Evidian Enterprise
Access Managementand 21 CFR Part 11

What is 21 CFR Part 11?

In their dealings with the US Foodand Drugs Administration (FDA),
some organizations, including
pharmaceutical companies, arerequired to provide documents to
the FDA, and to keep documentsinternally for archiving purposes.
Using physical documents
exclusively (paper, films etc.) would
impose an unnecessary regulatoryburden to these organizationsin terms of productivity andefficiency.

More and more, documents areavailable in electronic format,
either natively or afterscanning.
Therefore, title 21, part 11 of theCode of Federal Regulations (21CFR Part 11) details the conditions
required for:• Archiving and providing to
the FDA certain documents inelectronic format in place ofphysical format.

• Using electronic signatures inplace of regular signatures.
Not all documents required by
the FDA may be submitted inelectronic format. The listof documents for which electronic
format is considered official can be
consulted on-line in public docket
92s-0251.

Current status of 21 CFR Part 11
21 CFR Part 11 is effective since August 20th 1997. As its content generated many commentsin the industry, the FDA issued a compliance policy guide and draft guidance documents
over the next years, which were later rescinded. In August 2003, the FDA issued a “Guidancefor Industry”. In that document, the FDA announced its intention to revise specific aspects of
the regulation. Since the 21 CFR Part 11 remains valid and enforceable, we will include in thisdocument the necessary caveats when we comment the parts that will probably change in
the next months.

2 | Evidian Enterprise Access Management and 21 CFR Part 11

Identity and Access Management(IAM) and 21 CFR Part 11
IAM software can help anorganization achieve therequirements of 21 CFR Part
11. However, compliancerequires a large number ofother factors, of which IAM
software is but one element.
A compliance project entails,
among others:• Specifically designed Standard
Operating Procedures• Conformant applications, including document management
systems

A large number of 21 CFR Part 11
requirements conern the softwareand databases used to store andsign electronic records.
IAM software can help complianceprojects significantly by making
access to electronic records databases more secure.
Such software can also make iteasier for users to access compliant
systems, using applications tomanage electronic records andsigning documents. It thus makes
compliance less intrusive and helps
organizations achieve a better
return on investment.

• Internal awareness, checks andtraining

Using IAM software, organizations
can make user authentication
actions both easier to perform(through single sign-on) andmore secure (through strong
authentication). This may apply to alluser authentication actions such assystem access, application accessand record signature. In addition,
centralized audit trails make iteasier to analyze the sequence ofmulti-applications user actions.
Lastly, centralized user
management and sophisticatedprovisioning helps ensure that
authorized users obtain theiraccess and signature rights on an
as-needed basis.

Single Sign-On and 21 CFR Part 11

A Single Sign-On (SSO)
tool can be part of anenvironment compliant with
21 CFR Part 11.
SSO provides end-usereaseof-use and boots
productivity. This can beof considerable help inmanaging the proliferationof applicationspecific IDs,
passwords and hardwarebased authentication.

In that case, all authentications will
be performed under the control of
the SSO system, and the user justneeds one key pair in his or her daily
work. For instance:• Initial login to the workstationis performed with the primary
key pair (e.g. Windows login andpassword or USB token and PINcode).
• Login to non-sensitive applications is done transparently by the
SSO system.
• To log in to sensitive applications,the user needs to re-authenticate
with his or her primary credential.

• To sign documents, theapplication will request re-authentication. The SSO system will
notice that window and just ask
the user to re-authenticate using
the primary credential.
With such a system, administration
is made easier by the centralizationof management concerning
resources, access rights andpassword management.
An additional advantage of using
an SSO tool in that environmentis that, as it logs each secondary
re-authentication login requiredby a signature action, this provides
a second, centralized audit trail for
signatures.

Evidian Enterprise Access Management and 21 CFR Part 11 | 3

Some definitions

According to 21 CFR Part 11, the following definitions apply:• An electronic record meeting
the FDA requirements outlined
in 21 CFR Part 11 “may be used inlieu of paper records”. It can bemade of any type of informationin digital format handled with acomputer.

• A closed system is an environment “in which system accessis controlled by persons who areresponsible for the content ofelectronic records that are on thesystem.”• An open system is an environment “in which system access is
not controlled by persons who
are responsible for the content ofelectronic records that are on thesystem.”On-line information
The FDA’s 21 CFR Part 11 on-line information center:
http://www.fda.gov/ora/compliance_ref/part11/

Public docket 92s-0251:
http://www.fda.gov/ohrms/dockets/dockets/92s0251/92s0251.htm

FDA’s August 2003 “Guidance for Industry - Part 11, Electronic
Records; Electronic Signatures - Scope and Application”:
http://www.fda.gov/cder/guidance/5667fnl.htm

4 | Evidian Enterprise Access Management and 21 CFR Part 11

Audit Data Content withEnterprise Access Management
The data made available by Enterprise Access Management is extremely detailed. It covers
the following domains, among others:

Audit of user activity• Access to an application
authorized• Access refused because ofpassword/identifier• Access refused because oftime and date requirements(configurable)• Account blocked because of
too many refused attempts,
etc.

