |                |                |
| s |             |                  |                |                |
| i |             |                  |                |                |
| n |             |                  |                |                |
| g |             |                  |                |                |
| a |             |                  |                |                |
| n |             |                  |                |                |
| e |             |                  |                |                |
| l |             |                  |                |                |
| e |             |                  |                |                |
| c |             |                  |                |                |
| t |             |                  |                |                |
| r |             |                  |                |                |
| o |             |                  |                |                |
| n |             |                  |                |                |
| i |             |                  |                |                |
| c |             |                  |                |                |
| s |             |                  |                |                |
| i |             |                  |                |                |
| g |             |                  |                |                |
| n |             |                  |                |                |
| a |             |                  |                |                |
| t |             |                  |                |                |
| u |             |                  |                |                |
| r |             |                  |                |                |
| e |             |                  |                |                |
| b |             |                  |                |                |
| a |             |                  |                |                |
| s |             |                  |                |                |
| e |             |                  |                |                |
| d |             |                  |                |                |
| u |             |                  |                |                |
| p |             |                  |                |                |
| o |             |                  |                |                |
| n |             |                  |                |                |
| u |             |                  |                |                |
| s |             |                  |                |                |
| e |             |                  |                |                |
| o |             |                  |                |                |
| f |             |                  |                |                |
| i |             |                  |                |                |
| d |             |                  |                |                |
| e |             |                  |                |                |
| n |             |                  |                |                |
| t |             |                  |                |                |
| i |             |                  |                |                |
| f |             |                  |                |                |
| i |             |                  |                |                |
| c |             |                  |                |                |
| a |             |                  |                |                |
| t |             |                  |                |                |
| i |             |                  |                |                |
| o |             |                  |                |                |
| n |             |                  |                |                |
| c |             |                  |                |                |
| o |             |                  |                |                |
| d |             |                  |                |                |
| e |             |                  |                |                |
| s |             |                  |                |                |
| i |             |                  |                |                |
| n |             |                  |                |                |
| c |             |                  |                |                |
| o |             |                  |                |                |
| m |             |                  |                |                |
| b |             |                  |                |                |
| i |             |                  |                |                |
| n |             |                  |                |                |
| a |             |                  |                |                |
| t |             |                  |                |                |
| i |             |                  |                |                |
| o |             |                  |                |                |
| n |             |                  |                |                |
| w |             |                  |                |                |
| i |             |                  |                |                |
| t |             |                  |                |                |
| h |             |                  |                |                |
| p |             |                  |                |                |
| a |             |                  |                |                |
| s |             |                  |                |                |
| s |             |                  |                |                |
| w |             |                  |                |                |
| o |             |                  |                |                |
| r |             |                  |                |                |
| d |             |                  |                |                |
| s |             |                  |                |                |
| , |             |                  |                |                |
| a |             |                  |                |                |
| r |             |                  |                |                |
| e |             |                  |                |                |
| c |             |                  |                |                |
| o |             |                  |                |                |
| n |             |                  |                |                |
| t |             |                  |                |                |
| r |             |                  |                |                |
| o |             |                  |                |                |
| l |             |                  |                |                |
| s |             |                  |                |                |
| e |             |                  |                |                |
| m |             |                  |                |                |
| p |             |                  |                |                |
| l |             |                  |                |                |
| o |             |                  |                |                |
| y |             |                  |                |                |
| e |             |                  |                |                |
