Security Policies Reference

Define system-wide security policies.

Security Policies (Reference) enforce password requirements, electronic signatures, and session management rules for regulatory compliance and security best practices.

ecurity Policies provide:

Password complexity requirements
Electronic signature validation
Session timeout management
Account lockout rules
Password aging controls

Policies enable FDA 21 CFR Part 11 compliance and other regulatory requirements.

Pre-Defined Policies

Three standard policies are configured:

Policy	Use Case	Typical Settings
Default	Standard operations	Basic password, no timeout
Enhanced	Elevated security	Complex password, session timeout
Critical	Regulatory compliance	Strong password, e-signature, strict timeout

Configuration Properties

Property	Description	Required
Name	Unique policy identifier	Yes
Identification	Password and account rules	Yes
ESign	Electronic signature settings	No
Session	Timeout and auto-logoff	No
Description	Documentation text	No

Identification Settings

Password and account management rules:

Password Requirements

Property	Description	Range	Default
PasswordMinLength	Minimum characters	0-128	0 (no limit)
PasswordHistory	Previous passwords to remember	0-5	0
MinPasswordAge	Hours before change allowed	0+	0
MaxPasswordAge	Hours until expiration	0+	0 (never)

Account Security

Property	Description	Range	Default
UserNameMinLength	Minimum username length	0-128	0
BlockOnInvalidAttempts	Failed logins before lockout	0+	0 (no limit)
BlockAging	Hours until auto-unlock	0+	0 (manual)
AllowPasswordChange	Users can change own password	Yes/No	Yes
AllowShareUser	Multiple concurrent sessions	Yes/No	Yes

E-Signature Settings

Electronic signature requirements for critical actions:

Property	Description	Use Case
Enabled	Require e-signature	FDA compliance
TimeoutMinutes	Signature validity period	Re-authentication frequency

Configuring E-Signature

Enable in policy settings
Set timeout (e.g., 60 minutes)
Assign policy to users
Enable on controls requiring signature

Example:

csharp

// Check if e-signature required
if (@Security.Policy.ESign.Enabled)
{
    // Prompt for password
    if (!@Security.ValidateESignature())
    {
        return; // Action cancelled
    }
}

Session Management

Automatic logoff configuration:

Property	Description	Options
AutoLogOff	Logoff trigger	None, Inactivity, Duration, Both
InactivityMinutes	Idle time before logoff	1-9999
DurationHours	Maximum session length	1-9999

AutoLogOff Modes

Mode	Behavior	Use Case
None	No automatic logoff	Dedicated stations
Inactivity	Logoff after idle time	Shared workstations
Duration	Logoff after time limit	Shift changes
Both	Either condition triggers	Maximum security

Applying Policies

Assign to Users

Navigate to Security → Users
Select user row
Set Policy column
User inherits all policy settings

Runtime Behavior

csharp

// Get current user's policy
string policyName = @Security.CurrentUser.Policy;

// Check policy settings
var policy = @Security.Policies[policyName];
bool requiresESign = policy.ESign.Enabled;
int passwordMinLength = policy.Identification.PasswordMinLength;

Compliance Scenarios

FDA 21 CFR Part 11

Policy: Critical
Identification:
  - PasswordMinLength: 8
  - PasswordHistory: 5
  - MaxPasswordAge: 2160 (90 days)
  - BlockOnInvalidAttempts: 3
ESign:
  - Enabled: True
  - TimeoutMinutes: 30
Session:
  - AutoLogOff: Both
  - InactivityMinutes: 15
  - DurationHours: 12

High Security Environment

Policy: Enhanced
Identification:
  - PasswordMinLength: 12
  - AllowShareUser: False
  - BlockOnInvalidAttempts: 5
  - BlockAging: 24
Session:
  - AutoLogOff: Inactivity
  - InactivityMinutes: 10

Best Practices

Start with pre-defined - Modify existing policies
Document requirements - Clear compliance needs
Test thoroughly - Verify all settings work
Train users - Explain policy changes
Regular reviews - Update as needed
Gradual implementation - Phase in restrictions
Monitor compliance - Track violations

Troubleshooting

Account locked:

Check BlockOnInvalidAttempts
Verify BlockAging timeout
Administrator unlock required
Review failed login attempts

Password rejected:

Check PasswordMinLength
Verify against PasswordHistory
Confirm MinPasswordAge not violated
Review complexity requirements

Unexpected logoff:

Check Session settings
Verify InactivityMinutes
Review DurationHours
Check client activity detection

E-signature issues:

Verify policy enabled
Check timeout not expired
Confirm user has password
Test signature validation

In this section...

Page tree