AC 120-78A

U.

S. Department of Transportation Federal Aviation Administration Advisory Circular Subject: Electronic Signatures, Electronic Recordkeeping, and Electronic Manuals Date: 6/22/16 AC No: 120-78A Initiated by: AFS-300 Change:

This advisory circular (AC), as any AC, is not mandatory and does not constitute a regulation;

rather, it provides standards and guidance for electronic signatures, electronic recordkeeping, and electronic manual systems. Electronic recordkeeping systems/programs are used to generate many types of records (e.g., load manifests, dispatch release, aircraft maintenance records, maintenance task cards, pilot training records, flight release, and/or airworthiness release). This AC describes an acceptable means, but not the only means, for a certificate holder to utilize an electronic signature, electronic recordkeeping, and electronic manual systems.

ORIGINAL SIGNED by /s/ John Barbagallo Deputy Director, Flight Standards Service

Page iii (and iv)

CONTENTS Paragraph Page

CHAPTER 1. GENERAL INFORMATION1

1-1. Purpose1

1-2. Cancellation1

1-3. Where This AC Can Be Found1

1-4. Audience1

1-5. Scope1

1-6. Background3

1-7. Definitions3

1-8. Approval, Acceptance, and Authorization4

CHAPTER 2. ELECTRONIC SIGNATURES7

2-1. Electronic Signature7

2-2. Electronic Signature Process9

2-3. Electronic Signature Authorization12

CHAPTER 3. ELECTRONIC RECORDKEEPING15

3-1. Electronic Records15

3-2. FAA Standards for Electronic Records15

3-3. Electronic Recordkeeping System15

3-4. Electronic Recordkeeping Authorization18

CHAPTER 4. ELECTRONIC MANUAL SYSTEMS21

4-1. Electronic Manuals21

4-2. Electronic Manual System21

4-3 . Electronic Manual Authorization25

CHAPTER 5. VOLUNTARY DISCONTINUANCE BY CERTIFICATE HOLDER29

5-1. Voluntary Discontinuance29

CHAPTER 6. ADMINISTRATIVE31

6-1. Questions About This AC31

6-2. Other Related Regulations, Guidance, and Reading Material31

6-3. Obtaining Refere nce Material (current editions)32

APPENDIX 1. SAMPLE LETTER OF INTENT (2 pages)1

Par 1-1 Page 1 CHAPTER 1. GENERAL INFORMATION

1-1. PURPOSE. This advisory circular (AC) provides “approval” or “acceptance” guidelines for electronic signature, electronic recordkeeping, and electronic manual systems/programs. It is the certificate holder’s responsibility to address all Title 14 of the Code of Federal Regulations (14 CFR) parts that apply to their operation(s).

1-2. CANCELLATION. This AC cancels AC 120-78, Acceptance and Use of Electronic Signatures, Electronic Recordkeeping Systems, and Electronic Manuals, dated October 29, 2002.

1-3. WHERE THIS AC CAN BE FOUND. Certificate holders and the public may find this AC at http://www.faa.gov/regulations_policies/advisory_circulars.

1-4. AUDIENCE. This AC applies to the following regulated entities:

• Foreign air carriers or foreign persons operating a U.S.-registered aircraft in accordance with 14 CFR part 129, § 129.14.

• Certificate holders conducting operations in accordance with 14 CFR part 121, 125 (including part 125 Letter of Deviation Authority (LODA) holders), 133, 135, or 137.

• Fractional ownership program managers conducting operations in accordance with 14 CFR part 91 subpart K (part 91K).

• Operators conducting operations in accordance with part 91.

• Airmen certification course operators and training providers who provide instruction and evaluation in accordance with 14 CFR part 61, 63, 65, 141, or 142.

• Persons performing airmen certification in accordance with part 61, 63, 65, 141, or 142.

• Individuals performing maintenance or preventive maintenance in accordance with 14 CFR part 43.

• Repair stations operating in accordance with 14 CFR part 145.

• Aviation maintenance technical schools who provide instruction and evaluation in accordance with 14 CFR part 147.

• Organization Designation Authorization (ODA) holders in accordance with 14 CFR part 183 subpart D.

