Did you know? A digital archive can preserve every bit of a scientific dataset yet lose its meaning when the original software, units and codebook disappear. Preservation engineering must keep selected information usable, not merely stored.
The Gold Standard of Information Preservation Engineering follows OAIS information packages, metadata, format change, independent replicas, fixity, access rights, trusted repositories and documented recovery. It reflects both technical durability and the responsibilities of the people running the archive.
This guide uses the March 2025 OAIS and trustworthy repository standards, Library of Congress recommendations and the March 2026 NDSA sustainability update. All quantitative examples are fictional and should not be read as approved storage or risk targets.
Chapter index
The OAIS model, source packages and technical fixity · Chapters 1–17
- Preservation is the ability to use information in the future
- Selection is a necessary part of responsible preservation
- The 2025 OAIS model is the current international reference
- Open in OAIS does not mean public access to everything
- The designated community determines the knowledge to preserve
- Submission packages contain the producer’s handoff
- Archival packages carry long-term preservation responsibilities
- Dissemination packages serve access and lawful use
- OAIS functions extend beyond moving bytes
- Representation information converts bits into knowledge
- PREMIS structures preservation metadata
- Provenance must follow copies and transformations
- Fixity checks address unwanted byte changes
- Independent storage copies reduce some shared risks
- Worked example: calculate raw replica capacity
- A successful fixity percentage can conceal important gaps
- Worked example: distinguish verified from unresolved objects
File formats, migration, rights and access · Chapters 18–31
- Backups and digital preservation archives have different purposes
- Library of Congress guidance helps compare formats
- Text preservation needs structure and encoding
- Preserving photographs involves more than a thumbnail
- Audio archives need context and tracks
- Video preservation includes captions and synchronisation
- Dynamic websites require a declared capture goal
- Datasets need precision and interpretive context
- Emulation can preserve software-dependent behaviour
- Migration requires defined significant properties
- Worked example: migration success with exceptions
- Authorised access must respect rights and privacy
- Preservation is compatible with lawful deletion
- Accessibility should survive preservation and dissemination
Trustworthy archives, sustainability and future users · Chapters 32–42
- ISO 16363:2025 addresses repository trustworthiness
- NDSA Levels 2.1 is the latest 2026 guidance
- Environmental sustainability requires whole-system thinking
- Worked example: growth compounds across ingestion years
- Supplier resilience depends on exportability and independence
- Disaster recovery should be exercised for meaningful access
- Security controls must protect records and their verification
- Skilled people and institutional funding are technical dependencies
- Independent testing should begin with one real future-use question
- Frequently asked questions about digital preservation
- Continue through connected Gold Standard information subjects
Quick reference: what does future usability require?
| Preservation layer | Question to verify |
|---|---|
| Content | Are the intended bytes and objects still available? |
| Meaning | Can a user interpret format, relationships and units? |
| Provenance | Can source and significant changes be traced? |
| Operations | Are replicas and recovery demonstrably effective? |
| Rights and access | Can authorised users legitimately retrieve information? |
1. Preservation is the ability to use information in the future
Information preservation engineering aims to keep selected digital information authentic enough for its purposes, interpretable and accessible through changes in storage, software, staff and user knowledge. A working hard drive does not guarantee someone will understand the files on it twenty years later.
Did you know that a perfect copy of a scientific dataset can still be unusable when its units and codebook disappear? The gold standard links source content, representation information, rights, trustworthy operations and actual tests with future users.
2. Selection is a necessary part of responsible preservation
Not every file deserves permanent institutional care. Archival value, record obligations, research purpose, privacy, copyright and expected users influence selection. Uncontrolled retention can increase cost and expose sensitive information long after the legitimate purpose ends.
Write down the preservation decision and the authority behind it. A project should be able to explain why it selected one collection and lawfully disposed of another rather than simply expanding storage indefinitely.
3. The 2025 OAIS model is the current international reference
ISO 14721:2025, published in March 2025 as its third edition, defines a reference model for an Open Archival Information System. It describes an organisational system of technology, policies, people and responsibilities for preserving information.
OAIS is not the name of one commercial repository application. The reference model helps teams reason about functions, information packages and long-term knowledge dependencies without prescribing an identical technical design for every museum, laboratory or company.
4. Open in OAIS does not mean public access to everything
The term Open concerns the openly developed reference model and related standards. It does not demand unrestricted distribution of confidential business records, personal information or copyrighted cultural material.
An archive may lawfully control access while preserving content for its designated community. Engineers should distinguish the right to preserve, the right to disclose and the technical ability to retrieve an item.
5. The designated community determines the knowledge to preserve
An OAIS designated community consists of the users for whom an archive commits to keep information independently understandable, with relevant knowledge assumptions. A file intelligible to a project’s original scientists may become obscure when terminology, software or field definitions disappear.