| d |             |                  |                |                |
| t |             |                  |                |                |
| o |             |                  |                |                |
| e |             |                  |                |                |
| n |             |                  |                |                |
| s |             |                  |                |                |
| u |             |                  |                |                |
| r |             |                  |                |                |
| e |             |                  |                |                |
| t |             |                  |                |                |
| h |             |                  |                |                |
| e |             |                  |                |                |
| i |             |                  |                |                |
| r |             |                  |                |                |
| s |             |                  |                |                |
| e |             |                  |                |                |
| c |             |                  |                |                |
| u |             |                  |                |                |
| r |             |                  |                |                |
| i |             |                  |                |                |
| t |             |                  |                |                |
| y |             |                  |                |                |
| a |             |                  |                |                |
| n |             |                  |                |                |
| d |             |                  |                |                |
| i |             |                  |                |                |
| n |             |                  |                |                |
| t |             |                  |                |                |
| e |             |                  |                |                |
| g |             |                  |                |                |
| r |             |                  |                |                |
| i |             |                  |                |                |
| t |             |                  |                |                |
| y |             |                  |                |                |
| b |             |                  |                |                |
| y |             |                  |                |                |
| : |             |                  |                |                |
+---+-------------+------------------+----------------+----------------+
| 1 | Maintaining | *Unknown - Refer |                | This           |
| 3 | the         | to SAFE specific |                | information    |
|   | uniqueness  | credentialing    |                | needs to be    |
|   | of each     | procedures to    |                | documented     |
|   | combined    | verify this      |                | appropriately. |
|   | ide         | requirement.*    |                |                |
|   | ntification |                  |                |                |
|   | code and    |                  |                |                |
|   | password,   |                  |                |                |
|   | such that   |                  |                |                |
|   | no two      |                  |                |                |
|   | individuals |                  |                |                |
|   | have the    |                  |                |                |
|   | same        |                  |                |                |
|   | combination |                  |                |                |
|   | of          |                  |                |                |
|   | ide         |                  |                |                |
|   | ntification |                  |                |                |
|   | code and    |                  |                |                |
|   | password?   |                  |                |                |
|   |             |                  |                |                |
|   | *Subpart C  |                  |                |                |
|   | -- Section  |                  |                |                |
|   | 11.300 (a)* |                  |                |                |
+---+-------------+------------------+----------------+----------------+
| 1 | Ensuring    | *Unknown - Refer |                | This           |
| 4 | that        | to SAFE specific |                | information    |
|   | ide         | credentialing    |                | needs to be    |
|   | ntification | procedures to    |                | documented     |
|   | code and    | verify this      |                | appropriately. |
|   | password    | requirement.*    |                |                |
|   | issuances   |                  |                |                |
|   | are         |                  |                |                |
|   | p           |                  |                |                |
|   | eriodically |                  |                |                |
|   | checked,    |                  |                |                |
|   | recalled,   |                  |                |                |
|   | or revised  |                  |                |                |
|   | (e.g., to   |                  |                |                |
|   | cover such  |                  |                |                |
|   | events as   |                  |                |                |
|   | password    |                  |                |                |
|   | aging)?     |                  |                |                |
|   |             |                  |                |                |
|   | *Subpart C  |                  |                |                |
|   | -- Section  |                  |                |                |
|   | 11.300 (b)* |                  |                |                |
+---+-------------+------------------+----------------+----------------+
| 1 | Following   | *Unknown - Refer |                | This           |
| 5 | loss        | to SAFE specific |                | information    |
|   | management  | credentialing    |                | needs to be    |
|   | procedures  | procedures to    |                | documented     |
|   | to          | verify this      |                | appropriately. |
|   | ele         | requirement.*    |                |                |
|   | ctronically |                  |                |                |
|   | deauthorize |                  |                |                |
|   | lost,       |                  |                |                |
|   | stolen,     |                  |                |                |
|   | missing, or |                  |                |                |
|   | otherwise   |                  |                |                |
|   | potentially |                  |                |                |
|   | compromised |                  |                |                |
|   | tokens,     |                  |                |                |
|   | cards, and  |                  |                |                |
|   | other       |                  |                |                |
