Par 2-1 Page 7 CHAPTER 2. ELECTRONIC SIGNATURES
2-1. ELECTRONIC SIGNATURE. The U.S. Electronic Signatures in Global and National Commerce Act (Public Law (PL) 106-229 (also known as E-Sign)) defines an electronic signature as an “…electronic sound, symbol, or process, attached to or logically associated with a contract or other record and executed or adopted by a person with the intent to sign the record.”
NOTE: Throughout this AC, the term “electronic signature” refers to either electronic signatures or digital signatures. The specific electronic signature used depends on the end user’s preference and the system application.
a. General. The electronic signature’s purpose is identical to that of a handwritten signature or any other form of signature currently accepted or approved by the FAA; therefore, electronic signatures must possess those qualities and attributes that guarantee a handwritten signature’s authenticity.
NOTE: Electronic signatures should only be used to satisfy requirements relating to this AC. They may not be considered acceptable in other areas covered by 14 CFR having more specific applicability (e.g., legal depositions).
b. Types of Electronic Signatures. Electronic signatures may appear in various formats.
No matter the format, they must meet the legal requirements of electronic signing that appear in subparagraph 2-1c. Examples of electronic signature formats include, but are not limited to:
• A digitized image of a handwritten signature that is attached to an electronic record;
• An electronic code (e.g., a secret code, password, or personal identification number (PIN)) used by a person to sign the electronic record;
• A unique biometrics-based identifier, such as a fingerprint, voice print, or a retinal scan; or
• A digital signature.
c. Electronic Signature Standards. Electronic signatures should meet the following criteria to be considered legally binding.
(1) A person (the signer) must use an acceptable electronic form of signature.
(2) The signature must be unique to the signatory.
(3) There must be a means to identify and authenticate a particular person as the signer.
(4) The electronic form of signature must be executed or adopted by a person with the intent to sign the electronic record to indicate a person’s approval or affirmation of the information contained in the electronic record.
(5) The electronic form of signature must be attached to or associated with the electronic record being signed.
Par 2-1 Page 8
(6) The signature must be permanent and the information to which it is attached must be unalterable without a new signature.
(7) There must be a means to preserve the integrity of the signed record.
(8) A valid electronic signature must prevent the signatory from denying that he or she affixed a signature to a specific record, document, or body of data (non-repudiation).
d. Digital Electronic Signatures. Digital signatures are electronic signatures that incorporate encryption and decryption technology. Digital signatures that use this technology are typically the most secure because of the controls that are inherent with the technology itself.
(1) Digital Cryptography. Digital signature technology is based on Public and Private Key Infrastructure (PKI) cryptography. PKI cryptography is a class of cryptographic algorithms which require two separate keys, one of which is secret (private) and one of which is public.
Although different, the two parts of this key pair are mathematically linked. The public key is used to encrypt plain text or to verify a digital signature, whereas the private key is used to decrypt cipher text and to create a digital signature. To ensure the authenticity of a digital signature, PKI must incorporate the use of a digital certificate to authenticate the signatory’s identity. A digital certificate is issued by a trusted third party to establish the identity of the signatory. The third party who issues the digital certificate is known as a certificate authority (CA). The CA assumes the responsibility and liability of vouching for an individual’s identity.
(a) Public Key. A public key in a digital signature encrypts the digital signature itself and essentially converts it to a series of numbers and letters that are nearly impossible to duplicate. The encrypted data in a digital signature public key can be accessed by anybody;
hence the term “public” key. However, only the individual with the private key can turn the encrypted data into a digital signature. Examples of public keys include smart cards, digital tokens, access badges, or a user ID.
(b) Private Key. A Private Key is used by the individual signatory to decrypt the public key data and turn it into a digital signature. Examples of private keys are unique user name/password/access code combinations. A private key must be under the sole control of the person using it. The signatory must keep the private key secret and stored in a protected environment.
(c) Digital Certificate and CA. The digital certificate verifies the signatory. A digital certificate is like an identification card. The CA verifies the signatory’s identity and issues the certificate.
(2) Controls. Digital electronic signatures that use PKI and incorporate digital certificate authentication contain controls that ensure the authenticity of the signature. This technology also ensures the signature is permanently embedded in the document, record, or data in such a way as to render the content unalterable without a new signature.
