VR Series: Optional Higher Security with CFR21 Part 11 Features

The VR Series software allows for "normal" and "CFR-21" Higher Security selections.The "CFR-21" Higher Security includes CFR21 Part 11 type features 

The VR Series Recorders, as a component, has NOT been validated to comply with FDA CFR-21 Part 11. Typically the complete process made up of numerous components, software & procedures are validated as a system, not as individual components. It is the end user’s responsibility to validate the VR18 and/or other components & processes in the system are in compliance with appropriate CFR-21 part 11 regulations.

              

Return to Top


Normal Security & High Security (CFR-21 part 11 Features)

For Setup information refer to VR Series Configuration.htm; below is a description the Configuration page on how to setup Security.

 

In instruction manual 4.4 Instrument, select Normal security or Higher Security CFR-21.

 

                                

Normal Security: With “Normal” security selected in “4.4 Instrument” the Security Level dropdown allows “None” or “Security”. With “None” there is no password; with “Security” a common password for all users is used; password maximum is 8 characters. Once the password has been created the user needs to enter the password whenever Config, Dump, Clear or Operate soft keys are required. These keys enable the user to do configuration, dump data, clear data or manually operate the job.

CFR-21 Security Features: When the “CFR-21” is selected in “4.4 Instrument” the recorder operates under more restricted rules, many of which are required by CFR-21 Part 11. The CFR-21 security selection defines two types of users, Supervisor and Operator, each with different authority to access the recorder by using different passwords as shown in the graphic above.

Time limit during operation: If 10 minutes or longer since the last operator key action requires the user to enter password again. 

Audit Trail: CFR-21 Security offers audit trail function to record the user, time and operator actions to the event list. Incorrect password and unauthorized operation will be recorded into the event list as well.

CFR-21 Security Operator Levels:

Supervisor: Supervisor can define all the user names including other Supervisors and Operators with a maximum of 30 users. Supervisor has access to all recorder functions.  At least one Supervisor with an unlimited Time of Validity must be active.

Operator: Access to vertical keys to view the historical data, events and status, but no authority to access horizontal keys to do configuration, dump or clear data.

CFR-21 Security Time of validity:

The Time of validity may be configured as “Unlimited Time” or as 30, 60 or 90 days. If specified as 30, 60 or 90 days the account will be closed after the specified number of days; however the system will request the user to key in a new or remain with the original password when the user attempts to log in.

Return to Top

 


VR Series CFR21 Part 11 Feature Description: VR Series and Observer Software
 
Guidance on the use of VR Series Paperless Recorders for electronic record keeping
 

 Introduction

On August 20th 1997 the Food and Drug Administration made 21 CFR Part 11 effective.  This regulation is summarized as follows:

 

"The Food and Drug Administration (FDA) is issuing regulations that provide criteria for acceptance by the FDA, under certain circumstances, of electronic records, electronic signatures, and handwritten signatures executed to electronic records as equivalent to paper recorders and handwritten signatures executed on paper.  Theses regulations, which apply to all FDA program areas, are intended to permit the widest possible use of electronic technology, compatible with FDA's responsibility to promote and protect public health.  The use of electronic records as well as their submission to FDA is voluntary."

 

This guide provides details of the relevant sections of CFR21 Part 11and gives information on how the VR Series paperless recorders can be used to meet these FDA requirements for the creation of electronic records in a closed system.

 

 

Return to Top

 


 

FDA CFR21 Part 11 Subpart B, Section 11.10: Controls for modification

'Persons who use closed systems to create, modify, maintain, or transmit electronic records shall employ procedures and controls designed to ensure the authenticity, integrity, and when appropriate the confidentiality of electronic records, and can ensure that the signer cannot repudiate the signed record as not genuine."

 

All process data recorded by a VR Series paperless recorder are in proprietary (tamperproof) format and read-only from normal operator interface.  Via the use of Historical Viewer data review software "digital signature" can be added and checked to validate the integrity of the data.  If any part of the data record is changed the Historical Viewer software will warn the user of the invalid nature of the record.

 

Digital Signature within Observer software

 

 

Return to Top

 


FDA CFR21 Part 11 Section 11.10 (b)

"The ability to generate accurate and complete copies of records in both human and readable and electronic form suitable for inspection, review, and copying by the agency (FDA)."

 

The VR Series Paperless recorders can create process data files on Compact Flash memory cards.  These data files are created from secure records stores in internal flash memory.  Error detection algorithms are employed to ensure that the stored data faithfully represents the actual raw measurements made by the recorder.  Each write to the archive media is also verified to ensure the integrity of the data record.  The archived process data files can be viewed using the Historical Viewer review software.  The data can be viewed and printed in graphical formats.  Standard spreadsheet formats (e.g. Microsoft Excel) of the archived data files can be created for viewing by users who do not have the review software.

 

Screen below depicts Observer PC Software pop up window stating data has been tampered

 

 

 

 

Historical Data View with Observer PC software

[white or black background, time frame, etc. configurable]

 

 

 

Export Historical Data files in .csv format

[Data can be archived, reviewed, etc., by users without access to Review Software [Observer]

 

 

 

Depiction of .csv file opened in Microsoft ExcelŪ

 

 

Return to Top 


FDC CFR21 Part 11 Section 11.10 (c)

"Protection of records to enable their accurate and ready retrieval throughout the records retention period."

 

The VR Series paperless recorders use solid-state flash memory, for data storage, in the form of Compact Flash cards.  Data retention for this device is specified at a minimum of 10 years.  It provides Zero power data retention i.e. the data integrity is not dependent on battery back up.  The data is not affected by magnetic fields.  For longer term data storage the archive files can be copied to CDROM or to a network file server.

