Essential Records 1

What are Essential Records? Defined by Arizona State Statute §41-151.12(4) (a) Records containing information necessary to the operations of government in the emergency created by a disaster. (b) Records containing information necessary to protect the rights and interests of persons or to establish and affirm the powers and duties of governments in the resumption of operations after a disaster. May also be referred to as Vital Records

What Are Essential Records? (contd.) 5 core types of essential records: Are necessary for emergency response Are necessary to resume or continue operations Protect the health, safety, property, and rights of residents Would require massive resources to reconstruct Document the history of communities and families Essential records can be found in any format and in any medium.

Differentiate Essential Records from Other Records Only a small percentage of records are essential, typically less than five percent. Its critical value during and/or after an emergency makes a record essential. As disruption time increases, more records become essential.

Which of Your City/Town’s Records Are Essential? Essential records differ by department. Each department must determine which of its records is or are essential. What you need to know to identify essential records: Your department’s essential functions The stakeholders Your department’s records Relevant statutes, regulations, and standards

Know Your City/Town’s Essential Functions Identification of essential records starts with understanding essential functions.

Know the Stakeholders Who depends on you? Who do you depend on? Individuals Other departments Outside organizations Who provides mission-critical support? Information technology Human resources Legal and accounting Emergency management, COOP

Know Your City/Town’s Records Importance of a good records management program Records inventories Records retention schedules

Know Relevant Statutes, Regulations, and Standards Statutes and ordinances that apply to your locality. Regulations issued by federal, state and local governments. Standards from federal agencies and national organizations. Guidance from state and federal agencies, professional and industry associations.

Determine Essential Functions During an emergency, essential functions: Provide vital services Exercise civil authority Maintain the safety and well-being of the general population Sustain the jurisdiction’s industrial economic base Essential functions must continue under all circumstances. 10

Steps to Determine Essential Functions Step 1: Identify and Analyze Your Department’s Business Functions Review the city/town and departmental statements, internal directives, laws, and/or regulations that may pertain to your department’s mission. Check with IT and Emergency Management Answer the following: What business functions are performed by your department? What are the statutory or legal requirements? What are the program responsibilities? What functions not normally performed by your department might be required in an emergency? What are the requirements in your COOP Plan, if any?

Steps to Determine Essential Functions (cont’d.) Step 2: Determine the Essential Business Functions Is there anything that your department does that is critical? Which of these critical functions are performed only by your own department? Is there an alternative method of carrying out those functions during the emergency and recovery periods? After eliminating the business functions for which there are alternative methods of support, what functions are left? These are your essential business functions.

Steps to Determine Essential Functions (cont’d.) Step 3: Determine the Essential Records That Support Those Functions Do you consider any of these records to be invaluable? Are there records that you create or maintain that the public would need in an emergency? How soon would you need access to duplicates of these records? Think about what records your department creates or maintains that may be essential to other agencies or emergency services. Check the records that support essential functions against the five core types of essential records.

Interview Stakeholders Interview key stakeholders and staff to get information about essential functions. Ask specific and pointed questions: Yes: “What if you didn’t have access to that series of records for 24 hours?” No: “How long could you operate without that series of records?” You may also want to use a questionnaire to gather information. 14

Protect Essential Records

Risk Assessment — Types of Risks Risks from loss of agency memory Can be physical loss or intellectual loss Risks related to emergencies Natural emergencies Technological emergencies Civil emergencies Risks related to records management Legal Security Business Accountability Technology Long-term preservation of records

Risk Assessment — Scope of Emergency Onsite Immediate vicinity Community- or region-wide Photo courtesy of NARA

Factors to Consider When Assessing Risk Existing risks to records Physical location of the essential records Security and controls already in place Vulnerable areas Timing

Risk Analysis — Method to Evaluate Risks Establish a rating system: Probability rating Impact rating Rate your risks. Evaluate your findings.

