GM1 IS.D.OR.245(c)&(d) Record-keeping

• ED Decision 2023/009/R found in: Information Security (2023/203 and 2022/1645) Part-IS (Jun 2024)

GM1 IS.D.OR.245(c)&(d) Record-keeping ED Decision 2023/009/R RECORDS ACCESSIBILITY THROUGHOUT THE RETENTION PERIOD It is recommended to follow best practices for data retention and, for data that may need to be restored, backup strategies, such as the use of automated backup tools, segregation or geographic separation of backup storage location(s), and to consider offline backups to prevent ransomware risks. These practices should be considered also when record-keeping is contracted to service providers with distributed resources. Special attention should be paid to significant hardware and software changes, ensuring that stored digital records remain accessible and readable. (e.g. file system, application file format, forward compatible database versions, etc.). Paper-based information needs to be archived in an adequate environment, in which records are protected against degradation factors (e.g. excessive heat, light or humidity). RECORDS DATA INTEGRITY AND PROTECTION FROM UNAUTHORISED ACCESS A commonly used method to achieve authenticity and integrity protection is the use of digital signatures at document level. Digital signatures can be added to the document’s file (e.g. PDF) to ensure that a record has not been modified by someone other than its author (integrity) and that the author is who is expected to be (authenticity). Moreover, to prevent unauthorised access, records can be protected for example by implementing a role-based access control (RBAC) approach, or certain records can be password protected  at the file level. Commercial applications feature built-in basic password protection functions for their file formats. Access protection can also be achieved by protecting the environment where the individual records are stored (e.g. access protection on databases, file shares, directories, etc.). ##### GM1 IS.D.OR.245(c)&(d) Record-keeping *ED Decision 2023/009/R* **RECORDS ACCESSIBILITY THROUGHOUT THE RETENTION PERIOD** It is recommended to follow best practices for data retention and, for data that may need to be restored, backup strategies, such as the use of automated backup tools, segregation or geographic separation of backup storage location(s), and to consider offline backups to prevent ransomware risks. These practices should be considered also when record-keeping is contracted to service providers with distributed resources. Special attention should be paid to significant hardware and software changes, ensuring that stored digital records remain accessible and readable. (e.g. file system, application file format, forward compatible database versions, etc.). Paper-based information needs to be archived in an adequate environment, in which records are protected against degradation factors (e.g. excessive heat, light or humidity). **RECORDS DATA INTEGRITY AND PROTECTION FROM UNAUTHORISED ACCESS** A commonly used method to achieve authenticity and integrity protection is the use of digital signatures at document level. Digital signatures can be added to the document’s file (e.g. PDF) to ensure that a record has not been modified by someone other than its author (integrity) and that the author is who is expected to be (authenticity). Moreover, to prevent unauthorised access, records can be protected for example by implementing a role-based access control (RBAC) approach, or certain records can be password protected at the file level. Commercial applications feature built-in basic password protection functions for their file formats. Access protection can also be achieved by protecting the environment where the individual records are stored (e.g. access protection on databases, file shares, directories, etc.).