Return to Top

 


FDA CFR21 Part 11 Section 11.10 (d)

"Limiting system access to authorized individuals."

 

The VR Series paperless recorders provide the ability to limit access to the instruments configuration and critical operator functions.  For each user a unique id and password can be created for access to the configuration parameters.  The id and password can be alphanumeric and up to 8 characters in length.  In order to gain access to the configuration parameters, a valid operator ID and password combination have to be entered.  Any modification of the instruments configuration is recorded in the audit log identifying the user responsible for the change.  VR Series will logout automatically after a period of inactivity.

 

VR Series Security User Setup; up to 30 users per recorder

 

 

 

 Observer Software Security Setup

 

 

 

VR Series User Log in

 

 

 

Observer PC software User Log in

 

 

Return to Top

 


 

FDA CFR21 Part 11 Section 11.10 (e)

"Use of secure, computer-generated, time-stamped audit trails to independently recorder the date and time of operator actions that create, modify, or delete electronic records.  Record changes shall no obscure previously recorded information.  Such audit trail documentation shall be retained at least as long as that required for the subject electronic records and shall be available for agency review and copying."

 

The VR Series paperless recorders automatically produce a time stamped trail that includes power failure and recovery, configuration changes, data dumping and clearing, critical operator functions.  This information is stored in an audit log, which can be archived to a permanent file on Compact flash.  A separate alarm/event log automatically produces a time stamped record of all alarm state changes and can also be archived to a permanent file.

 

VR Series Event/Alarm display including Audit Trail

 

 

 

Observer PC Software Event/Alarm display including Audit Trail

 

 

Return to Top

 


FDA CFR21 Part 11 Section 11.10 (g)

"Use of authority check to ensure that only authorized individuals can use the system, electronically sign a record, access the operation or computer system input or output device, alter a record, or perform the operation at hand."

 

The recorders security system outlined in part d) limits access to the system to modify any configuration parameters.

 

Return to Top

 


FDA CFR21 Part 11 Section 11.10 (h)

"Use of device (e.g. terminal) checks to determine, as appropriate, the validity of the source of data input or operational instruction."

 

System errors and input channel status are logged.

Return to Top


FDA CFR21 Part 11 Section 11.10( i )

"Determination that the persons who develop, maintain, or use electronic record/electronic signature systems have the education, training, and experience to perform their assigned tasks."

 

Only Suitably qualified people are employed in product design & development and their training is updated to meet advances in technology.

Return to Top

 


FDA CFR21 Part 11 Section 11.10 (k)

"Use of appropriate controls over systems documentation including:

( 1 ) Adequate controls over the distribution of, access to, and use of documentation for system operation and maintenance.

( 2 ) Revision and change control procedures to maintain an audit trail that documents time-sequenced development and modification of systems documentation."

 

A design control system is used which is fully documented and traceable.  Documentation is provided for installation, configuration and operation in the instruments User Guide.

 

Return to Top

 


Summary

 

The VR Series, as a component, has NOT been validated to comply with FDA CFR-21 Part 11. Typically the complete process made up of numerous components, software & procedures are validated as a system, not as individual components. It is the end user’s responsibility to validate the VR Series and/or other components & processes in the system are in compliance with appropriate CFR-21 part 11 regulations.

 

1) All process data recorded by a VR Series Paperless Recorders is protected by an Encrypted "Digital Signature" to ensure the authenticity of these records.

 

2) Solid state flash memory is used to provide secure storage of data that is not reliant on battery backup which is not subject to magnetic fields.

 

3) Historical Viewer review software provides the ability to view the data records and audit trails in a human readable form.

 

4) User id and Password are provided in the recorders to limit access to authorized personnel.

 

5) A detailed audit log accompanies all process data recorded by a VR Series Paperless Recorder. All system events including configuration changers, power failures are logged. 

All entries are time and date stamped and include an operator id.

Return to Top


VR06-18 Guidelines 21CFR part 11.pdf

CFR21 Part 11 Final Ruling.pdf [226KB]

Join Our Mailing List
Email:

 

VR Series Product Brochures Manuals & Price Sheets

VR18_Brochure_v2.37_November-2011.pdf

VR18_Manual_V2.37_November-2011.pdf

 

VR06_Brochure_v2.37_November-2011.pdf

VR06_Manual_V2.37_November-2011.pdf

 

VR Series_NEMA_4_Brochure_Feb-2007.pdf

 

VR Series Price Sheet.pdf

 

Additional Information

VR06-18 Guidelines 21CFR part 11.pdf

VR06-18: Series FAQ's.pdf [40KB]

VR06-18: Series 2-Year Warranty Statement.pdf [13KB]

VR06-18: Firmware Update Sheet.pdf

VR06-18: CF Card Memory Calculations.zip

VR06-18: Reset to Factory Default 

VR06-18: Modbus Parameters 

UL Agency.pdf

CSA Agency.pdf

CE Conformity.pdf

 

Return To:

VR06-18: Recorder Home Page.htm

VR06-18: Sample Screen Display & Operational Review.htm

VR06-18: Plug & Play I/O.htm

VR06-18: Event & Alarm Description.htm

VR06-18: Installation: Panel or Bench Top Mounting.htm

VR06-18: Configuration.htm

VR06-18: Special Features: Math, Totalize, etc.htm

VR06-18: Observer Software Review.htm

VR06-18: Technical Support Documentation.htm

VR06-18: Download Firmware and Observer Software.htm

VR06-18: Security; CFR21 Part 11 Features.htm

 

Future Design Controls 888.751.5444 csr@futuredesigncontrols.com