1. Developing a Standards-Based Records Management Program
Frank McGovern Product Marketing Engineer

2. Agenda Trends and Challenges in RM Defining and Positioning RM
Overview of Relevant RM Standards
Using ISO 15489
Key Take-Aways

3. Records Management Trends
Decline in number of staff specializing in filing
Investment in Software functionality that creates records is growing
Mission critical records are often not sharable, retrievable or useable
Copies proliferate; data conflicts or is unreliable
often replaces phone conversations, meetings and formal written communication
Instant Messaging increasingly replaces
Litigation and discovery costs skyrocketing
Authenticity is questioned
Premature destruction
NARA

4. The Challenge of Electronic Records
Authenticity – Over Time
Variety – 4,800+ Different Types of E-Record Formats
Complexity – Increasingly Sophisticated Formats
Volume – Vast Quantities of Records
Obsolescence – Constantly Changing Technology
User Expectations –Evolving, Unrelenting
We are facing an electronic records challenge in the nation and specifically in the federal government. With the rapid evolution of information, technology has produced large, ever-increasing volumes of diverse, and complex digital records.
Since NARA’s mission is to preserve the history of this Nation it is our responsibility to address the electronic records challenge. Nara is a small agency responsible for all other agencies (approx. 400)
Scope - We have to do this for records of the entire Federal Government, which have different laws and rules that apply to them depending on whether they are records of federal agencies, or of the President, the Congress, or the Supreme Court. We also have to deal with donated materials, which are subject to their own rules, set out in deeds of gift.
Variety - There's a great variety in the kinds of electronic records we have to deal with. This variety is already apparent in the records already in the National Archives:
White House from President’s Reagan, Bush, and Clinton
Casualty records from the wars in Korea and Vietnam
The American Soldier in World War II
National Collaborative Perinatal Project,
Fishing, Hunting, & Wildlife Recreation
Abstracts of testimony, interviews, diaries from the Watergate Special Prosecution Force
• • • • •
The variety will only increase in the future.
Complexity - Besides the variety in types of records, we also have to cope with a great variety of complex types of digital data.
Volume
Clinton Administration: 38 million messages
State Department: 25 million electronic diplomatic messages
Department of Defense: > 50 million images of digital Official Military Personnel Files annually
Census Bureau: 600 to 800 million image files (2000 census)
Currently, there is no system to preserve all types of digital records over time.
NARA

5. Effective Records Management:
Simultaneous attention to People, Process and Technology
Integrating Records Management into an Organization’s Business Processes and IT Governance and Applications
NARA

6. Defining a Record Recorded information
Made or received by an organization
Regarding legal obligations or transactions
Evidence of operations
Has value requiring retention for a specific period of time
Regardless of recording format, medium or characteristics

7. Characteristics of a Record
Authenticity – It is what is says it is.
Reliability – It can be trusted as a full and accurate representation of the transactions or facts.
Integrity – It is complete and unaltered.
Usability – It can be located, retrieved, presented and interpreted
ISO 15489

8. RM from 10,000 Feet Supports event and time based retention rules
Structured file plan organizes records and manages, enforces complex policies/rules
Enables legal holds, facilitates audit and electronic evidence discovery
All processes are audited and managed
Ensures record authenticity, integrity and contextual relationships

9. RM from 10,000 Feet
Preserves records over time and ensures reliability
Ensures record access, retrieval and usefulness
Prevents unauthorized deletion
Ensures timely disposition and complete record expungement
Ensures privacy and record security policy management
Supports physical records

10. Records Management Standards
DoD Standard
ISO Standard 15489
ANSI/ARMA
VERS
DOMEA
MOREQ

11. DoD 5015.2 RM Software Certification and Testing Program
DoD certification required for software sales to Department of Defense, National Archives and Records Administration (NARA), federal government agencies
De facto industry standard
Key Sections
Definitions
Mandatory Requirements
General
Detailed
Non-Mandatory Features
Requirements defined by the Acquiring Organizations
Other Useful Features
Classified (Secret) Records

12. Impact of DoD Standard
Adoption and recognition by vendor community
50+ Vendors/Products Currently Certified
Standalone (RM only)
Product pairings (RM + ECM Suite)
Multiple Versions (Certification valid for 2 years)
Multiple Environments (Oracle/MS SQL/DB2)
45 Vendors/Products Scheduled
Mandatory for most government opportunities
Mandatory/highly desirable for most Fortune 1000 Companies and others
FileNet Records Manager is certified (Chapter 2)

13. ISO Standard 15489 Information and Documentation, Records Management
Part I – General
Part II – Guidelines
Important standard, gaining momentum throughout world
Framework for records program design in many industries

14. Principles of Records Management Programs
Key Points
Principles of Records Management Programs
Determining which records should be created
Deciding form and structure
Metadata requirements
Retrieval requirements
How to organize records
Assessing risks
Preserving records
Complying with legal and regulatory requirements
Security
Records retention
Improvement opportunities

15. Impact UK National Archives has formally adopted ISO 15489
Embraced in many UK FOI deployments
Foundation for US NARA’s Strategic Redesign of RM
Adopted by Australian Federal Government
Used by Auditor General to monitor Government performance
Translated in many Languages
Recognized by ARMA
Basis of FileNet’s RM Best Practices

16. MOREQ (European Union)
Model Requirements for the Management of Electronic Records
Focus on the functional requirements for electronic records management systems—390 requirements
Key areas:
Classification Schemes
Controls and Security
Retention and Disposal
Capturing Records
Referencing
Searching, Retrieval, and Rendering
Administrative Functions

