S 3.35 Basic user training on how to use the archive system

Initiation responsibility: Head of IT

Implementation responsibility: Head of IT, Archive Administrator

Archiving is a task involving particular responsibility and imposes high requirements on operation. The designated employees must be made aware and prepared specifically regarding this responsibility. For this, the users must be trained accordingly.

Such training should address the following topics, amongst other things:

• Procedure for converting analogue data:
  
  The proper procedures for collecting the documents, converting the documents to an electronic form, as well as electronically archiving the documents must be explained and trained using practical examples.
• Basic legal conditions of archiving:
  
  Legal requirements apply to archiving (see S 2.245 Determination of the legal influencing factors for electronic archiving). The users must be made aware of these requirements and the consequences of them not being observed.
• Protection of the confidentiality and integrity of the documents:
  
  The proper procedures for handling confidential documents and for protecting and checking the integrity of archived documents must be demonstrated. Possible consequences of incorrect operation must be pointed out.
• Particularities when using WORM media:
  
  The particularities for storing to write-once media must be pointed out in particular, i.e. it must be taken into account that data once stored cannot be deleted any more (a new version could be re-archived, if necessary). Along with capacity bottlenecks, this may also lead to data protection or confidentiality issues, since data is only identified as "to be deleted", but is not actually deleted.
• Organisation-specific security policies and their application during electronic archiving:
  
  Commonly, when designing the archive system, diverse security safeguards were planned that must be implemented by the individual users of the archive system. For example, these may refer to the labelling of the archiving media or to the way information classified as confidential or otherwise must be handled. All users must be made aware of these organisation-specific security policies.

The user training must be documented.

Review questions:

• Are the users of the archive system trained regarding the use of the system?
• Is the user training documented?