Can any provide their 21CFR Part 11 template or SOP (with company name crossed out) detailing stuff like who's authorized to use such information, when passwords need to be changed, how many characters, time out length, location of "archive", backup plan, etc., etc., etc.? The FDA sure doesn't make it clear. It seems like non-value added for everyone to do this from scratch....

All your questions are answered in 21CFR Patr 11.

In response to Anonymous2 - not everything is in there - specifically the things asked for. From this, you can imply that it is up to the individual company to decide what is appropriate.
Therefore, the problem with using another companies procedures would be that you would then have to justify why YOU chose those parameters.

General things are names unique, generally around 8 characters. Passwords: combination of letters and numbers at least 8 characters. Should be changed every 90days or if believe they have become known to someone else. Accounts lock out after 3 incorrect attempts (counter resets after 1 hour or so). Backup - depends what is on your ERec system and what/when changes occur, but generally a backup each working day is sufficient (if using Oracle databases, there are backup packages which work without having to take the database off-line so work can continue). Archiving of data is only really needed to improve system performance - the more data on the system the worse the performance will get. Archives can be in the same place as the original data, provided the system does a backup of the archive too. Backups should be stored in a secure, fireproof location away from the original system (i.e. don't keep backup tapes in a server room).

You should evaluate each ERES system against 21CFR11, but this is only really necessary if that system produces data for products going to the US (though of course it is still good practice to do it anyway).

I am unable to provide you with my companies policies and guidelines on 21CFR11. However, this web site might help:-

http://www.21cfrpart11.com/

Also, many companies such as Varian, Sievers, Agilent and others provide their interpretation of 21CFR11 on their web sites. They seem to be fairly consistent in their understanding.

The Legal, Quality and IT departments of your company should evaluate the ruling (which came out 5 years ago)and provide your company with the interpretation and guidance that you need.

The specifics that Tim refers to are fairly generic but you need to be in a position to defend your position to the FDA - don`t simply implement what others tell you without having developed a justification.

You should understand that the FDA are only fairly recently auditing companies against the ruling - the industries understanding will no doubt improve as we see what 483s are issued for non-compliance.

You should look at GMP Trends and Gold Sheet publications if you can get hold of them.

Good luck - we all need it.