NOTE: For the purposes of the AC, the term “certificate holder” is used to identify the regulated entities identified in paragraph 1-4 of this AC. The scope of this AC is intended for entities regulated by the Federal Aviation Administration’s (FAA) Flight Standards Service (FS) and is not intended to apply to production, design, or manufacturing authority (e.g., type certificate (TC), Supplemental Type Certificate (STC), Parts Manufacturer Approval (PMA), etc.) signature, recordkeeping, and manual requirements established by the FAA’s Aircraft Certification Service (AIR).

1-5. SCOPE. Signatures, records, and manuals as discussed in this AC generally apply to the following categories. (This list is not intended to be all inclusive.)

Par 1-5 Page 2

a. Signatures:

• Certification of Training or Qualification;

• Pilot Logbooks;

• Fitness for Duty;

• Flight/Dispatch Release;

• Load Manifests;

• Operational Control Briefing;

• Preflight Risk Analysis Worksheet;

• Maintenance Logbook;

• Airworthiness Release;

• Maintenance Performed;

• Continuous Airworthiness Maintenance Program (CAMP); and

• Extended Operations (ETOPS) Predeparture Service Check.

b. Records:

• Training and Qualification;

• Crewmember;

• Dispatcher;

• Flight, Duty, and Rest;

• Dispatch Release;

• Flight Release;

• Load Manifest;

• Communication;

• Maintenance Records;

• Maintenance Log;

• Airworthiness Release;

• ODA Records and Reports; and

• Effective March 9, 2018, Safety Management System (SMS) Records required by 14 CFR part 5, § 5.97.

c. Manuals:

• Flight Operations (including dispatch, flight following, and onboard/cabin);

• Ground Operations (including ground and passenger handling);

• Certificate Holder Aircraft Performance Manuals (Airplane Flight Manual (AFM) and Weight and Balance (W&B) information, etc.);

• Training Program;

• Maintenance (including overhaul, standard practices, etc.);

• Minimum equipment list (MEL);

• General Policy and Procedures; and

• User (e.g., Flight Management System (FMS), Flight Planning System, etc.).

Par 1-6 Page 3

1-6. BACKGROUND. The Government Paperwork Elimination Act (Public Law (PL) 105-277, Title XVII); the Electronic Signatures in Global and National Commerce Act (E-Sign) (PL 106-229); and Office of Management and Budget (OMB) Memorandum M-00-15, OMB Guidance on Implementing the Electronic Signatures in Global and National Commerce Act, encourage the use of electronic records, signatures, and alternative information technologies, and allow Government agencies to develop performance standards for their use.

OMB Circular A-130, Managing Information as a Strategic Resource, provides general guidance for federal organizations regarding the use of electronic signatures in connection with electronic records and electronic transactions. The use of these electronic technologies also supports the goals of the Small Business Paperwork Relief Act of 2002 (H.R. 327). This AC provides guidelines on meeting the FAA’s performance standards developed in accordance with the listed PLs and OMB memorandum.

1-7. DEFINITIONS. The following terms are used in this AC.

a. Authentication. The means by which a system validates the identity of an authorized user. These may include a password, a personal identification number (PIN), a cryptographic key, smart card, etc. These means may be combined (e.g., a cryptographic card and a PIN) for increased confidence in the identity of the system user.

b. Computer-Based Recordkeeping System. A system of record processing in which records are entered, maintained, archived, and retrieved electronically. The term “computer-based recordkeeping system” is synonymous with “electronic recordkeeping system.”

c. Data Backup. Use of one of several recognized methods of providing a secondary means for archiving records, separately from the original or primary. This can be used to reconstruct the format and content of electronically stored records in case of loss, failure, or damage to the primary recordkeeping system.

d. Data Verification. A process of ensuring accuracy of data records by systematically or randomly comparing electronic records with manual data entry documents.

e. Digital Signature. Cryptographically generated data that identifies a document’s signatory, with date and time. The result of which, when properly implemented, provides the services of original authentication, data integrity, and signer non-repudiation.

f. Electronic Manuals. Certificate holder manuals that may be electronically signed, stored, and retrieved by a computer system via CD-ROM, Internet/Intranet based, or various other forms of electronic media, to include commercial off-the-shelf portable electronic device (PED) hardware (e.g., laptop, tablet, phone, etc.).

g. Electronic Record. A contract or other record created, generated, sent, communicated, received, or stored by electronic means.

h. Electronic Recordkeeping System. A system of record processing in which records are entered, signed, stored, and retrieved electronically. The term “electronic recordkeeping system” is synonymous with “computer-based recordkeeping system.”

