ISO 16363:2012

Overview

ISO 16363:2012 - "Space data and information transfer systems - Audit and certification of trustworthy digital repositories" - defines a recommended practice for assessing the trustworthiness of digital repositories. Adopted from CCSDS 652.0-M-1, it provides a structured set of audit criteria that applies to the entire range of digital repositories and can be used as a basis for formal repository certification. The standard builds on the OAIS Reference Model and earlier community work (for example TRAC by RLG/NARA) to create objective evidence-based assessment criteria.

Key topics

ISO 16363 organizes audit criteria across organizational, technical and procedural domains. Major topics include:

• Organizational infrastructure
  • Governance and organizational viability
  • Staffing, roles and responsibilities
  • Preservation policy framework and procedural accountability
  • Financial sustainability, contracts and liabilities
• Digital object management
  • Ingest and acquisition practices
  • Creation and maintenance of preservation packages (AIP)
  • Preservation planning and AIP preservation actions
  • Information management and access management
• Infrastructure and security
  • Technical infrastructure risk management
  • Security risk management and Annex A security considerations
• Audit evidence and conformance
  • Use of documented evidence and mapping to relevant standards, best practices and controls

These sections give auditors and repository stewards measurable areas to evaluate, from policy and funding through to technical risk controls and access management.

Applications

ISO 16363 is practical for:

• Repository managers and archivists seeking to design, improve or demonstrate trustworthy digital preservation practices.
• Auditors and certification bodies using ISO 16363 as a formal basis for third‑party audits and certifications.
• Funding bodies or stakeholders evaluating organizational viability and sustainability of digital archives.
• IT and security teams implementing infrastructure and risk controls required for long‑term preservation.

Typical uses include formal certification preparation, gap analysis during repository design or redesign, vendor procurement criteria, and ongoing compliance or risk monitoring.

Related standards

• ISO 14721:2003 (OAIS) - conceptual reference model for archival systems (explicitly referenced by ISO 16363).
• CCSDS 652.0-M-1 - original Recommended Practice adopted by ISO 16363.
• Other CCSDS/ISO documents referenced for interoperability and security guidance.

ISO 16363 is a core standard for organizations committed to long‑term digital preservation and to demonstrating trustworthiness through transparent, evidence‑based audits. Keywords: ISO 16363, trustworthy digital repositories, audit and certification, digital preservation, OAIS, repository audit.