Audit of user rights
allocation activity (early2007)• Allocation of access rights(to a resource or group of
resources) for a user or groupof users• Creation and modification of
profiles• Allocation of rights specificto a security administrator(based on roles).
• Password change operations,etc.

Audit on status of user
access rights• Number of users, groups,
access granted• Suspended accounts, etc.

Note: Enterprise Access
Management uses theenterprise’s existing user andorganization data located in
an existing LDAP directory.
This feature allows you tokeep in place your user
management procedures.
Therefore, information onusers can be obtained byusing standard directory
tools.

Evidian Enterprise Access Management and 21 CFR Part 11 | 5

Detailed requirements

Evidian’s Enterprise Access Management provides Identity and Access Management toexisting applications (open or closed systems). It can help organizations achieve compliancefor their processes. This is explained in the following table.
Unless otherwise noted, the content of the “Evidian Enterprise Access Management feature”
column concern the Evidian Enterprise Access Management product. In addition, someanswers require the use of the Evidian WAM (Web Access Manager) product.

21 CFR Part Requirement
11 paragraph

Evidian Enterprise Access
Management feature

Subpart B – Electronic records
11.10

Controls for closed systems.
Persons who use closed systems to create, modify, maintain, or transmit electronic records
shall employ procedures and controls designed to ensure the authenticity, integrity, and,
when appropriate, the confidentiality of electronic records, and to ensure that the signer
cannot readily repudiate the signed record as not genuine. Such procedures and controls
shall include the following:

11.10.a

Validation of systems to ensure accuracy,
reliability, consistent intended performance,
and the ability to discern invalid or altered
records.

This area will be revised by the FDA, asannounced in the August 2003 “Guidancefor Industry” document. The FDA statesthat it does not intend to “impose any
additional requirements” in addition to
those that already apply outside 21 CFRPart 11.
In any case, it is strongly suggested toevaluate if systems validation is useful, even
if “there is no predicate rule requirement”
for doing so.
Systems validation processes typicallyrequire auditing in order to trace whether
procedures were satisfactorily completed.
Enterprise Access Management provides
comprehensive audit data on user
and administrator activity –see: Audit
Data Content with Enterprise Access
Management.

11.10.b

The ability to generate accurate and complete
copies of records in both human readable andelectronic form suitable for inspection, review,and copying by the agency. (…)

Not relevant.

11.10.cProtection of records to enable their accurate
and ready retrieval throughout the records
retention period.

Enterprise Access Management protects
access to theapplications that manage
the electronic records. Authorizedadministrators, using role-based methods,
may grant access rights that enable
retrieval at any time.

6 | Evidian Enterprise Access Management and 21 CFR Part 1111.10.d

Limiting system access to authorized individuals.

Enterprise Access Management limits
application and system access toauthorized users. Enterprise Access
Management is compatible with strong
authentication mechanisms, among avariety of authentication mechanisms.
Alternatively, Enterprise Access
Management can delegate workstation
access control to existing procedures (e.g.
standard Windows login with Active
Directory).
With applications written using J2EE, theSAM J2EE module can apply access control
to inter-application communications
as well.

11.10.e

Use of secure, computer-generated, timestamped audit trails to independently record
the date and time of operator entries
and actions that create, modify, or delete
electronic records. Record changes shall not
obscure previously recorded
information.
Such audit trail documentation shall be
retained for a period at least as long as that
required for the subject electronic records
and shall be available for agency review andcopying.

This area will be revised by the FDA, asannounced in the August 2003 “Guidancefor Industry” document. In particular,
the FDA suggests that organizations
evaluate which areas to apply audit trails to,based on risk assessments.
System and application access anddocument signing are actions that
potentially impact electronic records.
Enterprise Access Management records
such security and access events in audit
files (see Appendix A: Audit Data Content
with ).
The audit entries record the time of theevent as well as other information (useridentity used, resource etc.)
Enterprise Access Management
authentication encompasses all recordmanagement applications, both forapplication access and document signing.
This means that a centralized audit trail
can be analyzed for these events, evenfor multisystems and multi-applications
activities. In particular, sequencing of event
is much easier to analyze.
Enterprise Access Management audit
records can be stored
for long-term archiving.

11.10.f

Use of operational system checks to enforce
permitted sequencing of steps and events, as
appropriate.

Not relevant.