Par 1-7 Page 4

i. Electronic Signature. Functionally equivalent to a handwritten signature. The term “electronic signature” means an electronic sound, symbol, or process attached to, or logically associated with, a contract or other record and executed or adopted by a person with the intent to sign the record.

j. Operations Specifications (OpSpecs). Documents created and issued by the FAA through the Web-based Operations Safety System (WebOPSS) are collectively referred to as “Authorizing Documents.” For the purposes of this AC, the use of the term “OpSpec” hereafter refers to one or more of the following WebOPSS authorization documents:

(1) Management Specifications (MSpecs). Issued to program managers who conduct fractional ownership operations under part 91K.

(2) Operations Specifications (OpSpecs). Issued to certificate holders for part 121, 125, 129, 133, 135, 137, 145, or 147.

(3) Letters of Authorization (LOA). Issued to part 91 operators, part 141 pilot schools, and part 125 operators conducting operations in accordance with a LODA (identifiable in WebOPSS as “125M”).

(4) Training Specifications (TSpecs). Issued to part 142 training centers.

k. Password. An identification code or device required to access stored material, intended to prevent information from being viewed, edited, or printed by unauthorized persons.

l. Private Key. A key pair used to create a digital signature.

m. Public Key. A key pair used to verify a digital signature.

n. Signature. A mark or sign made by an individual to signify knowledge, approval, acceptance, or obligation, and to authenticate a record entry. A signature should be traceable to the individual making the entry, and it should be handwritten or part of an electronic signature system.

1-8. APPROVAL, ACCEPTANCE, AND AUTHORIZATION. There are many 14 CFR part regulations that address electronic signatures, records/recordkeeping, and manuals. There are varying requirements between the many 14 CFR parts for approval, acceptance, and authorization.

a. FAA Approval Required. FAA approval is required to use the following electronic manual and recordkeeping systems:

(1) Electronic MEL. Part 91K, § 91.1115(a)(2); part 121, § 121.628(a)(2); part 125, § 125.201(a)(2); and part 135, § 135.179(a)(2) certificate holders who conduct operations under parts 91K, 121, 125, or 135 must provide flightcrews with direct access to the MEL through printed or other means approved by the Administrator.

Par 1-8 Page 5 (and 6)

(2) Part 121 Crewmember and Dispatcher Records. Section 121.683(c) allows a certificate holder to use a computerized recordkeeping system, approved by the Administrator, to maintain crewmember and dispatcher records required by part 121.

(3) Part 125 Crewmember Records. Section 125.401 allows a certificate holder conducting part 125 operations to use a computerized recordkeeping system that is approved by the Administrator to record and maintain crewmember records required by part 125.

b. FAA Acceptance Required. With the exception of the items that require FAA approval (see subparagraph 1-8a above), FAA acceptance is required for certificate holders to use electronic signatures, electronic recordkeeping systems, and electronic manual systems to satisfy the requirements of parts 91K, 121, 125, 133, 135, and 145. FAA acceptance is also required for certificate holders who use electronic records, and the electronic signatures associated with those records, to satisfy the requirements of parts 141, 142, and 147.

c. OpSpec Authorization Required. The FAA will authorize the use of electronic signatures, electronic recordkeeping systems, and electronic manual systems via OpSpec A025, Electronic Signatures, Electronic Recordkeeping Systems, and Electronic Manual Systems. The OpSpec A025 template name varies by regulatory part. OpSpec authorization is required for parts 91K, 121, 125, 133, 135, 141, 142, 145, and 147. FAA guidance on the issuance of OpSpec A025 can be found in FAA Order 8900.1, Volume 3, Chapter 18, Section 3, Part A Operations Specifications—General.

