ENG_cubeLMS_FDA 21 CFR Part 11 Self Check List

Regulation

Compliance

Persons who use closed systems to create, modify, maintain, or transmit electronic records shall employ procedures and controls designed to ensure the authenticity, integrity, and, when appropriate, the confidentiality of electronic records, and to ensure that the signer cannot readily repudiate the signed record as not genuine. Such procedures and controls shall include the following:

[11.10a] Validation of systems to ensure accuracy, reliability, consistent intended performance, and the ability to discern invalid or altered records.

The CRScube system is a Closed system, so once created, data files cannot be changed. The Audit Trail function includes data logger, and captures all system interactions, creating modification records.

System Validation(validation) ensures accuracy, reliability, consistent performance, and the ability to identify invalid or altered records.

1. The system validation procedure follows SOP 151 Software Development to develop the system and documents important activities such as requirements, design specifications, and test documents based on the design.

2. Validation of electronic records is performed.

   1. Input data validation function

      • Character, number, and date Type input data check

      • Field Check: Required data entry check

      • Edit Check: If values are outside the normal range, a Warning Message or confirmation action is performed

[11.10b] The ability to generate accurate and complete copies of records in both human readable and electronic form suitable for inspection, review, and copying by the agency. Persons should contact the agency if there are any questions regarding the ability of the agency to perform such review and copying of the electronic records.

Users configured according to Role & Privilege can review electronic records and create copies. Downloaded files are human-readable, complete, and accurate. As needed, they can be printed or copied to portable media (e.g., CD-ROM) and retained for later audit / inspection.

[11.10c] Protection of records to enable their accurate and ready retrieval throughout the records retention period.

Provides procedures for data protection.

• Confirmation and warning messages are displayed for Data changes

• Provides a function for entering the reason for Data modification (Editing Reason)

[11.10d] Limiting system access to authorized individuals.

Access to the system is limited to authorized individuals, and ID/PW is used.

• System access via ID/PW input

• After 5 failed Login attempts, the user is locked (Lock) → access is possible through password reset

• User system access is restricted by the configured Role & Privilege.

[11.10e] Use of secure, computer-generated, time-stamped audit trails to independently record the date and time of operator entries and actions that create, modify, or delete electronic records. Record changes shall not obscure previously recorded information. Such audit trail documentation shall be retained for a period at least as long as that required for the subject electronic records and shall be available for agency review and copying.

Changes that occur during operation in cubeLMS can be tracked through Audit Trail using system-generated time stamps, User ID, input values, and reasons for change.

The Data Audit Trail fields are organized as follows.

• No. : Row Number for Audit Trail

• Date/Time : Date & Time when Data was entered & modified

• User : User who entered & modified Data

• Value : Entered & modified Value

• Reason: reason entered by the User when Data is modified

1. Deletion of Data is not shown in the List, but Data is not actually deleted.

2. Audit Trail is displayed as read-only, and modification and deletion are not possible.

3. Audit Trail can be accessed at any time within the system for as long as Data is retained.

[11.10f] Use of operational system checks to enforce permitted sequencing of steps and events, as appropriate.

cubeLMS is a system that manages each individual's Training Record.

The user Flow is divided into administrator and general user paths, and administrators proceed through Lecture creation → modification → training content management.

General users proceed through the steps of checking registered lectures → taking the course → training content management.

[11.10g] Use of authority checks to ensure that only authorized individuals can use the system, electronically sign a record, access the operation or computer system input or output device, alter a record, or perform the operation at hand.

cubeLMS allows only authorized people to create an ID, and users can be identified. Registered users are restricted in their system use according to Role & Privilege.

• Access to Company can be queried and modified only when access permission is granted.

• If you have only view permission, modification and input functions are restricted.

• Lecture creation and modification permissions are controlled.

• Permissions for performing administrative activities (user management, system settings, etc.) are controlled.

[11.10h] Use of device (e.g., terminal) checks to determine, as appropriate, the validity of the source of data input or operational instruction.

Since cubeLMS does not use a separate device, this does not apply.

[11.10i] Determination that persons who develop, maintain, or use electronic record / electronic signature systems have the education, training, and experience to perform their assigned tasks.

Work-related training is conducted according to SOP 102 Personal Training, and the records of that training are documented as each person's training record.

Training is conducted for End User, and a User Manual is provided in the system.

[11.10j] The establishment of, and adherence to, written policies that hold individuals accountable and responsible for actions initiated under their electronic signatures, in order to deter record and signature falsification.

This is a process applicable to Sponsor and CRO organizations.

[11.10k] Use of appropriate controls over systems documentation including:

(1) Adequate controls over the distribution of, access to, and use of documentation for system operation and maintenance.

(2) Revision and change control procedures to maintain an audit trail that documents time-sequenced development and modification of systems documentation.

cubeLMS creates, manages, and distributes system-related documents according to the following SOP.

