Part 11 and Electronic Signatures

Hello,

We use a PDF software called FOXIT which has an option for electronically signing documents. It also give you an option to create a password protected certificate to sign with.

If this certificate is protected by a Windows login and certificate password itself, will this meet the requirements for Electronic signatures in Part 11?

Other paid for document signing certificates I have looked at are stored on a USB drive and password protected.

Thank you

 

First off, you have read the regulation, right? (https://www.ecfr.gov/cgi-bin/text-i...2cd232be553cd&mc=true&node=pt21.1.11&rgn=div5)

Can you explain the "certificate password" a bit? Who assigns that, how is it controlled, how is it used, etc?

Without knowing more about the application and your use, the sections of the regulation that seem least likely to be met include:

• 11.50 - signature manifestation
• 11.200.1(i) - continuous session

And really, even after signing, much of 11.10 is a concern regarding management of the (signed) records. (You may already have a system for that, though).

If you have specific concerns about a particular aspect, it may be easier to assess than a general question of compliance.

 

Hi Yodon,

The "certificate password" is a password set by the signer when first setting up the certificate. Anytime that certificate is used, the password is required. I believe this meets the requirements of 11-200.1(i) since we are basically prompted for a password every time a signing happens.

Everything else you have mentioned Yodon we have already taken care of.

I know auditors interpret regulations in different ways. My question is more around how an FDA auditor is going to feel about us using a self generated certificate for signing (free) vs. a paid for document signing certificate from a third party. For example, here is the document signing certificate product from Entrust (https://www.entrust.com/document-signing-certificates/).

Matt

 

Yes, that's the rub, isn't it! If you can demonstrate that you meet the requirements and that the records are safe and the veracity of the signature then they *shouldn't* care if it's paid / 3rd party or not. But validation data would go a long way (either way).