Ordinance on Information Management and Security (OIMS) (IVSV)
Table of Provisions (15)
Statutory Text (15 Provisions)
This Ordinance governs the management and protection of information of public bodies of the Canton and the municipalities.
B. Classification System and Dossiers
The public body manages its business cases with an orderly system that allows for clear assignment and a targeted search for information.
**1 The Public Body shall store all information necessary for the processing and traceability of a business case in a dossier.**
**2 Information stored separately for technical, organizational, or legal reasons shall be referenced in the dossier.**
1 The public body designates a lead agency for each business case.
2 This lead agency is responsible for the completeness of the dossier.
1 Files are provided with information necessary for the processing, classification, and protection of a business case and its associated information (metadata).
1. 1. 20 - 107
1
170.8 Ordinance on Information Management and Security (OIMS)
File closure
2 They particularly include the following metadata
a. Title of the business case,
b. Opening and closing date,
c. Lead agency.
1 When a business case has concluded, the lead agency checks the completeness of the file and closes it.
2 It may remove information that is not necessary for the reconstructability of the business case.
Choice of Information Medium
C. Information Medium
1 The public body determines the form in which it manages its dossiers. It manages the dossiers in electronic form, as far as this is possible and economical. Otherwise, it manages the dossiers in physical form or, for special reasons, in mixed form.
2 It also determines
a. for dossiers in electronic form: the handling of physical information, particularly that which must be kept in original form to maintain legal validity or for evidentiary purposes,
b. for dossiers in physical form: the handling of electronic information.
3 If the public body does not manage its dossiers exclusively in electronic form, it shall report annually to the superior body or the supervisory authority on the reasons therefor.
Technical Means
**1 Introduction of New Technical Means**
1 When a public body introduces new technical means, in particular new information management systems, it shall ensure that existing information and metadata can continue to be used.
2 It shall use technical means that enable the transfer of the managed information into archive-suitable formats.
**Duty to Offer**
**D. Duty to Offer and Archiving**
1 The public body segregates dossiers if
a. their retention period has expired,
b. the corresponding public task has ceased to exist.
2
Ordinance on Information Management and Security (OIMS) 170.8
2 It offers the segregated dossiers together with the associated metadata to the competent archives and delivers the dossiers selected by the archives.
3 It irretrievably destroys or deletes
a. the dossiers not taken over by the archives,
b. duplicates of the information delivered to the archives.
4 Dossiers worthy of archiving that the archives cannot immediately take over due to capacity reasons shall continue to be preserved by the public body.
The Public Body
Other Duties
a. grants the Archives access to its information, to the extent that this is necessary for the public body to fulfil its duties,
b. consults the Archives on projects concerning electronic information management.
The archive may issue instructions for the offering and taking over of the right to issue directives, information, and instructions.
E. Information Security
1 The lead body assesses the risks and the need for protection for the information it manages. It assigns this information to one of the protection levels determined by the Government Council.
2 Based on this, the public body defines appropriate measures in a plan to protect the information. It specifies the effect, costs, and deadlines for these measures.
To achieve the protection objectives pursuant to Art. 7 para. 2 IDG, the public body shall in particular examine the following measures
a. for the protection objective Confidentiality: the definition and assignment of restrictive access rights, encryption, and anonymisation during transmission,
b. for the protection objective Integrity: the use of durable information carriers and their secure storage,
c. for the protection objective Availability: the establishment of redundancies and the implementation of precautionary measures for emergencies and crisis situations,
d. for the protection objective Attributability: the use of digital certificates and signatures,
1. 20-1 . 1. 20 - 107
3
170.8 Ordinance on Information Management and Security (IVSV)
e. for the protection objective Traceability: the logging and monitoring of accesses and changes,
f. for all protection objectives: personnel security clearances and raising awareness among employees regarding the secure handling of information.
Review
Information
Processing
by Third Parties
F. Quality Assurance
1 The public body shall ensure compliance with this Ordinance by its
administrative units.
2 It shall regularly review compliance with the Ordinance and the appropriateness of the measures taken to protect the information. If the protection goals according to § 7 para. 2 IDG are no longer met, it shall adapt the measures.
3 It shall document the results of the review and the adaptation of the measures.
processing, it ensures that the requirements of this Regulation are complied with.
4
1 OS 74, 558; for grounds, see ABI 2019-09-13.
2 Entry into force: January 1, 2020.
3 LS 170.4.