• Management of deliverable generation related to system development

  • SOP 151 Software Development

• Management procedures for document distribution, management, and access are provided

  • SOP 112 Document Control

  • SOP 121 System Manual

  • SOP 155 Change and Configuration Management

Regulation

Compliance

[11.30] Persons who use open systems to create, modify, maintain, or transmit electronic records shall employ procedures and controls designed to ensure the authenticity, integrity, and, as appropriate, the confidentiality of electronic records from the point of their creation to the point of their receipt. Such procedures and controls shall include those identified in 11.10, as appropriate and additional measures such as document encryption and use of appropriate digital signature standards to ensure, as necessary under the circumstances, record authenticity, integrity, and confidentiality.

cubeLMS is not applicable because it is a Closed System.

Regulation

Compliance

[11.50a] Signed electronic records shall contain information associated with the signing that clearly indicates all of the following:

(1) The printed name of the signer;

(2) The date and time when the signature was executed; and

(3) The meaning (such as review, approval, responsibility, or authorship) associated with the signature.

cubeLMS does not perform electronic signatures, so this is not applicable.

[11.50b] The items identified in paragraphs (a)(1), (a)(2), and (a)(3) of this section shall be subject to the same controls as for electronic records and shall be included as part of any human readable form of the electronic record (such as electronic display or printout).

cubeLMS does not perform electronic signatures, so this is not applicable.

Regulation

Compliance

[11.70] Electronic signatures and handwritten signatures executed to electronic records shall be linked to their respective electronic records to ensure that the signatures cannot be excised, copied, or otherwise transferred to falsify an electronic record by ordinary means.

cubeLMS does not perform electronic signatures, so this does not apply.

Regulation

Compliance

[11.100a] Each electronic signature shall be unique to one individual and shall not be reused by, or reassigned to, anyone else.

cubeLMS does not perform electronic signatures, so this does not apply.

[11.100b] Before an organization establishes, assigns, certifies, or otherwise sanctions an individual's electronic signature, or any element of such electronic signature, the organization shall verify the identity of the individual.

This process applies to Sponsor and CRO organizations.

[11.100c] Persons using electronic signatures shall, prior to or at the time of such use, certify to the agency that the electronic signatures in their system, used on or after August 20, 1997, are intended to be the legally binding equivalent of traditional handwritten signatures.

(1) The certification shall be submitted in paper form and signed with a traditional handwritten signature, to the Office of Regional Operations (HFC-100), 5600 Fishers Lane, Rockville, MD 20857.

(2) Persons using electronic signatures shall, upon agency request, provide additional certification or testimony that a specific electronic signature is the legally binding equivalent of the signer's handwritten signature.

This process applies to Sponsor and CRO organizations.

Regulation

Compliance

[11.200a] Electronic signatures that are not based upon biometrics shall:

(1) Employ at least two distinct identification components such as an identification code and password.

(i) When an individual executes a series of signings during a single, continuous period of controlled system access, the first signing shall be executed using all electronic signature components; subsequent signings shall be executed using at least one electronic signature component that is only executable by, and designed to be used only by, the individual.

(ii) When an individual executes one or more signings not performed during a single, continuous period of controlled system access, each signing shall be executed using all of the electronic signature components.

(2) Be used only by their genuine owners;

(3) Be administered and executed to ensure that attempted use of an individual's electronic signature by anyone other than its genuine owner requires collaboration of two or more individuals.

cubeLMS does not perform electronic signatures, so it is not applicable.

[11.200b] Electronic signatures based upon biometrics shall be designed to ensure that they cannot be used by anyone other than their genuine owners.

cubeLMS does not support biometrics.

Regulation

Compliance

Persons who use electronic signatures based upon use of identification codes in combination with passwords shall employ controls to ensure their security and integrity. Such controls shall include:

[11.300a] Maintaining the uniqueness of each combined identification code and password, such that no two individuals have the same combination of identification code and password.

cubeLMS ensures that the user ID / Password combination is always unique. Changing the user ID is not possible.

[11.300b] Ensuring that identification code and password issuances are periodically checked, recalled, or revised (e.g., to cover such events as password aging).

cubeLMS controls the login Password so that it is changed every 90 days.

[11.300c] Following loss management procedures to electronically deauthorize lost, stolen, missing, or otherwise potentially compromised tokens, cards, and other devices that bear or generate identification code or password information, and to issue temporary or permanent replacements using suitable, rigorous controls.

cubeLMS does not provide devices that generate ID or Password. If you forget your ID or Password, you can access the system after resetting your password through Find your ID and Reset Password.

[11.300d] Use of transaction safeguards to prevent unauthorized use of passwords and / or identification codes, and to detect and report in an immediate and urgent manner any attempts at their unauthorized use to the system security unit, and, as appropriate, to organizational management.

When system login fails, the remaining number of attempts is displayed, and after 5 failed login attempts, the user's account is placed in Lock status and access is controlled.

[11.300e] Initial and periodic testing of devices, such as tokens or cards, that bear or generate identification code or password information to ensure that they function properly and have not been altered in an unauthorized manner.

cubeLMS does not use devices such as tokens or cards.