1. “A Prepared Marylander Creates a Resilient Maryland” Vital Records Identification and Maintenance February 6, 2014 This document was prepared under a grant from FEMA's Grants Programs Directorate, U.S. Department of Homeland Security. Points of view of opinions expressed in this document are those of the authors and do not necessarily represent the official position or policies of FEMA's Grants Programs Directorate or the U.S. Department of Homeland Security. 1 We will start momentarily…

2. “A Prepared Marylander Creates a Resilient Maryland” Vital Records Identification and Maintenance February 6, 2014 2

3.  Session participants will remain muted  Type questions in “Questions Pane”  Feedback survey  Audio problems? http://bit.ly/AudioHelphttp://bit.ly/AudioHelp  Recorded, will be available over MEPP 3

4.  Introductions  Background & Definitions  Vital Records Protection & Recovery ◦ Vital Records Program ◦ Identify vital records & characteristics ◦ Agency / Business Impact Assessment (“BIA”) ◦ Risk Assessment / BIA Process ◦ Vital Records Inventory ◦ Recovery Point / Recovery Time Objective ◦ Proactive Protection  Conclusion  Contact Information 4 At this point in the presentation you should be able to hear the presenter speaking. Should you experience audio problems please visit http://bit.ly/AudioHelp http://bit.ly/AudioHelp

5.  Presenters: Preeti Emrick & Marissa Clark, University of Maryland Center for Health and Homeland Security  About CHHS : ◦ Created after 9/11 attacks ◦ To bolster UMB’s work related to homeland security ◦ Works with emergency managers and responders in the private sector & all levels of government ◦ Develops plans, policies, & strategies ◦ Enhance & ensure public safety during natural disasters or man-made catastrophes 5

6.  A COOP plan assures an agency remains capable of continuing minimum essential functions across a wide range of potential emergencies  Elements include: ◦ Policy, procedural, and systems manuals ◦ Succession plan ◦ Alternative facility locations ◦ Vital records preservation 6

7.  Record - Anything created or received by an agency in the course of its business ◦ Can be on any media ◦ Can be temporary or permanent  Vital Record - Record, regardless of media, which is necessary to complete an essential function or operational responsibilities, and which, if damaged or destroyed, would: ◦ Disrupt the agency’s operations & information flow ◦ Cause considerable inconvenience ◦ Require replacement or re-creation at considerable expense 7

8.  Emergency Operating Records - Records essential to the continued functioning of an agency during and after an emergency ◦ Ex: COOP, orders of succession, delegations of authority  Rights and Interests Records - Records essential to the protection of the legal and financial rights of an agency and individuals affected by its activities ◦ Usually not necessary to immediately re-establish operations ◦ Ex: payroll records, insurance contracts 8

9.  Establish a program  Assess capabilities & records maintenance  Identify vital records and characteristics  Create a vital records inventory  Recovery Point Objective (RPO)  Recovery Time Objective (RTO)  Proactive protection 9

10.  Purpose ◦ Provide agency with information it needs to conduct business under other than normal operating conditions & resume business afterwards ◦ Enable officials to identify & protect vital records  How agency will operate in an emergency/disaster  Records needed to protect the legal & financial rights of the government and citizens 10

11.  As part of continuity process, establish a vital records program that identifies and protects records identified as vital ◦ Identify no more than 7% of total records as vital (3-5% is ideal)  Must have clear authority ◦ Policies ◦ Authorities ◦ Procedures ◦ Designation of a Vital Records Manager 11

12.  Make it an “official” program ◦ Institutional significance ◦ Assign responsibility ◦ Training program ◦ Review and revisions  Program will assess capabilities for maintaining vital records 12

13.  Each vital record should be detailed in COOP plan  Details should include the following: ◦ Form - electronic vs. paper ◦ Category - emergency operating vs. rights & interests ◦ Type - static vs. dynamic ◦ Location ◦ Owner/person responsible 13

14.  Assists identification of vital records ◦ Evaluates strengths and weaknesses of an agency’s disaster preparedness ◦ Assesses operational & financial impact of disruption  BIA focuses on: ◦ Identifying threats and hazards along with their characteristics and likelihood of occurrence ◦ Evaluating vulnerability of essential functions to each threat or hazard ◦ Estimating the impact if performance of the essential function is disrupted ◦ Determining an overall risk value for each threat or hazard 14

15. 1. Identify potential hazards ◦ If possible, identify specific characteristics 2. Evaluate the magnitude and probability of identified potential hazards 3. Identify essential functions at risk ◦ Consider: personnel, property, systems/equipment, agency operations, reputation of or confidence in entity, regulatory and contractual obligations 15

16. 4. Look for vulnerabilities that would make an essential function more susceptible to damage from an identified potential hazard 5. Evaluate the impact of identified potential hazards ◦ Ex: casualties, property damage, agency operations interruption, financial loss, fines and penalties, lawsuits 16

17.  Important questions to consider for vital records: ◦ What are the risks? ◦ Is off-site storage necessary? ◦ Should there be an alternative storage media? ◦ Is duplication necessary?  Remember: Risk Assessment should be done four times during continuity planning ◦ Primary facility ◦ Alternate facility ◦ Vital records ◦ Vital equipment 17

18.  Identifies vital records  Individual stand alone document ◦ But should be included in COOP plan  Should be a “one-stop” place providing information on how to locate and recover vital records 18

19.  Include: ◦ Description of the records  Name, date, and information content  Volume  Arrangement  Frequency of use or retrieval  Physical format/media ◦ Update cycle ◦ Specific location of original and duplicates ◦ When the records are needed following an emergency or disaster (recovery priority) ◦ Protection method 19

20.  Every vital record should have a RPO and RTO identified in the COOP plan  Recovery Point Objective (RPO) – the maximum acceptable amount of data loss measured in time ◦ Should be completely independent of the minimum estimated time required to resume normal operations after a disaster 20

21.  Recovery Time Objective (RTO) – the maximum desired length of time allowed between an unexpected failure/disaster & the resumption of normal operations & service levels ◦ Defines the point in time after a failure or disaster at which the consequences of the interruption become unacceptable 21

22.  List of key agency personnel  Vital records inventory  Keys/access codes for records  Continuity facility locations  List of equipment necessary to access records  Contact information for vital records vendors 22

23.  Must be updated often  Rotate/cycle on a regular basis so the latest version will be available in the event of a disaster  Old records should be replaced with updated records 23

24.  More backups or longer retention periods  Scanning paper records  Assess & upgrade storage facility protection ◦ Consider use of off-site storage facility  30 miles away for emergency operating records  Rights and Interests records can be stored further away  Improve physical & cybersecurity measures 24

25. 25  Create a vital records program that assess capabilities for maintaining vital records  Identify vital records and characteristics in a vital records inventory & include in COOP plan  Update vital records frequently  Implement proactive protection of vital records  Build a culture of proactive protection

26. QUESTIONS? 26

27. 27 Audrey Cain -MEMA- (audrey.cain@maryland.gov) Jane J. Thursby -MEMA- (jane.thursby@maryland.gov)