Bsi bip 0008 2 2014

Evi d en t i a l we i g h t an d l eg a l adm i ss i b i l i ty of i n form a t ion

tran sferred e l ectron i ca l l y

Eviden tia l we igh t and lega l adm i ss ib i l i ty of

in forma tion tran sferred e lectron i ca l ly

Code of practi ce for the imp lemen ta tion of BS 1 0008

Peter Howes and A lan Sh ipman

F i rst pu b l i sh ed 1 998

Secon d ed i t ion 2002

Th i rd ed i t ion 2005

Fou rth ed i t ion 2008

F i fth ed i t ion 201 4

by

B S I Stan d a rd s Lim i ted

389 Ch i swi ck H ig h Road

Lon don W4 4AL

© Th e B ri t i sh Stan d a rd s I n st i tu t ion 201 4

Al l r i g h ts reserved . E xcep t a s perm i tted u n d er th e Copyr i g h t , Des i g n s an d Pa ten ts Act 1 988 , n o pa rt of th i s

pu b l i ca t ion m ay be rep rod u ced , sto red i n a retr i eva l system o r tran sm i tted i n an y form or by an y m ean s – e l ectron i c ,

ph otocopyi n g , reco rd i n g or o th erwi se – wi th ou t pr ior perm i ss ion i n wri t i n g from th e pub l i sh er.

Wh i l st every ca re h a s been taken i n d eve l op i n g an d comp i l i n g th i s pu b l i ca t ion , B S I a ccep ts no l i ab i l i ty for an y l o ss o r

d am ag e cau sed , a r i s i n g d i rect l y or i n d i rect l y i n con n ect ion wi th re l i an ce on i ts con ten ts excep t to th e exten t th a t

su ch l i ab i l i ty m ay n ot be exc l u d ed i n l aw.

Wh i l e every effort h a s been m ad e to tra ce a l l copyr i g h t h o l d ers , an yon e c l a im i n g copyri g h t shou l d g et i n tou ch wi th

th e B S I a t th e above ad d ress .

B S I h a s n o respon s ib i l i ty for th e pers i sten ce or a ccu ra cy of U RLs fo r extern a l o r th i rd -pa rty i n tern et web s i tes referred

to i n th i s book, an d d oes n ot g u a ran tee th a t an y con ten t on su ch web s i tes i s , or wi l l rem a i n , a ccu ra te or

app ropr i a te .

Th e ri g h ts of Peter H owes an d Al an Sh ipm an to be i d en t i fi ed a s th e au th ors of th i s Wo rk h a ve been a sserted by

th em i n a ccord an ce wi th sect ion s 77 an d 78 of th e Copyri g h t , Des i g n s an d Pa ten ts Act 1 988 .

Typeset i n G rea t B ri ta in by Letterpa rt Lim i ted , www. l etterpa rt . com

Pri n ted i n G rea t B ri ta in by Berfo rts G roup , www.berforts . co . u k

B r i t i sh Libra ry Ca ta l og u i n g i n Pu b l i ca t ion Da ta

A ca ta l og u e reco rd fo r th i s book i s a va i l ab l e from th e B ri t i sh Lib ra ry

