21 CFR Part 11 of the Code of Federal Regulations deals with the Food and Drug Administration (FDA) guidelines on electronic records and electronic signatures in the United States. 21 CFR(code of Federal Regulations) Part 11  all the quality documents including SOPs, MPBRs, PBRs and log books have been maintained on paper by companies in order to comply with FDA’s cGMP. Even as companies automated their production and quality processes, they were still being forced to maintain and track paper records. The code of Federal Regulations (CFR) Part 11 was implemented in 1997 to let the FDA accept electronic records and signatures in place of paper records and handwritten signatures for compliance. The regulation outlines controls for ensuring that electronic records and signatures are trustworthy, reliable, and compatible with FDA procedures and as verifiable and traceable as their paper counterparts.

21 CFR Part 11 Software Requirements

The following are the specific software requirements specified in Section 11.10:

• Protection of records to enable their accurate and ready retrieval throughout the records retention period
• The ability to generate accurate and complete copies of records in both human readable and electronic form
• Use of secure, computer-generated, time-stamped audit trails
• Use of operational system checks to enforce permitted sequencing of steps and events
• Use of authority checks to ensure that only authorized individuals can use the system,
• Determination that persons who develop, maintain, or use electronic record/electronic signature systems has the education, training, and experience to perform their assigned task
• The establishment of, and adherence to, written policies that hold individuals accountable and responsible for actions initiated under their electronic signatures
• Use of appropriate controls over systems documentation
• Validation of systems to ensure accuracy, reliability, consistent intended performance, and the ability to discern invalid or altered records
• Limiting system access to authorized individuals
• electronically sign a record, access the operation or computer system input or output device, alter a record, or perform the operation at hand
• Use of device checks to determine the validity of the source of data input or operational instruction