Par 2-2 Page 9
2-2. ELECTRONIC SIGNATURE PROCESS. A certificate holder’s electronic signature process should describe, contain, or address the following:
a. Uniqueness. An electronic signature is only valid if it is unique to the individual signatory. It should identify a specific individual and be difficult to duplicate.
b. Control. A valid electronic signature must be under the sole control of the signatory and require the signatory to use a unique user name and password to access the system and affix the signature.
c. Notification. The system should notify the signatory that the signature has been affixed.
d. Intent to Sign. The signatory should be prompted before their signature is affixed. The electronic signature block should contain a word or statement of intent that definitively conveys the signatory’s intent to affix his or her signature. Examples of statements that do this include, but are not limited to:
• “Signed by,”
• “Certified by,”
• “Instructor’s signature/certification,”
• “Signature,”
• “Authorized by,”
• “Signatory,”
• “Authentication,”
• “Acknowledged by,”
• “Acknowledgement,” and/or
• “Affirmed by.”
e. Deliberate. An individual using an electronic signature should take deliberate and recognizable action to affix their signature. Acceptable deliberate actions for creating an electronic signature include, but are not limited to, the following:
• Using a digital signature;
• Entering a user name and password;
• Swiping a badge; and/or
• Using an electronic stylus.
f. Signature Association. A signature must be attached to, or logically associated with, the record being signed; otherwise, it is not legally significant. There are two aspects to this issue:
(1) It must be clear to the signatory exactly what it is that they are signing. In an electronic environment, the signer must have an opportunity to review the record before signing it, and to clearly understand the parameters of the record they are signing. It is also critical that the signing process be established in a manner to ensure that the signatory’s electronic signature is applied only to what they can review.
Par 2-2 Page 10
(2) The electronic form of signature applied by the signer must be linked to the record being signed. Satisfying this requirement requires storing the data constituting the electronic form of signature and doing so in a way that permanently associates it with the electronic record that was signed.
g. Retrievable and Traceable. The user should be able to identify and retrieve the documents to which his or her electronic signature has been applied. An electronic signature should provide positive traceability to the individual who signed a record, record entry, or any other document.
h. Undeniable. A valid electronic signature is one that cannot be denied (repudiated) by the signer. An electronic signature process must contain procedures and controls designed to ensure the authenticity of the signature and that the signer cannot deny having affixed the signature to a specific record, document, or body of data.
i. Security Protocols and Prevention of Unauthorized Access and Modification. An electronic signature process must be secure and must prevent unauthorized access to the system that affixes the signature to the intended documents or records. The process must ensure that only the intended signatory can affix his or her signature and must prevent unauthorized individuals from certifying required documents, such as airworthiness or dispatch releases. The process must prevent modifications to information/data or additional entries to records or documents without requiring a new signature. Additionally, the process must contain restrictions and procedures to prohibit the use of an individual’s electronic signature when the individual leaves or terminates employment.
j. Permanent and Unalterable. A valid electronic signature must be a permanent part of the record or document to which it was affixed. The information contained in the record or document must be unalterable without a new signature to validate the alteration.
k. Identification and Authentication. Electronic signature software must have authentication capabilities that can identify a signature as belonging only to a particular signatory. An individual using an electronic signature should be required to use a method of authentication that positively identifies the individual within the electronic signature system.
l. Correctable. An electronic signature process should include a means for a certificate holder to correct records or documents that were electronically signed in error, as well as those documents where a signature is properly affixed but the information or data is in error. An electronic signature should be invalidated any time a superseding entry is made to correct the record or document. The information or signature being corrected should be voided but remain in place. The new information and/or signature should be easily identifiable.
m. Archivable. Since no paper document with an ink signature exists, a means of safely archiving electronically signed documents should be part of any electronic signature computer software.
n. Control of Private Keys and Access Codes. A digital electronic signature process must ensure the private key or access to the electronic system that affixes the signature is under the sole custody of the signatory at all times.
Par 2-2 Page 11
o. Policies and Procedures. When constructing an electronic signature process, the certificate holder’s manual should include the following elements:
(1) Procedures. Procedures should address how the applicable regulatory requirements for their program are met. These procedures should be available to all users of the system.
