When the first part of this series went up, Alicia Wise, Executive Director at CLOCKSS, asked whether governance belonged in the equation.
It does. The first two posts argued that preservation and information security professionals protect overlapping properties, and that preservation practitioners need a vocabulary the people holding the security budget recognize. It’s also important to be clear who owns the outcome once the conversation ends.
This post is for preservation practitioners whose institutions have risk and security structures their programs have not yet engaged. The argument is simple: managing preservation does not establish who can accept its risks or commit resources to address them. If no one outside your department holds that authority, your preservation risk has no owner — and your institution already has the machinery to give it one.
Managed is not governed
Management is the doing. Governance establishes who decides, who has authority, and who answers for the decision. Weill and Ross (2004) define it through decision rights and accountability; COBIT 2019 (ISACA, 2018) and ISO/IEC 38500 (ISO, 2024) likewise distinguish governance from management.
Many preservation programs are well managed. Fixity runs on schedule. Copies exist in more than one place. Somebody watches format obsolescence.
Governance adds a named risk owner with authority to act, a record somewhere an executive reads, and a review that happens whether or not anyone remembers to ask. It’s often an important missing ingredient.
Text description of the managed versus governed comparison
A table compares a managed program with a governed program across four properties.
Named. In a managed program, the risk is understood by the people doing the work. In a governed program, it is written down in language an executive reads.
Owned. In a managed program, “the library” is responsible. In a governed program, a named person with budget authority holds it.
Recorded. In a managed program, it is documented in a preservation plan. In a governed program, it is entered in the institutional risk register.
Reviewed. In a managed program, someone revisits it when they remember. In a governed program, it happens on a cadence, with a date attached.
Separating governance from management is one of the six governance system principles in COBIT 2019.
What governance actually looks like
Four properties make accountability visible.
Named. The risk is written down in language an administrator can read, not only in a preservation plan.
Owned. A specific person is accountable for the risk and has authority to accept it or secure resources to address it. That person may also manage preservation, but the authority must be explicit. “The library” is not an owner.
Recorded. It appears in the institutional risk register, in the format that register already uses. This is precisely what CHARM (Pennock, 2024) was built to produce: compatibility with ISO 31000 and the ability to generate scored, characterized risk statements that an enterprise register can absorb.
Reviewed. On a cadence, attached to something that already happens, rather than a new meeting nobody will defend.
APTrust’s policy register illustrates how ownership and review can be made visible at the document level. Every document carries an owner, a version, a last-updated date, an approval period, a next review date, and a status; approved policies are deposited in UVA’s institutional repository with DOIs so they outlast the staff who wrote them.
| Document | Owner | Version | Last updated | Next review | Status |
|---|---|---|---|---|---|
| Preservation Policy | Board | 3.1 | January 2025 | January 2027 | Approved |
| Governance Manual | Board | 3.3 | January 2025 | January 2028 | Approved |
| Risk Management Plan | Board | Draft 1.0 | April 2022 | TBD | Under review |
APTrust’s Risk Management Plan has remained in draft since 2022. Completion has moved from 2026 to 2027, and the Board is beginning to engage with strategic risk management this year.
Risk management gets back-burnered even in organizations that take it seriously. Governance does not prevent every delay. It makes the delay visible, assigns an owner, creates accountability, and clarifies the next step. Publishing this register makes our unfinished work accountable.
What the standards can’t do
The crosswalk accompanying Part Two found Govern to be the weakest NIST CSF function covered by the NDSA Levels (Tallman, 2026). That shows a limitation of the Levels, not that preservation programs lack governance.
Text description of the CSF coverage chart
The 22 CSF 2.0 categories are grouped into six rows by function. Each category is marked reached, minimal, or not reached.
Govern: GV.OC not reached, GV.RM not reached, GV.RR reached, GV.PO not reached, GV.OV reached, GV.SC minimal. Three unreached and one minimal.
Identify: ID.AM reached, ID.RA not reached, ID.IM reached. One of three unreached.
Protect: PR.AA reached, PR.AT not reached, PR.DS reached, PR.PS reached, PR.IR reached. One of five unreached.
Detect: DE.CM reached, DE.AE reached. None unreached.
Respond: RS.MA not reached, RS.AN reached, RS.CO not reached, RS.MI reached. Two of four unreached.
Recover: RC.RP reached, RC.CO not reached. One of two unreached.
Coverage is assessed against the NDSA Levels of Digital Preservation v2.0. Govern is the weakest function, with half its categories unreached and none reached strongly. Adding DPC RAM reduces the eight unreached categories to three.
Other preservation frameworks address governance directly. CHARM includes Budget and Strategy as risk sources. Six of DPC RAM’s eleven sections concern organizational capabilities. Trustworthy Repositories Audit & Certification (TRAC) opened with governance and organizational viability in 2007 (Center for Research Libraries and OCLC, 2007); its successor, ISO 16363 (CCSDS, 2024), requires succession planning, policy review, and regular audits and management reviews.
