ISO IEC 27050-4-2021.docx

INTERNATIONA1.STANDARDISO/IEC27050-4editionFirSt202104Informationtechno1.ogyE1.ectronicdiscovery-qhicareadinessTechno1.ogiesdeinformationDecouvertee1.ectronique一Par1.ie4:PreparationtechniqueReferencenumberIS(VIEC2705042021(E)COPYRIGHTPROTECTEDDOCUMENT©IS0/1EC2021M11c<hefivdi1.itedotherwise*ri快ChBxXniEX1.msitRiDhmw;Itmiihr<1.ij1.trfvx>CoPwnR.pnttjuiionpostingontheinternetoranInunnu1.withoutpriorwrittenpermission.PermissioncanberequestedfromeitherISOatt1.½addressbe1.oworISO*smemberhodyinthecountryofth<?rrcucstcr.三cB1.andonnct8r,GenevaPhone:t41227490111辆jtc:用洲部砾o.orgPub1.ishedinSwitzer1.andContentsForewordvitroductionSconeI1Vi1Z3Normativereferences1ATermsanddefinitinns14_S,mbkandabbreviatedterms25J6E1.ectronicdiscoverybackground27Technica1.readiness4Readinessfore1.ectronicdiscovery47.1ES1.idenUfiCatiOn47.1.1Genera1.47.1.3BStJiarPiSCaPe57.1.5ProactiveES1.identification67.27.2.2Assessingpreservationneeds*7.2.3PreSerVatiOnob1.igations6羽什照阳陋附a1.ionpr屈朋社Jn67.3pz>1.*<r.Mco1.1.ection7,7Methodsof7.3.2ProactiveES)ES1.co1.1.ection77.4ES1.ProCeSSng.一*-7.4.1Genera1.8汹4&触由6野IProCeSSing87.4.4ProactiveES1.processing87.5ESIreviewj1997.y?Genera1.Technotogj,-ass1.stedreview7.5.3ProactiveES1.review97.6ESIana1.ysis997.6.2Too1.sandtasksforESIana1.ysis7.6.3ProactiveESIana1.ysis107.7ESIproduction10774OfWfieInRparties107.7.3Receiringparties117.7.4ProactiveES1.Droduction11Additiona1.considerations118.1Genera1.一.118.2PriVaCyanddatsprotection118.38-Jfe-termRetttoniboruofIES1.preservation128.3.2Genera1.dataretention128.3.3Archive13E1.ectronicdiscoverycross-cuttingaspects169.1 Genera!169.2 P1.anning169.2.1 Hi0i刖JFP8ixdn11tp<EPQtation169.2.3 Monitoringandreassessment179.2.4 Endofprojectconsiderations179.3 BWttft8tation.一179.4.1 Supportandmaintenance179.4.2 Assemb1.ingtheteam179.4.3 sB画脚掘W一一.一.一._._._.199.5UseOftechno1.ogy199.5.1 P1.atformse1.ecdon/systemarchitecture1995.2Retira1.OrIHigrationofSySte1.nS19AnnexA(informative)ES!storagequestionnaire.21Bib1.iography29ForewordISO(theInternationa1.OrganizationforStandardization)andIEC(theInternationa1.E1.ectrotechnica1.tnmmiS0h0fifiqiiB<1.旬ratemtfteMmd1.bpidentStartiintdiZariQmaINSmitteesestab1.ishedbytherespectiveorganizationtodea1.withparticu1.arfie1.dsoftechnica1.activity.ISOandIECmitteesco1.1.aborateinfie1.dsofmutua1.interest.Otheriatpari°na1.cvons,Sovernmenta*dn<non-governmenta1.,in1.iaisonwithISOandIEC,a1.soTheproceduresusedtodeve1.opthisdocumentandthoseintendedforitsfurthermaintenanceare窗nf8妙CS1.g月M能也称理性幅1.o3.琲她3÷H4HeA三ri*tf<iM峥砧崛&or(KA崛Cdedtheeditoria1.ru1.esofthe1SOIECDirectives,Part2(seewww.iso.org/direc1.ives).皿加8h"g%卜wn%小品小8(?