ISO/DIS 17068-2015 pdf free.Information and documentation一Trusted third party repository for digital records.
ISO/DIS 17068 specifies requirements for a Trusted Third Party Repository(TTPR) to support the authorized custody service in order to ensure provable integrity and authenticity of the clients’ digital records and serve as a source of reliable evidence.
This International Standard is applicable to:
legally reliable retention service for digital records as a source of reliable evidence during the retention periods of legal obligation in both the private and the public sector, and;
– reliable repository service by enabling outsourcing management.
This International Standard has the limitation that the authorized custody of the stored records is between only the TTPR and the client. TTPR Certificate of authenticity shall limit on the digital records that prove its authenticity.
2 Normative references
ISO 14721: 2003. Space data and information transfer systems — Open Archival Information System — Reference Model
ISO 15489-1: 2001, Information and documentation – Records management – Part 1: General
ISO 15489-2: 2001, Information and documentation — Records management — Part 2: Guidelines
ISO 30301: 201 1, Information and documentation — Management system for records — Requirements
ISO/TS 15000-2: 2004, Electronic business eXtensible Markup Language (ebXML) — Part 2: Message service specification (ebMS)
UNCITRAL 2007, United Nations Convention on the Use of Electronic Communications in International Contracts
3 Terms and definitions
For the purposes of this document, the following terms and definitions apply.
4.1 Necessity for a TTPR
With the development and advancement of information and communication technology (ICT) over the last two decades, the use of digital records has increased greatly. Accordingly, the number of electronic transactions carried out by individuals and organizations in their daily activities has increased. For example, in international transactions, many documents and records in digital formats are exchanged in order to initiate, process and complete transactions between importers and exporters. Banks are also involved in digital records exchanges to confirm credit or payment. In the health industry, treatment records are exchanged between clinics or patients and insurance companies; order of treatment records are exchanged between general clinics and specialized clinics. These kinds of individual or organizational transactions are very common within one sector or across several industries. During these transactions, digital records is easily copied, modified and distributed by an unauthorized person. This aspect of documents and records retained in digital formats creates the risk of alteration or forgery, and has raised awareness of the need for the secure management and transaction of digital records.
To help prevent possible risks, some countries have enacted laws and regulations requiring provable authenticity, reliability, integrity and accessibility as a precondition for legal effect and enforceability of digital records. These regulations explain the requirements for adopting secured digital records and for judging their evidential admissibility. However, these requirements only typically describe the mandatory characteristics that retained digital records need to have, regardless of an organization’s records management capability. While many organizations have implemented a records system for themselves, implementation of digital records exchange across organizations often faces a number of challenges. Individuals are also limited in their ability to comply with legal requirements for the admissibility of their digital records. This limitation might cause social problems, delay operational processes, reduce efficiency and prevent electronic exchange.
Therefore, as the exchange of secure records becomes more significant for individual and/or organizational collaboration, the social demand for a trustworthy electronic transaction environment has emerged as one of the major issues in digital environments today. Protecting information in digital records is beginning to be regarded as an indispensable precondition for operational efficiency and economic benefit in organizations across all sectors and industries.
One way of resolving this situation is to use a TTPR. A third party is an independent individual or organization that is separate from the direct interests of mutual parties, and that acts as an intermediary when two parties are exchanging digital information in a secure manner. Society and governments shall be in a position to trust the third party. To prevent any complications that can arise during electronic transactions, a TTPR operates systems and facilities and follows well-defined procedures according to the principles and guidelines for managing digital records in a secure manner. During these processes, the TTPR ensures the authenticity, reliability, integrity and usability of digital records, for the period of the contracted service. In addition, the TTPR shall provide an official source of digital records that shall be admissible as evidence from a third party in the event of a dispute between parties regarding their records.ISO/DIS 17068 pdf download.