The field has had governance specifications for nearly twenty years. The practical question is whether those requirements connect to the people who can accept risk and commit institutional resources.
The consequence shows up in practice. The Texas Digital Library’s planning project on preserving sensitive data (Mumma, 2022) found institutions that had assessed their sensitive holdings and then decided not to bring the content into the library or archives at all. One recorded reason was unclear authority to manage it properly. Not insufficient storage. Not missing tools. Unclear authority.
This is what unclear governance can cost: an institution identifies preservation needs but cannot establish the authority to act.
Why security colleagues got there first
Anderson and Moore (2006) argued in Science that information security fails at least as often for economic reasons as technical ones. Security professionals spent the twenty years since building mechanisms that align incentives. Breach notification law put a clock on loss and disclosure. Insurance underwriting made controls a condition of coverage. And in 2023 the SEC began requiring public companies to describe, annually, their board’s oversight of cybersecurity risk and which committee holds it.
That last one is the instrument preservation professionals lack. The SEC did not tell companies to be secure. It required them to describe, publicly and on a schedule, how board-level oversight works.
Good preservation also requires duties, and some bind hard. Regional federal depository libraries must retain government publications permanently under 44 U.S.C. §1912. Deeds of gift commit institutions to specific collections. AAM’s Core Standards require museums to ensure their collections’ preservation and to steward resources held in the public trust. But a duty to preserve does not establish who accepts the risk, how failure is escalated, or when accountability is reviewed. Loss can remain silent for years.
Preservation programs need not wait for new external requirements. They can use the risk and governance structures their institutions already have.
Shared responsibility
Ownership fragments the moment content sits with a service provider or when access is licensed, and in most relationships nobody has written down where the lines of responsibility fall for digital preservation.
Text description of the shared responsibility matrix
A matrix with eight rows of responsibility and three columns: member, preservation service, and infrastructure provider. A solid mark indicates primary responsibility and a faded mark indicates a shared one.
Content, formats and metadata: member primary, preservation service shared.
Fixity generation and verification: preservation service primary, member shared.
Credentials and access keys: member primary, preservation service and infrastructure provider both shared.
Encryption of sensitive content: member primary, no others.
Storage durability and redundancy: preservation service and infrastructure provider both primary.
Physical and platform security: infrastructure provider primary, preservation service shared.
Restoration on request: preservation service primary, member shared.
Owning the preservation risk: member primary, preservation service shared.
Adapted from the APTrust Shared Responsibility Model of February 2025, itself built on the AWS model. Illustrative; every service divides these lines differently, which is the reason to publish them.
Cloud security providers worked this out years ago. The responsibility matrix is now so standard that a security team reviewing a vendor expects one and is unsettled when it is missing. APTrust published its version in February 2025, adapting the AWS model into three layers: AWS secures the underlying infrastructure, APTrust manages preservation of member content within it, and members remain responsible for the content itself, its formats, and its metadata.
The useful part of that post is where it handles the awkward case rather than the clean one. If a bad actor obtains a member’s credentials, responsibility spans all three parties: AWS secures the platform, APTrust enforces its security practices, and the member manages their own authentication. Saying so in public is more useful than any assurance about how seriously everyone takes security.
Most preservation services have not published anything equivalent. They should. A responsibility matrix is a governance artifact, not a marketing one, and its value lies entirely in naming the cases where the answer is uncomfortable.
The parties change with the arrangement. When a publisher supplies e-journal or e-book content for preservation, obligations the library cannot discharge, sit with the publisher: complete content, in agreed formats, with usable metadata. Some commercial preservation platforms take on format and metadata work that APTrust leaves with its depositors. That variation is the argument for each service publishing its own matrix rather than pointing at someone else’s.
Consortia can sustain accountability across changes in an individual institution’s priorities. A governing board, published policies, review cycles, and participation requirements provide continuity that no member can guarantee alone.
That does not remove the institution’s responsibility. Members still need a named risk owner who understands what the service covers and what remains theirs.
What good looks like
CRL’s certification of Scholars Portal shows an organization inviting outside scrutiny of how it runs its repository. DPC RAM benchmarking gives members a systematic comparison of organizational capability. The British Library’s published cyber incident review makes failures available for peers to examine and learn from.
None of these required a regulator. Each is an organization deciding that someone outside it should be able to check the work.
Where governance goes wrong
A description of governance that promises only benefits would deserve to be received with skepticism.
A risk register entry that nobody reads can create false confidence that the risk is handled. Naming an owner can isolate a problem rather than solve it, especially when the named owner has responsibility but no budget. A policy that exists but isn’t enforced trains everyone to ignore it. And consortial governance is genuinely slower than institutional governance; a board that meets twice a year cannot move at the speed of an incident.
