In its review of the October 2023 ransomware attack, the British Library included a detail that deserves more attention from digital preservation practitioners than it has received. The Library’s digital and digitized collections, along with the metadata describing them, survived in a system the attackers did not reach. Recovery was nonetheless hampered by the lack of viable infrastructure to restore that content.
Having the copy was necessary. It was not sufficient.
That gap, between holding a preservation copy and being able to put it back to work, sits precisely where digital preservation and information security meet. Neither discipline closes it alone. The Library published that review as a deliberate contribution to the sector, and the digital preservation community owes it a considerable debt. This post, and a second to follow, takes up the invitation.
The argument is straightforward. Digital preservation programs are already performing information security work. They tend to describe it in language that makes it invisible to the people who hold the security budget and the security mandate. That invisibility costs both sides.
Text description of the CIA and CHARM comparison
A two-column table compares the information security CIA triad with the CHARM digital preservation target values. Rows align related concepts, and empty cells show where a model has no counterpart.
Confidentiality appears in the CIA triad with no stated counterpart in CHARM.
Integrity appears in both. In CHARM it guards against entropy as well as adversaries.
Availability in the CIA triad corresponds to Accessibility and Retrievability in CHARM, which additionally require that content remain findable, renderable, and understandable.
Authenticity appears only in CHARM: the object is what it claims to be. The CIA triad has no counterpart.
Longevity appears only in CHARM, making the time horizon a stated target value. The CIA triad has no counterpart.
CHARM target values are from Pennock, M. (2024), Disentangling Digital Preservation Risk, University of Dundee. The alignment is illustrative.
The shared vocabulary
Information security has organized itself for decades around three properties, usually called the CIA triad: Confidentiality, Integrity, and Availability. Confidentiality means only authorized parties can access the data. Integrity means the data has not been improperly altered. Availability means authorized users can reach it when they need it. The model has been criticized within its own field as too coarse for modern practice (Samonas and Coss, 2014), and it has been extended, most notably by Donn Parker, whose hexad added authenticity, possession or control, and utility (Parker, 1998). It nonetheless remains the organizing frame for security reviews, vendor questionnaires, and risk registers.
Read against that frame, much routine preservation practice is security practice.
Fixity checking is an integrity control. Checksums generated at deposit and verified on a schedule are continuous monitoring by another name, and they produce exactly the kind of evidence a security team recognizes: a detective control with a documented cadence and an alerting path.
Geographically and organizationally distributed copies are an availability control and, increasingly, a recovery control. Distribution ensures that the failure of any one location, provider, or administrative domain does not take the content with it.
Identity and access management on restricted collections is a confidentiality control. The principle at work, least privilege, was formalized in computer science by Saltzer and Schroeder in 1975, though libraries and archives had been practicing its physical equivalent in closed stacks for considerably longer. Only those with a valid purpose get access, and only to what that purpose requires.
None of this is new work for preservation programs. What is often missing is the translation.
Where the models diverge
Saying that preservation does security work is only half the picture. The more interesting question is what each field names that the other does not, and the clearest way to see it is to set the triad beside a preservation risk model of comparable maturity.
CHARM, developed by Maureen Pennock as a practice-based PhD at the University of Dundee and introduced to the community at iPRES 2024, is the most recent and most comprehensively scoped of these. CHARM was completed in October 2023, before the attack on the British Library, where Pennock is Head of Digital Collection Management. It is a reference model for the whole digital preservation risk domain, built on risk science, compatible with ISO 31000, and accompanied by a risk identification framework and a risk assessment spreadsheet that produce scored, characterized risk statements. It belongs to a lineage of preservation risk and threat frameworks running through DRAMBORA (Digital Curation Centre, 2009) and the SPOT model (Vermaaten, Lavoie, and Caplan, 2012), and it is the first to map the domain at this scale.
CHARM defines digital preservation risk against five target values: retrievability, authenticity, integrity, accessibility, and longevity. Placed next to the triad, the overlaps and the gaps both become visible.
Integrity appears in both, though under different threat assumptions. Security frames integrity against an adversary who alters data. Preservation frames it additionally against entropy: bit rot, media degradation, silent corruption in transit, storage that fails quietly. This is a difference of threat model rather than of concern, and it is worth saying clearly that adversarial thinking is not new to preservation. Rosenthal and colleagues built an explicitly adversarial threat model into LOCKSS two decades ago (Rosenthal et al., 2005). It is unevenly distributed across the field, not absent.
Accessibility and retrievability together cover the ground the triad calls availability, but they extend it. In a security context, availability is largely about uptime and reachability. Retrievability and accessibility over decades also require that the object can still be found, rendered, and understood.