11.10.g

Use of authority checks to ensure that only
authorized individuals can use the system,
electronically sign a record, access the perationor computer system input or output device,alter a record, or perform the operation at hand.

Access control to the system, resources
and steps requiring re-authentication is
performed through Enterprise Access
Management and enforced throughcentralized rules-based management.
Alternatively, Enterprise Access anagement
can delegate workstation access control toexisting procedures (e.g.standard Windows
login with Active Directory).

11.10.hUse of device (e.g., terminal) checks todetermine, as appropriate, the validity of thesource of data input or operational instruction.

Users can be restricted to a particularterminal, a set of terminals, or terminals in
specific locations.
It is possible to enforce rules such as “User
A can access application B, but only fromworkstation C”.

Evidian Enterprise Access Management and 21 CFR Part 11 | 7

11.10.i

Determination that persons who develop,
maintain, or use electronic record/electronic
signature systems have the education, training,and experience to perform their assigned
tasks.

11.10.j

The establishment of, and adherence to, written Not relevant.
policies that hold individuals accountable andresponsible for actions initiated under theirelectronic signatures, in order to deter
record and signature falsification.

11.10.k

Use of appropriate controls over systems documentation including:

11.10.k1

Adequate controls over the distribution of,access to, and use of documentation for system
operation and maintenance.

Not relevant.

11.10.k2

Revision and change control procedures tomaintain an audit trail that documents timesequenced development and modification ofsystems documentation.

Not relevant.

11.30

Controls for open systems
Persons who use open systems to create,
modify, maintain, or transmit electronic records
shall employ procedures and controls designed
to ensure the authenticity, integrity, and, as
appropriate, the confidentiality of electronic
records from the point of their creation to thepoint of their receipt.
Such procedures and controls shall include
those identified in § 11.10, as appropriate,
and additional measures such as document
encryption and use of appropriate digital
signature standards to ensure, as necessary
under the circumstances, record authenticity,
integrity, and confidentiality.

Evidian and its partners provide trainingclasses on Enterprise Access Management.
They can also organize on-site training toprovide developers and administrators withhands-on experience.

For systems that can be accessed throughweb-based means, the Mobile E-SSO
module can systematically encrypt all
traffic between users and applications. This
ensures the integrity of data transfer.
Answers given in 11.10 apply.

11.50

Signature manifestations.

11.50.aSigned electronic records shall contain
information associated with the signing thatclearly indicates all of the following:(1) The printed name of the signer;(2) The date and time when the signature was
executed; and(3) The meaning (such as review, approval,
responsibility, or authorship) associated withthe signature

The audit trail generated by Enterprise
Access Management allows auditors toaccess, in a central location, information
regarding a signature event: identity of thesigner, date/time of signature, and type ofsignature window.
This means that the signature actions
can be audited, even centrally, even if theapplication’s own audit files have beenaltered.
It complements the audit trails generated
by individual recordmanagement
applications.

11.50.b

The items identified in paragraphs (a)(1), (a)(2),and (a)(3) of this section shall be subject to thesame controls as for electronic records and shallbe included as part of any human readable
form of the electronic record (such as electronic
display or printout).

Enterprise Access Management audit
data can be stored for long-term duration.
Procedures and tools used to protect
electronic records should be applied to thisaudit trail as well.

8 | Evidian Enterprise Access Management and 21 CFR Part 1111.70Signature/record linking.
Electronic signatures and handwritten
signatures executed to electronic records shallbe linked to their respective electronic
records to ensure that the signatures cannot
be excised, copied, or otherwise transferred tofalsify an electronic recordby ordinary means.

Because Enterprise Access Management
stores centrally an audit file listing the
instances of electronic signatures, it
provides an additional means of verifying
whether a digital signature has been
tampered with.

Subpart C – Electronic signatures
11.100General requirements.

11.100.a

Each electronic signature shall be unique to
one individual and shall not be reused by, or
reassigned to, anyone else.

Enterprise Access Management can beused alongside strong authentication
methods, such as smart cards or USB keys.

11.100.b

Before an organization establishes, assigns,
certifies, or otherwise sanctions an individual’s
electronic signature, or any element of suchelectronic signature, the organization shallverify the identity of the individual.

The identity of the individual is verified byEnterprise Access Management’s secure
single sign-on process.

11.100.c

Persons using electronic signatures shall, prior
to or at the time of such use, certify to theagency that the electronic signatures in theirsystem, used on or after August 20, 1997,
are intended to be the legally binding
equivalent of traditional handwritten
signatures.
(1) The certification shall be submitted in paper
form and signed with a traditional handwritten
signature, to the Office of Regional Operations(HFC–100), 5600 Fishers Lane, Rockville,
MD 20857.
(2) Persons using electronic signatures shall,
upon agency request, provide additional
certification or testimony that a specificelectronic signature is the legally binding
equivalent of the signer’s handwritten
signature.

