ISO/DIS 19475

Document management -- Minimum requirements for the storage of documents

Gestion de documents -- Exigences minimales pour le stockage des documents

Standards Content (sample)

DRAFT INTERNATIONAL STANDARD
ISO/DIS 19475
ISO/TC 171/SC 1 Secretariat: BSI
Voting begins on: Voting terminates on:
2020-09-23 2020-12-16
Document management — Minimum requirements for the
storage of documents
Gestion de documents — Exigences minimales pour le stockage des documents
ICS: 37.080
THIS DOCUMENT IS A DRAFT CIRCULATED
FOR COMMENT AND APPROVAL. IT IS
THEREFORE SUBJECT TO CHANGE AND MAY
NOT BE REFERRED TO AS AN INTERNATIONAL
STANDARD UNTIL PUBLISHED AS SUCH.
IN ADDITION TO THEIR EVALUATION AS
BEING ACCEPTABLE FOR INDUSTRIAL,
This document is circulated as received from the committee secretariat.
TECHNOLOGICAL, COMMERCIAL AND
USER PURPOSES, DRAFT INTERNATIONAL
STANDARDS MAY ON OCCASION HAVE TO
BE CONSIDERED IN THE LIGHT OF THEIR
POTENTIAL TO BECOME STANDARDS TO
WHICH REFERENCE MAY BE MADE IN
Reference number
NATIONAL REGULATIONS.
ISO/DIS 19475:2020(E)
RECIPIENTS OF THIS DRAFT ARE INVITED
TO SUBMIT, WITH THEIR COMMENTS,
NOTIFICATION OF ANY RELEVANT PATENT
RIGHTS OF WHICH THEY ARE AWARE AND TO
PROVIDE SUPPORTING DOCUMENTATION. ISO 2020
---------------------- Page: 1 ----------------------
ISO/DIS 19475:2020(E)
COPYRIGHT PROTECTED DOCUMENT
© ISO 2020

All rights reserved. Unless otherwise specified, or required in the context of its implementation, no part of this publication may

be reproduced or utilized otherwise in any form or by any means, electronic or mechanical, including photocopying, or posting

on the internet or an intranet, without prior written permission. Permission can be requested from either ISO at the address

below or ISO’s member body in the country of the requester.
ISO copyright office
CP 401 • Ch. de Blandonnet 8
CH-1214 Vernier, Geneva
Phone: [phone]
Email: [e-mail]
Website: www.iso.org
Published in Switzerland
ii © ISO 2020 – All rights reserved
---------------------- Page: 2 ----------------------
ISO/DIS 19475:2020(E)
Contents Page

Foreword ........................................................................................................................................................................................................................................iv

Introduction ..................................................................................................................................................................................................................................v

1 Scope ................................................................................................................................................................................................................................. 1

2 Normative references ...................................................................................................................................................................................... 1

3 Terms and definitions ..................................................................................................................................................................................... 1

4 General ............................................................................................................................................................................................................................ 2

4.1 P olicy ............................................................................................................................................................................................................... 2

4.2 Document types ..................................................................................................................................................................................... 3

4.3 Controlling a received and delivered document ........................................................................................................ 4

4.4 Risks in document handling and measures .................................................................................................................... 4

4.4.1 Receipt and formalization ........................................................................................................................................ 4

4.4.2 Formalized for recipient and delivery ........................................................................................................... 4

5 Receipt and formalization .......................................................................................................................................................................... 5

5.1 Requirements ........................................................................................................................................................................................... 5

5.2 Controls for receiving ........................................................................................................................................................................ 5

5.3 Controls for the formalization process............................................................................................................................... 5

5.4 Document to be used at processing ...................................................................................................................................... 6

5.5 Preserving the receiving and formalization contexts ............................................................................................ 6

6 Delivery .......................................................................................................................................................................................................................... 6

6.1 Requirements ........................................................................................................................................................................................... 6

6.2 Controls for the delivery process ............................................................................................................................................ 7

6.3 Controls for the formalizing for recipient process ................................................................................................... 7

6.4 Preservation of the delivery context .................................................................................................................................... 7