(2) Description of Electronic Signature Process. A description of the electronic signature process must be included in the certificate holder’s manual. The description should explain how electronic signatures will be used and how electronic signatures are applied throughout the certificate holder’s operation (e.g., dispatch releases, training records, airworthiness releases, and maintenance actions). For parts 91K, 121, 125, and 135, each electronic signature process must be identified by a revision number and date. For a new unrevised process, a certificate holder may identify the revision number as “0” or “Original.” A reference to the process revision number and date, as well as the manual that contains the description of the electronic signature process, will be part of the Operations Specification (OpSpec) A025, Electronic Signatures, Electronic Recordkeeping Systems, and Electronic Manual Systems, authorization. For those certificate holders who are not required to have manuals (e.g., part 135 single pilot and part 141), a standalone electronic signature process document is an acceptable alternative, provided it is in an official document maintained by the certificate holder.
(3) Responsible Personnel. Policies and procedures should identify the certificate holder’s personnel who have the authority and overall responsibility for the integrity and security of the electronic signature process and for controlling access to the computer software/application used in the process. Policies and procedures should also identify the persons with the authority and responsibility for modifying, revising, and monitoring the electronic signature process, as well as ensuring the process is followed by all appropriate personnel.
(4) Identification of Persons Authorized to Use Electronic Signatures. Certificate holders must have a system for identifying who is authorized to use the electronic signature process, for what purposes, and which records.
(5) Description of System Support. Policies and procedures should address system support of any computer hardware or software that is part of the electronic signature process.
(6) Hardware and Software Capabilities. Description(s) of the electronic signature hardware to be used and software capabilities for applications of electronic signatures in the certificate holder’s system(s).
(7) Auditing Process. Electronic signature policies and procedures should include an auditing process to ensure all of the requirements for electronic signatures continue to be met.
The process should include unauthorized event recognition, which includes actions to be taken by the certificate holder upon discovery of an attempt by an unauthorized individual to use an electronic signature.
(8) Process Changes. A certificate holder’s electronic signature process policies and procedures should address how the certificate holder will submit changes to the electronic signature process to the FAA for acceptance. For parts 91K, 121, 125, and 135 operations,
Par 2-2 Page 12 certificate holders will be required to identify changes to the process by revision number and date. This information will become part of the OpSpec A025 authorization. For all operations to which this AC applies, revisions to the electronic signature process must be included in the manual or official document containing the electronic signature process description.
(9) Data Backup and Retention. Policy and procedures should address how data backup and retention of data will be accomplished.
(10) Procedures for Computer System Outages and/or Disaster Recovery. Policy and procedures should address computer system outages (failure of hardware, software, application, network, etc.) or disaster recovery.
(11) Training and User Instructions. A certificate holder’s policies and procedures should include any training and instructions necessary to ensure authorized users understand how to access and properly apply the electronic signature process. Procedures should describe how users are notified of changes to the electronic signature process.
2-3. ELECTRONIC SIGNATURE AUTHORIZATION.
a. Application Submission. Certificate holders should submit their application to use an electronic signature process to the responsible Flight Standards office. The application medium (paper or electronic file) must be acceptable to both the applicant and the FAA. The FAA will review the application package according to the General Process for Approval or Acceptance of Air Operator Applications contained in Order 8900.1, Volume 3, Chapter 1, The General Process for Approval or Acceptance of Air Operator Applications. The FAA will review the application package for accuracy and completeness and discuss any deficiencies with the certificate holder.
The FAA may also notify the certificate holder in writing of any application deficiencies. Before the responsible Flight Standards office accepts the application package, the certificate holder will be required to correct all of the deficiencies. A certificate holder’s application package for authorization to use electronic signatures must include the following:
(1) Letter of Intent. The application must contain the certificate holder’s letter of intent to use electronic signatures.
(a) Estimated Date of Implementation. The letter must include the estimated date on which the certificate holder would like to begin using electronic signatures.
(b) Primary Point of Contact (POC). The letter must include the certificate holder’s primary POC for the electronic signature process application.
(2) A Description of the Proposed Electronic Signature Process. The electronic signature process description must address all of the requirements contained in paragraphs 2-1 and 2-2 of this AC.
