← Frameworks / FDA 21 CFR Part 11 / Control Mappings

FDA 21 CFR Part 11 — Electronic Records; Electronic Signatures

US federal regulation establishing criteria for acceptance of electronic records and electronic signatures by the FDA. 30 requirements across electronic records (validation, audit trails, system access controls, authority checks, device checks, education and training, documentation, open and closed system controls), electronic signatures (uniqueness, identity verification, signature manifestations, signature/record linking), and biometric and non-biometric authentication controls. Applies to all FDA-regulated industries including pharmaceuticals, medical devices, biologics, and food.

Controls: 92

Total Mappings: 155

Publisher: U.S. Food and Drug Administration (FDA) Version: 1997 (updated guidance 2003)

FDA 21 CFR Part 11 → SP 800-53 SP 800-53 → FDA 21 CFR Part 11 Coverage Analysis

AC (12) AT (4) AU (13) CA (3) CM (8) CP (3) IA (11) IR (1) MP (1) PE (2) PL (3) PM (3) PS (5) RA (4) SA (7) SC (8) SI (4)

AC Access Control

Control	Name	FDA 21 CFR Part 11 References
AC-01	Policy and Procedures	§11.10(d)
AC-02	Account Management	§11.10(d)§11.10(g)§11.100(a)§11.200(a)(2)§11.300(a)§11.300(b)§11.300(c)
AC-03	Access Enforcement	§11.10(d)§11.10(g)
AC-05	Separation of Duties	§11.10(d)§11.10(g)
AC-06	Least Privilege	§11.10(d)§11.10(g)
AC-07	Unsuccessful Logon Attempts	§11.10(d)§11.200(a)(1)(ii)
AC-11	Device Lock	§11.10(d)§11.200(a)(1)(i)§11.200(a)(1)(ii)
AC-12	Session Termination	§11.10(d)§11.200(a)(1)(i)
AC-16	Security and Privacy Attributes	§11.10(g)
AC-17	Remote Access	§11.30§11.300(d)
AC-19	Access Control for Mobile Devices	§11.10(h)
AC-24	Access Control Decisions	§11.10(g)

AT Awareness and Training

Control	Name	FDA 21 CFR Part 11 References
AT-01	Policy and Procedures	§11.10(i)
AT-02	Literacy Training and Awareness	§11.10(i)
AT-03	Role-based Training	§11.10(i)
AT-04	Training Records	§11.10(i)

AU Audit and Accountability

Control	Name	FDA 21 CFR Part 11 References
AU-01	Policy and Procedures	§11.10(e)
AU-02	Event Logging	§11.10(e)§11.50
AU-03	Content of Audit Records	§11.10(e)§11.50
AU-04	Audit Log Storage Capacity	§11.10(e)
AU-05	Response to Audit Logging Process Failures	§11.10(e)
AU-06	Audit Record Review, Analysis, and Reporting	§11.10(e)
AU-07	Audit Record Reduction and Report Generation	§11.10(e)
AU-08	Time Stamps	§11.10(e)
AU-09	Protection of Audit Information	§11.10(b)§11.10(e)
AU-10	Non-repudiation	§11.10(e)§11.30§11.50§11.70
AU-11	Audit Record Retention	§11.10(b)§11.10(c)§11.10(e)
AU-12	Audit Record Generation	§11.10(e)§11.50
AU-14	Session Audit	§11.10(e)

CA Security Assessment and Authorization

Control	Name	FDA 21 CFR Part 11 References
CA-02	Control Assessments	§11.10(a)§11.300(e)
CA-07	Continuous Monitoring	§11.10(a)
CA-08	Penetration Testing	§11.300(e)

CM Configuration Management

Control	Name	FDA 21 CFR Part 11 References
CM-02	Baseline Configuration	§11.10(f)
CM-03	Configuration Change Control	§11.10(k)
CM-04	Impact Analyses	§11.10(a)
CM-05	Access Restrictions for Change	§11.10(k)
CM-06	Configuration Settings	§11.10(f)
CM-07	Least Functionality	§11.10(f)
CM-08	System Component Inventory	§11.10(h)
CM-09	Configuration Management Plan	§11.10(k)

CP Contingency Planning

Control	Name	FDA 21 CFR Part 11 References
CP-06	Alternate Storage Site	§11.10(c)
CP-09	System Backup	§11.10(b)§11.10(c)
CP-10	System Recovery and Reconstitution	§11.10(c)