6.5 Monit oring of the delivered document .............................................................................................................................. 8

7 Storage ............................................................................................................................................................................................................................ 8

7.1 Storage ........................................................................................................................................................................................................... 8

Annex A (informative) Formalization .................................................................................................................................................................. 9

Annex B (informative) Delivery ..............................................................................................................................................................................11

Annex C (informative) Requirements for EDMS/ECM ......................................................................................................................13

Bibliography .............................................................................................................................................................................................................................15

© ISO 2020 – All rights reserved iii
---------------------- Page: 3 ----------------------
ISO/DIS 19475:2020(E)
Foreword

ISO (the International Organization for Standardization) is a worldwide federation of national standards

bodies (ISO member bodies). The work of preparing International Standards is normally carried out

through ISO technical committees. Each member body interested in a subject for which a technical

committee has been established has the right to be represented on that committee. International

organizations, governmental and non-governmental, in liaison with ISO, also take part in the work.

ISO collaborates closely with the International Electrotechnical Commission (IEC) on all matters of

electrotechnical standardization.

The procedures used to develop this document and those intended for its further maintenance are

described in the ISO/IEC Directives, Part 1. In particular, the different approval criteria needed for the

different types of ISO documents should be noted. This document was drafted in accordance with the

editorial rules of the ISO/IEC Directives, Part 2 (see www .iso .org/ directives).

Attention is drawn to the possibility that some of the elements of this document may be the subject of

patent rights. ISO shall not be held responsible for identifying any or all such patent rights. Details of

any patent rights identified during the development of the document will be in the Introduction and/or

on the ISO list of patent declarations received (see www .iso .org/ patents).

Any trade name used in this document is information given for the convenience of users and does not

constitute an endorsement.

For an explanation of the voluntary nature of standards, the meaning of ISO specific terms and

expressions related to conformity assessment, as well as information about ISO's adherence to the

World Trade Organization (WTO) principles in the Technical Barriers to Trade (TBT), see www .iso .org/

is o/ f or ewor d . ht m l .

This document was prepared by Technical Committee [or Project Committee] ISO/TC 171,

Subcommittee SC 1.

This second edition cancels and replaces the first edition (ISO TS 19475 series), which has been

technically revised.
The main changes from the previous edition are as follows:
— Clarified the relationship between business process and storage operations.

— Coordinated storage operations in accordance with the existing ISO standards involving storage.

— Integrated three parts standards into one parts standard.
A list of all parts in the ISO TS 19475 series can be found on the ISO website.

Any feedback or questions about this document should be directed to the user’s national standards

body. A complete listing of these bodies can be found at www .iso .org/ members .html.

iv © ISO 2020 – All rights reserved
---------------------- Page: 4 ----------------------
ISO/DIS 19475:2020(E)
Introduction

This document specifies the minimum requirements for the operation of a document management system.

Overall business operations are composed of the functions of receiving the document(s), performing

the work processes according to its contents, reporting the results of the processes and delivering

an outcome. A document management system serves the basic purpose of controlling the handling of

the received document, establishing the work processes and delivering the result of those processes.

Therefore, the reliability of the business processes and the process itself heavily depend on the

reliability of the document used as well as the reliability of the document management system.

The following operations are necessary for maintaining the reliability of business activities:

— An operation that maintains the reliability of the received documents;
— An operation that maintains the integrity of the process activities; and
— An operation that ensures the authenticity of the delivered documents.

The reliability of the work processes are demonstrated by the effectiveness evaluation of the internal

control of the organizations. Management is responsible for creating evidence during their business

activities, maintaining their authenticity and integrity and ensuring these will remain in place going

forward. Retained documents produced as evidence of work are audited and assessed for validity. The

framework and the controls for preserving documents are described in ISO 15489.

ISO 14641 describes the methods for storing a legitimately created electronic document and the

guidelines for maintaining its integrity in perpetuity.

EDMS is an effective technology for handling storage to ensure the reliability of documents processed

internally in an organization. For EDMS there is no precise standard. In these standards for EDMS, there

is the requirement for references.

The above-mentioned mechanisms are a useful foundation for demonstrating the integrity of work

processes.

