oSIST ISO/DIS 16175-2:2019

TECHNICAL ISO/TS
SPECIFICATION 16175-2
Second edition
2020-10
Information and documentation —
Processes and functional
requirements for software for
managing records —
Part 2:
Guidance for selecting, designing,
implementing and maintaining
software for managing records
Information et documentation — Processus et exigences
fonctionnelles applicables aux logiciels de gestion des documents
d'activité —
Partie 2: Recommandations pour le choix, la conception, la mise
en oeuvre et la tenue à jour des logiciels de gestion des documents
d’activité d'activité
Reference number
ISO/TS 16175-2:2020(E)
ISO 2020
---------------------- Page: 1 ----------------------
ISO/TS 16175-2:2020(E)
COPYRIGHT PROTECTED DOCUMENT
© ISO 2020

All rights reserved. Unless otherwise specified, or required in the context of its implementation, no part of this publication may

be reproduced or utilized otherwise in any form or by any means, electronic or mechanical, including photocopying, or posting

on the internet or an intranet, without prior written permission. Permission can be requested from either ISO at the address

Foreword ..........................................................................................................................................................................................................................................v

Introduction ................................................................................................................................................................................................................................vi

1 Scope ................................................................................................................................................................................................................................. 1

2 Normative references ...................................................................................................................................................................................... 1

3 Terms and definitions ..................................................................................................................................................................................... 1

4 Assessing the organizational framework and context .................................................................................................. 1

4.1 General ........................................................................................................................................................................................................... 1

4.2 Organizational records maturity ............................................................................................................................................. 2

4.3 Records controls .................................................................................................................................................................................... 3

4.4 Technical environment..................................................................................................................................................................... 3

4.4.1 General...................................................................................................................................................................................... 3

4.4.2 Paper environment ........................................................................................................................................................ 3

4.4.3 Digital environment ...................................................................................................................................................... 3

4.4.4 Hybrid environment ..................................................................................................................................................... 5

4.5 Project scoping and resources ................................................................................................................................................... 5

5 Determining a project methodology ................................................................................................................................................ 7

5.1 General ........................................................................................................................................................................................................... 7

5.2 Defining stakeholders ....................................................................................................................................................................... 7

6 Determining and managing functional requirements .................................................................................................. 8

6.1 Developing functional requirements ................................................................................................................................... 8

6.2 Considerations for defining functional requirements ........................................................................................... 8

6.3 Managing functional requirements ....................................................................................................................................... 9

7 Determining configuration ........................................................................................................................................................................ 9

7.1 General ........................................................................................................................................................................................................... 9

7.2 Importance of documentation of configuration decisions .............................................................................10

7.3 Configuration decisions — Areas of configuration ...............................................................................................10

7.3.1 General...................................................................................................................................................................................10

7.3.2 Records aggregation ..................................................................................................................................................11

7.3.3 Agents (Users).................................................................................................................................................................12

7.3.4 Business process ...........................................................................................................................................................12

7.3.5 Metadata schema for records ............................................................................................................................12

7.3.6 Business classification schemes ......................................................................................................................13

7.3.7 Access and permission rules ..............................................................................................................................13

7.3.8 Disposition authorities ............................................................................................................................................13

7.3.9 User interface ...................................................................... .............................................................................................13

7.3.10 Supported automation .............................................................................................................................................13

7.3.11 Supported automation tools ...............................................................................................................................14

7.3.12 Automated capture of records process metadata ............................................................................14

7.3.13 Integration needed to other existing business software ............................................................14

7.3.14 Applicable records-specific rules ...................................................................................................................14

8 Determining requirements to migrate and convert records ...............................................................................15

9 Communication, training and change management ....................................................................................................15

9.1 General ........................................................................................................................................................................................................15

9.2 Communications .................................................................................................................................................................................16

9.3 Training program requirements ...........................................................................................................................................16

9.4 Change management readiness .............................................................................................................................................16

9.5 E valuation and review ...................................................................................................................................................................17

10 Post-implementation review, monitoring and assessment ..................................................................................18

10.1 Post-implementation review ...................................................................................................................................................18

10.2 Monitoring ...............................................................................................................................................................................................18

10.3 Assessment ..............................................................................................................................................................................................19

Annex A (informative) Considerations for a methodology for implementing software for

managing records .............................................................................................................................................................................................20

Bibliography .............................................................................................................................................................................................................................22

ISO (the International Organization for Standardization) is a worldwide federation of national standards

bodies (ISO member bodies). The work of preparing International Standards is normally carried out

through ISO technical committees. Each member body interested in a subject for which a technical

committee has been established has the right to be represented on that committee. International

organizations, governmental and non-governmental, in liaison with ISO, also take part in the work.

ISO collaborates closely with the International Electrotechnical Commission (IEC) on all matters of

The procedures used to develop this document and those intended for its further maintenance are

described in the ISO/IEC Directives, Part 1. In particular, the different approval criteria needed for the

different types of ISO documents should be noted. This document was drafted in accordance with the

editorial rules of the ISO/IEC Directives, Part 2 (see www .iso .org/ directives).

