ISO/TR 22428-1:2020

TECHNICAL ISO/TR
REPORT 22428-1
First edition
2020-09
Managing records in cloud computing
environments —
Part 1:
Issues and concerns
Gestion des documents d'activité dans les environnements
d'informatique en nuage —
Partie 1: Enjeux et préoccupations
Reference number
©
ISO 2020
© ISO 2020
All rights reserved. Unless otherwise specified, or required in the context of its implementation, no part of this publication may
be reproduced or utilized otherwise in any form or by any means, electronic or mechanical, including photocopying, or posting
on the internet or an intranet, without prior written permission. Permission can be requested from either ISO at the address
below or ISO’s member body in the country of the requester.
ISO copyright office
CP 401 • Ch. de Blandonnet 8
CH-1214 Vernier, Geneva
Phone: +41 22 749 01 11
Email: copyright@iso.org
Website: www.iso.org
Published in Switzerland
ii © ISO 2020 – All rights reserved

Contents Page
Foreword .v
Introduction .vi
1 Scope . 1
2 Normative references . 1
3 Terms and definitions . 1
4 Stakeholder model . 4
4.1 General . 4
4.2 Cloud records management service customer . 5
4.2.1 General. 5
4.2.2 Cloud records producer . 5
4.2.3 Cloud records manager . 6
4.2.4 Cloud records user . 6
4.3 Cloud records management service provider . 6
4.3.1 General. 6
4.3.2 Records management SaaS provider . 6
4.3.3 PaaS provider . 7
4.3.4 IaaS provider . 7
4.4 Cloud records management service partner . 7
4.4.1 Cloud records management agent . 7
4.4.2 Cloud records management auditor . 7
5 Cloud records management environments . 8
5.1 General . 8
5.2 Records management processes in the cloud environment . 8
5.3 Metadata in cloud records management services . 9
5.4 Cloud reference architecture for managing authoritative records .10
6 Use cases in cloud records management .11
6.1 General .11
6.2 SaaS shared by customers .12
6.3 SaaS developed by customers .13
6.4 Records management based on IaaS .13
6.5 Multiple IaaS used by customers .14
6.6 Records management agent .15
7 Risks in cloud records system .16
7.1 General .16
7.2 Cloud service risks .16
7.3 Cloud system risks .18
7.4 Cloud stakeholder risks .19
8 Social and legal issues of cloud services .19
8.1 General .19
8.2 Legal issues .20
8.2.1 General.20
8.2.2 Cross-border data jurisdictional issues .20
8.2.3 Inability to enforce contractual terms .20
8.2.4 Non-negotiable licensing terms .21
8.2.5 Data ownership issues .21
8.2.6 Conflict between the terms and conditions .21
8.3 Social issues .21
8.3.1 General.21
8.3.2 Limitations of technical security .22
8.3.3 Social impact of personal information leakage accidents .22
8.3.4 Unavailability of personal records.23
8.3.5 Risk of long-term preservation of records in the cloud service .23
Bibliography .24
iv © ISO 2020 – All rights reserved

Foreword
ISO (the International Organization for Standardization) is a worldwide federation of national standards
bodies (ISO member bodies). The work of preparing International Standards is normally carried out by
ISO technical committees. Each member body interested in a subject has the right to be represented on
the relevant technical committee if such committee has been established. International organizations,
governmental and non-governmental, in liaison with ISO, also take part in the work. ISO collaborates
closely with the International Electro-technical Commission (IEC) on all matters related to electro-
technical standardization.
The procedures used to develop the present document and those intended for its further maintenance
are described in the ISO/IEC Directives, Part 1. In particular, the various approval criteria needed for
different types of ISO documents should be noted. This document was drafted in accordance with the
editorial rules of the ISO/IEC Directives, Part 2 (see www .iso .org/ directives).
Attention is drawn to the possibility that some of the elements of this document may be the subject of
patent rights. ISO shall not be held responsible for identifying any or all such patent rights. Details of
any patent rights identified during the development of the document will be listed in the Introduction
and/or on the ISO list of patent declarations received (see www .iso .org/ patents).
Any trade name used in this document is given for the purpose of information for users’ convenience
and does not constitute an endorsement.
For an explanation of the voluntary nature of standards, the meaning of ISO-specific terms and
expressions related to conformity assessment, as well as information on ISO's adherence to the World
Trade Organization (WTO) principles in the Technical Barriers to Trade (TBT), see www .iso .org/ iso/
foreword .html.
This document was prepared by Technical Committee ISO/TC 46, Information and documentation,
Subcommittee SC 11, Archives/records management.
A list of all parts in the ISO 22428 series can be found on the ISO website.
Any feedback or questions on this document should be directed to the user’s national standards body. A
complete listing of these bodies can be found at www .iso .org/ members .html.
Introduction
A cloud service refers to capabilities offered via cloud computing where users can borrow, to use
flexibly, physical or virtual resources which include software and platform, as well as computing
infrastructure, such as data storage and computing servers. The cloud service offers benefits, such as
dynamic scalability, enhanced organizational agility, resilience and cost reduction, enabling improved
organizational competitiveness and efficiency. Cloud services are emerging as an essential aspect of
information technology due to location-independent resource sharing, availability via the Internet and
mobile devices, and the ability to deliver on-demand services and lower costs.
Currently, the explosive growth of digital content through mobile platforms and the Internet of things
is driving organizations to move their computing systems and information assets to the cloud. As a
result, a number of companies and government organizations have shifted their business systems to
cloud services, and many other organizations are planning to adopt cloud services. In the near future, it
is expected that most data will be processed and stored in cloud services.
Cloud services might prove to be an alternative for organizations that are reluctant to invest in
establishing their own computer systems for digital records management. Cloud services can provide
the software, hardware, and platform needed to implement a system for records at an affordable price.
It is often n
...