I SBN 978 0 580 85677 8

Con ten ts

Foreword vi i

Acknowl ed g em en ts vi i i

In trodu ction

1

G en era l

5

1 Con text of the organ i za tion

9

1 . 1 G en era l

9

1 . 2 I ssu es

9

1 . 3 Req u i rem en ts

9

1 .4 Bou n d a r i es and app l i cab i l i ty

1

0

2 Leadersh ip

1

1

2 . 1 Lead ersh ip an d comm i tm en t

1

1

2 . 2 Po l i cy sta tem en ts

1

1

2 . 3 Ro l es an d respon s i b i l i t i es of workers 23

2 .4 Leg a l an d reg u l a tory en vi ronm en t 23 3 Plann ing 24

3 . 1 Act ion s to ad d ress ri sks an d opportu n i t i es 24

3 . 2 Ob j ect i ves and a ch i evem en ts 25 4 Support 27

4 . 1 Resou rces 27

4 . 2 Com peten ce 27

4 . 3 Awa ren ess 27

4 .4 Report i n g an d comm u n i ca t i on s 27

4 . 5 Docum en ted i n form a t i on 28 5 Opera tion 37

5 . 1 M an ag em en t overvi ew 37

5 . 2 Stan d a rd i zed docum en ts 37

5 . 3 Vers ion con tro l 38

5 .4 Ch an g e con tro l 38

5 . 5 Storag e 38

5 . 6 Send i ng d a ta to a rch i ves 39

5 . 7 Prepa ra t i on for tran sfer 40

5 .8 I d en t i ty au th en t i ca t i on 5 1

5 . 9 Send er an d rec ip i en t au th en t i ca t i on 52

5 . 1

0 I d en t i fi ca t i on of i n form a t ion 52

5 . 1

1 Tran sfer 53

5 . 1

2 Rece i p t of tran sfer 54

5 . 1

3 Destru ct ion 61

5 . 1

4 System m a i n ten an ce 61

5 . 1

5 Secu r i ty an d protect ion 62

5 . 1

6 Con tra cts 64

5 . 1

7 Th i rd -pa rt i es 65

5 . 1

8 Tim e con s i d era t i on s 67

5 . 1

9 E rror h an d l i ng processes 67

6 Perform an ce eva lua tion 69

6 . 1 M on i tori ng , m ea su rem en t , an a l ys i s and eva l u a t ion 69v

6 . 2 I n tern a l au d i t 69

6 . 3 M an ag em en t revi ew 7 1

7 Improvemen t 74

7 . 1 G en era l 74

7 . 2 Preven t i ve and correct i ve a ct i on s 74

7 . 3 Con t i n u a l im provem en t 75

Annex A U n stru ctu red message con s idera tion s 77

A. 1 G en era l 77

A. 2 Po l i cy ob j ect i ves 77

A. 3 Crea t ion 78

A.4 Spamm i n g , fi l teri ng an d vi ru ses 79

A. 5 Copyri g h t an d person a l u se 80

A. 6 Reten t i on and d estru ct ion 81

Annex B – Examp le e lectron i c tran sfer po l i cy sta temen t 84

Annex C Referen ces 88

vi

Foreword

Evidentia l weight and lega l adm issib ility of informa tion tran sferred e lectron ica lly – Code of pra ctice for

the imp lementa tion of BS 1 0008 (referred to i n th i s docum en t a s ‘th e Cod e ’ ) i s pr im a r i l y con cern ed

wi th th e au th en t i c i ty, i n teg ri ty an d a va i l ab i l i ty of e l ectron i ca l l y tran sferred i n form a t ion , to th e

d em on strab l e l eve l s of certa i n ty requ i red by an org an i za t i on . I t i s pa rt i cu l a rl y app l i cab l e wh ere th i s

tran sferred i n form a t ion m a y be u sed a s evi d en ce i n d i spu tes i n s i d e an d ou ts i d e th e l eg a l system .

Th i s i s th e fi fth ed i t ion of th e Cod e , wh i ch wa s fi rst pub l i sh ed i n 1 998 a s PD 5000 . Th i s ed i t ion i s an

ed i tori a l revi s i on of th e fou rth ed i t ion (B I P 0008 -2 (2008 ) ) . I t i s tech n i ca l l y s im i l a r, wi th an exten s i on of

i ts scope to i n c l u d e th e tran sfer of i n form a t ion stored i n d a taba ses and o th er e l ectron i c system s . I t h a s

a l so been restru ctu red i n recog n i t i on of th e pub l i ca t i on of B S 1 0008 : 201 4 , Evidentia l weight and lega l

adm issib ility of e lectron ic informa tion — Specifica tion, an d can be con s i d ered to be a gu i d e to th e

im p l em en ta t ion of th e B ri t i sh Stand a rd i n re l a t ion to i n form a t ion tran sferred e l ectron i ca l l y.

U sers of th e previou s ed i t ion s shou l d con s i d er th e ad van tag es of a ssess i n g th e i r i n form a t ion

m an ag em en t system s i n th e l i g h t of th i s n ew ed i t i on , an d am en d th e i r system s and /or docum en ta t ion

wh ere appropr i a te .

