Statement of 21 CFR Part 11 Validation Results

Transcription

1 Statement of Validation Results Software application: Session Manager DB (TurboTag ) Sealed Air Corporation Version: Status: Validated through version (Original validation completed on May 8, 2008) Validation via Installation / Operational / Performance Qualifications according to manufacturer s specifications and interpretations of applicable code of federal regulations ( Part 211 [ (b)] and [Subpart B]) Validation of software upgrades through version is in progress (as of Jan 13, 2009) Reference: See APPROVED (signed) Validation Summary Report: Session Manager DB Software Version Document No. TT-RPT-02, rev. 00, May 8, (available upon request to Sealed Air Corp.) Validation : CQE Services, LLC Validation Signature (CQE Services, LLC) Approval Signature (Sealed Air Corporation) Page 1 of 8

2 Electronic Records Verification ( ) The purpose of the Performance Qualification (PQ) for the Session Manager DB Software was to establish confidence that the software is capable of consistently performing according to established User Requirements 1 (Specifications), and meets applicable aspects of Part 11. This performance testing was performed for the integral Session Manager DB Software, TurboTag User Administrator Software, and the incorporated database. The Session Manager DB Software functions for storing, retrieving, and maintaining temperature records in a reliable and secure electronic format were included in the scope of this validation. This validation provides verification that such records in electronic format may be relied upon with a high degree of assurance for their content, accuracy, authenticity and integrity. The Session Manager DB Software, with integral database, is utilized for configuration of TurboTag T-700C Temperature Tags as well as downloading and storing the temperature data for the purpose of maintaining reliable supply chain temperature records that can be associated directly with products utilizing the RFID functions. This section verifies that the electronic records for temperature and User-entered data are compliant with regulatory requirements. The use of critical records in electronic data format are maintained under provisions of [Electronic Records] if the electronic format is used in place of paper format of the data records. Control of electronic data (temperature records and associated User-entered data) are achieved through a combination of procedural and technological (computer system) controls. This validation was executed with Session Manager DB Software as a Closed System. This validation was performed using a TurboTag Session Manager DB Software and User Administrator Software using an installation on a dedicated PC workstation. However, the system will enable data sharing if a network server is used for the database, and has been provided and configured appropriately. This mode of operation will not affect data security since 1 For this validation process, the User Requirements are the manufacturer s specifications and documented operational and performance per the TTS-01, TurboTag Session Manager DB Software and DR-1 Reader Setup and Operating Instructions, and TurboTag User Manager Software Setup and Operating Instructions. End users who purchase and use the TurboTag system are responsible for defining the requirements specific for their intended use of the system. Page 2 of 8

3 the database operates the same, only the Session Manager DB applications are installed on remote workstations 2. 2 This validation effort verifies the database functionality and security without network sharing. It is the responsibility of the End User to validate their installation of the Session Manager DB application as it is installed in their particular environment, including network sharing of the database, if applicable. Page 3 of 8

4 (Subpart B) Summary of Compliance Testing Session Manager DB 11.10(a) System Validated? Validated through version (a) Ability to discern invalid or section 6.7 Tag File Security altered records? section 6.8 Database Security 11.10(b) Ability to generate accurate section 5.13 Printing copies of records? section 6.10 Data Export (print & export) 11.10(c) Stored data is protected section 5.14 Data (data security)? Integrity/Accuracy/Unique Records section 6.8 Database Security 11.10(c) Data records are readily section 5.12 View Records from retrievable? Database section 6.6 Data Retrieval Consistency Page 4 of 8

5 11.10(d) System Access limited to Authorized individuals? Section 5.1 Application Security User/Password Requirements CFR Login Access Requirements Invalid Password Access Denied Account Locking Inactivity Auto-Logout Password Expiration User Privileges Section User Manager application security Section 6.1 User Manager Performance User Creation Administrator functions for User Lock/Unlock Administrator functions for User Active/InActive User ID Integrity Page 5 of 8

6 11.10(e) Is there a secure, computer generated, time stamped audit trail that records the date and time of operator entries and actions that create, modify, or delete records? Section 6.5 Audit Trail Verification Record creation and associated Tag events are logged in an audit trail (Configure, Start, Read). Non-Tag / User events associated with Tag records are logged (Login, Create Protocol, Change Protocol, Change Data configuration) When installed per manufacturer s instructions and appropriate Windows controls are applied, then the Session Manager DB database is inaccessible. In the event of intentional access and database tampering through unconventional methods, then the Session Manager DB recognizes that changes have occurred within the database. Records that have been tampered with inside of the database are flagged on the Session Manager DB VIEWER screen with Check-Sum Error! messages and a red indicator light. This indicates that the database associated with this (currently viewed) record may have been corrupted, modified, or tampered with directly within the database. Notes: This test was performed in a non-normal usage situation to verify that the Session Manager DB application will recognize altered database values in the unlikely event of intentional hacking or sabotage. Database values can not be altered from Session Manager (see validation test sections & 6.5.2) Page 6 of 8

7 11.10(e) Data record updates do not obscure the previously recorded information? Section The Tag recording episode is reliably stored into and retrieved from the database (via the Data Viewer function). The additional data points (since the first Read event in the previous test) are added to the original data with the same Tag ID/Session ID. The original data points are not overwritten or changed with the addition of new points (e) Is the audit trail stored and Section 6.5 Audit Trail Verification retrievable throughout the records retention period? 11.10(f) System checks for proper Section 5.4 Data Entry sequencing of steps and events? Section 5.5 Event Log Data entry (includes testing of User entry fields that have been set as required ) Section 5.6 Software State verification Section 5.9 Tag Configuration, Starting, and Reading 11.10(g) System ensures that only Section 5.1 Application Security authorized individuals can use the system? (security) 11.10(h) Use of device checks to Section 5.6 Software State verification verify the validity. Section 5.8 UHF/ECP detection & operation Section 5.9 Tag Configuration, Start, Reading (with the DR-1) Section 6.4 Download from QC-1 Handheld Reader (Infrared Import) Page 7 of 8

8 11.10(i) N/A N/A 11.10(j) N/A N/A 11.10(k) N/A N/A Procedural (not a Technological control) Procedural (not a Technological control) Procedural (not a Technological control) Controls For Open System N/A Electronic Signature Manifestations N/A Subpart C is not applicable to Session Manager DB Session Manager DB is validated as a Closed System. Intentional signatures, such as for review and / or approval of records which would be representative of hand written signatures - is not part of Session Manager DB. However, digital signatures are used to log certain User events into the audit trail. This is part of the User login requirements, where the User s login and operations while logged in are recorded in the audit trail. (Verified in section 6.5 Audit Trail Verification) Page 8 of 8