and M. Todd
Organizations should establish criteria for determining which digital objects need to be
maintained as records and what methods should be employed to fix their form and content if
they are fluid when generated. The criteria should be based on business needs but should
respect as well the requirements of legal, administrative and historical accountability.
(C2) Record creation procedures should ensure that digital components of
records can be separately maintained and reassembled over time.


 (P4)
Every digital record is composed of one or more digital components. A digital component is
a digital object that is part of one or more digital records, including any metadata necessary to
order, structure or manifest content, and that requires a given preservation action. For example,
an e-mail that includes a picture and a digital signature will have at least four digital components
(the header, the text, the picture and the digital signature). Reports with attachments in different
formats wil


l consist of more than one digital component, whereas a report with its attachments
saved in one PDF file will consist of only one digital component. Although digital components
are each stored separately, each digital component exists in a specific relationship to the other
digital components that make up the record.
Preservation of digital records requires that all the digital components of a record be
consistently identified, linked and stored in a way that they can be retrieved and reconstituted


into a record having the same documentary presentation it manifested when last closed. Each
digital component requires one or more specific methods for decoding the bitstream and for
presenting it for use over time. The bitstream can be altered, as a result of conversion for
example, as long as it continues to be able to fulfil its original role in the reproduction of the
record. All digital components must be able to work together after they are altered; therefore, all
changes need to be assessed by t


he creator for the effects they may have on the record.
Organizations should establish policies and procedures that stipulate the identification of
digital components at the creation stage and that ensure they can be maintained, transmitted,
reproduced, upgraded and reassembled over time.
(C3) Record creation and maintenance requirements should be formulated in
terms of the purposes the records are to fulfil, rather than in terms of the
available or chosen record-making or recordkeeping technologies.


 (P6)
Digital records rely, by definition, on computer technology and any instance of a record
exists within a specific technological environment. For this reason, it may seem useful to
establish record creation and maintenance requirements in terms of the technological
characteristics of the records or the technological applications in which the records may reside.
However, not only do technologies change, sometimes very frequently, but they are also
governed by proprietary considerations established


 and modified at will by their developers.
Both these factors can significantly affect the accessibility of records over time. For these
reasons, references to specific technologies should not be included in records policies,
strategies and standards governing the creation and maintenance of an organization’s records.
Only the business requirements and obligations that the records are designed to support should
be explicitly kept in consideration at such a high regulatory level. At the level of impleme


ntation,
the characteristics of specific technologies should be taken into account to support the
established business requirement and make possible its realization.
Technological solutions to record creation and maintenance are dynamic, meaning that they
will evolve as the technology evolves. New technologies will enable new ways of creating
records that meet an organization’s business requirements. The rapid adoption of Web
technologies to support business communication and transaction illustrates


this. Specific
activities for maintaining records will therefore require continuing adaptation to new situations
InterPARES 2 Project, Policy Cross-domain

Page 5 of 5
Policy Framework, v1.2 (March 2008)
L. Duranti, J. Suderman and M. Todd
drawing on expertise from a number of disciplines. To extend the example of the use of Web
technologies, organizations creating and maintaining transactional records in a mainframe
environment need to draw on knowledge of the new Web technologies from both connec


tivity
(i.e., how to connect the mainframe to the Web) and security standpoints (i.e., how to protect
the records from remote, Web-based attacks). As new technologies are used to create records,
reference to new archival knowledge will continue to be required.
Technological solutions need to be specific to be effective. Although the general theory and
methodology of digital preservation applies to all digital records, the maintenance solutions for
different types of records require different methods.


 Therefore, they should be based on the
specific juridical-administrative context in which the records are created and maintained, the
mandate, mission or goals of their creator, the functions and activities in which the records
participate and the technologies employed in their creation to ensure the best solutions are
adopted for their maintenance.
Record policies that are expressed in terms of business requirements rather than
technologies will need to be periodically updated as the organization’s


 business requirements
change, rather than as the technology changes. It is the role of a specific action plan to identify
appropriate technological solutions for the maintenance of specific aggregations of records. The
identified solutions must be monitored with regard to the possible need for modifying and
updating. This requires the records creating body to be aware of new research developments in
the archival and records management fields and to collaborate with interdisciplinary efforts to
develo


p appropriate methods for the management of digital records.
(C4) Record creation and maintenance policies, strategies and standards should
address the issues of record reliability, accuracy and authenticity expressly and
separately. (P2)
In the management of digital records, reliability, accuracy and authenticity are three vital
considerations for any organization that wishes to sustain its business competitiveness and to
comply with legislative and regulatory requirements. These considerations shoul


d be directly
and separately addressed in records policies and promulgated throughout the organization. The
concept of reliability refers to the authority and trustworthiness of a record as a representation of
the fact(s) it is about; that is, to its ability to stand for what it speaks of. In other words, reliability
is the trustworthiness of a record’s content. It can be inferred from two things: the degree of
completeness of a record’s documentary form and the degree of control exercised over the
pr


ocedure (or workflow) in the course of which the record is generated. Reliability is then
exclusively linked to a record’s authorship and is the sole responsibility of the individual or
organization that makes the record. Because, by definition, the content of a reliable record is
trustworthy, and trustworthy content is, in turn, predicated on accurate data, it follows that a
reliable record is also an accurate record.
An accurate record is one that contains correct, precise and exact data. Accuracy of


 a
record may also indicate the absoluteness of the data it reports or its perfect or exclusive
pertinence to the matter in question. The accuracy of a record is assumed when the record is
created and used in the course of business processes to carry out business functions, based on
the assumption that inaccurate records harm business interests. However, when records are
transmitted across systems, refreshed, converted or migrated for continuous use, or the
technology in which the record resides is up


graded, the data contained in the record must be
verified to ensure their accuracy was not harmed by technical or human errors occurring in the
transmission or transformation processes. The accuracy of the data must also be verified when
records are created by importing data from other records systems. This verification of accuracy
is the responsibility of the physical or juridical person receiving the data; however, such person
is not responsible for the correctness of the data value, for which the se


nding person is
InterPARES 2 Project, Policy Cross-domain

Page 6 of 6
Policy Framework, v1.2 (March 2008)
L. Duranti, J. Suderman and M. Todd
InterPARES 2 Project, Policy Cross-domain

Page 7 of 7
accountable. Thus, the receiving person should issue a disclaimer regarding accuracy of
records using other persons’ data.
The concept of authenticity refers to the fact that a record is what it purports to be and has
not been tampered with or otherwise corrupted. In other words, authenticity is the


trustworthiness of a record as a record. An authentic record is as reliable and accurate as it was
when first generated. Authenticity depends upon the record’s transmission and the manner of its
maintenance and custody. Authenticity is maintained and verifiable by maintaining the identity
and integrity of a record. The identity of a record is established and maintained by indicating at a
minimum the names of the persons participating in the creation of the record (e.g., author,
addressee); the action o


r matter to which the record pertains; the date(s) of compilation, filing or
transmission; the record’s documentary form; the record’s digital presentation (or format); the
relationship of the record to other records through a classification code or a naming convention;
and the existence of attachments. The integrity of a record is established and maintained by
identifying the responsibility for the record through time by naming the handling person or
office(s)13 and the trusted records officer14 or th


e recordkeeping office,15 identifying access
privileges16 and access restrictions17 and indicating any annotations or any modifications
(technical or otherwise) made to the record by the persons having access to it.
Thus, record reliability is a quality that is established when a record is created and implies
accuracy of the data contained in the record, while record accuracy and authenticity are
qualities that are connected with the transmission and maintenance of the record. The latter are
therefor


e the responsibility of both the records creator and any legitimate successor.
Authenticity is protected and guaranteed through the adoption of methods that ensure the
record is not manipulated, altered, or otherwise falsified after its creation, either during its
transmission or in the course of its handling and preservation, within the recordkeeping
system.18
(C5) A trusted record-making system should be used to generate records that can
be presumed reliable.19
A trusted record-making system consi


sts of a set of rules governing the making of records
and a set of tools and mechanisms used to implement these rules. To generate reliable records,
every record-making system should include in its design integrated business and documentary
procedures, record metadata schemes, records forms, record-making access privileges and
record-making technological requirements.
Integrated business and documentary procedures are business procedures linked to
documentation procedures and to the classification sy


stem (i.e., the file management plan or
taxonomy) established in the organization. This integration reinforces the control over record-
making procedures: it supports the reliability of records by explicitly connecting records to the

13 Handling office (or person) is defined as “The office (or officer) formally competent for carrying out the action to which the record
relates or for the matter to which the record pertains” (InterPARES 2 Terminology Databa


se, op. cit.).
14 Trusted records officer (also called records keeper or records manager) is defined as “an individual or a unit within the creating
organization who is responsible for keeping and managing the creator’s records, who has no reason to alter the kept records or
allow others to alter them and who is capable of implementing all of the benchmark requirements for authentic records” (Ibid.).
These are listed in The Long-term Preservation of Authentic Electronic Records, cit., “Authenticity Task


