Open system vs closed system under 21 CFR Part 11: which is yours?
Part 11 calls a system closed when the people responsible for its records control who gets in, and open when they do not. Answer four questions about one system, a LIMS, a hosted eQMS, an e-signature account, and see which it is, why, and what the open-system rule in § 11.30 then asks for. Each reason says whether it comes from the rule, from FDA, or from our reading of a case the rule leaves open.
The tool
Click any answer to change it. Pre-filled with a realistic example: a small device maker’s vendor-hosted eQMS.
Load an example
Result for: eQMS, vendor-hosted (SaaS)
Depends — closed only on the contract's terms
Why
- § 11.3(b)(4)RuleA closed system is "an environment in which system access is controlled by persons who are responsible for the content of electronic records that are on the system."
- 62 FR 13441, cmt 44FDA, 1997 preambleFDA cautioned that records "stored on systems operated by third parties, such as commercial online services" sit under the third party's control, and it would regard that as open.
- 62 FR 13440–41, cmt 41FDA, 1997 preambleFDA also left the basis for authorising access, "contractual relationship" included, to the firm.
- Our readingOur readingA contracted GxP system is not the 1997 "commercial online service". If the agreement puts every account, the vendor's own included, under your approval, logs the vendor's access and lets you audit it, the people responsible control access and the system can be called closed. The rule does not settle this, so we say both.
Where this is our reading
Part 11 defines open and closed by who controls access and stops there. FDA’s 1997 comments speak of “commercial online services” and public phone lines, not of contracted GxP software. Where a line above says “Our reading”, it is our judgement on a case the rule does not settle, with the reason given. Record your own classification and its reason in the system’s validation file.
What § 11.30 then asks for
- § 11.10(a)–(k)RuleThe closed-system controls: validation, copies for FDA, retrieval through the retention period, limited access, a secure time-stamped audit trail, operational, authority and device checks, trained people, a signature accountability policy, and control of system documentation.
- Our readingOur readingFor the contract to carry a closed classification it should say: your system owner approves every account, the vendor's admin and support accounts included; vendor access is logged in the audit trail and reported to you; you may audit; records come back complete when the contract ends.
- 2024 Q&A, III.CFDA guidanceFDA's clinical-investigation Q&A lists what to assess in a provider before you sign: oversight it allows you, validation, complete copies for the retention period, backup and migration, access control SOPs, audit trails, protection of data at rest and in transit, e-signature controls.
- Our readingOur readingEncrypt in transit and at rest anyway. Most hosted systems already do, it costs you a line in the URS, and it ends the open-or-closed argument in an inspection.
What it checks
Part 11 sorts every system into one of two kinds, and the only test is who controls access. A closed system is “an environment in which system access is controlled by persons who are responsible for the content of electronic records that are on the system” (§ 11.3(b)(4)). An open system is the same sentence with “not” in it (§ 11.3(b)(9)). Closed systems carry the § 11.10 controls. Open systems carry those controls “as appropriate” plus the § 11.30 extras, such as document encryption and digital signature standards, from the point a record is created to the point it is received.
The test is not where the server sits, whether it touches the internet, or what the vendor’s brochure says. FDA’s first draft did define a closed system by membership of “the organization that operates the system”. Comments asked what to do about contractors, temps and consultants, and FDA rewrote both definitions around control of access instead, calling it “the most important factor in classifying a system as closed or open” (62 FR 13440, comment 41).
The check asks who runs the system, who approves accounts, whether the operator’s own access is in writing, and how records leave. Before you run it, confirm the records are Part 11 records at all with the Part 11 applicability checker; the background is in what 21 CFR Part 11 covers and who it binds.
How to use this check
- 01Pick one system and one record flow. A LIMS that keeps results on your server and mails certificates of analysis to clients is closed for the first and needs § 11.30 for the second. Run the check once per flow.
- 02Answer who runs it, not where it sits. A server in a colocation cage you administer is yours; an eQMS your vendor runs is not, even if only your staff log in.
- 03Name who approves accounts. Look at the last admin account created. If your system owner did not approve it, and could not have refused it, someone else controls access.
- 04Read the contract for the operator's own access. Most SaaS agreements cover uptime and data return. Fewer say who at the vendor may open your records and how you would know.
- 05Follow the records out. Where do signed PDFs, exports and certificates go? Email and consumer file shares are the leg teams forget.
- 06File the answer. Put the classification and its reason in the system's validation file or URS, so the next inspection starts from a written position, not from memory.
With the answer in hand, mark the controls one by one in the Part 11 compliance checklist: set its profile to open or closed and the § 11.30 line comes into scope or drops out of it. Write any encryption or signature requirement into your user requirement specification so validation tests it.
