Special Interest Group: Industry Standards

Hello¡
I am working with a company that would like to get a certification on the trustworthyness of their ECM system (implementation and content) but we have doubts about which is the appropriate standard:
Is it possible to get certified on ISO 15801?... It seems that not because it is a TR; as 15489
Is it possible to be certified on ISO 18759? on ISO 18829:2017?
Can you tell me about certification bodies that are accredited to obtain this type of ISO certification?

Thanks,

------------------------------
Elisa Garcia-Morales
Information and Records Management Consultant
Inforarea, Madrid- Spain
------------------------------

@Betsy Fanning @Robert Blatt -- checking to see if either of you can help on this question from Elisa.

Thanks!

------------------------------
Jessica Lombardo
Director of Membership
AIIM
------------------------------

@Jessica Lombardo, I sent this to Bob right after it was posted.  he said he was working on a reply.  I suspect it got buried under his many other priorities and demands on his time. ​​

------------------------------
Lorne Rogers
Vice-Chair, ISO Trustworthy Content/Document Management
President
Aria Consulting & Implementers Ltd.
http://ariaconsulting.net
------------------------------

Original Message:
Sent: 11-21-2018 12:24
From: Jessica Lombardo
Subject: Trustworthiness certification

@Betsy Fanning @Robert Blatt -- checking to see if either of you can help on this question from Elisa.

Thanks!

------------------------------
Jessica Lombardo
Director of Membership
AIIM
------------------------------

Yes,  Elisa and <g class="gr_ gr_40 gr-alert gr_tiny gr_spell gr_inline_cards gr_run_anim ContextualSpelling multiReplace" id="40" data-gr-id="40">i</g> have been trying to find a good time to discuss this via a <g class="gr_ gr_137 gr-alert gr_spell gr_inline_cards gr_run_anim ContextualSpelling ins-del multiReplace" id="137" data-gr-id="137">skype</g> call.   Once <g class="gr_ gr_154 gr-alert gr_tiny gr_spell gr_inline_cards gr_run_anim ContextualSpelling multiReplace" id="154" data-gr-id="154">i</g> get some more clarity on what Elisa is trying to accomplish, <g class="gr_ gr_255 gr-alert gr_tiny gr_spell gr_inline_cards gr_run_anim ContextualSpelling multiReplace" id="255" data-gr-id="255">i</g> will post a detailed message to the group on the discussion.  If others have a similar question, we can <g class="gr_ gr_461 gr-alert gr_spell gr_inline_cards gr_run_anim ContextualSpelling ins-del" id="461" data-gr-id="461">setup</g> a con call for all those who have <g class="gr_ gr_522 gr-alert gr_gramm gr_inline_cards gr_run_anim Grammar only-ins replaceWithoutSep gr-progress" id="522" data-gr-id="522">interest</g> in this topic.

Regards,

R. Blatt

------------------------------
Robert Blatt, MIT, LIT, CHPA-III
Principal Consultant, Electronic Image Designers (EID).
Chair, Trustworthy Storage
Chair, Trustworthy Document Management & Assessment
Chair, ECM Implementation Guidelines
ISO Convenor: 18829, 18759, 22957, 18759)
US Delegate to ISO TC/171
TC/171 Liaison Officer to TC46 SC11
TC/171 Liaison Officer to TC/272
------------------------------

Original Message:
Sent: 11-21-2018 12:24
From: Jessica Lombardo
Subject: Trustworthiness certification

@Betsy Fanning @Robert Blatt -- checking to see if either of you can help on this question from Elisa.

Thanks!

------------------------------
Jessica Lombardo
Director of Membership
AIIM
------------------------------

Elsa;

As discussed over the phone, there is no agreed-upon industry certification for trustworthy content/records management solutions at this point.   There are various other documents prepared by other bodies that use the term "certification" and "trusted repositories", but neither of them meet the level of examination needed to properly perform a detailed assessment of not only how the technologies are begin used, but also how the technologies themselves have been designed and implemented/integrated.

