FDA 21 CFR Part 11 Requires Access Controls Your Manufacturing OT Does Not Have

Yes. Part 11 applies to any system that creates, modifies, maintains, archives, retrieves, or transmits electronic records subject to FDA predicate rules. When a bioreactor DCS logs batch parameters, those are electronic records under Part 11. The access controls in Section 11.10(d/e/g) apply to any remote access to those systems.

Manufacturing floor OT: bioreactor DCS and SCADA for batch processing, CIP automation, HVAC and environmental monitoring, WFI purification, lyophilization controllers, filling line automation, and serialization systems. LIMS, clinical trial databases, and electronic lab notebooks are not in scope.

A VPN provides network-layer access to a subnet. Section 11.10(d) requires limiting access at the system level. Section 11.10(e) requires time-stamped audit trails. Section 11.10(g) requires authority checks per operation. A VPN satisfies none of these at the asset level.

The CSG deploys in 20 minutes per site. Deployment requires no changes to OT network topology or control system configurations. Network firewall policies may require minor updates to enable the CSG connection path. No new VLANs. No change control process for network infrastructure modifications. One CSG covers multiple manufacturing OT systems in the same building. CSG gateways capture session recordings across every connected building and site; Centralizer aggregates governance data and indexes recordings for replay. API synthesis, formulation, fill/finish, and packaging facilities all governed from one console.

Every session is recorded with timestamp, user identity, asset accessed, session duration, and complete visual recording. When an FDA inspector requests records for a specific batch or time period, the data is a report pull from Centralizer.

IEC 62443 provides the industrial automation security framework. Part 11 provides the FDA regulatory requirement. The CSG architecture satisfies both: SR 1.1 (human user ID and authentication), SR 2.8 (auditable events), and SR 3.1 (communication integrity).

The CSG deploys in 20 minutes per site. Deployment requires no changes to OT network topology or control system configurations. Network firewall policies may require minor updates to enable the CSG connection path. No new VLANs. No downtime required for OT systems during installation. The gateway communicates outbound to Centralizer only. No inbound ports are opened on the manufacturing network. Deployment during normal operations with zero disruption to batch processes, environmental monitoring, or filling line automation.

Yes. EU GMP Annex 11 requires validated access controls, audit trails, and data integrity measures for computerised systems in pharmaceutical manufacturing. The session isolation architecture delivers the same controls that satisfy FDA Part 11 Section 11.10(d/e/g). ISPE GAMP 5 risk-based validation applies to the access control classification. For manufacturers operating under both FDA and EMA oversight, one deployment satisfies both regulatory frameworks.