BS 10008:2014

Provides requirements for the implementation And operation of electronic information management systems, including the storage and transfer of information, with an objective of enabling the user to ensure the authenticity and integrity of the information is maintained, so that it is trustworthy and is either accepted without dispute or successfully resists challenge.

This British Standard specifies requirements for the implementation and operation of electronic information management systems, including the storage and transfer of information, with an objective of enabling the user to ensure the authenticity and integrity of the information is maintained, so that it is trustworthy and is either accepted without dispute or successfully resists challenge. These issues are important where the information might be used as evidence – whether for business, compliance, legal or other dispute resolution purposes. This British Standard covers: the management of the availability of electronic information over time; the electronic transfer or communication of electronic information; the linking of electronic identity to particular electronic information, including the use of electronic signatures and electronic copyright systems, as well as the verification of electronic identity. This British Standard also includes requirements for the stewardship and accountability of the management of information throughout its life cycle. The requirements specified in this British Standard are generic and intended to be applicable to all organizations (or parts thereof), regardless of type, size and nature of business. The extent of application of these requirements depends on the organization’s operating environment and complexity. This British Standard applies to electronic information in any form, including general office documents, electronic images and information held in databases and other electronic systems. The information may be alphanumeric, image based and/or voice/video recordings. This British Standard does not cover processes used to evaluate the authenticity of information prior to it being captured or created in the system.