Digital Signature - 21 CFR part 11 compliance

[Bert Peeters]

Hi All,
I'm also curious to know the difference between Adobe Sign and the free option in Adobe Reader to apply digital ID (certificates) in the light of 21 CFR part 11 compliance. Does the latter option allow for 21 cfr part 11 compliance? I'm really struggling with this. Most of the information I find linked to this is for AdobeSign.
Many thanks in advance,
Bert

[ls_rbls]

Hi,

You need to download and read this document : https://helpx.adobe.com/sign/kb/Is-Adobe-Sign-21-CFR-Part-11-Compliant.html

See also other information here: https://www.adobe.com/content/dam/acom/en/security/pdfs/adobe-sign-compliance-21CFRpt11-wp-ue.pdf

https://www.techrepublic.com/article/adobe-makes-e-signature-tool-healthcare-compliant-adds-sap-inte...

[Bert Peeters]

Thanks a lot! I've found most of these references as well. My main question is: Adobe Reader also has a standard option (for free) to certify documents with a digital signature. However, does this offer to same features and level of compliance then AdobeSign, i.e. is there any added value to subscribe and pay for AdobeSign. We're working in a regulated environment so compliance is key.
Many thanks,
Bert

[ls_rbls]

Hi,

Adobe Reader meets the same criteria.

As a matter of fact, When compared with Adobe Acrobat Pro, its does provide the users with a more restrictive and tighter security.

[svulinec]

Hi, I have been struggling with this as well. 

is there evidence to be found on the FDA regs that states AdobePro and/or Reader to be 21 CFR Part 11 compliant? I have seen the above links, but looks like it just refers to Adobe Sign.

Thanks,

[ls_rbls · Accepted solution]

Well, that is because Adobe Sign is the engine that enforces the security mechanisms and standards of E-sign when electronic signatures are applied in such workflow.

This is different from just sending a document or downloading government forms, in which individuals just apply any type of electronic signature.

When you create a form, you'll notice that when you click on the Fill &Sign tool it will switch and interface with Adobe Sign before you send this form out to collect electronic signature from your intended recipients.

But, Please define what you meant by FDA. 

Are we talking about the Food and Drug Administration or something else?

If this has to do with a government agency and gow they use their and distribute their own PDFs forms you'll have to do your own homework there because that doesn't necessarily mean these PDFs were created with Adobe products.

In the meanwhile, I am going to find an old thread where I answered this question for another user.

I posted there the references that you're inquiring about that deals with the Adobe Acrobat side of the house

[svulinec]

Thanks so much for the communication back and the information. Yes, i am looking into some of the Food and Drug Administrations approved electronic signatures they allow for institutions to be compliant with them.

I know AdobeSign the application is compliant. I am avoiding the E Sign Application, because once you sign, it locks the docuemnt and i cannot edit it after the signature goes in place. I was trying to research and decipher if when creating an Adobe document, using the "prepare" field and adding a "digital Signature" for a user, if that would also be compliant in their regulations, but couldn't seem to find the language. But now, I see that I may need to research "e-signature" vs. "digital signature" as I have seen other threads that they may not be the same thing. I guess it just takes some digging. Thanks again for the reply, you were very helpful!

[ls_rbls]

Here you go,

The self-signed digital certificates and/or  employing the use of common access card readers is the way to go definitely.

Is hard to beat SHA encryption and decryption, specially when it is used in combination with reputable and trusted root certificate issuing authorities.

This workflow definitely cuts out the unnecessary middlemen, and it also allows you  to have mechanisms ready that validate digital signatures and to protect the integrity of such documents. 

This was my prior thread to another user with a similar concern as his organization was about to do business with another company in Europe: https://community.adobe.com/t5/acrobat/how-to-see-the-certificate-validity-in-document-signed-with-d...

To be thorough evaluate this document on ISO 27001 and 27002 from the FDA's 

"COLLABORATIVE APPROACHES FOR MEDICAL DEVICE AND HEALTHCARE CVBERSECURITY"  : 

• https://www.fda.gov/media/89789/download

AND THEN  --->>>  If your inquiry is related to the manufacturing and deployment of medical devices during this pandemic, the FDA has the following document: What-is-the-relationship-between-FDA’s-Quality-System-Regulation-for-Devices--Part-820-and-ISO-9001--2000 

This has nothing to do with Adobe but it is worth looking into with every other ISO related things that are evolving during the new world order transition and as we type in here .

In that document, look into the FDA's Quality System Regulation Part 820 as they claim that it doesn't harmonize with other ISO standards such as ISO 9001. Is constantly under revision because it involves how other countries employ their own quality management standards.

You can get it from their website:

• https://www.fda.gov/media/75903/download

+++ Below is a list of resources on the Adobe side of the house:

Adobe Current list of Certifications:

• https://www.adobe.com/content/dam/cc/en/security/pdfs/MasterComplianceList.pdf

Adobe Experience Cloud discussion on ISO 27001:2013 certification:

• https://experienceleaguecommunities.adobe.com/t5/adobe-experience-cloud-questions/iso-27001-2013-cer...
  
  

Adobe Industry Standards and Regulations

• https://www.adobe.com/security/compliance.html

Adobe Common Control Framework (which is open source)

• https://blogs.adobe.com/security/2018/10/introducing-the-adobe-common-controls-framework-ccf-version...

+++ Additional informational Resources:

• https://asq.org/quality-resources/iso-9001

ASQ/ANSI/ISO 9001:2015: Quality Management Systems - Requirements (E-Standard)

• https://asq.org/quality-press/display-item?item=T1040E

International Organization for Standardization

• https://www.iso.org/isoiec-27001-information-security.html

[Skye29625825cy2k]

Hi Bert,

Did you find a solution for this question? I am also wondering the same.

[saskiab52245447]

Hi Bert, Skye,

Did either of you figure this out? I am also wondering if we are able to use the free version Adobe reader version for part 11 compliance. Thank you. 

[Skye29625825cy2k · Accepted solution]

from my understanding, i tis not part 11 compliant unless the system is validated as such. we went with the 21 cfr part 11 adobe sign e-signatures and validated the system for 21 cfr part 11 compliance.

[ls_rbls]

@Skye29625825cy2k ,

Thank you for updating the thread!