(3) The Documents and/or Records That Will Contain an Electronic Signature.
The application must state specifically which documents or records the certificate holder desires to contain an electronic signature.
Par 2-3 Page 13 (and 14)
(4) Manual Containing the Electronic Signature Process. The certificate holder must include a copy of the manual(s) (or document for operations that do not require a manual) that contains the electronic signature process description.
b. Demonstration of the Process. The FAA will require a certificate holder to demonstrate the electronic signature process. The items requiring demonstration will typically include at least the following:
(1) Hardware and Software Capabilities. The certificate holder should demonstrate the actual electronic signing of a document.
(2) Security Protocols and Prevention of Unauthorized Access and Modification.
The certificate holder should demonstrate the following:
(a) How the electronic signature process prevents unauthorized personnel from signing a document or record.
(b) How the process prevents anybody other than the intended signatory to affix his or her signature.
(c) How modifications to a signed document are prevented without a new signature.
(d) How the signature is permanently affixed to the document or record being signed.
(3) Quality Control (QC) Procedures. The certificate holder should demonstrate its QC procedures for ensuring the security and authenticity of electronic signatures.
c. Successful Completion of Application Process for Acceptance and Authorization.
When a certificate holder successfully completes the application and demonstration process, the FAA will accept the electronic signature process and authorize its use by signing and issuing OpSpec A025.
d. Unsuccessful Application. If the certificate holder fails to submit an acceptable application or fails to successfully demonstrate the electronic signature process, the responsible Flight Standards office will reject the application and provide an explanation to the certificate holder in writing.
Par 3-1 Page 15 CHAPTER 3. ELECTRONIC RECORDKEEPING
3-1. ELECTRONIC RECORDS. An electronic record must provide equivalent or better data integrity, accuracy, and accessibility to what would otherwise be provided by a paper record. In general, a record preserves the evidence of an event. It should contain enough information to clearly depict the event that took place. It is the certificate holder’s responsibility to address all 14 CFR requirements for their recordkeeping system(s) applicable to their operation(s).
3-2. FAA STANDARDS FOR ELECTRONIC RECORDS. To be considered complete and valid, an electronic record should contain at least the following information:
• The type of event that took place (e.g., training, maintenance performed, signing of a release, conduct of a flight, etc.);
• For a training event, information that shows compliance with regulatory requirements, such as the name of the course module or subject, the number of hours of instruction, whether the student passed or failed, etc.;
• When the event took place (e.g., the date and time (where appropriate));
• Where the event took place (e.g., the station, training facility, maintenance facility, etc.);
• Who was involved in the event (e.g., crewmember, dispatcher, instructor, mechanic, etc.);
• Aircraft type and registration number for pilot logbook records (when required by regulation);
• Certification, verification, or authentication of the event, such as a signature, where required by regulation; and
• Applicable aircraft, airframe, engine, propeller, appliance, component, or part make and model (M/M) for maintenance records, such as life-limited parts and time-in-service records.
3-3. ELECTRONIC RECORDKEEPING SYSTEM. Electronic recordkeeping system(s) should include the following elements:
a. Security.
(1) The system should protect confidential information.
(2) The system must ensure that the information in an electronic record is not altered in an unauthorized way.
(3) The system must provide for secure access and contain safeguards against unauthorized access.
b. Procedures. Electronic recordkeeping system procedures must be incorporated into the certificate holder’s manual system. For those certificate holders who are not required to have manuals (e.g., 14 CFR part 135 single pilot and 14 CFR part 141), a standalone electronic recordkeeping system procedures document is an acceptable alternative, provided it is an official document maintained by the certificate holder. Procedures should include at least the following:
Par 3-3 Page 16
(1) Procedures for Making Required Records Available to FAA and National Transportation Safety Board (NTSB) Personnel. A certificate holder must provide its records in a format and manner that is acceptable to the requesting agency. FAA personnel assigned to a certificate holder with an electronic recordkeeping system may request a certificate holder to provide direct access to the electronic system for the purpose of inspecting regulatory records.