Good governance comes with costs and a compliance burden. The preservation field therefore has some harder question to sit with. The forcing functions that brought security governance came with a compliance burden, and compliance work is not preservation work. It is not always obvious that practitioners want the whole package, and it is worth being clear about this and which parts we need and which we want.
Where this leaves us
If you take one thing from this series, make it a commitment to conversations you have not had yet. Ask whoever runs risk at your institution whether collections appear anywhere in the register. Ask who is named against that entry. Ask when it was last reviewed. Those three questions take an afternoon, and the answers will tell you more about your program’s real position than another maturity assessment will.
Three posts, three arguments. The first was that preservation and security professionals protect overlapping properties and mostly do not know it. The second was that the translation between them is learnable and the vocabulary already exists. The argument in this one is that digital preservation and security do not matter much unless somebody owns the outcome.
Alicia asked the right question. Governance is not a fourth topic alongside confidentiality, integrity, and availability. It determines whether any of the three survives a budget cycle.
References
American Alliance of Museums. (n.d.). Core Standards for Museums. Washington, DC: AAM. https://www.aam-us.org/programs/ethics-standards-and-professional-practices/core-standards-for-museums/
Anderson, R., and Moore, T. (2006). The economics of information security. Science, 314(5799), 610-613. https://doi.org/10.1126/science.1130992
APTrust. (2025). Embracing the shared responsibility model in digital preservation. 24 February 2025. https://aptrust.org/2025/02/24/embracing-the-shared-responsibility-model-in-digital-preservation/
APTrust. (2026). Policies, guidelines, and governance documentation. https://aptrust.org/resources/policies/
British Library. (2024). Learning Lessons from the Cyber-Attack: British Library cyber incident review. 8 March 2024. London: British Library. https://www.bl.uk/home/british-library-cyber-incident-review-8-march-2024.pdf
Center for Research Libraries and OCLC. (2007). Trustworthy Repositories Audit & Certification: Criteria and Checklist. Version 1.0. Chicago: CRL. https://www.crl.edu/sites/default/files/2025-01/trac.pdf
Consultative Committee for Space Data Systems. (2024). Audit and Certification of Trustworthy Digital Repositories. Recommended Practice, Issue 2. CCSDS 652.0-M-2. Washington, DC: CCSDS. (Published as ISO 16363.)
Depository Library Program, 44 U.S.C. §1912 (Regional depositories; designation, functions). https://www.govinfo.gov/link/uscode/44/1912
Digital Preservation Coalition. (2024). Digital Preservation Coalition Rapid Assessment Model (DPC RAM), Version 3. http://doi.org/10.7207/dpcram24-03
Digital Preservation Coalition. (2025). New RAM Benchmarking Results 2025 Now Available! 1 October 2025. https://www.dpconline.org/news/new-ram-benchmarking-results-2025-now-available
International Organization for Standardization. (2018). ISO 31000: Risk management, Guidelines. Geneva: ISO.
International Organization for Standardization. (2024). ISO/IEC 38500: Information technology, Governance of IT for the organization. Third edition. Geneva: ISO/IEC.
ISACA. (2018). COBIT 2019 Framework: Introduction and Methodology. Schaumburg, IL: ISACA.
Levels of Preservation Revisions Working Group. (2019). Levels of Digital Preservation Matrix V2.0. National Digital Stewardship Alliance. https://osf.io/2mkwx/
Mumma, C. (2022). Preserving Sensitive Data in Distributed Digital Storage Networks. IMLS award LG-34-19-0055-19. https://hdl.handle.net/2249.1/156715
National Institute of Standards and Technology. (2024). The NIST Cybersecurity Framework (CSF) 2.0. NIST CSWP 29. https://doi.org/10.6028/NIST.CSWP.29
Pennock, M. (2024). Disentangling Digital Preservation Risk: An Interdisciplinary Exploration and Solution. PhD thesis, University of Dundee. https://doi.org/10.15132/20000457
Scholars Portal. (n.d.). Trustworthy Digital Preservation at Scholars Portal. Ontario Council of University Libraries. https://tdr.scholarsportal.info/
Tallman, N. (2026). Crosswalk: NDSA Levels v2.0 and DPC RAM v3 to NIST Cybersecurity Framework 2.0. Charlottesville, VA: University of Virginia. https://doi.org/10.18130/uva-open/75
US Securities and Exchange Commission. (2023). Cybersecurity Risk Management, Strategy, Governance, and Incident Disclosure. Release Nos. 33-11216; 34-97989. https://www.sec.gov/newsroom/press-releases/2023-139
Weill, P., and Ross, J. W. (2004). IT Governance: How Top Performers Manage IT Decision Rights for Superior Results. Boston: Harvard Business School Press. ISBN 978-1-59139-253-8.