d. The FAA Will Use OpSpec A025 as the Method to Convey Approval, Acceptance, and Authorization. The FAA will use OpSpec A025 as the method to convey FAA approval or acceptance for those items that require specific FAA approval or acceptance to be maintained, accessed, or distributed electronically. The signature on the OpSpec by the FAA principal inspector (PI) or other aviation safety inspector (ASI) with OpSpec signature authority indicates the FAA’s approval or acceptance of the item (depending on the requirement). When the FAA issues OpSpec A025 in WebOPSS, the certificate holder is authorized to use the electronic items listed, as of the effective date of the active OpSpec. This date also signifies the effective date of FAA approval or acceptance.

e. There is No Requirement for Formal Approval, Acceptance, or Authorization for Part 61, 63, 65, 91 (Excluding 91K), 137, or 183. The use of an electronic signature, electronic recordkeeping system, or electronic manual system under part 61, 63, 65, 91 (excluding 91K), 137, or 183 does not require formal FAA approval, acceptance, or authorization. OpSpec (including an MSpec/TSpec/LOA) A025 does not apply to operations under these parts. The FAA recommends that all certificate holders adopt the standards for electronic signatures, records, and manuals as set forth in the AC, regardless of whether or not approval, acceptance, or authorization is required. If a required signature, record, or manual is provided in an electronic format or application that does not meet the standards set forth in this AC, the FAA may question its validity. If the FAA determines that an electronic signature, record, or manual does not meet the standards or is otherwise unacceptable, the FAA office with oversight responsibility will notify the certificate holder in writing. Upon receiving notification, it is incumbent upon the certificate holder to make the appropriate corrections.

Par 2-1 Page 7 CHAPTER 2. ELECTRONIC SIGNATURES

2-1. ELECTRONIC SIGNATURE. The U.S. Electronic Signatures in Global and National Commerce Act (Public Law (PL) 106-229 (also known as E-Sign)) defines an electronic signature as an “…electronic sound, symbol, or process, attached to or logically associated with a contract or other record and executed or adopted by a person with the intent to sign the record.”

NOTE: Throughout this AC, the term “electronic signature” refers to either electronic signatures or digital signatures. The specific electronic signature used depends on the end user’s preference and the system application.

a. General. The electronic signature’s purpose is identical to that of a handwritten signature or any other form of signature currently accepted or approved by the FAA; therefore, electronic signatures must possess those qualities and attributes that guarantee a handwritten signature’s authenticity.

NOTE: Electronic signatures should only be used to satisfy requirements relating to this AC. They may not be considered acceptable in other areas covered by 14 CFR having more specific applicability (e.g., legal depositions).

b. Types of Electronic Signatures. Electronic signatures may appear in various formats.

No matter the format, they must meet the legal requirements of electronic signing that appear in subparagraph 2-1c. Examples of electronic signature formats include, but are not limited to:

• A digitized image of a handwritten signature that is attached to an electronic record;

• An electronic code (e.g., a secret code, password, or personal identification number (PIN)) used by a person to sign the electronic record;

• A unique biometrics-based identifier, such as a fingerprint, voice print, or a retinal scan; or

• A digital signature.

c. Electronic Signature Standards. Electronic signatures should meet the following criteria to be considered legally binding.

(1) A person (the signer) must use an acceptable electronic form of signature.

(2) The signature must be unique to the signatory.

(3) There must be a means to identify and authenticate a particular person as the signer.

(4) The electronic form of signature must be executed or adopted by a person with the intent to sign the electronic record to indicate a person’s approval or affirmation of the information contained in the electronic record.

(5) The electronic form of signature must be attached to or associated with the electronic record being signed.

Par 2-1 Page 8

(6) The signature must be permanent and the information to which it is attached must be unalterable without a new signature.

(7) There must be a means to preserve the integrity of the signed record.

(8) A valid electronic signature must prevent the signatory from denying that he or she affixed a signature to a specific record, document, or body of data (non-repudiation).

d. Digital Electronic Signatures. Digital signatures are electronic signatures that incorporate encryption and decryption technology. Digital signatures that use this technology are typically the most secure because of the controls that are inherent with the technology itself.