However, in executing their business operations, organizations receive various types of document and

deliver them to other organizations. Sharing documents has the potential for a variety of risks.

There is the risk that the organization may receive a document without any right to use it. There also

is the risk that the document contains false information, or that the information was received through

inappropriate communication channels. Or, the information is inappropriate for business purposes.

Any of these circumstances will degrade the reliability of the work processes.

There also are risks involved when delivering a document to another organization. For example, it could

be delivered to the wrong party or the information is not appropriate to be shared. Organizations need

to take the necessary steps to mitigate these risks.

Organizations need to clarify their handling process procedures for receipt and delivery of documents.

Document handling procedures need to include quality criteria for the documents to be processed.

By applying the controls described in this document, an organization can operate their document

management system appropriately.
© ISO 2020 – All rights reserved v
---------------------- Page: 5 ----------------------
DRAFT INTERNATIONAL STANDARD ISO/DIS 19475:2020(E)
Document management — Minimum requirements for the
storage of documents
1 Scope

This document specifies the minimum requirements necessary to maintain the authenticity, integrity

and readability of documents managed by an electronic document management system. Clarifying the

methods and procedures for appropriately handling electronic documents promotes the usability of the

documents, in both a legal and business context.

This document expresses a general business process as a document handling process. The document

handling processes include receiving, processing, and delivering the documents as follows:

— Formalizing the receipt of a document in a manner that is appropriate for a work process.

— Storing the formal document in the work process environment.
— Delivery of the document to another organization.

This document establishes the controls for execution of the work processes while maintaining the

authenticity and integrity of the document received.

This document establishes the policies for the storage of documents used as part of the work process. It

also details the controls for performing the receipt and conversion process appropriately.

To preserve an electronic document in such a manner that its integrity is maintained, adherence to

ISO 14641 requirements is required.
2 Normative references

The following documents are referred to in the text in such a way that some or all of their content

constitutes the requirements of this document. For dated references, only the edition cited applies. For

undated references, the latest edition of the referenced document (including any amendments) applies.

ISO 14641, Electronic document management — Design and operation of an information system for the

preservation of electronic documents — Specifications
3 Terms and definitions
For the purposes of this document, the following terms and definitions apply.

ISO and IEC maintain terminological databases for use in standardization at the following addresses:

— ISO Online browsing platform: available at https:// www .iso .org/ obp
— IEC Electropedia: available at http:// www .electropedia .org/
3.1
EDMS

a software program that manages the creation, storage, and control of documents electronically

3.2
preservation system
a system retains documents and metadata as evidence of the handling of documents
© ISO 2020 – All rights reserved 1
---------------------- Page: 6 ----------------------
ISO/DIS 19475:2020(E)
3.3
storage system

information technology system that has the capability of managing electronically stored documents.

3.4
database

collection of machine-readable information organized so that it can be easily accessed, managed,

and updated
[SOURCE: ISO 5127:2017, 3.1.13.03]
3.5
metadata

data about other data, documents or records that describes their content, context, structure, data

format, provenance, and/or rights attached to them
[SOURCE: ISO 5127:2017, 3.1.10.26.01: ISO 15489-1: ISO 23081-1]
4 General
4.1 Policy

This document expresses a document handling in the framework of business process. The document

handling processes include receipt, processing and delivery of documents, but are not limited to them.

The relationships are shown in Figure 1.

When a document is received, the receiving organization stores it, and if necessary, sets the data format

and form appropriate for the processing process.

Each receiving organization stores the document in a storage system, so that the change history of the

document throughout the handling process is securely maintained. Maintaining a log of the handling

process in the preservation system also is required.

After processing is complete, if necessary, the delivering organization formats the document

appropriately for the recipient’s use. The organization sending the document transfers or shares it to

another organization.

The integrity of a delivered document can be tracked throughout the document processing process.

Therefore, organizations can use work-related documentation to fulfil accountability.