Attention is drawn to the possibility that some of the elements of this document may be the subject of

patent rights. ISO shall not be held responsible for identifying any or all such patent rights. Details of

any patent rights identified during the development of the document will be in the Introduction and/or

Any trade name used in this document is information given for the convenience of users and does not

For an explanation of the voluntary nature of standards, the meaning of ISO specific terms and

expressions related to conformity assessment, as well as information about ISO's adherence to the

World Trade Organization (WTO) principles in the Technical Barriers to Trade (TBT), see www .iso .org/

This document was prepared by Technical Committee ISO/TC 46, Information and documentation,

This second edition of ISO/TS 16175-2 cancels and replaces ISO 16175-2:2011 and ISO 16175-3:2010,

which have been technically revised. The main changes compared to the previous editions are as

— functional requirements for software that were previously provided in ISO 16175-2:2011 and

— guidance on implementing software for digital records that was previously provided in all three

parts of the previous edition of the ISO 16175 series has been updated and consolidated;

— in an updated form, some generic content on implementing records systems (both digital and

analogue), that was previously provided in the now withdrawn ISO/TR 15489-2:2001 have been

Any feedback or questions on this document should be directed to the user's national standards body. A

All organizations have at least one records system. Records systems are information systems which

capture, manage and provide access to records over time. Records systems can consist of technical

elements such as software, and non-technical elements such as policy, procedures and agents. Records

systems as a whole include the policy, processes, software and people that use and manage records.

Records systems exist in many variations: in paper systems, in software specifically designed to meet

functionality for managing records, or as business software which capture and manage records. This

document is focused on management of records in the digital environment, using software, but the

This document makes no distinction between software applications that are used for any business

purpose and those applications specifically intended and designed to manage records. Examples of

the former include Enterprise Content Management Systems and applications which create records

as one part of their functionality such as Contracts Management Systems, Case Management Systems

or transactional systems. The term used throughout is therefore “software for managing records”,

which is intended to encapsulate the totality of applications that manage records as part of their usual

functioning. It is assumed that almost all business applications generates data that is needed to serve as

evidence of business activity for future reference and as such, among other things, need to create, store

and manage records, whether within their own functionality or in combination with other applications.

Clauses 4 and 5 provide guidance on assessing the context of the organization and on scoping a project to

implement software for managing records. Clauses 6 to 8 provide guidance on identifying requirements

for the functionality of the software, including those for conversion and migration. Clause 9 provides

guidance on communication, training and change management. Clause 10 provides guidelines for post-

ISO 16175-1 provides a set of model functional requirements and associated guidance for software for

This document provides guidance for decision making and processes associated with the selection,

design, implementation and maintenance of software for managing records, according to the principles

This document is applicable to any kind of records system supported by software, including paper

records managed by software, but is particularly focused on software for managing digital records.

This document provides guidance to records professionals charged with, or supporting the selection,

design, implementation and maintenance of systems for managing records using a variety of software.

It can also provide assistance to information technology professionals such as solution architects/

designers, IT procurement decision makers, business analysts, business owners and software

The following documents are referred to in the text in such a way that some or all of their content

constitutes requirements of this document. For undated references, the latest edition of the referenced

ISO 30300, Information and documentation — Records management — Core concepts and vocabulary

For the purposes of this document, the terms and definitions given in ISO 30300 apply.

ISO and IEC maintain terminological databases for use in standardization at the following addresses:

Organizations have distinct cultures which usually affect their approach to managing records. These

cultures are part of the organizational context. Factors that impact the information culture of an

— the societal and organizational requirements, including legislation and/or regulation, standards

and related policy containing requirements for managing records and outline compliance.

The organizational culture affects decisions on selection and implementation of systems and software

for managing records. Where an organization has a defined information governance framework, the

system for managing records should be integrated with the information governance framework.

Where software for managing records supports processes shared by multiple organizations,

information culture factors should be considered for each organization. Selection and design of

software for managing records should be responsive to the needs of each organization. Responsibility

and ownership for managing cross-organizational systems and the rights in managing records created

Selection and design of software for managing records should be undertaken within an organizational

framework that defines the policies and responsibilities to be implemented, and the records control

elements needed to scope the project. The following aspects should be considered during the planning

Assessing organizational records maturity helps guide the selection, design and implementation

of software for managing records. Undertaking an assessment of organizational maturity enables

benchmarking of progress over time, and assessment amongst similar organizations.

— whether strategic responsibilities for managing records are included in the senior management

— whether records and their management are considered explicit components of information

— whether records functionality is included as a core component of the enterprise information

— the level at which responsibility is assigned to resource, enforce and monitor conformance with

— the availability of trained users and operational users in designing, implementing and maintaining

— the organizational culture and the extent of awareness of responsibilities for creating and managing

— what policies, standards and guidance outlining records responsibilities and obligations have been

developed for the organization, whether they are current and whether they are compliant to the

— whether records requirements have been incorporated into information governance frameworks

and all relevant organizational policies, standards and guidelines (for example privacy, information

— whether records have been linked to organizational and/or functional risk assessments;

— what support is available to users in understanding their records responsibilities.

Records systems can be designed in many ways to support business, and more than one records

system may exist within the organization as a whole. Records controls should be devised at an

organizational level whenever possible, so that they can be applied consistently to all records without

constraining the organization to using a single software application. These records controls identified

in ISO 15489-1:2016, Clause 8, should be developed prior to the implementation of a specific software

Records controls developed at organizational level can be used to develop more specific records controls

that can be supported by software to manage records which operate at a smaller level – for example,

controls applying to a part of the organization, or relating to a specific function. The organizational

records controls can form the design template from which the specific elements particularly suited to

the scope of the software implementation can be extracted, or developed in further detail if needed.

The following subclauses address common technical environments in which software for managing

Paper records systems are often organized into files which physically group documents representing

organizational transactions together in ways that reflect their formation. Paper files are typically

managed and accessed through registers and indexes that are often automated using software.

