1. Emergency Preparedness for Government Records Texas State Library and Archives Commission State and Local Records Management Division P.O. Box 12927, Austin, TX 78711-2927 (512) 463-7610 | slrminfo@tsl.state.tx.us www.tsl.state.tx.us/slrm/

2. Agenda  Records emergencies in Texas  Records management basics  Legal obligations  Essential records – how to identify, protect, and ensure access  Records emergency planning and response – how to prepare for and recover from a records emergency

3. Government Record  Created or received by a local government, officer, or employee in transaction of public business; or by or on behalf of a state agency or an elected state official documenting activities in the conduct of state business or use of public resources  Any medium – paper, letter, book, map, photograph, audio, video, microform, magnetic tape, electronic  Open or confidential information

4. Does not include the following:  Convenience copies  Copies of documents furnished to the public (Public Information Act)  Blank forms/stocks of publications  Library or museum materials  Alternative Dispute Resolution working files

5. Records Emergencies in Texas

6. Tornadoes March 2000 (Fort Worth) Photo: Associated Press

7. Tornadoes May 27, 1997 (Cedar Park) Photo: Associated Press

8. Wildfires December 26, 2005 - April 1, 2006 (Northeastern Panhandle) Photo: Associated Press

9. Wildfires September 4 – October 10, 2011 (Bastrop County) Photo: Victoria Yarbrough

10. Floods Severe storms, flooding across 29 counties, 2002 (Bexar County) Photo: Texas State Library and Archives Commission / Steve Drake

11. Tropical Storms Tropical Storm Allison, June 2001 (Houston) Photo: Houston Chronicle / Dr. Neil Frank

12. Hurricanes Hurricane Ike, 2008 (Galveston) Photo: Mark Wilson/Getty Images North America

13. Newton County (2000) Courthouse Fires Photo: Texas Association of Counties

14. Power Outages Hurricane Dolly, July 2008 (South Padre Island) Photo: EPA/Bob Pearson

15. Security Breaches  Hackers:  University of Texas at Arlington – prescription records & SSNs of 27,000 individuals potentially exposed to unauthorized source  Houston teenager hacked into protected computers of federal agencies (White House, U.S. Army), a community college, & large telecommunications firms – estimated $1.5 million in damages  Computer Virus:  Texas Tech Health Sciences Center website down 24 hours due to virus that slipped past anti-virus software

16. The Basics  Information is an asset  Risks related to emergencies  Emergencies are not the same for everyone  Active records management is crucial  Routine disposition

17. Emergencies  Natural  Hurricanes  Floods  Technological  Building or equipment failures  Electrical malfunctions  Civil  Arson  Vandalism  Terrorism

18. Legal Obligations  Local governments’ duties:  Essential records program  Local Government Code, Chapter 203.021(5)  Emergency management program  Government Code, Chapter 418 (Texas Disaster Act of 1975)  State agencies’ duties:  Vital records program  Government Code, Chapter 441.183(4)  Emergency management program  Government Code, Chapter 418 (Texas Disaster Act of 1975)

19. C ontinuity o f Op erations (COOP ) The 11 elements of viable COOP capability:  Essential functions  Vital (Essential) records  Orders of succession  Delegations of authority  Alternate facilities  Interoperable communications  Human capital  Tests, training, and exercises  Devolution  Reconstitution  Written COOP Plan

20. Essential Records

21.  Definition  How to identify  How to protect  How to ensure access in the event of an emergency

22. What are Essential Records?  Records that are needed to:  Resume or continue operations  Re-create legal and financial status  Protect and fulfill obligations to the people of the state Local Government Code, Section 201.003(5)

23. Resume or Continue Operations  Examples:  Delegations of authority  Rules, policies, and procedures  Prison, jail, and parole records  Maps and building plans (as-built plans)  Emergency or COOP plan

24. Re-create Legal and Financial Status  Examples:  Contracts and leases  Accounts receivable / payable  Insurance records  Payroll

25. Protect & Fulfill Obligations to the People of the State  Examples:  Deeds, mortgages, land records  Birth and marriage records  Active court proceedings  Voting records Birth records, Brownsville City Hall storage vault

26. How To Identify Essential Records  Need to differentiate essential records from other records  Less than 5% of all government records are essential

27. How To Identify Your Essential Records  Factors to consider: 1. Your essential functions 2. Your records 3. Your stakeholders 4. Relevant statutes, regulations, and standards

