The password requirements in 21 CFR Part 11 are deliberately performance-based: the regulation requires that every user have a unique identification code and password combination, that those credentials be periodically reviewed or revised, and that the organization follow loss management procedures when credentials are lost, stolen, or otherwise compromised. Beyond those three mandates, the FDA leaves length, complexity, rotation intervals, and lockout thresholds to each organization to design and defend. There is no character-count rule in the regulation itself.
The Three Mandatory Password Controls
The password-specific rules live in 21 CFR 11.300. Organizations whose electronic signatures rely on identification codes and passwords must implement controls to ensure the security and integrity of those credentials, and three of those controls are spelled out.1eCFR. 21 CFR 11.300 – Controls for Identification Codes/Passwords
Every User Needs a Unique ID and Password Combination
No two people can share the same credentials. Shared logins remain one of the most common findings in FDA inspections, and they matter because a shared account destroys attribution: the audit trail can’t tell who actually performed an action, and the electronic signature framework built on top of the password collapses with it.1eCFR. 21 CFR 11.300 – Controls for Identification Codes/Passwords
Credentials Must Be Periodically Checked, Recalled, or Revised
The regulation mentions password aging as an example of what this covers. For years most organizations read this as a mandatory expiration policy on a 60- to 90-day cycle. That reading is now being reconsidered in light of updated NIST guidance, but the underlying obligation is unchanged: you need a documented process for reviewing whether credentials are still secure and for revoking or refreshing them when they aren’t.1eCFR. 21 CFR 11.300 – Controls for Identification Codes/Passwords
Loss Management for Compromised Credentials
Organizations must follow procedures to deauthorize tokens, cards, or other devices that store or generate credential information when they are lost, stolen, or potentially compromised, and must issue temporary or permanent replacements under rigorous controls. In a password-only environment, that translates to a documented process for disabling a compromised account, forcing a credential reset, and verifying the user’s identity before restoring access.1eCFR. 21 CFR 11.300 – Controls for Identification Codes/Passwords
Why There’s No Minimum Length or Complexity Rule
Part 11 tells you what the controls have to accomplish, not how to build them. The regulation’s language for closed systems asks for controls that ensure the authenticity, integrity, and confidentiality of records, and for measures that limit system access to authorized individuals.2eCFR. 21 CFR 11.10 – Controls for Closed Systems Whether you get there with a 12-character passphrase, a hardware token, or multi-factor authentication is your call, and your validation documentation is where you defend that call.
The trade-off is real. Companies get flexibility to adopt modern authentication, but they also lose the comfort of a checklist. An eight-character minimum with quarterly rotation was never actually in Part 11; it became convention, and conventions drift out of date faster than regulations do.
How NIST 800-63B Changes the Playbook
NIST Special Publication 800-63B, the federal digital identity guideline, now explicitly discourages two practices that most Part 11 password policies were built around. NIST states that verifiers “shall not impose other composition rules (e.g., requiring mixtures of different character types) for passwords” and “shall not require subscribers to change passwords periodically.” Research into breached password databases showed that forced complexity produces predictable patterns (a capital first letter, a number and symbol at the end) and that forced rotation leads users to make minimal, guessable changes. NIST does require a forced change when there is evidence a password has been compromised.3National Institute of Standards and Technology. NIST Special Publication 800-63B – Digital Identity Guidelines
NIST’s current minimum length requirements are 15 characters for single-factor passwords and 8 characters when the password is used as part of multi-factor authentication.3National Institute of Standards and Technology. NIST Special Publication 800-63B – Digital Identity Guidelines
Part 11 does not reference NIST 800-63B, and the FDA has not issued guidance reconciling the two. The regulation’s performance-based language arguably accommodates the NIST approach: longer passwords without forced complexity, combined with multi-factor authentication and compromise-based rotation, can provide stronger security than the traditional eight-character-plus-complexity model. If you update your policy in that direction, document why the new approach satisfies Part 11’s security mandate. That written rationale is what you hand an inspector who asks why you stopped forcing 90-day rotations.
Account Lockout and Failed Login Attempts
Part 11 does not specify a number of failed attempts before lockout. Automatic account lockout is a near-universal implementation of the access control requirement in 11.10, because unlimited password guessing would undermine both the access limit and the credential integrity mandate.2eCFR. 21 CFR 11.10 – Controls for Closed Systems Most validated systems lock an account after three to five consecutive failed attempts and require an administrator or a time-based delay to release it. Whatever threshold you choose, put it in your system security policy and make sure the audit trail captures failed logins alongside successful ones.
How Passwords Function in Electronic Signatures
The password rules exist partly to support electronic signatures, and the signature rules dictate how the password behaves at the moment of signing. An electronic signature that isn’t based on biometrics must use at least two distinct identification components, typically a user ID and a password. When someone performs multiple signings during a single, continuous session, the first signing requires both components; subsequent signings during that same session may use only one component, provided that component can only be executed by its owner.4eCFR. 21 CFR 11.200 – Electronic Signature Components and Controls
Every electronic signature must be unique to one individual and can never be reused or reassigned. Before assigning an electronic signature, the organization must verify the individual’s identity.5eCFR. 21 CFR 11.100 – General Requirements Those two rules are what let a password-based signature resist repudiation: the signer can’t credibly claim someone else used their credentials, because the system was built to prevent that.
Supporting Controls That Make Passwords Meaningful
Password controls don’t do their job in isolation. Several other Part 11 controls have to be in place for the password framework to hold up during an inspection.2eCFR. 21 CFR 11.10 – Controls for Closed Systems
- A secure, computer-generated, time-stamped audit trail that independently records every operator action creating, modifying, or deleting a record. Changes cannot obscure prior information, and the audit trail must be retained at least as long as the record itself.
- Authority checks that verify each user is authorized for the specific action attempted, whether that is signing a record, altering data, or accessing a device.
- Training and qualification for everyone who develops, maintains, or uses the system, including the IT staff configuring the password policy and the end users relying on it.
- A written accountability policy that holds individuals responsible for actions taken under their electronic signatures. That policy is what gives a password-based signature its legal weight: if your password approved a batch record, you are on the hook for that approval.
What Inspectors Cite When Password Controls Fail
Part 11 violations typically surface during FDA inspections as Form 483 observations or in warning letters. Common password-related findings include shared user accounts, missing or incomplete audit trails, no account lockout mechanism, no documented loss management procedure, and no periodic review of credentials. These findings rarely stand alone; an inspector who sees weak password controls tends to look harder at the broader electronic record system.
The FDA can take regulatory action for non-compliance with predicate rules, which remain fully enforced regardless of any enforcement discretion the agency exercises over other parts of Part 11.6U.S. Food and Drug Administration. Part 11, Electronic Records; Electronic Signatures – Scope and Application Password controls sit squarely within active enforcement scope. If credentials were shared or the audit trail can’t establish who did what, an investigator may refuse to accept the electronic records at all, which leaves you operating without the documentation your predicate rules require.