 Force Report,” available at
http://www.interpares.org/book/interpares_book_d_part1.pdf and, more specifically, the already cited “Requirements for Assessing
and Maintaining the Authenticity of Electronic Records,” available at http://www.interpares.org/book/interpares_book_k_app02.pdf.”
15 Recordkeeping office is defined as “The office given the formal competence for designing, implementing and maintaining the
creator’s trusted recordkeeping system” (InterPARES 2 Terminology Database, op. cit.).
16 Ac


cess privileges is defined as “The authority to access a system to compile, classify, register, retrieve, annotate, read, transfer or
destroy records, granted to a person, position or office within an organization or agency” (Ibid.).
17 Access restrictions is defined as “The authority to read a record, granted to a person, position or office within an organization or
agency” (Ibid.).
18 See MacNeil et al., “Authenticity Task Force Report,” op. cit.
19 There is no corresponding Preserver Principle.
Pol


icy Framework, v1.2 (March 2008)
L. Duranti, J. Suderman and M. Todd
activities in which they participate and to the records organization system, thereby standardizing
the procedures for creating and managing those records. The integration of business and
documentary procedures also establishes the basis and central means to demonstrate
ownership of and responsibility for the records. A record-making metadata scheme is a list of all
metadata elements that need to be documented in the course of record-


making processes for
the purposes of uniquely identifying each record and enabling the maintenance of its integrity
and the presumption of its authenticity. Such a scheme can also be used later to verify
authenticity when questioned. Records forms are specifications of the documentary forms for
the various types of records generated in the record-making system. Access privileges refer to
the authority to compile, edit, annotate, read, retrieve, transfer and/or destroy records in the
record-making syst


em, granted to officers and employees by the records creator on the basis of
position duties and business needs. Access privileges control access to the record-making
system and are established in the course of integrating business and documentary procedures
through connecting specific classes of records to the office of primary responsibility for a
business function or activity. The establishment and implementation of access privileges is the
most important step towards ensuring that the reliability o


f records can be presumed. Record-
making technological requirements include the hardware and software specifications for the
record-making system that have a direct impact on the documentary form of records.
(C6) A trusted recordkeeping system should be used to maintain records that can
be presumed accurate and authentic. (P11, P12)
A trusted recordkeeping system consists of a set of rules governing the keeping of records
and a set of tools and mechanisms used to implement these rules. Every recordke


eping system
should include in its design a recordkeeping metadata scheme, a classification scheme, a
retention schedule, a registration system, a recordkeeping retrieval system, recordkeeping
technological requirements, recordkeeping access privileges and procedures for maintaining
accurate and authentic records.
A recordkeeping metadata scheme is the list of all necessary metadata to be attached to
each record to ensure its continuing identity and integrity in the recordkeeping system. A
classific


ation scheme is a plan for the systematic identification and arrangement of business
activities and related records into categories according to logically structured conventions,
methods and procedural rules. A retention schedule is a document specifying and authorizing
the disposition of aggregations of records as identified in the classification scheme. A
registration system is a method for assigning a unique identifier to each created record, linked to
its identity and integrity metadata. Recordkeep


ing access privileges refer to the authority to
classify, annotate, read, retrieve, transfer and/or destroy records in the recordkeeping system,
granted to officers and employees by the records creator based on position duties and business
needs. Typically, access to records for purposes of classification, transfer and destruction is
given only to the trusted records officer of the organization. A recordkeeping retrieval system is
a set of rules governing the searching and finding of records and/or inf


ormation about records in
a recordkeeping system and the tools and mechanisms used to implement these rules.
Recordkeeping technological requirements include the hardware and software specifications for
the recordkeeping system. The procedures for maintaining accurate and authentic records are
the procedures designed to ensure that the data in the records and the identity and integrity of
the records in the recordkeeping system are protected from accidental or malicious corruption or
loss.
To improve


 efficiency and reduce the potential for human-induced error, the record-making
and recordkeeping systems should be designed to automate, as much as possible, the creation
of the identity and integrity metadata both at the point of records creation or modification (e.g.,
when migrated to a new system or file format), and whenever the aggregations to which the
InterPARES 2 Project, Policy Cross-domain

Page 8 of 8
Policy Framework, v1.2 (March 2008)
L. Duranti, J. Suderman and M. Todd
InterPARES 2 P


roject, Policy Cross-domain

Page 9 of 9
records belong are created or modified—every record unit should automatically inherit the
metadata of the higher level in the classification at the point of creation as well as whenever
there are updates to the metadata of the higher level.
A records creator should indicate in its records management policy that it is the trusted
records officer’s responsibility to manage the recordkeeping system. The role of the trusted
records officer is analogous to that of


 a trusted custodian; thus, the trusted records officer
should have the qualifications for a trusted custodian as stated in principle C8.
A recordkeeping system that complies with the above requirements and procedures in its
design and management is capable of ensuring the accuracy and authenticity of records after
their creation, since these requirements and procedures establish the maximum degree of
control with regard to the maintenance and use of the records.
(C7) Preservation considerations sho


uld be embedded in all activities involved in
record creation and maintenance if a creator wishes to maintain and preserve
accurate and authentic records beyond its operational business needs. (P7)
The concept of the records lifecycle in archival science refers to the theory that records go
through distinct phases, including creation, use and maintenance and disposition (i.e.,
destruction or permanent preservation).
It is essential for records creators dealing with records in digital form to understan


d that,
differently from what is the case with traditional records, preservation is a continuous process
that begins with the creation of the records. Traditionally, records are appraised for preservation
at the disposition stage, when they are no longer needed for business purposes. With digital
records, decisions regarding preservation must be made as close as possible to the creation
stage because of the ease with which they can be manipulated and deleted or lost to
technological obsolescence.
Th


e notion that records preservation starts at the creation stage requires that preservation
considerations be incorporated and manifested in the design of record-making and
recordkeeping systems. Each aggregation of records appraised for preservation should be
identified in accordance with the classification scheme and records retention schedule
established by the records creator, and this identification should be indicated among the records
metadata. The aggregations of records so identified should be


monitored throughout their
lifecycle so that appraisal decisions and preservation considerations can be updated and/or
modified to accommodate any possible change occurring after they are first made. To monitor
and implement appraisal decisions and preservation considerations, the designated preserver
should be given access to the organization’s recordkeeping system. Policies and procedures
should be established to facilitate constant interaction between the records creator and its
designated preserve


r.
(C8) A trusted custodian should be designated as the preserver of the creator’s
records. (P1)
The designated records preserver is the entity responsible for taking physical and legal
custody of and preserving20 (i.e., protecting and ensuring continuous access to) a creator’s
inactive records.21 Be it an outside organization or an in-house unit, the role of the designated

20 The term “preservation” is defined as “The whole of the principles, policie


s, and strategies that controls the activities designed to
ensure materials’ (data, documents, or records) physical and technological stabilization and protection of intellectual content”
(InterPARES 2 Terminology Database, op. cit.).
21 An inactive record is defined as “A record that is no longer needed by the creator for day-to-day activity, but that may be
preserved and occasionally used for legal, historical or operational purposes” (Ibid.).
Policy Framework, v1.2 (March 2008)
L. Duranti, J. Suder


man and M. Todd
InterPARES 2 Project, Policy Cross-domain

Page 10 of 10
preserver should be that of a trusted custodian for a creator’s records. To be considered as a
trusted custodian, the preserver must:
•
act as a neutral third party; that is, demonstrate that it has no stake in the content of the
records and no reason to alter records under its custody and that it will not allow
anybody to alter the records either accidentally or on purpose;
•
be equipped with the knowledge and skills neces


sary to fulfil its responsibilities, which
should be acquired through formal education in records and archives administration; and
•
establish a trusted preservation system that is capable of ensuring that accurate and
authentic copies of the creator’s records are acquired and preserved.
For as long as the records are maintained by the creator in its recordkeeping system, they
are active or semi-active records,22 although under the responsibility of a trusted records officer.
A records custodian tru


sted by the records creator as its designated preserver should maintain
records that have been removed from the recordkeeping system for long-term or indefinite
preservation. This trusted custodian will establish and maintain a preservation system to receive
and preserve the creator’s digital records. This involves ensuring that the accuracy and
authenticity of the records received from the creator are assessed and maintained. Within the
context of the preservation system, the designated preserver iden


tifies appropriate preservation
strategies and procedures, drawing on expertise from various disciplines, including archival
science, computer science and law. The preservation procedures are implemented within the
preservation system.
Only preservers that satisfy the requirements for trusted custodian are capable of fulfilling
their duties of preserving authentic records over time and enabling a presumption of authenticity
of the authentic copies they make for preservation purposes.
(C9) All busin


ess processes that contribute to the creation and/or use of the same
records should be explicitly documented. (P10)
Records created in the course of carrying out one business function or one business
process are often also used in the course of conducting other business functions or processes.
In cases like this, records used in separate activities may be associated only with one activity in
the records creator’s record-making or recordkeeping system, or with none in some central
“information” system


or application. This practice creates difficulties for the records creator in
identifying aggregations of records for accountability purposes and for its designated preserver
in conducting appraisal and preservation activities.
It is recommended that policies and procedures be established that require detailed
documentation of all business functions and processes contributing to the creation and use of
the same records in any records creator’s application or system and an explicit linkage between
eac


h record and the related workflow. Procedural manuals with such descriptions are effective
in increasing the awareness of the impact of record-making and recordkeeping on the
management of an organization. A subsequent different use of records after their creation can
be captured by metadata, which are also capable of tracing the contexts in which records are
generated.

