I85PREP
⌘ K
CDIP study materials
CDIP study resources

CDIP: Standards, Compliance, and Security

CDIP · Work through your exam, one topic at a time.

All guide sections

Standards, Compliance, and Security

Standards, Compliance and Security tests whether your design would survive an audit: are formats open and durable, are retention and disposition defensible, and is access controlled and evidenced.

Format and records standards

  • TIFF 6.0 baseline with CCITT Group 3/4 compression remains the workhorse for bitonal images; JPEG and JPEG 2000 handle continuous tone.
  • PDF is ISO 32000; PDF/A (ISO 19005, parts 1 to 4) is the constrained archival profile: no encryption, embedded fonts, no external dependencies. PDF/UA (ISO 14289) covers accessibility.
  • Records management: ISO 15489 (principles), ISO 16175 (software functions), DoD 5015.02 and MoReq2010 (requirements), OAIS ISO 14721 (preservation model).
  • Barcodes: Code 39, Code 128, UPC/EAN, PDF417, Data Matrix, QR, each with different density, character set and error correction.

Compliance drivers

Retention schedules set minimum and maximum keeping periods; legal hold suspends disposition for named matters. US business-records admissibility rests on FRE 803(6) and 902(11) with a custodian certification; ESIGN and UETA govern electronic signatures in the US, eIDAS in the EU, and UK BIP 0008 addresses legal admissibility of scanned images. Sector rules include HIPAA, GDPR, SOX, PCI DSS, FERPA and 21 CFR Part 11.

Security controls

Confidentiality, integrity and availability drive the control set: strong authentication with MFA, role- or attribute-based authorization, encryption at rest (AES-256) and in transit (TLS), PKI digital signatures for non-repudiation, immutable audit trails of access and disposition, data loss prevention, and certified destruction per NIST SP 800-88. Redaction must remove underlying content and its text layer, not overlay a black box.

Worked example

A hospital scans patient records. Reasoning: HIPAA requires access control, audit logging and encryption, so use unique user IDs with MFA, role-based access by department, TLS in transit and AES-256 at rest. Retain adult records per the state schedule, apply legal hold to any record tied to litigation, and redact third-party information by true removal before release. Verify the audit trail records who viewed each document and when.

Traps that cost marks

Treating PDF/A as a security control. Believing a black rectangle is redaction. Confusing a scanned signature image with a cryptographic digital signature. Letting a retention rule delete records under legal hold. Assuming encryption without key management is encryption.