Arkib Negara ELECTRONIC RECORDS MANAGEMENT and archive mgmt guideline_eng

e-SPARK
5.2.4 Key management
As a general rule, keys and other material required to decrypt data should be accessible for
the life of that data.
Where encryption is only used for confidentiality during transmission, there should be no
need for a key management plan. Continued access to the encryption keys is unnecessary if
the sending agency retains a record of the unencrypted transaction and the receiving agency
retains the decrypted record of the transaction. However, both agencies should ensure that
the records are captured with recordkeeping metadata relating to the encryption process.
If an agency decides to retain records in their encrypted form, then an ongoing key
management plan is essential for enabling future access.
The records created or received using online security processes such as PKI, should be
disposed of according to the business activity to which they pertain, It is important to note
that unauthorized alteration of a record as evidenced by an unverifiable digital signature, or
inability to decrypt an encrypted record, may constitute de facto destruction of a record.
5.2.5 Recordkeeping, security and information management framework
Authentication and encryption issues need to be addressed early and considered as part of
an agency’s overall recordkeeping, security and information management framework.
Developing such a framework involves:
• Developing a policy and strategy for information management.
• Assessing and implementing recordkeeping and information systems to maintain
required records.
• Identifying recordkeeping requirements.
• Assigning responsibilities.
5.2.6 Policy and strategy
To ensure the success of an online security program, especially when it involves the use of
digital signatures and encryption, a strategy and companion policy for information resource
management (including recordkeeping) should be developed.
Preferably, the strategy should be developed as part of the online security program, and be
in place before implementation of the program occurs. Recordkeeping related to online
security technology should be part of an agency’s overall information management or
recordkeeping policies.
Copyright Arkib Negara Malaysia Page 59 of 86