Why a standard for electronic archiving?
Launched at the initiative of market stakeholders, a voluntary standard is a reference framework that provides guidelines and technical or quality requirements for products, services, or practices, in the public interest. It is the result of a consensus-based collaborative effort between professionals and users who have participated in its development. Any organization may choose to use it or not; this is why the standard is called voluntary.
The NF Z42-013 was developed to enable private and public organizations to refer to proven and validated principles and procedures when designing or operating information systems for the capture, archiving, and retrieval of their digital documents. The standard serves as a basis for certification, which guarantees users that digital documents are captured, archived, retrieved, and communicated in a manner that ensures the archived document retains the same value as the original document throughout its retention period.
What is archival retention for evidentiary purposes? How does this standard allow me to access it?
Only a judge can determine the legal admissibility of a document. Case law shows that the use of voluntary standards NF Z42-013 or the NF 461 certification provides strong support for establishing the admissibility of the document as evidence in the event of a dispute or legal proceeding. This evidentiary value is assessed by the judge based on the document’s integrity, reliability, and traceability.
Why was the standard revised? Was this driven by new regulations—such as eIDAS, GDPR, or others?
All standards are reviewed regularly, approximately every five years, to reflect changes in the markets for which they provide a framework. In this case, the standard NF Z42-013 The 2009 version did not take into account certain current issues and best practices (electronically signed documents, GDPR, encryption, third-party identity providers), and the regulatory landscape has evolved over the past ten years. The new version of the standard is designed to be open-ended, thereby providing greater flexibility in the choices made.
Who is the NF Z42-013 standard on electronic archiving intended for?
The standard NF Z42-013 is intended for:
Public or private organizations that need to preserve their digital assets for organizational, regulatory, heritage, or legal protection purposes.
Providers of electronic archiving services or solutions (third-party archiving providers, infrastructure, software, consulting, etc.)
Who can use the NF Z42-013 standard, and how?
The standard NF Z42-01 Standard 3 applies to both organizations that operate an electronic archiving system for their own use and third-party archiving service providers acting on behalf of their clients. Adherence to the standard is voluntary, but users who comply with it have every reason to demonstrate their strict adherence through certification.
What does the new NF Z42-013 standard bring?
For electronic archiving, the scope of the standard NF Z42-013 has not changed since the 2009 version, but the requirements and recommendations have been explicitly organized into three categories—functional, organizational, and infrastructure—for greater clarity. The core principles remain valid, while being updated. The standard also allows for greater flexibility in the implementation and use of recent technologies; the ability to rely on third-party components and to integrate information systems (IS).
The digitization of paper-based business documents is no longer covered by the standard on electronic archiving, which is now addressed in a specific standard issued in May 2017 ( NF Z42-026 ) that are recommended for this subject. For documents in other formats, the archive owner is advised to follow best practices. The appendix on formats has been removed as it is becoming increasingly obsolete.
Is the 2009 version of the standard still valid?
The 2020 version of the standard NF Z42-013 replaces the 2009 version. Regulatory texts that reference the 2009 version of the standard—such as the December 4, 2009, decree specifying standards for archiving and outsourced management services—must be updated to reflect the requirements of the new version. Similarly, an update to the NF 461 certification standard is currently underway.
Does the ISO 14641 standard follow the same developments as the French standard Z42-013?
The title of the international voluntary standard ISO 14641 is: “Electronic Archiving — Design and Operation of an Information System for the Integrity Preservation of Electronic Records — Specifications.” The current version dates from June 2018. This is an international standard that is independent of NF Z42-013 and follows its own standardization process. No revision of this document is currently planned.
Does the update to the standard affect the archiving process?
The technical archiving process as described in the 2009 version of the standard NF Z42-013 is compatible with the 2020 version, which introduces additional technical capabilities. There is no impact on the existing archive collection. However, the new edition requires special attention in terms of organizational and documentation processes. Archives preserved according to the process defined in the 2009 version of the standard technically meet the requirements of the 2020 version. However, with the aim of harmonizing processes, a review could be conducted.
What is the difference between archiving, storage, and electronic backup?
To ensure long-term preservation in an electronic archiving system (EAS), it is necessary to implement an archiving solution that is integrated with a storage solution, which in turn is supplemented by a backup solution.
- The purpose of archiving is to ensure the availability, integrity, confidentiality, and traceability of the records.
- Storage is one of the components of archiving, enabling organizations to address the issue of availability through information media whose characteristics are tailored to the objectives of archiving.
- Backup, commonly referred to as a backup copy NF Z42-013 , is a process that allows data to be recovered in the event of a problem with the primary storage medium.
What is the difference between an electronic records management system (ERMS) and a digital vault?
The digital safe component of the standard NF Z42-020 ensures the integrity and traceability of the digital objects deposited there. It offers specific capabilities in terms of confidentiality, including encryption of the data and documents stored there. The SAE, on the other hand, offers specific archival features: format preservation, document classification, lifecycle management, archiving profiles, etc. These are features not found in an electronic vault component or a digital vault service. The choice of tool will therefore depend on the intended purpose of the preservation. For example, regarding electronic pay stubs, an employer may use an SAE to archive all of its employees’ pay stubs, while the employee will access their electronic pay stubs via a digital vault service.
