General Requirements – 11​.100

Signature Uniqueness - 11.100 (a)

21 CFR Part 11:

“(a) Each electronic signature shall be unique to one individual and shall not be reused by, or reassigned to, anyone else.”

FDA-audited industries should use the OS User Based or OS Group Based Security model for best results. Both OS Security models use Windows operating system authentication. This permits user name and password management, outside AVEVA Batch Management, directly in the Windows operating system environment. By using OS Security you benefit from the standard Windows functions for password aging, logon maximum trial, user name uniqueness and more.

It is not recommended to use local OS Groups as Roles, as that requires each node within a Batch environment to have the same OS Users, Groups, and user-group mappings to get the same level of access to the user at each node. Defining users on individual nodes creates a possibility of the same user name being assigned to different users. For example, if user name jdoe was used on a node for John Doe and jdoe was used on a different node for Jane Doe, within the same system, records would not be able to distinguish between the users. Managing users in a single location and authenticating by connecting to that location eliminates the potential for multiple users having the same user name, which in turn ensures signature uniqueness.

Once an individual leaves a company, the user shall not be removed from the system but rather disabled so that the user name remains unique in the system.

Situations where a workflow is stopped because a single user who can perform an action is not available should be avoided if possible because of the risk that a userid and password is divulgated to allow the process to continue. Each secured function role/user assignment should be reviewed with the human organization in mind. AVEVA Batch Management Security Editor provides a mapping of functions vs roles that can be used for this analysis (Print àApplications and Functions). An example printout is depicted in Figure 34.

Figure 34 - Application Functions vs roles printout