How long is a CSOS digital certificate valid?

CSOS digital certificates carry an expiration date set at the time of issuance by the DEA's Certification Authority. Certificate holders should track their expiration date on a compliance calendar and initiate renewal well before the expiration date, because processing is not instantaneous. For multi-site systems, maintaining a certificate inventory that tracks expiration dates across all registered locations and designees is a recommended program control.

What happens if my CSOS certificate expires?

An expired CSOS certificate immediately disables the holder's ability to sign electronic Schedule II orders. The facility cannot place CSOS orders through that certificate until it is renewed through the DEA's CSOS portal. To avoid ordering disruptions, build certificate renewal reminders into your compliance calendar with sufficient lead time — an expired certificate cannot sign orders, and the only fix is renewal.

Can a designee sign CSOS orders on behalf of the registrant?

Yes. Just as paper Form 222 allows an authorized designee to sign under a Power of Attorney, CSOS permits designees to hold their own digital certificates and sign electronic orders on behalf of the registrant. Designees must obtain their own individual digital certificates and have their authority formally established through the CSOS designee process. When a designee leaves the organization or changes roles, their CSOS signing authority must be promptly revoked to prevent unauthorized Schedule II purchasing under your registration.

How long must CSOS electronic records be retained?

CSOS electronic records carry the same two-year minimum retention requirement as paper Form 222 records under 21 C.F.R. §1304.04. Records must be retained at the registered location or readily accessible from it, organized so any specific order can be located during an inspection, and backed up to prevent data loss — an IT failure does not excuse a registrant from the retention obligation. State boards may impose longer retention periods, which supersede the federal minimum.

CSOS: Electronic Ordering of Schedule II Controlle…

Q: Is CSOS mandatory for Schedule II ordering?

CSOS enrollment is not legally mandated — a registrant may continue to use paper DEA Form 222 if they choose. However, in practice enrollment has become effectively necessary at many facilities because a growing proportion of DEA-registered distributors now route Schedule II orders primarily through CSOS. Multi-site health systems and high-volume dispensing operations almost universally use CSOS to avoid the physical form management burden across locations.

The Controlled Substance Ordering System (CSOS) is the DEA's electronic alternative to paper DEA Form 222 for ordering Schedule II controlled substances. For high-volume pharmacy operations and multi-site health systems, CSOS eliminates the logistical burden of managing, securing, and mailing controlled form booklets while maintaining the same accountability standards. Understanding how CSOS works — and how to manage it correctly — is essential for any facility that orders Schedule II drugs in volume.

What Is CSOS and How Does It Relate to Form 222?

CSOS, governed by 21 C.F.R. Part 1311, is the DEA's electronic equivalent of paper Form 222. When a registrant uses CSOS, the electronic order serves the same legal function as a paper Form 222 order — it is the authorized mechanism by which a DEA registrant purchases Schedule II controlled substances from a DEA-registered distributor. No other purchase order, invoice, or internal requisition can substitute for a Form 222 or a CSOS electronic order in the Schedule II supply chain.

CSOS does not create a separate ordering system running parallel to Form 222 — it replaces it for the transactions it covers. A registrant who has enrolled in CSOS and placed an electronic order through it has satisfied the same Form 222 requirement that a registrant filing a paper form satisfies. The DEA records in both systems are equivalent for inspection and audit purposes.

For a full overview of paper Form 222 requirements and how CSOS compares in practice, see our DEA Form 222 complete guide.

Who Must Enroll in CSOS?

Enrollment in CSOS is not mandated for all registrants — a registrant may continue to use paper Form 222 if they choose. However, enrollment is required for any registrant who wishes to order Schedule II controlled substances electronically. Once a registrant opts into CSOS, electronic orders submitted through the system have full legal authority for Schedule II purchasing.

In practice, enrollment has become effectively necessary at most facilities because a growing proportion of DEA-registered distributors now route Schedule II orders exclusively or primarily through CSOS. A facility that has not enrolled may find that its paper Form 222 submissions are slower to process or that some suppliers have shifted to CSOS-only fulfillment workflows. Multi-site health systems and high-volume dispensing operations almost universally use CSOS to avoid the physical form management burden across locations.

The Digital Certificate Process

The cornerstone of CSOS authentication is the DEA-issued digital certificate. This certificate is a cryptographic credential that uniquely identifies the authorized signer and allows CSOS to verify that the person placing or approving an order is who they claim to be and holds the authority to commit the registrant to a Schedule II purchase. The digital certificate:

Is issued by the DEA's Certification Authority after the applicant completes identity verification
Is tied to a specific individual — the registrant or authorized designee — not to the facility's shared login
Has an expiration date and must be renewed before it lapses; an expired certificate disables the holder's ability to sign CSOS orders
Must be protected from unauthorized access just as a physical Form 222 booklet must be physically secured
Is non-transferable — the certificate holder cannot share credentials with a colleague who does not have their own certificate

The identity verification process for obtaining an initial certificate involves submitting an application through the DEA's CSOS portal and completing the required steps to confirm the applicant's identity and DEA registration status. New applicants should allow adequate lead time before their CSOS ordering capability is needed, since processing is not instantaneous.

