èßäapp

A vital records program identifies and protects records containing vital information necessary for an organization to continue its key functions and activities in case of an emergency/disaster.

Vital Records Policy

All University records designated as vital or essential to the operation of the University and which if destroyed would seriously impair or disrupt normal University affairs, or which by their loss might place the University in a state of legal or fiscal jeopardy, are to be secured, either by microfilm or other comparable duplication or suitable backup method of protection.

University departments have the primary responsibility to keep records designated as vital records safe and secure on a continuing basis regardless of the media format on which it is stored. Departmental responsibility for vital records is defined in the Business Policy Manual under the guidelines of Records and Records Management, Policy #907.

Informational

Based on business document analysis and in light of various recent disasters, all programs, offices, departments, and laboratories must determine what information must be protected and how to protect it. Departments should develop a plan of action to respond to emergencies or disasters that may damage their business records and provide for the recovery of needed information.

Purpose/Foundation

This document was developed as a guide and is designed to be a tool you can use to help you:

• Develop a plan for identifying and protecting vital information
• Conduct an analysis of threats and risks
• Select protection methods
• Implement and maintain a vital records protection program for your department or program

Objectives

The objectives of a vital records program are to:

• Identify records needed to conduct business under emergency operating conditions (first 72 hours following a disaster)
• Identify records needed to perform or reconstruct the organization's most mission-critical functions
• Identify records protecting the legal and financial rights of the organization/institution, its employees, and the people it serves
• Develop and implement cost effective methods, including off-site storage and the application of technology, to protect and safeguard those records identified as vital from loss, misuse, and unauthorized access or modification
• Develop policies, procedures, and a plan of action to assess damage and to begin recovery of any records that may be affected by an emergency or disaster, regardless of the storage medium

Types of Vital Records

There are two types of vital records:

1. Emergency operating records - Records essential to the continued functioning of an organization during (emergency response activities) and after an emergency to ensure the continuation of the organization, and
2. Rights and interests records - Records essential to the protection of the legal and financial rights of an organization and of the individuals directly affected by the organization's activities.

Examples:

• Emergency operating records - list of èßäapprecovery staff, system backups, emergency preparedness plans
• Rights and interests records - payroll records

Important Points

Establishing and maintaining a vital records program takes time, labor, and money. Vital records should be restricted to those records that really are crucial for start-up of operations after a disaster occurs.

Other points to remember:

A small percentage of business records are vital, that is, essential to emergency functioning and to business continuance, and are difficult or impossible to replace. ARMA International and the National Archives and Records Administration (NARA) estimates that in most organizations, only 1-10% of their records are deemed vital. Some units may have no vital records.

The length of time the records are kept (retention) does not necessarily indicate that a record is vital, nor does a record designated as vital always remain vital.

Vital records may be in any format or medium (paper, electronic, microfilm, etc.). The vital records copy may not be the "original" -- the information contained, not the medium, is most important.

If the information is contained in a medium other than paper, consideration must be given to the technology required to access the information and the availability of that technology in the event of a disaster.

The Records Center (RC) can store vital records, and can offer 24-hour access. In many cases, the RC may be the best place to store records for protecting the department's/institution's financial and legal rights, but not the best place for emergency operating records, unless housed in a special and separate location within that facility.

1. Developing a Plan

Task 1. Write an assessment plan.

• Review the current status of the vital records program in your office, if any
• Identify what is to be accomplished
• Outline how the program will be developed and administered

Task 2. Develop forms for gathering information.

• Forms to list vital functions and records supporting those functions

Task 3. Identify broad categories of potentially vital records.

• Categories may include part or all of a records series or group of records.
• Examples: personnel records, system documentation, credential files, etc.

Task 4. Obtain approval from management to begin implementation; get the highest level of authority possible.

Task 5. Coordinate with other offices, e.g., Emergency Coordinator, Facilities Management, Security, Information Management, Risk Management, etc.

Task 6. Establish and assign program responsibilities, positions, I.D. badges and job descriptions.

Examples:

• Facility Vital Records Officer - ensures the protection of organizational vital records and oversees the vital records program.
• Facility Vital Records Liaison - coordinates the vital records program in the backup position.