22 An active record is defined as “A record needed by the creator for the purpose o


f carrying out the actions for which it was created
or for frequent reference” (Ibid). A semi-active record is defined as “A record that is no longer needed for the purpose of carrying out
the actions for which it was created, but which is needed by the records creator for infrequent reference” (Ibid.).
Policy Framework, v1.2 (March 2008)
L. Duranti, J. Suderman and M. Todd
(C10) Third-party intellectual property rights attached to the creator’s records
should be explicitly identified and managed in t


he record-making and
recordkeeping systems. (P8)
Every records creator is usually aware that the records that it creates, or which are under its
control or custody, contain information covered by intellectual property legislation. However,
creators should also be aware that in some cases the intellectual property rights linked to a
record may belong to a party other than the author and addressee.
All intellectual property rights attached to a record need to be documented in the metadata
accompanying


 such record at the time that it is made or received and set aside. Intellectual
property issues can significantly influence the reproduction of records, which is central to the
processes of refreshing, converting and migrating records for either continuous use or
preservation purposes. Subject to variations among different legislative environments,
reproductions of records with intellectual property rights held by third parties may violate
legislation that protects such rights. These issues must be id


entified and addressed at the stage
of designing the record-making and recordkeeping systems. In the case of records identified for
long-term preservation, long-term clearance of such rights should be addressed explicitly in the
creator’s record policy.
(C11) Privacy rights and obligations attached to the creator’s records should be
explicitly identified and protected in the record-making and recordkeeping
systems. (P9)
Privacy legislation protects the rights of individuals with reference to personal


 data that may
be part of any record used and maintained by a records creator with whom they have interacted.
The limits of privacy depend on the legislative framework in which the records creator operates.
The framework may be in conflict with the access policy linked to the mandate of the records
creator and even with the access to information legislation in the same jurisdiction.
The presence of personal information within the records should be identified and
documented within the metadata schema


linked to the records in the record-making and
recordkeeping systems of the creator. Metadata schemas that note and administer the use of
personal information contained within the records must be embedded in record-making and
recordkeeping systems. This will enable the protection of personal information through the
establishment of system-wide access privileges. In cases where records are to be preserved
indefinitely, privacy issues relating to access to records must be expressly resolved (i.e., explic


it
permissions must be sought from the individuals concerned), ideally prior to record creation.
This is the best way to ensure that the records are managed in accordance with privacy
legislation and that the preserver will be able to effectively include the privacy issues relevant to
the records in the preservation feasibility study during appraisal. The designated preserver for
each records creator should, as a trusted custodian, be granted access to records containing
personal information to perfor


m preservation activities. Processing of personal information for
maintenance or preservation purposes is different from the use of it for research or business
purposes. Regardless of the legislative framework, the records creator should be able to
demonstrate that processing of records containing personal information does not put such
information at risk of unauthorized access.
Responsibility for processing records containing personal data for maintenance and
preservation purposes must reside with th


e records creator and its legitimate successors.
Although the practice of outsourcing these functions to specialized commercial operators is
authorized and regulated under most existing privacy legislation, the practice should still be
avoided whenever possible to minimize the number of individuals authorized to access and/or
process the records, thus reducing the risk of unauthorized disclosure of personal information in
InterPARES 2 Project, Policy Cross-domain

Page 11 of 11
Policy Framework, v1.


2 (March 2008)
L. Duranti, J. Suderman and M. Todd
the records and of jeopardizing the ability to obtain permission to process personal information
for maintenance or preservation purposes.
In the case of records that are not yet designated for permanent preservation, appraisal
decisions should be taken before the initial mandate for processing personal information has
expired to ensure that the legal basis for retaining such records is still in force.
(C12) Procedures for sharing records across diff


erent jurisdictions should be
established on the basis of the legal requirements under which the records are
created. (P13)
Records creators with branches in geographically separate areas (i.e., areas that are
covered by different legislation), must be aware that different access, privacy and intellectual
property laws may have an impact on their records-sharing activities. Such sharing activities
encompass records exchange within the records creator or with outside organizations, such as
governments


 or business partners. This includes providing records to a trusted preserver, where
the latter operates in a legal environment different from that of the records creator.
The fact that records are freely accessible in one jurisdiction does not imply that they can be
accessed in the same way in other jurisdictions. Records creators must investigate such issues
and address them in their policies.
(C13) Reproductions of a record made by the creator in its usual and ordinary
course of business and for i


ts purposes and use, as part of its recordkeeping
activities, have the same effects as the first manifestation, and each is to be
considered at any given time the record of the creator. (P3)
In the digital environment, the first manifestation of a record, be it a draft, an original or a
copy, only exists when first composed in the creator’s record-making system, if it is an internal
record, or when first received in the creator’s recordkeeping system, if it is transmitted from the
outside. When the re


cord is closed and saved into the record-making or recordkeeping system,
its first manifestation technically disappears, as the saving action decomposes it into its digital
components. Any later manifestation of the digital record is a reproduction resulting from an
assembly of its digital components. Conceptually, however, records creators can use any
reproduction of a record’s first manifestation as if it were the record’s first manifestation, as long
as the reproduction is made in the usual and ordi


nary course of carrying out business activities
and used for such activities. This means that each reproduction in sequence should have the
same admissibility in court as the record’s first manifestation and be given the same weight.
To establish that a record is reproduced in the usual and ordinary course of business, it is
necessary to set out routine procedures in writing. In effect, if reliable records have been
generated in a trusted record-making system and their accuracy and authenticity have be


en
maintained together with that of the received records in the creator’s recordkeeping system,
then all records should have the same authority and effects as their first manifestation.
Although, according to the theory of the record (i.e., diplomatics), an “original” record in a
digital system is the first manifestation of a received record and, if after closing such
manifestation the original no longer exists, it might be useful to look at three examples of
statutory laws pertaining to the meaning o


f “original.” Common to all three variations is the
principle that it is the relationship of a record to the business of the creator that determines
whether the record in question has the authority and effects of an original.
InterPARES 2 Project, Policy Cross-domain

Page 12 of 12
Policy Framework, v1.2 (March 2008)
L. Duranti, J. Suderman and M. Todd
InterPARES 2 Project, Policy Cross-domain

Page 13 of 13
Example 1: The U.S. Federal Rules of Evidence distinguishes between originals and
duplic


ates, with greater value as evidence given to originals. For digital records, it is
noteworthy that if “data are stored in a computer or similar device, any printout or
other output readable by sight, shown to reflect the data accurately, is an ‘original.’”23
Example 2: The quality of being original is acknowledged in Italian legislation in
terms of adding weight or greater trustworthiness to records. Italian legislation
emphasizes the difference between digital data (original) and any kind of output


of
those data (copy), by establishing that “any data or document electronically created
by any public administration represents a primary and original source of information
that may be used to make copies on any kind of medium for all legal purposes.”24
Example 3: The Electronic Signatures Law of the People’s Republic of China regards
a digital record as an original if it meets the two following qualifications: it must be 1)
capable of presenting the content effectively and of being retrieved and con


sulted at
any moment, and 2) capable of unfailingly showing the integrity of the content from
the moment of its completion. However, annotations made to a data electronic
document [digital record] and changes of presentation occurring in the process of
data exchanging, storing and displaying are not considered to affect its integrity.25
Principles for Records Preservers
(P1) A designated records preserver fulfils the role of trusted custodian. (C8)
The designated records preserver is the entity respo


nsible for taking physical and legal
custody of and preserving (i.e., protecting and ensuring continuous access to) a creator’s
inactive records. Be it an outside organization or an in-house unit, the role of the designated
preserver should be that of a trusted custodian for a creator’s records. To be considered as a
trusted custodian, the preserver must:
•
act as a neutral third party; that is, demonstrate that it has no stake in the content of the records
and no reason to alter records under its cu


stody and that it will not allow anybody to alter the
records either accidentally or on purpose;
•
be equipped with the knowledge and skills necessary to fulfil its responsibilities, which should be
acquired through formal education in records and archives administration; and
•
establish a trusted preservation system that is capable of ensuring that accurate and authentic
copies of the creator’s records are acquired and preserved.
The acquisition of a creator’s records is undertaken by the preserv


er, who, after having
assessed the accuracy and authenticity of the records, produces an authentic copy of them from
the creator’s recordkeeping system. Records that are acquired this way are authentic copies of
the records of the creator identified for long-term preservation, because they are made by the
designated preserver in its role of trusted custodian.
The authentic copies of the creator’s records are then kept by the trusted custodian in a
trusted preservation system, which should include in


its design a description and a retrieval
system. This trusted preservation system must also have in place rules and procedures for the

23 United States House of Representatives, Federal Rules of Evidence, Article X. Contents of Writings, Recordings, and
Photographs: Rule 1001. Definitions, Committee on the Judiciary, Committee Print No. 8 (December 31, 2004). Available at
http://judiciary.house.gov/media/pdfs/printers/108th/evid2004.pdf. The same rule ge


neralizes that “any counterpart” to the writing or
recording “intended to have the same effect by a person executing or issuing it” is an original.
24 Italy, DPR 445/2000, art. 9, par. 1. Available at http://www.parlamento.it/parlam/leggi/deleghe/00443dla.htm.
25 China. Electronic Signatures Law of the People’s Republic of China, art. 5. Translated by Sherry Xie. See also Sherry Xie (2005).
“InterPARES 2 Project – Policy Cross-domain: Supplements to the Study of Archival Legislation in China (Report I),


