Title 21 CFR Part 11
ActiveSpecialized framework
Best for: Any organization that creates, modifies, maintains, or transmits electronic records under FDA-regulated processes: pharmaceutical manufacturers, biotech firms, medical device companies, CROs, clinical laboratories, and food producers subject to FDA oversight. No revenue or size threshold applies. If your QMS, MES, LIMS, or clinical trial platform runs under FDA jurisdiction, Part 11 applies. AWS-hosted GxP workloads fall under this requirement.
| Mandatory? | Mandatory for FDA-regulated industries using electronic records |
|---|---|
| Who validates? | FDA inspection; no formal certification |
| Renewal | No fixed cycle; ongoing compliance |
| Scope | Electronic records and signatures in FDA-regulated industries |
| Governing body | U.S. Food and Drug Administration (FDA), Department of Health and Human Services, 21 CFR Part 11 (1997, amended 2003). Official source |
Get started
Point the module source at the Title 21 CFR Part 11 endpoint and pin a version range you reviewed:
module "..." {
source = "cfrpart11.compliance.tf/terraform-aws-modules/<module>/aws"
version = "<version>"
}cfrpart11.compliance.tf lists every Title 21 CFR Part 11 module with its versions, inputs and outputs.
What compliance.tf covers and what you handle
| Area | Compliance.tf automates | You handle |
|---|---|---|
| Audit Trail Completeness | Validates CloudTrail and API Gateway logging configuration. Checks multi-region trail enablement, S3 object-level read/write event logging, CloudWatch integration, and security trail configuration. Gaps where regulated record changes would go unlogged surface as findings. | Application-level audit trails within GxP systems (LIMS, MES, ERP) must capture old and new values and operator identity per Section 11.10(e). You also need to identify which S3 buckets hold regulated records, map them to predicate rules, and maintain documented audit trail review procedures with qualified reviewers. |
| Encryption at Rest | Covers API Gateway cache encryption, backup recovery point encryption, and CloudTrail log encryption. Verifies that KMS customer-managed keys are in use for trail encryption rather than default AWS-managed keys. | KMS key rotation policy, key access policy reviews, and documented rationale for key management decisions. Encryption must also extend to all data stores holding regulated records (RDS, EBS, DynamoDB) beyond the controls sampled here. |
| Encryption in Transit | Flags deprecated SSL/TLS protocol versions and missing SSL certificates on API Gateway stages, covering CloudFront and API Gateway TLS configuration. | Defining minimum TLS version policy at the organizational level, performing periodic cipher suite reviews, and documenting encryption-in-transit controls for system validation packages (IQ/OQ/PQ documentation). |
| Backup and Record Retention | Checks backup retention minimums, recovery point encryption, and deletion protection. Backup plans below the 35-day baseline and recovery points exposed to manual deletion both generate findings. | Determining actual retention requirements based on predicate rules (e.g., 21 CFR 211.180 requires batch production records for at least 1 year past expiry). Retention periods in production GxP environments typically need to be configured well beyond 35 days. Testing restore procedures and documenting restore validation results is also on you. |
| Access and Network Controls | Checks AWS Organizations membership and public IP exposure on compute resources. Validates centralized account governance and that launch configurations do not assign public IPs by default. | Implementing IAM policies, role-based access control, and unique user identification per Section 11.10(d). Establishing procedures for electronic signature management per Subpart C (Sections 11.100, 11.200, 11.300). Periodic access reviews and documentation of authority checks. |
Controls by category
76 of 110 mapped controls are Enforced by compliance.tf modules at terraform plan. The other 34 are Mapped only: Title 21 CFR Part 11 lists them, no compliance.tf module checks them.
Audit Trails - Section 11.10 (e)
The most common findings under Section 11.10(e) are gaps in regional trail coverage, missing object-level S3 logging for GxP data buckets, and CloudTrail logs not forwarded to CloudWatch. The requirement is specific: secure, computer-generated, time-stamped trails that capture old and new values and the identity of the person behind each change. Assessors will also verify that trails cannot be modified or deleted by the same operators whose actions they record.
Encryption at Rest - Section 11.10 (c)
Assessors verify that backups, cached API responses, and audit trail logs are encrypted with customer-managed KMS keys, not AWS default service keys. The distinction matters under Section 11.10(c) because customer-managed keys give the organization documented control over access to regulated records. Unencrypted backup recovery points are a frequent gap, particularly when teams assume encryption is inherited from the source volume.
Encryption in Transit - Section 11.10 (c)
The first thing an assessor checks is whether deprecated SSL/TLS protocols (SSLv3, TLS 1.0, TLS 1.1) are still in use. CloudFront distributions configured with legacy origin SSL protocols and API Gateway stages missing client SSL certificates for backend authentication are the two most common findings. Evidence should include TLS configuration documentation and vulnerability scan results confirming no weak cipher suites are active.
| Control | Status |
|---|---|
| API Gateway REST API stages should have a client certificate configured | Mapped |
Record Retention and Protection - Section 11.10 (b)
Configuration showing recovery points cannot be manually deleted is the primary evidence auditors request here. Section 11.10(b) requires the ability to produce accurate, complete copies of records suitable for FDA inspection, which means those records cannot be subject to casual deletion by operators. The 35-day retention check is a floor, not a target: most GxP record types under predicate rules such as 21 CFR 211.180 require retention well beyond that, often tied to product expiry dates.