Worked example: FDA's own cases from 1997
The preamble to the final rule answered commenters with concrete cases. Each row below is one of them, run through this check. The right-hand cell is computed by the tool, so if the logic drifted from FDA’s reading, this table would show it.
| Situation FDA described | FDA said | This check |
|---|---|---|
| A sales representative's laptop; the representative, responsible for the records, controls who may use it to sign62 FR, cmt 19, 13436 | Closed | Closed system |
| The same records copied to a public online service that stores them for later retrieval62 FR, cmt 19, 13437 | Open | Open system |
| Dial-in over public phone lines, where access is under the control of the people responsible for the records62 FR, cmt 44, 13441 | Could be closed; add security | Closed system |
| Records stored on systems operated by third parties, such as commercial online services62 FR, cmt 44, 13441 | Open | Open system |
| Records sent by the representative to a central location by way of a public online service62 FR, cmt 95, 13452 | Additional measures necessary | Depends — closed at rest, open in transit |
| The same records hand delivered, or sent by direct connection between the two62 FR, cmt 95, 13452 | Additional measures may not be necessary | Closed system |
| A record received in an email mailbox on an open system, then moved to a local computer62 FR, cmt 97, 13452 | May necessitate open-system controls | Depends — closed at rest, open in transit |
Cites are comment number and page in 62 FR 13430 (March 20, 1997). “Public online service” and “commercial online services” are FDA’s 1997 terms.
Two of the cases matter most for a lab today. Remote access does not by itself make a system open: FDA said dial-in over public lines “could be considered part of a closed system” when the responsible people control access, though firms “would be prudent” to add security such as input device checks and call-backs. And a closed system can feed an open leg: the same records, once mailed or uploaded to a public service, need the § 11.30 measures for that part of the trip.
Vendor-hosted software: the case the rule does not settle
Most small teams now keep Part 11 records in someone else’s data centre: an eQMS, a LIMS, an e-signature service. FDA’s 1997 words point one way. Where records are “stored on systems operated by third parties, such as commercial online services”, FDA said it “would regard such a system as being open” (comment 44). The same preamble points the other way too: FDA refused to write down the basis for granting access, “such as existence of a fiduciary responsibility or contractual relationship”, so firms could set those criteria themselves (comment 41).
Our reading: a GxP system under a quality agreement is not the 1997 online service. If your system owner approves every account, the vendor’s admin and support accounts included, the vendor’s access is logged and reported to you, and you can audit it, then the people responsible for the records control access and the system can fairly be called closed. That is why the check answers “Depends” for this case instead of picking a side, and why it asks you to encrypt in transit and at rest anyway: that is the first measure § 11.30 names, most hosted systems already do it, and it ends the argument.
FDA’s 2024 Q&A on clinical investigations does not use the words open or closed for cloud services. It says regulated entities stay “responsible for ensuring that electronic records meet applicable part 11 requirements” and recommends a written agreement with the IT service provider. The supplier questions to ask are in Part 11 for cloud and SaaS systems; what vendors publish about their own controls is laid out in the eQMS comparison and the e-signature comparison.
Study data at a CRO
When your case report forms live in a CRO’s EDC, whose records they are decides whose check it is. For an IND, a sponsor may transfer obligations to a CRO, and “Any such transfer shall be described in writing” (§ 312.52(a)). What you did not transfer stays yours, and in a system the CRO controls it is in an open system from your side. The EDC and eConsent comparison reads what those systems publish.
Five things teams get wrong
- § 11.3(b)(4)"It is on the internet, so it is open." The definitions never mention networks. FDA accepted remote access over public lines as possibly closed when the responsible people control it.
- § 11.10"Closed means we can skip encryption." § 11.30 does not apply, but § 11.10 still asks for authenticity and integrity, and FDA's 2024 clinical Q&A asks for a security risk assessment on every system, open or closed.
- § 11.30"Open means the system fails Part 11." Open is a classification, not a finding. An open system is compliant when it carries the § 11.10 controls as appropriate and the extra measures.
- § 11.3(b)(9)"The vendor says it is a closed system." The classification turns on who controls access to your records, which is a fact about your contract and your configuration, not about the product.
Common misreading
“Open systems need PKI.” They do not, by the rule’s words. FDA wrote that a digital signature is “one measure that may be used, but is not specifically required” (62 FR 13451, comment 94). The rule asks for measures “such as” encryption and digital signature standards, as necessary under the circumstances.
Open or closed, signatures follow the same rules: § 11.50 manifestation, § 11.70 linking and the § 11.200 components. The Part 11 requirements, section by section walks each one.
Where the rule says so
The rule, FDA’s commentary on it, and the guidance this check is built from, each read on the date shown.
- 21 CFR Part 11, Electronic Records; Electronic Signatures (eCFR, §§ 11.3, 11.10, 11.30), National Archives and FDAread 2026-10-22
- Electronic Records; Electronic Signatures, final rule and preamble, 62 FR 13430 (March 20, 1997), Federal Registerread 2026-10-22
- The same rule, full text as printed (comments 19, 41, 44, 56, 94, 95, 97), GovInforead 2026-10-22
- Part 11, Electronic Records; Electronic Signatures: Scope and Application (guidance, 2003), FDAread 2026-10-22
- Electronic Systems, Electronic Records, and Electronic Signatures in Clinical Investigations: Questions and Answers (2024), FDAread 2026-10-22
- 21 CFR Part 312, § 312.52 Transfer of obligations to a contract research organization (eCFR), National Archives and FDAread 2026-10-22