” 3. Available at
http://www.interpares.org/display_file.cfm?doc=ip2(policy)archival_legislation_CHINA_SUPPLEMENT.pdf.
Policy Framework, v1.2 (March 2008)
L. Duranti, J. Suderman and M. Todd
InterPARES 2 Project, Policy Cross-domain

Page 14 of 14
ongoing production of authentic copies as the existing system becomes obsolete and the
technology is upgraded. This requirement is consistent with the final recommendations of
InterPARES 1, which developed the Baseline Requirements Supporting the Producti


on of
Authentic Copies of Electronic Records,26 a set of requirements to be implemented by the
preserver. It should be noted that the simple fact of reproducing records in the preserver’s
preservation system does not make the results authentic copies; such designation must be
provided by the preserver’s authority.
A sustainable preservation strategy requires close collaboration between a records creator
and its designated preserver as trusted custodian. It is the preserver’s responsibility to take the


initiative in collaborating with the creator to establish acquisition and preservation procedures
and in advising the creator in any records management activities essential to the preserver’s
acquisition and preservation activities.
(P2) Records preservation policies, strategies and standards should address the
issues of record accuracy and authenticity expressly and separately. (C4)
An accurate record is one that contains correct, precise and exact data. The accuracy of a
record is assumed when the


 record is created and used in the course of business processes to
carry out business functions, based on the assumption that inaccurate records harm business
interests. However, when records are transmitted across systems, refreshed, converted or
migrated for preservation purposes, or the technology in which the record resides is upgraded,
the data contained in the record must be verified to ensure their accuracy was not harmed by
technical or human errors occurring in the transmission or transformati


on processes. This
verification of accuracy is the responsibility of the preserver who carries out the transmission or
transformation process; however, such person is not responsible for the correctness of the data
value, for which the creator remains accountable, just as is the case for the reliability of the
records containing the data.
The concept of authenticity refers to the fact that a record is what it purports to be and has
not been tampered with or otherwise corrupted. In other words, authen


ticity is the
trustworthiness of a record as a record. A record is authentic if it can be demonstrated that it is
as it was when created. An authentic record is as reliable and accurate as it was when first
generated. Authenticity depends upon the record transmission and the manner of its
preservation and custody. Thus, it is a responsibility of both the records creator and its
legitimate successor (i.e., either the person or organization acquiring the function(s) from which
the records in question re


sult and the records themselves, or a designated records preserver).
Authenticity is protected and is verifiable by ensuring that the identity and the integrity of a
record are maintained. The identity of a record is what distinguishes it from all other records. It
is declared at the moment of creation by indicating at a minimum the following attributes: the
names of the persons participating in the creation of the record (e.g., author, addressee); the
action or matter to which the record pertains; the


 date(s) of compilation, filing or transmission;
the record’s documentary form; the record’s digital presentation (or format); the relationship of
the record to other records through a classification code or a naming convention; and the
existence of attachments. The record identity so declared must be maintained intact through
time first by the creator and its trusted records officer while the record is in active or semi-active
use, and subsequently by the designated records preserver when the record i


s designated as
inactive. The integrity of a record is its wholeness and soundness and can only be inferred from
circumstantial evidence related to the person who held responsibility for the record through time,
from access privileges and access restrictions and from the indication of any annotation or
modification (technical or otherwise) that such person(s) with access to record might have made

26 See MacNeil et al., “Authenticity Task Force Report,”


op. cit., and, more specifically, Authenticity Task Force, “Appendix 2.”
Policy Framework, v1.2 (March 2008)
L. Duranti, J. Suderman and M. Todd
InterPARES 2 Project, Policy Cross-domain

Page 15 of 15
to it. Thus, the establishment and maintenance of record integrity are supported by declaring the
following record attributes: the names of the handling office(s), the office of primary
responsibility27 for the record over time and/or the recordkeeping office and the designated
preserver; the access


privileges code28 and the access restriction code;29 and the list of
annotations30 and of format changes.31
Authenticity is not a quality that can be bestowed on records after their creation and
maintenance by any preservation process. A preserver can only protect and maintain what was
transferred under its responsibility. Authenticity is protected and maintained through the
adoption of methods that ensure that the record is not manipulated, altered, or otherwise
falsified after its transfer. It is t


he preserver’s responsibility to assess the authenticity of records
considered for acquisition into a preservation system and to ensure that it remains intact after
the transfer to such system by respecting within the preserving unit or organization the same
Benchmark Requirements that bind the creator (e.g., access privileges, measure against
corruption or loss) and the Baseline Requirements for preservers.
(P3) Reproductions of a creator’s records made for purposes of preservation by
their trusted


custodian are to be considered authentic copies of the creator’s
records. (C13)
Reproductions of digital records in the creator’s record-making and recordkeeping systems
made in the usual and ordinary course of activity for either action or reference purposes can be
considered to have the same authority and effects as the first manifestation of the same
records. Reproductions of a creator’s records for preservation purposes rather than in response
to a creator’s business need are considered authentic


copies of the records of the creator,
because they are never used in their present manifestation for action or reference by the creator
itself. The creator’s records and their authentic preservation copies are the same records but at
different phases in their lifecycle and thus at a different status of transmission.32 The former are
used by their creator to achieve business goals, while the latter are made by the preservers for
preservation purposes.
Copies of records in the preserver’s preservation


system may not be designated authentic if
the preserver has made them for purposes other than preservation; for example, a copy from
which personal identifiers are removed may be made for access purposes. Ultimately, only the
preserver has the authority to designate a copy as authentic.
(P4) Records preservation procedures should ensure that the digital components
of records can be separately preserved and reassembled over time. (C2)
Every digital record is composed of one or more digital components.


A digital component is
a digital object that is part of one or more digital records, including any metadata necessary to
order, structure or manifest content and that requires a given preservation action. For example,
an e-mail that includes a picture and a digital signature will have at least four digital components

27 Office of primary responsibility is defined as “The office given the formal competence for maintaining the authoritative version or
cop


y of records belonging to a given class within a classification scheme” (InterPARES 2 Terminology Database, op. cit.).
28 Access privileges code is defined as “The indication of the person, position or office authorized to annotate a record, delete it, or
remove it from the system” (Ibid.).
29 Access restriction code is defined as “The indication of the person, position or office authorized to read a record” (Ibid.).
30 List of annotations is defined as “Recorded information about additions made to a re


cord after it has been created” (Ibid.).
31 List of format changes is defined as “Recorded Information about modifications to a record’s documentary form or digital format
after it has been created” (Ibid.).
32 In diplomatics, the status of transmission is the degree of perfection of record. There are three possible statuses of transmission:
draft, original and copy. Copies are than further categorized according to their authority, and the most authoritative among the
copies is the authentic copy; that


 is, a reproduction that is declared conforming to the reproduced entity by an officer having the
authority to do so. Professional archivists are among such officers.
Policy Framework, v1.2 (March 2008)
L. Duranti, J. Suderman and M. Todd
InterPARES 2 Project, Policy Cross-domain

Page 16 of 16
(the header, the text, the picture and the digital signature). Reports with attachments in different
formats will consist of more than one digital component, whereas a report with its attachments
saved in on


e PDF file will consist of only one digital component. Although digital components
are each stored separately, each digital component exists in a specific relationship to the other
digital components that make up the record.
Preservation of digital records requires that all the digital components of a record be
consistently identified, linked and stored in a way that they can be retrieved and reconstituted
into a record having the same presentation it manifested when last closed. Each digital
componen


t requires one or more specific methods for decoding the bitstream and for presenting
it for use over time. The bitstream can be altered, as a result of conversion, for example, as long
as it continues to be able to fulfil its original role in the reproduction of the record. All digital
components must be able to work together after they are altered; therefore, all changes need to
be assessed by the preserver for the effects they may have on the record.
The preserver must be prepared to advise the cre


ator, directly or through development of
recommended standards, on the types of digital components that the preserver’s system is able
to sustain. Where standards governing the types and formats of digital components are
common to both the record-making and recordkeeping systems and the record preservation
system, the preserver can directly influence the creator towards those standards that will
facilitate meeting the preservation requirements. Where no common standards exist or can
reasonably be adop


ted, the preserver must understand the degree of interoperability of certain
types and formats of digital components. This understanding will provide a basis for the
preserver to assess the capability of the preservation system to preserve the digital components
and their relationships as they emerge from the creator’s record-making and recordkeeping
systems.
Highly interoperable formats—that is, formats that are not tied to specific applications or
versions of applications—are generally seen to prov


ide a better basis for preservation work. It is
important, however, not to focus exclusively on the interoperability of formats at the expense of
the relationships between them that also must be preserved. For example, an HTML-based
Web page may be comprised of digital components that are highly interoperable, but the version
of HTML coding used to structure the components may be an old version with many deprecated
terms (i.e., terms that are not recognized by current software browsers that may be used


 to
reproduce the Web page).
(P5) Authentic copies should be made for preservation purposes only from the
creator’s records; that is, from digital objects that have a stable content and a
fixed documentary form. (C1)
A record is defined by InterPARES, following the traditional archival definition, as “a
document made or received in the course of a practical activity as an instrument or a by-product
of such activity and set aside for action or reference.”33 This definition implies that, to be
consid


ered as a record, a digital object generated by the creator must first be a document; that
is, must have stable content and fixed documentary form. Only digital objects possessing both
are capable of serving the record’s memorial function.
The concept of stable content is self-explanatory, as it simply refers to the fact that the data
and the information in the record (i.e., the message the record is intended to convey) are
unchanged and unchangeable. This implies that data or information cannot be ov


erwritten,
altered, deleted or added to. Thus, if one has a system that contains fluid, ever-changing data or
information, one has no records in such a system until one decides to make one and to save it
with its unalterable content.