NOTE This document specifies control measures for the smooth handling of storage operations related to the

receipt of a document and the issuance and delivery of the processing results. Storage of the document(s) involved

with the general handling processes are controlled in accordance with EDMS and ECM. (The requirements of

EDMS/ECM are shown in Annex C.) The preservation and maintenance of the evidential information of business

execution are in accordance with the preservation system specified in ISO 14641.
2 © ISO 2020 – All rights reserved
---------------------- Page: 7 ----------------------
ISO/DIS 19475:2020(E)
Figure 1

The organization validates that the document received contains the information required for

processing, whether the organization had the right to receive it, etc. After the document is formalized a

format appropriate for handling, it shall be verified that the conversion was made accurately.

Organizations with established handling processes use documents that are formalized in a format

that is appropriate for that process. The organization reviews the document created by following the

process along with the document received. This check confirms the quality of the processing results.

The approved document will be formalized as appropriate for the recipient’s use prior to delivery.

The delivered document is then stored within the preservation system. The delivered document is

monitored in terms of use, transfer, copying, updates and deletion.

By handling the document according to the methods described in this document, the integrity of

document handling is assured.
4.2 Document types
Types of document to be received by the organization are as follows:
— In paper form, such as an application document.

— A scanned electronic document from an original hard copy or photograph (jpeg image), etc.

— A document that was packaged with other forms of data (office systems, CAD, etc.)

— A document extracted from database information using an application program interface (API).

— A document obtained through a network via API (in this case, the document is not actually moving.)

— A document that is part of a data stream.

Each type of information needs a different type of control; therefore, having specific controls for each

type reduces the risk of losing information or creating an error.
© ISO 2020 – All rights reserved 3
---------------------- Page: 8 ----------------------
ISO/DIS 19475:2020(E)
4.3 Controlling a received and delivered document

To maintain the quality of the handling process, the integrity of the document received and delivered

shall be confirmed.

This is critical to ensure the reliability of the receipt the document, formalizing to deliverable form and

delivery processes of the document.
To maintain reliability of these processes, manage the document as follows:
— Define the type of document to be handled.
— Define the handling procedure for each type of document.
— Note the context of the handling process so that each process can be audited

— When any problems are found during an audit, correction and improvement actions will be

conducted.

NOTE “Context” is defined as information related to the document handling history. Examples include the

document author, references, update log, handling logs related to processing, etc.

4.4 Risks in document handling and measures
4.4.1 Receipt and formalization

An organization receives and formalizes the documents it receives in a format that is appropriate for its

use in the organization. The formalized document is then used according to the handling process.

This chapter describes the risks associated with the organization responsible for receiving and

formalizing the documents.
Examples of the risks are as follows:
— An organization can receive a document that it does not have the right to use.

— When inappropriate documentation is processed, the organization's decisions will not be made

correctly.

— Incorrect worker assignments are the cause of information leakage and false information.

— When authenticity of the document received is not confirmed, it is not possible to maintain the

quality of the documentation process and the delivered documents.
4.4.2 Formalized for recipient and delivery
This chapter describes the risks associated delivery processes.
Examples of the risks are as follows:

— The delivery of the document is inconsistent with the work process (tampering).

— Inappropriate documents are delivered (error).
— The document is delivered to unauthorized users.
— The document is destroyed while in use.
4 © ISO 2020 – All rights reserved
---------------------- Page: 9 ----------------------
ISO/DIS 19475:2020(E)
5 Receipt and formalization
5.1 Requirements

Organizations should define handling methods for each type of document to properly control the

documents they receive.

The type of document and the handling methods are defined according to the receiving policy and the

contract with the vendor or customer.

NOTE The type of document is defined by its use and purpose. The format of the document is defined by its

handling method.
5.2 Controls for receiving

The organization shall confirm the skill level of the person responsible for receiving the document

before giving the work order.

The organization shall confirm whether the organization has the rights and privileges to use the

received document.

An organization shall not receive types of document they do not have the rights and privileges to use.

The organization shall maintain the integrity of the document received and the document formalized in

accordance with its purpose for processing.

The organization shall maintain the quality of the equipment involved in the receiving and formalizing

processes.

NOTE 1 When outsourcing receipt duties to outside organization, care is taken to avoid receiving documents

not authorized to be outsourced in their handling.

