§ 11.300 Controls for identification codes/passwords.
Persons who use electronic signatures based upon use of identification codes in combination with passwords shall employ controls to ensure their security and integrity. Such controls shall include:
(a) Maintaining the uniqueness of each combined identification code and password, such that no two individuals have the same combination of identification code and password.
(b) Ensuring that identification code and password issuances are periodically checked, recalled, or revised (e.g., to cover such events as password aging).
(c) Following loss management procedures to electronically deauthorize lost, stolen, missing, or otherwise potentially compromised tokens, cards, and other devices that bear or generate identification code or password information, and to issue temporary or permanent replacements using suitable, rigorous controls.
(d) Use of transaction safeguards to prevent unauthorized use of passwords and/or identification codes, and to detect and report in an immediate and urgent manner any attempts at their unauthorized use to the system security unit, and, as appropriate, to organizational management.
(e) Initial and periodic testing of devices, such as tokens or cards, that bear or generate identification code or password information to ensure that they function properly and have not been altered in an unauthorized manner.
How BatchGlow handles this
The signing secret is read only by the signing step itself, never as an argument of any other action, and it is kept out of error reports. A reading signed with a device key revoked as compromised is refused.
What it asks for, in plain words
- 21 CFR 11.300
- Signatures made with an identification code and a password are kept secure: no two people share a code-and-password combination; issued codes and passwords are checked, recalled or revised periodically; lost or compromised tokens and cards are deauthorized; attempts at unauthorized use are prevented, detected and reported urgently; and tokens and cards are tested.
- 21 CFR 11.300(d)
- Transaction safeguards prevent unauthorized use of passwords and identification codes, and any attempt at it is detected and reported at once to the system security unit and, as appropriate, to management.
These summaries are BatchGlow's reading of the text on this page, checked against it on 2 Oct 2026. The text governs.