Unlocking Trust in the Digital Era: Navigating FDA and ISO Compliance with Digital Signatures and Signing Intent

Workzone

Unlocking Trust in the Digital Era: Navigating FDA and ISO Compliance with Digital Signatures and Signing Intent

In FDA (U.S. Food and Drug Administration) and ISO 27002 compliant processes, digital signatures play a crucial role in ensuring the integrity, authenticity, and security of electronic records and signatures. The use of digital signatures is outlined in the FDA’s regulations, particularly in the context of electronic records and electronic signatures, as specified in Title 21 of the Code of Federal Regulations (CFR) Part 11 and ISO/IEC 27002:2013 respectively.

Digital signatures are not just for PDF documents though. Most FDA/ISO compliant processes require digital signature approvals for changes to software as well, also known as Pull Requests. Essentially files containing code are documents that need to undergo a strict review and approval process, just like any other controlled documents that are part of the change management.

Here are the key elements related to digital signatures, signing intent, and the role of the signee in an FDA/ISO compliant process:

Digital Signatures:
- Authentication: Digital signatures serve as a means of electronic authentication, confirming the identity of the person associated with the signature. Approving a pull request and signing the approval with a signature token ensures the approver uniquely identified.
- Data Integrity: The unique approval signature in combination with the git commit hash of the pull request commit help ensure the integrity of the pull request approval as both signature and the commit hash cannot be changed or tampered with.
- Non-repudiation: Digital signatures provide non-repudiation, meaning the signer cannot later deny their involvement in the signing process.

Signing Intent:
- Explicit Intent: The signing process should involve explicit intent from the individual to sign. This means the person signing understands and intends to authenticate the information. The pull request reviewer must pro-actively select a reason for the their signature approval.

Role of the Signee:
- Designated Roles: Compliance regulations emphasize the importance of defining and assigning specific roles to individuals involved in the electronic signature process. In Atlassian Bitbucket the pull request reviewers group membership(s) can serve as a role. When a reviewer signs a pull request can simply select the group they are signing for to assume their role.
- Responsibilities: Each role or reviewer group should have defined responsibilities. Naturally Bitbucket comes with easy to use access controls ensuring that only authorized individuals can perform specific actions, including signing. Reviewers are only added to pull requests if they are a member of a nominated signature-reviewer group.