U.S. FDA Title 21 CFR Part 11 Compliance Assessment of SAP Collaboration Folders (cfolders)

Transcription

1 U.S. FDA Title 21 CFR Part 11 Compliance Assessment of SAP Collaboration Folders (cfolders) Disclaimer These materials are subject to change without notice. SAP AG s compliance analysis with respect to SAP software performance based on 21 CFR Part 11: (i) in no way expresses the recognition, consent, or certification of SAP software by the United States Food and Drug Administration; and (ii) applies to certain components of SAP Collaboration Folders (cfolders) only as stated herein. The customer is solely responsible for compliance with all applicable regulations, and SAP AG and its affiliated companies ( SAP Group ) have no liability or responsibility in this regard. These materials are provided by SAP Group for informational purposes only, without representation or warranty of any kind, and SAP Group shall not be liable for errors or omissions with respect to the materials. The only warranties for SAP Group products and services are those that are set forth in the express warranty statements accompanying such products and services, if any. Nothing herein should be construed as constituting an additional warranty. Seite 1 von 8

2 Content 1 Summary CFR Part 11 Assessment Collaboration Folders (cfolders) Security E-Records FDA Requirement History, Authorizations, Status Management and Versioning Digital Signature Compliance of cfolders with 21 CFR Part References... 8 page 2/8

3 1 Summary Based upon SAP AG s interpretation of the Part 11 rule and the functions and features discussed within this document SAP AG believes that the SAP Collaboration Folder (cfolders) application fully complies with 21 CFR Part 11. page 3/8

4 2 21 CFR Part 11 Assessment 2.1 Collaboration Folders (cfolders) cfolders is an Internet-based collaboration application within SAP PLM. This collaboration platform enables to collaborate with external business partners in virtual teams in order to optimize cross-enterprise processes. It allows you to efficiently share and exchange structured and unstructured information, such as data sheets and all kinds of documents, with internal team members, external partners, and suppliers. Collaborative and competitive scenarios are possible. Following investigation was done for cfolders 3.00, 3.10 and Security cfolders 4.0 is delivered together with cprojects as Add-on cproject Suite (component CPROCJECTS) and can be installed on a SAP NetWeaver Application Server without any other components. The cfolders 3.1 system is built on Web Application Server 6.20 and cfolders 3.0 on SAP R/3 Enterprise basis components. Therefore all Security features of SAP NetWeaver Application Server or Web Application Server 6.20 or SAP R/3 Enterprise basis components are valid for cfolders: They fulfil the 21 CFR Part 11 security requirements. In chapter 2.5 the statements for SAP NetWeaver Application Server are valid also for Web Application Server 6.0 and SAP R/3 Enterprise basis components. 2.3 E-Records FDA Requirement FDA requires the ability to log and track changes on Business Objects and dependent objects in a compliant software environment. The computer system must provide functionality to log changes, creation and deletion applied to Business Objects and to depending objects (e.g. configuration data). The minimal necessary information the system has to provide is: Old Value of an attribute of the changed Business Object New Value of this attribute Person who changed the value Date and time of change Action (create, modify, delete) History, Authorizations, Status Management and Versioning You can display the history of all folders and the objects they contain, including subfolders and generic objects and also the history of user groups, by choosing History from the menu on the screen for the relevant object. page 4/8

5 The history gives you an overview of everything that has happened to a folder, folder object, or a user group (including granting authorizations), when it happened, and who carried out each activity. For date and time of change the application server time is used. If a folder contains other objects, for example, a document, you can branch directly from the folder history to the history of that object. You can also display the history of deleted folders or folder objects. The cfolders system monitors these changes in the background. Users cannot add any comments on these changes. Prerequisite is that you have administration authorization for the object whose history you want to display. In cfolders authorizations are controlled via ABAP authorization objects and roles. This is the standard method for controlling access to transactions and programs in an SAP ABAP system. Authorizations are combined in an authorization profile that is associated with a role. User administrators can then assign the corresponding roles via the user master record, so that the user can access the appropriate transactions for his or her tasks. Access control lists (ACLs) in cfolders are used to define authorizations at object level. Objects in cfolders are: collaborations, areas, folders, documents, status profiles, and user groups. There are six authorization activities: read, write, create, administration, delete, and none. It is also possible to create authorizations that depend on the status of an object. Authorization can be granted to users, user groups, and roles. In cfolders, you can use the Status Management function to control and monitor workflows. Versions are not just changes made to a folder object, for example, to a document or note. A version is a snapshot of the contents of folder objects at a particular point in time. You can also change the contents of a folder object without creating a new version, unless this version is protected: Objects in cfolders that have a status may have the Version Protected indicator set can be edited; when you save any changes that you make, however, the system creates a new version of the object. The original version cannot be changed. If the object is a document, the system creates a new version when you save your changes or when you check in the document. 2.4 Digital Signature In case digital signature is needed within cfolders the Encapsulated Signature Tool in SAP NetWeaver Application Server can be implemented on a project basis. Here are some of the particulars: The software must consist entirely of coding from the ABAP programming language which is the case for SAP cfolders as a prerequisite for using the encapsulated signature tool. The prerequisite does not apply to user interfaces; the tool can also be utilized with user interfaces programmed in a language other than ABAP, such as JAVA. In this case, security and authentication issues have to be considered carefully to avoid security gaps. You must have SAP NetWeaver Application Server 6.20 or higher to use the encapsulated signature tool. For further information refer to the implementation guide titled Digital Signature-Tool (SAP note ) application basis is necessary for cfolders 3.00 and NW 2004 can be used also for cfolders NW 2004s is needed for cfolders page 5/8

