Category: Digital Preservation

Authenticity

Simply put

In records management, authenticity is the quality of a record being what it claims to be, created or sent by the person or system said to have done so, and at the time claimed. It gives users confidence that a record is genuine rather than altered, forged, or misrepresented. Establishing authenticity depends on being able to verify and trust these claims over time.

Formal definition

Authenticity is one of the core characteristics of an authoritative record, alongside reliability, integrity, and usability. It denotes the property of a record being genuine and verifiable: that it is what it purports to be, that it was created or transmitted by the purported agent, and that it was created or transmitted at the purported time. In information security terms, authenticity is closely related to confidence in the validity of a transmission, message, or originator (per NIST usage), though in recordkeeping it applies to the record as evidence rather than solely to a communication. Authenticity is typically supported through controls over creation, capture, and custody, and through documented metadata and audit trails that allow the record's provenance to be demonstrated. It should be distinguished from integrity, which concerns whether a record is complete and unaltered, and from reliability, which concerns whether a record can be trusted as an accurate representation of the activity it documents; a record may be unaltered yet still not authentic if its claimed origin cannot be verified. The specific evidentiary weight given to authenticity may vary by jurisdiction and sector.

Why it matters

Authenticity underpins the evidential value of records. When an organization relies on a record to demonstrate that an activity occurred, to support a decision, or to meet a legal or regulatory obligation, it is implicitly asserting that the record is what it claims to be and originated from whom and when it claims. If that assertion cannot be verified, the record's usefulness as evidence is diminished, regardless of how neatly it is stored or how complete its contents appear. Authenticity is therefore not an abstract quality but a practical condition for trust in recorded information.

A record may be complete and unaltered yet still fail the test of authenticity if its claimed origin or timing cannot be established. This distinction matters in contexts where the provenance of a record is contested, such as litigation, audits, freedom of information requests, or regulatory investigations. The evidentiary weight attached to a record, and the standards used to test its authenticity, typically vary by jurisdiction and sector, so professionals should treat authenticity as something to be demonstrated through controls and documentation rather than assumed.

Because authenticity must be sustainable over time, it is closely tied to how records are created, captured, and kept in custody. As systems change, formats become obsolete, and custody is transferred, the chain of evidence that supports an authenticity claim can weaken if it is not deliberately maintained. Organizations that neglect this often find that the value of their records erodes not through deliberate tampering but through the gradual loss of the metadata and context needed to prove genuineness.

Who it's relevant to

Records managers

Records managers are responsible for the controls over creation, capture, and custody that allow authenticity to be established and maintained. They design and oversee the metadata and audit trail practices that document a record's provenance, and they must ensure these practices persist as systems, formats, and custody arrangements change over time.

Information governance officers

Authenticity is one of the properties that gives recorded information value as evidence, and information governance officers are concerned with the policies and accountability frameworks that make it sustainable. They typically consider authenticity alongside integrity, reliability, and usability when setting expectations for how records are managed across the organization.

Archivists

Archivists depend on being able to demonstrate the provenance and custodial history of records held for long-term or permanent retention. Because authenticity must be preserved as records outlive the systems that created them, archivists focus on maintaining the context and metadata that allow a record's genuineness to be re-established well into the future.

Compliance and legal teams

Where records are relied upon in litigation, audits, or regulatory processes, the ability to demonstrate authenticity can affect their evidentiary weight. Because the standards applied and the weight given typically vary by jurisdiction and sector, compliance and legal professionals often need to assess how authenticity can be shown for records relevant to a particular matter rather than assuming it.

Inside Authenticity

Identity

The property that a record is what it purports to be, attributable to a known creator or source and associated with a specific activity, context, and point in time. Establishing identity typically depends on metadata capturing authorship, provenance, and the circumstances of creation.

Integrity

The condition that a record is complete and unaltered, or that any authorized changes are documented and traceable. Authenticity depends in part on integrity, since a record whose content cannot be shown to be intact is harder to establish as genuine, though the two properties are distinct.

Provenance and chain of custody

Documented evidence of a record's origin and the sequence of its custody and handling over time. An unbroken and well-documented custodial history typically strengthens claims to authenticity, particularly where records move between systems or custodians.

Metadata

Contextual and structural information, such as creator, date, format, and links to related records and business activity, that supports assertions about a record's identity and the conditions under which it was created and maintained. Persistent, reliable metadata is often central to demonstrating authenticity over time.

