21 CFR Part 11 — clause by clause
Electronic records and signatures: what the rule asks for, the core mechanism designed for it, and the requirement with automated tests that evidences it.
The essentials
Why it matters in Russia
If the data may end up in an FDA submission, records and signatures must meet Part 11 wherever the study runs. International projects with Russian sites live under the EAEU Rules and Part 11 at once.
The signature is bound to the data
Re-authentication for every signature, meaning and scope, a snapshot hash. Editing covered data invalidates the signature — this cannot be switched off.
Claim level
We say “designed for the requirements”: fitness for your processes is confirmed by the customer’s validation. The vendor package is there for it.
Clause → mechanism → evidence
| Requirement | Mechanism | Evidence |
|---|---|---|
| 11.10(b) Accurate copies | Documents and exports are produced by the server through the export log with SHA-256; printed copies are PDF/A | URS-31 |
| 11.10(c) Protection of records | Clinical data are never physically deleted; backups are verified by restoring them | URS-08 · URS-25 |
| 11.10(d) Limiting access | Permission × scope, deny wins, default deny; locks; tenant isolation | URS-05 · URS-06 · URS-24 |
| 11.10(e) Audit trail | Every change in the same transaction: who, when, before and after, reason; append-only | URS-01 · URS-32 |
| 11.10(f) Operational checks | Design version: draft → review → approval → publication; a published one is immutable | URS-18 |
| 11.50 · 11.200(a) Signatures | Fresh authentication, name, date-time and meaning; signing-factor guessing is limited | URS-04 |
| 11.70 Signature/record linking | Hash of the covered data snapshot; an edit invalidates the signature automatically | URS-03 |
| 11.300 Identification codes and passwords | Password and a second factor by policy; HttpOnly-cookie sessions only, idle timeout | URS-23 |
URS is a requirement from the vendor catalogue. The automated tests for each requirement are listed in the traceability matrix (RTM), which ships in the per-release vendor package.
Questions
Related regulations
How to set it up — in the documentation
Is this a qualified electronic signature?
No. Under 63-FZ it is a simple electronic signature: its force is set by a local act or an agreement between the parties. The signing mechanism is designed for Part 11 requirements.
Can signature invalidation on edit be switched off?
No — it is a core invariant, covered by automated tests (URS-03).
See also
See the system on your own scenario
We walk through the full cycle on a demo study and answer your validation and hosting questions.