BS 10008-1:2020

This British Standard specifies requirements for the implementation and operation of electronic information management systems, including the storage and transfer of electronically stored information (ESI), with an objective of enabling the user to ensure the authenticity and integrity of the ESI is maintained, so that it is trustworthy and is either accepted without dispute or successfully resists challenge.

This British Standard specifies requirements for the implementation and operation of electronic information management systems, including the storage and transfer of electronically stored information (ESI), with an objective of enabling the user to ensure the authenticity and integrity of the ESI is maintained, so that it is trustworthy and is either accepted without dispute or successfully resists challenge. These issues are important where the ESI might be used as evidence – whether for business, compliance, legal or other dispute resolution purposes. This British Standard covers: the management of the availability of ESI over time; the electronic transfer or communication of ESI; and the linking of electronic identity to particular ESI, including the use of electronic signatures and electronic copyright systems, as well as the verification of electronic identity. This British Standard also includes requirements for the stewardship and accountability of the management of ESI throughout its life cycle. The requirements specified in this British Standard are generic and intended to be applicable to all organizations (or parts thereof), regardless of type, size and nature of business. The extent of application of these requirements depends on the organizations operating environment and complexity. This British Standard applies to ESI in any form, including general office documents, electronic images and information held in databases and other electronic systems. The ESI can be alphanumeric, image based and/or voice/video recordings, captured from static and mobile devices. This British Standard does not cover processes used to evaluate the authenticity and integrity of ESI prior to it being captured or created in the system.