reviewed and found acceptable by the FAA to provide guidance in establishing first article processes and procedures.
3.6.6 Verification of Supplier Product.
Methods used to verify that articles conform to specified requirements, including customer-supplied materials and customer-designated sources. These methods include, but are not limited to, the following:
3.6.6.1 For articles accepted at the PAH’s facility, inspection may be accomplished on receipt, or when characteristics remain accessible, at any time before the final acceptance of the end item. The procedures should encompass a complete inspection (for example, all dimensional characteristics, nondestructive testing, hardness checks, spectrographic analysis, and functional tests). When the PAH has established that the supplier’s production or process methods will consistently produce articles that conform to its requirements, use of statistical quality control methods may be acceptable. The inspection plan used is required by the rule to preclude the acceptance of any nonconforming articles. Additionally, when it is necessary to determine material integrity, the following methods should be considered:
Laboratory analysis to verify an article’s complete chemical and physical properties when tests can be performed without destroying the article (for example, by test coupon or small section of the article).
When laboratory analysis cannot be performed without destroying the article, a sample of such articles should be subject to a qualitative and quantitative analysis (for example, by test coupon or small section of the article). This analysis will verify the article’s complete chemical and physical properties.
3.6.6.2 For articles that cannot or will not be inspected on receipt, the PAH’s procedures should include, as a minimum, inspection and testing of first articles to verify the articles conform to the PAH’s requirements and periodic inspection thereafter. Inspections and tests completed for the purpose of showing conformity to contract requirements may be accomplished at a supplier’s facility. These inspections and tests are required by the rule to be conducted according to a documented process within the PAH’s FAA-approved quality system. More than one article may require such inspection or testing until the production repeatability of the supplier has been established. These procedures should include methods to control, identify, and segregate articles waiting for testing or inspection from those already approved.
3.6.6.3 The PAH may allow a supplier to perform an appropriate or major inspection when it has established that the supplier is capable of performing such an inspection function. However, the PAH should approve any 3-4
delegation of inspection or use of statistical techniques beyond the first tier supplier. Such delegation includes the following:
Major inspections. These include properties classified as critical by the approved design holder’s engineering drawings, process specifications, test specifications, and quality control procedures; or properties that cannot be verified except by destructive test of each article or extensive disassembly.
Material review. This includes the identification and maintenance of relevant MRB procedures that define the scope and authority of the supplier MRB. Material review also includes the process for submitting, to the PAH, supplier nonconformances that are required by the rule to be approved before they can be considered as changes to the FAA-approved type design.
Statistical techniques.
3.6.6.4 The PAH is required by the rule to have supplier, including subtier supplier, information available to the FAA on request. This information should include, but is not limited to, the following:
The name and address of each supplier.
The name and address of each supplier that performs major inspection or material review for the PAH.
The name and address of each supplier that furnishes articles when conformance to PAH requirements cannot, or will not, be made on receipt at the PAH’s receiving facility.
Where, and by whom, the article will undergo inspection.
The title and telephone number of the person to contact at the supplier facility that can furnish the purchase order(s), quality control data, technical data, and other pertinent data or information to the FAA.
Identification of each supplier with direct ship authorization.
Results of the PAH’s supplier evaluations, audits, or other surveillance activities.
3.6.6.5 The PAH is required by the rule to have a method for generating and maintaining inspection records. These procedures should include the following:
Contents of each record used for the article inspected. This should include, as a minimum, the name, part or article number, serial number (if applicable), sample size, type and number of inspections made, conformance or nonconformance, number and description of nonconformances found, and action taken.
3-5
Requirements for record legibility, completeness, accuracy, and retention periods.
Requirements that tools used for record retention (for example, tape files and microfilm) exhibit legible data and acceptance stamps or signatures.
3.6.7 Supplier Rating.
A system that exhibits the performance, capability, and reliability of suppliers.
3.6.8 Notification to the FAA.
A procedure to ensure advance notification to the FAA of any significant change in the scope of any supplier arrangements.