28. 1. Essential Functions  During an emergency, essential functions:  Provide vital services  Exercise civil authority  Maintain safety and well-being of the general population  Sustain the jurisdiction’s industrial economic base  Must continue under all circumstances

29. Determining Essential Functions  Analyze your business functions:  What business functions must you continue to perform?  Which of those functions are performed only by you?  Is there any alternative method of carrying out those functions?  All remaining functions are your essential functions

30. 2. Your Records  Importance of a good records management program  Records inventories  Records retention schedules

31. 3. Stakeholders  Know your stakeholders  Who depends on you?  Who provides mission-critical support?  Interview stakeholders  What if you didn’t have access to that information for 24 hours or longer?  How long could you operate without those records?

32. 4. Relevant Statutes, Regulations and Standards  Statutes and ordinances that apply to your organization  Regulations issued by state and local governments  Standards from federal agencies and national organizations

33. Photo: Ross Tuckerman/AFP/Getty Images

34. How To Protect Essential Records  Identify and evaluate hazards and risks  Determine and evaluate preparedness and mitigation measures

35. Identify and Evaluate Hazards and Risks  Hazard  Risk Pipes over filing cabinets = HAZARD Wet records = RISK

36. Risk Assessment Techniques  Expert interviews  Brainstorming – “What if?”  Site survey

37. Site Survey  Environmental  Physical  Personnel  Information security  Preparedness Above: Boxcar storage: environmental and physical risks Left: Restricted access areas on the computer network improve information security

38. Risk Analysis 1. Establish rating system 2. Rate your risks 3. Evaluate your findings

39. 1. Establish Rating System  Probability rating  Impact rating

40. R ISK A NALYSIS R ATING S YSTEM Impact of Risk High Catastrophic impact; devastating loss The incident has little chance of occurring. Catastrophic impact; devastating loss Similar incidents have occurred in the past. Catastrophic impact; devastating loss The incident is expected to occur. Medium Serious/critical impact; significant loss The incident has little chance of occurring. Serious/critical impact; significant loss Similar incidents have occurred in the past. Serious/critical impact; significant loss The incident is expected to occur. Low Minor/marginal impact; some loss The incident has little chance of occurring. Minor/marginal impact; some loss Similar incidents have occurred in the past. Minor/marginal impact; some loss The incident is expected to occur. LowMediumHigh Probability of Risk

41. 2. Rate Your Risks  Rate each risk identified  Examples:  Water damage  Theft  Mold and mildew IDENTIFIED RISKPROBABILITYIMPACT 1. Water damage due to pipe leak in records storage area High 2. Theft of records due to unsecure vault door LowHigh 3. Mold due to temperature and humidity— unstable environment Medium

42. 3. Evaluate Your Findings  Determine your threshold for action =Action R ISK A NALYSIS R ATING S YSTEM Impact of Risk High Catastrophic impact; devastating loss The incident has little chance of occurring. Catastrophic impact; devastating loss Similar incidents have occurred in the past. Catastrophic impact; devastating loss The incident is expected to occur. Medium Serious/critical impact; significant loss The incident has little chance of occurring. Serious/critical impact; significant loss Similar incidents have occurred in the past. Serious/critical impact; significant loss The incident is expected to occur. Low Minor/marginal impact; some loss The incident has little chance of occurring. Minor/marginal impact; some loss Similar incidents have occurred in the past. Minor/marginal impact; some loss The incident is expected to occur. LowMediumHigh Probability of Risk

43. Preparedness and Mitigation Measures  On-site protection  Dispersal  Evacuation  Tape backup  Data replication  Mirroring Image: “The History of Tape Storage” http://flic.kr/p/4HYNgX

44. How To Ensure Access to Essential Records  Prioritize access  Develop procedures

45. Prioritize Access  Based on the type of essential record: Priority 1: First 0-12 hours Priority 2: First 12-72 hours Priority 3: After first 72 hours Emergency and/or COOP plans Maps and building plans Delegations of authority Active court proceedings Bail bond forfeitures Contracts & leases Inactive case papers Historical photographs Medical records