Providing this direct access to the FAA is voluntary. The FAA will not request direct electronic access to records beyond those that are required by regulation and authorized in Operations Specification (OpSpec) A025, Electronic Signatures, Electronic Recordkeeping Systems, and Electronic Manual Systems. It is important to distinguish a certificate holder’s voluntary provision of direct access to its electronic recordkeeping system to the FAA from the certificate holder’s responsibility to make regulatory records available to the FAA in accordance with 14 CFR part 119, § 119.59(c). In accordance with this regulation, each employee of, or person used by, the certificate holder who is responsible for maintaining the certificate holder’s regulatory records (those required under Title 49 of the United States Code (49 U.S.C.)
applicable to the operation of the certificate holder) must make those records available to the Administrator.
(2) Quality Control (QC). The system should have procedures for auditing the computer system periodically to ensure the quality, integrity, and accuracy of the system. If workstations are server-based and contain no inherent attributes that enable or disable access, there is no need for each workstation to be audited. (A record of the audit should be completed and retained on file as part of the certificate holder’s record retention requirements. This audit may be a computer program that automatically audits itself.)
(3) Maintenance Support and Backup Measures. The system should include procedures for maintenance and support that include provisions for electronic system (computer hardware, software, application network, etc.) outages and protect against the loss of record data.
The system should also include backup measures to maintain and provide access to records in the event of a system failure. The backup system may be a separate electronic system, a backup server, or backup drive. Backup can also include media such as print or CD-ROM, external drive, or other media acceptable to the FAA.
(4) Record Transfer. Procedures should ensure that records transferred with an aircraft (either electronic or on paper) meet regulatory requirements (i.e., 14 CFR part 43, § 43.10;
part 91, § 91.419; part 121, § 121.380a; and part 135, § 135.441).
(5) Persons with Authorized Access. The system procedures should contain guidelines for authorized representatives of the certificate holder to use electronic recordkeeping and to have access to the appropriate records (each representative with authorization to make entries shall be issued a unique individual access code and password in order to validate the entry). In particular, procedures should specifically address instructor, evaluator, and supervisor access to the system.
(6) Electronic Authentication, Signature, Validation, or Endorsement. Most records required by 14 CFR require some kind of validation, such as a signature, certification, endorsement, or authentication. This validation must be a permanent part of any electronic record. Any electronic form of validation must meet the legal requirements of electronic signing
Par 3-3 Page 17 as outlined in this AC. The certificate holder must also have authorization to use an electronic signature in OpSpec A025.
(7) Training and User Instructions. Each electronic recordkeeping system should contain training and user instructions for the persons responsible for entering, maintaining, and retrieving data from the system. Training should include security awareness and system integrity, as well as procedures that are necessary to authorize access to the electronic recordkeeping system. User instructions should include those for FAA personnel who are provided direct access to the system.
(8) Transferring Data. Technological advances may make it desirable or necessary for a certificate holder to update its electronic recordkeeping system or transfer data to a new system. The certificate holder must have policies and procedures that ensure the continued integrity of record data when a certificate holder moves records from one system to another. This could entail running redundant systems for a brief period of time.
(9) Continuity of Data Between Legacy and Electronic Systems. The system should have a method of ensuring continuity of data during transition from a legacy (hardcopy) system to an electronic system.
(10) Continuity of Records for Maintenance Providers. Procedures should ensure continuity with maintenance providers. Certificate holders must ensure there is continuity between their program(s) and their maintenance provider’s programs. This is necessary to ensure the quality and integrity of each record that is maintained via the electronic recordkeeping system.
c. Responsible Personnel. Policies and procedures should identify the certificate holder’s personnel who have the authority and overall responsibility for the integrity and security of the electronic recordkeeping system and who are responsible for controlling access to the system.
Policies and procedures should also identify the persons with the authority and responsibility for modifying the electronic recordkeeping system, as well as those who are responsible for entering data into the system.
d. Description of Electronic Recordkeeping System(s). There may be more than one system required to maintain various kinds of records. Each electronic recordkeeping system used by the certificate holder must be described in its manual. The manual containing the description will be included in the OpSpec A025 authorization for parts 91K, 121, 125, and 135. For those certificate holders who are not required to have a manual, a standalone electronic recordkeeping system procedures document is an acceptable alternative, provided it is an official document maintained by the certificate holder. Each electronic recordkeeping system description should address the information and elements contained in paragraphs 3-1, 3-2, and 3-3 of this AC, as well as the following:
(1) Description of electronic recordkeeping system(s) to include system facilities, hardware, and software.
