United States Administration And EPA 220-R-94-001 Environmental Protection Resources Management February 1994 Agency (3404) v/EPA Analysis Of Management Of Electronic Records Recommended Framework For Policy Development And Dissemination And Summary Of Comments Final fry Recycled/Recyclable /">'% Printed on paper that contains at least C7 50% post-consumer recycled fiber ------- Analysis of Management of Electronic Records Recommended Framework for Policy Development and Dissemination This document is a revision of IT AS Delivery Order 271, Deliverable 4-1, Recom- mended Framework for Policy Development and Dissemination, Draft, published August 12, 1993. The revision includes text changes in response to reviewer comments to the draft. A formal response to Agency review comments is published under separate cover as Deliverable 6-2, Summary of Comments. Within this Final Recommended Framework for Policy Development and Dissemination, Deliverable 4-2, are several other deliverables identified for the delivery order. Deliver- able 7-2, Final Revised Recommendations List, is included as Section 8.0 Recommenda- tions (pages 31-34). Foreward ------- Recommended Framework for Policy Development and Dissemination Analysis of Management of Electronic Records Foreward ------- Analysis of Management of Electronic Records Recommended Framework for Policy Development and Dissemination Table of Contents Executive Summary iii 1.0 Introduction 1 2.0 Goals of Electronic Records Management Program 3 2.1 Strategies For Meeting Goals 4 2.2 Benefits of An Effective Electronic Records Management Program.. 5 3.0 Roles and Responsibilities 7 3.1 NARA and GSA Assigned Responsibilities 7 3.2 Roles and Responsibilities Identified Through Studies and Reports.. 8 3.3 EPA 9 4.0 Vehicles for Communicating Electronic Records Management Requirements 11 5.0 Relationships Among EPA Policies, Procedures and Guidelines 15 6.0 Addressing the Issues 17 6.1 What's Included in EPA Policy, Procedures, and Guidance Documents 17 6.2 What's Not Included in EPA Guidance 18 6.3 NARA's Evaluation 18 6.4 Issues from EPA Staff Interviews 20 7.0 A Blueprint for an Effective System of Policies, Procedures and Guidance on Electronic Records Management for the EPA 22 7.1 Structure of Electronic Records Management Policy, Procedures, and Guidance 22 7.2 Stakeholders in Developing, Reviewing, Receiving and Implementing Agency Policies, Procedure, and Guidance Documents 23 7.3 Addressing Issues Through Policies and Guidance 25 7.4 Maintenance of, and Scheduling for, an Effective Electronic Records Management Policy, Procedures and Guidance System 26 7.5 Impact of Meeting Requirements on Individual Agency Offices and Information Systems and ADP Operations 27 8.0 Recommendations 28 Table of Contents i ------- Recommended Framework for Policy Development and Dissemination Analysis of Management of Electronic Records Appendices Appendix A - Related Policy, Procedure, and Guidance Documents Appendix B - Chart Defining Major Requirements Appendix C - Bibliography ii Table of Contents ------- Analysis of Management of Electronic Records Recommended Framework for Policy Development and Dissemination Executive Summary The U. S. Environmental Protection Agency (EPA) uses information technology exten- sively to carry out its day-to-day activities and its programmatic mission. In doing so, EPA generates a large volume of records, primarily in electronic form. These records are often of long-term or permanent value to the Agency and to the nation. Their man- agement, in electronic or paper form, is governed by Federal regulations, the Agency's documentation requirements, and program needs. Like many other agencies of the Federal government, EPA must now determine: If it is appropriate to retain records in electronic format instead of paper or to print selected records to paper for future preservation and use, and If the Agency wants to maintain some or all of its records electronically, how it will do so. A number of efforts currently are underway to address various aspects of information management in EPA. Throughout the Agency, staff are working to improve the useful- ness of EPA's information resources by making information more accessible, reducing its dependence on paper, updating IRM policies, and implementing document manage- ment technologies. These efforts may overlook records management implications. This report identifies areas where inadequate records management policies may limit the Agency's benefit from its investment in automated information systems. As an example, EPA is dedicated to reducing pollution and to improving the environ- ment. Consequently, efforts are underway to reduce the amount of paper consumed in day-to-day operations, yet EPA's policies require that electronic mail messages qualify- ing as records be printed out in hard copy. The purpose of the report is to position the Agency to use electronic records not only as an information source, but as the basic documentation for legal, fiscal, and audit pur- poses. It defines a policy framework that will: Guide EPA in making the transition from a paper-based records system to one in which automated systems can serve as the official documentation of Agency ac- tivities and programs, and Provide a blueprint for the development of an effective