7 thoughts on “2023-07-03 Public and Agency Comment – Managing Records Created on Collaboration Platforms”
I think this is a great start to a huge issue. I am in the process of developing governance for the use of O365 and its multiple repositories. My agency is using individual centralized SharePoint workspaces for each office to manage their records and to collaborate. I am working with OIT to manage the creation of new sites. Part of the governance being develop is instructing the Agency where they may create, collaborate, and save records because ofthe multiple repositories. Very clear guidance must be given at the onset of because it takes time to configure O365 to manage records through their life cycle. and, more importantly, the creation of unstructured data/records repositories. O365 is not a RM tool, so it wasn’t configured to take all scenarios into account. O365 has RM functionality and I believe my Agency is doing a good job with what it has been given to work with. Microsoft makes changes without notice so staying on top of the changes that affect the RM tools proves to be challenging. This guidance will be helpful, but it should’ve been provided before the requirement to become fully electronic.
Line 86: You might want to ask the question, “Will the collaboration environment be the official recordkeeping system?” Some agencies may use the collaboration environment for a short term project or as an active workspace, but then move the documents to a different location for official recordkeeping later in the workflow.
5. What are the considerations when implementing records management in an existing internal collaboration platform?
● Are the records in the collaborative environment scheduled? Or is a new schedule necessary?
Platform should not be used unless records schedule has been determined.
● Can records created in the collaboration environment be maintained in the platform or do they need to be moved to a separate repository?
If this process is not automated, then who will be responsible for moving records to separate repository?
● How will the agency be able to respond to requests for information/records contained in the system?
Major security and/or proprietary risk if agency has to request federal records from an outside source.
● Can temporary records be deleted in accordance with their retention policy?
How will deletion of records be tracked?
● Can permanent records be identified and exported for transfer to NARA with associated metadata?
I don’t believe any platform of this magnitude will have the capabilities of identifying and exporting for transfer to NARA with associated metadata if it is not an existing ERM solution.
//BREAK//
Does this bulletin address Capstone (GRS 6.1) and how platform will comply with retention of such emails and/or electronic messaging?
FAA – The following are my comments.
1) The use of the phrase “the Hosting Agency” is important but appears to only be listed in the answer to questions. This phrase should be incorporated in the guidance to clarify principle roles as the administration of the technology will directly effect the ability to collect and maintain metadata as well as the transfer of records to NARA.
2) Please make sure phraseology and explanation is provided to clarify this guidance and the guidance provided on “Other electronic messaging systems” in bulletin NARA Bulletin 2023-02, Expanding the Use of a Role-Based Approach (Capstone) for Electronic Messages as this bulletin defines what “Other electronic messaging systems may include”.
3) Based on our internal discussions it may be helpful to discuss the difference between records that can be scheduled based on content and records that are not contained in a file (or attachment) and can only be found or accessed from within the collaboration platform (ie. form data, text/chat, task list and their resolution, workflow or other transactional decision information, polls/surveys from the platform(ie. no other paper or PDF source).
re: “Can records created in the collaboration environment be maintained in the platform or do they need to be moved to a separate repository?”
The answer in almost all cases is a resounding Yes. However NARA needs to provide clear guidance to AROs that collaboration platforms can be records systems with fairly simple configuration. There is no reason for project files (for one example) existing in a system like O365 be migrated to a records system as long as their deletion when retention has been met can be documented.
For too long the government has treated electronic data as though it were physical data – to be used in one place (a desk or file cabinet) and then moved to another (an electronic records system). In the days of paper records this worked because physical file cabinet storage was a premium, when agencies are creating terabytes of information annually the requirement to move records to a records system simply does not happen.
Proof? Look at the totality of records in any agencies records system against the totality of information existing in their other systems. If the records system contains 1% of the total data in any agency I’ll eat my hat.
Asking system users and owners to move records from one platform to a “records system” almost never happens which means the records program is not in compliance. To gain compliance allow records to remain where they are created in these systems and schedule them in place. Create a policy for migrating extremely long-term or Permanent records to an archiving system.
Records systems are best utilized to manage extremely long-term records when maintaining them in the original system does not make economic sense such as the case with 75 year or Permanent records.
Building records-management-by-design into business processes and systems is the key to sustainable records management and defensible FOIA and eDiscovery. When the system of record is the collaboration platform and mapped to a data map then FOIA and Discovery becomes easier, and identifying records for permanent archiving to NARA will occur with better and more reliable frequency.
Too many records programs rely on the business identifying and moving records which any records officer worth their salt will honestly state does not happen except in very small cases. NARA needs to provide clear guidance on manage in place. The vast majority of government records, especially with the (long needed) rewrite of the Federal Records definition in 2014, are temporary in nature and should reside where they were created, mapped to a data catalogue so they can be found for FOIA or Discovery, and then deleted at the end of their retention period where they were created and used.
I agree.
Related to managing in place:
What does it mean in a collaboration platform? Are records managed in the folder/storage of creation or are they consolidated to a specialized “RM” folders with appropriate permissions and back links?
Managing in place adds complexity to the Records Managers landscape. They have to know that the places exist and be involved in configuring them for appropriate RM, then have access to provide governance.
An ability to identify records sinks (inside collaboration as well) and manage them centrally would be kind of nice to have. This, of course, requires standardizing retention and permission controls, which would also go a long way towards interoperability of records across systems/services throughout their lifespan.
State Department – Is there any thought given to adding language to this bulletin regarding the option to use the updated GRS 6.1 to cover chat messages within collaborative platforms for those agencies that have adopted the Capstone Approach?