Authorized Signers and Designees

Just as paper Form 222 can be signed by the DEA registrant or an authorized designee holding a current Power of Attorney, CSOS allows designees to hold their own digital certificates and sign electronic orders on behalf of the registrant. The rules governing who may serve as an authorized signer under CSOS mirror the Power of Attorney rules that govern Form 222:

The registrant (the individual named on the DEA registration) may sign CSOS orders directly using their own certificate
A designee may be granted signing authority by the registrant through the CSOS designee process, and must obtain their own individual digital certificate
The designee's authority is tied to their relationship with the specific DEA registration — a certificate holder who changes employers must update their authorization accordingly
When a designee leaves the organization or their role changes, their CSOS signing authority must be revoked promptly

Failure to revoke a departed employee's CSOS signing authority is a regulatory exposure: if that individual retains the ability to sign Schedule II orders after leaving, any orders signed would constitute unauthorized Schedule II purchasing under your registration.

How CSOS Orders Flow to Suppliers

A CSOS-enabled purchase workflow typically follows these steps:

The authorized signer or designee creates the order in the facility's purchasing system or directly in the CSOS interface, specifying the drug, strength, quantity, and supplier
The order is digitally signed using the signer's DEA-issued certificate, which affixes a cryptographic signature that cannot be altered without detection
The signed electronic order is transmitted to the designated DEA-registered supplier
The supplier validates the digital signature, confirms the registrant's active DEA registration, and processes the order
Upon shipment, the supplier issues a CSOS-compliant shipping confirmation that links back to the original order
When the shipment is received at the registered location, the receiving record is matched to the CSOS order to complete the transaction chain

Each step in this chain creates an electronic record that must be retained. The equivalents of the three-part paper Form 222 copies are the electronic order record (retained by the purchaser), the supplier's copy, and the DEA's record of the transaction.

Reconciliation with the Paper Form 222 Trail

Facilities that have transitioned entirely to CSOS no longer maintain paper Form 222 booklets for new orders, but they may retain historical paper Form 222 records from before the transition. These records must continue to be retained for the full two-year minimum period from their date of use. During a DEA inspection, inspectors may request both CSOS electronic records and any historical paper Form 222 records still within the retention window, and the two sets of records must together account for all Schedule II purchasing without gaps.

For each CSOS order, the receiving department should verify that the quantity received matches the quantity ordered on the CSOS record and the quantity shown on the supplier's invoice. Any discrepancy between what was ordered, what was shipped per the supplier's records, and what was physically received is a diversion red flag that must be investigated and documented before the shipment is added to perpetual inventory.

Recordkeeping Requirements for CSOS

Electronic CSOS records carry the same two-year retention requirement as paper Form 222 records under 21 C.F.R. §1304.04. The records must be:

Retained at the registered location or readily accessible from it in a format the DEA can audit
Organized so that any specific CSOS order can be located and produced during an inspection
Backed up to prevent data loss — an IT failure that destroys CSOS records does not excuse a registrant from the retention obligation
Maintained separately from general purchasing records, or in a manner that allows immediate identification and retrieval of the controlled substance order records

Many facilities export CSOS order records to their controlled substance management system or pharmacy information system to consolidate all Schedule II transaction records in a single audit trail. Whatever system is used, the ability to produce a complete, chronological record of all CSOS orders during any given period is essential.

Troubleshooting Common CSOS Errors

CSOS issues that interrupt Schedule II ordering can halt purchasing until resolved. The most common problems and their resolutions:

Expired digital certificate: Renew the certificate through the DEA CSOS portal well in advance of the expiration date. Track certificate expiration dates on your compliance calendar. An expired certificate cannot sign orders — the only fix is renewal.
Certificate not recognized by the supplier: Confirm the certificate is properly installed on the signing workstation and that the supplier's CSOS interface supports the current certificate format. Some integration issues require contact with the DEA or the supplier's technical support.
Order rejected by supplier for DEA registration issue: Verify that the facility's DEA registration is current and has not lapsed or been suspended. A CSOS order will be rejected if the registrant's DEA registration is expired.
Designee's signing authority no longer recognized: Confirm that the designee's authorization within CSOS reflects their current role and that their certificate has not expired. If the registrant who granted authority has changed, the designee authorization may need to be re-established.
Duplicate order submission: CSOS electronic orders may be flagged for duplicate review if the same item is ordered in rapid succession. Confirm orders are only submitted once; a second submission before the first is processed may create fulfillment confusion that must be resolved with the supplier.

Program Considerations for Multi-Site Systems

For health systems with multiple DEA-registered locations, CSOS management adds a layer of credential administration that must be explicitly assigned and tracked. Each registered location is a separate DEA registration, and CSOS authority does not automatically extend across locations. Key program considerations include:

Maintaining a certificate inventory that tracks which individuals hold active CSOS certificates for which registrations
Building certificate renewal reminders into the compliance calendar with sufficient lead time for the renewal process
Ensuring that employee transitions (departures, role changes, leave) trigger immediate review of CSOS signing authority
Centralizing the reconciliation of CSOS orders to receiving records so that discrepancies across sites are visible to the system-level compliance team

CSOS: Electronic Ordering of Schedule II Controlled Substances Explained