A username and a password: what a 21 CFR Part 11 signature actually proves
Every drug batch released in the United States rests on an electronic signature. Under 21 CFR §11.200, that signature may lawfully consist of two components: an identification code and a password. A password is a bearer secret. It can be shared, watched, phished and typed by someone else — and after the fact, nobody can tell.
What does a 21 CFR Part 11 signature actually prove?
Less than most people assume. Part 11 permits a non-biometric electronic signature to consist of an identification code and a password. That construct sits under batch release across the industry, and it establishes that someone knew two secrets — not that a named person read what they signed.
- Compliance and evidentiary strength are different properties. A Part 11-compliant signature can be entirely compliant and still unable to demonstrate who signed.
- The gap exists because §11.200(a)(1) was written before hardware authenticators, not because anyone implemented it badly.
- The Evidentiary Ladder has five rungs. Most GxP systems sit on rung one or two, and moving to rung four costs a gesture, not a re-validation.
Part of Pharma and GxP identity
Start with what the rule says, exactly
21 CFR §11.200(a)(1) provides that electronic signatures not based upon biometrics shall employ at least two distinct identification components, such as an identification code and password. The rule goes on to require that signings during a continuous session use both components for the first signing and at least one for subsequent signings, and that signings not in a continuous session use both.
§11.100 requires that each electronic signature be unique to one individual and not reused. §11.10(d) requires limiting system access to authorised individuals. §11.50 requires that signed records contain the printed name of the signer, the date and time, and the meaning of the signature.
All of that is sound. None of it requires that the signature be produced by something the signer physically possesses, and none of it requires that the signature cryptographically cover the content being signed.
Think of it like a hotel key card
Here is the useful analogy. A password is like telling someone the code to a keypad. You can be careful with it, you can change it often, and the door will still open for anyone who knows it. A hardware credential is like a key card that stays in your pocket: you can lend it, but you cannot copy it by describing it, and while it is in your pocket nobody else can open the door.
When an FDA investigator finds shared logins on a manufacturing floor, the finding is usually written up as a training or procedural failure. It is more accurate to say it is the predictable behaviour of a system built on a shareable secret, in an environment with gloves, gowns, shift changes and a terminal on the wall.
The GxP Signature Evidentiary Ladder
Five rungs. Each adds one property. You can locate your own MES, eQMS and LIMS on this ladder in an afternoon.
| Rung | What the signature is | What it proves to a hostile third party | Part 11 status |
|---|---|---|---|
| 1 | Username and password, session-based | That someone who knew a secret used a terminal | Compliant |
| 2 | Username and password, re-entered per signing | The same, at a specific moment | Compliant |
| 3 | Possession factor added — token or device | Something the signer holds was present | Compliant |
| 4 | Hardware credential with user verification, signing a canonical statement of the record | A specific human confirmed this exact content | Compliant |
| 5 | Rung 4 plus offline third-party verification against a published key | The above, checkable without trusting the manufacturer's systems | Compliant |
Note the right-hand column. Every rung is compliant. The ladder measures something the regulation does not: how much of your assurance rests on your own organisation being trustworthy.
Where the ladder matters most
Not everywhere. The signatures that deserve rung four are the ones whose reversal is expensive or impossible:
- Batch release and disposition decisions.
- Invalidation of an out-of-specification laboratory result.
- Deviation closure and CAPA effectiveness sign-off.
- Approval of a master batch record or a method change.
- Any signature that a Qualified Person will later rely on for certification.
Training completion records and routine logbook entries do not need this, and gating them would waste the control's credibility.
What changes in the validated system
Less than validation teams fear. The signature manifest required by §11.50 still appears in the record. The audit trail required by §11.10(e) is unchanged. What is added is a signed object, produced by the signer's credential, covering a canonical representation of the record content.
Canonicalisation matters and is worth one sentence of explanation: the same logical content must always produce the same bytes before hashing, otherwise two systems will disagree about whether a record matches. We use RFC 8785, the JSON Canonicalization Scheme, and maintain a differential test suite because two implementations of a canonicaliser that disagree on a single edge case will produce an unverifiable signature at exactly the wrong moment.