Many organizations now operate in a digital environment. While some paper records can still be

created or received, these are converted to digital form using digitization processes and the digitized

records are incorporated into the records system for processing. For guidance on digitization, see

In this environment, the main concern is to deploy software that supports the characteristics of

authoritative records (that is, authenticity, reliability, integrity and useability). It is also usually

important to enable the digital records (including their metadata) to persist beyond the lifetime of the

software application in which they were initially managed. At the same time, the resources to support

It is important that digital continuity be maintained. Software usually has a practical lifespan of about

5 to 10 years prior to major upgrade or replacement. Issues to be considered in addressing digital

— data which need to be considered as a record may no longer be stored and accessible in recognized

documentary form. Data fields in databases which provide evidence of transactions are records.

Such systems are often business applications which need to consider how to maintain the evidence

of business. On some occasions, structured metadata defined for particular industries can inform

the configuration of metadata elements. Key to considering implementation of records requirements

— how to ensure that it is reproducible as presented to a user at a particular time;

This should be done using the process of appraisal. For further guidance on appraisal, see

— some business applications enable storage of documents within their software boundaries.

Documents can be constantly changing, whereas records should be protected from unauthorised

— documents can be composed of data, which can be stored separately and represented as a single

view (document) when required. The capacity to store data and disaggregated content separately,

— workflow tools may be used to support authorizations and approvals. Such tools often utilize links

and email notifications, and act as connectors between specific software. The workflow definitions

themselves can be required as records, as can the results of those workflows – particularly approvals

All projects which seek to implement fundamental change from paper to digital should comprehensively

— requirements to define adequate processes to ensure the legal admissibility of digital copies of

— jurisdictional requirements to retain certain physical records after digitization.

Cloud services are increasingly being used to provide storage and flexible access to software and

digital records. Multiple options exist for procurement and deployment of cloud services. Options

include software as a service, software with a browser-based user interface and storage of records in

the cloud. For records, this “as a service” approach usually involves storage of digital records on servers

external to the organization. As products emerge which are designed for the cloud environment,

records software functionality is increasingly being made available as a service. At present this is

typically access to a single proprietary set of functionality or software providing records functionality.

Over time, it is anticipated that smaller and smaller bundles of functionality will be made available as

services, allowing clever implementations to build the required records processes and functionality

In this environment, in addition to the issues of authenticity and sustainability, organizations need

to consider jurisdictional rules around data sovereignty, network security and developing adequate

contractual and technical frameworks to guarantee an adequate level of service. Requirements relating

to the end of the service and migration from one platform to another need to be addressed when

initiaiting service agreements. Risk assessment tools supporting decisions on adopting cloud-based

Software for managing records can be available as web-based software which organizations deploy

flexibly on demand as the organization size and requirements change. Such software can involve

multiple agents, including those external to the organization – for example, suppliers or providers

of services. Both parties use the same software to document transactions and communications.

PROJET DE NORME INTERNATIONALE
ISO/DIS 16175-2
ISO/TC 46/SC 11 Secrétariat: SA
Début de vote: Vote clos le:
2019-01-21 2019-04-15
Information et documentation — Processus et exigences
fonctionnelles applicables aux logiciels de gestion des
documents d'activité —
Partie 2:
Recommandations pour le choix, la conception, la mise
en oeuvre et la tenue à jour des logiciels de gestion des
documents d’activité d'activité

Information and documentation - Processes and functional requirements for software for managing

Part 2: Guidance for selecting, designing, implementing and maintaining software for managing records

Le présent document est distribué tel qu’il est parvenu du secrétariat du comité.

Avant-propos ................................................................................................................................................................... v

Introduction ................................................................................................................................................................... vi

1 Domaine d'application .................................................................................................................................. 1

1.1 Public visé .......................................................................................................................................................... 1

2 Références normatives .................................................................................................................................. 1

3 Termes et définitions ..................................................................................................................................... 1

4 Exigences générales applicables aux logiciels de gestion de documents d'activité

numériques ....................................................................................................................................................... 2

4.1 Hypothèses ........................................................................................................................................................ 2

4.2 Présentation générale des exigences ....................................................................................................... 2

documentaires et à définir le périmètre d'un projet ......................................................................... 4

5.1 Généralités ......................................................................................................................................................... 4

5.2 Maturité de l'organisme en matière de gestion des documents d'activité ................................. 4

5.3 Mesures de contrôle pour la gestion des documents d'activité ..................................................... 5

5.4 Environnement technique ........................................................................................................................... 6

5.4.1 Environnement papier .................................................................................................................................. 6

5.4.2 Environnement hybride ................................................................................................................................ 6

5.4.3 Environnement numérique ......................................................................................................................... 6

5.4.4 Environnement de « cloud computing ».................................................................................................. 8

5.4.5 Logiciels collaboratifs basés sur le Web ................................................................................................. 8

5.5 Définition du périmètre et des ressources du projet ......................................................................... 9

6 Détermination d'une méthodologie de projet ................................................................................... 11

6.1 Généralités ...................................................................................................................................................... 11

6.2 Définition des parties prenantes ............................................................................................................ 11

7 Détermination et gestion des exigences fonctionnelles applicables aux logiciels de

gestion des documents d'activité ........................................................................................................... 12

7.1 Élaboration des exigences fonctionnelles ........................................................................................... 12

7.2 Facteurs à prendre en compte pour la définition des exigences fonctionnelles ................... 13

7.3 Gestion des exigences fonctionnelles.................................................................................................... 13

8 Détermination de la configuration ........................................................................................................ 14

8.1 Généralités ...................................................................................................................................................... 14

