21 CFR § 1311.30 - Requirements for storing and using a private key for digitally signing orders.

---
identifier: "/us/cfr/t21/s1311.30"
source: "ecfr"
legal_status: "authoritative_unofficial"
title: "21 CFR § 1311.30 - Requirements for storing and using a private key for digitally signing orders."
title_number: 21
title_name: "Food and Drugs"
section_number: "1311.30"
section_name: "Requirements for storing and using a private key for digitally signing orders."
chapter_name: "DRUG ENFORCEMENT ADMINISTRATION, DEPARTMENT OF JUSTICE"
part_number: "1311"
part_name: "REQUIREMENTS FOR ELECTRONIC ORDERS AND PRESCRIPTIONS"
positive_law: false
currency: "2026-04-05"
last_updated: "2026-04-05"
format_version: "1.1.0"
generator: "[email protected]"
authority: "21 U.S.C. 821, 828, 829, 871(b), 958(e), 965, unless otherwise noted."
regulatory_source: "70 FR 16915, Apr. 1, 2005, unless otherwise noted."
cfr_part: "1311"
---


# 1311.30 Requirements for storing and using a private key for digitally signing orders.

(a) Only the certificate holder may access or use his or her digital certificate and private key.

(b) The certificate holder must provide FIPS-approved secure storage for the private key, as discussed by FIPS 140-2, 180-2, 186-2, and accompanying change notices and annexes, as incorporated by reference in § 1311.08.

(c) A certificate holder must ensure that no one else uses the private key. While the private key is activated, the certificate holder must prevent unauthorized use of that private key.

(d) A certificate holder must not make back-up copies of the private key.

(e) The certificate holder must report the loss, theft, or compromise of the private key or the password, via a revocation request, to the Certification Authority within 24 hours of substantiation of the loss, theft, or compromise. Upon receipt and verification of a signed revocation request, the Certification Authority will revoke the certificate. The certificate holder must apply for a new certificate under the requirements of § 1311.25.