33 See the InterPARES 2 Terminology Database, op. cit.
Policy Framework, v1.2 (March 2008)
L. Duranti, J. Suderman and M. Todd
InterPARES 2 Project, Policy Cross-domain

Page 17 of 17
The concept of fixed form is mor


e complex. A digital object has a fixed form when its binary
content is stored so that the message it conveys can be rendered with the same documentary
presentation it had on the screen when first saved. Because the same documentary
presentation of a record can be produced by a variety of digital presentations, fixed form does
not imply that the bitstreams must remain intact over time. It is possible to change the way a
record is contained in a computer file without changing the record; for example, if


 a digital object
generated in ‘.doc’ format is later saved in ‘.pdf’ format, the way it manifests itself on the
screen—its documentary presentation, or “documentary form”—has not changed, so one can
say that the object has a fixed form.
One can also produce digital information that can take several different documentary forms.
This means that the same content can be presented on the screen in several different ways, the
various types of graphs available in spreadsheet software being one example. In


this case, each
presentation of such a digital object in the limited series of possibilities allowed by the system is
to be considered as a different view of the same record having stable content and fixed form.
In addition, one has to consider the concept of “bounded variability,”34 which refers to
changes to the form and/or content of a digital record that are limited and controlled by fixed
rules, so that the same query, request or interaction always generates the same result. In such
cases, variat


ions in the record’s form and content are either caused by technology, such as
different operating systems or applications used to access the document, or by the intention of
the author or writer of the document. Where content is concerned, while, as mentioned, the
same query will always return the same subset, its presentation might vary within an allowed
range, such as image magnification. In consideration of the fact that what causes these
variations also limits them, they are not considered to be v


iolations of the requirements of stable
content and fixed form.
Based on this understanding, any preservation policy should clearly state that reproductions
of authentic copies for preservation purposes can only be made from the creator’s records, as
identified by the creator.35
The preserver should know (or help establish) the creator’s criteria for identifying the digital
objects that are maintained as records and the methods employed to stabilize their content and
fix their form. This is consiste


nt with the preserver’s responsibility to advise the creator on its
record creation processes and technologies. This advising activity will also provide the
preserver with the critical information needed to understand the business activities and
processes that caused the records to come into being and with the ability to assess their
continuing identity and integrity.
(P6) Preservation requirements should be articulated in terms of the purpose or
desired outcome of preservation, rather than in terms


of the specific technologies
available. (C3)
Digital records rely, by definition, on computer technology, and any instance of a record
exists within a specific technological environment. For this reason, it may seem useful to
establish record preservation requirements in terms of the technological characteristics of the
records or the technological applications in which the records may reside. However, not only do
technologies change, sometimes very frequently, but they also are governed by proprietar


y
considerations established and modified at will by their developers. Both these factors can
significantly affect the continued accessibility of digital records over time. For these reasons,
references to specific technologies should not be included in preservation policies and
standards. Only the requirements and obligations that the records are designed to support

34 See Duranti and Thibodeau, “The Concept of Record,” op. cit.
35 See principle C1 in


 the Principles for Creators regarding the identification of records.
Policy Framework, v1.2 (March 2008)
L. Duranti, J. Suderman and M. Todd
should be explicit within record preservation policies and standards. It is only at the level of
implementation that specific technologies should, indeed must, be named.
Technological solutions to record preservation issues are dynamic, meaning that they will
evolve as the technology evolves. This affects record preservation in two ways. First, it makes it
pos


sible to adopt new strategies to meet preservation needs, as happened with the use of XML
to support the long-term preservation of structured records. Second, it creates opportunities for
drawing on expertise from a number of disciplines. These two issues are interconnected. Thus,
for example, while utilization of XML is, by itself, only one activity for preservation, it might be
matched with using data grid technology as a stable and enduring platform to support XML-
based records. By experimenting wit


h these combinations, new archival knowledge will continue
to be both acquired and required.
Technological solutions also need to be specific to be effective. Although the general theory
and methodology of digital preservation applies to all digital records, the preservation solutions
for different types of records require different methods. These should be based on the specific
context in which the records are created and maintained, the functions and activities to which
the records are linked and t


he technologies employed for record-making and recordkeeping to
ensure the best solutions are designed for preserving each type of record.
Preservation policies that are expressed in terms of record requirements rather than
technologies will be more stable, needing updates only if the record requirements change,
rather than as the technology changes. Preservation action plans will likely need to be updated
more frequently to identify appropriate technological solutions for the digital preservation of


specific aggregations of records. The identified solutions must be monitored with regard to the
possible need for modifying and updating.
(P7) Preservation considerations should be embedded in all activities involved in
each phase of the records lifecycle if their continuing authentic existence over
the long term is to be ensured. (C7)
The concept of the records lifecycle in archival science refers to the theory that records go
through distinct phases, including creation, use and maintenance and dis


position (destruction or
permanent preservation).
It is essential for preservers who acquire digital records to understand that, differently from
what is the case with traditional records, preservation is a continuous process that begins with
the creation of the records. Analogue records are appraised for preservation at the disposition
stage, when they are no longer needed by the creator for business purposes. With digital
records, decisions relevant to preservation must be made as close as possible


to the creation
stage because of the ease and the speed with which digital objects can be manipulated, deleted
by accident or on purpose, or lost to technological obsolescence.
The notion that records preservation starts at the creation stage requires that preservation
considerations be incorporated and manifested in the design of record-making and
recordkeeping systems. Each aggregation of records appraised for preservation should be
identified in accordance with the classification scheme and the re


cords retention schedule
established by the records creator in collaboration with the preserver, and this identification
should be indicated in the records metadata. The records so identified should be monitored
throughout their lifecycle by the preserver, so that appraisal decisions and preservation
considerations can be updated to accommodate any possible changes occurring after they are
first made. Appraisal decisions need to be reviewed to ensure that the information about the
appraised records is


 still valid, that changes to the records and their context have not adversely
affected their identity or integrity and that the details of the process of carrying out disposition
are still workable and applicable to the records. To monitor and implement appraisal decisions
and preservation considerations, the designated preserver should obtain continuing access to
InterPARES 2 Project, Policy Cross-domain

Page 18 of 18
Policy Framework, v1.2 (March 2008)
L. Duranti, J. Suderman and M. Todd
the re


cords creator’s recordkeeping system within limits agreed upon with the creator and
reflected in the preserver’s access privileges. The preserver should establish procedures to
facilitate constant interaction with the records creator.
(P8) Third-party intellectual property rights attached to the creator’s records
should be explicitly identified and managed in the preservation system. (C10)
Preservers know that records under records creators’ control usually contain information
covered by intellectual


 property legislation. They should also be aware that, in some cases, the
intellectual property rights attached to records belong to a party other than the author; that is,
the intellectual property rights reside with a third party. Third-party intellectual property rights
should be documented in the metadata accompanying such records because they influence the
processes of refreshing, converting and migrating them for either continuous use or
preservation purposes. Subject to variations in different l


egislative environments, reproductions
of records with third-party intellectual property rights attached to them may violate legislation
that protects such rights. In the case of records identified for long-term preservation, long-term
clearance of such rights should be addressed explicitly with the records creator.
Because preservation in a digital environment involves making copies, intellectual property
rights have become an issue, not just for access as in the past, but for preservation. It is the


preserver’s responsibility; first, to advise the creator on how to address intellectual property
issues in its record-making and recordkeeping systems, and, second, to ensure that intellectual
property issues are addressed in the design of the preservation system. In particular, any issues
relevant to third-party intellectual property rights should be cleared before the transfer of records
to be preserved from the creator to the preserver. The latter must consider these issues as a
part of the assess


ment of feasibility of preservation.
(P9) Privacy rights and obligations attached to the creator’s records should be
explicitly identified and protected in the preservation system. (C11)
Privacy legislation protects the rights of individuals with reference to personal data that may
be part of any record used and maintained by a records creator with whom they have interacted.
The limits of privacy depend on the legislative framework in which the records creator operates.
It may be in conflict with the


access policy linked to the mandate of the records creator and even
with the access to information legislation in the same jurisdiction. Besides lobbying for
exceptions, the designated preserver should ensure that the consequences of the existing
situation for preservation and access are clearly understood.
The presence of personal information within the records should be identified and
documented among the metadata linked to the records in the record-making and recordkeeping
systems of the creators.


