21 CFR Part 11

Controls for closed systems.

Controls for open systems.

• A unique UserID and password is required to access the system
• User account should be in active status
• Access to Modules is required to create, edit, view records
• Electronic Signature is required to create, edit, approve, reject and/or delete any records
• Detail report can be used to print the human readable format of the record
• Inactivity will auto-log out the users from the system.
• The system uses Hypertext Transfer Protocol Secure (https) is a combination of the Hypertext Transfer Protocol (HTTP) with the Secure Socket Layer (SSL)/Transport Layer Security (TLS) protocol. TLS is an authentication and security protocol widely implemented in browsers and Web servers. SSL works by using a public key to encrypt data transferred over the SSL connection. Most Web browsers support SSL. It allows you to communicate securely with the web server.

Electronic Signature Functionality. The system prompts the user to key-in the user id and password for create, edit, approve and delete actions within the system. When the create, edit, approval, reject and/or delete action is executed, the system captures:

• The name of the user who executed one of the functions
• The date and time the user executed the function; and The meaning of the action performed such as (author of the record, approval or rejection of the record).

Audit Trail Functionality along with electronic signature functionality with Date & Time Stamping for all records related description. It ensures to capture details for each and every system entry done for all the records including the previous and current change value/description.

Electronic signature of a user is unique combination of a user-id and password. A user-id and associated with a user who can be further identified by their Name (FN, LN), Title, email address and a phone number (optional) in the system.

To gain access to the system, a user must input two distinct identification components:

• User-id
• Password (see 11.300 controls for identification codes/password)

Once logged in the system, any create, edit, approve, reject, delete action required re-entering the user-id and password combination.

User-id and password policy management is controlled by the designated administrator of the system.

• Each user is assigned a unique user-id to gain access to the system
• Creating a password must adhere to the policy below:
  • A password must contain at least eight characters, including one alphabetic character and one number.
  • The security question’s answer can’t contain the user’s password.
  • When users change their password, they can’t reuse their last three passwords.
  • A password can’t contain a user’s username and can’t match a user’s first or last name. Passwords also can’t be too simple. For example, a user can’t change their password to ‘password’.