Vital Records Management Briefing Draft: March 2007 DRAFT

Vital Records

Management Briefing

Draft: March 2007

DRAFT

Why Are We Here?

(Include a joint introduction here provided by FEMA/NARA to set the

stage for this briefing?)

Disasters and Records

Restoration Services Northridge Earthquake

Fort Worth, Texas Tornado

World Trade Center, 9-11-01

Photographs www.September11News.com

Hurricane Katrina Orleans Parish Courthouse

Pack-out begins as records are pulled from the Courthouse

Wet, moldy records on the floor. Paths had to be cleared to start work.

Wet, moldy records from the bottom to the top

Records were often found in heaps

Removing Hard Drives (above)

Contractor pulls records from Courthouse for triage

Hurricane Katrina Success Story

USDA National Finance Center

Vital Records & COOP

Laws, Regulations, and Guidance

44 U.S.C. 3101, assigns to agency heads responsibility for the proper management of records

Executive Order 13231, Critical Infrastructure in the Information Age, assigns roles and responsibilities for the protection of critical information systems.

Federal Preparedness Circular 65, explicitly requires the agency COOP to incorporate vital records planning

36 CFR 1236, Management of Vital Records lays out in detail the elements of a comprehensive program.

What are Federal Records?

The definition of a record, according to the Federal Records Act, is:

"...all books, papers, maps, photographs, machine-readable materials, or other documentary materials, regardless of physical form or characteristics, made or received by an agency of the U.S. Government under Federal law or in connection with the transaction of public business and preserved or appropriate for preservation by that agency or its legitimate successor as evidence of the organization, functions, policies, decisions, procedures, operations, or other activities of the Government or because of the informational value of the data in them." (44 U.S.C. 3301, Definition of Records)

Where are Records Found?

What are Vital Records?

Vital records mean essential agency records that are needed to meet operational responsibilities under national security emergencies or other emergency or disaster conditions (emergency operating records), or to protect the legal and financial rights of the Government and those affected by Government activities (legal and financial rights records)

Record Value Scale

IMPORTANT

USEFUL

NONESSENTIAL

3%–7%

50%–75%

15%–25%

20%–30%

VITAL

Type I Emergency Operating Records

Records needed to resume and/or continue operating during an emergency or disaster

– Emergency plan, Delegation of Authority, building plans, system manuals, files plans/records locations, vital records inventories, and equipment inventories

Type II Legal and Financial Rights Records

Records needed to re-create legal and financial operations and safeguard the interests of the organization, its employees, and its clientele

– Accounts receivable– Social Security, payroll, and retirement– Land titles, deeds, treaties, leases, contracts, insurance, licenses– Research findings, licensing and compliance, product

development– Obligations whose loss would pose significant risk

Legal and Financial Rights Records

An Effective Vital Records Program

Issuance of a directive establishing the program, assigning responsibilities, and instituting vital records policies

Provides for staff training

Requires periodic review and testing

Official establishment of the program and assignment of responsibility:

An Effective Vital Records Program

Provides for:

Identification.

Protection.

Ready availability.

Identification

First, determine the essential functions that the agency must continue to perform under adverse operating conditions

Then, analyze and prioritize your agency and departmental essential functions

Next, conduct a records inventory to identify the mission-critical data and vital records that support those functions

Tools for Identifying Vital Records

Mission and departmental functional statements

Recordkeeping policies and procedures

Critical agency functions as stated in COOP Plan

Inventories

File plans

Records schedules

Identification

Maintain a complete inventory of records

Including the location of the records

With complete access information

Protection

Identify the risks involved if vital records are retained at their current locations and in their current media—and the difficulty of reconstituting them if they are destroyed.

Risk Assessment

Protection

Selection of appropriate protection methods, including: Automatic/Routine Dispersal

Planned Dispersal

Duplication/Copying– Formats– Microform– Digital formats– Backup tapes– Paper

Vital Records Storage Considerations: Needed during and immediately following a

disaster/emergency

– Store those vital records in close proximity to your office and have 24-hour availability (which may mean storage at a "hot" site, and storage in a format that does not rely on special equipment to read the records)

You might not need your legal and financial rights records as quickly

– These records might be stored in facilities farther away with less need for quick access

Protection

Protection

Examples of Storage Options: On-site storage in vaults, fire-resistant containers, or secure central

file rooms

Off-site storage at another office, in a Federal Records Center, in a "hot" or “cold” site, in a commercial storage facility

Things to Consider When Choosing Off-Site Storage

Equipment and electricity may be needed to read the records

Off-site facilities chosen by your agency must meet standards in accordance with NARA regulations—36 CFR 1228.156

The facility should have 24-hour security and be environmentally controlled (temperature and humidity)

The facility should allow 24-hour access by appropriate agency officials

The facility should be inspected for water leaks along walls and floors, and around windows

The facility should have fire suppression and/or smoke detection systems that are connected to local emergency officials

Cost of storage may depend on the volume of vital records and the storage format

Protection - Electronic Vital Records

Are vital and non-vital electronic records being backed up en masse with no distinction between the two?

Backup data frequently, on a scheduled basis, and store at COOP sites and on redundant systems as applicable.

Encourage users to save vital records to the server and not their hard-drives.

Protection - Electronic Vital Records

Ensure appropriate IT infrastructure at alternate site(s) to support critical information systems and data.

Provide computer system documentation at the alternate site.

Select personnel (primary/backup) for the IT support team based on their normal responsibilities, system knowledge, and availability to recover systems on an on-call basis.

Protection - Electronic Vital Records

Implement security procedures and enforce virus scans and updates.

Identify preventive controls to mitigate outage impacts.Uninterruptible power supply (UPS)Fire suppression systemsGasoline or diesel-powered generatorsAir conditioning systems with excess capacity to overt the failure

of certain componentsHeat-resistant and waterproof containers for backup media

Protection - Electronic Vital Records

Determine the appropriate protection strategy for your vital records (tape backup vs. remote data replication, use of multiple techniques, etc.)

Commit to ongoing hardware/equipment upgrades and software migration for the long haul as part of the vital records program

Ready Availability

An appropriate medium for accessing vital records within 12 hours of COOP activation:

LAN

Vital electronic records

Critical information systems and data

Internal and external e-mail and archives

Vital hardcopy records

Ready Availability

Procedures for Routinely Updating Vital Records:

Cycling needs to be part of the plan

Cycling may be done on a daily, weekly, quarterly, or annual basis—depending on the need

Development of Procedures to Ensure Access:

Availability of critical information is crucial to the continuation of operations. Therefore, agencies must develop procedures for the use of vital records during an emergency

Document the policies, authorities, and responsibilities of agency officials, and procedures governing the vital records program, in appropriate issuances such as directives or procedural manuals

Ready Availability

Ready Availability

Development and maintenance of a vital records packet that includes:

A list of key personnel and disaster staff with up-to-date telephone numbers.

A vital records inventory with precise locations of all vital records.

Necessary keys and/or access codes.

Alternate operating facility locations.

Training

Development of training for all involved staff:

Periodic briefings to managers

Staff training

Testing

Testing capabilities for:

Protecting classified and unclassified vital records and databases.

Providing access to vital records from alternate operating facilities.

Testing and drills serve to assess, validate, or identify for subsequent correction all elements of the vital records program

Program Review

Periodic program review that:

Addresses new security issues.

Updates information.

Identifies additional vital records.

Provides an opportunity to familiarize staff with the program.

Questions?

Contact Information:

Designated NARA Contact

Designated FEMA Contact