Legal admissibility concerns whether or not a piece of evidence would be accepted by a court of law. To ensure the admissibility, information needs to be managed by a secure system throughout its lifetime (which can be for many years). Where doubt can be placed on the information, the evidential weight may well be reduced, potentially harming the legal case.
BS 10008 ensures that any electronic information required as evidence of a business transaction is afforded the maximum evidential weight. The process is based on the specification of requirements for planning, implementing, operating, monitoring and improving the organization’s information management systems.
What is BS 10008?
BS 10008 is the British Standard that specifies the requirements for the implementation and operation of electronic information management systems, and to the electronic transfer of information from one computer system to another, addressing issues relating to the authenticity and integrity of the electronic information. These issues are important where the electronic information could be used as evidence.
BS 10008 also specifies the requirements for the management of the availability of the electronic information over time.
BS 10008 addresses issues related to electronic identity verification, including the use of electronic signatures and electronic copyright systems, as well as the linking of electronic identity to particular electronic documents.
The requirements specified in BS 10008 are generic and apply to any corporate body, large or small, whatever the nature of its business. The extent of application of these requirements depends on the corporate body’s operating environment and complexity.
It applies to electronic information in any form.
Alan Shipman, Chairman of the BSI committee responsible for the development of BS 10008, said: “The new standard is an important step in ensuring the admissibility of evidence in the UK. It has been developed by a wide range of experts in the field of document management as a specification of good practice”.
What does the standard include?
- The management of electronic information over long periods, including through technology changes, where information integrity is vital
- How to manage the various risks associated with electronic information
- How to demonstrate the authenticity of electronic information
- The management of quality issues related to document scanning processes
- The provision of a full life history of an electronic object throughout its life
- Electronic transfer of information from one computer system to another
- Covers policies, security issues, procedures, technology requirements and auditability of electronic document management systems (EDMS).
Frequently Asked Questions on BS 10008
Who should use BS 10008?
BS 10008 is applicable to any corporate body, large or small, whatever the nature of its business, and especially topical for business managers, records managers, compliance officers and legal advisors in financial institutions, insurance companies and local government departments.
How will BS 10008 benefit my business?
BS 10008 can benefit your business by:
- Maximising the benefits of electronic document storage systems
- Protecting your customers from the perceived legal risks of electronic document storage
- Minimizing the risks involved with the long-term storage of information in an electronic form.
- Addressing the issues related to electronic identity verification, including the use of electronic signatures and electronic copyright systems, as well as the linking of electronic identity to particular electronic documents.
What type of information does the standard cover?
The form of the information may be ‘page based’ (such as word processing documents and scanned or other images), may be ‘dynamic’ (such as documents with integrated formulae and databases), may be 3-dimensional and/or may contain voice / video recordings.
What does the standard exclude?
BS 10008 does not apply to processes used to evaluate the authenticity of information prior to its being imported into the system.
How is BS 10008 different to the Code of Practice?
The publication of BS 10008 reflects the demands of the adopters of the Code of Practice (CoP) for a more formal compliance standard.
BS 10008 covers the scope of the all three parts of the Code of Practice (BIP 0008-1, BIP 0008-2, BIP 0008-3).
By complying with BS 10008, it is anticipated that the evidential weight of electronic information transferred to and/or managed by a corporate body will be maximised, by ensuring its trustworthiness and reliability.
Compliance with BS 10008 will assist in minimizing the risks involved with the long-term storage of information in an electronic form.
BS 10008 has been structured along the lines of the Plan-Do-Check-Act model (PDCA) used in the majority of Management Systems standards, as a business model for continuous improvement.
Will the Code of Practice (BIP 0008) no longer be available?
The Code will be updated in accordance with BS 10008. Implementation of the recommendations given in the latest edition of the CoP will assist with compliance of BS 10008.
Will the standard be called up in legislation?
Both BS 10008 and the CoP are referenced in the Section 46 of the Freedom of Information Act 2000: Code of Practice on Records Management
For more information about freedom of information (FOI) and data protection, visit the Information Commissioner’s Office website:
http://www.ico.gov.uk/
BS 10008 is available in two formats, as a hard copy printed version or electronically, as a PDF for download.
Also of interest
Four books support the standard and offer guidance: