National Archives of Finland long-term preservation permission procedure for governmental agencies and development of national auditing and certification system Markus Merenmies National Archives of Finland DLM Forum Members Meeting Budapest, Hungary 12th-13th May 2011

Topics Why permission? What is required to have it? Auditing and certification system

Why permission? Based on archives act Permanent preservation only in digital format requires a permission ”Proactive risk mitigation” To verify the fullfillment of requirements before records are produced

Requirement categories Information and task classification –Quality and accordance with ”real life” –Maintenance classification Records management process –How task classification is used Disposal of non-permanent records –Documented and managed administrative process –Required audit-trail of disposal Transfer –Documented and managed administrative process –Proper file formats (and content) and valid XML-structure –Error handling and transfer management General ”Good governance” –Log-file management –Information security

Auditing and certification system Governmental agencies National Archives Sähke requirements Sähke requirements Long-term preservation Permission procedure Request For permission preservation agreement State Treasury Office Auditing service Auditing service Security requirements Security requirements Records Quality control What we have to know? What we want to have? Have they done It right? Transfer Test Service Transfer Test Service Process and metadata Process and metadata Software functionalities Software functionalities information security information security Records Management schedule Records Management schedule What we have to do?

Auditing Management of processes and information Pre-defined requirements and measuring quidelines (auditing toolbox) Documented awareness of responsibilities ERMS should be sertified, if not, then auditing should cover it also

Auditing process Outsourced pre-defined auditing package –3 days, 2800€ –Security audit: 6 days, 5500€ Assisted systematic self-assesment –Pre-requirements for documentation –Self-assesment questions –Auditing workshop To recommend (or not) permission for long- term preservation Separate technical transfer-test service

Sertification of ERMS ERMS Functionalities and Sähke2- requirements Challenge: How requirements are stated and how to measure? Status: re-writing Sähke2-requirements and development of sertification framework But… Normally products are customized

Good governance How ownership of the system/process is defined and managed? Logfiles: how produced, why used? Security audit and risk management Development of Governmental Enterprise Architecture –General rules for information management and responsibilities

Should we do it ourselves? Yes –Difficult to outsource –Required expertice only in archives No –Not enough own resources –Software auditing requires special skills

What we’ve learnt? How to verify? That must be clear when writing requirements. –Sähke3 should support certification –Compliance with Moreq2010 Define first, what you need to know Different tools for different means What you measure, that you’ll get. Keep focus on important issues Everything is simple, until you try it

Environment of requirements Public organization National archives Board of antiqueties National library Ministry of Education and culture Ministry of Finance

Thank you Markus Merenmies National Archives of Finland