8.2 Importance de la documentation des décisions de configuration ............................................. 14

8.3 Décisions en matière de configuration ................................................................................................. 15

8.3.1 Domaines de configuration....................................................................................................................... 15

9 Détermination des exigences de migration et de conversion des documents d'activité ... 21

10 Communication, formation et gestion des changements ............................................................... 22

10.1 Généralités ...................................................................................................................................................... 22

10.2 Communication ............................................................................................................................................. 22

10.3 Exigences du programme de formation ............................................................................................... 22

Tous droits réservés. Sauf prescription différente ou nécessité dans le contexte de sa mise en oeuvre, aucune partie de cette

publication ne peut être reproduite ni utilisée sous quelque forme que ce soit et par aucun procédé, électronique ou mécanique,

10.4 Préparation à la gestion des changements ......................................................................................... 23

y compris la photocopie, ou la diffusion sur l’internet ou sur un intranet, sans autorisation écrite préalable. Une autorisation peut

10.5 Évaluation et examen .................................................................................................................................. 25

être demandée à l’ISO à l’adresse ci-après ou au comité membre de l’ISO dans le pays du demandeur.

11 Examen, suivi et appréciation post-mise en œuvre ......................................................................... 25

Avant-propos ................................................................................................................................................................... v

Introduction ................................................................................................................................................................... vi

1 Domaine d'application .................................................................................................................................. 1

1.1 Public visé .......................................................................................................................................................... 1

2 Références normatives .................................................................................................................................. 1

3 Termes et définitions ..................................................................................................................................... 1

4 Exigences générales applicables aux logiciels de gestion de documents d'activité

numériques ....................................................................................................................................................... 2

4.1 Hypothèses ........................................................................................................................................................ 2

4.2 Présentation générale des exigences ....................................................................................................... 2

documentaires et à définir le périmètre d'un projet ......................................................................... 4

5.1 Généralités ......................................................................................................................................................... 4

5.2 Maturité de l'organisme en matière de gestion des documents d'activité ................................. 4

5.3 Mesures de contrôle pour la gestion des documents d'activité ..................................................... 5

5.4 Environnement technique ........................................................................................................................... 6

5.4.1 Environnement papier .................................................................................................................................. 6

5.4.2 Environnement hybride ................................................................................................................................ 6

5.4.3 Environnement numérique ......................................................................................................................... 6

5.4.4 Environnement de « cloud computing ».................................................................................................. 8

5.4.5 Logiciels collaboratifs basés sur le Web ................................................................................................. 8

5.5 Définition du périmètre et des ressources du projet ......................................................................... 9

6 Détermination d'une méthodologie de projet ................................................................................... 11

6.1 Généralités ...................................................................................................................................................... 11

6.2 Définition des parties prenantes ............................................................................................................ 11

7 Détermination et gestion des exigences fonctionnelles applicables aux logiciels de

gestion des documents d'activité ........................................................................................................... 12

7.1 Élaboration des exigences fonctionnelles ........................................................................................... 12

7.2 Facteurs à prendre en compte pour la définition des exigences fonctionnelles ................... 13

7.3 Gestion des exigences fonctionnelles.................................................................................................... 13

8 Détermination de la configuration ........................................................................................................ 14

8.1 Généralités ...................................................................................................................................................... 14

8.2 Importance de la documentation des décisions de configuration ............................................. 14

8.3 Décisions en matière de configuration ................................................................................................. 15

8.3.1 Domaines de configuration....................................................................................................................... 15

9 Détermination des exigences de migration et de conversion des documents d'activité ... 21

10 Communication, formation et gestion des changements ............................................................... 22

10.1 Généralités ...................................................................................................................................................... 22

10.2 Communication ............................................................................................................................................. 22

10.3 Exigences du programme de formation ............................................................................................... 22

10.4 Préparation à la gestion des changements ......................................................................................... 23

10.5 Évaluation et examen .................................................................................................................................. 25

11 Examen, suivi et appréciation post-mise en œuvre ......................................................................... 25

11.1 Généralités ...................................................................................................................................................... 25

11.2 Conduite d'un examen post-mise en œuvre pour les systèmes documentaires .................... 25

11.2.1 Examen mené immédiatement après la mise en œuvre................................................................. 26

11.2.2 Examen après une certaine durée d'utilisation ................................................................................ 26

11.2.3 Mesures entreprises à l'issue des examens ........................................................................................ 27

11.3 Surveillance .................................................................................................................................................... 27

11.4 Évaluation ....................................................................................................................................................... 28

Bibliographie ................................................................................................................................................................ 30

L'ISO (Organisation internationale de normalisation) est une fédération mondiale d'organismes nationaux

de normalisation (comités membres de l'ISO). L'élaboration des Normes internationales est en général

confiée aux comités techniques de l'ISO. Chaque comité membre intéressé par une étude a le droit de faire

partie du comité technique créé à cet effet. Les organisations internationales, gouvernementales et non

gouvernementales, en liaison avec l'ISO participent également aux travaux. L'ISO collabore étroitement avec

la Commission électrotechnique internationale (IEC) en ce qui concerne la normalisation électrotechnique.

