21 CFR Part 11
Protect the systems that fall under Part 11
21 CFR Part 11 is the US rule for electronic records and electronic signatures. It applies to companies with requirements from the FDA, the US Food and Drug Administration. XoT is not itself in scope, but it protects the systems that are.
The rule
What Part 11 covers
Part 11 is part of Title 21 of the US Code of Federal Regulations. It dates from 1997. It covers systems that create, modify, store or transmit records that the FDA requires. That can be a batch record system, a LIMS or a control system that stores data.
Section 11.10 lists controls for closed systems. These are systems where access is controlled by the people responsible for the content.
XoT does not create or store such records. So XoT is not a system in scope of Part 11. But several of the controls in 11.10 concern access. That is where XoT helps.
The controls
The controls XoT helps with
The table shows the Part 11 controls that concern access and protection. The last column shows whether XoT helps. The rows where XoT helps are highlighted in green.
| Section | Control | XoT |
|---|---|---|
| 11.10(d) | Only authorised individuals can access the system | Yes |
| 11.10(g) | Checks that only authorised individuals can use the system | Partly |
| 11.10(h) | Checks that data comes from a valid source | Partly |
| 11.10(c) | Records are protected throughout the retention period | Partly |
| 11.30 | Additional controls for open systems | Partly |
| 11.10(a) | Validation of the system | No |
| 11.10(e) | Audit trail for the records | No |
| 11.50–11.300 | Electronic signatures | No |
The descriptions of the controls are our simplifications.
Control by control
How XoT helps
Access – 11.10(d) and (g)
The Lock only lets authorised people reach the system. Every policy applies to a specific person, specific equipment and a specific time. The login in the system itself remains. That is also where the system checks what the person may do.
Valid source – 11.10(h)
The control is about data coming from a valid source. In XoT, every device has its own certificate. When an instrument and a server each sit behind a Lock, only data from identified devices reaches the server.
Protection of records – 11.10(c)
The system is invisible to anyone without authorisation. That protects the records against access over the network. Backups and archiving are your responsibility.
Open systems – 11.30
A system counts as open when access is not controlled by the people responsible for the content. Then additional measures are needed, such as encryption. With XoT, the system owner also controls remote access, and the connection is encrypted with WireGuard.
Audit trail – 11.10(e)
The audit trail for the records sits in your system and shows changes to data. XoT does not replace it. The XMS does, however, log who reached the system and when. The XMS also logs every change to policies and access rights, in a log that is protected against later changes. That complements the system's own audit trail.
Validation
Validation according to risk
In September 2025 the FDA published final guidance on Computer Software Assurance. It covers software used in production and quality systems for medical devices. The guidance says validation should be proportionate to risk. The supplier can be assessed on, among other things, certifications and security practices.
You qualify XoT as part of the infrastructure. Our description of how we work with quality, a software bill of materials (SBOM) and penetration test reports are available on request.
Common questions
Is XoT Part 11 compliant?
XoT is not in scope of Part 11, because it does not create or store records. XoT can be part of the infrastructure around the systems that are in scope.
Does XoT handle electronic signatures?
No. Signatures are made in your system. XoT makes sure only authorised people reach it.
Do we need to qualify XoT?
Yes, as part of the infrastructure. You decide the scope of the qualification based on risk. We contribute material.
How does Part 11 relate to Annex 11?
Both cover computerised systems. Part 11 covers FDA requirements in the US. Annex 11 covers GMP in the EU. Many companies need to follow both.
This is our interpretation of Part 11. It is not legal advice.
Ask for material
We are happy to describe how XoT fits into your environment and what material you need.