(1) Digital Cryptography. Digital signature technology is based on Public and Private Key Infrastructure (PKI) cryptography. PKI cryptography is a class of cryptographic algorithms which require two separate keys, one of which is secret (private) and one of which is public.

Although different, the two parts of this key pair are mathematically linked. The public key is used to encrypt plain text or to verify a digital signature, whereas the private key is used to decrypt cipher text and to create a digital signature. To ensure the authenticity of a digital signature, PKI must incorporate the use of a digital certificate to authenticate the signatory’s identity. A digital certificate is issued by a trusted third party to establish the identity of the signatory. The third party who issues the digital certificate is known as a certificate authority (CA). The CA assumes the responsibility and liability of vouching for an individual’s identity.

(a) Public Key. A public key in a digital signature encrypts the digital signature itself and essentially converts it to a series of numbers and letters that are nearly impossible to duplicate. The encrypted data in a digital signature public key can be accessed by anybody;

hence the term “public” key. However, only the individual with the private key can turn the encrypted data into a digital signature. Examples of public keys include smart cards, digital tokens, access badges, or a user ID.

(b) Private Key. A Private Key is used by the individual signatory to decrypt the public key data and turn it into a digital signature. Examples of private keys are unique user name/password/access code combinations. A private key must be under the sole control of the person using it. The signatory must keep the private key secret and stored in a protected environment.

(c) Digital Certificate and CA. The digital certificate verifies the signatory. A digital certificate is like an identification card. The CA verifies the signatory’s identity and issues the certificate.

(2) Controls. Digital electronic signatures that use PKI and incorporate digital certificate authentication contain controls that ensure the authenticity of the signature. This technology also ensures the signature is permanently embedded in the document, record, or data in such a way as to render the content unalterable without a new signature.

Par 2-2 Page 9

2-2. ELECTRONIC SIGNATURE PROCESS. A certificate holder’s electronic signature process should describe, contain, or address the following:

a. Uniqueness. An electronic signature is only valid if it is unique to the individual signatory. It should identify a specific individual and be difficult to duplicate.

b. Control. A valid electronic signature must be under the sole control of the signatory and require the signatory to use a unique user name and password to access the system and affix the signature.

c. Notification. The system should notify the signatory that the signature has been affixed.

d. Intent to Sign. The signatory should be prompted before their signature is affixed. The electronic signature block should contain a word or statement of intent that definitively conveys the signatory’s intent to affix his or her signature. Examples of statements that do this include, but are not limited to:

• “Signed by,”

• “Certified by,”

• “Instructor’s signature/certification,”

• “Signature,”

• “Authorized by,”

• “Signatory,”

• “Authentication,”

• “Acknowledged by,”

• “Acknowledgement,” and/or

• “Affirmed by.”

e. Deliberate. An individual using an electronic signature should take deliberate and recognizable action to affix their signature. Acceptable deliberate actions for creating an electronic signature include, but are not limited to, the following:

• Using a digital signature;

• Entering a user name and password;

• Swiping a badge; and/or

• Using an electronic stylus.

f. Signature Association. A signature must be attached to, or logically associated with, the record being signed; otherwise, it is not legally significant. There are two aspects to this issue:

(1) It must be clear to the signatory exactly what it is that they are signing. In an electronic environment, the signer must have an opportunity to review the record before signing it, and to clearly understand the parameters of the record they are signing. It is also critical that the signing process be established in a manner to ensure that the signatory’s electronic signature is applied only to what they can review.