Record what the future audience needs to know, then test that assumption using people outside the producing team. A preserved CSV with undefined units and codes may contain valid bytes but fail its purpose.
6. Submission packages contain the producer’s handoff
A submission information package, or SIP, includes material offered to an archive under agreed rules. The producer may provide content, metadata, documentation and rights evidence, and the archive validates what it has actually received.
A successful upload is only the beginning. Record the producer, source identifiers, agreed manifest, format and exceptions. Do not silently mark a missing dataset as successfully preserved because the transfer interface turned green.
7. Archival packages carry long-term preservation responsibilities
The archival information package, or AIP, provides a maintained representation for preservation, including information and metadata needed to interpret and manage selected content. It may differ from the original submitted package after authorised enrichment or normalisation.
Preserve the source relationship and significant changes rather than pretending all archival packages are byte-identical to submissions. A deliberate conversion can improve longevity if the process and resulting fidelity are documented.
8. Dissemination packages serve access and lawful use
A dissemination information package, or DIP, can deliver an authorised representation to users. For example, a museum may preserve a high-resolution master but supply an accessible lower-resolution web image for ordinary research.
The access copy should be traceable to the preserved object, and users should understand differences in fidelity or redaction. A readable derivative does not necessarily preserve all the content’s scientific or artistic characteristics.
9. OAIS functions extend beyond moving bytes
The OAIS framework addresses ingest, archival storage, data management, preservation planning, administration and access, with appropriate roles and interfaces. The archive must also manage evolving technology and user knowledge.
A repository that only offers automatic backup is not automatically a complete OAIS implementation. Operational responsibilities, change management and independent evidence distinguish a durable preservation service from an unmaintained file dump.
10. Representation information converts bits into knowledge
Formats, schemas, field names, units, measurement methods, character encodings and required software can all be necessary for future interpretation. A computer reading a sequence of numbers is not the same as a historian understanding what those numbers describe.
Preserve useful format specifications, data dictionaries and conceptual relationships. Where a file depends on external software or network services, identify which dependencies a future user would need.
11. PREMIS structures preservation metadata
The Library of Congress PREMIS Data Dictionary 3.0 describes preservation metadata organised around Objects, Events, Rights and Agents. These allow systems to describe material, actions performed, legal context and responsible entities.
For a migrated file, record the source object, transformation event, validation outcome and the responsible process. A simple note saying ‘backup completed’ lacks the detail needed to diagnose later problems.
12. Provenance must follow copies and transformations
A preserved document may pass through scanning, editing, metadata correction, format conversion or transfer between organisations. The lineage should show what was derived from what and when significant actions occurred.
Filesystem creation timestamps may change during ordinary copying. Preserve stable object identifiers and relevant event evidence rather than relying on a date that only reflects a recent transfer.
13. Fixity checks address unwanted byte changes
Cryptographic digests can help detect whether stored bytes differ from a trustworthy earlier version. The preservation process needs suitable algorithms, protected reference values, clear checking schedules and response to discrepancies.
A matching checksum does not prove that the original record was accurate or complete. It is evidence of consistency of defined bytes. Source authenticity and meaningful content checks require additional controls.
14. Independent storage copies reduce some shared risks
Multiple copies can support recovery after media or site failure, provided they do not all depend on the same vulnerable system. Copies in one account with shared administrator credentials may be lost to one compromised identity.
Plan storage across credible failure domains, consider geographic and supplier risks, and test authorised restoration. The mere presence of three objects with the same filename is not proof of resilient preservation.
15. Worked example: calculate raw replica capacity
Suppose a fictional digital collection contains 24 terabytes of selected unique data. Holding three full replicas would nominally require 24 × 3 = 72 terabytes of content capacity before metadata, indexes, additional historical versions and storage-system overhead.
That is arithmetic, not a universal recommendation to keep exactly three copies. Independence, security, access speed and environmental cost determine whether a particular architecture adequately protects the actual materials.
16. A successful fixity percentage can conceal important gaps
A repository should know which selected objects were checked, which passed, which changed and which could not be examined. The denominator should reflect objects due for verification, not only files successfully reached by a monitoring job.
A single critical unrecoverable research dataset may matter more than hundreds of routine image copies. Report high-impact unresolved cases separately, and avoid treating unknown integrity as confirmed corruption or as confirmed safety.
17. Worked example: distinguish verified from unresolved objects
Assume 120,000 fictional objects are due for a scheduled fixity check. The system verifies 119,700 with matching references, while 300 remain unchecked or unresolved. The successful verified coverage is 119,700 ÷ 120,000 = 99.75%.