Task 7. Communicate the vital records plan initiative to all staff.

Examples:

• Announcements at management coordinators meetings, executive team meetings, and in directives and postings
• Memoranda to unit chiefs and/or all staff from management
• Newsletters
• Electronic mail announcements

Task 8. Develop a timeline for completion.

Outputs for Phase 1

• Vital records development and implementation plan
• Questionnaire and form for information collection
• List of potential vital records categories
• Modified position descriptions
• Handouts and reference materials for staff
• Memo informing staff of initiative

2. Identifying Vital Records

Task 1. Identify essential staff to complete task.

Examples:

• Vital records officer
• Unit managers
• Records coordinators/liaisons
• Local emergency operations officer

Task 2. Brief department managers.

Task 3. Train people who will interview temporary or student staff, if needed.

Task 4. Refine list of potential records documenting vital functions:

• Emergency procedures
• Business resumption records
• Legal and financial rights records

Outputs for Phase 2

• Completed questionnaires or interview notes
• Listing of potential vital records
• How they are protected, and how can we improve on methods

3. Assessing the Threat

Task 1. Review existing disaster recovery plans and consolidate where possible.

Task 2. Identify applicable threats and risks.

Examples:

• Fire damage
• Water damage (flood, water pipe break, etc.)
• Winds, storms/tornadoes
• Earthquake
• Sabotage or terrorism
• Human error or carelessness
• Building or equipment failure
• Power loss or electric surge
• Insects, rodents, and other pests
• Mold and mildew
• Media deterioration or break-down
• Civil emergencies (riots, war, etc.)
• Other: __________________

Outputs for Phase 3

Risk assessment reports

4. Selecting Protection Methods

Task 1. Review completed questionnaires and forms.

Task 2. Compare the list of vital records to the records retention authorizations to determine if the retention of the records have a bearing on decisions on how the records will be protected. For example, if the records are permanent and are microfilmed, microfilm copies may be the best protection method.

Task 3. Assess current on-site storage and practices. For example, there may already be fire-resistant cabinets in use for other reasons that could be used for vital records protection.

Task 4. Determine which records:

• Have "built-in" duplication or dispersal and identify the location(s) and media format
• Need to be duplicated and stored off-site and identify the type of duplication
• Need to be stored in fire-resistant equipment on-site
• Have special considerations such as records with confidential business information (CBI) or other sensitive information

Task 5. Create a resource list of disaster recovery firms in your geographic area. Talk to Risk Management and determine response times, approaches, and capabilities of those firms contracted by the University's insurance company. Update the information at least annually.

Task 6. Identify "hot" and "cold" sites to accommodate electronic records, including applications for running the systems and system documentation.

Task 7. Submit lists of vital records and protection methods for each type of vital record to unit managers for comments.

Task 8. Respond to comments and revise lists, as needed.

Task 9. Compile final list of vital records and protection methods.

Task 10. Obtain approval of final list from top management.

• Outputs for Phase 4
• Draft list of vital records and protection methods
• Comments from managers
• Final list of vital records and protection methods
• Staff notifications

Examples:

• Announcement at Executive Staff meeting
• Newsletter articles
• LAN messages

5. Implementation and Testing

Task 1. Select appropriate off-site and on-site storage space and equipment.

Examples:

• Records Center
• Other storage facilities
• Other agency offices, etc.

Task 2. Purchase and maintain supplies and equipment for recovery of records after a disaster.

Examples:

• Rolls of plastic sheeting
• Work gloves
• Protective face masks

Task 3. Develop a rotation schedule and procedures for transfer of duplicates.

• Who will over see the transfer
• What media will be transferred
• When will it be transferred and how

Task 4. Include basic training for new staff and others.

Task 5. Transfer backup copy of vital records to off-site and safe on-site storage equipment.

Task 6. Test the program for one or two months prior to drafting final plan.

• Choose one or two departments or units for testing
• Rotate duplicates on a predetermined schedule
• Include drills on use of equipment, supplies, and procedures for recovery of records on all media

Task 7. Upon successful completion of the testing, implement the program throughout the facility.