| Control | Status |
|---|---|
| Backup plan rules should retain recovery points for at least 35 days | Mapped |
Additional controls (103)
AWS AppSync (1)
| Control | Status |
|---|---|
| AppSync GraphQL APIs should not use API key authentication | Enforced |
AWS CloudTrail (1)
| Control | Status |
|---|---|
| CloudTrail trails should have log file validation enabled | Mapped |
AWS CodeBuild (2)
AWS Database Migration Service (1)
| Control | Status |
|---|---|
| DMS replication instances should not be publicly accessible | Enforced |
AWS IAM (7)
AWS KMS (1)
| Control | Status |
|---|---|
| KMS CMK rotation should be enabled | Enforced |
AWS Lambda (2)
| Control | Status |
|---|---|
| Lambda functions should be in a VPC | Enforced |
| Lambda functions should restrict public URL | Enforced |
AWS Secrets Manager (1)
| Control | Status |
|---|---|
| Secrets Manager secrets should be encrypted using CMK | Enforced |
Amazon CloudFront (1)
| Control | Status |
|---|---|
| CloudFront distributions should use the recommended TLS security policy | Enforced |
Amazon CloudWatch (1)
| Control | Status |
|---|---|
| CloudWatch log groups should have retention period of at least 365 days | Enforced |
Amazon CloudWatch Logs (1)
| Control | Status |
|---|---|
| Log groups should have encryption at rest enabled | Enforced |
Amazon DynamoDB (3)
Amazon EBS (1)
| Control | Status |
|---|---|
| Attached EBS volumes should have encryption enabled | Enforced |
Amazon EC2 (7)
Amazon EFS (2)
| Control | Status |
|---|---|
| EFS file systems should have encryption at rest enabled | Enforced |
| EFS file systems should be encrypted with CMK | Enforced |
Amazon EMR (1)
| Control | Status |
|---|---|
| EMR cluster Kerberos should be enabled | Mapped |
Amazon ElastiCache (1)
Amazon Kinesis (1)
| Control | Status |
|---|---|
| Kinesis streams should have server side encryption enabled | Mapped |
Amazon MSK (2)
| Control | Status |
|---|---|
| MSK clusters should have public access disabled | Enforced |
| MSK clusters should disable unauthenticated access | Enforced |
Amazon OpenSearch Service (5)
Amazon RDS (16)
Amazon Redshift (8)
Amazon S3 (17)
Amazon SNS (1)
| Control | Status |
|---|---|
| SNS topics should be encrypted at rest | Enforced |
Amazon SageMaker (3)
Amazon VPC (4)
Elastic Load Balancing (8)
Related frameworks
| Framework | Control overlap | Note |
|---|---|---|
| NIST Cybersecurity Framework v1.1 | High 86% | |
| PCI DSS v4.0 | High 84% | |
| NIST SP 800-171 Rev 2 | High 83% |
Frequently asked questions
Does 21 CFR Part 11 apply to my organization if we use cloud-hosted systems?
Yes. Part 11 follows the records, not the infrastructure. If your FDA-regulated processes produce electronic records in AWS or any other cloud platform, you are responsible for demonstrating Part 11 compliance for those records. The FDA's 2003 guidance on scope and application did not exempt cloud environments. You need to qualify your cloud service provider (typically via a shared responsibility model and SOC 2 reports) and validate the application layer yourself.
What is the difference between Part 11 and predicate rules?
Predicate rules are the underlying FDA regulations that require records to be maintained (e.g., 21 CFR 211 for drug cGMP, 21 CFR 820 for device quality systems). Part 11 specifies how those records must be managed when they are in electronic form. You cannot comply with Part 11 in isolation: first identify which predicate rules apply to your products, then determine which records under those rules are electronic, and then apply Part 11 controls to those records.
How does the FDA's enforcement discretion guidance affect what I need to implement?
Treat the September 2003 enforcement discretion guidance as prioritization, not exemption. The FDA indicated it would exercise discretion on certain requirements, including validation, audit trails, record retention, and legacy systems, but did not waive them. Recent warning letters confirm active enforcement of audit trail and access control requirements. Section 11.10(e) audit trails for predicate-rule records are still expected, regardless of the 2003 guidance.
How long does it take to achieve Part 11 compliance in an AWS environment?
It depends on the number of GxP systems and their current state. Infrastructure-level controls (encryption, logging, access management) can be configured and validated in 4 to 8 weeks using Terraform and policy-as-code. Application-level validation (IQ/OQ/PQ) for each GxP system typically takes 3 to 6 months. A full program covering infrastructure, applications, SOPs, and training for a mid-size pharma company usually runs 6 to 12 months from kickoff to inspection readiness.
Are the controls in this mapping sufficient for full Part 11 compliance?
No. These controls cover infrastructure-level technical requirements: audit trails, encryption, access restrictions, and backup retention. Part 11 also requires procedural controls that infrastructure checks cannot address, including system validation documentation (Section 11.10(a)), written policies that hold individuals accountable for actions under their electronic signatures (Section 11.10(j)), unique electronic signatures (Section 11.100(a)), and the biometric/non-biometric signature requirements in Subpart C. This benchmark is one layer in a broader compliance program that must also include SOPs, training records, and application-level validation.