That percentage does not establish all objects are preserved successfully. Identify the 300 items, their uniqueness and why the checks failed. A trustworthy report includes exceptions instead of using the favourable average as a substitute for investigation.
18. Backups and digital preservation archives have different purposes
Operational backups primarily support recovery after failure, while archives address longer-term use, meaning and responsible custody. A backup rotation may delete older versions required for historical evidence, while an archival package may lack the services needed to restore a live application.
Define separate recovery objectives, archival horizons and validation tasks. Good organisations need both capabilities when both risks matter; naming an object storage tier ‘archive’ does not make it a trustworthy long-term repository.
19. Library of Congress guidance helps compare formats
The Library of Congress Recommended Formats Statement 2025–2026 describes preferences for published works, images, datasets and other materials using characteristics associated with long-term access.
Its preferred formats are context-specific, not a promise that every selected format is permanent. Preserve suitable originals as needed and check whether conversions retain the properties future users must understand.
20. Text preservation needs structure and encoding
A scholarly article may need headings, table relationships, formulae, citations and character encoding as well as visual pages. A scanned image of a page can preserve appearance while making the text inaccessible to some readers.
The Library of Congress format guidance considers XML-based formats, high-quality PDFs and accessibility among its preferences. Test the delivered document’s structure and reading order instead of assuming that a file extension guarantees fidelity.
21. Preserving photographs involves more than a thumbnail
For digital photographs, meaningful properties may include image dimensions, resolution, colour information, captured metadata and the connection to a specific original or object. A reduced image can be convenient for web access while insufficient for conservation research.
Different collections need different masters and derivatives. Record imaging methodology and distinguish a photograph’s appearance from unmeasured physical properties of the subject it depicts.
22. Audio archives need context and tracks
Audio can depend on sample format, channel layout, capture details, performer metadata, timestamps, cues and related documents. A streaming file may be serviceable for listening while discarding properties valuable to future research.
Document the original recording, authorised transformations and attached metadata. A lossless master with no description or rights information may be harder to use responsibly than its technical quality suggests.
23. Video preservation includes captions and synchronisation
A video object may include picture, sound, timecodes, subtitles, accessibility tracks and supplemental context. Losing captions or audio synchronisation can materially change an archival experience even if the visual file opens.
Test representative playback after migration and record which source and language tracks remain. A short social-media clip is not equivalent to a complete recorded performance or research observation.
24. Dynamic websites require a declared capture goal
A webpage can rely on live data, scripts, interactive forms and external content. A screenshot preserves one visible moment, not necessarily the data, functionality or transaction that produced it.
Choose whether the goal is to preserve public appearance, the text, linked files, source code or a specific interactive experience. Record what a crawl or snapshot omitted and why.
25. Datasets need precision and interpretive context
A CSV or database export can be portable while losing units, relational structure, access permissions or numerical precision. Conversely, a native database may require software dependencies that become obsolete.
The Library of Congress datasets guidance explicitly notes such trade-offs. A migration plan should preserve relationships and intended uses, not merely the count of exported rows.
26. Emulation can preserve software-dependent behaviour
An interactive application, scientific analysis or game may depend on a particular operating system or hardware. Emulation can recreate selected technical environments so future users can examine functionality rather than only a static screenshot.
Preservation planning must consider licensing, security and the accuracy of the recreated behaviour. A successful launch of old software is useful evidence but not proof that all peripherals or historical user experiences are identical.
27. Migration requires defined significant properties
Changing a format may alter fonts, layout, metadata, transparency, numerical values or links. Define the properties important to future use before conversion and test whether they survived.
Preserve the original object and conversion details where lawful and appropriate. An automated log saying 100% success often means every conversion job ended, not that every resulting artefact remained meaningful.
28. Worked example: migration success with exceptions
A fictional project selects 30,000 objects for migration, with 29,940 passing the defined initial validator and 60 needing review. The apparent accepted proportion is 29,940 ÷ 30,000 = 99.8%.
That number does not prove every accepted file retained all significant properties. A few rare, scientifically unique records among the 60 may require specialist repair or a different preservation strategy.
29. Authorised access must respect rights and privacy
Archives may preserve personal, confidential or copyrighted material while limiting disclosure appropriately. Right to store, right to transform and right to publish are not identical.
PREMIS includes a rights entity, which can help describe permissions and obligations. A storage administrator should not treat possession of the bytes as blanket authorisation to release them to the public.
30. Preservation is compatible with lawful deletion
Some holdings require long-term care, while others need disposal when retention duties end. Deleting unnecessary copies can reduce privacy and environmental risks when authorised and documented.
Information Lifecycle Engineering addresses capture, retention and disposition; preservation engineering focuses on keeping selected material intelligible through change.
