21 CFR Part 11 compliance support

Title 21 Code of Federal Regulations Part 11 (“CFR Part 11”) establishes the United States Food and Drug Administration (the “FDA”) regulations on electronic records and electronic signatures. If enabled by your organization’s admin, you can use Box Sign Part 11 e-signatures (“Part 11 e-signatures”) with Box Sign requests for your regulated documents.

This document is for informational purposes only and should not be relied upon as legal advice. If you have any legal questions regarding 21 CFR Part 11 or your organization’s intended use of Part 11 e-signatures, you should consult legal counsel licensed in your jurisdiction(s) before making use of Part 11 e-signatures. For requirements and additional information, visit eCFR :: 21 CFR Part 11.

Support for 21 CFR Part 11 compliance in Box Sign requires GxP Validation. For more information, visit GxP Validation, or contact your account manager.

Additionally, if you are a GxP customer using certain single sign-on (SSO) configurations for your Box environment, ensure that you have configured your SSO controls to force authentication to create compliant 21 CFR Part 11 e-signatures.

Support for 21 CFR Part 11 e-signatures is not compliant with the following signing workflows and options:

• Ready-Sign Links
• Sign Myself
• Box Sign Salesforce integration signature requests

Admin enablement

As an admin, you can restrict users and groups to creating, sending, and managing only 21 CFR Part 11 signature requests. This helps ensure compliance.

To configure the restriction:

1. In the Admin Console, go to Enterprise Settings and select the Box Sign tab.

2. In the Advanced CFR Part 11 Settings section, select Edit Configuration. The line above the button shows the current status, for example, Restriction to 21 CFR Part 11 disabled for all managed users.

   

3. In the Configure Restriction to 21 CFR Part 11 window, select who the restriction applies to:

   Option	Result
   Disable for all managed users	Users can send both standard and 21 CFR Part 11 requests, unless a reusable template sets the request type.
   Enable for all managed users	All managed users can send only 21 CFR Part 11 requests.
   Enable for select users and groups	Only the users and groups you select are restricted to 21 CFR Part 11 requests.
   Enable for everyone except select users and groups	All managed users except the ones you select are restricted to 21 CFR Part 11 requests.

4. Select Save.

Signing reasons

Signers must select a reason each time they sign a 21 CFR Part 11 request. As an admin, you choose which reasons they can select from:

• Default reasons: Three predefined reasons that you can’t edit.
• Customized reasons: A list of reasons that you create. Make sure your reasons meet 21 CFR Part 11 requirements.

You can also let signers write their own reason.

To set signing reasons:

1. In the Admin Console, go to Enterprise Settings and select the Box Sign tab.

2. In the Advanced CFR Part 11 Settings section, under Signing Reasons, select Default reasons or Customized reasons.

3. If you selected Customized reasons, select Add Reason and enter at least two reasons. You can add up to 25 reasons, each up to 60 characters.

   

4. Optional: To let signers write their own reason when adopting their signature or initials to a signature request, select Allow signers to add a custom reason.

5. Select Save.

Sending process

To begin the sending process:

1. Select Request Signature or initiate a signature request through a reusable template.
2. In the recipient panel, under CFR Part 11 Setting, select CFR Part 11 request or Standard Request from the Request Flow dropdown. If the signature request was initiated using a template, these settings will not be available, as they are preset by the template creator at the time the template was created.
3. Follow the sending process from Sending a document for signature to continue.

Within the document preparation experience, senders can verify that their signature request will follow the CFR Part 11 e-signature workflow by ensuring they have the CFR Part 11 Signature request icon next to their signature request file name. When a sender modifies a recipient’s role, they can review the 21 CFR Part 11 login requirements to notify their signers of the requirement in advance.

When preparing a Part 11 e-signature request, you have two options:

1. For a single signer or a recipient group that was assigned the “signer” role, senders can add a required signature field or an initials field or both. Stamps, and any other fields are not included in the Part 11 e-signature process.
2. Senders can add no fields at all to a single signer or recipient group. In that case, those recipients will need to drag and drop the fields they need to complete and will then be required to add at least one signature field or one initials field before the signer can complete the signature request.

