Skip to content
System management
ASD ISMISM-1510

ASD ISM 1510 Develop and maintain a digital preservation policy

What it says

A digital preservation policy is developed, implemented and maintained.

Quoted as published. Everything else on this page is written by Control Stack.

What it means

In plain English

Organisations must create and keep up-to-date a policy for preserving digital information.

This control is about having a plan for making sure important digital information stays accessible and safe over time. Without a plan, you risk losing valuable data to technology changes, degradation, or mistakes, which can hurt your business operations and reputation.

Why it matters

Without a digital preservation policy, information can be lost or become unreadable as formats and platforms age, disrupting operations and retention obligations.

How to implement

  1. Business owners should work with their IT team to outline all the types of digital data their organisation creates and holds.

    This can be done by listing files, documents, and records, and by having a meeting to discuss how each is used and its importance.

  2. The IT team should draft a digital preservation policy that covers how to keep, store, and protect digital information.

    This can be done by using online templates or guidelines from sources like the ACSC (Australian Cyber Security Centre) and adapting them to fit the specific needs of the organisation.

  3. Managers should ensure all employees are trained on the new digital preservation policy.

    This involves holding a workshop or briefing session where the policy is explained, allowing staff to ask questions, and providing written copies or summaries.

  4. The IT team should set up a schedule to review and update the digital preservation policy regularly.

    This could mean setting a date every six months to check the policy against new technology changes or new security threats, making adjustments as needed.

  5. System owners should get feedback from employees who interact with digital data regularly to improve the preservation practices.

    They can do this by conducting surveys or feedback sessions to understand practical challenges and opportunities for policy improvement.

Keep it running

Maintain and review the digital preservation policy to cover formats, metadata, migration steps and storage media refresh so records remain accessible and secure.

Evidence and audit

  1. Check 1 of 5What an auditor asks for

    Ask for

    The current digital preservation policy document: Request a copy and note the date it was last updated.

    Look at

    Sections that mention specific storage methods and data types covered.

    Good evidence

    Will include details on data types, storage strategies, and a recent review date.

  2. Check 2 of 5What an auditor asks for

    Ask for

    Meeting records or notes from policy development discussions: Request evidence of staff and stakeholder involvement in creating the policy.

    Look at

    Meeting notes or email threads that show who contributed to the policy's content.

    Good evidence

    Contains dated records with participant names and key discussion points.

  3. Check 3 of 5What an auditor asks for

    Ask for

    Staff training records related to digital preservation: Request documentation that details who attended the training and what content was covered.

    Look at

    Sign-in sheets, emails confirming attendance, or training presentation slides.

    Good evidence

    Has a list of trained employees and their roles, with evidence of training materials used.

  4. Check 4 of 5What an auditor asks for

    Ask for

    The schedule outlining regular reviews of the digital preservation policy: Request documentation or reminders sent to staff about upcoming reviews.

    Look at

    A regular review process and adjustments made based on feedback or changes in technology.

    Good evidence

    Includes a clear, documented schedule with past review dates and planned future ones.

  5. Check 5 of 5What an auditor asks for

    Ask for

    To see results of feedback activities from employees about the preservation practices: Request results or summaries of surveys or discussions held with staff.

    Look at

    Evidence of consideration of the feedback in policy updates.

    Good evidence

    Includes feedback reports, potential policy adjustments, and response plans to address concerns raised.

Mappings

Closest match in ISO/IEC 27001: A.5.1, Policies for information security, which this control partially meets.

ISO 27001

ISO/IEC 27001: 1 mapping

  • A.5.1Policies for information securityPartially meets

Mappings show how controls relate across frameworks. They do not imply full equivalence or certification.