PD ISO/TR 18128:2014

Foreword
Introduction
1 Scope
2 Normative references
3 Terms and definitions
4 Risk assessment criteria for the organization
5 Risk identification
6 Analysing identified risks
7 Evaluating risks
8 Communicating the identified risks
Annex A (informative) - Example of a documented risk
        entry in a risk register
Annex B (informative) - Example: checklists for
        identifying areas of uncertainty
Annex C (informative) - Guide to using controls
        from ISO/IEC 27001, Annex A
Bibliography

Describes: a) a method of analysis for identifying risks related to records processes and systems, b) a method of analysing the potential effects of adverse events on records processes and systems, c) guidelines for conducting an assessment of risks related to records processes and systems, and d) guidelines for documenting identified and assessed risks in preparation for mitigation.

This Technical Report intends to assist organizations in assessing risks to records processes and systems so they can ensure records continue to meet identified business needs as long as required. The report establishes a method of analysis for identifying risks related to records processes and systems, provides a method of analysing the potential effects of adverse events on records processes and systems, provides guidelines for conducting an assessment of risks related to records processes and systems, and provides guidelines for documenting identified and assessed risks in preparation for mitigation. This Technical Report does not address the general risks to an organization’s operations which can be mitigated by creating records. This Technical Report can be used by all organizations regardless of size, nature of their activities, or complexity of their functions and structure. These factors, and the regulatory regime in which the organization operates which prescribes the creation and control of its records, are taken into account when identifying and assessing risk related to records and records systems. Defining an organization or identifying its boundaries should take into account the complex structures and partnerships and contractual arrangements for outsourcing services and supply chains which are a common feature of contemporary government and corporate entities. Identifying the boundaries of the organization is the initial step in defining the scope of the project of risk assessment related to records. This Technical Report does not address directly the mitigation of risks as methods for these will vary from organization to organization. The Technical Report can be used by records professionals or people who have responsibility for records in their organizations and by auditors or managers who have responsibility for risk management programs in their organizations.