rohit/probo
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

Update CFR framework

Browse Source 
Signed-off-by: Bryan Frimin <bryan@getprobo.com>
This commit is contained in:
Bryan Frimin
2026-02-05 15:03:07 +01:00
parent b016f44525
commit 64fbad061d
1 changed files with 140 additions and 60 deletions
Download Patch File Download Diff File Expand all files Collapse all files

148
apps/console/public/data/frameworks/21CFR-part11.json
View File

@@ -7,64 +7,144 @@
}, },
"controls": [ "controls": [
{ {
"id": "P11-001", "id": "11.10(a)",
"name": "System Validation", "name": "System Validation",
"description": "Systems are validated to ensure accuracy, reliability, consistent intended performance, and the ability to discern invalid or altered records." "description": "Validate electronic record systems to ensure accuracy, reliability, consistent intended performance, and the ability to detect invalid or altered records."
}, },
{ {
"id": "P11-002", "id": "11.10(b)",
"name": "Record Copies",
"description": "Generate accurate and complete copies of electronic records in both human-readable and electronic form suitable for FDA inspection, review, and copying."
},
{
"id": "11.10(c)",
"name": "Record Protection and Retention",
"description": "Protect electronic records to ensure accurate and ready retrieval throughout the required retention period."
},
{
"id": "11.10(d)",
"name": "Access Control",
"description": "Limit system access to authorized individuals."
},
{
"id": "11.10(e)",
"name": "Audit Trails", "name": "Audit Trails",
"description": "Secure, computer-generated, time-stamped audit trails independently record operator entries and actions." "description": "Use secure, computer-generated, time-stamped audit trails to record creation, modification, or deletion of electronic records; ensure prior information is not obscured and audit trails are retained with the records."
}, },
{ {
"id": "P11-003", "id": "11.10(f)",
"name": "Record Retention", "name": "Operational Controls",
"description": "Electronic records are protected to enable accurate and ready retrieval throughout the records retention period." "description": "Implement system checks to enforce permitted sequencing of steps and events."
}, },
{ {
"id": "P11-004", "id": "11.10(g)",
"name": "Access Controls", "name": "Authority Controls",
"description": "System access is limited to authorized individuals with unique user IDs." "description": "Ensure only authorized individuals can use the system, sign records, access devices, or alter records."
}, },
{ {
"id": "P11-005", "id": "11.10(h)",
"name": "Electronic Signatures", "name": "Device Controls",
"description": "Electronic signatures are unique to an individual and verifiable." "description": "Verify the validity of data input sources and operational instructions where applicable."
}, },
{ {
"id": "P11-006", "id": "11.10(i)",
"name": "Signature Linking", "name": "Personnel Competency",
"description": "Electronic signatures are permanently linked to their respective electronic records." "description": "Ensure individuals who develop, maintain, or use electronic record or signature systems are trained, qualified, and competent."
}, },
{ {
"id": "P11-007", "id": "11.10(j)",
"name": "Signature Integrity", "name": "Accountability Policies",
"description": "Electronic signatures cannot be excised, copied, or transferred to falsify an electronic record." "description": "Establish and enforce written policies holding individuals accountable for actions taken under electronic signatures."
}, },
{ {
"id": "P11-008", "id": "11.10(k)(1)",
"name": "Signature Binding Enforcement", "name": "Documentation Access Controls",
"description": "System enforces technical and procedural controls to maintain binding between record content and signature." "description": "Control the distribution, access, and use of system documentation."
}, },
{ {
"id": "P11-009", "id": "11.10(k)(2)",
"name": "Operational Checks", "name": "Documentation Change Control",
"description": "Operational system checks enforce permitted sequencing of steps and events." "description": "Maintain an audit trail of time-sequenced development and changes to system documentation."
}, },
{ {
"id": "P11-010", "id": "11.30",
"name": "Authority Checks", "name": "Open System Protections",
"description": "Authority checks ensure only authorized individuals can use the system or sign records." "description": "Apply additional safeguards (e.g., encryption, digital signatures) to protect the authenticity, integrity, and confidentiality of records in open systems."
}, },
{ {
"id": "P11-011", "id": "11.50(a)",
"name": "Device Checks", "name": "Signature Manifestation",
"description": "Device checks determine the validity of the source of data input." "description": "Ensure signed electronic records display the signer's name, date/time of signing, and meaning of the signature."
}, },
{ {
"id": "P11-012", "id": "11.50(b)",
"name": "Training", "name": "Signature Record Integrity",
"description": "Personnel have education, training, and experience to perform assigned tasks." "description": "Subject signature information to the same controls as electronic records and include it in human-readable outputs."
},
{
"id": "11.70",
"name": "Signature-to-Record Linking",
"description": "Securely link electronic signatures to their respective records to prevent excision, copying, or transfer."
},
{
"id": "11.100(a)",
"name": "Signature Uniqueness",
"description": "Ensure each electronic signature is unique to one individual and is not reused or reassigned."
},
{
"id": "11.100(b)",
"name": "Identity Verification",
"description": "Verify an individual's identity before assigning or authorizing an electronic signature."
},
{
"id": "11.100(c)",
"name": "Signature Legal Certification",
"description": "Certify to the FDA that electronic signatures are intended to be legally binding equivalents of handwritten signatures."
},
{
"id": "11.200(a)(1)",
"name": "Multi-Factor Signature Components",
"description": "Require at least two distinct identification components (e.g., ID and password) for non-biometric electronic signatures."
},
{
"id": "11.200(a)(2)",
"name": "Signature Ownership Control",
"description": "Ensure electronic signatures are used only by their genuine owners."
},
{
"id": "11.200(a)(3)",
"name": "Signature Misuse Prevention",
"description": "Implement controls requiring collaboration of two or more individuals for unauthorized signature use."
},
{
"id": "11.200(b)",
"name": "Biometric Signature Protection",
"description": "Ensure biometric electronic signatures cannot be used by anyone other than their genuine owners."
},
{
"id": "11.300(a)",
"name": "Credential Uniqueness",
"description": "Maintain the uniqueness of identification code and password combinations."
},
{
"id": "11.300(b)",
"name": "Credential Lifecycle Management",
"description": "Periodically check, recall, or revise identification codes and passwords."
},
{
"id": "11.300(c)",
"name": "Credential Loss Management",
"description": "Deauthorize lost, stolen, or compromised authentication devices and issue replacements securely."
},
{
"id": "11.300(d)",
"name": "Unauthorized Access Detection",
"description": "Implement safeguards to detect and immediately report unauthorized use of credentials."
},
{
"id": "11.300(e)",
"name": "Authentication Device Integrity Testing",
"description": "Perform initial and periodic testing of authentication devices to detect unauthorized alteration."
} }
] ]
} }