Outputs for Phase 5

• Written procedure for duplicating vital records at time of creation and predetermined backup schedule
• Written procedure for transferring vital records to off-site or on-site storage, including transmittal forms
• Instructional materials for all units to facilitate vital records protection training
• Other duplicate copies of vital records should have predetermined dispositions

6. Documenting the Program

Task 1. Identify each facility's department's vital records procedures by highlighted tabs in each plan manual. Include a list of the vital records with location and method of protection.

Task 2. The facility's Continuity/Disaster Plan is not complete without the Vital Records Protection and Retention Plan.

Task 3. Write final report on the development, implementation, testing and management of this two-fold vital records and disaster prevention plan manual.

Outputs/Off-sites for Phase 6

• Final report
• Section for unit procedure manual
• Possible title: Disaster Recovery and Vital Records Protection Plan Manual
• A copy of the complete plan should go to each facility department, top management, off-site backup, Fire and Police Departments, all team leaders, other team members and a copy to Campus Archives

7. Maintaining the Program

Task 1. Transfer duplicates of vital records to off-site and on-site storage facilities (hot site and cold site) on an ongoing basis according to an established rotation schedule.

Task 2. Dispose of duplicates that have reached their destruction date as directed by the rotation/retention schedule.

Task 3. Perform periodic audits and testing of the plan and established procedures (once a year or more).

• Identify and evaluate alternate protection techniques as they become available
• Identify additional records to be included or records to be removed from the program
• Simulate a disaster (desktop exercise)
• Retrieve the necessary records
• Ensure the capability of re-establishing operations from the backup resources

Outputs/Off-sites for Phase 7

• Duplicate copies of vital records that have no other backup or protection method
• File of transmittal forms for off-site backups
• Audit report file by date performed

Additional Resources

For more information, here is a selected list of other resources for vital records and disaster recovery.

• , PO Box 116, Jefferson City, MO 65102, (573) 526-9113
• , PO Box 510110, St. Louis, MO 63151, (314) 894-0276.
  Quarterly journal dedicated to disaster recovery and contingency planning. Includes articles on actual disasters, periodic listings of disaster recovery consultants and other useful information such as a "Disaster Related Internet Directory."
• Disaster Recovery Yellow Pages (Eighth Edition) by Dr. Steven Lewis. The Systems Audit Group, Inc., 1999. For this listing see: èßäappRecords Management (in-house resource).
  Resource directory includes information on disaster recovery consulting services, hot sites, publications and supplies, guidelines for preparing contingency plans and disaster recovery processes. Information on the publication can be found on the ARMA International Internet site at:
• Emergency Management for Records and Information Programs by Virginia A. Jones, CRM and Kris E. Keyes. ARMA International, 1997.
  A guide organized by the essential phases of emergency management - prevention, preparedness, response, and recovery. Includes sample forms and checklists. Information on the publication can be found on the ARMA International at:
• Disaster Prevention and Response for Special Libraries: An Information Kit by Miriam Kahn. Special Libraries Association, 1995.
  For information on this author contact: èßäappRecords Management.
  This publication is specifically for disaster planning in libraries but contains information useful to any organization. Includes steps for writing a disaster response plan, tips on dealing with paper and non-paper formats and several checklists. Information on this publication can also be found on the Special Libraries Association at:
• Total Contingency Planning for Disasters by Kenneth N. Myers. Wiley, 1993.
  Book focusing on disaster prevention and disaster recovery includes sample contingency plans. Information on the publication can be found on the ARMA International Internet site at:
• Vital Records - A Guideline by ARMA International Standards Vital Records Task Force. ARMA International, 1993.
  Booklet contains brief outline of steps in the development of a vital records program. Includes sample forms and bibliography. Information on the publication can be found on the ARMA International Internet site at:
• 
  Instructional guide addressing the identification and protection of records containing information Federal agencies may need to conduct business under emergency operating conditions or to protect the legal and financial rights of the Federal Government and the people it serves. Includes a sample disaster and emergency plan and a self-evaluation guide.