Framework overlap

Does AWS Well-Architected Security Pillar cover FDA 21 CFR Part 11?

You hold AWS Well-Architected Security Pillar and have been told to do FDA 21 CFR Part 11. Here is how much overlaps, control by control.

54% of FDA 21 CFR Part 11 you already have

AWS Well-Architected Security Pillar already covers about 54% of FDA 21 CFR Part 11, leaving 6 of 13 controls as genuinely new work.

Already covered 6 Likely covered 1 New work 6

What is genuinely new work

Nothing in AWS Well-Architected Security Pillar reaches these. This is the list to scope.

Part11.100
Electronic signatures - general requirements (21 CFR §11.100)
Part11.200
Electronic signature components and controls (21 CFR §11.200)
Part11.50_70
Signature manifestations + signature / record linking (21 CFR §§11.50 + 11.70)
Part11.Definitions
Definitions (21 CFR §11.3)
Part11.Scope
Scope and implementation (21 CFR §§11.1-11.2)
Part11.Status
21 CFR Part 11 - corpus status, FDA enforcement landscape, CSA transition
Show the 7 you already have
Part11.30
Controls for open systems (21 CFR §11.30)
Part11.300
Controls for identification codes and passwords (21 CFR §11.300)
Part11.AccessAndAuth
Access control + authority + device checks (21 CFR §11.10(d) + (f) + (g) + (h))
Part11.AuditTrail
Audit trail requirements - secure computer-generated time-stamped (21 CFR §11.10(e))
Part11.CSV
Computer system validation + risk-based approach (21 CFR §11.10(a) + 2003 FDA Scope and Application Guidance + 2023 CSA draft)
Part11.RecordRetention
Record protection + retention + readiness for inspection (21 CFR §11.10(b) + (c))
Part11.10
Controls for closed systems (21 CFR §11.10)

How this is calculated

Already covered means a mapping runs from a control in AWS Well-Architected Security Pillar to that control. Likely covered means no direct mapping exists but both frameworks map to the same control in a third standard. New work means neither. We keep those separate rather than adding them into one friendlier number, because blending them would present a two-hop inference as a verified fact.

Coverage is not symmetric. Run it the other way and you will get a different number; both are correct.

From 332,959 cross-framework control mappings across 723 frameworks, 531 of them verified against their source documents. It does not tell you that you are compliant: a mapped control means the two standards ask for the same thing, not that you have done it.

Try another pair · Today's edition