 or control analysis. 
AUDIT AND CERTIFICATION OF TRUSTWORTHY DIGITAL REPOSITORIES 
CCSDS 652.0-M-1 
Page 5-13 
September 2011 
Discussion 
The repository should conduct regular risk assessments and maintain adequate security 
protection in order to provide expected and contracted levels of service, following codes of 
practice such as ISO 27000. 
‘System’ here refers to more than IT systems, such as hardware, software, communications 
equipment and facilities, and firewalls. Fire protection and flood detec