We are pleased to announce the issuance of NARA Bulletin 2015-03 Guidance on Managing Digital Identity Authentication Records.
This Bulletin provides guidance to agencies on managing digital identity authentication related transactional records, such as digital certificates and Public Key Infrastructure (PKI) files, created or used in the course of agency business. It supersedes our earlier records management guidance for PKI digital signature authenticated and secured transaction records.
This Bulletin will not interfere with agencies’ ability to use digital identity authentication measures that meet their business needs. Agencies must remove any digital identity authentication measures, such as passwords or encryption, from permanent records before transfer to NARA. NARA will coordinate the secure transfer of records to NARA with encryption that can be removed upon arrival in NARA.
Posted in General
Tagged guidance, PKI
In May, we presented the updated Records Management for Legal Consul briefing. Video from the two parts of this briefing have now been uploaded on NARA’s You Tube Channel. A copy of the briefing slides is available as a .pdf.
This program utilizes CART services in place of sign language interpreters. To see the captions, click on the CC logo at the lower right part of the frame.
Below are the videos and the major points in each session.
Records Management for Legal Counsel Part I – Time: 1:25:00
Key points in Federal statutory and regulatory requirements that relate to agency records
Best practices in building a defensible records management program
Counsel’s role in an agency records management program
Challenges and legal issues associated with electronic records
Records Management for Legal Counsel Part II – Time: 1:13:00
Statutory updates from 2014
The role of legal counsel in an agency’s record keeping program
E-Record keeping and E-Discovery
Legal holds on records and the duty of agency counsel
Posted in General
Tagged training, video
NARA is pleased to announce that we have issued NARA Bulletin 2015-01, Determining the Appropriate Age for Scheduling the Legal Transfer of Permanent Records to the National Archives and Records Administration (NARA).
This Bulletin clarifies the appropriate age at which permanent records, regardless of their media or format, should be transferred into NARA’s legal custody. Generally, records should not be scheduled for the legal transfer to NARA before 15 years for unclassified records and 25 years for classified records. This bulletin is associated with a new scheduling aid, Checklist for Proposing the Early Legal Transfer of Permanent Records. The checklist is a tool to help agencies and NARA staff determine if the records are appropriate for legal transfer before 15 years.
NARA Bulletins provide fundamental guidance to Federal agencies who must then determine the most appropriate ways to incorporate the guidance into their work.
A briefing on this Bulletin will be delivered at the August BRIDG meeting. Please leave any questions and comments you may have. Thank you.
Later this year, the U.S. Government will publish the third National Open Government Action Plan (NAP). This will build on the prior action plans published in 2011 and 2013. Our efforts to improve the management of government records, through things like the Managing Government Records Directive, have been included in these previous plans.
Now, we are soliciting input on this effort from our stakeholders. Please read this post from the Open Government Initiative to see how you can get involved. We look forward to your suggestions and getting them in the next version of the National Open Government Action Plan.
Here is the next tip from our GRS Team.
Flexible retentions in the GRS: Your new best friend
Many new GRS disposition instructions look like this: “Destroy when 3 years old, but longer retention is authorized if required for business use.” Some reviewers have criticized us for this latitude, and recommended that we state a specific retention period (in the above case, 3 years), then stop. They object to the elastic clause. Here’s what we bet is at the bottom of these objections, and why we believe flexibility is really in agencies’ best interests.
We suspect the main objection to retention flexibility is a fear that offices outside the direct sight lines of an agency’s records management function will abuse “longer retention is authorized” as license to never discard anything ever again. If our guess just tapped into the primal root of your own objection to flexible retention, we have good news. Flexible retention really is the agency records officer’s new best friend. If a GRS item has an elastic disposition, as long as you retain records for the minimum time required, you can do one of three things:
- You can determine how long your agency has business use for the records. Answering the question “how long is enough?” is more work than pulling a number out of a hat, and less entertaining than throwing darts at a dartboard, but conversation with subject area experts should get you to a good, defensible answer. Once you’ve determined the right time period for your agency in excess of the minimum in the GRS, you can publish it without the flexible elastic clause in your records manual and cite the GRS item as your authority.
- You can determine that your agency will do just fine with the minimum retention period in the GRS, and not a day longer. Use the GRS item in your agency manual without the flexible elastic clause and cite the GRS item as your authority.
- You can do nothing. Let individual offices in your agency determine their own business needs. We can’t recommend this as a best practice, but we acknowledge it as an option.
And the good news mentioned above? Did you notice that in all three of these options you do not have to process a records schedule through NARA or ask for a GRS exception? You have the authority to make choices to best suit your agency. We think that’s very good news indeed.
Posted in GRS
Tagged GRS, retention
We are requesting comments on a draft NARA Bulletin entitled “Guidance on Managing Digital Identity Authentication Records.” The draft is available here (.pdf).
This draft Bulletin will provide guidance on the records management requirements related to digital identification records. Specifically, this guidance will provide guidance on managing digital identity authentication-related transactional records, such as digital certificates and Public Key Infrastructure (PKI) files created or used in the course of agency business. This Bulletin will also supersede several of NARA’s records management guidance for PKI digital signature authenticated and secured transaction records.
Agencies use digital identity authentication to protect sensitive records, authenticate employee sign-ins, identify ownership of websites, and many other purposes. They use a wide variety of software. Because of the wide variety of uses and software, the Bulletin provides agencies flexibility in using digital identity authentication technology to manage temporary records. However, when agencies transfer permanent electronic records to NARA, the records must be free of encryption or other forms of security (unless permanent records must be encrypted during transfer to NARA).
Please make your comments about the draft Bulletin by June 12, 2015. Please comment below or email comments to Lisa Haralampus at Lisa.Haralampus@nara.gov. We will review all the comments we receive. Thank you.
This is a reminder that NARA is holding an open public meeting on Thursday, May 21, 2015, from 10 a.m. to 12 p.m. in the McGowan Theater (basement level), National Archives and Records Administration downtown building, 700 Pennsylvania Avenue, NW to solicit comments on General Records Schedule 6.1: Email Managed under a Capstone Approach. This is in conjunction with its publication in the Federal Register.
NARA will now also be live-streaming this event for convenience of interested participants and those who may not be in the DC area. Participants can access the event at the below link. Questions and comments during the event are encouraged on the live stream page. Participants can also send questions or comments in advance by 9:00am on the day of the event to email@example.com.
If attending in person, please enter on the Constitution Avenue side of the building, the “Special Events” entrance (which is actually the exit for the general public). Registration information and other additional information on this meeting is published in a separate Federal Register Public meeting Notice.
A copy of the review package comprised of the proposed records disposition schedule, accompanying FAQ, and appraisal memoranda, can be downloaded (.pdf). To aid in public understanding of this GRS, we also created a White Paper (.pdf) that provides additional background information on the Capstone approach, appraisal of records at NARA, and the development of this general records schedule. So that we can insure all comments are received and considered for the Federal Register comment period, comments must be sent to firstname.lastname@example.org no later than June 1, 2015.
Posted in GRS
Tagged capstone, GRS