What is 21 CFR in SCADA and HMI Systems?

 In this article, we will learn the concept of 21CFR in SCADA and HMI automation systems.

SCADA systems are designed to control and view the operation of a machine or plant in a controlled and efficient manner.

As more and more industries are adopting SCADA in their automation integration, some industries are such which require strict adherence to standards and norms for running a system.

What is 21 CFR in SCADA?

Majorly, they are food and pharmaceuticals. In every country, the FDA (Food & Drug Administration) regulatory board generates this compliance standard for a system to run. Without this compliance, a system cannot be passed to operate. This compliance is called 21 CFR Part Compliance.

CFR stands for Code of Federal Regulations.

Almost all the SCADA systems have this facility of 21 CFR inbuilt in them fully or partially. Partially means some coding needs to be done by the programmer to achieve the remaining points.

21 CFR System

A proper 21 CFR system ensures that the machine is running under proper regulations, rules, and standards.

The main criteria which make it trustworthy are that it records data with electronic signatures which are more accurate as compared to handwritten records on paper.

Let us see the general topics of 21FCR which are covered in SCADA systems.

User Management

It is the key feature of 21FCR. Basically, it monitors and controls the activity of the operator who is operating the system.

In SCADA systems, there are multiple set parameters. It must be ensured that each and every parameter be given its corresponding user level to operate.

A higher-level group must have the authority to create and delete users of other groups. Activities like cut, copy, paste, delete, etc. of files must not be given to unauthorized users.

Password Policy

 All the accounts and users must be password protected. There must be password setting criteria in the system; like minimum characters, types of characters, password length etc.

The last 5 passwords (just an example) shall not be allowed. The password should not be the same as the User ID. After the generation of a user ID, the system shall always ask to change the password on the first attempt of login.

Only a higher-level group can block or unblock a user. The system should automatically limit and record the number of failed login attempts.

The users must be asked to change at regular intervals after the password expiry date has been achieved; but before changing, they must be prompted a few days back that the password is about to expire.

Audit Trail

Basically, one of the purposes of 21 CFR is to track all the modifications performed in a SCADA system. This is called an audit trail.

All the modifications must be recorded with the proper date and time stamp. And this audit trail should not be editable at all. One more feature is of electronic signature.

Before modifying every parameter, an electronic signature is to be made so that the system can identify who was the user.

Electronic Data and its Storage

As data is an important part of 21 CFR, its security and storage access is also an important factor.

Only authorized users must have access to file storage paths in the SCADA computer. The data which has been generated should not be editable. Disk partitions in the PC must be made appropriately so that data storage happens properly.

Apart from these, there are some other general parameters too. When a data report is generated, it should have the name of the operator who has generated the report as well as the date and time.

Before modifying any parameter, it should ask a reason for changing the parameter. Without entering the reason, the operator cannot edit the parameter.

File storage access must be limited to only authorized users. All the alarms and events must be captured properly with the date and time stamps.

The sole purpose of the 21 CFR standard is to maintain the authenticity of the system. As food and drugs are a very critical sector, a proper audit of these systems is a must.