--- title: 3 Steps to Annex 11 and 21 CFR Part 11 Compliance description: In this blog we present a 3 step approach to demonstrating compliance with 21 CFR Part 11 and Annex 11 image: https://blog.montrium.com/hubfs/Blog/paper-struggles.jpg --- [![Montrium-header-logo](https://blog.montrium.com/hs-fs/hubfs/2%20-%20Logos/Header-Logo.png?width=166&name=Header-Logo.png "Header-Logo")](https://www.montrium.com) - [Products](https://www.montrium.com) - [Platform Overview](https://www.montrium.com/platform-overview) - [eTMF Connect](https://www.montrium.com/etmf-connect) - [RegDocs Connect](https://www.montrium.com/regdocs-connect) - [Quality Connect](https://www.montrium.com/quality-management) - [Demo Center](https://www.montrium.com/demo-center) - [Pricing](https://www.montrium.com/pricing) - [Adobe Services](https://www.montrium.com/adobe-sign-validation-services) - [Insights](https://www.montrium.com/resource-center) - [Connect Blog](https://blog.montrium.com/blog) - [The Experts Blog](https://blog.montrium.com/experts) - [Knowledge Center](https://www.montrium.com/resource-center) - [Webinars](https://www.montrium.com/webinars) - [Demo Center](https://www.montrium.com/demo-center) - [News & Press](https://www.montrium.com/newsroom) - [Conferences & Events](https://www.montrium.com/events-conferences) - [About](https://www.montrium.com/about) - [Our Company](https://www.montrium.com/about) - [Our Customers](https://www.montrium.com/customers) - [Careers](https://www.montrium.com/careers) - [Contact Us](https://www.montrium.com/contact-us) - [Request Demo](https://www.montrium.com/demo) # 3 Steps to Annex 11 and 21 CFR Part 11 Compliance by [Gianna De Rubertis](https://blog.montrium.com/experts/author/gianna-de-rubertis) [Regulations & Standards](https://blog.montrium.com/experts/topic/regulations-standards) Organizations that wish to do business and obtain market approval in both the EU and USA must abide by the requirements of Eudralex Annex 11 and FDA 21 CFR Part 11 respectively. In this blog (a section from our [popular Part 11 vs Annex 11 whitepaper](https://info.montrium.com/whitepaper-approaching-compliance-with-21-cfr-part-11-and-annex-11)), we present a standard approach to demonstrating compliance with both these regulatory directives. ## Step 1. Perform a gap assessment Assess the environment in which the computer system will be used.  Identify the procedural and technical controls which must be in place to ensure the regulatory expectations are met.  Begin with the regulatory mapping (provided in Table 1 of our new whitepaper - [Approaching Compliance with 21 CFR Part 11 and Annex 11](https://info.montrium.com/whitepaper-approaching-compliance-with-21-cfr-part-11-and-annex-11)), then build on this table by describing how the system can (or cannot) meet each regulatory requirement.  ## Step 2. Plan and implement mitigation activities Within the assessment, you may find that the system is incapable of meeting regulatory requirements (either technically or via procedural controls).  Mitigation activities must be planned and implemented to close the identified “gaps”.  Some examples of mitigation activities are presented in Table 3.   | **Example Identified Gap** | **Example Mitigation Activity** | | --- | --- | | Daily backup jobs do not run on the system. | The system must be added to data backup schedules. Standard Operating Procedures (SOPs) for data backup and retention need to be updated to capture the system within scope. | | System does not have a built-in user authentication process. | Integrate the system with a third-party user authentication and management system. Validate this system integration. | | Underlying infrastructure is not qualified. | For on-premise systems: qualify the infrastructure. For hosted (SaaS) systems: perform a supplier assessment to evaluate the capabilities of the supplier. | At a minimum, system validation should always be identified as a mitigation activity.  The validation strategy should be tailored to the complexity and criticality of the system (see Step 3). ## Step 3. Validate the computer system following the GAMP® 5 approach While Annex 11 provides some how-to guidance on implementing regulations, the industry has accepted publications such as ISPE’s GAMP® 5 to provide detailed recommendations on how to implement computerized systems for GxP compliant environments.  GAMP® 5 defines the industry’s standard framework for risk-based validation. As shown in Table 4, if one is willing to tolerate some minor variations between wordings, definitions and structures, the GAMP® 5 validation approach can result in compliance with both Annex 11 and 21 CFR Part 11. It is worth noting that a supplier cannot sell a “validated system” as validation requires demonstration that the system performs as intended **in its actual environment**. Moreover, a supplier cannot sell a system that is certified as Annex 11 or 21 CFR Part 11 compliant. The supplier can only provide the functionality that enables compliance; system compliance and validation ultimately remain the responsibility of the regulated user of the system. For more on where the two directives intersect. [Check out our whitepaper below](https://info.montrium.com/whitepaper-approaching-compliance-with-21-cfr-part-11-and-annex-11)! [![Where do Annex 11 and Part 11 intersect?](https://no-cache.hubspot.com/cta/default/334618/0fa024c1-efae-478c-aa0b-48957a794833.png)](https://cta-redirect.hubspot.com/cta/redirect/334618/0fa024c1-efae-478c-aa0b-48957a794833) This article is part of a recent whitepaper titled "[Approaching Compliance with 21 CFR Part 11 & Annex 11: A Practical Guide](https://info.montrium.com/whitepaper-approaching-compliance-with-21-cfr-part-11-and-annex-11)" and is a product of contributions from several Montrium consultants.   