Arkib Negara ELECTRONIC RECORDS MANAGEMENT and archive mgmt guideline_eng

e-SPARK
Why? It is impossible for the Arkib Negara Malaysia to gain access to and store all the
components of authentication schemes necessary to ensure their ongoing functionality. The
Archives will be unable to re-validate digital signatures attached to records because it will not
attempt to gain possession of the relevant public and private keys (or equivalent device).
Similarly, the Arkib Negara Malaysia will not have the ability to decrypt records. There are
many different means by which a record may have been encrypted and it would not be
possible to guarantee the ongoing functionality of each one – or even gain access to the
various schemes.
If a record is transferred to the Arkib Negara Malaysia, it is unlikely that there will be a
continuing business need for any attached digital signatures to remain functional.
However, a public office needs to make a risk management decision on whether it continues
to support the key management plan for records that have been transferred to the Arkib
Negara Malaysia. The agency may choose to capture appropriate recordkeeping metadata
as sufficient proof that the digital signature was valid at the time of the transaction. On the
other hand, the risk management process could require the agency to maintain the key
management plan to provide access to the public key for the purpose of re-validation.
Unencrypted or decrypted records should be transferred together with the contextual
information (e.g. encryption details such as the name of the CA or RA provider, the
reference number of the digital certificate that contained the public key, and the date and
time of the transaction).
Meeting the recordkeeping recommendations contained within these guidelines will ensure
the accessibility, readability, integrity and completeness of electronic records created during
online security processes, and ensure that records transferred as national archives will be
well controlled and accompanied by appropriate metadata.
Records transferred to the custody of the Arkib Negara Malaysia will be stored in conditions
that ensure their security and long-term preservation and accessibility.
Implementation Checklist
The intention of this checklist is to serve as a tool that public offices can use when planning
to use authentication and encryption technologies.
Initial considerations
Has your public office established the level of online security needed?
Have online security processes been included in your public office’s recordkeeping,
security and information management framework?
Copyright Arkib Negara Malaysia Page 63 of 86