FDA 21 CFR Part 11 Part11.200: Electronic signature components and controls (21 CFR §11.200)

Section 11.200 establishes electronic signature components + controls: (a) ELECTRONIC SIGNATURES THAT ARE NOT BASED UPON BIOMETRICS must: (1) EMPLOY AT LEAST TWO DISTINCT IDENTIFICATION COMPONENTS such as an identification code + password (the FDA's two-factor electronic signature requirement); (i) when an individual executes a series of signings during a single + continuous period of controlled system access + the first signing must be executed using all electronic signature components + subsequent signings must be executed using at least one electronic signature component that is only executable by + and designed to be used only by the individual; (ii) when an individual executes one or more signings not performed during a single + continuous period of controlled system access + each signing must be executed using all of the electronic signature components. (2) be used only by their genuine owners; (3) be administered + executed to ensure that attempted use of an individual's electronic signature by anyone other than its genuine owner requires collaboration of two or more individuals. (b) ELECTRONIC SIGNATURES BASED UPON BIOMETRICS must be designed to ensure that they cannot be used by anyone other than their genuine owners.