This is the best way to ensure that the records are managed in
accordance with privacy legislation and that the preserver will be able to effectively include the
privacy issues relevant to the records in the preservation feasibility study during appraisal. The
designated preserver for each creator should, as a trusted custodian, obtain access to records
containing personal information to perform preservation activities. Archival processing of
personal information for preservation purposes is different


from the use of it for research or
business purposes. Regardless of the legislative framework, the creator and the preserver
should be able to demonstrate that archival processing of records containing personal
information does not put such information at risk of unauthorized access.
Preservers should also insist that responsibility for processing records containing personal
data for preservation purposes must reside with the records creator and its legitimate
successors. Although the practice of outs


ourcing these preservation functions to specialized
commercial operators may be authorized and regulated under most existing privacy legislation,
InterPARES 2 Project, Policy Cross-domain

Page 19 of 19
Policy Framework, v1.2 (March 2008)
L. Duranti, J. Suderman and M. Todd
InterPARES 2 Project, Policy Cross-domain

Page 20 of 20
the practice should still be avoided whenever possible to minimize the number of individuals
authorized to access and/or process the records, thus reducing the risk of u


nauthorized
disclosure of personal information in the records and of jeopardizing the ability to obtain
permission to process personal information for preservation purposes.
In the case of records that are not yet designated for permanent preservation, appraisal
decisions should be taken before the initial mandate for processing personal information has
expired to ensure that the legal basis for retaining such records is still in force.
(P10) Archival appraisal should identify and analyze all the busi


ness processes
that contribute to the creation and/or use of the same records. (C9)
A record may be created for one purpose and then subsequently used for different purposes
by different persons. Any appraisal decision should consider all uses of the record and be aware
of the business processes behind them. This is necessary to make an informed decision about
what to preserve as well as to be able to dispose effectively of all possible copies of the records
that have not been selected for preservatio


n.
The use of records or information within records by different business processes may be
desirable from the creator’s standpoint in terms of providing a degree of interoperability among
the creator’s information and record systems. In such situations, the preserver should advise the
creator that metadata attached to records used by many business processes must identify each
relevant business process. This is critical for the creator because it ensures the authenticity of
the records by establishing


their identity and integrity in each context. It is also critical for the
preserver who must understand all contexts in which the records were used to effectively
undertake appraisal and also to meet the baseline requirements for maintaining authenticity for
any records acquired into the preservation system.
(P11) Archival appraisal should assess the authenticity of the records. (C6)
Appraisal decisions should be made by compiling information about kept records and their
context(s), assessing their va


lue and determining the feasibility of their preservation.36
As part of the assessment of value, preservers must establish the grounds for presuming
that the records being appraised are authentic. This means that preservers must ensure that
each record identity has been documented and maintained as documented and must ascertain
the degree to which the records’ creator has guaranteed their integrity by making sure that its
records are intact and uncorrupted. The evidence supporting the presumption of au


thenticity
must be measured against the InterPARES Benchmark Requirements.37
(P12) Archival description should be used as a collective authentication of the
records in an archival fonds. (C6)
Archival description of a fonds emerges from the comprehensive analysis of the various
relationships interwoven in the course of the formation and accumulation of records and
therefore is the most reliable means of establishing the continued authenticity of a body of
interrelated records. While the authenticity


of individual records can be in part established
through their metadata, the authenticity of aggregations of records (i.e., file, series or fonds),
can only be proved through archival description.
It has always been the function, either explicit or implicit, of archival description to
authenticate the records by perpetuating their administrative and documentary relationships;

36 See Terry Eastwood et al., “Part Two – Choosing to Preserve: The Selection


 of Electronic Records: Appraisal Task Force Report,”
in The Long-term Preservation of Authentic Electronic Records: Findings of the InterPARES Project, Luciana Duranti, ed. (San
Miniato, Italy: Archilab, 2005), 67–98. PDF version available at http://www.interpares.org/book/interpares_book_e_part2.pdf.
37 See the already cited benchmark requirements in MacNeil et al., “Appraisal Task Force Report,” op. cit.
Policy Framework, v1.2 (March 2008)
L. Duranti, J. Suderman and M. Todd
InterPARES 2 Project, P


olicy Cross-domain

Page 21 of 21
but, with digital records, this function has moved to the forefront. In fact, as original digital
records disappear and an interminable chain of non-identical reproductions follows them, the
researchers looking at the last of those reproductions will not find in it any information regarding
provenance, authority, context or authenticity.
The authentication function of archival description is different from that of a certificate of
authenticity, because it is not si


mply an attestation of the authenticity of individual records, but a
collective attestation of the authenticity of the records of a fonds and of all their
interrelationships as made explicit by their administrative, custodial and technological history
(including a description of the recordkeeping system(s) within which they have been maintained
and used), the scope and content and the hierarchical representation of the records aggregates.
It is also different both from the identity and integrity metada


ta attached to individual records,
which are part of the record itself and are reproduced time after time with it and from the
additional metadata attached to records aggregations (e.g., file, series) within the recordkeeping
system to identify them and document their technological transformations.
The unique function of archival description is to provide an historical view of the records and
of their becoming, while presenting them as a universality in which each member’s individuality
is subject to


 the bond of a common provenance and destination.
(P13) Procedures for providing access to records created in one jurisdiction to
users in other jurisdictions should be established on the basis of the legal
environment in which the records were created. (C13)
Different jurisdictions may have different laws and regulations with regard to access rights in
relation to the protection of privacy, intellectual property and any other kind of public or private
interests (e.g., market sensitive records). Prese


rvers who are a unit of a records creator (e.g.,
in-house archival programs or archives) that has geographically separated branches falling
under different legislation must be aware of the impact of such diverse legal contexts on their
records-sharing activities. This will affect access policies relevant to both internal and external
sharing activities.


Top Threats Working Group
The Notorious Nine
Cloud Computing Top Threats in 2013
February 2013

© 2013, Cloud Security Alliance.  All rights reserved.
2

CLOUD SECURITY ALLIANCE The Notorious Nine: Cloud Computing Top Threats in 2013
The permanent and official location for Cloud Security Alliance Top Threats research is
http://www.cloudsecurityalliance.org/topthreats.

© 2013 Cloud Security Alliance – All Rights Reserved
All rights reserved.  You may d


ownload, store, display on your computer, view, print, and link to The Notorious Nine:
Cloud Computing Threats in 2013 at http://www.cloudsecurityalliance.org/topthreats/, subject to the following: (a) the
Report may be used solely for your personal, informational, non-commercial use; (b) the Report may not be modified or
altered in any way; (c) the Report may not be redistributed; and (d) the trademark, copyright or other notices may not
be removed.   You may quote portions of the Report as permitted b


y the Fair Use provisions of the United States
Copyright Act, provided that you attribute the portions to The Notorious Nine: Cloud Computing Threats in 2013.

© 2013, Cloud Security Alliance.  All rights reserved.
3

CLOUD SECURITY ALLIANCE The Notorious Nine: Cloud Computing Top Threats in 2013
Contents
Acknowledgments
................................................................................................................................................................... 5
Executive S


ummary
................................................................................................................................................................. 6
1.0 Top Threat: Data Breaches
................................................................................................................................................ 8
1.1 Implications
..............................................................................................................................................


..................... 8
1.2 Controls ......................................................................................................................................................................... 8
1.3 Links .............................................................................................................................................................................. 8
2.0 Top Threat: Data Loss .......................................................................................


................................................................ 9
2.1 Implications
................................................................................................................................................................... 9
2.2 Controls ......................................................................................................................................................................... 9
2.3 Links ...............................................................


............................................................................................................... 9
3.0 Top Threat: Account or Service Traffic Hijacking ............................................................................................................ 10
3.1 Implications
................................................................................................................................................................. 10
3.2 Controls ..................................


..................................................................................................................................... 10
3.3 Links ............................................................................................................................................................................ 10
4.0 Top Threat: Insecure Interfaces and APIs ....................................................................................................................... 12
4.1 Implications


..................... 12
5.0 Top Threat: Denial of Service .......................................................................................................................................... 14
5.1 Implications
................................................................................................................................................................. 14
5.2 Controls ................................................................................................................


....................................................... 14
5.3 Links ............................................................................................................................................................................ 14
6.0 Top Threat: Malicious Insiders ........................................................................................................................................ 16
6.1 Implications
.......................................................................


.......................................................................................... 16
6.2 Controls ....................................................................................................................................................................... 16
6.3 Links ............................................................................................................................................................................ 17
7.0 Top Threat: Abuse of Cloud Services .....


......................................................................................................................... 18
7.1 Implications
................................................................................................................................................................. 18
7.2 Controls ....................................................................................................................................................................... 18
7.3 Links .......


..................................................................................................................................................................... 18

© 2013, Cloud Security Alliance.  All rights reserved.
4

CLOUD SECURITY ALLIANCE The Notorious Nine: Cloud Computing Top Threats in 2013
8.0 Top Threat: Insufficient Due Diligence
............................................................................................................................ 19
8.1 Implications
.....


................ 20
9.0 Top Threat: Shared Technology Vulnerabilities .............................................................................................................. 21
9.1 Implications
................................................................................................................................................................. 21
9.2 Controls .................................................................................................................................


...................................... 21
9.3 Links ............................................................................................................................................................................ 21

© 2013, Cloud Security Alliance.  All rights reserved.
5

CLOUD SECURITY ALLIANCE The Notorious Nine: Cloud Computing Top Threats in 2013
Acknowledgments
Co-Chairs
Rafal Los, HP
Dave Shackleford, Voodoo Security
Bryan Sullivan, Microsoft

CSA Global Staff
Alex


Ginsburg, Copywriter
Luciano JR Santos, Research Director
Evan Scoboria, Webmaster
Kendall Scoboria, Graphic Designer
John Yeoh, Research Analyst

The CSA Top Threats to Cloud Computing Survey in 2012 was assisted by the extended CSA Top Threats Working Group,
led by committee members: Aaron Alva, Olivier Caleff, Greg Elkins, Allen Lum, Keith Pasley, Satheesh Sudarsan, Vinoth
Sivasubramanian, and Rajeev Venkitaraman

© 2013, Cloud Security Alliance.  All rights reserved.
6

CLOUD SECURIT


Y ALLIANCE The Notorious Nine: Cloud Computing Top Threats in 2013
Executive Summary
At an unprecedented pace, cloud computing has simultaneously transformed business and government, and created
new security challenges.  The development of the cloud service model delivers business-supporting technology more
efficiently than ever before.  The shift from server to service-based thinking is transforming the way technology
departments think about, design, and deliver computing technology and applications.