6 2.5 Compliance of cfolders with 21 CFR Part 11 The following table summarizes how cfolders comply with each requirement of 21 CFR Part 11. Part 11 Clause 11.10(a) 11.10(b) (c) 11.10(d) 11.10(e) 11.10(f) 11.10(g) 11.10(h) 11.10(i) SAP Assessment of cfolders All electronic records within SAP cfolders provide adequate audit trails that can be reviewed for information. These records are secured from unauthorized access. All electronic records generated in cfolders are accurate, complete, and presented in a human readable format. Electronic records in cfolders can be printed or exported. All electronic records can be maintained in the active database to accommodate all required retention periods even when software is upgraded. Access to these records is secured by authorization profiles. Robust security administration and authorization profiles assure system access. Changes to security profiles are recorded in SAP NetWeaver Application Server. ACLs are available; they are part of the ABA layer. cfolders history ensure a complete audit trail: Electronic records are generated for creating, modifying, or deleting data. These records are date and time stamped and include the user ID of the individual who is logged on the system and performed the action, maintain the old and new values of the change and the transaction used to generate the record. You can control the processing statuses of documents using status and workflow management and so enforce the proper sequence of operations as required by the applicable regulation: You can define several statuses that represent important processing statuses a processing cycle of a document. The processing cycle of a document can be represented in a status network. You construct this network by creating a relationship between the statuses for a document type (predecessor/successor relationship). In each processing situation, the system determines the possible subsequent statuses of the current status. You can display and select these statuses using the possible entries function. SAP NetWeaver Application Server and ACLs (ABA layer) execute authority checks in conjunction with robust security administration and authorization profiles to ensure only authorized individuals can access the system, electronically sign a record, and access or perform the operation at hand. SAP NetWeaver Application Server also records changes to authorization profiles. N/A The Product Innovation Lifecycle (PIL) for SAP development requires that all personnel responsible for developing and maintaining SAP products have the education, training, and experience to perform their assigned tasks. A wide range of additional education and training offerings and regular assessments of individual training requirements ensure a process of continuous learning for SAP staff involved in the development and support of all SAP software. page 6/8

7 Part 11 Clause 11.10(j) 11.10(k) (a) 11.50(b) (a) (b) (c) (a)(1) (a)(2) (a)(3) (b) (a) (b) (c) SAP Assessment of cfolders SAP ERP maintains the electronic records (audit trail) for revision and change control according to clause 11.10(e). For open systems, SAP NetWeaver Application Server supports interfaces with complementary software partners that supply cryptographic methods such as public key infrastructure (PKI) technology. The Encapsulated Signature Tool can be implemented to satisfy these requirements. The Encapsulated Signature Tool can be implemented to satisfy these requirements. The Encapsulated Signature Tool can be implemented to satisfy these requirements. The Encapsulated Signature Tool can be implemented to satisfy these requirements. SAP NetWeaver Application Server requires two distinct components a user ID and a password to perform each and every electronic signature. By design, SAP NetWeaver Application Server does not support continuous sessions where only a single component is necessary subsequent to the first signing. related to the functions or capabilities of the COMPUTER system. SAP NetWeaver Application Server user and security administration functions ensure that the attempted use of an individual s electronic signature other than the genuine owner requires the collaboration of two or more individuals. SAP NetWeaver Application Server provides a certified interface to biometric devices such as fingerprint and retinal scanning devices. Look for certified vendors in the SAP Complementary Software Program. SAP NetWeaver Application Server user and security administration functions provide the necessary controls to ensure that no two individuals have the same combination of identification code (user ID) and password. SAP NetWeaver Application Server can be configured to force users to change passwords at various intervals and it provides system checks to prevent users from repeating passwords or using combinations of alphanumeric characters that are included in the user ID. User ID s can also be invalidated, for example, when an employee leaves the company. page 7/8

8 Part 11 Clause (d) (e) SAP Assessment of cfolders SAP NetWeaver Application Server fulfills this requirement and behaves as demanded by the requirement. 3 References help.sap.com: SAP NetWeaver 04 Security Guide help.sap.com: SAP NetWeaver 2004s Security Guide help.sap.com: SAP Web Application Server Security Guide for ABAP Technology SAP White Paper: 21 CFR Part 11 Compliance Assessment of SAP NetWeaver 04 / 2004s Application Server help.sap.com: SAP Project and Portfolio Management Security Guide help.sap.com: P library: SAP Project and Portfolio Management, Design Collaboration with cfolders SAP White Paper: Complying with U.S. FDA Title 21 CFR Part 11 for the Life Sciences Industry SAP White Paper: SAP NetWeaver Providing the Building Blocks for Effective Governance, Risk, and Compliance Management Digital Signatures in SAP Applications SAP Best Practices Implementation guide entitled Digital Signature-Tool (attached in note ) FDA Title 21 CFR Part 11 Electronic Records; Electronic Signatures: Final Rule, March 1997 Authors: Dr. Anja Modler-Spreitzer and Dr. Christoph Roller, IBU Consumer Products & Life Sciences, SAP AG page 8/8