46. Access Priorities LEVELDEFINITIONACCESSEXAMPLES TIMEFRAME FOR ACCESS Priority 1Records essential for response and emergency operations and therefore needed immediately Physical protective storage is close to disaster response site for immediate access. Electronic replication methods are available for immediate access of information on 24-hour availability. Emergency action plan Business continuity plan Vital records manual Current facility drawings Personnel security clearance files Within the first 0–12 hours Priority 2Records essential for quick resumption and continuation of business following an emergency Physical protective storage is close to disaster recovery site for quick business resumption. Electronic methods are quickly accessible, and backups can be quickly restored. Current client files In-progress Accounts Payable and Accounts Receivable Research documentation Current contracts and agreements Within the first 12–72 hours Priority 3Records needed to continue essential functions if normal agency information were unavailable for a prolonged period Physical protective storage is accessible and outside of the disaster area. Accounts Payable and Accounts Receivable files Existing contracts and agreements Unaudited financial records After the first 72 hours

47. Procedures to Ensure Access  Cycling  Periodically replacing or updating copies of essential records  Develop duplication schedule  Documenting  Policies  Delegations of authority  Responsibilities

48. Photo: AP/Roswell Daily Record, Mark Wilson

49. Records Emergency Planning and Response

50. Records Emergency Action Plan (REAP)  Outlines the information and actions needed to respond to and recover from a records emergency  Purpose is to prevent the following:  Loss of records and information  Costly salvage of records and information  Delay in restoring critical business functions

51. What is a REAP?  REAP is part of larger emergency plan (e.g., COOP)  Portion of an emergency plan that addresses records

52. Components of a REAP  Introduction  Policy statement  Responsibilities and authorities  Communication plan  Locations of essential records  Records salvage priorities  Supplies  Vendors and suppliers  Facility information  Preparedness, response, and recovery procedures  Training, testing, and updating

53. Photo: AP/The Forum, Dave Samson

54. How to Respond to a Records Emergency  Assess the damage to records  Determine response priorities  Implement the response

55. Assess the Damage to Records  Determine nature and severity of the damage  Document volume and extent of damage  Identify which records are affected vs.

56. Determine Response Priorities  Use the salvage priorities specified in your REAP  Recover essential records and valuable records first  Must also be concerned with all records at the damage site

57. Implement the Response  First priority – personal health and safety  Second priority – security and privacy

58. Implement the Response  Initial action steps  Cover materials  Remove standing water  Stabilize temperature and humidity  Use fans to circulate air Image: Contaminated records, soaked by a burst pipe in a storage area, are wrapped in plastic while awaiting transfer to a recovery area.

59. How to Recover from a Records Emergency  Water damage – most common  Set up recovery area  Common drying methods  Records beyond salvage

60. Set Up Recovery Area  Large enough to accommodate several tables  Good air circulation  Securable  Access to clean water  Environmental controls

61. Common Drying Methods  Vacuum/Freeze-Drying  Dessicant Drying  Air Drying  Cryogenic Drying

62. Records Beyond Salvage  Identify destroyed records  Document damage Library fire (Plymouth Public Library, UK): papers destroyed by fire, August 20, 2008. Source: http://flickr.com/photos/plymouthlibraries/2781744496/

64. Summary  Local governments and state agencies have legal obligation to protect their records  Important to have active records management  Think of potential risks to your records posed by different hazards and emergencies  Assess and analyze risks to your records  Consider your options well in advance  Be a prudent “prospector” when identifying your essential functions  Determine access priority before an incident occurs

65. Back at the Office  Start communication between records management and emergency management personnel  Identify essential functions and essential records  Ensure essential records are backed up and stored off-site  Start developing a Records Emergency Action Plan (REAP)

66. TSLAC Resources  E-mail us  slrminfo@tsl.state.tx.us  Call us  (512) 463-7610  Website  http://www.tsl.state.tx.us/slrm http://www.tsl.state.tx.us/slrm  Blog  http://www.tsl.state.tx.us/slrm/blog http://www.tsl.state.tx.us/slrm/blog  Discussion list  http://lists.tsl.state.tx.us/mailman/listinfo/tx-rml http://lists.tsl.state.tx.us/mailman/listinfo/tx-rml  http://lists.tsl.state.tx.us/mailman/listinfo/tx-rms http://lists.tsl.state.tx.us/mailman/listinfo/tx-rms

67. Texas State Library and Archives Commission State and Local Records Management Division P.O. Box 12927, Austin, Texas 78711-2927 (512) 463-7610 | slrminfo@tsl.state.tx.us Questions?