21 CFR Part 11 compliance checklist
Every requirement of 21 CFR Part 11, from the § 11.10 controls to the § 11.300 password rules, as one line each with its cite. Set the system's profile, mark each line, and print the gap list for your next validation or audit meeting.
The tool
Check one system
Pre-filled with a small QC lab's chromatography data system. Change any line, or clear it to a blank checklist. Your marks stay in this browser only.
Result
13 of 25 in place
26 of 26 lines marked: 13 in place, 9 partly, 3 not yet, 1 not applicable.
Gaps to close (12)
- § 11.10(j)Not yetWritten policies hold individuals accountable and responsible for actions initiated under their electronic signatures, and people follow them.Note: No signed e-signature accountability policy.
- § 11.100(b)Not yetThe organization verifies a person's identity before it issues that person an electronic signature or any part of one.Note: No record of an identity check before accounts were issued.
- § 11.100(c)Not yetThe organization has certified to FDA, in a letter signed by hand, that its electronic signatures are the legally binding equivalent of handwritten signatures.Note: No Non-Repudiation Letter on file.
- § 11.10(a)PartlyThe system is validated to ensure accuracy, reliability, consistent intended performance, and the ability to discern invalid or altered records.Note: Vendor IQ/OQ on file; PQ for our own methods not written yet.
- § 11.10(c)PartlyRecords are protected so they can be retrieved accurately and readily throughout the records retention period.Note: Nightly backup runs; a restore has never been tested.
- § 11.10(e)PartlyThe audit trail is retained at least as long as the records it covers and is available for FDA review and copying.Note: Archive SOP names the results but not the audit trail.
- § 11.10(g)PartlyAuthority checks let only authorized individuals use the system, sign a record, reach its input or output devices, alter a record, or perform the operation at hand.Note: Two senior analysts also hold the admin role.
- § 11.10(i)PartlyPeople who develop, maintain, or use the system have the education, training, and experience to perform their assigned tasks.Note: User training on file; none for the IT contractor who patches the server.
- § 11.10(k)(2)PartlyRevision and change control keeps an audit trail of time-sequenced changes to the systems documentation.Note: Config changes logged; manual revisions not tied to change control.
- § 11.50(b)PartlyName, date and time, and meaning are controlled like the record and appear on every human readable form of it, on screen and on printouts.Note: Custom report template prints name and date but drops the meaning.
- § 11.200(a)(2)–(3)PartlySignatures are used only by their genuine owners, and anyone else's attempt to use one would need two or more people to collaborate.Note: Admins can set a user's password without the user knowing.
- § 11.300(d)PartlyTransaction safeguards prevent unauthorized use of codes and passwords, and attempts are reported immediately and urgently to the system security unit.Note: Lockout after 3 failed tries; nobody is alerted.
30 lines, cites under each
Subpart B: electronic records
§§ 11.10, 11.30
The system is validated to ensure accuracy, reliability, consistent intended performance, and the ability to discern invalid or altered records.
§ 11.10(a)2003 guidance: enforcement discretion area
Evidence: Validation plan, test records and report for your intended use.
The system can generate accurate and complete copies of records in both human readable and electronic form for FDA inspection, review and copying.
§ 11.10(b)2003 guidance: enforcement discretion area
Evidence: A sample export with its metadata and audit trail, made on demand.
Records are protected so they can be retrieved accurately and readily throughout the records retention period.
§ 11.10(c)2003 guidance: enforcement discretion area
Evidence: Backup and archive procedure, plus a dated restore test.
System access is limited to authorized individuals.
§ 11.10(d)
Evidence: User list matched against an approved access request for each account.
A secure, computer-generated, time-stamped audit trail independently records the date and time of operator entries and actions that create, modify, or delete records.
§ 11.10(e)2003 guidance: enforcement discretion area
Evidence: The audit trail switched on, and proof users cannot edit or switch it off.
Record changes do not obscure previously recorded information.
§ 11.10(e)2003 guidance: enforcement discretion area
Evidence: An edited record showing the old value, the new value, who and when.
The audit trail is retained at least as long as the records it covers and is available for FDA review and copying.
§ 11.10(e)2003 guidance: enforcement discretion area
Evidence: Retention rule that names the audit trail beside the record.
Operational system checks enforce the permitted sequencing of steps and events, as appropriate.
§ 11.10(f)
Evidence: A test showing a step cannot run out of order (for example, approve before review).
Authority checks let only authorized individuals use the system, sign a record, reach its input or output devices, alter a record, or perform the operation at hand.
§ 11.10(g)
Evidence: Role matrix: which role may create, edit, sign, approve and administer.
Device (terminal) checks confirm the validity of the source of data input or operational instructions, as appropriate.
§ 11.10(h)
Evidence: Which instruments and terminals may send data, and how the system checks it.