Th i s pub l i ca t ion i s th e second pa rt of B I P 0008 , wh i ch i s m ad e up of th e fo l l owi n g :

• B I P 0008 -1 (201 4) , Evidentia l weight and lega l adm issib ility of informa tion stored e lectron ica lly —

Code of pra ctice for the imp lementa tion of BS 1 0008;

• B I P 0008 -3 (201 4) , Evidentia l weight and lega l adm issib ility of linking e lectron ic identity to

informa tion — Code of pra ctice for the imp lementa tion of BS 1 0008.

Th e Cod e i s pub l i sh ed by B S I i n recog n i t i on of th e l a rg e n um ber of im p l em en ta t i on s of e l ectron i c

i n form a t ion m an ag em en t system s , an d of th e con t i n u i n g un certa i n ty abou t th e l eg a l a ccep tab i l i ty of

i n form a t ion th a t h a s been tran sferred e l ectron i ca l l y. I t provi d es g ood pra ct i ce gu i d an ce for th e

tru stworth y e l ectron i c tran sfer of i n form a t ion .

vi i

Acknowledgemen ts

Th e Ed i tors wou l d espec i a l l y l i ke to th an k th e B S I Leg a l Adm i ss i b i l i ty Ed i tori a l Boa rd an d Pan e l an d

comm i ttees IDT/1 , Document management app lica tion s an d IDT/1 /-/5 , Revision s of BS 1 0008 for th e i r

con tribu t i on to th e cu rren t and previ ou s ed i t i on s of th i s pub l i ca t ion , i n pa rt i cu l a r for th e i r bu s i n ess

fores i gh t and t i re l ess read i n g of th e m an u scrip t . Th e i r su g g est ion s for im provem en ts ad d ed va l u e to

th e fi n a l pub l i ca t ion s .

Th e m em bers of IDT/1 a re M a rt i n B a i l ey, I an Cu ri ng ton , Aan d i I n ston , M a rc Fresko , Peter H owes , Ph i l i p

J on es , An d rew Ken n y, B i l l M a yon -Wh i te , Rog er S Poo l e , N i ck Pope , I an Wa l d en , Leon i e Wa tson , And rew

P ibworth , N e i l P i tm an , Al an Sh i pm an and Tom Wi l son .

Th e m em bers of IDT/1 /-/5 a re E l i sabeth Be l i s l e , B ern i e Dyer, Peter H owes , R i ch a rd J effrey-Cook, B i l l

M a yon -Wh i te , Rog er S Poo l e , Al an Sh ipm an , Rod Ston e an d Tom Wi l son .

I n pa rt i cu l a r, we wou l d l ike to th an k J en n i fer Ca rru th from B S I for h er exce l l en t ad vi ce an d

copy-ed i t i ng work on B S 1 0008 : 201 4 .

Peter H owes

Al an Sh ipm an

(Ed i tors )

G roup 5 Tra i n i n g Lim i ted

Th e Ed i tors wou l d a l so l i ke to th an k th e fo l l ow i n g org an i za t i on s for revi ewi n g th e previou s ed i t ion s of

th i s pub l i ca t i on :

Assoc i a t i on of Ch i ef Po l i ce O ffi cers (ACPO ) ;

Assoc i a t i on for Pa ym en t C l ea ri n g Servi ces (APACS ) ;

B r i t i sh Com pu ter Soc i ety (BCS ) – I n form a t ion R i sk M an ag em en t & Au d i t (I RMA) spec i a l i st g roup ;

N a t i on a l Au d i t O ffi ce (NAO ) ;

Po l i ce I n form a t ion Tech no l og y O rg an i sa t ion (P I TO ) ;

Th e N a t i on a l Arch i ves (TNA) .

Th e fi rst ed i t ion of PD 5000 , pub l i sh ed i n 1 998 , wa s spon sored by G roup 5 , i n a ssoc i a t ion w i th th e

E l ectron i c O r i g i n a l I n i t i a t i ve .

vi i i