/ GxP / 21 CFR Part 11 coverage

GxP change control for PLC without the audit-week scramble

Approval, deployment and audit of every PLC, SCADA and HMI change — aligned to GxP / 21 CFR Part 11 from day one, generated as a by-product of the work, not assembled the week before the audit.

/ 01Scope

What counts as an OT change

/ Change type

PLC code

Logic edits, routine changes, function-block swaps, firmware updates.

/ Change type

SCADA tags

Point database additions, alarm threshold edits, scaling changes.

/ Change type

HMI graphics

Screen layout, button bindings, operator permission scopes.

/ Change type

Recipes

Production recipes, setpoints, batch parameters, ingredient lists.

/ Change type

Machine parameters

Drive parameters, IO config, safety thresholds, network topology.

/ 02GxP / 21 CFR Part 11

How VEM aligns to GxP / 21 CFR Part 11

21 CFR Part 11 requires electronic records to be attributable, legible, contemporaneous, original and accurate — and electronic signatures to be unique to the signer and inseparable from the record. VEM applies cryptographic signatures to every captured controller state, binds the signature to an authenticated user, and locks the audit trail against retroactive edit. EU Annex 11 expectations on validated change control, risk-based review and full traceability map directly onto the same workflow. See the broader the complete OT change management guide for the cross-regime crosswalk.

/ Use case

A sterile-fill manufacturer running 11 packaging lines uses VEM as the system of record for every PLC and HMI change in the GMP boundary. When an FDA inspector pulled a 12-month sample of recipe changes during a routine inspection, every sampled change produced an electronically signed record with the requester, approver, diff and deployment timestamp on a single PDF.

/ 03Process

Request → Review → Deploy → Audit

/ 01

Request

Engineer files a change with the proposed diff attached.

/ 02

Review

CAB or single approver reviews the diff, risk and deployment plan.

/ 03

Deploy

VEM pushes the approved version, captures before/after signatures.

/ 04

Audit

Immutable record links request, approval, diff and deployment.

/ 04Compliance

Other regimes covered

Want the full framework? the complete OT change management guide.

/ 05FAQ

GxP / 21 CFR Part 11 change management — common questions

Make GxP / 21 CFR Part 11 change evidence a by-product, not a project.

Book a demo →