Les procédures utilisées pour élaborer le présent document et celles destinées à sa mise à jour sont décrites

dans les Directives ISO/IEC, Partie 1. Il convient, en particulier de prendre note des différents critères

d'approbation requis pour les différents types de documents ISO. Le présent document a été rédigé

conformément aux règles de rédaction données dans les Directives ISO/IEC, Partie 2

L'attention est attirée sur le fait que certains des éléments du présent document peuvent faire l'objet de

droits de propriété intellectuelle ou de droits analogues. L'ISO ne saurait être tenue pour responsable de ne

pas avoir identifié de tels droits de propriété et averti de leur existence. Les détails concernant les références

aux droits de propriété intellectuelle ou autres droits analogues identifiés lors de l'élaboration du document

sont indiqués dans l'Introduction et/ou dans la liste des déclarations de brevets reçues par l'ISO

Les éventuelles appellations commerciales utilisées dans le présent document sont données pour

information à l'intention des utilisateurs et ne constituent pas une approbation ou une recommandation.

Pour une explication de la nature volontaire des normes, la signification des termes et expressions

spécifiques de l'ISO liés à l'évaluation de la conformité, ou pour toute information au sujet de l'adhésion de

l'ISO aux principes de l'Organisation mondiale du commerce (OMC) concernant les obstacles techniques au

Le présent document a été élaboré par le Comité technique ISO/TC 46, Information et documentation, Sous-

Cette seconde édition annule et remplace la première édition (ISO 16175-1:2010, ISO 16175-2:2011 et

Une liste de toutes les parties de la série ISO 16175 se trouve sur le site web de l'ISO.

Tous les organismes ont au moins un système documentaire, et généralement plusieurs. Les systèmes

documentaires sont des systèmes d'information qui capturent et gèrent des documents d'activité et qui en

assurent l'accessibilité dans le temps. Les systèmes documentaires peuvent contenir des éléments

techniques, tels que des logiciels, et des éléments non techniques tels que des politiques, procédures et

agents. Les systèmes documentaires, au sens général du terme, incluent les politiques, processus, logiciels

et personnes qui utilisent et gèrent des documents d'activité . Les systèmes documentaires se déclinent en

diverses variantes : dans des systèmes papier, dans des logiciels spécialement conçus pour remplir la

fonctionnalité de gestion des documents d'activité, ou sous la forme de logiciels métier qui capturent et

gèrent des documents d'activité. Le présent document se concentre sur la gestion des documents d'activité

dans un environnement numérique, utilisant des logiciels, mais les principes et aspects généraux qui y sont

Les organismes décident du type de logiciel de gestion des documents d'activité qu'il convient d'utiliser pour

soutenir des processus métier particuliers, des unités opérationnelles données ou l'organisme dans son

ensemble, et évaluent les risques liés aux processus métier lorsqu'ils prennent ce type de décision Le

périmètre du logiciel de gestion des documents d'activité est affecté par le cadre social et réglementaire dans

lequel évolue l'organisme, par l'aptitude ou la maturité de l'organisme vis-à-vis des documents d'activité

reflétés dans ses politiques et dans la répartition des responsabilités, ainsi que par les technologies adaptées

Les organismes qui utilisent déjà des documents d'activité numériques pour mener et documenter leurs

activités, ou qui envisagent une dématérialisation de leurs documents d'activité, recherchent des solutions

aux problèmes associés à la gestion des documents d'activité numériques. Les décisions prises aujourd'hui

par les organismes concernant les fonctionnalités du logiciel, de même que l'organisation et la structure des

informations contenues dans le logiciel, auront un impact significatif sur la durabilité à long terme des

documents d'activité numériques. L'aptitude à conserver des documents d'activité numériques au-delà de

la durée de vie d'une instance unique d'un logiciel dépend étroitement de la conception, du choix et de la

configuration du logiciel, et il convient d'en tenir compte dans un contexte de gouvernance de l'information

La présente norme internationale n'établit aucune distinction entre les applications logicielles utilisées à

n'importe quelle fin en terme d’activité et celles qui sont spécifiquement destinées et conçues pour la gestion

de documents d'activité. Les premières englobent, par exemple, les systèmes et applications de gestion de

contenu d'entreprise qui, entre autres fonctionnalités, permettent la création de documents d'activité, tels

que les systèmes de gestion de contrats, les systèmes de gestion de dossiers ou les systèmes transactionnels.

Le terme « logiciel de gestion des documents d'activité » est donc ici employé afin de couvrir la totalité des

applications qui gèrent des documents d'activité dans le cadre de leur fonctionnement usuel. L'hypothèse

retenue est que toutes les applications métier généreront des données qui devront servir de preuve

d'activité opérationnelle à des fins de référence ultérieure et qui, entre autres, devront créer, stocker et gérer

des documents d'activité, soit à l'aide de leurs propres fonctionnalités internes, soit dans le cadre d'une

« Système documentaire » Système d'information qui capture et gère des documents d'activité et qui en

assure l'accessibilité dans le temps. NOTE Un système documentaire peut comporter des éléments

techniques tels que des logiciels, qui peuvent être conçus spécifiquement pour la gestion des documents

d'activité ou pour répondre à un autre objectif organisationnel, et d'éléments non techniques, notamment

une politique, des modes opératoires, des personnes et d'autres acteurs, ainsi que d'une répartition des

Les organismes déploient des applications logicielles pour automatiser leurs activités opérationnelles et

leurs transactions. Les informations numériques générées par une application peuvent servir de seule

preuve ou de seul enregistrement du processus ou de la transaction, même si l'application n'a pas été

spécifiquement conçue pour gérer des documents d'activité. Sans preuve de ces activités, les organismes

s'exposent à un risque et peuvent ne pas être en mesure de répondre aux attentes de la législation ou de la

communauté, ainsi qu'aux attentes en matière de responsabilité et d'activité commerciale. En raison de la

nature dynamique et manipulable des applications métier, il peut s'avérer difficile de capturer les

documents d'activité et de gérer en continu leur caractère fixe, authentique, fiable, exploitable et intègre.