Authenticity has no counterpart in the triad, which is why Parker’s hexad added it. Integrity tells you the bits have not changed. It does not tell you the object is what it claims to be, who deposited it, or when. That requires provenance and chain of custody, which OAIS (ISO 14721) and TDR (ISO 16363) largely exist to formalize.
Longevity has no counterpart either, and it may be the single most useful word in the comparison. It makes the time horizon an explicit target value rather than a background assumption. A control that satisfies confidentiality, integrity, and availability today, and cannot be shown to satisfy them in twenty years, has not satisfied longevity at all.
And confidentiality has no counterpart in CHARM. Neither did the SPOT model. CHARM captures related concerns in its Legal and Policy risk source classes, so this is a gap in the stated target values, not a total absence. The reasons are principled and come up in the second part of this post, and they align with what practitioners will recognize: confidentiality is the leg of the triad the preservation field discusses least, and it deserves more attention than it gets. That is the subject of the second part of this post.
What security frameworks do not reach
Text description of the CHARM risk source coverage chart
Thirteen risk source classes are grouped under three risk originating entities and shaded as typically covered, partially covered, or rarely covered by an institutional information security program.
Digital Content: Content Files, partially covered. Metadata, rarely covered. Storage Media, partially covered.
Organisational Infrastructure: Strategy, rarely covered. Legal, partially covered. Policy, partially covered. People, typically covered. Budget, rarely covered. Processes and Workflows, partially covered.
Technological Infrastructure: Rendering Software, rarely covered. System Software, typically covered. Physical Hardware, typically covered. Network, typically covered. Processes and Workflows, partially covered.
The classes are from Pennock, M. (2024). Processes and Workflows is shared across two entities. The coverage shading is illustrative and will vary by institution.
The target values are only the top layer of CHARM. Beneath them sits a risk source model that locates risk in three originating entities: Digital Content, Organizational Infrastructure, and Technological Infrastructure. Across those three, CHARM identifies thirteen classes of risk source.
Cybersecurity is inside this model rather than beside it. It appears as a factor in the Network class, through the configuration of system software utility programs, and as malware in content files. Preservation risk modeling already absorbs information security as one risk source among many, which is a useful corrective to any framing of these fields as rivals.
What stands out is the Organizational Infrastructure entity, which carries six of the thirteen classes: Strategy, Legal, Policy, People, Budget, and Processes and Workflows. Budget is a named class of preservation risk source in a peer-reviewed reference model.
No information security framework answers for a budget line being cut. No technical control addresses a grant not being renewed, an institution deciding a program is discretionary, or the departure of the one person who understood a collection. These are the threats preservation programs are most likely to face and least able to engineer against, and their presence in CHARM reminds us that the preservation risk landscape is wider than the security risk landscape, not deeper.
Preservation as a recovery capability
Institutional security programs increasingly plan against the NIST Cybersecurity Framework, updated to version 2.0 in February 2024 and organized around six functions: Govern, Identify, Protect, Detect, Respond, and Recover. Preservation contributes to several of these. It sits most squarely in Recover.
Text description of the recovery tier chart
A horizontal chart places four recovery tiers along an axis marked seconds, minutes, hours, days, and weeks.
Hot failover spans seconds to minutes. Warm standby spans minutes to hours. Operational backup spans hours to days. The preservation copy spans days to weeks and is highlighted.
A callout reads: a worked example. In 2021, NC State University Libraries lost 35 terabytes of special collections storage, including the only backup. Sixteen terabytes were restored from APTrust over six weeks. Not hot failover, and a tier a continuity plan can accommodate.
Tier boundaries are indicative. Actual recovery time varies with volume, storage class, network capacity, and organizational readiness.
APTrust has a documented case. In June 2021, an accidental staff action at NC State University Libraries deleted 35 TB of locally hosted special collections storage, including the only backup. Staff recovered 19 terabytes from local sources and the remaining 16 TB from APTrust over six weeks, and it all came back.
Two things about that story matter for this argument.
First, the threat was not an attacker. It was an internal action taken in good faith that took out the primary and the backup together. Separating credential and administrative domains addresses that scenario and the ransomware scenario equally well, so the case for it doesn’t depend on assuming an adversary.
The second is the number. Six weeks for 16TB is not hot failover and should never be sold as such. It is a recovery tier of last resort with a measured recovery time objective, and stating it plainly is what makes it usable. A business continuity plan can accommodate a tier that takes weeks. It cannot accommodate a claim that collapses under scrutiny in the first tabletop exercise.
That is also why restoration testing matters more than most preservation programs treat it as mattering. APTrust offers a spot restoration feature that members can use to simulate restoration to verify both the service and the depositing organization’s ability to make sense of what comes back. The British Library’s experience supports the practice: the copy survived, but the ability to use it did not.