3.6.9 Reporting of Supplier Nonconformances.
A supplier-reporting process for products, articles, or services that have been released from or provided by a supplier and subsequently found not to conform to the PAH’s requirements.
3.6.10 Change Control.
A system that ensures changes in requirements are properly controlled and incorporated as agreed between the supplier and the PAH. These include, but are not limited to— Submittal to the PAH for approval of supplier designs and changes before incorporation, when required;
Submittal to the PAH of changes to a supplier’s manufacturing process, when required;
Submittal to the PAH of changes to a supplier’s quality system that may affect inspection, conformity, or the airworthiness of the article; and Methods used to act on notifications of nonconforming articles, and ensuring proper investigation and corrective action is taken.
3.6.11 Direct Ship.
Methods for controlling direct shipments from a PAH’s supplier to a customer for articles manufactured under the PAH’s production approval. The customer may order articles from either the PAH or the supplier. SAE ARP9114, Direct Ship Guidance for Aerospace Companies (dated 9/9/2005), is an industry guideline that has been reviewed by the FAA and found acceptable to provide guidance in establishing direct shipment processes and procedures. There may be restrictions on the direct shipment of articles from suppliers not located in the United States. The FAA Manufacturing Inspection District Office (MIDO) may be contacted for more specific information. Direct shipment may only be used when the PAH—
3.6.11.1 Has approved quality procedures that will compensate for the absence of inspections normally conducted at the PAH’s facility. Compensating factors 3-6
should include onsite evaluations of the supplier and the inspection of the article as either— A source inspection performed by the PAH, or An inspection by the supplier under a delegated inspection authority from the PAH.
3.6.11.2 Provides direct ship authorization to a supplier.
3.6.11.3 Issues and maintains records of direct ship authorization and makes them available to regulatory authorities on request.
3.6.11.4 Ensures the requirements of the importing country will be met before authorizing direct shipment to a customer located outside the United States.
3.6.11.5 Obligates the supplier to— Direct ship the article.
Meet any special customer requirements accepted by the PAH.
Maintain evidence that the supplier has direct ship authorization from the PAH.
Maintain evidence of direct shipments made on behalf of the PAH.
Provide a signed direct ship declaration with the shipment.
Provide a signed or stamped statement of conformance certifying that the article conforms to approved data with the shipment.
Provide traceability of the shipment to the customer purchase request.
Provide evidence with the shipment that acceptance or inspection has been accomplished by the PAH or through a delegated inspection authority.
Provide a statement with the shipment that delegation of inspection authority has been granted by the PAH, and that the inspection was performed on behalf of the PAH when delegated inspection is used.
3.6.12 Other-Party Supplier Surveillance.
Methods for the use of other-party supplier surveillance may be used by a PAH provided the processes used meet the requirements identified in FAA Order 8120.12, Production Approval Holder Use Of Other-Parties To Supplement Their Supplier Control Program, and are documented in the PAH’s quality manual.
3.6.13 Suppliers Holding a Production Approval.
Methods used to address suppliers that hold a production approval for the article to be supplied. A PAH’s surveillance of individual suppliers may be reduced, but not eliminated, provided that— 3-7
Satisfactory interface between the two quality systems can be demonstrated to the FAA;
The articles to be supplied are included in the scope of their production approval; and If the supplier is located outside the United States, a bilateral agreement for airworthiness is in effect between the United States and the country of the supplier. The bilateral agreement will include provisions for United States’ acceptance of the types of articles or products produced under the supplier’s production approval.
3.6.14 Use of Suppliers Located Outside the United States.
Methods for the use of suppliers (including subtier suppliers) outside the United States.
These should include provisions for the following:
The PAH providing early notification to the FAA of the proposed use of a supplier in another country or jurisdiction.
The PAH is required by the rule to make available to the FAA information on non- U.S. suppliers when requested.
The PAH should ensure the FAA has access within the country where its supplier (including subtier suppliers) is manufacturing. It should also ensure all necessary processes, agreements, or procedures are in place to mitigate any undue burden on the FAA. Such burdens could inhibit the FAA from performing its regulatory functions and certificate management responsibilities.