Bon nombre d'applications métier génèrent et stockent des données qui peuvent faire l'objet de mises à jour

constantes (dynamiques), qui sont transformables (manipulables) et qui ne contiennent que des données à

jour (non redondantes). Bien qu'une entreprise puisse tout à fait légitimement exiger des données

dynamiques, manipulables et non redondantes, il est indispensable que ses documents d'activité, s'ils ont

vocation à servir de preuve irréfutable pour ses activités opérationnelles, soient fixes et inviolables.

Autrement dit, il est nécessaire que les systèmes et processus soient capables de garantir la fiabilité et

l'authenticité des documents d'activité afin de servir de preuve pour des activités opérationnelles passées.

Aux fins du présent document, les caractéristiques des documents d'activité (au sens défini dans

l'ISO 15489-1:2016, 5.2.2) peuvent s'appliquer à l'ensemble des données, documents ou informations, quels

qu'ils soient. Une approche de la gestion des documents d'activité permet de maintenir la traçabilité des

actions documentant l'activité aussi longtemps que cela est nécessaire pour étayer des assertions

d'authenticité, de fiabilité et d'intégrité. Cette approche peut être appliquée à des données, des documents,

La présente norme internationale fournit des lignes directrices pour la prise de décision concernant le

choix, la conception, la mise œuvre et la tenue à jour de logiciels de gestion des documents d'activité,

Le présent document s'applique à tout type de système documentaire soutenu par un logiciel, mais se

concentre plus spécifiquement sur les logiciels dédiés à la gestion des documents d'activité numériques.

La présente norme internationale fournit des recommandations à l'attention des professionnels des

documents d'activité chargés de concevoir, mettre en œuvre et tenir à jour des systèmes de gestion des

documents d'activité à l'aide de divers logiciels. Elle peut également apporter une aide aux professionnels

des technologies de l'information et aux éditeurs de logiciels cherchant à comprendre les exigences

Les documents suivants cités dans le texte constituent, pour tout ou partie de leur contenu, des exigences

du présent document. Pour les références non datées, la dernière édition du document de référence

ISO 15489-1, Information et documentation — Gestion des documents d'activité — Partie 1 : Concepts et

ISO 23081-2, Information et documentation — Gestion des métadonnées pour l'information et les

ISO 30300, Information et documentation — Systèmes de gestion des documents d'activité — Principes

Pour les besoins du présent document, les termes et définitions donnés dans l'ISO 30300 s'appliquent.

— que des contrôles des documents d'activité (en particulier ceux identifiés dans l'ISO 15489-1:2016,

— que les projets de mise en œuvre des exigences liées aux documents d'activité dans les logiciels ne

— que tous les nouveaux projets de mise en œuvre de logiciels imposent l'application des exigences

La conception, la mise en œuvre et la tenue à jour des logiciels de gestion des documents d'activité font

partie intégrante en continu de l'effort de gestion des documents d'activité au sein des organismes, afin

de refléter l'évolution constante des environnements technologiques, les nouveaux logiciels métier et les

Les exigences générales ici incluses sont conformes aux principes de gestion des documents d'activité

énoncés à l'Article 4 de l'ISO 15489-1:2016. La Partie 1 de la présente norme (ISO 16175-1:2018) fournit

des exigences fonctionnelles plus détaillées concernant les logiciels de création ou de gestion de

1. Il convient que le logiciel prenne en charge la gestion des documents d'activité numériques

Lors de l'automatisation d'un processus métier, il convient que le logiciel satisfasse aux exigences

2. Le logiciel de gestion des documents d'activité numériques doit maintenir des liens

SLOVENSKI STANDARD
oSIST ISO/DIS 16175-2:2019
01-november-2019
Informatika in dokumentacija - Procesi in funkcionalne zahteve za načrtovanje
programske opreme za upravljanje zapisov - 2. del: Navodilo za izbiro,
načrtovanje, uvedbo in vzdrževanje programske opreme za upravljanje zapisov

Information and documentation - Processes and functional requirements for software for

documents d'activité dans les environnements électroniques de bureau -- Partie 2:

Lignes directrices et exigences fonctionnelles pour les systèmes de management des

2003-01.Slovenski inštitut za standardizacijo. Razmnoževanje celote ali delov tega standarda ni dovoljeno.

Information et documentation — Principes et exigences fonctionnelles pour les documents d'activité dans

Partie 2: Lignes directrices et exigences fonctionnelles pour les systèmes de management des documents

All rights reserved. Unless otherwise specified, or required in the context of its implementation, no part of this publication may

be reproduced or utilized otherwise in any form or by any means, electronic or mechanical, including photocopying, or posting

on the internet or an intranet, without prior written permission. Permission can be requested from either ISO at the address

Foreword ........................................................................................................................................................................................................................................iv

Introduction ..................................................................................................................................................................................................................................v

1 1 .......................................................................................................................................................................................

