CDS password updates

[JA]

Our laboratory chromatographic instruments are comprised of Waters Alliances running Empower 2 and Agilent 1100s running an older version of Chemstation with Chemstore. These, and the rest of our instruments are all on an "Analytical Network" which is completely independent of our corporate network and not at all accessible from the outside world.

We are forced by the system policies in the CDS to update our login passwords on a regular basis. Under this restriction, when you change one you're best to go around the entire lab logging in to each and every database (especially with Agilent's Chemstore) on each PC to ensure consistency. We have a corporate policy to update our company network passwords every three months but I am not clear if this actually applies to the Analytical network.

What are your opinions, with reference to 21CFR11 compliance, on the necessity to update CDS passwords on a regular basis?

[DR]

Regardless of your CFR concerns (which your IT department probably does not care about when they write their password rules), it would probably be a good idea to come up with a password that can have enough required character types etc. that fits the rules for all of your systems and can be incremented by altering the digits embedded in it.

Then all you have to do is remember what the current number is and you can use the same password for everything you log into.

[JA]

DR,
I think you may have missed the point of my post and the question contained therein. I made no mention of it, but passwords on both the corporate and analytical networks have to satisfy complexity requirements: length, upper and lower case, numerals, and optional symbols.

I'll cut to the chase: I'm sick of the revolving analytical network passwords which require us not only to revise them on a regular basis but go around every machine to perform the update. I personally don't see the significance of updating one's password on an isolated network which is only accessible by physically being on site. The analytical laboratory and premises in general are areas restricted by magnetic code keys or "pogs".

I put the question out there firstly to see if other labs have the same password updating procedure and secondly to see if it was actually a compliance requirement.

[lmh]

Just a malicious suggestion: complain to your human resources department that in making such password requirements, the computing staff are being discriminatory against you on the grounds of having an auditory memory (rather than visual) that cannot differentiate between upper and lowercase letters.

Then keep a low profile and enjoy the fun...

Incidentally, I agree: I'd love to know how many hours of instrument time are wasted by over-enthusiastic security measures compared to how many hours are trashed by people getting through your password security.

[DR]

As long as these analytical PCs are not only physically isolated and secure, and they're isolated from the rest of the computer network (as in you can't remote to them, login and do stuff), I would see no reason to require separate passwords - except where required for 21CFR part 11 signature generation concerns - but then, I'm not an IT person.