The sender should ensure that either a signature field or initials field is assigned to a signer and selected as a required field by the signer. If a sender tries to send a signature request marking a signature field or initials field as “not required”, an error banner will be displayed and the sender will not be able to proceed with sending the signature request.

The Request Flow option you select is remembered for the user’s next signature request. For example, if the user selects “CFR Part 11 request” in the first request, the same option is pre-selected by default in the second request to provide consistency and guidance.

Require Password (Optional)
The sender can choose if they want to add an additional password of their choice to the signature request by toggling Require Password.

Templates

For templates, follow the process in Creating, using, and sharing templates under To create a template. Template creators can select CFR Part 11 request or Standard Request from the Request Flow dropdown in the recipient panel during document preparation and lock the request type to ensure anyone who leverages the template must utilize the configured request type.

21 CFR Part 11 signing process

Once a recipient initiates a signature request, they will be required to log in to their Box account to authenticate their identity to continue with the CFR Part 11 e-signature request. If the signer does not have a Box account, Box will prompt the recipient to create a free account in order to authenticate to the Box service. After logging in, you follow the same process as in Signing a document, with two additional steps:

• If the request includes a signature or initials field assigned to a recipient, that recipient must select the reason for applying their signature or initials to the request.
• Once the signing reason has been applied to the signature or initials field(s), recipients must re-authenticate their log-in after each Part 11 e-signature

• The 21 CFR Part 11 signing process only applies to the application of signature and initials fields. It does not apply to the application of stamps or any other fields.
• The customer is responsible to ensure the identity of each recipient is verified to the organization’s satisfaction prior to providing such recipient with account login access credentials for Box. The customer must authenticate each user’s identity prior to sending a Part 11 e-signature request.

Reason for signing

After the recipient selects their signature or initials, the recipient can select the following reasons in order to proceed:

• Default signing reasons, which include:
  • I read and approve this document
  • I read and agree to this document
  • I read and authored this document
• Customized signing reasons, if the admin or co-admin configured them instead of the default reasons
• The recipient’s own signing reason, if the admin or co-admin enabled custom reasons for signers

The recipient’s selection is recorded in their signature block or initials field within the signed document and in the signing log for reference.

Re-authenticating each Part 11 e-signature

The Part 11 e-signature workflow will log you out of any open Box account browser-based sessions and reinitiate your account session by logging you back in at the time of signing. Be sure to save your existing work before initiating a Part 11 e-signature workflow.

After adopting your signature or initials or both, providing your reason for signing, and navigating to the next page, you will then be prompted to re-authenticate your session by logging in with your credentials. Re-authentication completes the signing process for that Part 11 e-signature.

Recipients can continue adding their signature or initials to other locations within the request by selecting the next signature or initials field, selecting their reason, and re-authenticating their session. This process is repeated until all required signature or initials or both fields in the CFR Part 11 e-signature request are completed.

The sender may choose not to assign any fields to a signer. In this case, the recipient may drag and drop fields when completing the CFR Part 11 e-signature request. The signer will need to add at least one signature or initials field to complete the process. When the recipient adds a field, they will be prompted to adopt a signature or initials, provide a signing reason, and re-authenticate themselves.

Automatic resizing of the CFR Part 11 e-signature and initials fields

Signature and initials fields within CFR Part 11 signature requests will have preconfigured sizing dimensions and may be automatically resized to ensure that the final CFR Part 11 signature and initials frame, including details within the frame, are legible.

These predefined dimensions do not apply to signature or initials fields included within batch send signature requests.

For legibility purposes, Box Sign may automatically resize signature and initials fields within CFR Part 11 signature requests initiated from reusable templates, regardless of how the fields are configured within the template. We recommend reviewing the signature request in the document preparation process to confirm the field properties are properly sized and meet the sender’s requirements prior to sending the request.

Signing log

Once the Part 11 e-signature request is complete, the Signing Log is available for review and reference. The signing log displays each Part 11 e-signature or initials or both, authentication details, and the signing reason as pictured below. You can learn how to access the Signing Log associated with your document here.

For additional information about how Box can support compliance with 21 CFR Part 11, contact your account manager or customer success manager.