# 21CFRPart11\_Pharma **URL:** \ **Category:** Ignition\ **Tags:** vision\ **Created:** [February 6, 2024, 4:00pm UTC](https://forum.inductiveautomation.com/t/21cfrpart11-pharma/85304 "2024-02-06T16:00:47Z")\ **Posts on this page:** 7\ **Page:** 1
**Author:** ![kar\_las](https://avatars.discourse-cdn.com/v4/letter/k/b77776/32.png) [@kar\_las](https://forum.inductiveautomation.com/u/kar_las)\ **Post date:** [February 6, 2024, 4:00pm UTC](https://forum.inductiveautomation.com/t/21cfrpart11-pharma/85304/1 "2024-02-06T16:00:47Z")
Question: How does the software ensure compliance with 21 CFR Part 11, particularly concerning the logging of user management actions such as modification and deletion within the Vision module? Background: While evaluating the software's features for our project development, we've noticed that certain actions related to user management, particularly modifications and deletions, are not being logged in the audit trail within the Vision module. Considering the importance of compliance with 21 CFR Part 11 requirements, which mandate comprehensive audit trails for electronic records, it's critical for us to ensure that all relevant user actions are adequately tracked and documented. Could you please provide insight into how the software addresses this specific aspect of compliance and if there are any plans to enhance the audit trail functionality within the Vision module to encompass user management actions comprehensively? Also Could you provide guidance on the process or mechanisms within the software that allow us to set up and customize user audit messages based on button actions? Additionally, are there any best practices or recommended configurations to ensure accuracy and completeness in logging these critical user interactions? Are there any sample Ignition applications available that have been developed to meet requirements such as user management, tracking of failed attempts, logging of all actions within the application, electronic signatures, etc.? ---
**Author:** ![Matrix\_Engineering](https://sea1.discourse-cdn.com/inductiveautomation/user_avatar/forum.inductiveautomation.com/matrix_engineering/32/19781_2.png) [@Matrix\_Engineering](https://forum.inductiveautomation.com/u/Matrix_Engineering)\ **Post date:** [February 6, 2024, 4:05pm UTC](https://forum.inductiveautomation.com/t/21cfrpart11-pharma/85304/2 "2024-02-06T16:05:44Z")
> **[Meeting 21 CFR 11 Standards for Pharma](https://inductiveautomation.com/resources/customerproject/meeting-21cfr-11-standards-for-pharma)** > > Bachem Americas, a pharmaceutical company, designed and built a new cleavage unit for its chemical process at its Vista, Calif. facility. Inductive Automation’s Ignition software was used as a uniform HMI for the cleavage unit control system to... [https://docs.inductiveautomation.com/display/DOC81/Audit+Log+and+Profiles](https://docs.inductiveautomation.com/display/DOC81/Audit+Log+and+Profiles) ---
**Author:** ![pturmel](https://sea1.discourse-cdn.com/inductiveautomation/user_avatar/forum.inductiveautomation.com/pturmel/32/3295_2.png) [@pturmel](https://forum.inductiveautomation.com/u/pturmel)\ **Post date:** [February 6, 2024, 4:26pm UTC](https://forum.inductiveautomation.com/t/21cfrpart11-pharma/85304/3 "2024-02-06T16:26:27Z")
The Bachem example uses Active Directory for its user authentication. Using Vision's user management component with an internal user source may simply not be possible for this task. ---
**Author:** ![Chris\_Nathan](https://sea1.discourse-cdn.com/inductiveautomation/user_avatar/forum.inductiveautomation.com/chris_nathan/32/45712_2.png) [@Chris\_Nathan](https://forum.inductiveautomation.com/u/Chris_Nathan)\ **Post date:** [February 6, 2024, 10:22pm UTC](https://forum.inductiveautomation.com/t/21cfrpart11-pharma/85304/4 "2024-02-06T22:22:27Z")
This [document](https://inductiveautomation.com/resources/article/21-cfr-part-11-compliance-with-inductive-automations-ignition-platform) lays out IA's recommended best practices. In that article it talks about extending the audit functionality via scripting. `system.util.audit` will allow you to generate customized audit data pretty easily. See [here](https://docs.inductiveautomation.com/display/DOC81/system.util.audit). This [documentation](https://docs.inductiveautomation.com/display/DOC81/Auditing+Actions+Reference) shows all of the actions that are automatically audited ---
**Author:** ![Chris\_Nathan](https://sea1.discourse-cdn.com/inductiveautomation/user_avatar/forum.inductiveautomation.com/chris_nathan/32/45712_2.png) [@Chris\_Nathan](https://forum.inductiveautomation.com/u/Chris_Nathan)\ **Post date:** [February 7, 2024, 3:54pm UTC](https://forum.inductiveautomation.com/t/21cfrpart11-pharma/85304/5 "2024-02-07T15:54:16Z")
I see in our [documentation](https://docs.inductiveautomation.com/display/DOC81/Auditing+Actions+Reference) that we log audit events for "creating, editing, or deleting a user". Can you confirm that this does not occur? What version of Ignition are you using? Are you using the internal Ignition identity provider or external? ---
**Author:** ![kar\_las](https://avatars.discourse-cdn.com/v4/letter/k/b77776/32.png) [@kar\_las](https://forum.inductiveautomation.com/u/kar_las)\ **Post date:** [February 10, 2024, 1:25pm UTC](https://forum.inductiveautomation.com/t/21cfrpart11-pharma/85304/6 "2024-02-10T13:25:09Z")
Hi, Thank you, Yes, it is available. I think we may need to put little effort into capturing the exact modifications done in the user management components instead of common naming 'edited". Can we bring the Password Policies Properties of the gateway to vision screens for user configuration? ---
**Author:** ![Chris\_Nathan](https://sea1.discourse-cdn.com/inductiveautomation/user_avatar/forum.inductiveautomation.com/chris_nathan/32/45712_2.png) [@Chris\_Nathan](https://forum.inductiveautomation.com/u/Chris_Nathan)\ **Post date:** [February 14, 2024, 7:52pm UTC](https://forum.inductiveautomation.com/t/21cfrpart11-pharma/85304/7 "2024-02-14T19:52:28Z")
At this time, we have no plans to further enhance the functionality of the User Management component (where you can manage your users and their roles) nor add any other notable security **configuration** features like this to the designer. I'm sure there are some security implications in play here as well, but ultimately we often have to ask ourselves _should that be configurable in the designer/in a client session or only configurable in the gateway webpage_? For frequent activities (such as manipulating users and their roles) we will build that functionality out into the designer (hence the User Management component) but oftentimes we intentionally reserve a lot of configuration operations to be performed in the gateway webpage.