topic Re: FDA 21 CFR Part 11 Compliance in Alfresco Archive

FDA 21 CFR Part 11 Compliance

mstoakes — Thu, 17 May 2007 01:24:45 GMT

I'm interested in deploying Alfresco in an FDA regulated environment, and the current release seems to be 21 CFR Part 11 complaint except for one feature. Alfresco doesn't have a digital signature capability. Does anyone know of a third party module that allows Alfresco to meet the Part 11 requireme

Re: FDA 21 CFR Part 11 Compliance

kurtkbee — Thu, 17 May 2007 16:06:44 GMT

So i guess i am not the only one asking about this,
see thread:
http://forums.alfresco.com/viewtopic.php?t=5935&highlight=

however it seems that there is a lack of "proper" support for digital signatures, however there is a basic way to achieve electronic signatures

based on what i was told by one of the developers …..:

â€œAs I understand it, the digital signature case is essentially as Paul described it. They would like to have an in-flight workflow with a property sheet that would let approvers â€œsign their approvalâ€ to a document. This signature would then be retained as part of the lifecycle history of that document.

The actual signature itself would feature a re-authentication of sorts. In my head, it would be a â€œsignâ€ button within the workflow property sheet. Clicking it would reveal a password box. Theyâ€™d fill in the box and click â€œattach my signatureâ€ at which point we could probably Ajax the auth call. If successfully, their signature would be attached to the workflow or also to one or more payload objects"

but i am concerned that it does not really satisfy the requirement (see my thread and link to 21cfrpart11.com).

Slightly off-topic, another thing i would like is watermark generation and embedding during PDF conversion/creation.

Re: FDA 21 CFR Part 11 Compliance

mstoakes — Thu, 17 May 2007 16:35:35 GMT

I think that the digital signature signing the way you describe it would meet the Part 11 rule. The watermarking of PDFs is important, because of the requirement for document/signature binding.

The way public key encryption currently works requires that the official document must always live on the server along with the signature. If you download the official document to say a USB drive and take it home with you, there would be no way to offline verify the signature. One could make changes to the document and no one would be the wiser. If the document is watermarked as a copy of the official document, then an offline file or a printout would always indicate it is a copy.

Unless Microsoft provides a better way to lockdown Word documents, a PDF is the best alternative for a file format for official documents.