Compliance FrameworksAmericas
FDA 21 CFR Part 11
FDA Electronic Records and Electronic Signatures - audit trail, validation, access control, integrity.
FDA Electronic Records and Electronic Signatures - audit trail, validation, access control, integrity.
| Short name | 21 CFR 11 |
| Region | Americas |
| Country or scope | United States |
| Sector | Healthcare |
| In your workspace | On unless you switch it off in Compliance › Manage. |
How Safeguard covers 21 CFR 11
- Scan requirements: 6, all decided by a scan.
- Controls: the scan requirements below, plus 14 controls from Safeguard's control catalog for 21 CFR 11.
- Automated tests: none map to it directly. You can link any automated test to its controls yourself (how).
- Policy templates: 26: 4 written for 21 CFR 11 and 22 from the standard set.
How each kind of coverage works, and what the readiness score counts: Compliance frameworks.
What a scan checks
Each scan of a product checks these 6 requirements against what the scan found, including the product's software inventory (SBOM).
| Requirement | What Safeguard checks | Decided by |
|---|---|---|
FDA-P11-10A System Validation Baseline | Systems must be validated to ensure accuracy, reliability and consistent intended performance; validation is only meaningful against a fully enumerated system where every software component is named and versioned (21 CFR § 11.10(a)) | Scan |
FDA-P11-10B Accurate Machine-Readable Copies | Systems must be able to generate accurate and complete copies of records in both human-readable and electronic form suitable for FDA inspection; standardised machine-readable system documentation (SPDX/CycloneDX) satisfies the electronic-copy expectation for the software record (21 CFR § 11.10(b)) | Scan |
FDA-P11-10C Record Protection and Integrity | Records must be protected so they remain accurate and readily retrievable throughout the retention period; cryptographic integrity evidence (hashes) for the software handling those records demonstrates protection against undetected alteration (21 CFR § 11.10(c)) | Scan |
FDA-P11-10E Audit Trail Foundations | Secure, computer-generated, time-stamped audit trails must independently record operator entries and actions; the system documentation itself must carry document identity and creation timestamps to anchor that audit chain (21 CFR § 11.10(e)) | Scan |
FDA-P11-10K Documentation and Change Control | There must be controls over systems documentation, including revision and change-control procedures that maintain an audit trail of modifications; vague or floating component versions (latest, wildcards, ranges) are incompatible with controlled change management (21 CFR § 11.10(k)) | Scan |
FDA-P11-50 Signature and Authorship Manifestation | Signed electronic records must show the printed name of the signer and the date, time and meaning of the signing; analogously, the system record must identify who or what tool created it (21 CFR § 11.50) | Scan |
More controls in the catalog
The framework's Controls tab lists its scan requirements and these controls from Safeguard's control catalog. Evidence them with automated tests, uploaded evidence, policies or an attestation.
| Control | Name |
|---|---|
11.10(a) | System Validation |
11.10(b) | Record Legibility & Retention |
11.10(c) | Record Protection & Archival |
11.10(d) | System Access Limitation |
11.10(e) | Secure Audit Trails |
11.10(f) | Operational System Checks |
11.10(g) | Authority Checks |
11.10(k) | Personnel Training Controls |
11.30 | Open Systems Additional Controls |
11.50 | Signature Manifestations |
11.70 | Signature/Record Linking |
11.100 | Electronic Signature Uniqueness |
11.200 | Electronic Signature Components |
11.300 | ID Code & Password Controls |
Policy templates
Written for 21 CFR 11:
- Computer System Validation (CSV) Policy: 21 CFR Part 11
- Electronic Signature Controls Procedure: 21 CFR Part 11
- Audit Trail Review Procedure: 21 CFR Part 11
- Open Systems Security Policy: 21 CFR Part 11
And 22 from the standard set, adapted to 21 CFR 11.