FAQs

Credentials are like digital passports that unlock access to systems and information. For DSCSA, this takes four forms: you can verify any drug package with the original manufacturer, you can create or respond to trace requests, you can report and resolve supply chain exceptions, and you can prove and track your ATP status as well as those of your trading partners.

DSCSA is an ownership law, so you only need one credential to cover your entire organization. This can be achieved with a single DEA certificate and state license.

The DEA CSOS (Controlled Substance Ordering System) digital certificate is issued by the agency to an individual person at a physical site in order to allow that site to transmit controlled substance orders without supporting paper forms. The process to enrol and receive a CSOS certificate owner is enough that it meets the identity assurance requirements for DSCSA credentialing by itself.

No, as long as the DEA certificate is tied to a licensed pharmacy location. A general rule of thumb is to pick a location where the address is unlikely to change in the near future.

The DEA reassures registrants that the use of the DEA Signing Certificate is perfectly acceptable for this purpose; it was foreseen and specifically allowed for by the DEA in their policy manual CSOS Certificate Policy, Version 4.1, January 2015, section 1.4.1 Appropriate Certificate Uses.

While the DEA (Controlled Substance Ordering System) CSOS certificate can be used as evidence for issuing a credential, it cannot be used as an interoperable DSCSA credential by itself. There is no interoperable mechanism for exercising the DEA certificate over networks such as the VRS. In addition, because DEA certificates are issued to allow for controlled substance ordering, few manufacturers have them.

No, you can point to any licensed pharmacy location as evidence to support your credential. A general rule of thumb is to pick a location where the address is unlikely to change in the near future.

Legisym, our credential issuer partner, tracks the DEA certificates and state licenses to ensure that credentials remain current. If the address changes, that means your DEA number and state license number will change. You’ll get an email from Legisym indicating that you have 30 days to upload another CSOS certificate.

Legisym is the credential issuer that actually provides the credential by reviewing the documentation and checking and monitoring your state license over time. LedgerDomain provides the software that uses the credential to sign and check messages, and link out to the broader DSCSA enhanced drug distribution security network. There’s a division of responsibilities between LedgerDomain and Legisym, as Legisym sees your documentation and monitors your license but never gets to see how you use your digital credential. Our job at LedgerDomain is to manage the credential and link it to the broader network, but we can never issue credentials ourselves.

You will only need one credential to cover your entire organization, and can choose any supply chain role you fill as your “primary” ATP type for the credential.

During the credential implementation period, you should only need to add the DSCSA lead at your organization, and the CSOS certificate holder.