The PAH is required by the rule to ensure access to its suppliers. Assurance of access should be provided by the supplier, or when no regulatory agreements are in place, the government of the country or jurisdiction in which the supplier is located.
This assurance of access will be made available to the FAA. If access is at any time obstructed or denied, the FAA may instruct the PAH to cease using the supplier.
3.6.15 FAA Certificate Management in Other Countries.
When a PAH uses a supplier in a country or jurisdiction that has a bilateral agreement with the United States, the FAA may use a bilateral partner CAA to perform surveillance activities and/or conduct inspections on behalf of the FAA. The following procedures should be used:
The PAH will afford the FAA or CAA any necessary support in its surveillance activity.
When specifically requested by the FAA/CAA to facilitate surveillance activities, suppliers located outside the United States will make appropriate data available to the FAA through the PAH for certificate management purposes. This data should be in the English language.
3-8
Note 1: FAA Order 8100.11, Decision Paper Requirements for Undue Burden and No Undue Burden Determinations Under 14 CFR part 21 for Production and Export Airworthiness Approvals, is used by FAA personnel when notified by the PAH of its intent to use a supplier outside the United States.
Note 2: When the FAA requests a bilateral partner CAA to conduct surveillance activities or conformity inspection(s) at a supplier facility, the PAH will be responsible for any charges imposed by the CAA to accomplish the request(s).
3-9
CHAPTER 4. ELECTRONIC RECORDS.
4.1 Purpose.
This chapter provides information and guidance to PAHs on managing and controlling information systems that generate and store records used in the manufacture of products and articles.
4.2 Background.
Several CFR sections require PAHs to maintain manufacturing and quality records as evidence that products and articles were produced in accordance with approved design requirements. As the aerospace industry has grown, many PAHs have developed or purchased information systems to generate and store manufacturing and quality records.
This chapter does not discuss what manufacturing and quality records should contain.
Rather, it describes the control mechanisms that a PAH should use for an information system that generates or stores records of products and articles manufactured to CFR requirements.
4.3 Electronic Manufacturing and Quality System Records.
The record system should detect and deter unauthorized disclosure, modification, or use of records. Record systems require protection to ensure an accurate history of the manufacturing process of a product or article. An information management system should be protected from intruders. The system should also be protected from employees with authorized access privileges who attempt to perform unauthorized actions. Protection is achieved not only by technical, physical, and personnel safeguards, but also by clearly articulating to all employees the organizational procedures regarding authorized system use.
4.3.1 Security Principles of Electronic Record Systems.
Although information management systems are diverse, common security attributes should be present in all record systems. An acceptable electronic record system should include the following:
4.3.1.1 User Identification.
Each system user should be uniquely identified in the system with an account number or other identification code. This code identifies who has logged onto the system and is the primary means of verifying access. The information management system should retain the user identification codes entered to verify the requests made on the system. This information should be available for review by the system manager.
4.3.1.2 Authentication of User.
There should be a means of verifying that the person entering the user identification code is the authorized individual. Typically, this 4-1
authentication is through a password known only to the authorized user.
This password would allow access to the system only when used together with the user identification code. Passwords should be updated periodically.
4.3.1.3 Principle of Least Possible Privilege.
The authorization capability of the record system should follow the principle that each person is limited to only the information and transaction authority required by their job responsibilities. Privacy locks may be used to ensure this principle is followed. The level of access at which information is guarded within the system will depend on the design of the system.
Based on the design of the information management system, privacy locks and keys may control single data elements or any combination of data elements. Levels of protection may include the following:
Data items, Data aggregates, Sets, Fields, Files, or The complete system.
4.3.1.4 Relation to Quality Data Responsibilities.
The system should ensure authorization privileges coincide with the responsibilities outlined in the organization’s quality system. For example, a manufacturing individual should not normally have write capability to an inspection acceptance field within a manufacturing record. Additionally, an inspector should not have access to a material review engineer disposition field within a material review record. The system should be capable of assigning each user the specific access authority needed. The various types of authorization may include the following:
Read-Only Access. Allows the user to read all or specific fields of information but does not allow any write or data manipulation capability.