What the EU is doing in parallel
EU GMP Annex 11 is under revision, and a new annex addressing artificial intelligence brings model-assisted GMP decisions into the validated-system perimeter. Both make the same question more pressing: if a human oversight step is required, what artefact demonstrates that it happened? The answer cannot be a database row written by the system under review.
A conformance checklist you can run
- For each GxP system, identify the top five signature meanings by consequence.
- For each, determine whether the signature covers a canonical representation of the content or only records a decision against an identifier.
- Determine whether the credential is a knowledge factor, a possession factor, or both.
- Determine whether an external party could verify the signature without access to your system.
- Place each on the ladder. Bring the result to your data governance forum as an architecture question.
None of this requires an inspection finding to justify. It requires someone to ask what your signatures prove, which — in twenty-five years of Part 11 literature — is a question almost nobody has written down.
The ladder, rung by rung
| Rung | Establishes | Fails against |
|---|---|---|
| ID and password | Someone knew two secrets | Sharing, which happens for practical reasons |
| Unique account, no sharing | An account acted | An operator who lent credentials |
| Possession factor | A person acted | Nothing at this level |
| Record binding | What they signed | Later alteration |
| Third-party verification | An inspector can test it | Nothing |
Objections and honest limits
“We are Part 11 compliant, so we are fine.” Compliant and evidential are different standards. Part 11 sets a floor written in 1997; what an inspector or a court asks is what the signature demonstrates.
“Credential sharing does not happen here.” It happens everywhere there is a gowned operator, a shared terminal and a time-critical step. Designing as though it does not is how the first rung stays the top rung.
Climbing the ladder
- Audit for shared credentials on signing terminals. Start with the ones inside classified areas.
- Add a possession factor. Something the signer holds, not something they can tell a colleague.
- Bind the record digest into the signature. So alteration is detectable rather than logged elsewhere.
- Make it verifiable without the system. Records outlive the manufacturing execution system.
Terms used here
- Non-biometric signature
- Under Part 11, a signature composed of at least two identification components such as an ID and a password.
- Sole control
- The requirement that only the named individual can produce their signature — which knowledge-based factors cannot satisfy.
- Record binding
- Including a digest of the signed record inside the signature, so later alteration is detectable.
Frequently asked questions
Has FDA said password-based signatures are insufficient? No, and this article does not claim otherwise. §11.200 explicitly permits an identification code and password. The distinction drawn here is between regulatory sufficiency and evidentiary strength, which are different properties.
Would moving to hardware credentials require revalidation? Scope depends on your system. In most architectures the signing component is a defined interface, and the change is to what produces the signature rather than to the record structure. Treat it as a change control with a risk assessment, not a rebuild.
Does this apply to EU Annex 11 as well? The same analysis applies. Annex 11 addresses electronic signatures and is under revision, and current expectations already press against shared accounts in GMP systems.
What is the smallest useful step? Place your five highest-consequence signature meanings on the ladder. The exercise takes an afternoon and produces a finding you can act on regardless of whether you adopt anything.
Is an ID and password Part 11 compliant? Yes, for a non-biometric signature. Compliant is a floor; it establishes knowledge of two secrets rather than a named person's act.
What is the highest-value rung to add? A possession factor. Knowledge is shareable, and on a shop floor it is shared for practical reasons.
Why does third-party verifiability matter? Because GxP records outlive the systems that hold them, and an inspector should not need your MES to test a signature.
Where this fits in Manav
Manav binds the signer to the exact record being certified, on a credential under their sole control, and produces a receipt an inspector can verify years later without access to the manufacturing system.
Sources and further reading
- 21 CFR Part 11 — Electronic Records; Electronic Signatures
- FDA guidance, Data Integrity and Compliance With Drug CGMP: Questions and Answers.
- EudraLex Volume 4 — EU GMP guidelines
- RFC 8785 — JSON Canonicalization Scheme
- W3C Web Authentication Level 2