By [Gianna De Rubertis](https://blog.montrium.com/experts/author/gianna-de-rubertis) | March 16, 2015 at 8:30 AM | [Regulations & Standards](https://blog.montrium.com/experts/topic/regulations-standards) | [0 Comments](https://blog.montrium.com/experts/3-steps-to-becoming-annex-11-and-21-cfr-part-11-compliant#comments-listing) #### Share This Story, Choose Your Platform! - [Tweet](https://twitter.com/share) ### About the Author: [Gianna De Rubertis](https://blog.montrium.com/experts/author/gianna-de-rubertis) ![](https://blog.montrium.com/hubfs/gianna%20copy_150x150.png) Gianna is the Director of the Professional Services team and is responsible for in-house verification projects as well as validation services provided to external clients. She has extensive validation experience, which includes validation of manufacturing equipment, utilities, and computerized systems (including ERP, EDMS, and eSignature solutions). Gianna has also developed a solid understanding of the various regulations which apply to the pharmaceutical, biotech and device industries. [Facebook](http://www.facebook.com/montrium) [LinkedIn](http://ca.linkedin.com/pub/gianna-de-rubertis/1a/16b/744) [Twitter](https://www.twitter.com/montrium) ### Related posts [![How to Navigate Controls for Advanced Data Governance in Office 365](https://blog.montrium.com/hubfs/How%20to%20Navigate%20Controls%20for%20Advanced%20Data%20Governance%20in%20Office%20365.jpg)](https://blog.montrium.com/experts/how-to-navigate-controls-for-advanced-data-governance-in-office-365) #### [How to Navigate Controls for Advanced Data Governance in Office 365](https://blog.montrium.com/experts/how-to-navigate-controls-for-advanced-data-governance-in-office-365) [![Business Performance Enhancements Series – How to Get Started With Flow and SharePoint Online](https://blog.montrium.com/hubfs/Blog-CTA---Business-Process-Enhancements.jpg)](https://blog.montrium.com/experts/business-performance-enhancements-series-how-to-get-started-with-flow-and-sharepoint-online) #### [Business Performance Enhancements Series – How to Get Started With Flow and SharePoint Online](https://blog.montrium.com/experts/business-performance-enhancements-series-how-to-get-started-with-flow-and-sharepoint-online) [![What You Should Know About Continuous Validation in Office 365](https://blog.montrium.com/hubfs/11%20-%20Images/CTAs/Blog-Featured-image---What-you-should-know-about-CVaaS.jpg)](https://blog.montrium.com/experts/continuous-validation-in-office-365) #### [What You Should Know About Continuous Validation in Office 365](https://blog.montrium.com/experts/continuous-validation-in-office-365) [![Why You Need to Validate (and Re-Validate) a Cloud-Based System](https://blog.montrium.com/hubfs/CTA_Why%20You%20Need%20to%20Validate%20(and%20Re-Validate)%20a%20Cloud-Based%20System.jpg)](https://blog.montrium.com/experts/why-you-need-to-validate-and-re-validate-a-cloud-based-system) #### [Why You Need to Validate (and Re-Validate) a Cloud-Based System](https://blog.montrium.com/experts/why-you-need-to-validate-and-re-validate-a-cloud-based-system)  [![Request a demo - Montrium](https://no-cache.hubspot.com/cta/default/334618/946f729b-e75e-4ce4-840f-30b279eb83cc.png)](https://cta-redirect.hubspot.com/cta/redirect/334618/946f729b-e75e-4ce4-840f-30b279eb83cc) ### Recent Posts #### NEWSLETTER SIGNUP - PRODUCTS - [Clinical Solutions](https://www.montrium.com/etmf-connect) - [Regulatory Solutions](https://www.montrium.com/regdocs-connect) - [Quality Solutions](https://www.montrium.com/quality-connect) - Adobe - [Adobe Validation Services](https://www.montrium.com/adobe-sign-validation-services) - [Adobe Acrobat Sign Validation Pack](https://www.montrium.com/adobe-sign-validation-pack) - COMPANY - [About Us](https://www.montrium.com/about) - [Careers](https://www.montrium.com/careers) - [Blog](https://blog.montrium.com/blog) [![Montrium-Logo_email header](https://blog.montrium.com/hs-fs/hubfs/2%20-%20Branding/Current%20Montrium%20Logos/Montrium-Logo_email%20header.png?width=353&name=Montrium-Logo_email%20header.png)](https://www.montrium.com/) Montrium is a knowledge based company, that focuses on leveraging its deep understanding of GxP processes and technologies to provide cost-effective solutions to life science organizations. Copyright 2026 Montrium Inc | All Rights Reserved | [Privacy Policy](https://www.montrium.com/privacy-policy) | [Terms & Conditions](https://www.montrium.com//terms-conditions) - [](http://www.facebook.com/Montrium) - [](http://www.twitter.com/Montrium) - [](http://www.youtube.com/user/Montrium) - [](https://plus.google.com/+Montrium) - [](http://www.linkedin.com/company/montrium) - [](mailto:info@montrium.com) ![](https://dc.ads.linkedin.com/collect/?pid=568201&fmt=gif)