system of policies and pre cedures that meet Federal requirements for automated systems and the needs of EPA staff. Executive Summary ------- Recommended Framework for Policy Development and Dissemination Analysis ol Management of Electronic Records Such a blueprint is necessary because the Agency currently lacks policies, procedures, and guidance that would direct the implementation of a strong electronic records pro- gram. During its review of the Agency's records management program, the National Ar- chives and Records Administration (NARA) found that Agency policies do not meet Fed- eral statutory and regulatory requirements. This study has confirmed that Agency pol- icy, procedures, and guidance incorporate only selected high level statutory and Federal requirements. EPA fails to include a much larger number of these requirements in a con- sistent and well organized manner. Finally, EPA staff expressed concern about a num- ber of specific areas for which guidance is missing or confusing and indicated that addi- tional and/or clearer guidance would make their use of information more productive and effective, and ensure their ability to meet mission, legal, and reporting requirements. This report recommends action in four areas to ensure that Agency policy complies with Federal regulations and supports programs that find it cost effective to keep official Agency records in electronic form. The full text of the report's recommendations is in- cluded as 8.0 Recommendations. A summary of these recommendations follows. 1. Review, consolidate, and simplify Agency policies, procedures, and guidance. A program should be designed to integrate electronic records requirements into related policy and guidance, to coordinate policy with NDPD operational directives, and to ensure development and maintenance of electronic records policy. 2. Make EPA staff aware of their responsibility to create and maintain adequate and proper documentation of government activities in any medium. An effective mechanism to disseminate policies and guidance to EPA staff, contractors, and grant- ees is needed to ensure compliance with Federal requirements. Policies must enable users to identify and manage records contained in electronic mail, word processing, and imaging systems and on PCs, LANs, and laptops. 3. Incorporate electronic records management in Agency IRM planning, budget- ing, and review processes. Electronic records management issues should be ad- dressed in IRM strategic planning and review processes. Electronic recordkeeping should be incorporated in budgeting decisions related to information systems. 4. Institute electronic records management in all mission program and IRM activi- ties. Adequate descriptions and documentation of records and systems are essential for the identification of long-term use, storage, and retrieval of electronic records. Re- cords managers should be involved in the development of an architecture (with NDPD) to support electronic recordkeeping as well as in all systems development ef- forts. An effective records management program provides benefits to both staff and the Agency as a whole. Improved electronic records management policies will support im- provements in the following areas: overall information management; staff productivity; Executive Summary ------- Analysis of Management of Electronic Records Recommended Framework for Policy Development and Dissemination timely information for decision making; audits and management reviews; data integrity and information system security; reductions in the amount of duplicated paper; system performance and importance; and the preservation of information of performance value for future generations. Executive Summary v ------- Recommended Framework for Policy Development and Dissemination Analysis o( Management of Electronic Records VI Executive Summary ------- Analysis of Management of Electronic Records Recommended Framework for Policy Development and Dissemination 1.0 Introduction This project has identified Federal requirements for electronic records management that are defined in statutes and regulations, and has compared them with internal directives implementing those requirements in a number of selected agencies. The project then col- lected and analyzed the U. S. Environmental Protection Agency (EPA) policies and guid- ance and compared them to Federal requirements. This report defines a framework for the issuance of policy, guidance, and procedures within the EPA that will: Provide a guide to what needs to be done to permit EPA to make full use of its automated resources to serve as the basic recordkeeping system for the Agency's activities and programs, by - Ensuring the availability and accessibility of records to support the Agency in carrying out its mission; - Clearly defining responsibilities of Agency management and staff for elec- tronic recordkeeping; - Improving the way in which staff carry out their work; and - Ensuring that valuable records of the Agency are retained for future re- searchers and historians. Provide a blueprint for the Agency to develop policies and procedures that - Meet Federal statutory and regulatory requirements; - Respond to recommendations of the National Archives and Records Admini- stration (NARA) evaluation; and - Meet the needs of EPA