Step 1: Establish a Rating System Probability Rating Scale Criterion High The event is expected to occur. Medium Similar events have occurred in the past. Low The event has little chance of occurring. Impact Rating Scale Criterion High Catastrophic impact; devastating loss. Medium Serious/critical impact; significant loss. Low Minor/marginal impact; some loss.

Step 1: Establish a Rating System (cont’d.) Compile ratings to create your rating system Risk Analysis Rating System High Catastrophic impact; devastating loss The event has little chance of occurring. Similar events have occurred in the past. The event is expected to occur. Medium Serious/critical impact; significant loss Low Minor/marginal impact; some loss Impact of Risk Probability of Risk

Step 2: Rate Your Risks Rate each risk identified in your risk analysis. Example: Essential records in 2nd-floor procurement office—identified risks: Debris blocking access to cabinets Debris and water from storm Mold and mildew Temperature and humidity—unstable environment Loss of data Fire damage Inability to access data Inability to communicate

Step 2: Rate Your Risks (cont’d.) Identified Risk Probability Impact 1. Debris blocking access to cabinets High 2. Debris and water from storm 3. Mold and mildew Medium 4. Temperature and humidity—unstable environment 5. Loss of data 6. Fire damage Low 7. Inability to access data 8. Inability to communicate

Step 3: Evaluate Your Findings Determine your threshold for action Risk Analysis Rating System High Catastrophic impact; devastating loss The event has little chance of occurring. Similar events have occurred in the past. The event is expected to occur. Medium Serious/critical impact; significant loss Low Minor/marginal impact; some loss = Action = No action Impact of Risk Probability of Risk

Managing the Risk: Prioritizing Actions To prioritize your actions, rank the risks that require action. When prioritizing, consider: Cost to reconstruct the data Cost of defending against legal actions associated with loss

Document the Risks Document the results of your risk assessment, risk analysis, and prioritizing. Prepare a strategy to communicate your findings to your City/Town leaders so they can address the risks as: Part of the COOP planning Part of the essential records program planning Part of emergency planning Part of records management and information technology planning

Strategies for Handling Risk Acceptance Mitigation Consider the different formats available and the cost associated with each Photo courtesy of Tina Seetoo, Georgia Archives

Duplication of the Original Records Duplication formats: Microform Digital formats Backup tapes Paper

Storage of Essential Records On-site storage options: Vaults Secure central file rooms Fire-resistant containers Off-site storage options: Another office Agreement with another city/town Commercial storage facility “Hot” and “cold” sites Photo courtesy of NARA

Make Essential Records Available Cities/Towns must be prepared to access their essential records. Retrieval procedures should require only routine effort. All equipment needed to read essential records must be available.

Access Essential Records 31 31

Priority Levels and Timeframes for Accessing Essential Records Priority 1—First 12 hours Needed immediately, to respond to the incident Necessary to resume or continue operations Priority 2—First 12–72 hours Needed to manage the incident and resume operations Protects the health, safety, property, and rights of residents Priority 3—After first 72 hours Needed to continue essential functions and for long-term recovery Requires massive resources to reconstruct Documents the history of communities and families

Access Priorities Table Level Definition Access Examples Timeframe for Access Priority 1 Records essential for response and emergency operations and therefore needed immediately Physical protective storage is close to disaster response site for immediate access. Electronic replication methods are available for immediate access to information. Emergency action plan Business continuity plan Vital records manual Current facility drawings Personnel security clearance files Within the first 0–12 hours *Store in close proximity Priority 2 Records essential for quick resumption and continuation of business following an emergency Physical protective storage is close to disaster recovery site for quick business resumption. Electronic methods are quickly accessible, and backups can be quickly restored. Current client files In-progress Accounts Payable and Accounts Receivable Research documentation Current contracts and agreements Within the first 12–72 hours Priority 3 Records needed to continue essential functions if normal agency information were unavailable for a prolonged period Physical protective storage is accessible and outside of the disaster area. Accounts Payable and Accounts Receivable files Existing contracts and agreements Unaudited financial records After the first 72 hours This chart is based in part on ARMA International, ANSI-ARMA 5-2003 Vital Records: Identifying, Managing, and Recovering Business-Critical Records

