Security, Access Control, and Audit Trails
What you must know
Security protects confidentiality, integrity, and availability of trial data. Access control ensures users see only what their role requires (least privilege). Audit trails record every create, modify, and delete action with user, timestamp, and reason.
Concepts to master
Know role-based access control (RBAC) and the principle of least privilege. Understand that unique user IDs are required and shared accounts are prohibited under Part 11. Know that audit trails must be retained for the record retention period and be available for inspection. Recognize the importance of password policies, session timeouts, and encryption in transit and at rest.
Traps
Questions often imply that an administrator can edit or delete audit trail entries. Watch for shared logins presented as acceptable for convenience. Another trap: assuming audit trails are only needed for final data, not for intermediate changes.
Rule of thumb
If a user can change data without leaving a trace, the system fails Part 11. Test the audit trail by making a change, then verifying the entry captures user, time, old value, new value, and reason.