A note on air gaps
Ransomware has collapsed much of the distance between these fields. Once attackers began targeting backups specifically, and the British Library review indicates that its attackers used the Library’s own backup processes during exfiltration, immutability became a control that serves security and preservation at once.
Precision matters here because the term most often used is also the one most easily overclaimed. In both fields, an air gap means storage media with no network path: tape, disconnected disk, and the emerging class of ceramic, glass, and film-based archival media. Cloud object storage with object lock, versioning, and a separate credential domain is a strong control, and it answers the overwhelming majority of realistic scenarios. It is not an air gap. It is immutability enforced in configuration and in a provider’s control plane, and describing it accurately is more persuasive to a security reviewer than describing it grandly.
The direction of travel is worth noting. The 2023 NDSA Storage Survey found a shift toward commercial cloud storage and away from collaborative storage models, while the National Academies’ 2024 consultation on archival storage technologies for the intelligence community documents active development in offline archival media. The field is moving toward online storage at the moment when offline media most clearly addresses the threat everyone worries about. That tension is worth sitting with rather than resolving by assertion.
Where this leaves us
Cybersecurity and digital preservation protect overlapping properties under different threat models and time horizons, using many of the same controls. Preservation programs are already doing security work. Security programs often don’t know their institution holds an offsite, independently administered, immutable copy of its digitized and born-digital collections because nobody has told them.
The second part of this post takes up the harder half: the confidentiality problem the preservation field has underinvested in, the places where these two disciplines genuinely pull against each other, what preservation programs stand to gain from their security colleagues rather than the other way around, and what to actually bring to that first conversation.
References
Academic Preservation Trust. (2026). Configuring Restoration Spot Tests. APTrust Documentation. https://docs.aptrust.org/user-guide/registry/spot_tests/
British Library. (2024). Learning Lessons from the Cyber-Attack: British Library Cyber Incident Review, March 2024. London: British Library. https://www.bl.uk/stories/blogs/posts/learning-lessons-from-the-cyber-attack
Consultative Committee for Space Data Systems. (2025). Reference Model for an Open Archival Information System (OAIS). CCSDS 650.0-M-3, ISO 14721:2025. Geneva: ISO.
Digital Curation Centre. (2009). DRAMBORA. https://www.dcc.ac.uk/tools/drambora
National Academies of Sciences, Engineering, and Medicine. (2024). Rapid Expert Consultation on Archival Data Storage Technologies for the Intelligence Community. Washington, DC: National Academies Press. https://doi.org/10.17226/27445
National Digital Stewardship Alliance Storage Survey Working Group. (2024). Current Trends in Digital Preservation Storage: Results from the 2023 NDSA Storage Survey. Zenodo. https://doi.org/10.5281/zenodo.13648690
National Institute of Standards and Technology. (2024). The NIST Cybersecurity Framework (CSF) 2.0. NIST CSWP 29. https://doi.org/10.6028/NIST.CSWP.29
Parker, D. B. (1998). Fighting Computer Crime: A New Framework for Protecting Information. New York: Wiley.
Pennock, M. (2024). Disentangling Digital Preservation Risk: An Interdisciplinary Exploration and Solution. PhD thesis, University of Dundee. https://doi.org/10.15132/20000457
Pennock, M. (2024). Scaling up knowledge of digital preservation risk: from concept to reference model and risk assessment with CHARM. iPRES 2024, Ghent, Belgium. https://doi.org/10.21428/5676bf2d.7f25ec43
Rosenthal, D. S. H., Robertson, T., Lipkis, T., Reich, V., and Morabito, S. (2005). Requirements for digital preservation systems: a bottom-up approach. D-Lib Magazine, 11(11). https://doi.org/10.1045/november2005-rosenthal
Saltzer, J. H., and Schroeder, M. D. (1975). The protection of information in computer systems. Proceedings of the IEEE, 63(9), 1278-1308. https://doi.org/10.1109/PROC.1975.9939
Samonas, S., and Coss, D. (2014). The CIA strikes back: redefining confidentiality, integrity and availability in security. Journal of Information System Security, 10(3), 21-45. https://www.jissec.org/Contents/V10/N3/V10N3-Samonas.html
Tallman, N. (2025). Lessons from the Frontlines: Navigating Data Loss and Recovery in Digital Preservation. Academic Preservation Trust. https://aptrust.org/2025/01/21/lessons-from-the-frontlines-navigating-data-loss-and-recovery-in-digital-preservation/
Vermaaten, S., Lavoie, B., and Caplan, P. (2012). Identifying threats to successful digital preservation: the SPOT model for risk assessment. D-Lib Magazine, 18(9/10). https://doi.org/10.1045/september2012-vermaaten