Not relevant.

11.200Electronic signature components and controls.

11.200.aElectronic signatures that are not based upon biometrics shall:

11.200.a.1

Employ at least two distinct identification
components such as an identification code andpassword.

Enterprise Access Management supports
a variety of identification methods that
include two components, such as ID /password or smart card / PIN code.

11.200.a.1.i

When an individual executes a series ofsignings during a single, continuous period ofcontrolled system access, the first signing shallbe executed using all electronic signaturecomponents; subsequent signings shall be
executed using at least one electronic signaturecomponent that is only executable by, anddesigned to be used only by, the individual.

Supported. Enterprise Access anagement’s
secure single sign-on process detects
partial re-authentication windows
issued by individual applications.
In that case, the user can be asked to enterhis or her password or PIN code again.

Evidian Enterprise Access Management and 21 CFR Part 11 | 9

11.200.a.1.ii

When an individual executes one or moresignings not performed during a single,
continuous period of controlled system access,each signing shall be executed using all of theelectronic signature components.

Supported. A time-out period can be
configured to end a period of systemaccess forcibly if no action has been
performed. When accessing the station
after the period has ended, the user must
perform full primary authentication
again.

11.200.a.2

Be used only by their genuine owners; andNo two users can have the same ID, asEnterprise Access Management uses theenterprise’s existing LDAP directory
environment.
Authentication can be reinforced by strong
authentication methods, such as smart
cards or USB tokens.
Single sign-on can be set up in such a waythat the users do not know their IDs andpasswords on specific applications.
Therefore, they cannot give away these IDs
and passwords.

11.200.a.3

Be administered and executed to ensure that
attempted use of an individual’s electronic
signature by anyone other than its genuine
owner requires collaboration of two or moreindividuals.

Passwords are not visible to administrators.
Enterprise Access Management canbe configured so that whenever theadministrator creates a new user (orchanges the user’s password) the user
must change his or her password.
The user is therefore the only one to know
his or her primary password.
Signing in place of a user would therefore
require the cooperation of the user as wellas the administrator. In addition, Enterprise
Access Management can alert a supervisor
whenever a password is created (Feature
requires integration services).
Lastly, workflow solutions can be
implemented to require approval for
password changes. This necessitates
integration services.

11.200.bElectronic signatures based upon biometrics
shall be designed to ensure that they cannot
be used by anyone other than their genuine
owners.

Enterprise Access Management iscompatible with biometricauthentication solutions.

11.300Controls for identification codes/passwords.
Persons who use electronic signatures based upon use of identification codes in combination
with passwords shall employ controls to ensure their security and integrity. Such controls
shall include:

11.300.a

Maintaining the uniqueness of each combined
identification code and password, such that notwo individuals have the same combination ofidentification code and password.

By design, no two users can have the same
Enterprise Access Management primary
ID. With Enterprise Access Management’s
secure SSO (Enterprise SSO), “sharedaccounts” can disappear from the IS.

11.300.b

Ensuring that identification code and password
issuances are periodically checked, recalled, orrevised (e.g., to cover such events as password
aging).

Enterprise-wide password policies –including password aging – can be
defined and implemented centrally with
AccessMaster.

10 | Evidian Enterprise Access Management and 21 CFR Part 1111.300.c

Following loss management procedures toelectronically deauthorize lost, stolen, missing,or otherwise potentially compromised tokens,cards, and other devices that bear or generate
identification code or password information,and to issue temporary or permanent
replacements using suitable, rigorous controls.

The authentication device management
features of Enterprise Access Management(Authentication Manager) make itpossible to de-authorize and issue
replacement of such devices. This requires
the Token Manager component ofEnterprise Access Management.
In addition, Enterprise Access anagement’s
central management capabilities
make it possible to quickly remove
all authorizations from compromised
accounts.

11.300.d

Use of transaction safeguards to prevent
unauthorized use of passwords and/or
identification codes, and to detect andreport in an immediate and urgent manner
any attempts at their unauthorized use to thesystem security unit, and, as appropriate, toorganizational management.

Detection of an unauthorized attempt ataccessing a resource can generate an alert
sent to a supervisor. Such security alerts
are also logged for later auditing.
(Feature requires integration services)

11.300.e

Initial and periodic testing of devices, suchas tokens or cards, that bear or generate
identification code or password information toensure that they function properly and havenot been altered in an unauthorized manner.

Not relevant.

Evidian Enterprise Access Management and 21 CFR Part 11 | 11

Eviden is a registered trademark © Copyright 2024, Eviden SAS – All rights reserved.

ECT-240701-SJ-WP-Evidian Enterprise Access Management and 21 CFR Part 11