FDA 21 CFR Part 11 Part11.30: Controls for open systems (21 CFR §11.30)

Section 11.30 establishes the controls for OPEN SYSTEMS. Persons who use open systems to create + modify + maintain + transmit electronic records must employ procedures + controls designed to ensure the authenticity + integrity + as appropriate the confidentiality of electronic records from the point of their creation to the point of their receipt. Such procedures + controls must include those identified in §11.10 (closed system controls) AS APPROPRIATE + ADDITIONAL MEASURES such as: (a) DOCUMENT ENCRYPTION + (b) USE OF APPROPRIATE DIGITAL SIGNATURE STANDARDS to ensure record authenticity + integrity + confidentiality. Open systems are those where access is not controlled by the persons responsible for the content of electronic records on the system - typically systems where multiple organisations or external parties have access (e.g. cloud-hosted multi-tenant systems + EDC platforms shared across CROs + clinical sites + sponsors + external sites + IoT-connected medical devices transmitting data to external repositories). The §11.30 additional measures (encryption + digital signatures) are intended to maintain trustworthiness when the §11.10 closed-system controls are insufficient.