21 CFR Part 11 governs electronic records and electronic signatures in FDA-regulated industries. While it doesn't prescribe a specific backup product, its requirements have direct implications for how you back up, retain and recover GxP data. Fail to meet them and your electronic records may not be considered trustworthy or reliable in an inspection.
This guide breaks the relevant requirements into plain language, with the control you need for each. Want a printable version? Grab the free 21 CFR Part 11 readiness checklist and the ALCOA+ template from our resources page.
§11.10(b) requires the ability to generate accurate and complete copies of records in both human-readable and electronic form for inspection. Your backups must therefore be restorable to a usable state — not just present. Vaultvec verifies every restore point with a checksum so recoverability is proven, not assumed.
§11.10(c) requires records be protected to enable accurate and ready retrieval throughout the retention period. That means immutable, tamper-resistant backups and a retention policy that matches your GxP record requirements. Vaultvec enforces immutable restore points with per-workload retention windows and automatic pruning.
§11.10(e) requires secure, time-stamped audit trails that record operator actions without obscuring prior values, retained as long as the record. Backup and restore events belong in that trail. Vaultvec writes them to a hash-chained audit log you can independently verify.
While RPO/RTO aren't named in Part 11, demonstrating 'ready retrieval' means defining and meeting recovery objectives. Set your maximum acceptable data loss (RPO) and downtime (RTO), then schedule backups to satisfy them. Use our free RPO/RTO calculator to get a recommended strategy.
§11.10(a) requires system validation to ensure accuracy, reliability and the ability to discern altered records. Follow a GAMP 5 lifecycle, keep formal change control, and perform periodic reviews. Vaultvec ships with documentation to support validation of the backup and audit-trail functions.
No — it requires that records remain retrievable and protected. Your backup frequency should be driven by your RPO. Tighter RPOs require more frequent backups.
As long as the underlying GxP record must be retained, which varies by record type and market. Retention policies should be documented and enforced by the system.