蛔UiH®MaM用枇之ft5J½WWbkeStf1.ya1.1.11Rf3?Subjectrights.Detai1.sofanypatentrightsidentifiedduringthedeve1.opmentof"h4,瓜施UwMhintheIntroductionand/orontheISO1.istofpr】UMMdednrionsreceived(seewww.iso.org/patents)ortheIEC1.istofpatentdec1.arationsreceived(seepatents.iecch).Anytradenameusedinthisdocumentisinformationgivenfortheconvenienceofusersanddoesnotconstituteanendorsement.E卯统SiOnSeX岬IftibQ岫EabwMt喇】entofa州曲dards,thfoewngMtouiISSpadtoif1.iimA1.wrWa1.dTndO呻Nzaiion(WTO)princip1.esintheTechnica1.BarrierstoTrade(TBT).seewww.iso.org/iso/foreword.htm1.3翻碎曜Mc海砂R三枷也UW/8痛就CMWC8MMMSOIEd眄Ma.。mMbrmaamtechno1.ogy,A1.istofa1.1.partsintheISO/IEC27050seriescanbefoundontheISOwebsite.A摘M2f1.SK做的6hsMR1.iesthiscaP8(feU佩HIShQuwWWF谿memberUnationa1.standardsbody.AIntroductionE1.ectronicdiscoverycanexposeorganizationsandtheirstakeho1.derswithinandoutsidethoseorganizationstoco1.1.ectiveandindividua1.risks,inc1.uding1.ega1.,financia1.andethica1.Thisdocumentistobereadinre1.ationtoISO/IEC27050-1,ISO/IEC27050-2,andISO/IEC270S0-3.艮曜网UQ联花UNAieS。喝林屋用告帮。户匕壁演砒及q就融期由胸弱球ift叼QVidenCeaitica1.的榴UiSitione1.ectronica1.1.ystoredinformation(ESI)sometimenecessitateprotections1.ikestoragesecuritytoguardagainstdatabreaches(coveredinISO/IEC27040).vi©ISO/IEC2021-A1.1.rightsreservedInformationtechno1.ogyE1.ectronicdiscovery一Technica1.readiness1 Scopee1.ectronicdiscoverymeasuresperspectivehe1.pbothtechno1.ogyandandappropriatee1.ectronicdiscoverye1.ectronicdiscoveryactivities.bothnontechnica1.andtechnica1.personne1.invo1.vedinsomeora1.1.ofthe2 Normativereferencesconstitutesrequirements1.atesteditiondocument.referencedrefrences,(inc1.udingarnendments)app1.ics.app1.ies.ISO/IECOverview1.nfbnnationvocabu1.ary-Securitytechniques-Informationsecuritymanagement3 TermsanddefinitionsandISO/IEC221231andthefo1.1.owingapp1.y.ISOOn1.inebrowsingp1.atform:avai1.ab1.eah枝PHWWWT66g=abp3.1comp1.ianceob1.igations1.ega1.requirementsandotherrequirementsrcgu1.ations,cntry:Comp1.iancccommitmentszsuchorganizationa1.mandator)rrequirements,Suchcontractua1.re1.ationships.renumbered.14001:2015,3.2.9,modifiedNote1toentryhasbeenremovedandNote2toentry1©ISO/IEC2021-A1.1.rightsreservedPart4:Thisdocumentprovidesguidanceonthewaysanorganizationcanp1.anandpreparefor,andimp1.ement,guidanceonproactivefromthethatcanofenab1.eeffectiveprocesses.Thisdocumentprovidesandprocesses.Thisdocumentre1.evanttoThefo1.1.owingdocumentsarereferredtointhetextinsuchawaythatsomeora1.1.oftheircontentundatedreferences,theofthisoftheFordateddocumenton1.ytheanyeditioncitedForISO/IEC221231.jnformationtechno1.ogyC1.oudcomputingVocabu1.arysystems27000,andtechno1.ogyISO/IEC270504:2019,Informationtechno1.ogyE1.ectronicdiscoveryPart1:OverviewandconceptsForthepurposesofthisdocument,thetermsanddefinitionsgiveninISO/IEC27000,ISO/IEC27050-1,ISOandIECmaintaintermino1.ogica1.databasesforuseinstandardizationatthefo1.1.owingaddresses:-IECE1.ectropedia:avai1.ab1.eathttp:/www.e1.cc1.ropedia.org/1.ega1.requirementsthatanorganizationhastocomp1.ywithandotherrequirementsthatanorganizationhastoorchoosestocomp1.ywithNote1orVO1.Untaryob1.igationscanarisefromindustr>rstandards,asapp1.icab1.e1.awsandcodesOfpracticeandagreementswithcommunitygroupsornon-governmenta1.organizations.SOURCE:ISO3.2technica1.readinessstateofhavingtheknow1.edge,ski1.1.s,processesandtechno1.ogiesneededtoaddressaparticu1.arissueorcha1.1.enge4 Symbo1.sandabbreviatedtermsBCMbusinesscontinuitymanagementCCTVc1.osed-circuitte1.evisionESIe1.ectronica1.1.ystoredinformationICTinormationandcommunicationtechno1.ogyPBXprivatebranchexchangeP1.1.persona1.1.yidentifiab1.einformationRIMrecordsandinformationmanagementSaaSsoftwareasaserviceTARtechno1.ogy-assistedreviewVPNvirtua1.privatenetworkWORMwriteoncereadmany5 E1.ectronicdiscoverybackgroundE1.ectronicdiscoveryisane1.ementoftraditiona1.discoveryordisc1.osureanditisaprocessthatW快a>im"y1.ytorWtMf加WftXionpi佳6FVingJhmoI1.m。那9o1.SFhgJBttevysrticteHUriEhfducingrequirementsandrecommendationsprovidedinthisdocumentareinaccordancewiththee1.ectronicdiscoveryconceptsdescribedin:1SOIEC27050-1:2019,C1.ause3:keye1.ectronicdiscoverytermino1.ogy；1SOIEC27050-1:2019,6.2:e1.ectronicdiscoveryissuesandprimarycostdrivers；1SOIEC27050-1:2019.6.3:genera1.e1.ectronicdiscoveryobjectives;ISO/IEC27050-1:2019,C1.ause7:commonESItypes,commonsources,andrepresentations;ISO/IECe1.ements.27050-1:2019,C1.ause8:descriptionofthee1.ectronicdiscoveryprocessandtheProCeSSISO/IEC27050-1differentiatesbetweengenericactionssuchas"identifying“fromthespecifice1.ectronicd1.三路邳三9hise1.邹删曲，城压8昵帼曲嬲阍和蛤泥叫刷0-1:201砂8髓祜曲SWpwise流岳OniCdiscoveryprocesse1.ementsandtheinterre1.ationshipsbetweenthem(seeISO/IEC27050-1:2019,8.1,forafu1.1.description).Figure1E1.ectronicdiscoveryprocesse1.ementswithcausesandconformancerequirementstocnab!cwhercpossib1.e,appropriateC1.ectronicconip1.yingISO1ECadditiona1.proactivemeasurescoveraddressaFangee1.ectroniccha1.1.enges.organizationcan promotingcommonunderstandingofvariousconceptsandtermino1.ogyfore1.ectronicdiscovery;encouragingpractica1.andcost-effectivediscoverybythosetaskedwithmanagingES!throughtheProjectsengaged1.ega1.practitioners,servicesproviders,independentexperts,courts,andanyotherthroughoutthediscoveryprocess;techno1.ogytoreducecostsandrisks,whi1.eincreasingefficienciessensitiveESI.coversencounteredinWrittcnmajoritye1.ectronicnecessari1.ythecasemind,andthereforeISO/IEC27050-2providesguidancefordecisionmakersandthoseho1.dingresponsib1.ero1.estoensurethatpo1.icyoffai1.ureproper1.ymanagedand.effectiveandminimizedwhi1.esti1.1.discoveryandprocesses.ISO/IEC27050-3providesrequirementsandguidanceassociatedwiththee1.ectronicdiscoveryprocesse1.ementsshowninFigure1.Whi1.etheguidanceandrequirementsprovidedinbenefitfrom27050-2ISO/IEC27050-3thatkeyaspectsofofIe1.ateddiscovery.TheISO/IEC27050seriesaddressesthesecha1.1.engesby: