ISO 15489

ISO 15489
Title	ISO 15489
Status	Published
Year	2001
Organization	International Organization for Standardization
Subject	Records management

ISO 15489

Overview

ISO 15489 is an international standard on records management that provides principles and requirements for creating, capturing, and managing records in organizations. It is intended to inform practices used by bodies such as the United Nations, European Commission, World Health Organization, International Monetary Fund, and World Bank, and to intersect with frameworks like ITIL, COBIT, NIST Cybersecurity Framework, Basel Committee on Banking Supervision, and OECD guidance. The standard relates to archival practice found in institutions such as the National Archives and Records Administration, The British Library, and Bibliothèque nationale de France while aligning with legal regimes exemplified by the Freedom of Information Act 2000, General Data Protection Regulation, Sarbanes–Oxley Act, and Public Records Act 1958.

Scope and Objectives

The scope addresses the lifecycle of records used by corporations, non-profits, and public authorities including those comparable to Google, Microsoft, Amazon (company), Facebook, and Apple Inc. in managing electronic records, as well as in healthcare settings like Mayo Clinic and Johns Hopkins Hospital. Objectives include ensuring authenticity, reliability, integrity, and usability of records in contexts such as International Criminal Court, European Court of Human Rights, World Trade Organization, and International Labour Organization dispute resolution, and supporting compliance obligations arising from instruments like the UN Convention on the Rights of the Child and WTO Agreements.

Structure and Parts

The standard is presented in distinct sections that mirror document organization used by bodies such as ISO/IEC JTC 1, British Standards Institution, and Standards Australia. Its modular layout echoes approaches adopted by publications like the ISO 9001 quality management standard, ISO 27001 information security standard, and sectoral standards such as ISO 14001. The parts delineate requirements, implementation guidance, and conformance criteria similar to how IEEE and IETF produce specifications for technical ecosystems like TCP/IP and POSIX.

Key Principles and Requirements

Core principles emphasize record creation, metadata, classification, retention, disposition, and preservation which are concepts also central to practices at the National Archives (United Kingdom), Library of Congress, and Australian National Archives. Requirements invoke governance arrangements comparable to corporate governance structures overseen by entities like the Financial Conduct Authority, U.S. Securities and Exchange Commission, and International Organization of Securities Commissions. The standard recommends roles and responsibilities akin to those of a Chief Information Officer, Chief Data Officer, and records managers within organizations such as Goldman Sachs, Deutsche Bank, and HSBC. It prescribes controls that map to digital preservation initiatives exemplified by the LOCKSS program, Preservation Metadata: Implementation Strategies (PREMIS), and repositories like arXiv and PubMed Central.

Implementation and Compliance

Implementation typically requires aligning business processes, IT systems, and legal teams from institutions like Accenture, Deloitte, KPMG, and PricewaterhouseCoopers to achieve compliance with auditors such as Ernst & Young and Grant Thornton. Compliance activities intersect with records retention schedules used in jurisdictions governed by laws like the Freedom of Information Act 1966 (UK), Privacy Act 1974 (US), and regulatory regimes administered by agencies like the European Data Protection Board and Federal Trade Commission. Tools and platforms provided by vendors comparable to OpenText, Box, Inc., Microsoft SharePoint, and IBM are often configured to meet the standard’s controls and metadata schemes similar to Dublin Core.

Impact and Adoption

Adoption has influenced public administrations such as Her Majesty's Revenue and Customs, Department for Work and Pensions, United States Department of Defense, and European Central Bank, as well as private-sector firms in finance, healthcare, and technology. It has shaped curricula in academic institutions like University of Oxford, Harvard University, University of Melbourne, and University College London and professional certification programs offered by associations such as the Association of Records Managers and Administrators and International Council on Archives. International development programs run by UNICEF and World Bank Group have referenced the standard in capacity-building projects.

Criticisms and Limitations

Critics note that the standard can be abstract and resource-intensive for small organizations like startups and small charities, drawing comparisons with compliance burdens observed under Basel III and GDPR implementation. Observers have also argued that it may not fully address rapid technological change seen with blockchain deployments, cloud computing providers such as Amazon Web Services, Google Cloud Platform, and Microsoft Azure, or the scale of data in platforms like Twitter and YouTube. Legal scholars citing courts such as the European Court of Human Rights and Supreme Court of the United States have highlighted tensions between long-term preservation requirements and legal discovery processes under rules such as the Federal Rules of Civil Procedure.

Category:Information standards