People who develop, maintain, or use the system have the education, training, and experience to perform their assigned tasks.
§ 11.10(i)
Evidence: Training records for users, administrators and the vendor or IT staff who maintain it.
Written policies hold individuals accountable and responsible for actions initiated under their electronic signatures, and people follow them.
§ 11.10(j)
Evidence: A signed e-signature accountability policy, acknowledged by every signer.
Distribution of, access to, and use of the documentation for system operation and maintenance is controlled.
§ 11.10(k)(1)
Evidence: Admin and maintenance manuals kept as controlled documents.
Revision and change control keeps an audit trail of time-sequenced changes to the systems documentation.
§ 11.10(k)(2)2003 guidance: enforcement discretion area
Evidence: Change control records tied to each revision of the system documents.
From creation to receipt, the open system has the § 11.10 controls as appropriate plus additional measures such as document encryption and appropriate digital signature standards.
§ 11.30
Not applicable closed system: § 11.30 covers open systems
Subpart B: signature manifestation and linking
§§ 11.50, 11.70
Each signed record shows the printed name of the signer, the date and time of signing, and the meaning (such as review, approval, responsibility, or authorship).
§ 11.50(a)
Evidence: A signed record on screen with all three parts visible.
Name, date and time, and meaning are controlled like the record and appear on every human readable form of it, on screen and on printouts.
§ 11.50(b)
Evidence: A printout or PDF of the same signed record, with all three parts.
Signatures are linked to their records so they cannot be excised, copied, or otherwise transferred to falsify a record by ordinary means.
§ 11.70
Evidence: A test: change the signed record and see the signature flagged or voided.
Subpart C: electronic signatures
§§ 11.100, 11.200, 11.300
Each electronic signature is unique to one individual and is never reused by, or reassigned to, anyone else.
§ 11.100(a)
Evidence: No shared or generic accounts; leavers' accounts disabled, never renamed.
The organization verifies a person's identity before it issues that person an electronic signature or any part of one.
§ 11.100(b)
Evidence: A dated identity check on file before each account was issued.
The organization has certified to FDA, in a letter signed by hand, that its electronic signatures are the legally binding equivalent of handwritten signatures.
§ 11.100(c)
Evidence: A copy of your Non-Repudiation Letter; a company-wide letter covers all employees.
Each non-biometric signature uses at least two distinct identification components, such as an identification code and password.
§ 11.200(a)(1)
Evidence: The signing dialog asking for both components.
In one continuous session the first signing uses all components and later signings at least one private component; outside a continuous session every signing uses all components.
§ 11.200(a)(1)(i)–(ii)
Evidence: The session timeout setting and a test of a second signing.
Signatures are used only by their genuine owners, and anyone else's attempt to use one would need two or more people to collaborate.
§ 11.200(a)(2)–(3)
Evidence: Password and admin-reset procedure; admins cannot learn or set a user's password silently.
Biometric signatures are designed so no one other than their genuine owners can use them.
§ 11.200(b)
Not applicable no biometric signatures
No two individuals have the same combination of identification code and password.
§ 11.300(a)
Evidence: System setting or user list showing every code is unique.
Code and password issuances are periodically checked, recalled, or revised (for example, password aging).
§ 11.300(b)
Evidence: Password policy settings and the periodic access review.
Lost, stolen, missing, or compromised tokens and cards are electronically deauthorized, and replacements are issued under suitable, rigorous controls.
§ 11.300(c)
Not applicable no tokens or cards in use
Transaction safeguards prevent unauthorized use of codes and passwords, and attempts are reported immediately and urgently to the system security unit.
§ 11.300(d)
Evidence: Lockout setting and how a failed-login alert reaches the person who acts on it.
Tokens and cards are tested initially and periodically to confirm they work and have not been altered.
§ 11.300(e)
Not applicable no tokens or cards in use
What it checks
30 lines covering Subpart B (§§ 11.10, 11.30, 11.50, 11.70) and Subpart C (§§ 11.100, 11.200, 11.300). Each line keeps the rule's operative words and adds the evidence an inspector usually asks to see. The profile drops the lines a system cannot owe: § 11.30 for a closed system, the token lines when nobody uses tokens, the password lines for biometric signing, and every signature line for a system nobody signs in.
The checklist assumes Part 11 applies. It reaches only records a predicate rule requires, or records you submit to FDA, kept in electronic form; paper printouts that meet the predicate rule and are the records you rely on do not trigger it. If you are not sure, run the Part 11 applicability checker first, and the open vs closed system check if a vendor hosts the system.
How to use this checklist
- 01Pick one system. Part 11 is met system by system, so a LIMS, an ELN and a document control tool each get their own sheet.
- 02Set the profile. Open or closed decides whether § 11.30 is in play; how people sign decides which § 11.200 and § 11.300 lines count.
- 03Mark every line In place, Partly, Not yet or Not applicable, and write the evidence you would hand an inspector in the note.
