Navigation and service

BSI - Federal Office for Information Security (Link to homepage)

BSI Technical Guideline 03138 Replacement Scanning (RESISCAN)

In administration, the judiciary and private companies (e.g. in the healthcare, insurance, tax and accounting sectors), as digitalization progresses electronic document management and process processing systems are increasingly being used. In order to implement electronic legal and commercial transactions, there is an increase in legislation that allows or requires electronic data file-management. However, the parallel handling of paper documents is still necessary and will continue to be so in the future, as the digitalization of existing files is far from complete and new entries will continue to be made in paper. To date, the originals have been preserved in a large number of cases in order to avoid potentially consequential conflicts with legal documentation and storage regulations. At the same time, they are often scanned to facilitate internal file processing.

Storing the originals of the paper files places a heavy financial and organizational burden on the departments concerned. From a legal point of view, in addition to the very different rules on the admissibility of replacement scanning in different areas of law, there are uncertainties due to inconsistent technical and organizational requirements. The law can always impose abstract legal requirements at most. Despite numerous efforts, for example in the field of tax-relevant and commercial documents, the technical implementation is largely left to the user. Due to various scanning solutions on the market, which vary greatly in the implementation of security requirements or are incomplete from a holistic information technology perspective, this leads to uncertainty in practical application.

The technical guideline TR-03138 (TR-RESISCAN) aims to close this gap between abstract and inconsistent legal requirements and the reliable technical realization of scanning. The technical guideline brings together the security-relevant technical and organizational measures to be taken into account during the replacement scanning along a structured scanning process. Thus, the objectives of information security and legal certainty are taken into account in equal measure.

On the one hand, the technical guideline therefore serves the user in the public and private sector to facilitate the selection of scanning solutions by striving for a standardization of requirements and security measures. On the other hand, manufacturers and service providers are given the necessary specifications by means of which they can design and offer their services in accordance with the technical guideline.

By means of a defined conformity check, users or providers of scanning services can thus provide documented proof that their processes and systems for replacing scanning meet the technical and organizational requirements. A proven confirmation of conformity and a certificate issued by the Federal Office for Information Security (BSI) can be used as a performance criterion for procurement procedures by the customer. In addition to a certification, self-declarations from scanning service providers or users can also be considered, depending on the application. Thus the technical guideline serves as a practical guideline for the regularity of a scanning process without an associated obligation to certify.

Main document and Annex P

BSI TR-03138 Replacement Scanning (TR-RESISCAN) consists of the main document and the corresponding normative test specification (Annex P). The main document describes all the necessary measures in a compact manner. The test specifications contain the test cases necessary for conformity testing, the positive fulfilment must be confirmed in the context of an audit for successful certification. Even if no certification is sought, the test specifications can be used to make it easier to check your own scanning process.

Current Technical Guideline TR-03138 & Evidence of conformity testing (Date: Dec. 2024):

Previous Technical Guideline TR-03138 & Evidence of conformity testing (Date: April 2020):

Brief overview and action guide

The short overview summarises practical information and the central contents of the BSI TR-03138-RESISCAN. BSI Technical Guideline 03138 Replacement Scanning - Overview

A general guideline for the safe design of the replacement scanning is provided by the following document: Replacement scanning made easy – a tool for institutions and businesses

The generic scanning concept describes a basic procedure for replacement scanning according to BSI TR-03138 as a template for concrete implementation in companies and authorities. Possible implementation scenarios are presented on the basis of examples and hints for project practice are given.

Generic scan concept according to BSI TR-03138

Instructions for use

The purely informative application instructions provide assistance in practical application. They serve the interested reader for further information, but are not required for the implementation of a TR-03138 compliant scanning process. In particular, they are not subject to certification. There are currently four application notes.

Application note A (result of the risk analysis) and application note R (non-binding legal notes) document the preparatory work on which the technical guideline is based. In addition, application note V contains an exemplary process documentation. As a guideline, this contains a sample procedure description for replacing scanning in the form of an individually filled checklist. This provides assistance for the user in structuring a scanning process according to TR-03138. The new application note F summarises frequently asked questions (FAQs) about TR-03138.

Practical examples

Guideline: E-Scanning for Federal Authorities

Replacement scanning according to E-Government law (EGovG) and TR-RESISCAN

The aim of this practical guide is to support the authorities of the Federal Administration by providing practical assistance in the introduction of legally compliant replacement scanning. The guide was developed jointly by the Federal Ministry of the Interior (BMI) and the Federal Office for Information Security (BSI). Many other federal agencies have made a valuable contribution to this guide by providing information and experience.

Guideline: E-Scanning for Federal Authorities

The guide is supplemented by the following templates and samples, which are helpful in the efficient preparation of the necessary components of the process documentation in accordance with TR-03138:

Implementation of the transfer note (German Pension Insurance)

The measures defined in BSI TR-03138 are intended to enable the probative value of the scan product to be approximated as far as possible to the original. One measure in this regard is the keeping of a transfer note.

In the event of a legal dispute, the transfer note should make it possible to trace the course of the media break as well as the further process steps along the scanning process up to the evidence-proven storage, in order to draw a conclusion on the evidential value of the electronic image of a paper document.

The content and technical design is left to the respective user of the directive. The German pension insurance (Deutsche Rentenversicherung Bund) has developed an XML schema that can display all relevant information and can be used flexibly for any scanning project.

In the main document offered here as an example, the content of the transfer note is discussed in accordance with the content specified in the TR-01338. In the annexes, a scanned pension application illustrates the implementation in different formats.

Transfer note for scan products

Examples of transfer notes from the German Pension Insurance

Implementation of a protection needs assessment (Federal-State Commission for Information Technology in Justice (BLK))

The Federal-State Commission for Information Technology in Justice (BLK) commissioned its working group "Electronic Legal Transactions" to draft a common, cross-border definition of protection requirements for the replacement scanning. The result is the "Protection Needs Assessment for Replacement Scanning in Judicial Procedures on the Basis of TR-03138" (04.11.2015).

Protection Needs Assessment for Replacement Scanning in Judiciary based on TR-03138

Contact

The Federal Office for Information Security (BSI) is responsible for the supervision of this technical guideline:

Federal Office for Information Security
D 15 - eID solutions for digital administration
P.O. Box 20 03 63
53133 Bonn
E-mail: resiscan@bsi.bund.de

 

Similar topics

Back to Technical Guidelines