Access control · Lockout register · Credential lifecycle
User access management for accountable GxP records.
Give each person their own account and role, and keep a record of access changes for review.
Forced Password Change on First Sign-In
Every administrator-issued credential is temporary pairing.
Lockout and Access Register
Filter for locked now, must-change-password, never signed in, password overdue.
Admin-mediated recovery for accounts without email
IT Admin verifies identity in person or by callback, records the verification method and reason, e-signs, and issues a one-time password or PIN that…
What goes wrong today3 common problems
Administrators know their users' passwords
If an admin sets a password that is never forced to change, that admin can produce another person's electronic signature. §11.300(a) uniqueness fails in practice, however good the policy document reads.
Kiosk operators have no inbox to reset to
Email-link password reset assumes a mailbox. Line operators created for kiosk sign-in have none, so lockouts stall production until someone improvises.
Sign-in history is incomplete or invisible
Auth events recorded against the wrong site, or hidden behind an owner-only permission, mean the credential record you rely on at inspection is not the one that exists.
Everything V5 does here6 capabilities
Forced Password Change on First Sign-In
Every administrator-issued credential is temporary pairing. The user must set their own password before any signable action, so no administrator retains a credential that can sign as someone else.
Lockout and Access Register
Filter for locked now, must-change-password, never signed in, password overdue.
Admin-mediated recovery for accounts without email
IT Admin verifies identity in person or by callback, records the verification method and reason, e-signs, and issues a one-time password or PIN that expires in 24 hours and forces a change at first use. Fully audited — no shared credential, no mailbox required.
Optional Recovery Questions, Honestly Framed
Hashed, rate-limited knowledge answers can be switched on per site as a convenience path that only ever grants a forced password change, never a session. Regulators treat knowledge-based answers as weak, so the admin-mediated path stays the control you point an auditor at.
Deliberate Lock, Disable and Leaver Handling
Suspend or disable an account with a mandatory reason and e-signature — indefinitely or until a date. Sign-in and PIN entry are blocked immediately, while historic signatures and records stay intact. Deactivation is never deletion.
One credential timeline per user
Sign-ins, lockouts, unlocks, admin resets and forced changes read as a single chronological history with the site each event happened in — the whole credential lifecycle in one place.
Standards Referenced
- 21 CFR Part 11 §11.10(d), (g) (limited system access, authority checks)
- 21 CFR Part 11 §11.300(a)–(d) (identification code / password controls)
- EU GMP Annex 11 §12 (security)
- MHRA GxP Data Integrity Guidance (2018)
- NIST SP 800-63B (authenticator and recovery guidance)
Common questions5 answers
- What is user access management software in a GxP context?
- It controls who holds an account, what they are allowed to do, how their credential is issued and recovered, and how every one of those events is recorded. Under 21 CFR Part 11 the credential is the signature, so access management is a compliance control rather than an IT convenience.
- How do you reset a password for an operator with no email address?
- An IT Admin verifies the operator's identity in person, by badge or by phone callback, records the verification method and a reason, e-signs the action, and issues a one-time password or PIN valid for 24 hours that forces a change at first sign-in. The whole sequence appears in that user's history.
- Does an administrator ever know a user's working password?
- No. Anything an administrator sets is temporary and must be replaced by the user before they can sign anything, which keeps signature uniqueness intact under §11.300.
- Can IT Admins manage lockouts, or only the account owner?
- IT Admin is a first-class role for user, device and access administration — it can view sign-in history, see the lockout register, unlock, force a reset and disable accounts, each with reason and e-signature.
- What does the auditor actually get shown?
- The access register for the site plus the credential timeline for any named user: issue, first-login change, sign-ins, failures, lockouts, unlocks with reason and signature, disables and leaver actions.