Scope ................................................................................................................................................................................................................................. 1

1.1 Audience ....................................................................................................................................................................................................... 1

2 Normative references ...................................................................................................................................................................................... 1

3 Terms and definitions ..................................................................................................................................................................................... 1

4 High level requirements for software managing digital records ....................................................................... 1

4.1 Assumptions .............................................................................................................................................................................................. 1

4.2 General overview of requirements ........................................................................................................................................ 2

5 Assessing or ganizational readiness to implement records systems and scoping a project...3

5.1 General ........................................................................................................................................................................................................... 3

5.2 Organizational records maturity ............................................................................................................................................. 3

5.3 Records controls .................................................................................................................................................................................... 4

5.4 Technical environment..................................................................................................................................................................... 4

5.4.1 Paper environment ........................................................................................................................................................ 4

5.4.2 Hybrid environment ..................................................................................................................................................... 5

5.4.3 Digital environment ...................................................................................................................................................... 5

5.4.4 Cloud computing environment ............................................................................................................................ 6

5.4.5 Web-based collaborative software ................................................................................................................... 6

5.5 Project scoping and resources ................................................................................................................................................... 7

6 Determining a project methodology ................................................................................................................................................ 8

6.1 General ........................................................................................................................................................................................................... 8

6.2 Defining stakeholders ....................................................................................................................................................................... 9

7 Determining and managing functional requirements for software for managing records ....9

7.1 Developing functional requirements ................................................................................................................................... 9

7.2 Considerations for defining functional requirements ........................................................................................10

7.3 Managing functional requirements ....................................................................................................................................10

8 Determining configuration .....................................................................................................................................................................11

8.1 General ........................................................................................................................................................................................................11

8.2 Importance of documentation of configuration decisions .............................................................................11

8.3 Configuration decisions ................................................................................................................................................................11

8.3.1 Areas of configuration ..............................................................................................................................................12

9 Determining requirements to migrate and convert records ...............................................................................16

10 Communication, training and change management ....................................................................................................17

10.1 General ........................................................................................................................................................................................................17

10.2 Communications .................................................................................................................................................................................17

10.3 Training program requirements ...........................................................................................................................................17

10.4 Change management readiness .............................................................................................................................................18

10.5 E valuation and review ...................................................................................................................................................................19

11 Post implementation review, monitoring and assessment ...................................................................................19

11.1 General ........................................................................................................................................................................................................19

11.2 Conducting a post implementation review for records systems ..............................................................19

11.2.1 Review immediately after the implementation ..................................................................................20

11.2.2 Review after a period of operation ...............................................................................................................20

11.2.3 Action following reviews .......................................................................................................................................20

11.3 Monitoring ...............................................................................................................................................................................................21

11.4 Assessment ..............................................................................................................................................................................................22

Bibliography .............................................................................................................................................................................................................................23

ISO (the International Organization for Standardization) is a worldwide federation of national standards

bodies (ISO member bodies). The work of preparing International Standards is normally carried out

through ISO technical committees. Each member body interested in a subject for which a technical

committee has been established has the right to be represented on that committee. International

organizations, governmental and non-governmental, in liaison with ISO, also take part in the work.

ISO collaborates closely with the International Electrotechnical Commission (IEC) on all matters of

The procedures used to develop this document and those intended for its further maintenance are

described in the ISO/IEC Directives, Part 1. In particular the different approval criteria needed for the

different types of ISO documents should be noted. This document was drafted in accordance with the

editorial rules of the ISO/IEC Directives, Part 2 (see www .iso .org/directives).

Attention is drawn to the possibility that some of the elements of this document may be the subject of

patent rights. ISO shall not be held responsible for identifying any or all such patent rights. Details of

any patent rights identified during the development of the document will be in the Introduction and/or

Any trade name used in this document is information given for the convenience of users and does not

For an explanation on the voluntary nature of standards, the meaning of ISO specific terms and

expressions related to conformity assessment, as well as information about ISO's adherence to the

World Trade Organization (WTO) principles in the Technical Barriers to Trade (TBT) see the following

This document was prepared by Technical Committee ISO/TC 46, Documentation and Information,

This second edition cancels and replaces the first edition (ISO 16175-1:2010, ISO 16175-2:2011 and

All organizations will have at least one, and generally more than one, records system. Records systems

are information systems which capture, manage and provide access to records over time. Records

systems can consist of technical elements such as software, and non-technical elements such as policy,

procedures and agents. Records systems as a whole include the policy, processes, software and people

that use and manage records . Records systems exist in many variations: in paper systems, in software

specifically designed to meet functionality for managing records, or as business software which capture

and manage records. This document is focused on management of records in the digital environment,

using software, but the general principles and considerations apply whatever the environment.

Organizations make decisions on what type of software for managing records should support

particular business processes, business units or the organization as a whole and consider the risks

that are linked to business processes when making such decisions. The scope of software for managing

records will be affected by the social and regulatory framework within which an organization operates,

by the organizational readiness or maturity around records reflected in its policies and allocation of

responsibilities, and by the technologies that are appropriate for organizational use.

Organizations that already rely on digital records to conduct and document business, or that are

interested in eliminating paper records from their operations, are seeking solutions to the issues arising

from management of digital records. The decisions that organizations make today about the capability

of the software, and the organization and structure of information within the software will have a

significant impact on the long term sustainability of digital records. The capacity to sustain digital

records beyond the lifespan of a single instance of software is closely linked to the design, selection and

configuration of software, and should be considered carefully within an organization-wide information

This international standard makes no distinction between software applications that are used for

any business purpose and those applications specifically intended and designed to manage records.

Examples of the former include Enterprise Content Management Systems and applications which create

records as one part of their functionality such as Contracts Management Systems, Case Management

Systems or transactional systems. The term used throughout is therefore ‘software for managing

records’, which is intended to encapsulate the totality of applications that manage records as part of

their usual functioning. It is assumed that almost all business applications will generate data that will

need to serve as evidence of business activity for future reference and as such will, inter alia, need to

create, store and manage records, whether within their own functionality or in combination with other

Organizations deploy software applications to automate business activities and transactions. The

digital information generated by an application may serve as the only evidence or record of the process

or transaction, despite the application not being designed specifically for the purpose of managing

records. Without evidence of these activities, organizations are exposed to risk and may be unable to

meet legislative, accountability, business and community expectations. Because of the dynamic and

manipulable nature of business applications, the capture of records and the ongoing management of

their fixity, authenticity, reliability, usability and integrity can be challenging.