NOTE 2 An organization avoids the risk of receiving a document they are not authorized to process.

NOTE 3 The authenticity and reliability of the document received is either confirmed by such public credibility

information as an electronic signature or time stamp, or the organizational trust or credibility of the party who

sent the information.
5.3 Controls for the formalization process

Controls for the formalization process of the document received from an outside organization into a

format appropriate for the document handling process are explained below.

Formalization processes for the purpose of conversion include digitizing a paper document received,

registering or duplicating the document, whether received in paper form or an electronic file, and

deploying a data file received into processing.

NOTE Security risks in terms of physical security or system security are not discussed in this document.

Please refer to the relevant IT security standards.

When converting a document into a format that is appropriate for processing, the organization should

ensure that the received document and the converted document are the same.

During the receipt process, handling shall be suspended if the information includes a document that

is not able to be formalized. When the receipt process is suspended, the organization shall store the

information in question and return the relevant document to the sender.

NOTE See Annex A for the controls for inspection of the document format received.

© ISO 2020 – All rights reserved 5
---------------------- Page: 10 ----------------------
ISO/DIS 19475:2020(E)
5.4 Document to be used at processing

Metadata shall be extracted from the received document that will be used during processing.

Metadata to be used during the document handling processes contains rights and privileged information,

information for identifying the document, and the purpose of the document being processed for use.

Metadata is used to control the processes of the users and custodians of the document, as well as to

identify the processing procedures.

The organization shall store the extracted metadata as well as the received contents into the EDMS or

ECM.
NOTE The requirements for EDMS and ECM are shown in Annex C.
5.5 Preserving the receiving and formalization contexts

The context of the receiving and formalization operations shall be taken as a log with machinery or as an

operations log. The context information contains the received and formalized documents, the software

used for formalization and the documents for use, and stores this information in the preservation system.

The document metadata shall contain the name of the person that created it, an electronic signature

and a time stamp marking the date it was preserved. The use of an electronic signature and time stamp

is done in accordance with the criteria described in ISO 14641.

NOTE 1 The requirements for ensuring the authenticity of the preserved document will vary by each country’s

legal regulations.
1) Authorize the output document.

2) Authenticate and apply a time stamp for both the received document and the output document.

3) Documents are stored with a trusted storage service. This document is called a true copy.

In addition, the context information (use log, reference log, update log, etc.) related to the generation

of the document is preserved with an electronic signature and time stamp.

4) In addition to 2) above, the name and version of the software program used for editing and creation

is also recorded and stored.

In addition to above, the usage history of the system program should be required.

NOTE 2 The document to be stored as evidence is specified by the operation rules developed in accordance

with the relevant laws relating to that operation.

NOTE 3 The document to be stored contains the name of the person, the date of creation, etc. It is critical to

decide on the handling procedures to ensure data integrity according to the information handling rules.

6 Delivery
6.1 Requirements

Organizations should define the handling methods for each type of document to be controlled and

delivered.

The type of document and the handling methods are defined according to the delivery policy and the

contract with the vendor or customer.

NOTE See Annex B for the controls for inspection of the document format that is deliverable.

6 © ISO 2020 – All rights reserved
---------------------- Page: 11 ----------------------
ISO/DIS 19475:2020(E)
6.2 Controls for the delivery process

The organization shall preserve appropriate and validated business processes according to roles and

responsibilities. Thus, the organization maintains the integrity of the processing process.

The organization shall assign appropriate workers to the delivery process.

The organization shall ensure that the organization to which the document is to be delivered has the

rights and privileges to use the document that is being shipped to them.

The organization shall only deliver documents that they have the authority and privileges to deliver.

The organization shall maintain the integrity of the delivery process.

The organization shall maintain the quality of the equipment used for the delivery process.

The organization shall suppress the format and range of the document against the request of the

delivery destination.

In addition, the organization shall convert to the format and range of the documents that have been

made to the destination request.
The organization shall select an appropriate communication channel.

The organization shall be able to monitor the usage status of the information delivered.

The organization shall define the expiration date of the delivered document.

The document delivered and the preservation of the delivery log shall not be destroyed within the

period specified.
The delivered do
...