Presumption and verification

Authenticity is often supported by a presumption arising from trustworthy recordkeeping systems and controls, and may also be established through verification against corroborating evidence. It is a claim to be demonstrated rather than an inherent, self-evident quality of the record.

Common questions

Answers to the questions practitioners most commonly ask about Authenticity.

Is authenticity the same as accuracy, meaning an authentic record must contain true or correct information?

No. Authenticity concerns whether a record is what it purports to be, that it was created or sent by the person claimed, at the time claimed. It does not speak to whether the content is factually accurate or truthful. A record can be authentic while containing errors or false statements, because authenticity addresses provenance and identity rather than the correctness of the information recorded.

Does confirming a record's authenticity also confirm that it has not been altered?

Not on its own. Authenticity and integrity are distinct but related properties. Authenticity addresses whether a record is genuinely what it claims to be and who created it, while integrity addresses whether the record remains complete and unaltered over time. A full assessment of a record's trustworthiness typically considers authenticity alongside integrity, reliability, and usability rather than relying on authenticity in isolation.

How can an organization establish and maintain the authenticity of records over time?

Authenticity is typically supported by controls applied from the point of creation or capture through the record's life, including documented policies and procedures governing how records are created, transmitted, maintained, and managed. Capturing and preserving metadata about origin, authorship, and custody, and controlling who can create or handle records, all contribute. Because authenticity can be more difficult to demonstrate for records that have passed through many hands or systems, maintaining an unbroken and documented chain of custody is often central.

What metadata helps demonstrate that a record is authentic?

Metadata that documents the record's origin and management context is generally most relevant, such as information about who created or sent the record, when it was created or received, and how it has been maintained and moved between custodians. The specific metadata elements captured often depend on organizational policy, the recordkeeping system in use, and any applicable standards or sector requirements.

How does authenticity apply to copies and drafts rather than the authoritative record?

Authenticity questions apply differently across an authoritative record, a copy, and a draft. Establishing which instance is the authoritative record, and distinguishing it from copies, working drafts, or transitory information, is often a precondition for assessing authenticity meaningfully. Organizations typically manage this through classification and controls that identify the record of authority and govern how copies and drafts are handled.

How should authenticity be handled when records are migrated or converted between systems or formats?

Migration and format conversion can create risks to a record's authenticity, since the process may affect how origin and custody are demonstrated. In practice, organizations often address this by documenting the migration process, preserving associated metadata, and maintaining evidence of the chain of custody through the change. The appropriate approach depends on organizational policy and any applicable standards, and it is generally prudent to plan for these risks before migration rather than after.

Common misconceptions

Authenticity and integrity are the same thing.

They are related but distinct properties. Integrity concerns whether a record is complete and unaltered, while authenticity concerns whether the record is what it purports to be and comes from its claimed source. A record can have its integrity intact yet still have contested authenticity, and vice versa; both, together with reliability and usability, contribute to a record's trustworthiness.

A digital signature or encryption automatically makes a record authentic.

Technical controls can support claims to authenticity and integrity, but authenticity is not conferred by any single mechanism. It typically rests on the broader trustworthiness of the recordkeeping system, reliable metadata, and documented provenance and custody, and its evidential weight depends on organizational policy and the applicable jurisdiction and sector.

Authenticity is a fixed property established once at creation.

Authenticity must often be maintained and demonstrable throughout a record's lifecycle, especially as records are migrated, converted, or transferred between systems and custodians. Maintaining it typically depends on sustained controls, persistent metadata, and a documented chain of custody rather than a one-time determination.

Best practices

Capture and preserve reliable metadata about creator, provenance, context, and date at the point of creation or capture, since these underpin later claims to authenticity.

Maintain documented chain of custody and provenance as records move between systems, formats, or custodians, so that authenticity can be demonstrated rather than merely assumed.

Implement controls that protect and evidence integrity, and record any authorized changes in a traceable manner, recognizing that integrity supports but does not by itself establish authenticity.

Rely on the demonstrable trustworthiness of the overall recordkeeping system rather than any single technical mechanism, and document the controls that give rise to a presumption of authenticity.

Plan for maintaining authenticity across the full lifecycle, including migration and format conversion, so that these processes do not undermine the record's identity or evidential value.

Align authenticity requirements with applicable organizational policy and relevant jurisdictional and sector obligations, treating evidential expectations as variable rather than uniform.