articu1.atingobjectivesandrisksinherentinthestepsinthee1.ectronicdiscoveryprocess;process; providingguidanceandbestpracticesforthoseresponsib1.eforde1.iveringe1.ectronicdiscoveryparties(e.g.intheprocess); identifyingcompetencyareasforthoseinvo1.vedine1.ectronicdiscovery;promotingproactiveuseof suggestingwaystoavoidinadvertentdisc1.osuresofpotentia1.1.yprivi1.eged,confidentia1.,orTheoverridingobjectiveistohe1.porganizationsmeettheire1.ectronicdiscoverygoa1.s(e.g.1.ega1.ob1.igations,businessobjectives,regu1.atoryrequirements).Whi1.ethisaspectsdocumenthasbeenthewithOf1.argermatters.Itisnotdiscoveryprojectsinthata1.1.stepsarepequ<r1.(1.rijQnagesn)0Ui1.jtophCeioCVCr51H)HKten1.TUUMpia啊Uubuiida11ttcr隹Iteattea'possUiMh*a!)tasing1.eofseparateindividua1.soreventeamsforeache1.ementofthee1.ectronicdiscoveryproject6Technica1.readinessTechnica1.readinessmeanshavingtheknow1.edge,ski1.1.s,processesandtechno1.ogiesneededtoaddressd伊a而EhmgjSmHMiiHeiII*fitEorf(rarpwrtzhtiort>irfdydoesttbehcatitiwtnHsinthidingIMgnoMtfkntingencythatcanoccur.t叫的M用端fextta能蝴醮dd岫品於啷腑briatereadines嘶酬部曲CoVe碘盟罪IMeIeme帙曲readinessisa1.sodependentonthetypeoforganization(e.g.1.ega1.versusrecordsmanagement)aswe1.1.asthero1.etheorganizationp1.aysinthee1.ectronicdiscoveryprocess(e.g.producingpartyversusreceivingparty).Thee1.ectronicdiscoveryreadinessobjectivescaninc1.udethefo1.1.owing：-tr三Mv碘SedConhM部麻那d的邮阚部s,oFH窣andres曲蚓。叫&岫,use,hand1.ingor identifypotentia1.1.yre1.evantsourcesofESI; proper1.ypreserveandretainpotentia1.1.yre1.evantESI; produceresponsiveESIinaformthatisuseab1.ebytherequestingparty; conductthee1.ectronicdiscoveryprocesswithinthetimeconstraints.Technica1.readinessinthecontextofe1.ectronicdiscoveryshou1.dbebasedontheinformationarchitecture,businessprocesses,anddatac1.assificationandretentionpo1.iciesoftheorganization.EbnfoM1.itZ*n。期4hpideru曲WVwTOM¾MIeet即IWSPr1.触斜灿Paft>¾z;PrOdIIA川Zatib1.1.a1.SoimportanttheESIisprotected(forexamp1.e,backup,businesscontinuitymanagement,orsecurity)andorganizedsothatthismateria1.canbeusedeffective1.y.deve1.opedanddataretentionanddisposa1.practicestobeforma1.ized.7hisftWSSfKdi融ronicdiscoveryp1.an(seeISO/IEC27050-2:2018,6.5).7.1 ESIidentification7.1.1 Genera1.ISO/IEC27050-3:2020,6.2,providesbothrequirementsandguidanceforESIidentification.Oftheserthefo1.1.owingcanbenefitfromreadinessorproactiveactivities： basicp1.anningassociatedwithdeterminingwhoexecutesES!identificationandhowitisexpectedtobeperformed; understandingtheorganization'sESI1.andscape,inc1.udingoperationa1.aspectsthatcou1.dimpactpreservation; deve1.opmentofstandardtemp1.atesforinterviewquestionsandsurveyforms;4 