Par 2-2 Page 10

(2) The electronic form of signature applied by the signer must be linked to the record being signed. Satisfying this requirement requires storing the data constituting the electronic form of signature and doing so in a way that permanently associates it with the electronic record that was signed.

g. Retrievable and Traceable. The user should be able to identify and retrieve the documents to which his or her electronic signature has been applied. An electronic signature should provide positive traceability to the individual who signed a record, record entry, or any other document.

h. Undeniable. A valid electronic signature is one that cannot be denied (repudiated) by the signer. An electronic signature process must contain procedures and controls designed to ensure the authenticity of the signature and that the signer cannot deny having affixed the signature to a specific record, document, or body of data.

i. Security Protocols and Prevention of Unauthorized Access and Modification. An electronic signature process must be secure and must prevent unauthorized access to the system that affixes the signature to the intended documents or records. The process must ensure that only the intended signatory can affix his or her signature and must prevent unauthorized individuals from certifying required documents, such as airworthiness or dispatch releases. The process must prevent modifications to information/data or additional entries to records or documents without requiring a new signature. Additionally, the process must contain restrictions and procedures to prohibit the use of an individual’s electronic signature when the individual leaves or terminates employment.

j. Permanent and Unalterable. A valid electronic signature must be a permanent part of the record or document to which it was affixed. The information contained in the record or document must be unalterable without a new signature to validate the alteration.

k. Identification and Authentication. Electronic signature software must have authentication capabilities that can identify a signature as belonging only to a particular signatory. An individual using an electronic signature should be required to use a method of authentication that positively identifies the individual within the electronic signature system.

l. Correctable. An electronic signature process should include a means for a certificate holder to correct records or documents that were electronically signed in error, as well as those documents where a signature is properly affixed but the information or data is in error. An electronic signature should be invalidated any time a superseding entry is made to correct the record or document. The information or signature being corrected should be voided but remain in place. The new information and/or signature should be easily identifiable.

m. Archivable. Since no paper document with an ink signature exists, a means of safely archiving electronically signed documents should be part of any electronic signature computer software.

n. Control of Private Keys and Access Codes. A digital electronic signature process must ensure the private key or access to the electronic system that affixes the signature is under the sole custody of the signatory at all times.

Par 2-2 Page 11

o. Policies and Procedures. When constructing an electronic signature process, the certificate holder’s manual should include the following elements:

(1) Procedures. Procedures should address how the applicable regulatory requirements for their program are met. These procedures should be available to all users of the system.

(2) Description of Electronic Signature Process. A description of the electronic signature process must be included in the certificate holder’s manual. The description should explain how electronic signatures will be used and how electronic signatures are applied throughout the certificate holder’s operation (e.g., dispatch releases, training records, airworthiness releases, and maintenance actions). For parts 91K, 121, 125, and 135, each electronic signature process must be identified by a revision number and date. For a new unrevised process, a certificate holder may identify the revision number as “0” or “Original.” A reference to the process revision number and date, as well as the manual that contains the description of the electronic signature process, will be part of the Operations Specification (OpSpec) A025, Electronic Signatures, Electronic Recordkeeping Systems, and Electronic Manual Systems, authorization. For those certificate holders who are not required to have manuals (e.g., part 135 single pilot and part 141), a standalone electronic signature process document is an acceptable alternative, provided it is in an official document maintained by the certificate holder.

(3) Responsible Personnel. Policies and procedures should identify the certificate holder’s personnel who have the authority and overall responsibility for the integrity and security of the electronic signature process and for controlling access to the computer software/application used in the process. Policies and procedures should also identify the persons with the authority and responsibility for modifying, revising, and monitoring the electronic signature process, as well as ensuring the process is followed by all appropriate personnel.

(4) Identification of Persons Authorized to Use Electronic Signatures. Certificate holders must have a system for identifying who is authorized to use the electronic signature process, for what purposes, and which records.

(5) Description of System Support. Policies and procedures should address system support of any computer hardware or software that is part of the electronic signature process.

(6) Hardware and Software Capabilities. Description(s) of the electronic signature hardware to be used and software capabilities for applications of electronic signatures in the certificate holder’s system(s).

(7) Auditing Process. Electronic signature policies and procedures should include an auditing process to ensure all of the requirements for electronic signatures continue to be met.

The process should include unauthorized event recognition, which includes actions to be taken by the certificate holder upon discovery of an attempt by an unauthorized individual to use an electronic signature.

(8) Process Changes. A certificate holder’s electronic signature process policies and procedures should address how the certificate holder will submit changes to the electronic signature process to the FAA for acceptance. For parts 91K, 121, 125, and 135 operations,