Insert or Write Access Authorizations. Allows the user to enter data into specified fields or series of fields.
Change Access Authorizations. Allows the user to change entries in specified fields, but does not allow removal of the original entry.
Changes may be accomplished by adding information to a restricted field (which is only used when the information in a field will be retained) but the information is not correct. For example, when an article has been rejected by inspection, the rejection history may need to be retained even after the article is repaired. Change access authorization may be given to allow a senior inspector the authority to 4-2
change the inspection status of a reworked article; however, the record retains the original rejection indication and the user identification of the individual making the change.
Delete Access Authorizations. Allows the user to remove entries and leave the fields blank. While authorization to delete information by the user making the entry may be unrestricted, subsequent delete authorization should be closely controlled. Delete access authorization may be issued only to supervisors for deleting incorrect entries by subordinate employees. Subsequent to final approval of a product or article, information should not be deleted. After approval, incorrect data should be changed rather than deleted.
Security Access Authorizations. The system manager should retain the security access authorizations. These authorizations should only be exercised when properly executed documents allow their use, such as an approval letter signed by the director of quality.
4.3.2 Auditing Mechanisms.
The information management system should include mechanisms that detect security breaches. These breaches should include any attempt to circumvent security or modify data without authorization. When such a security breach is detected, the system should alert the security manager and note any fields that have been accessed. The security breach information should be retained within the system until reviewed by the system manager. Security breach logs should be available only to select individuals and be protected from modification or data alteration at all times. Normally the system operator will be warned of unauthorized activity. Serious events, such as repeated unauthorized access attempts, may generate alarms at the system level.
4.3.3 Protection Against Software and Hardware Destruction.
Information system records should be protected from destructive computer programs (that is, computer viruses) that attack or degrade the software. Information management systems should include virus detection programs that ensure viruses are not introduced into the environment through contaminated software or hardware.
4.3.3.1 Inventories.
Inventories of all software and hardware configurations and locations should be used to ensure unauthorized hardware/software does not enter the information management system’s environment.
4.3.3.2 Portable Equipment.
Portable computer equipment, such as laptops, represent special risks from destructive software; therefore, procedures should address their use in the information management system’s environment.
4-3
4.3.3.3 Network Security.
Many PAHs use large information management system networks with several interacting workstations or terminals. If a large interactive system is used, procedures should address additional protection necessary to control the network. The PAH should define the degree of protection, based on the complexity and application of the system.
4.3.3.4 System Backup.
Provisions should be developed for loss of data resulting from system failure. In all cases, lost data will be regenerated. The amount of time between backups will depend on the degree of risk the approval holder wishes to accept to reestablish lost information.
4.3.4 Media Control.
The media on which information is stored should be carefully controlled and protected.
Transportable media such as tapes, disks, and cartridges should be stored in secure locations. Media from external sources should be subject to validation to ensure they are from authorized sources. The listing below provides some examples of the types of media available.
4.3.4.1 Floppy disks and computer hard drives should not be used for long-term storage of quality and manufacturing records. Information that will be retained for more than 3 months should be transferred to optical disks or magnetic storage media such as chromium dioxide or metal particle tapes.
An external or electronic labeling system should be used that ensures retrieval of individual records.
4.3.4.2 Magnetic tapes should be tested within 6 months of use to verify the tape is free of errors and complies with the standards of the National Institute of Standards and Technology. Optimally, new tapes that have been maintained in a cool, dry environment should be chosen for storing records. Specific storage criteria for magnetic tapes include the following:
Environmental temperatures between 62 and 68 degrees Fahrenheit.
Relative humidity between 35 percent and 45 percent.
All tapes should be rewound under controlled tension every 3½ years.
All information that will be retained for more than 10 years should be transferred to new tapes before reaching 10 years.
