OPS.1.2.2 Archiving

Before methods and products for electronic archiving are chosen, the technical, legal and organisational influencing factors MUST be determined and documented. The results MUST be incorporated into the archiving concept in question.

The aims to be achieved through archiving MUST be defined. In particular, this MUST take into consideration the rules to be followed, the employees who will be responsible, and the desired scope of functions and services.

The results MUST be documented in an archiving concept. The Top Management MUST be involved in this process. The archiving concept MUST be adapted to the current circumstances at regular intervals.

The IT components of an archive system MUST be installed in secured rooms. It MUST be ensured that only authorised persons may access the rooms. Archive storage media MUST be stored appropriately.

All the data, documents, and records stored in an archive MUST be uniquely indexed. To this end, the desired structure and extent of an archive's index information MUST be defined in the design phase.

The following MUST be ensured over the entire archiving period in question:

• the data format used can be processed by the applications used
• the data stored can be read and reproduced in the future in such a way that semantics and significance can be maintained
• the file system used on the storage medium can be processed by all the components involved
• the storage media can be read at any time without technical issues
• the cryptographic methods used for encryption and the preservation of legal relevance by means of digital signatures, seals, time stamps, or technical evidence records correspond to the state of the art

The integrity of index databases MUST be safeguarded and verifiable. In addition, index databases MUST be backed up regularly. It MUST be possible to restore the backups. Medium-sized and large archives SHOULD have redundant index databases.

All archive data, the related index databases, and the system data MUST be backed up at regular intervals (see CON.3 Backup Concept).

All attempts to access electronic archives MUST be logged. To this end, dates, times, users, client systems, the actions performed, and any error messages SHOULD be recorded. The archiving concept in question SHOULD specify how long the log data should be retained.

The log data for archive access SHOULD be evaluated regularly. In so doing, the internal specifications of the organisation at hand SHOULD be taken into account.

The specific staff members to whom specific events (e.g. system errors, timeouts, and the copying of records) should be displayed SHOULD also be defined. Critical events SHOULD be evaluated and, if required, escalated immediately once they are detected.

A suitable data format MUST be selected for archiving. It MUST ensure that archived data and selected features of the initial document medium can be reproduced in the long term in a format that is true to the original.

It MUST be possible to unambiguously interpret and electronically process the document structure of the selected data format. The syntax and semantics of the data formats used SHOULD be documented and published by a standardisation organisation. A loss-free image compression method SHOULD be used for evidential and audit-compliant archiving.

It SHOULD be ensured that employees use archive systems as prescribed in the applicable archiving concept. To this end, an administration and user policy SHOULD be drawn up. The administration policy SHOULD cover the following items:

• assignment of responsibility for operation and administration
• agreements regarding performance parameters during operation (including service level agreements)
• terms regarding the assignment of site and data access rights
• terms regarding the assignment of access rights to the services provided by the archive
• regulations regarding the handling of archived data and archive media
• monitoring of the archive system and the related environmental conditions
• rules on backups
• rules on logging
• separation of producers and consumers (OAIS model)

Users and the responsible employees in the IT Operation Department SHOULD be trained in their areas of responsibility.

The training of IT Operation Department employees SHOULD cover the following subjects:

• system architecture and security mechanisms of the archive system used and the underlying operating system
• installation and operation of the archive system and handling of archive media
• documentation of administrative activities
• escalation procedures

The user training SHOULD cover the following subjects:

• handling the archive system
• operating the archive system
• legal framework conditions of archiving

The completion of these training courses and the names of those who attend SHOULD be documented.

The capacity available in archive media SHOULD be monitored continuously. Once it has fallen below a defined threshold, a responsible employee MUST be alerted automatically. The alert SHOULD be role-based. A sufficient number of empty archive media MUST be available on short notice at any point in time to prevent storage bottlenecks.

Whether archiving processes are still working correctly and properly SHOULD be checked regularly. A checklist SHOULD be drawn up for this that includes questions regarding responsibilities, organisational processes, use of archiving, the redundancy of archived data, administration, and technical assessment of the archive system. The audit results SHOULD be documented transparently and compared against the target condition. Deviations SHOULD be investigated.

The market for archive systems SHOULD be observed regularly and systematically. Among other aspects, the following criteria SHOULD be taken into account:

• changes in standards
• instances in which hardware and software manufacturers move to different technologies
• published security gaps or vulnerabilities
• cases in which the security of cryptographic algorithms becomes compromised

Developments in the field of cryptography should be continuously monitored to assess the ongoing reliability and security of a given algorithm (see also OPS.1.2.2.A20 Appropriate Use of Cryptographic Procedures During Archiving).

Archive data that has been secured using cryptographic procedures that will no longer be suitable for securing in the foreseeable future SHOULD be re-secured in good time using suitable procedures.

Archive systems SHOULD be kept in line with the current state of the art over long periods of time. New hardware and software SHOULD be tested comprehensively before being installed in a running archive system. When commissioning new components or introducing new file formats, a migration concept SHOULD be drawn up. This concept SHOULD describe all changes, tests, and expected test results. Conversion of the individual data sets SHOULD be documented (using a transfer note).

When converting archive data to new formats, it SHOULD be checked whether the data must also be archived in its initial format as a consequence of legal requirements.

A new archive system SHOULD always be selected on the basis of the specifications mentioned in the archiving concept in question. It SHOULD meet the requirements formulated in this concept.

Appropriate media SHOULD be selected and used for archiving. In doing so, the following aspects should be considered:

• the data volumes to be archived
• the average access times
• the average number of simultaneous users accessing the archive system

The archive media SHOULD also meet the requirements of long-term archiving with regard to audit compliance and useful life.

Regular function and recovery tests SHOULD be performed for archiving. The readability and integrity of archived storage media SHOULD be checked at least once a year. Appropriate processes SHOULD be defined for troubleshooting.

Furthermore, the hardware components of archive systems SHOULD be checked for sound functionality at regular intervals. Whether all archiving processes work without any errors SHOULD also be checked regularly.

To cover long retention periods, archive data SHOULD only be secured with cryptographic procedures that are based on current standards.

If documents on paper are digitised and transferred to an electronic archive, it SHOULD be ensured that the digital copy matches the original document in terms of its images and content.