Trustworthy digital repository certification

Today I proposed that my institution complete a trustworthy digital repository certification self-
assessment.  I wasn't aiming high, not the ISO 16363 one, but rather the entry level CoreTrustSeal (CTS).  Our repository service hasn't been evaluated since it was launched in 2007, and as the landscape has changed immensely since then, I thought it was high time that we had a good solid look at our system and see how it stacks up when evaluated against international standards.

So I approached my boss and asked when the next Library Management meeting was. Our Library is incredibly hierarchical in it's staffing, so mere peeps like me are not welcome at the Library Management meetings, and as we have no Library Manager, the three Team Leaders (of which my boss is one) are essentially running the Library.  But more on that in the future.

So, finding out that the final Library Management meeting for the year was scheduled for this week, I informed my boss that I would be giving her a paper on repository certification for her to table at the meeting.  The gist of it is that this is what it is, this is why we should do it, and this is what we expect.

I'm expecting much resistance, especially from one of the other Team Leaders who likes to think she knows everything but doesn't, and from my Director who doesn't seem to value the repository as part of the research infrastructure. 



So here is my proposal (slightly edited for public consumption)....

Trustworthy Digital Repository Certification Proposal

Background

Repositories, whether they be institutional, data, disciplinary or archival, are becoming an increasingly critical part of an organisations research infrastructure not only as a place to store material and make them accessible and discoverable, but as a secure location that is committed to the preservation and long-term custodianship of scholarly activity. This involves having a technology solution backed by institutional policies that will ensure the longevity and continuity of service.

One increasingly popular method for organisations to demonstrate their commitment to this is through repository certification which aims to evaluate the sustainability and 'trustworthiness' of a repository service. The concept of trust underpins the relationship between repositories and their users. Depositors trust that the repository will accept responsibility for and safeguard their digital objects, and users trust that the objects they access are accurate and true to their original form. This is a key difference between repositories and other types of information systems - the need to permanently store and ensure ongoing access, authenticity and integrity to digital objects.

The development of the OAIS model (Open Archival Information System) provides an independent consensus of the requirements of an archive or repository for providing long term preservation and access to digital information. Created in 2002 and approved as an ISO standard in 2003, the OAIS model defines six functional entities of a trustworthy system: ingest, archival storage, data management, administration, preservation planning and access. The rise of the OAIS model accompanied a demand for assurance that repositories claiming to use OAIS actually adhere to those standards; that is, a demand for trustworthiness. 

From: https://www.dpconline.org/docs/technology-watch-reports/1359-dpctw14-02/file

 

This has led to several international assessment methodologies for trustworthiness of a repository, all of which assess to varying degrees three primary areas: organisational infrastructure, digital object management and technical infrastructure.

The three most well-known certifications are:

• Trusted Repositories Audit and Certification (TRAC)
• based on OAIS and ISO 16363 Audit and Certification of Trusted Digital Repositories
• over 100 metrics evaluated
• evidence-based audit framework
• full external auditing process

• nestorSeal
• based on 34 criteria
• written by German NESTOR-group
• based on the DIN Standards Committee in Germany, DIN 31644 Information and documentation - Criteria for trustworthy digital archives
• self-assessment and evidence
• review of assessment by two reviewers appointed by NESTOR

• CoreTrustSeal (CTS)
• launched in 2017 and is a combination of two precursor trust seals - ICSU World Data System (WDS) and Data Seal of Approval (DSA)
• based on 16 criteria
• self-assessment with peer review
• three-year certification period

From: https://services.phaidra.univie.ac.at/api/object/o:584413/diss/Content/get

The CTS is the entry-level certification for trustworthiness of repositories. Currently in Australia there are four organisations that have obtained the CTS (or its precursor, WDS or DSA).

• Space Weather (Sydney) - WDS Certified Repository
• Australian Antarctic Data Centre (Hobart) - CTS Certified Repository
• Australian Data Archive (Canberra) - CTS Certified Repository
• CSIRO Data Access Portal (Canberra) - CTS Certified Repository

There are several other institutions that have gone through the certification self-assessment in order to identify gaps in their organisational environment, including Deakin University (who underwent the full TRAC certification). 

From Our Perspective
We have two repositories - the Research Collections (currently the Research Bank) and the Research Archives. However, our repositories are not just a place to store digital objects. They are a combination of both software and services that are provided to support digital objects and related archival and scholarly communication material

Our organisation has not undergone an evaluation of its repositories since the launch of the Research Bank in 2007, so the degree of ‘trustworthiness’ (how well it meets the criteria) is unknown. Currently both the collections and the archives are on two different software platforms, with different objectives and missions. Although there is an ongoing commitment in providing access to these digital objects, this is not documented well in policy or guidelines. At present it is expected that our repositories would fail many of the trustworthiness criteria.

Note: ExLibris have made a commitment to ensure that Alma-D meets the criteria for the CTS in 2019. It is anticipated that VITAL (Innovative) would fail the technical components of CTS assessment. 

My Project Proposal
Out of the three certification methodologies, it is recommended that the Library complete the self-assessment of the CTS. This will benefit us as it will provide an opportunity to examine our research infrastructure (technical and organisational) as well as our data structure against an internationally recognised set of criteria. This will help to determine the Library (and the repositories) strengths and weaknesses. Although we will be unable to achieve CTS certification alongside ExLibris in 2019 it is nevertheless an opportunity for the Library to begin to look at the gaps in our commitment, so we can better advocate for change. It is hoped that in the future we will be able to obtain the CTS certification for both the research collections and the archival collections. This will provide a solid foundation to apply for higher-level certifications in the future.

The main objectives of this project proposal would be:

• Assess our infrastructure against the CTS framework for the research collections and archival collections.
• Identify the function and mission for the research collections and archival collections.
• Identify areas where the organisational policy and workflows do not meet the criteria.
• Identify areas where the technical infrastructure does not meet the criteria.
• Develop a plan of areas that need improvement in order to gain the CTS in 2020 or 2021.

It is anticipated that this project would take 6 months to complete and would not require any additional resourcing. Expected end date would be December 2019 with the outcome being a clearer understanding of the Library’s strengths and weaknesses in terms of our repository landscape. Findings and recommendations would then provide the foundation on which future policies and workflows could be built.

Appendix

CoreTrustSeal Critiera

(listed in the project proposal, but linked here)