31. Accessibility should survive preservation and dissemination
A digital archive that stores a perfectly intact image-only report may exclude a reader who needs accessible text. When a relevant service offers captions, transcripts or structured documents, these should be managed as meaningful content.
The Library of Congress has considered digital accessibility in its recommended format evaluation since 2024. Test future-use tasks with relevant readers, not only with the preservation software’s file validator.
32. ISO 16363:2025 addresses repository trustworthiness
ISO 16363:2025 is a March 2025 edition of the standard for auditing and certifying trustworthy digital repositories. It supports examination of repository responsibilities and controls, not a simple assertion that one storage product is certified by default.
An organisation citing ISO 16363 should distinguish studying the standard from undergoing an applicable formal audit or certification. Trustworthiness involves governance, preservation practice and technical infrastructure together.
33. NDSA Levels 2.1 is the latest 2026 guidance
The National Digital Stewardship Alliance released Levels of Digital Preservation 2.1 in March 2026, extending the earlier 2019 2.0 resource with environmental-sustainability guidance and selected refinements.
The guidance explicitly cautions that the highest level need not be appropriate for every functional area and organisation. Use risk and preservation value rather than pursue impressive scorecards at any cost.
34. Environmental sustainability requires whole-system thinking
Power, cooling, hardware replacement, storage replicas and data movement have environmental impacts. Eliminating unnecessary copies may help, but removing the only independent preservation path can endanger unique cultural or scientific material.
Evaluate actual preservation obligations, failure domains and long-term cost. Responsible sustainability balances resource use with the permanent loss risk of irreplaceable information.
35. Worked example: growth compounds across ingestion years
Imagine a fictional archive collecting 8 TB of unique new data in year one, with new annual volume rising 20% in each of the next two years. Year-two ingestion is 9.6 TB; year three is 11.52 TB; total new unique data are 8+9.6+11.52 = 29.12 TB.
If three complete copies of all that content were required, the nominal content capacity would be 87.36 TB before other overhead. This does not mean three copies are universally right or quantify actual energy use.
36. Supplier resilience depends on exportability and independence
A cloud archive can fail operationally if credentials are lost, contracts change, a supplier exits or the only catalogue database becomes unavailable. Vendor choice should include full export, identifiers, formats and documentation.
Test an authorised transfer to a genuinely independent destination and check whether objects can still be retrieved with their metadata. A provider’s general uptime statistic does not establish archival portability.
37. Disaster recovery should be exercised for meaningful access
A theoretical plan does not prove readiness after fire, flooding, cyber compromise or critical staff departure. Test selected recovery scenarios under controlled conditions and confirm both file integrity and interpretability.
An archive restored as uninterpretable raw blocks has not met its user obligation. Record the recovery dependencies and reasons for any failed exercise.
38. Security controls must protect records and their verification
Archives need appropriately controlled identities, privileged access, audit evidence and protected integrity references. Immutable storage and replicas can help against some threats but may share misconfiguration or administrative dependencies.
An attacker with broad account permissions might make both copies and catalogues inaccessible. Plan recovery without assuming the same compromised credentials or network will remain available.
39. Skilled people and institutional funding are technical dependencies
Preservation programmes require qualified maintainers, documented policies, secure funding and roles that continue beyond the original project. An impressive storage array can become a stranded asset when nobody understands how to restore its objects.
Document succession, procurement and maintenance obligations. Institutional continuity is part of engineering because a format migration or emergency response requires accountable people able to execute it.
40. Independent testing should begin with one real future-use question
Choose a representative object and ask a person outside the producing team to locate it, identify its source, open the correct representation, understand important units and reproduce a relevant interpretation.
Trace any difficulties back to ingest, representation metadata, documentation or access rules. A successful independent test provides more direct evidence of preserved usefulness than a status dashboard showing no storage errors.
41. Frequently asked questions about digital preservation
Does a matching hash prove an original document is true? No. Are three copies guaranteed to be independent? No. Does OAIS Open mean all archive content must be publicly available? No. Does a file migration guarantee every property survived? No.
Is NDSA Levels 2.0 the newest version as of October 2026? No; 2.1 appeared in March 2026. Can an organisation cite ISO 16363 without claiming formal certification? Yes, if it accurately describes the status. Can preserved data become unintelligible despite intact bits? Yes.
42. Continue through connected Gold Standard information subjects
Explore Information Lifecycle Engineering, Information Provenance, Information Integrity Engineering, Information Assurance, Information Governance and Information Quality.
Primary sources: ISO 14721:2025, ISO 16363:2025, PREMIS 3.0, NDSA Levels 2.1 and Library of Congress 2025–2026 format guidance. Worked calculations are fictional.