FDA 21 CFR Part 11 Compliance

[mstoakes]

I'm interested in deploying Alfresco in an FDA regulated environment, and the current release seems to be 21 CFR Part 11 complaint except for one feature. Alfresco doesn't have a digital signature capability. Does anyone know of a third party module that allows Alfresco to meet the Part 11 requirement for digital signatures?

If the Alfresco folks added this capability, there could be tremendous revenue from the pharmaceutical industry in the form of validation services, training, and support. This is a curious gap in the feature set especially since one of the founders and developer come from Documentum, which has a strong presence in the pharma space.

Give me Part 11 compliance or give me death! (apologies to Patrick Henry)

[kurtkbee]

So i guess i am not the only one asking about this,
see thread:
http://forums.alfresco.com/viewtopic.php?t=5935&highlight=

however it seems that there is a lack of "proper" support for digital signatures, however there is a basic way to achieve electronic signatures

based on what i was told by one of the developers …..:

“As I understand it, the digital signature case is essentially as Paul described it.  They would like to have an in-flight workflow with a property sheet that would let approvers “sign their approval” to a document.  This signature would then be retained as part of the lifecycle history of that document.

The actual signature itself would feature a re-authentication of sorts.  In my head, it would be a “sign” button within the workflow property sheet.  Clicking it would reveal a password box.  They’d fill in the box and click “attach my signature” at which point we could probably Ajax the auth call.  If successfully, their signature would be attached to the workflow or also to one or more payload objects"

but i am concerned that it does not really satisfy the requirement (see my thread and link to 21cfrpart11.com).

Slightly off-topic, another thing i would like is watermark generation and embedding during PDF conversion/creation.

[mstoakes]

I think that the digital signature signing the way you describe it would meet the Part 11 rule. The watermarking of PDFs is important, because of the requirement for document/signature binding.

The way public key encryption currently works requires that the official document must always live on the server along with the signature. If you download the official document to say a USB drive and take it home with you, there would be no way to offline verify the signature. One could make changes to the document and no one would be the wiser. If the document is watermarked as a copy of the official document, then an offline file or a printout would always indicate it is a copy.

Unless Microsoft provides a better way to lockdown Word documents, a PDF is the best alternative for a file format for official documents.