 Yet these advances have created
new security vulnerabilities, including security issues whose full impact is still emerging.

Among the most significant security risks associated with cloud computing is the tendency to bypass information
technology (IT) departments and information officers.  Although shifting to cloud technologies exclusively is affordable
and fast, doing so undermines important business-level security policies, processes, and best practices.  In the absence
of these standards, busin


esses are vulnerable to security breaches that can quickly erase any gains made by the switch
to SaaS.

Recognizing both the promise of cloud computing, and the risks associated with it, the Cloud Security Alliance (CSA) has
pioneered the creation of industry-wide standards for effective cloud security.  In recent years, CSA released the
“Security Guidance for Critical Areas in Cloud Computing” and the “Security as a Service Implementation Guidance.”
These documents have quickly become the industry-s


tandard catalogue of best practices to secure cloud computing,
comprehensively addressing this within the thirteen domains of CSA Guidance and ten categories of service associated
with the SecaaS Implementation Guidance series.  Already, many businesses, organizations, and governments have
incorporated this guidance into their cloud strategies.

However, CSA recognizes that a central component of managing risks in cloud computing is to understand the nature of
security threats.  The purpose of the “


The Notorious Nine: Cloud Computing Top Threats in 2013” report is to provide
organizations with an up-to-date, expert-informed understanding of cloud security threats in order to make educated
risk-management decisions regarding cloud adoption strategies.

The top threats report reflects the current consensus among experts about the most significant threats to cloud security.
While there are many vulnerabilities to cloud security, this report focuses on threats specifically related to the shared,
on


-demand nature of cloud computing.

To identify the top threats, CSA conducted a survey of industry experts to compile professional opinion on the greatest
vulnerabilities within cloud computing.  The Top Threats working group used these survey results alongside their
expertise to craft the final 2013 report.  The survey methodology validated that the threat listing reflects the most
current concerns of the industry.  In this most recent edition of this report, experts identified the following nine c


ritical
threats to cloud security (ranked in order of severity):
1. Data Breaches
2. Data Loss
3. Account Hijacking
4. Insecure APIs
5. Denial of Service

© 2013, Cloud Security Alliance.  All rights reserved.
7

CLOUD SECURITY ALLIANCE The Notorious Nine: Cloud Computing Top Threats in 2013
6. Malicious Insiders
7. Abuse of Cloud Services
8. Insufficient Due Diligence
9. Shared Technology Issues

With descriptions and analysis of these threats, this report serves as an up-to-date threat


identification guide that will
help cloud users and providers make informed decisions about risk mitigation within a cloud strategy.  This threat
research document should be utilized in conjunction with the best practices guides, “Security Guidance for Critical Areas
in Cloud Computing V.3” and “Security as a Service Implementation Guidance.”  Together, these documents will offer
valuable guidance during the formation of comprehensive, appropriate cloud security strategies.

© 2013, Cloud Security Alli


ance.  All rights reserved.
8

CLOUD SECURITY ALLIANCE The Notorious Nine: Cloud Computing Top Threats in 2013
1.0 Top Threat: Data Breaches
It’s every CIO’s worst nightmare: the organization’s sensitive internal data falls
into the hands of their competitors.  While this scenario has kept executives
awake at night long before the advent of computing, cloud computing
introduces significant new avenues of attack.  In November 2012, researchers
from the University of North Carolina, the University


of Wisconsin and RSA
Corporation released a paper describing how a virtual machine could use side
channel timing information to extract private cryptographic keys being used in
other virtual machines on the same physical server.  However, in many cases
an attacker wouldn’t even need to go to such lengths.  If a multitenant cloud
service database is not properly designed, a flaw in one client’s application
could allow an attacker access not only to that client’s data, but every other
client’s data as


well.
1.1 Implications
Unfortunately, while data loss and data leakage are both serious threats to
cloud computing, the measures you put in place to mitigate one of these
threats can exacerbate the other.  You may be able to encrypt your data to
reduce the impact of a data breach, but if you lose your encryption key, you’ll
lose your data as well.  Conversely, you may decide to keep offline backups of
your data to reduce the impact of a catastrophic data loss, but this increases
your exposure to dat


a breaches.
1.2 Controls
CCM DG-04: Data Governance - Retention Policy
CCM DG-05: Data Governance - Secure Disposal
CCM DG-06: Data Governance - Non-Production Data
CCM DG-07: Data Governance - Information Leakage
CCM DG-08: Data Governance - Risk Assessments
CCM IS-18: Information Security - Encryption
CCM IS-19: Information Security - Encryption Key Management
CCM SA-02: Security Architecture - User ID Credentials
CCM SA-03: Security Architecture - Data Security/Integrity
CCM SA-06: Security Ar


chitecture - Production/Non-Production Environments
CCM SA-07: Security Architecture - Remote User Multi-Factor Authentication
1.3 Links
1. Cross-VM Side Channels and Their Use to Extract Private Keys
http://www.cs.unc.edu/~yinqian/papers/crossvm.pdf
2. Multi-Tenant Data Architecture
http://msdn.microsoft.com/en-us/library/Aa479086
SERVICE MODEL

RISK ANALYSIS
CIANA: Confidentiality
STRIDE: Information Disclosure
CSA REFERENCE
Domain 5: Information Management
and Data Security
Domain 10: App


lication Security
Domain 12: Identity, Entitlement
and Access Management
Domain 13: Virtualization
IS THREAT STILL RELEVANT?

TOP THREAT RANKING

IaaS
PaaS
SaaS
RISK MATRIX

Perceived Risk
Actual Risk

© 2013, Cloud Security Alliance.  All rights reserved.
9

CLOUD SECURITY ALLIANCE The Notorious Nine: Cloud Computing Top Threats in 2013
2.0 Top Threat: Data Loss
For both consumers and businesses, the prospect of permanently losing one’s
data is terrifying.  Just ask Mat Ho


nan, writer for Wired magazine: in the
summer of 2012, attackers broke into Mat’s Apple, Gmail and Twitter accounts.
They then used that access to erase all of his personal data in those accounts,
including all of the baby pictures Mat had taken of his 18-month-old daughter.
Of course, data stored in the cloud can be lost due to reasons other than
malicious attackers.  Any accidental deletion by the cloud service provider, or
worse, a physical catastrophe such as a fire or earthquake, could lead to t


he
permanent loss of customers’ data unless the provider takes adequate
measures to backup data.  Furthermore, the burden of avoiding data loss does
not fall solely on the provider’s shoulders.  If a customer encrypts his or her
data before uploading it to the cloud, but loses the encryption key, the data
will be lost as well.
2.1 Implications
Under the new EU data protection rules, data destruction and corruption of
personal data are considered forms of data breaches and would require
appropriate


notifications.
Additionally, many compliance policies require organizations to retain audit
records or other documentation.  If an organization stores this data in the
cloud, loss of that data could jeopardize the organization’s compliance status.
2.2 Controls
CCM DG-04: Data Governance - Retention Policy
CCM DG-08: Data Governance - Risk Assessments
CCM RS-05: Resiliency - Environmental Risks
CCM RS-06: Resiliency - Equipment Location
2.3 Links
1.       Cloud Computing Users Are Losing Data, Syma


ntec Finds
http://news.investors.com/technology/011613-640851-cloud-computing-data-
loss-high-in-symantec-study.htm
2.       Kill the Password: Why a String of Characters Can’t Protect Us Anymore
http://www.wired.com/gadgetlab/2012/11/ff-mat-honan-password-hacker/

RISK ANALYSIS
CIANA: Availability, Non-Repudiation
STRIDE: Repudiation, Denial of
Service
CSA REFERENCE
Domain 5: Information Management
and Data Security
Domain 10: Application Security
Domain 12: Identity, Entitlement
and Access


 Management
Domain 13: Virtualization
IS THREAT STILL RELEVANT?

