21 CFR Part 11 Deployment Guide

Overview

21 CFR Part 11 defines the requirements under which electronic records and electronic signatures are considered trustworthy and equivalent to paper records and handwritten signatures. Compliance is a shared responsibility: the product provides the technical controls, and the customer organization provides validation, procedures, and physical and organizational security.

This guide maps the Part 11 requirements to the product features and to the procedural controls the organization must define. The technical controls are described in detail in the Part 11 Compliance Mode, Audit Trail, and Electronic Signatures articles.

Product Controls

The following features form the technical foundation for a Part 11 deployment. Enable Part 11 Compliance Mode on the Parameters page as the starting point; it enforces individual logins, protects historic records, activates electronic signature enforcement, and applies a mandatory password expiry.

• Part 11 compliance mode: master switch that enforces the regulated behaviors. See the Part 11 Compliance Mode article.
• Audit trail: always-on, append-only, hash-chained record of configuration changes, operator actions, security events, and records management events, with chain verification, CSV export, and API access. The audit trail rotates on its own Audit Retention Days setting, separate from Rotation Days. See the Audit Trail article.
• Electronic signatures: password re-entry with a meaning and optional comment, enforced per action category, for variable writes per variable, and permanently linked to the audit records of the signed action. See the Electronic Signatures article.
• Access control: individual user accounts on the Users page, rights per group on the User Groups page, session timeouts, and optional single-session enforcement.
• Password controls: Password Min Length, Password Require Complexity, Password Expiry (days), Must change password on next login, and the login throttling settings in the Login and Password Policy section on the Parameters page.
• Record protection: Rotation Days bounds the historic trend, alarm, and event data and Audit Retention Days bounds the audit trail separately, Data Forwarders replicate the historian records including the audit trail and electronic signatures to an external archive database, and server redundancy keeps a second copy of the records online.

Traceability Matrix

The table below maps the individual Part 11 requirements to the control that satisfies them and to where that control lives. Controls marked procedural must be provided by the customer organization.

Procedural Controls

The following controls must be defined by the customer organization; the product supports them but cannot enforce them. Set the Full Name of every account that will apply electronic signatures: it is the printed name of the signer required by 21 CFR 11.50(a)(1), and in Part 11 compliance mode a local account cannot sign until its Full Name is set.

• Individually assigned accounts: give every operator, engineer, and administrator a personal account, and verify the identity of each person before issuing one. Reserve the built-in Admin account for engineering and commissioning.
• Retention period: define the required record retention period for the application, which can be multiple years, and set Audit Retention Days to at least that period, or to 0 to retain the audit trail indefinitely. Rotation Days governs the historic trend, alarm, and event data separately, so it can be shorter to control disk usage; size the disk for the audit trail volume over the full retention period, or use a Data Forwarder to an external archive database to preserve records beyond the local rotation window.
• Report set: define which record copies (viewer exports, Python script reports) the application must produce for inspection, and qualify them as part of the validation.
• Validation: perform IQ/OQ/PQ on the configured system, including the enforcement behaviors of compliance mode and the signing flows.
• FDA certification letter: submit the certification per 11.100(c) that the electronic signatures in the system are the legally binding equivalent of handwritten signatures.
• Active Directory deployments: enforce the password policy in the directory, since domain account passwords are managed there.

Deciding What to Sign

Which records must be signed is determined by the applicable predicate rule, the underlying regulation such as 21 CFR Part 211, and not by Part 11 itself; see FDA Guidance for Industry, Part 11, Electronic Records; Electronic Signatures - Scope and Application (August 2003). The Signature Required Actions setting in the Part 11 Compliance (21 CFR) section on the Parameters page is where the site expresses that decision: the quality team selects the operator actions that represent approval points in its process, for example Download recipes to the process, and leaves routine operator actions and configuration changes to the audit trail. For variable writes the decision is made per variable: select Write variables marked Signature Required and select Signature Required on the GMP-critical variables only. See the When Signatures Are Required section in the Electronic Signatures article.

EU GMP Annex 11 paragraph 9 expects a documented reason for changes to GMP-critical data. The Comment field of the Electronic Signature dialog captures this reason for the operator actions selected under Signature Required Actions, so sites subject to Annex 11 select the relevant actions there to obtain reason-for-change capture. Configuration changes are recorded in the audit trail without a signature; their reason is documented through the site change control procedure.

Scope note on the audit trail: the audit trail obligations target the creation, modification, and deletion of records, plus security events. Viewing records and read access require no audit trail entry. Historic trend values have no edit path in the product; they stay as the historian recorded them.

Server Hardening

Harden the server the application runs on; the operating system is part of the record protection.

• File system permissions: setup restricts the data folder of an instance to the SYSTEM account, the Administrators group and the IIS app pool of the instance, and removes inherited permissions so that other accounts on the server have no access. Verify this after installation and after each upgrade.
• Disk encryption: encrypt the volumes that hold the databases.
• Time synchronization: synchronize the server clock with NTP; audit record timestamps depend on it, and the audit trail records detected clock anomalies.
• Physical security: place the server in a restricted-access location.
• Offsite copies: include the EnvisionSCADA databases and the archive database a Data Forwarder writes to in the site backup regime, and hold a copy at a separate location.

Record Protection and Archiving

Record protection under 11.10(c) is met by replicating the records to a database the site already backs up and retains, rather than by a backup scheduler inside the application. A Data Forwarder streams the historian data, alarms, events, audit trail, and electronic signatures to an external SQL Server, MySQL, SQLite, or PostgreSQL database as the records are produced. Forward Signatures requires Forward Audit Trail, and signatures are always forwarded ahead of the audit records that reference them, so the archive can always resolve which signature authorized which action. Data Forwarders run on the primary server; a standby server drains its records to the primary first, so the archive receives one complete stream across a failover.

The EnvisionSCADA databases themselves are protected by the site backup regime, for example a volume or virtual machine snapshot of the server, and the project configuration is versioned through the project export. Verify the restore procedure for both as part of the installation qualification, and record the result.

Rotation exists to bound disk usage so the historian cannot fill the volume and stop the system. It is not the record retention mechanism for a 21 CFR Part 11 deployment. The archive database that a Data Forwarder writes to holds the records for the mandated period.

Size Rotation Days and Audit Retention Days longer than the longest period the archive database can be unavailable. Rotation removes records on age alone and does not check whether a Data Forwarder has already sent them, so a record that ages out while the archive server is unreachable is not recoverable. If the archive server can be offline for two weeks for maintenance or a network fault, set the retention periods well above that.

Setting Audit Retention Days to 0 disables audit trail rotation and keeps the audit records indefinitely, which removes the constraint at the cost of unbounded growth on the local disk. Signature records are never removed by rotation.