(2) Identification of records that will be maintained in the electronic system(s).
Par 3-3 Page 18
(3) Identification of which electronic records on which the certificate holder will use an authorized electronic signature process.
e. Changes to the Electronic Recordkeeping System. A certificate holder’s policies and procedures should include details of when revisions to the electronic recordkeeping system will be submitted for approval or acceptance (depending on the regulatory requirement) prior to implementation. This includes new versions of system software. Software version numbers will be included in the OpSpec A025 authorization for parts 91K, 121, 125, and 135. For all operations to which this AC applies, changes to the electronic recordkeeping system must be included in the manual or official document containing the electronic recordkeeping system description.
f. Audit Procedures. The certificate holder must have auditing procedures that ensure the quality and integrity of each record maintained in the system and that all of the requirements of the electronic recordkeeping system continue to be met. Procedures should include unauthorized event recognition, which includes actions to be taken by the certificate holder upon discovery of an attempt by an unauthorized individual to access and/or make entries into the electronic recordkeeping system.
3-4. ELECTRONIC RECORDKEEPING AUTHORIZATION.
a. Application. Certificate holders should submit their application for an electronic recordkeeping process to the responsible Flight Standards office. The application medium (paper or electronic file) must be acceptable to both the applicant and the FAA. The FAA will review the application package according to the General Process for Approval or Acceptance of Air Operator Applications contained in Order 8900.1, Volume 3, Chapter 1. The FAA will review the application package for accuracy and completeness and discuss any deficiencies with the certificate holder. The FAA may also notify the certificate holder in writing of any application deficiencies. Before the responsible Flight Standards office accepts the application package, the certificate holder will be required to correct all of the deficiencies. A certificate holder’s application package for authorization to use an electronic recordkeeping system must include the following:
(1) Letter of Intent. The application must contain the certificate holder’s letter of intent to use an electronic recordkeeping system.
(a) The Name of the Electronic System(s). The letter must include the kinds of records along with the name of the electronic system to be used to maintain the records. There may be more than one system required to maintain various kinds of records.
(b) Estimated Date of Implementation. The letter must include the estimated date on which the certificate holder would like to implement the electronic recordkeeping system.
(c) Primary Point of Contact (POC). The letter must include the certificate holder’s primary POC for the electronic recordkeeping system application process.
(2) A Description of the Proposed Electronic Recordkeeping System(s). The electronic recordkeeping system description must address all of the requirements contained in
Par 3-4 Page 19 (and 20) paragraphs 3-1, 3-2, and 3-3 of the AC, and include a description of the system facilities, hardware, and software. Software version numbers must be included.
(3) The Records That Will be Maintained in the System. The certificate holder must state specifically which records the certificate holder intends to maintain and access via the electronic recordkeeping system. The application should include a sample of each record type.
(4) The Data Backup. The application must describe the details of the certificate holder’s data backup system.
(5) Access and Security Procedures. The application must include information regarding access and security procedures.
(6) Electronic Signature Processes. The application must include a description of any electronic signature process associated with each electronic record category.
b. Demonstration of the System. The FAA will require a certificate holder to demonstrate the electronic recordkeeping system. The items requiring demonstration will typically include at least the following:
(1) User Access. The certificate holder should demonstrate how to securely access the system.
(2) Security Protocols and Prevention of Unauthorized Access and Record Modification. The certificate holder should demonstrate how the system prevents unauthorized access or modifications to the records maintained on the system.
(3) Record Entry. The certificate holder should demonstrate how a record is entered into the system.
(4) QC Procedures. The certificate holder should demonstrate the procedures for ensuring the quality and integrity of each record maintained on the system.
c. Successful Completion of Application Process for Approval or Acceptance and Authorization. When the certificate holder successfully completes the application and demonstration process, the FAA will accept or approve (depending on the regulatory requirement) the electronic recordkeeping system and authorize its use by signing and issuing OpSpec A025.
d. Unsuccessful Application. If the certificate holder fails to submit an acceptable application or fails to successfully demonstrate the electronic recordkeeping process, the responsible Flight Standards office will reject the application and provide an explanation to the certificate holder in writing.