CreateofESItheorganizationsystems,possib1.yS1.oredjmaptoprovideacentra1.ized1.istingOfWhat7.1.2 ESI1.andscapeinformation,whenrepresentationsmatternon-ESIasrequirementsre1.ectronicdiscoveryprocess,pointIdentificationpreservationbeanddisc1.osureandcomprehensivethepossib1.e.phasesOfscopematter.Thepotentia1.1.yk1.erni11catio11requiresdi1.igentinvestigationandana1.ytica1.thinking.theorganizationcrcatcISO/IEC27050-3:2020,6.2.5).ccntra1.izcd1.istinginc1.udedetai1.sOfofspecific1.ocationsidentifya1.1.re1.evantPo1.iciesdesignedretentionmanagedpreservationassistanceBCMapp1.icab1.eshou1.dre1.evanttriggeringstored(ESIe1.ectronicdiscoveryteamcanusethedatamaptoidentifywherethesystemse1.ectionprocess.themcanbeproducedtohe1.pinformdecisionsaroundthee1.ectronicdiscoveryOrganizationa1.scanningprojcc1.requirements.shou1.dinc1.udecodingspecificationsthatcanbespecifictothebusinessSecurityconip1.ianceOb1.igationsa1.1.associatedmetadatapurposesworkProducte1.ectronicdependenton7.1.4 Datac1.assificationSenSitiVity,purposesgovernance,requiringdiscovery.dataunderdataprotectionorprivacy1.egis1.ation.becreatedviathearchitectureandsystemdesign.©ISO/IEC2021-A1.1.rightsreservedtypesa1.istorinventoryofhasandorvhereitadataunderstandtheimp1.icationsassociatedwithissuing1.ega1.ho1.dsorpreservationorders.ISO/IEC27050-1:2019,C1.ause7,providesusefu1.informationonthecommontypesofESmonsourcesESI.ESIcombinedwiththeandspecificpartofthecanserveasausefu1.startingThisinidentifyingpotentia1.sourcesofre1.evantESI.Thesesourcescaninc1.udebusinessunits,peop1.e,ICTsystemsandhardcopy.subjectshou1.dasthoroughcanbeuncertainasear1.yTheaofES1.natureofthematteritse1.fandtheindividua1.sinvo1.vedcanchangeasthematterprogresses.Theidentificationteamshou1.danticipatechangeandhaveaprocedureinp1.aceforcapturinganynew1.yidentiedESI.Adatamapisacomprehensiveanddefensib1.einventoryofanorganizationICTsystemsthatstoreESI.Itisimportant(seeadatamaptoprovideaThisshou1.da1.soOfwhichtypesESIexistvrithinofdatasetsandcaninc1.udetheroutedatatakeswhenintransita1.ongside,forexamp1.e,whohascontro1.overamai1.boxandwheretheserverssitinc1.udinganyhardcopymateria1.requirements.Thisdatamapshou1.dbe(e.g.andpo1.icy,withthepo1.icy,ofICTpo1.icy)personne1.andtoeachitemofESI.Idea1.1.y,thedatamapcana1.soinc1.udethe1.ocationsOfhardcopymateria1.Resourceshou1.dheassignedtothetaskandon-goingresponsibi1.ityofcreatingandmanagingthedatamap.Afterthemateria1.isevent,themap).TheESImapcanprovidesufficientdetai1.aroundwhatdatarepositoriesarepotentia1.1.ydiscoverab1.eandhowthedatawithinWherehardcopymateria1.formsareidentified,thereshou1.dbeadecisionandprocessinp1.acetomanagetheandandcoding.ThisSeeAnnexAforassistancewithcreationofthedatamap.The1.eve1.ofneedsandnecessaryfortheESI,asapp1.icab1.etotheandoftheisdiscoveryprocess.TheSec