IA Identification and Authentication

Control	Name	FDA 21 CFR Part 11 References
IA-01	Policy and Procedures	§11.10(d)
IA-02	Identification and Authentication (Organizational Users)	§11.10(d)§11.100(a)§11.200(a)(1)§11.200(a)(1)(ii)§11.200(a)(2)§11.200(a)(3)
IA-03	Device Identification and Authentication	§11.10(h)
IA-04	Identifier Management	§11.10(d)§11.100(a)§11.100(b)§11.200(a)(2)§11.300(a)§11.300(c)
IA-05	Authenticator Management	§11.10(d)§11.100(a)§11.100(b)§11.200(a)(1)§11.200(a)(1)(ii)§11.200(a)(2)§11.300(a)§11.300(b)§11.300(c)§11.300(e)
IA-06	Authentication Feedback	§11.200(a)(1)§11.300(d)
IA-07	Cryptographic Module Authentication	§11.200(a)(1)
IA-08	Identification and Authentication (Non-organizational Users)	§11.100(a)
IA-09	Service Identification and Authentication	§11.10(h)
IA-11	Re-authentication	§11.200(a)(1)(i)§11.200(a)(1)(ii)
IA-12	Identity Proofing	§11.100(b)§11.200(a)(3)

IR Incident Response

Control	Name	FDA 21 CFR Part 11 References
IR-06	Incident Reporting	§11.300(c)

MP Media Protection

Control	Name	FDA 21 CFR Part 11 References
MP-04	Media Storage	§11.10(c)

PE Physical and Environmental Protection

Control	Name	FDA 21 CFR Part 11 References
PE-19	Information Leakage	§11.200(a)(3)
PE-20	Asset Monitoring and Tracking	§11.10(h)

PL Planning

Control	Name	FDA 21 CFR Part 11 References
PL-01	Policy and Procedures	§11.10(j)
PL-02	System Security and Privacy Plans	§11.1§11.10(j)§11.10(k)
PL-04	Rules of Behavior	§11.10(j)

PM Program Management

Control	Name	FDA 21 CFR Part 11 References
PM-01	Information Security Program Plan	§11.1
PM-09	Risk Management Strategy	§11.2
PM-11	Mission and Business Process Definition	§11.1§11.2

PS Personnel Security

Control	Name	FDA 21 CFR Part 11 References
PS-01	Policy and Procedures	§11.10(i)
PS-02	Position Risk Designation	§11.10(i)
PS-03	Personnel Screening	§11.10(i)§11.100(b)
PS-06	Access Agreements	§11.10(j)
PS-08	Personnel Sanctions	§11.10(j)

RA Risk Assessment

Control	Name	FDA 21 CFR Part 11 References
RA-01	Policy and Procedures	§11.2
RA-02	Security Categorization	§11.1§11.2
RA-03	Risk Assessment	§11.2
RA-07	Risk Response	§11.2

SA System and Services Acquisition

Control	Name	FDA 21 CFR Part 11 References
SA-03	System Development Life Cycle	§11.10(a)
SA-05	System Documentation	§11.10(k)
SA-08	Security and Privacy Engineering Principles	§11.10(a)
SA-10	Developer Configuration Management	§11.10(a)
SA-11	Developer Testing and Evaluation	§11.10(a)§11.10(f)
SA-15	Development Process, Standards, and Tools	§11.10(a)
SA-17	Developer Security and Privacy Architecture and Design	§11.10(a)

SC System and Communications Protection

Control	Name	FDA 21 CFR Part 11 References
SC-07	Boundary Protection	§11.30
SC-08	Transmission Confidentiality and Integrity	§11.30§11.70§11.300(d)
SC-10	Network Disconnect	§11.200(a)(1)(i)
SC-12	Cryptographic Key Establishment and Management	§11.30
SC-13	Cryptographic Protection	§11.30§11.300(d)
SC-17	Public Key Infrastructure Certificates	§11.30
SC-23	Session Authenticity	§11.30§11.300(d)
SC-28	Protection of Information at Rest	§11.10(b)§11.10(c)§11.70

SI System and Information Integrity

Control	Name	FDA 21 CFR Part 11 References
SI-06	Security and Privacy Function Verification	§11.10(a)§11.300(e)
SI-07	Software, Firmware, and Information Integrity	§11.10(b)§11.10(f)§11.70
SI-10	Information Input Validation	§11.10(f)
SI-12	Information Management and Retention	§11.10(c)§11.10(k)