- 04Use Not applicable only where the rule allows it, such as the "as appropriate" lines in § 11.10(f) and (h), and say why in the note.
- 05Print or copy the result. The gap list puts Not yet first; each gap becomes a change control, a CAPA or an SOP to write.
For the reasoning behind each line, read Part 11 requirements, section by section. Two lines have their own tools: the signature manifestation check for § 11.50, and the audit trail review checklist for what sits behind § 11.10(e).
Worked example: a small QC lab
The tool opens on this example: a small QC lab's chromatography data system, a closed system on the lab's own server, eight named users, signing with a user ID and password. Four lines fall out of scope from the profile (§ 11.30, § 11.200(b), § 11.300(c) and (e)), and the lab marked § 11.10(h) Not applicable because each instrument has one acquisition PC. Result: 13 of 25 in place. 26 of 26 lines marked: 13 in place, 9 partly, 3 not yet, 1 not applicable.
| Cite | Status | What the lab found |
|---|---|---|
| § 11.10(j) | Not yet | No signed e-signature accountability policy. |
| § 11.100(b) | Not yet | No record of an identity check before accounts were issued. |
| § 11.100(c) | Not yet | No Non-Repudiation Letter on file. |
| § 11.10(a) | Partly | Vendor IQ/OQ on file; PQ for our own methods not written yet. |
| § 11.10(c) | Partly | Nightly backup runs; a restore has never been tested. |
| § 11.10(e) | Partly | Archive SOP names the results but not the audit trail. |
| § 11.10(g) | Partly | Two senior analysts also hold the admin role. |
| § 11.10(i) | Partly | User training on file; none for the IT contractor who patches the server. |
| § 11.10(k)(2) | Partly | Config changes logged; manual revisions not tied to change control. |
| § 11.50(b) | Partly | Custom report template prints name and date but drops the meaning. |
| § 11.200(a)(2)–(3) | Partly | Admins can set a user's password without the user knowing. |
| § 11.300(d) | Partly | Lockout after 3 failed tries; nobody is alerted. |
12 gaps, Not yet first. Scroll sideways on a phone for the last column.
The three Not yet lines cost the least to close: a one-page accountability policy every signer signs, an identity check filed for each of the eight accounts, and the company's Non-Repudiation Letter. The biggest Partly is § 11.10(a); the lab scoped the missing performance testing with the CSA validation scope planner and logged the contractor's training on a training record.
What the 2003 guidance changes, and what it does not
Lines marked “enforcement discretion area” sit in the four areas FDA's 2003 Scope and Application guidance narrowed: validation, audit trail, record retention and record copying (§ 11.10(a), (b), (c), (e) and (k)(2)). FDA wrote that it does “not intend to take enforcement action to enforce compliance with the validation, audit trail, record retention, and record copying requirements of part 11 as explained in this guidance.”
Common misreading
That is not a pass on those lines. The same guidance says FDA “will enforce all predicate rule requirements, including predicate rule record and recordkeeping requirements”, and predicate rules carry their own versions: § 211.68(b) for drug CGMP computer controls and backups, § 58.130(e) for GLP data changes that must not obscure the original entry. Part 11 sets no retention period of its own; the predicate rule does. The signature sections, §§ 11.50 to 11.300, stay fully enforced.
Four lines teams misread
- § 11.200(a)(1)Part 11 does not require biometrics, tokens or multi-factor login. "An identification code and password" meets the two-component rule; digital signatures and encryption appear only as additional measures for open systems in § 11.30.
- § 11.50(a)The time on a signature does not have to be the signer's local time. The 2003 guidance says FDA does not expect it, and that your documentation should explain the time zone reference.
- § 11.100(c)The certification letter is yours, not your vendor's. The rule puts it on "Persons using electronic signatures", and FDA accepts an individual or a company-wide letter.
- § 11.10(i), (j)A vendor can supply the audit trail and the signing dialog, but training and the accountability policy are always your lines to close.
Selling to the EU as well? Annex 11 asks for things Part 11 does not, such as periodic evaluation and business continuity; the Annex 11 vs Part 11 mapping lines them up clause by clause.
Where the rule says so
The rule text and the guidance this checklist is built from, each read on the date shown.
- 21 CFR Part 11, Electronic Records; Electronic Signatures (eCFR), National Archives and FDAread 2026-10-22
- Part 11, Electronic Records; Electronic Signatures: Scope and Application (guidance, 2003), FDAread 2026-10-22
- Letters of Non-Repudiation Agreement, FDAread 2026-10-22
- 21 CFR Part 211, CGMP for Finished Pharmaceuticals (eCFR), National Archives and FDAread 2026-10-22
- 21 CFR Part 58, Good Laboratory Practice for Nonclinical Laboratory Studies (eCFR), National Archives and FDAread 2026-10-22