17. ANSI/ARMA 9-2004 – Email Standard
Requirements for Managing Electronic Messages as Records
Describes
Retention and Disposition IAW Records Retention Schedule
Acceptable Use
Access and Retrieval
Appropriate Security Measures
Network Security
Protection of Confidential Information
Identification and Protection of Vital Records
Remote Access
Back-Up
Metadata Capture
Audit Trails
Anti-Virus Protection
No certification program

18. VERS Standard (Australia)
Victorian Electronic Records Strategy
Generic, extensible standard
Works with existing recordkeeping and business practices
Ensures records preservation
Enable viewing of records in the future, regardless of systems that created them
Specifies methods to capture records from desktop and business systems
Specifies ways to capture meta data
Preserves contextual relationships
Details audit trail methodologies so that changes to records are detectable

19. DOMEA (Germany) Document Management and Electronic Archiving
RM for case files
Governs
Completeness, integrity and authenticity of official records, to guard against official documents being altered, changed, removed, destroyed or deleted.
The records principle of public administration, i.e., documents are organized in subject files.
Maintenance of adequate and proper documentation for accountability and lawfulness of administrative procedures.

20. RM Standards Summary RM STANDARDS Products Program DoD 5015.2*
ISO 15489
VERS*
ANSI/ARMA
DOMEA*
MOREQ*
*Formal Certification Programs

21. ISO Part 1 General
Applies to the management of records, in all formats or media, created or received by any public or private organization in the conduct of its activities, or any individual with a duty to create and maintain records
Provides guidance on determining the responsibilities of organizations for records and records policies, procedures, systems and processes
Provides guidance on records management in support of a quality process framework to comply with other ISO standards
Provides guidance on the design and implementation of a records system

22. ISO – Part 2 Guideline
Provides guidance on implementing the policies and procedures in Part 1
Developing Policies and Procedures
Formulating Records Management Strategies
Designing the Records Management Program Elements
Implementing the Solution
Establishing Processes and Controls
Programs to Monitor and Audit the Program
Training the Organization of RM Policies and Procedures

23. Steps to Sound Records Management
Develop/Review Policies and Responsibilities
Strategic Planning, Program Design and Implementation
Develop Records Processes and Controls
Monitoring and Auditing Requirements
Planning and Executing Training Programs

24. Develop/Review Policies and Responsibilities
Develop Records Management Policy Statements
Documents Policies and Procedures Performed in the Normal Course of Business
Authorized by Highest Level in the Organization
Define Responsibilities and Program Authorities
Requires Employees to Declare Records
Ensure Records Created as Part of the Process
Provide Transparent or Easy Access
Provide Protection of Records
Enforces Records Disposition Policies

25. Strategic Planning, Program Design and Implementation
Step A:
Conduct preliminary investigation
Step B:
Analyze business activity
Step C:
Identify requirements for records
Step E:
Identify strategies to satisfy requirements
Step F:
Design records system
Policy
Design
Step D:
Assess existing systems
Standards
Implementation
Step H:
Conduct post-implementation review
Step G:
Implement records systems

26. Strategic Planning, Program Design and Implementation
Conduct Preliminary Investigation
Analyze Business Activities and Processes
Identify Records Requirements
Assess Existing Systems
Develop Strategies for Meeting Records Requirements
Design the Records System
Implement the Records System
Perform Post-Implementation Review

27. Develop Records Processes and Controls
Instruments of Control
Classification Scheme Based on Business Processes
Disposition Processes
Security and Access Controls
Analyze Regulatory Requirements
Perform Risk Analysis
Identify Employ and User Permissions
Classify Business Activities
Create Thesaurus, Glossary
Establish Records Disposition Authority
Determine Documents/Objects to Classify as Records
Develop Retention Schedules

28. Develop Records Processes and Controls
Capture
Registration
Classification
Access and security classification
Identification of disposition status
Storage
Use and tracking
Implementation of disposition

29. Monitoring and Auditing Requirements
Identify Requirements for Compliance Auditing
Determine what Evidential Weight is Necessary
Develop Performance Metrics and Monitoring and Reporting Processes

30. Auditing and Monitoring
The laws have changed worldwide and while the trickle …
The UK companies law, King 2 in South Africa…
Over 8000 compliance regulations in North America…
The federal government announced on January 12th…
The government also recently made electronic records…
Many of the regulations overlap…
(click)
2 essential elements are required to achieve compliance…
Policies, controls and process…
That’s where proof comes in…
Why proof is essential to compliance?
If you have to defend your business practices…
The records.
And you must also demonstrate you complied…
Spoliation being the willful alteration or destruction of evidence.
Proof is one part content and one part process.
Auditing and Monitoring
Policies, Controls and Process
CA Database Protection Act
SOX
Patriot Act
HIPAA
Basel II
Evidence and Proof
Business and Messaging Apps
Records Management

31. Auditing and Monitoring
August 2004 Industry Advisory Council White Paper

32. Auditing and Monitoring
August 2004 Industry Advisory Council White Paper

33. Auditing and Monitoring
August 2004 Industry Advisory Council White Paper

34. Auditing and Monitoring
August 2004 Industry Advisory Council White Paper

35. Planning and Executing Training Programs
Identify Records Management Training Requirements for the Organization
Determine the Personnel that Must be Trained
Managers, including senior managers,
Employees,
Contractors,
Volunteers,
Other personnel who have a responsibility to create or use records
Provide Records Management Professionals Training
Determine Training Methods
Evaluate Effectiveness of Training

36. Key Take-Aways Records Management is a journey
RM Software applications are tools, not a substitute for policy
The ISO Standard serves as an excellent model for an RM program