There are a couple of different possible approaches to this. If you keep the electronic records (scanned documents) for reference only, and retain the paper documents for use in legal actions, then how you hold the electronic records doesn't really matter. If you are planning on using the electronic records in legal action at a later date, then they need to be scanned and held in accordance to the BSI BIP0008:2004 standard. Basically sumerised as ensuring the Authenticity and Integrity of the scanned material once it is on file. Your problem is that there is no relevant case law (that I can find on this), so you are into a risk management exercise. (the one case that used electronic evidence in a contractual dispute, did not challenge the authenticity or integrity of the electronic documents presented) Use of write-once media e.g. CD-R (not RW) makes life easier, but if you take the files off of Hard Disk storage, the access times increase rapidly. You also need to bare in mind the CD-R's (and most other WORM technogies) are not permanent, and they will need to be included in a refresh cycle (i.e. re-created at periodic intervals e.g. 5 years) The recomended approach would be to seek out an EDMS/EDRMS specialist, and discuss this with your local IT and Legal departments to cover the risks and issues that arrise. On a cost benefit basis disk drives are cheaper (and getting even more cheaper) than any physical storage method. You may also wish to consider historic value of the information in addition to it's direct enforcement usage, but this needs to be counter balanced by obligations under the Data Protection Act.