“Grab and Go” Kits Certain City/Town officials will be on call immediately following the emergency. They should have “Grab and Go” kits that contain specific essential records. Develop procedures to keep “Grab and Go” kits up-to-date Use cycling to replace records that are changing to ensure you have current information

Develop Procedures to Ensure Access to Essential Records To ensure access, City/Towns should develop and document: Policies Delegations of authority Responsibilities of agency officials Procedures governing the essential records program Incorporate your essential records into your COOP plan

Don’t Forget Your Stakeholders Your network of stakeholders is invaluable for integrating your essential records emergency planning with your current COOP Plan COOP Manager Emergency Managers Agency head IT director Legal and accounting staff Records management personnel Custodians of archival records Agencies or outside organizations

Records Emergency Planning and Response

Overview of Emergency Planning and the REAP 38 38

Phases of Emergency Management

Federal Guidance on Emergency Preparedness and Response National Response Framework (NRF) National Incident Management System (NIMS) Incident Command System (ICS) Developing and Maintaining State, Territorial, Tribal, and Local Government Emergency Plans—Comprehensive Preparedness Guide 101 (CPG 101) FEMA Continuity Guidance for Non-Federal Entities Continuity Guidance Circular 1 (CGC1) Continuity Assistance Tool (CAT)

Emergency Response—How it Works at the Local Level Response always starts at the local level. Each state government has its own emergency response plan. Several levels of government may become involved. NIMS ensures that all responders are operating and communicating under the same protocols for incident management. ICS ensures a clear chain of command. CGC1 and CAT ensure that operations will resume.

What is a Records Emergency Action Plan (REAP)? A REAP is a written, approved, implemented, and periodically tested plan that includes the information and actions needed to respond to and recover from a records emergency. All response and recovery players should participate in developing, approving, and testing the plan. The REAP is part of a larger disaster plan. It is not the disaster plan itself; it is only an element of the plan. The portion of your disaster plan that includes records

Six Keys to Successful Response and Recovery A detailed REAP Committed management Educated and trained staff Timely initial response Effective communication Quick, informed decisions 43

Preparing a Records Emergency Action Plan 44 44

Identify the Disaster Plans and People Relevant to Your City/Town Identify the disaster plans in place so your REAP can: Tie into those plans most effectively Address any records-specific shortcomings they may have Identify and meet your emergency planning personnel to inform them about your REAP planning project.

Forming an Action Team Identify the members: Assign responsibility. Select staff who are flexible and capable of performing well under pressure. Select employees at all levels. Select employees who represent all functions. Assign responsibility. Select team leadership.

Components of the REAP Introduction Financial or Funding Information Policy Statement Responsibilities and Authorities Communication Plan Emergency Contact Directory Locations of Essential Records Records Salvage Priorities Supplies Financial or Funding Information Vendors and Suppliers Contractor Statement of Work Facility Information Staging Space Preparedness, Response, and Recovery Procedures Training, Testing, and Updating Appendixes

Introduction States the purpose of the REAP and the entire preparedness program Includes information about: The scope of the plan (what functional units it covers) How to use the document The date of creation or revision How to revise the document

Policy Statement A clear, dated policy statement or directive From the most senior officer in the agency Approves the plan and identifies it as an official agency policy

Responsibilities and Authorities Delegation of authority and chain of command Roles and responsibilities for various activities REAP Teams Records Response and Recovery Manager Other assignments

Communication Plan Identify multiple communication strategies to be used during an emergency. List the modes of communication to be used during an emergency. Include Phone Tree and emergency contact directory.