Annually, a statistically valid sample of all tapes should be tested to identify any loss of data. Tapes with 10 or more errors due to storage conditions should have all data transferred to new tapes. If the sample contains defective tapes, all other tapes that might have been affected by the same cause (that is, poor quality tape, high usage, poor environment, or improper handling) should be tested and corrected.
4-4
Smoking, eating, or drinking in the magnetic tape storage or test areas should be prohibited.
4.3.4.3 Chromium dioxide tapes should be handled like magnetic tapes except for periodic rewinding and cleaning. Although unproven, some industry experts believe rewinding and cleaning can be destructive to these tapes.
4.3.4.4 Before use of any metal particle tapes for long-term storage, the PAH should ensure the tapes can maintain the integrity of the data stored.
4.3.4.5 Additional information regarding long-term storage of electronic media can be found in the National Institute of Standards and Technology’s Special Publication 500-101, Care and Handling of Computer Magnetic Storage Media. This publication is available from the Superintendent of Documents, U.S. Government Printing Office, Washington, DC 20402.
4.3.4.6 Optical disks are recommended for their greater durability over older media such as magnetic tapes or disks.
4.3.4.6.1 Gold compact disks or digital versatile disks are preferred over similar media for long-term data storage. This is preferred over aluminum and silver writing surfaces, which are susceptible to corrosion or oxidation.
4.3.4.6.2 The PAH should maintain data transferred to storage, and provide access and ensure integrity of information for the long term. This may require migrating data from one media to the next to avoid media obsolescence.
The devices necessary to read the discs should also be kept and maintained.
4.3.4.6.3 When obtaining archival grade discs, the PAH should consider the following: dye failure, bonding failure, scratches, and production quality.
Testing is a highly recommended step in the process as conditions vary from machine to machine and among disks. It is recommended that the PAH keep multiple copies. Ideally one master copy should be stored under optimal conditions; one in-use copy should be stored for access purposes;
and one safety copy should be stored at a different location.
4.3.4.6.4 Rewritable disk formats are not recommended as their use can lead to accidental, but permanent, loss of data.
4.3.4.6.5 Optical disks, for all their resilience, are still susceptible to environmental factors. Optical disks should not be exposed to extreme temperatures or direct sunlight that may cause heat buildup in the disk or damage the data layer with ultraviolet rays. The environment should optimally be maintained between 65 and 75 degrees Fahrenheit, and between 30 and 50 percent humidity.
4-5
4.3.5 Documentation.
The information management system should be properly documented.
4.3.5.1 All software programs within the system, including program changes, should be fully documented.
4.3.5.2 Procedures should be developed that control all data entered into the system. The procedures should address all information management system and human interface activities.
4.3.6 Availability.
The information management system industry is extremely dynamic concerning the systems that are available for recordkeeping. If the PAH changes from one system to another, the records produced by the old system will remain accessible to the FAA in a usable format. The PAH’s documented quality control system should indicate how this accessibility is accomplished.
4.4 Information Management System Facility Management.
The information management system cannot be properly protected unless the facilities that house the equipment are properly protected from physical threats and hazards.
Areas that should be considered include the following:
4.4.1 Physical Security.
Each area where electronic records will be used should be surveyed for potential physical hazards. Fire and water are two of the most damaging forces regarding electronic information. Although not all hazards can be eliminated, opportunities for loss can be minimized by careful planning.
4.4.2 Environmental Conditions.
Procedures should address the environmental conditions (for example, temperature, humidity, static) of the areas where the record system computers and stored media are located. Manufacturer specifications provide a useful guide for developing procedures.
4.4.3 Disaster Recovery.
A contingency plan should be developed that will allow recovery of critical system information in case of a disaster, such as a fire. One acceptable method is to have a remote backup system to which data is regularly transferred.
4.5 Training.
Organizations that have elected to use electronic record systems should train each employee who is involved with any portion of that system. The subject matter and objectives should vary depending on the employee’s level within the organization and job responsibilities. Training should include security awareness, organizational policy, system operation, and record storage requirements. Training should be documented and those documents made available for review by the FAA.
4-6