21 CFR Part 11 · Electronic Signatures

Part 11 Never Required a Password

Michael Martone  ·  VP, Quality & Compliance  ·  ISPE GAMP Americas Steering Committee

Somewhere in your quality system there is an SOP that mandates password re-entry at every electronic signature. Ninety-day rotation. A complexity rule: one uppercase, one number, one symbol. And somewhere in a validation deliverable, all of it is justified with three words: “21 CFR Part 11.”

None of it is in Part 11.

The rule requires two distinct identification components and a signature that only its genuine owner can produce. It never named a password. It never mandated rotation. It never specified complexity. What happened is that in 1997, a username and a password were the only practical way to deliver “two distinct components,” so the industry did that, and then, over twenty-five years, quietly forgot the distinction between the requirement and the implementation. We froze one era’s technology into a mandate the regulation never wrote.

This is what over-compliance looks like. Not malice, not laziness — a dated implementation mistaken for the rule, defended long after the reason for it expired.

The security profession already abandoned these rules

Before we get to what Part 11 actually says, deal with the objection that’s already forming: isn’t the password there for security? Aren’t you asking us to weaken the signature?

No. And the people best positioned to say so are the ones who wrote the password rules in the first place.

NIST SP 800-63B, the authoritative federal standard for digital identity, spent the last decade retiring the exact practices pharma quality still enforces. Its 2024 revision formally removed forced periodic rotation; organizations are now told to require a change only when there is evidence the credential has been compromised. It recommends against composition rules — the uppercase-number-symbol mandates — because they push people toward “Password1!” without meaningfully improving resistance to real attacks. Rotation and complexity, NIST concluded, produce predictable, reused, weaker passwords.

OWASP reached the same place. Its 2025 Top 10 names authentication failures directly and says, in plain language, that rotation and complexity requirements were once considered best practice and should now be stopped, per NIST, in favor of multi-factor authentication on important systems.

So when someone objects that passwordless SSO “weakens” the electronic signature, they have it exactly backwards. Clinging to the password isn’t ahead of the security curve. It’s a decade behind it. Modernizing the signature moves it toward current security consensus, not away from it.

What Part 11 actually says

Now the regulation, precisely.

Section 11.200(a) requires that a non-biometric electronic signature “employ at least two distinct identification components such as an identification code and password.” Read the operative words. Such as. It is illustrative, not mandatory. The rule requires two distinct components. It offers ID-and-password as an example of two distinct components. It does not require that either one be a password.

The rest of the section describes properties, not technology. A signing during a single, continuous period of controlled system access uses all components at first signing, and at least one component — executable only by the individual — for subsequent signings. The signature must be usable only by its genuine owner. Its misuse must require the collaboration of two or more people. And §11.300 requires controls that ensure the security and integrity of whatever identification mechanism you use.

Every one of those is a property. Uniqueness. Owner-only execution. Non-repudiation. Controlled access. Part 11 was written technology-neutral on purpose — it tells you what a signature must guarantee, and deliberately does not tell you which technology must guarantee it. The password was never the requirement. It was one way to meet it, in a year when it was the only way.

What a modern signing event actually looks like

Here is a passwordless, SSO-based signing flow, and how each step maps to what §11.200 actually demands.

Identity established. The signatory authenticates through the identity provider — username and password if you like, but increasingly SSO with multi-factor or a passkey. The IdP issues a signed, session-bound token. This is the first distinct identification component, verified, and often verified more strongly than a password alone. Worth noting: OWASP is explicit that once a session is established, its token is equivalent to the strongest authentication method used to create it. The token is not a weaker stand-in for the login. It carries the login’s full strength.

The binding. At the moment of signing, the platform re-validates that token against the identity provider. This is not a third factor padding a count. It is the step that proves the identity is still live — still this person, still this session — and it is what makes the signing event provably continuous with the authentication. OWASP recommends exactly this: re-authentication at high-risk events, a fresh check when something consequential is about to happen. A signature is precisely such an event.

The signing component. The platform then requires a signing PIN, entered fresh at the signature event, a component executable only by the individual. The signature is applied and written to the audit trail. This PIN is what defeats the attack OWASP lists among its top authentication failures: the user who walks away from an unlocked session. A live session alone can’t sign. Only the owner, supplying the owner-only component, can.

The result is two distinct identification components, established at login and re-asserted at signing, bound into one non-repudiable signature, with stronger identity assurance than re-typing a password ever provided.

One honest caveat, because it’s what makes the argument sound rather than convenient: controlled sessions have bounded lifetimes and defined re-authentication — NIST specifies session and inactivity timeouts precisely so that “continuous controlled access” means something. The regulated firm still has to define its session policy, its re-authentication triggers, and its justification, and document them. This isn’t an exemption from anything. It’s a compliant implementation, justified — which is exactly the freedom a technology-neutral predicate rule was written to allow.

The rule didn’t age. Our reading of it did.

Step back from passwords and the shape of the thing is familiar.

We took a requirement expressed as properties, and pinned it to the one technology that happened to satisfy it in 1997. Then we stopped re-reading the requirement. The technology moved — identity got federated, multi-factor got standard, the password got demoted by the very institutions that once championed it — and our interpretation stayed frozen. We kept enforcing the artifact long after it stopped being the best way, or even a good way, to deliver what the regulation actually asks for. And we called that caution.

It isn’t caution. It’s over-compliance: mistaking the tradition for the mandate, and treating the refusal to modernize as a form of rigor.

The properties Part 11 requires — unique identity, owner-only signing, non-repudiation, controlled access — are better served today by modern federated identity than by the password we mistook for the rule.

Part 11 never required a password. It required proof that you are who you say you are, and that you meant to sign. Modern identity gives you more of that, not less.

The regulation was waiting for us to catch up the whole time.