I think this is a great start to a huge issue. I am in the process of developing governance for the use of O365 and its multiple repositories. My agency is using individual centralized SharePoint workspaces for each office to manage their records and to collaborate. I am working with OIT to manage the creation of new sites. Part of the governance being develop is instructing the Agency where they may create, collaborate, and save records because ofthe multiple repositories. Very clear guidance must be given at the onset of because it takes time to configure O365 to manage records through their life cycle. and, more importantly, the creation of unstructured data/records repositories. O365 is not a RM tool, so it wasn’t configured to take all scenarios into account. O365 has RM functionality and I believe my Agency is doing a good job with what it has been given to work with. Microsoft makes changes without notice so staying on top of the changes that affect the RM tools proves to be challenging. This guidance will be helpful, but it should’ve been provided before the requirement to become fully electronic.
Line 86: You might want to ask the question, “Will the collaboration environment be the official recordkeeping system?” Some agencies may use the collaboration environment for a short term project or as an active workspace, but then move the documents to a different location for official recordkeeping later in the workflow.
5. What are the considerations when implementing records management in an existing internal collaboration platform?
● Are the records in the collaborative environment scheduled? Or is a new schedule necessary?
Platform should not be used unless records schedule has been determined.
● Can records created in the collaboration environment be maintained in the platform or do they need to be moved to a separate repository?
If this process is not automated, then who will be responsible for moving records to separate repository?
● How will the agency be able to respond to requests for information/records contained in the system?
Major security and/or proprietary risk if agency has to request federal records from an outside source.
● Can temporary records be deleted in accordance with their retention policy?
How will deletion of records be tracked?
● Can permanent records be identified and exported for transfer to NARA with associated metadata?
I don’t believe any platform of this magnitude will have the capabilities of identifying and exporting for transfer to NARA with associated metadata if it is not an existing ERM solution.
//BREAK//
Does this bulletin address Capstone (GRS 6.1) and how platform will comply with retention of such emails and/or electronic messaging?
FAA – The following are my comments.
1) The use of the phrase “the Hosting Agency” is important but appears to only be listed in the answer to questions. This phrase should be incorporated in the guidance to clarify principle roles as the administration of the technology will directly effect the ability to collect and maintain metadata as well as the transfer of records to NARA.
2) Please make sure phraseology and explanation is provided to clarify this guidance and the guidance provided on “Other electronic messaging systems” in bulletin NARA Bulletin 2023-02, Expanding the Use of a Role-Based Approach (Capstone) for Electronic Messages as this bulletin defines what “Other electronic messaging systems may include”.
3) Based on our internal discussions it may be helpful to discuss the difference between records that can be scheduled based on content and records that are not contained in a file (or attachment) and can only be found or accessed from within the collaboration platform (ie. form data, text/chat, task list and their resolution, workflow or other transactional decision information, polls/surveys from the platform(ie. no other paper or PDF source).
Thanks
re: “Can records created in the collaboration environment be maintained in the platform or do they need to be moved to a separate repository?”
The answer in almost all cases is a resounding Yes. However NARA needs to provide clear guidance to AROs that collaboration platforms can be records systems with fairly simple configuration. There is no reason for project files (for one example) existing in a system like O365 be migrated to a records system as long as their deletion when retention has been met can be documented.
For too long the government has treated electronic data as though it were physical data – to be used in one place (a desk or file cabinet) and then moved to another (an electronic records system). In the days of paper records this worked because physical file cabinet storage was a premium, when agencies are creating terabytes of information annually the requirement to move records to a records system simply does not happen.
Proof? Look at the totality of records in any agencies records system against the totality of information existing in their other systems. If the records system contains 1% of the total data in any agency I’ll eat my hat.
Asking system users and owners to move records from one platform to a “records system” almost never happens which means the records program is not in compliance. To gain compliance allow records to remain where they are created in these systems and schedule them in place. Create a policy for migrating extremely long-term or Permanent records to an archiving system.
Records systems are best utilized to manage extremely long-term records when maintaining them in the original system does not make economic sense such as the case with 75 year or Permanent records.
Building records-management-by-design into business processes and systems is the key to sustainable records management and defensible FOIA and eDiscovery. When the system of record is the collaboration platform and mapped to a data map then FOIA and Discovery becomes easier, and identifying records for permanent archiving to NARA will occur with better and more reliable frequency.
Too many records programs rely on the business identifying and moving records which any records officer worth their salt will honestly state does not happen except in very small cases. NARA needs to provide clear guidance on manage in place. The vast majority of government records, especially with the (long needed) rewrite of the Federal Records definition in 2014, are temporary in nature and should reside where they were created, mapped to a data catalogue so they can be found for FOIA or Discovery, and then deleted at the end of their retention period where they were created and used.
I agree.
Related to managing in place:
What does it mean in a collaboration platform? Are records managed in the folder/storage of creation or are they consolidated to a specialized “RM” folders with appropriate permissions and back links?
Managing in place adds complexity to the Records Managers landscape. They have to know that the places exist and be involved in configuring them for appropriate RM, then have access to provide governance.
An ability to identify records sinks (inside collaboration as well) and manage them centrally would be kind of nice to have. This, of course, requires standardizing retention and permission controls, which would also go a long way towards interoperability of records across systems/services throughout their lifespan.
State Department – Is there any thought given to adding language to this bulletin regarding the option to use the updated GRS 6.1 to cover chat messages within collaborative platforms for those agencies that have adopted the Capstone Approach?