TOP THREAT RANKING

SERVICE MODEL

IaaS
PaaS
SaaS
RISK MATRIX

Perceived Risk
Actual Risk

© 2013, Cloud Security Alliance.  All rights reserved.
10

CLOUD SECURITY ALLIANCE The Notorious Nine: Cloud Computing Top Threats in 2013
3.0 Top Threat: Account or Service
Traffic Hijacking
Account or service hijacking is not new.  Attack methods such as phishing,
fraud, and exploitation of software vulnerabilities s


till achieve results.
Credentials and passwords are often reused, which amplifies the impact of
such attacks.  Cloud solutions add a new threat to the landscape.  If an attacker
gains access to your credentials, they can eavesdrop on your activities and
transactions, manipulate data, return falsified information, and redirect your
clients to illegitimate sites.  Your account or service instances may become a
new base for the attacker.  From here, they may leverage the power of your
reputation to lau


nch subsequent attacks.
In April 2010, Amazon experienced a Cross-Site Scripting (XSS) bug that allowed
attackers to hijack credentials from the site.  In 2009, numerous Amazon
systems were hijacked to run Zeus botnet nodes.
3.1 Implications
Account and service hijacking, usually with stolen credentials, remains a top
threat.  With stolen credentials, attackers can often access critical areas of
deployed cloud computing services, allowing them to compromise the
confidentiality, integrity and availab


ility of those services.  Organizations
should be aware of these techniques as well as common defense in depth
protection strategies to contain the damage (and possible litigation) resulting
from a breach.  Organizations should look to prohibit the sharing of account
credentials between users and services, and leverage strong two-factor
authentication techniques where possible.
3.2 Controls
CCM IS-07: Information Security - User Access Policy
CCM IS-08: Information Security - User Access Restriction


/Authorization
CCM IS-09: Information Security - User Access Revocation
CCM IS-10: Information Security - User Access Reviews
CCM IS-22: Information Security - Incident Management
CCM SA-02: Security Architecture - User ID Credentials
CCM SA-07: Security Architecture - Remote User Multi-Factor Authentication
CCM SA-14: Security Architecture - Audit Logging / Intrusion Detection
3.3 Links
1.       Amazon purges account hijacking threat from site
http://www.theregister.co.uk/2010/04/20/amazon_website


_treat/
RISK ANALYSIS
CIANA: Authenticity, Integrity,
Confidentiality, Non-repudiation,
Availability
STRIDE: Tampering with Data,
Repudiation, Information Disclosure,
Elevation of Privilege, Spoofing
Identity
IS THREAT STILL RELEVANT?

TOP THREAT RANKING

SERVICE MODEL

IaaS
PaaS
SaaS
RISK MATRIX

Perceived Risk
Actual Risk

© 2013, Cloud Security Alliance.  All rights reserved.
11

CLOUD SECURITY ALLIANCE The Notorious Nine: Cloud Computing Top Threats in 2013
2.


    Zeus bot found using Amazon’s EC2 as C&C Server
http://www.theregister.co.uk/2009/12/09/amazon_ec2_bot_control_channel/

CSA REFERENCE
Domain 2: Governance and
Enterprise Risk Management
Domain 5: Information Management
and Data Security
Domain 7: Traditional Security,
Business Continuity, and Disaster
Recovery
Domain 9: Incident Response
Domain 11: Encryption and Key
Management
Domain 12: Identity, Entitlement,
and Access Management

© 2013, Cloud Security Alliance.  All rights rese


rved.
12

CLOUD SECURITY ALLIANCE The Notorious Nine: Cloud Computing Top Threats in 2013
4.0 Top Threat: Insecure Interfaces and
APIs
Cloud computing providers expose a set of software interfaces or APIs that
customers use to manage and interact with cloud services.  Provisioning,
management, orchestration, and monitoring are all performed using these
interfaces.  The security and availability of general cloud services is dependent
upon the security of these basic APIs.  From authentication and


 access control
to encryption and activity monitoring, these interfaces must be designed to
protect against both accidental and malicious attempts to circumvent policy.
Furthermore, organizations and third parties often build upon these interfaces
to offer value-added services to their customers.  This introduces the
complexity of the new layered API; it also increases risk, as organizations may
be required to relinquish their credentials to third-parties in order to enable
their agency.
4.1 Implica


tions
While most providers strive to ensure security is well integrated into their
service models, it is critical for consumers of those services to understand the
security implications associated with the usage, management, orchestration
and monitoring of cloud services.  Reliance on a weak set of interfaces and APIs
exposes organizations to a variety of security issues related to confidentiality,
integrity, availability and accountability.
4.2 Controls
CCM IS-08: Information Security - User Access


 Restriction/Authorization
CCM SA-03: Security Architecture - Data Security/Integrity
CCM SA-04: Security Architecture - Application Security
4.3 Links
1.       Insecure API Implementations Threaten Cloud
http://www.darkreading.com/cloud-security/167901092/security/application-
security/232900809/insecure-api-implementations-threaten-cloud.html
2.       Web Services Single Sign-On Contains Big Flaws
http://www.darkreading.com/authentication/167901072/security/news/2326
02844/web-services-single-sign


-on-contain-big-flaws.html

RISK ANALYSIS
CIANA: Authenticity, Integrity,
Confidentiality
STRIDE: Tampering with Data,
Repudiation, Information Disclosure,
Elevation of Privilege
IS THREAT STILL RELEVANT?

TOP THREAT RANKING

SERVICE MODEL

IaaS
PaaS
SaaS
RISK MATRIX

Perceived Risk
Actual Risk

© 2013, Cloud Security Alliance.  All rights reserved.
13

CLOUD SECURITY ALLIANCE The Notorious Nine: Cloud Computing Top Threats in 2013

CSA REFERENCE
Domain 5


: Information Management
and Data Security
Domain 6: Interoperability and
Portability
Domain 9: Incident Response
Domain 10: Application Security
Domain 11: Encryption and Key
Management
Domain 12: Identity, Entitlement,
and Access Management

© 2013, Cloud Security Alliance.  All rights reserved.
14

CLOUD SECURITY ALLIANCE The Notorious Nine: Cloud Computing Top Threats in 2013
5.0 Top Threat: Denial of Service
Simply put, denial-of-service attacks are attacks meant to prevent users of a


cloud service from being able to access their data or their applications.  By
forcing the victim cloud service to consume inordinate amounts of finite
system resources such as processor power, memory, disk space or network
bandwidth, the attacker (or attackers, as is the case in distributed denial-of-
service (DDoS) attacks) causes an intolerable system slowdown and leaves all
of the legitimate service users confused and angry as to why the service isn’t
responding.
While DDoS attacks tend to genera


te a lot of fear and media attention
(especially when the perpetrators are acting out of a sense of political
“hactivism”), they are by no means the only form of DoS attack.  Asymmetric
application-level DoS attacks take advantage of vulnerabilities in web servers,
databases, or other cloud resources, allowing a malicious individual to take out
an application using a single extremely small attack payload – in some cases
less than 100 bytes long.
5.1 Implications
Experiencing a denial-of-service atta


ck is like being caught in rush-hour traffic
gridlock: there’s no way to get to your destination, and nothing you can do
about it except sit and wait.  As a consumer, service outages not only frustrate
you, but also force you to reconsider whether moving your critical data to the
cloud to reduce infrastructure costs was really worthwhile after all.  Even
worse, since cloud providers often bill clients based on the compute cycles and
disk space they consume, there’s the possibility that an attacker may


 not be
able to completely knock your service off of the net, but may still cause it to
consume so much processing time that it becomes too expensive for you to run
and you’ll be forced to take it down yourself.
5.2 Controls
CCM IS-04: Information Security - Baseline Requirements
CCM OP-03: Operations Management - Capacity/Resource Planning
CCM RS-07: Resiliency - Equipment Power Failures
CCM SA-04: Security Architecture - Application Security
5.3 Links
1.      As Cloud Use Grows, So Will Rate of


DDoS Attacks
http://www.infoworld.com/d/cloud-computing/cloud-use-grows-so-will-rate-
of-ddos-attacks-211876

RISK ANALYSIS
CIANA: Availability
STRIDE: Denial of Service
CSA REFERENCE
Domain 8: Data Center Operations
Domain 9: Incident Response
Domain 10: Application Security
Domain 13: Virtualization
Domain 14: Security as a Service
IS THREAT STILL RELEVANT?

TOP THREAT RANKING

SERVICE MODEL

IaaS
PaaS
SaaS
RISK MATRIX

Perceived Risk
Actual Risk

© 2013, Cloud Securit


y Alliance.  All rights reserved.
15

CLOUD SECURITY ALLIANCE The Notorious Nine: Cloud Computing Top Threats in 2013
2.       Computerworld: DDoS is Cloud’s security Achilles heel (September 16,
2011)
http://www.computerworld.com.au/article/401127/ddos_cloud_security_achil
les_heel/

3.       OWASP: Application Denial of Service
https://www.owasp.org/index.php/Application_Denial_of_Service

4.       Radware DDoSpedia
http://security.radware.com/knowledge-center/DDoSPedia/

© 2013, Cloud


 Security Alliance.  All rights reserved.
16

CLOUD SECURITY ALLIANCE The Notorious Nine: Cloud Computing Top Threats in 2013
6.0 Top Threat: Malicious Insiders
The risk of malicious insiders has been debated in the security industry.  While
the level of threat is left to debate, the fact that the insider threat is a real
adversary is not.
CERN defines an insider threat as such:1
“A malicious insider threat to an organization is a current or former employee,
contractor, or other business partner


 who has or had authorized access to an
organization's network, system, or data and intentionally exceeded or misused
that access in a manner that negatively affected the confidentiality, integrity,
or availability of the organization's information or information systems.”
6.1 Implications
A malicious insider, such as a system administrator, in an improperly designed
cloud scenario can have access to potentially sensitive information.
From IaaS to PaaS and SaaS, the malicious insider has increasing l


evels of
access to more critical systems, and eventually to data.  Systems that depend
solely on the cloud service provider (CSP) for security are at great risk here.
Even if encryption is implemented, if the keys are not kept with the customer
and are only available at data-usage time, the system is still vulnerable to
malicious insider attack.
6.2 Controls
CCM CO-03: Compliance - Third Party Audits
CCM DG-01: Data Governance - Ownership / Stewardship
CCM DG-03: Data Governance - Handling / Label