Lesson 6: Signature Validation

For each electronic signature received, CROMERR requires that the system verify that the identified signer is actually authorized to sign the submittal.

Reference:

• Review the Regulation Language: § 3.2000(b)(5)(i)
• Definition of Valid Electronic Signature
• Definition of Electronic Signature Device

Under the Submission Process, CROMERR requires that the system be able to flag counterfeit submittals. Under the Signature Validation Process, CROMERR also requires that the system be able to flag counterfeit credential use, which would indicate that the credential has been compromised.

Reference:

• Review the Regulation Language: § 3.2000(b)(5)(i)
• Definition of Valid Electronic Signature
• Definition of Electronic Signature Device

CROMERR requires that the system include procedures to follow up on evidence and reports of credential compromise, including procedures to revoke a credential when compromise is indicated. Correspondingly, the system must be able to reject submissions that include e-signatures executed with revoked credentials.

Reference:

• Review the Regulation Language: § 3.2000(b)(5)(i)
• Definition of Valid Electronic Signature
• Definition of Electronic Signature Device

CROMERR requires that the system include procedures to follow up on evidence and reports of credential compromise, including procedures to revoke a credential when compromise is indicated. Correspondingly, the system must be able to reject submissions that include e-signatures executed with revoked credentials.

Reference:

• Review the Regulation Language: § 3.2000(b)(5)(ii)
• Definition of Valid Electronic Signature
• Definition of Electronic Signature Device

Related to item 5—requiring signature binding—CROMERR requires that the system be able to determine whether the content of an electronically-signed submittal matches the content at the time the signature was executed.

Reference:

• Review the Regulation Language: § 3.2000(b)(5)(ii)