Many business applications generate and store data that may be subject to constant updating (dynamic),

able to be transformed (manipulable) and only contain current data (non-redundant). While business

requirements for dynamic, manipulable and non-redundant data may be entirely legitimate, if records

are to serve as reliable evidence of business activity they need to be fixed and inviolable. That is,

systems and processes need to be able to guarantee the reliability and authenticity of the records as

1) ‘Records system’ Information system which captures, manages and provides access to records over time. Note:

records system can consist of technical elements such as software, which may be designed specifically for managing

records or for some other business purpose, and non-technical elements including policy, procedures, people and

For the purposes of this document the characteristics of records (as defined in ISO 15489-1:2016, Clause

5.2.2) can be applied to any and all of data, documents or information. A records approach enables

the traceability of actions documenting business to be maintained for as long as needed to support

assertions of authenticity, reliability and integrity. This approach can be applied to data, documents,

This international standard provides guidelines for the decision making around selection, design,

implementation and maintenance of software for managing records, according to the principles

This document is applicable to any kind of records system supported by software but is particularly

This international standard provides guidance to records professionals charged with designing,

implementing and maintaining systems for managing records using a variety of software. It may

also provide assistance to information technology professionals and software vendors seeking to

The following documents are referred to in the text in such a way that some or all of their content

constitutes requirements of this document. For undated references, the latest edition of the referenced

ISO 15489-1, Information and documentation — Records management — Part 1: Concepts and principles

ISO 23081-2, Information and documentation — Managing metadata for records — Part 2: Conceptual and

ISO 30300, Information and documentation — Management systems for records — Fundamentals and

For the purposes of this document, the terms and definitions given in ISO 30300 apply.

— That records controls (particularly those identified ISO 15489-1:2016, clause 8) are already

— That projects to implement records requirements in software will be continuous; and

— That all new software implementation projects require implementation of defined records

Designing, implementing and maintaining software for managing records is an ongoing and continual

part of managing records within organizations, to reflect constantly changing technological

The high level requirements included here are consistent with the principles for managing records

outlined in ISO 15489-1:2016, Clause 4. Part 1 of this Standard (ISO 16175-1:2018) provides more

detailed functional requirements for software that creates or manages digital records.

1. Software should support the management of digital records as a core component of the

When automating a business process, records requirements should be met by software.

2. Software managing digital records shall maintain persistent links to the business context.

An understanding of the business context of records is required to enable accurate interpretation of

their content. Software should persistently link to the specific business context in which records are

3. Software managing digital records should be able to capture metadata, automatically

Software should be designed and implemented in a manner that allows maximum automatic assignment

of point of capture records metadata, enabling end-user overwrite capability prior to capture, where

needed. Records process metadata should be automatically generated and captured as the system is used.

Software that automates management of records should be designed in a way that makes such activity

largely ‘invisible’ to the end-users . Techniques for this may include automatic logging of events

occurring on records at all levels of aggregation and minimizing end-user requirements to interact with

5. Software should support interoperability over time and across platforms and domains.

Digital records often have operational or legal requirements for retention over periods of time that

may exceed the lifespan of the hardware or software that created it. Software should be able to present

records in a manner that maintains its metadata, useability and enables it to be converted to new

Records often need to last longer than the system in which they are initially created, captured and

managed. Records software should incorporate capabilities for bulk re-formatting as part of import

(ingest) or export capability or, at a minimum, via non-proprietary encoding of record metadata.

Software should not allow unauthorised access or modifications to any records or to records metadata.

Where authorised modifications are performed, they should be fully documented. Information which is

confidential or which contains personal information should be identified and mechanisms deployed to

8. Software should support the disposition of records in a managed, systematic and

Software needs to be able to dispose of records in a systematic and auditable way in line with business

9. Software should rely as much as possible on open, robust and technology neutral standards.

Many software products that create or manage records are developed using proprietary code.

Hardware or software dependencies can have adverse effects on access and preservation of records in

Organizations have distinct cultures which affect their approach to managing records. These cultures

are part of the organizational context. The factors that impact the information culture of an organization

— The societal and organizational requirements, including legislation, standards and related policy

The organizational culture affects decisions on selection and implementation of systems and software

for managing records. Where an organization has a defined information governance framework, the

system for managing records should be integrated with the information governance framework.

Where software for managing records supports processes shared by multiple organizations,

information culture factors should be considered for each organization. Selection and design of

software for managing records should be responsive to the needs of each organization. Responsibility

should be clearly assigned for managing cross-organizational systems and the rights in managing

Implementing software for managing records should be undertaken within an organisational

framework that defines the policies and responsibilities to be implemented, the records control tools

and the elements needed to scope the project. The following aspects should be considered during the

Assessing an organization’s maturity for managing records will assist in selecting a software approach

suited to the organization. Undertaking an assessment of organizational maturity will enable

benchmarking of progress over time, and assessment amongst similar organizations.

— Whether strategic responsibilities for managing records are included in the senior management

— Whether records and their management are considered explicit components of information

— Whether records functionality is included as a core component of the enterprise information

— The level at which responsibility is assigned to resource, enforce and monitor compliance with

— The availability of trained users to assist operational users in designing, implementing and

— The organizational culture and the extent of awareness of responsibilities for creating and managing

— What policies, standards and guidance outlining records responsibilities and obligations