What certifications are available for electronic archiving?
NF 461 certification certifies a specific electronic archiving system (EAS) operated by a specific organization. Thus, an organization may submit multiple EASs for NF 461 certification. It guarantees the quality and security of the electronic archiving system’s design in accordance with the production chain standardization requirements defined in the standard NF Z42-013 and the additional technical requirements described in the NF 461 certification standard. This does not preclude compliance with the requirements pertaining to services associated with the SAE’s functionalities.
When is NF 461 certification useful?
The NF 461 certification will be of interest to any organization wishing to:
- ensure the reliable operation of an electronic records management system using a set of best practices;
- define the expertise and resources necessary to deliver high-quality services;
- describe the technical and contractual specifics tailored to each archive owner;
- provide assurances regarding the quality of the solution and the expected performance of its features;
- have access to an evaluation framework and a recognized, impartial, and reliable certification system;
- engage management and employees in a unifying and dynamic project.
When is NF461 certification required?
NF 461 certification is now required:
- for use in a contractual context where ownership of the trademark is required;
- to obtain approval for the preservation of current and intermediate public records in digital format.
How can you tell if a company’s electronic archiving system is NF 461 certified?
You can view the dedicated page on the marque-nf.com website at any time to access the directory of NF 461-certified electronic archiving systems (EAS) and their electronic certificates.
Does the revision of the standard result in changes to the certification’s validity period and the frequency of compliance audits?
No, the revision of the standard does not result in any changes: NF 461 certificates are valid for three years, with annual audits.
If I am already NF 461 certified, do I need to go through the certification process again?
Holders of an NF 461 certificate must comply with the new requirements of the standard and the certification guidelines for certified electronic archiving systems. They will have one year to achieve compliance, starting from the certificate’s expiration date, during which time the next audit will incorporate the new requirements.
What should I do if a change affects my certified electronic records management system?
In the event of a significant change (such as a change in hosting provider or software), a “change notification” must be submitted to AFNOR Certification in accordance with the NF 461 certification standard.
When will the new version of the NF 461 standard be published?
The new version of the NF 461 certification standard was published on February 5, 2021.
Until when can I submit my SAE for NF 461:2009 certification?
You may apply for NF 461:2009 certification until the date of publication of the new certification standard. If the certification contract was signed prior to that date, only the initial audit may still be conducted based on the 2009 version.
What is the difference between certification and accreditation?
- Certification is a process by which a third party provides written assurance that a product, organization, process, service, or competency complies with the requirements specified in a reference document. Issued by AFNOR Certification, the NF 461 is the only certification that guarantees an electronic records management system complies with all the requirements of the standard NF Z42-013 .
- Accreditation is an authorization granted by an authority to designate a company to carry out an activity that requires prior authorization. Effective January 1, 2021, the accreditation required for the preservation and management of current and intermediate public records will be issued by the prefect of the applicant’s location, provided that the applicant holds a valid NF 461 certificate.
What are the requirements for certifying an electronic records management system?
NF 461 certification is based on the following audit procedures:
- a tour of all the sites associated with the SAE,
- interviews with the staff involved,
- hands-on demonstrations,
- a literature review.
When should the NF Z42-013 standard on electronic archiving and the NF Z42-026 standard on faithful digitization be used?
The standard NF Z42-026 was drafted in response to the growing trend toward the digitization of document management processes within businesses, local governments, and public agencies, as well as changes in legislation. The digitization of paper documents improves access to their content and, through the use of compliant systems, enhances the security of information preservation (integrity, confidentiality, availability, and durability). Consequently, the question arises as to whether it is appropriate to eliminate the requirement for dual retention (original document and faithful digital copy). The NF Z42-026 standard (with its NF 544 certification ) supplements the standard NF Z42-013 . It outlines the responsibilities of the various stakeholders involved in digitization and sets forth the measures needed to ensure accurate digitization and establish digitization processes. Holders of a NF 461 certification Companies that incorporate digitization solutions may find it beneficial to pursue NF 544 certification to highlight the quality of their digitization services and their compliance with the standard.
What is the relationship between this standard and the NF Z42-020 standard regarding digital safe components?
It is necessary to distinguish the digital safe component described in the standard NF Z42-020 and the digital safe service. The NF Z42-020 standard provides a framework for the digital safe component (software), which is designed to provide integrity, traceability, and evidentiary value to the information systems (IS) or applications into which it is integrated. This July 2012 standard describes functional and administrative requirements. It forms the basis of the NF 203 certification standard (Digital Safe Component Software) from AFNOR Certification. Since 2016, with the Law on the Digital Republic, and even more so since 2018, the digital safe service has been governed by a regulatory framework established by Decrees 2018-418 and 2018-853.
Is ISO 27001 certification also required?
The ISO 27001 certification on information system security management is not a prerequisite for compliance with the NF Z42-013 standard. The NF Z42-013 incorporates several principles found in the ISO 27001 standard. Consequently, certification based on ISO 27001 within the scope of electronic records management facilitates compliance with NF Z42-013.