The important item to note is that all organizations should have a compliant assessment performed by a qualified resource (ISO 18829) and that assessment should examine not only the policies and procedures but also the technologies that were implemented/deployed along with how the data was migrated from the existing storage locations into the secured environment.

Another standard that should be considered for any records environment is ISO 18759, Trusted Storage Sub-System (TSS) functional and technical requirements.   This is the standard developed by several storage vendors documenting the core functionality of the repository allowing an organization to determine whether the information is properly maintained in accordance with the record schedule/policy(ies), whether user follow these procedures and policies, and ensuring information appropriate levels of history and audit functions are integrated/implemented.  A key component within ISO 18759 is the "control head" within the environment ensuring/enforcing how the repository functions and protecting the data/records as the organization requires.

I hope this information helps.

------------------------------
Robert Blatt, MIT, LIT, CHPA-III
Principal Consultant, Electronic Image Designers (EID).
Chair, Trustworthy Storage
Chair, Trustworthy Document Management & Assessment
Chair, ECM Implementation Guidelines
ISO Convenor: 18829, 18759, 22957, 18759)
US Delegate to ISO TC/171
TC/171 Liaison Officer to TC46 SC11
TC/171 Liaison Officer to TC/272
------------------------------

Thank you, Robert.

First of all for your quick willingness to help me. Your response has been very helpful in helping to define the strategy in relation to assessing the trustworthiness of content/records management solutions.

Beyond the issue of records management, we have also the need to certify the reliability of the long-term preservation repository. In this sense I have seen that there is a certification body accredited for ISO 16363 called PTAB - Primary Trustworthy Authorisation Body. An interesting first experience towards certification is the Federal Digital System (FDsys) of GPO iso-16363-2012-audit-and-certification.

I have the perception that, as in the profession, there is a gap between records management and archives/digital preservation. Several aspects of the standards seem to overlap. I would like to know the opinion of this group. I don't know if there are connections between TC20 and TC171.

It has been a pleasure talking to you, an attentive greeting.
Elisa

 

------------------------------
Elisa Garcia-Morales
Information and Records Management Consultant
Inforarea, Madrid- Spain
------------------------------

Original Message:
Sent: 11-23-2018 08:59
From: Robert Blatt
Subject: Trustworthiness certification

Elsa;

As discussed over the phone, there is no agreed-upon industry certification for trustworthy content/records management solutions at this point.   There are various other documents prepared by other bodies that use the term "certification" and "trusted repositories", but neither of them meet the level of examination needed to properly perform a detailed assessment of not only how the technologies are begin used, but also how the technologies themselves have been designed and implemented/integrated.

The important item to note is that all organizations should have a compliant assessment performed by a qualified resource (ISO 18829) and that assessment should examine not only the policies and procedures but also the technologies that were implemented/deployed along with how the data was migrated from the existing storage locations into the secured environment.

Another standard that should be considered for any records environment is ISO 18759, Trusted Storage Sub-System (TSS) functional and technical requirements.   This is the standard developed by several storage vendors documenting the core functionality of the repository allowing an organization to determine whether the information is properly maintained in accordance with the record schedule/policy(ies), whether user follow these procedures and policies, and ensuring information appropriate levels of history and audit functions are integrated/implemented.  A key component within ISO 18759 is the "control head" within the environment ensuring/enforcing how the repository functions and protecting the data/records as the organization requires.

I hope this information helps.

------------------------------
Robert Blatt, MIT, LIT, CHPA-III
Principal Consultant, Electronic Image Designers (EID).
Chair, Trustworthy Storage
Chair, Trustworthy Document Management & Assessment
Chair, ECM Implementation Guidelines
ISO Convenor: 18829, 18759, 22957, 18759)
US Delegate to ISO TC/171
TC/171 Liaison Officer to TC46 SC11
TC/171 Liaison Officer to TC/272
------------------------------