|   | devises     |                  |                |                |
|   | that bear   |                  |                |                |
|   | or generate |                  |                |                |
|   | ide         |                  |                |                |
|   | ntification |                  |                |                |
|   | code or     |                  |                |                |
|   | password    |                  |                |                |
|   | i           |                  |                |                |
|   | nformation, |                  |                |                |
|   | and to      |                  |                |                |
|   | issue       |                  |                |                |
|   | temporary   |                  |                |                |
|   | or          |                  |                |                |
|   | permanent   |                  |                |                |
|   | r           |                  |                |                |
|   | eplacements |                  |                |                |
|   | using       |                  |                |                |
|   | suitable,   |                  |                |                |
|   | rigorous    |                  |                |                |
|   | controls?   |                  |                |                |
|   |             |                  |                |                |
|   | *Subpart C  |                  |                |                |
|   | -- Section  |                  |                |                |
|   | 11.300 (c)* |                  |                |                |
+---+-------------+------------------+----------------+----------------+
| 1 | Using       | *Unknown - Refer |                | This           |
| 6 | transaction | to SAFE specific |                | information    |
|   | safeguards  | credentialing    |                | needs to be    |
|   | to prevent  | procedures to    |                | documented     |
|   | u           | verify this      |                | appropriately. |
|   | nauthorized | requirement.*    |                |                |
|   | use of      |                  |                |                |
|   | passwords   |                  |                |                |
|   | and/or      |                  |                |                |
|   | ide         |                  |                |                |
|   | ntification |                  |                |                |
|   | codes, and  |                  |                |                |
|   | to detect   |                  |                |                |
|   | and report  |                  |                |                |
|   | in an       |                  |                |                |
|   | immediate   |                  |                |                |
|   | and urgent  |                  |                |                |
|   | manner any  |                  |                |                |
|   | attempts at |                  |                |                |
|   | their       |                  |                |                |
|   | u           |                  |                |                |
|   | nauthorized |                  |                |                |
|   | use to the  |                  |                |                |
|   | system      |                  |                |                |
|   | security    |                  |                |                |
|   | unit, and   |                  |                |                |
|   | as          |                  |                |                |
|   | a           |                  |                |                |
|   | ppropriate, |                  |                |                |
|   | to          |                  |                |                |
|   | org         |                  |                |                |
|   | anizational |                  |                |                |
|   | management? |                  |                |                |
|   |             |                  |                |                |
|   | *Subpart C  |                  |                |                |
|   | -- Section  |                  |                |                |
|   | 11.300 (d)* |                  |                |                |
+---+-------------+------------------+----------------+----------------+
| 1 | Initial and | *Unknown - Refer |                | This           |
| 7 | periodic    | to SAFE specific |                | information    |
|   | testing of  | credentialing    |                | needs to be    |
|   | devices,    | procedures to    |                | documented     |
|   | such as     | verify this      |                | appropriately. |
|   | tokens or   | requirement.*    |                |                |
|   | cards, that |                  |                |                |
|   | bear or     |                  |                |                |
|   | generate    |                  |                |                |
|   | ide         |                  |                |                |
|   | ntification |                  |                |                |
|   | code or     |                  |                |                |
|   | password    |                  |                |                |
|   | information |                  |                |                |
|   | to ensure   |                  |                |                |
|   | that they   |                  |                |                |
|   | function    |                  |                |                |
|   | properly    |                  |                |                |
|   | and have    |                  |                |                |
|   | not been    |                  |                |                |
|   | altered in  |                  |                |                |
|   | an          |                  |                |                |
|   | u           |                  |                |                |
|   | nauthorized |                  |                |                |
|   | manner?     |                  |                |                |
|   |             |                  |                |                |
|   | Subpart C   |                  |                |                |
|   | -- Section  |                  |                |                |
|   | 11.300 (a)  |                  |                |                |
+---+-------------+------------------+----------------+----------------+

# References

> FDA. *Code of Federal Regulations, Title 21, Food and Drugs, Part 11.*
> "Electronic Records; Electronic Signatures: Final Rule." *Federal
> Register*, Vol. 62, No. 54. March 20, 1997.
>
> FDA. *Draft Guidance for Industry. "*Computerized Systems Used in
> Clinical Trials." *http://www.fda.gov/cder/guidance/6032dft.htm.*
> September 2004. Revision 1.
>
> FDA. *Guidance for Industry.* Part 11, Electronic Records; Electronic
> Signatures -- Scope and Application.
> *http://www.fda.gov/cder/guidance/5667fnl.pdf.* August 2003.
>
> Grinbaum, L.A., *Journal of GXP Compliance* "Remaining in a 21 CFR
> Part 11 Compliant State." Vol. 6, No.3. April, 2002.
>
> "Frequently Asked Questions" *http://www.21cfrpart11.com*