Emergency Contact Directory Include: Agency staff Emergency responders Facility contractors Key parent agency staff, other administrative contacts Insurance providers Salvage and restoration vendors and contractors Other contacts

Locations of Essential Records Include the essential records inventory. Necessary information: Title Location Retention period Container ID Format and media Volume Location of master copy (if one exists)

Records Salvage Priorities Prioritize records for recovery in an emergency. Determine which records will require attention first, and which ones can wait. Essential records and permanent records have priority. Temporary records should be prioritized based on their retention period. Organized in three parts: First Priority Second Priority Third Priority Photo courtesy of NARA

Supplies List supplies you may need in the event of an emergency. Supplies needed to prevent further damage to records Supplies needed to aid in packing out records for further recovery Include where to purchase the supplies. Document the location(s) of the supplies. List contractors for food, water, and personal care supplies.

Financial or Funding Information How to obtain funds that may be required Tracking system for expenses Establish special codes for labor, equipment, and supplies.

FEMA/Win Henderson—New Orleans—2005 Vendors and Suppliers List vendors and suppliers of records emergency services and supplies. Consider developing standing contracts. FEMA/Win Henderson—New Orleans—2005

Statement of Work, Contract, and Memorandum of Understanding A generic draft Statement of Work (SOW), ready to use Obtained from your Procurement Office Signed contracts or Memorandums of Understanding (MOU)

Facility Information Provide all relevant facility information: Evacuation plans Location of, operating instructions for, and/or shutoffs for electrical systems, water sources, HVAC systems, etc. Locations of keys, hazardous materials, etc.

Staging Space Identify and make arrangements for use of building space. Keep contact information up-to-date. Outline: The procedures you will use to transfer or obtain office equipment and supplies The services you will need (electricity, water, communications, computers, etc.)

Preparedness, Response, and Recovery Procedures This is the largest and most detailed section of your REAP. Detail the procedures covering each phase of the emergency: Preparedness Response Recovery Indicate when an emergency status is upgraded from one phase to the next.

Assessment Team Roles and Responsibilities Assessment Team consists of the people knowledgeable about the facility, the emergency response, and the records involved. When establishing the Assessment Team: Detail specific responsibilities. Outline clear lines of authority. Remember that one person may play more than one role. 62

Response Team Roles and Responsibilities Response Team members may be responsible for: Separating records Moving records Packing records Drying material Maintaining tracking logs Maintaining documentation of records Labeling records Labeling or relabeling boxes

Training, Testing, and Updating Document the goals and objectives. Document specific training programs for responders and specialized teams. Testing Document the testing goals and objectives. Document the schedule and plan for conducting testing activities. Updating Document any changes made to the REAP. Indicate who will be responsible for distributing updated versions.

Appendixes Information which is needed for the effective execution of the REAP, but which should be kept separate from the main narrative of the Plan

“dPlan” Pocket Response Plan (PreP) Heritage Preservation’s Field Guide and Wheel

Distribute the REAP After management approval, the REAP is ready for distribution. Each team member should receive all or part of the REAP. Protect confidential information.

Promote the REAP All employees need to know their roles in implementation in the event of an emergency. Possible promotion methods: Agency newsletter Intranet Periodic emails Staff meetings Training

Train REAP Team Members and All Personnel REAP Teams need training specific to their roles. Some functions may require special training. Train team alternates. All agency personnel must have an orientation to the REAP.

Test and Validate the REAP A REAP is not effective unless it is tested and validated. The object is to validate and improve the REAP. Testing should occur at least annually. Methods include: Drill Tabletop activity Functional activity Full-scale activity Include all REAP Team members.

Review and Update the REAP Regularly review and update information contained in the REAP to ensure that it is accurate and current. Establish a schedule. Regularly check and update all dynamic data, especially in appendixes. Distribute updates immediately.

Resources for Help IPER Resource Center: http://www.statearchivists.org/resource- center/iper Federal agencies and programs State agencies and programs Non-governmental agencies Regional conservation centers Commercial vendors Response and recovery procedures for each region, state, or locale