staff. Many within EPA's Office of Information Resources Management (OIRM) and other pro- grams are working on aspects of information management, including computer security, data standards, and geographic information systems. This report provides a framework for records management inherent in information management. NARA's most recent evaluation of EPA's current electronic records management pro- gram pinpointed a number of concerns. These included the lack of an adequate capabil- ity to manage and use the electronic records it holds, unclear assignment of responsibili- ties, policies that are unclear and ever changing, the nonexistence of an inventory of elec- tronic records and disposition schedules to cover these records, lack of consistent docu- mentation covering electronic records and records systems, nonrecognition of electronic recordkeeping in planning, and lack of records considerations in the development of new systems and modification of existing ones. 1.0 Introduction 1 ------- Recommended Framework for Policy Development and Dissemination Analysis of Management of Electronic Records According to NARA's instructional guide "Managing Electronic Records," electronic re- cords are defined as "information that is recorded in a form that only a computer can process and that satisfies the definition of a Federal record in 44 USC 3301." The statu- tory definition of a record included in 44 U.S.C. 3301 is: "all books, papers, maps, pho- tographs, machine-readable materials, regardless of physical form or characteristics, made or received by an agency of the United States Government under Federal law or in con- nection with the transaction of public business and preserved or appropriate for preserva- tion by that agency or its legitimate successor as evidence of the organization, functions, policies, decisions, procedures, operations, or other activities of the Government or be- cause of the informational value of data in them." It is important to note that the determination of what is a record is based on its informa- tion content and not on the form in which the information is created or maintained. Yet, electronic records raise special concerns unrelated to the content. Electronic re- cords are different from paper records, in that they are not eye readable and there is every indication that the life span of magnetic media and even optical disk storage is not as long as that of paper. Electronic records require different procedures for preserva- tion, dissemination, storage, and use. They bring a new set of participants into the re- sponsibility matrix. The participants include individual employees creating and maintain- ing records at their workstations. 2 1.0 Introduction ------- Analysis of Management of Electronic Records Recommended Framework for Policy Development and Dissemination 2.0 Goals of Electronic Records Management Program Most Federal agencies are now using information technology to create records of their administrative and program activities. Yet, many of these records are now being printed and maintained in paper format. This will not always be the case. In EPA, as part of its pollution prevention program, there are efforts currently underway to reduce the amount of paper consumed in the Agency's day-to-day operations. Thus, it is essential that records management policies focus on electronic records, though the application of these policies will apply to paper as well. The Agency will need to take steps now to position itself to use its electronic records as an important resource and as basic docu- mentation for legal, fiscal, and audit purposes. The goals of the Agency's electronic records management program are to: Fully comply with Federal statutory and regulatory requirements. Document Agency programs and activities for future use in governmental actions, judicial proceedings, or scientific and historical research; and ensure availability of information systems beyond their original intent or use to support future needs. Preserve electronic records that fully support the Agency's current and future mis- sions, that document its programs and activities, that support its decisions and its day-to-day operations, and that are carefully organized, readily available, and ac- cessible to management and staff. Inform Agency management staff of their electronic records responsibilities. Develop procedures for the identification, preservation, dissemination, storage, and use of electronic records that are implementable, easily understood, and en- forceable. To' meet these goals, the Agency must establish policies and procedures that clearly de- fine responsibilities, legal requirements, and program objectives. It must fully integrate records management into other IRM functions, such as strategic planning, budgeting, sys- tems development, and public access programs. Where it is not possible to include re- cords management requirements in all related Agency-wide policies, they should be incor- porated by reference. Procedures for ensuring implementation of the electronic records policies must be in place for all uses of information technology and each stage of a sys- tems and records life. Policies must require careful and accurate documentation of the records and the systems in which they reside. The program must be supported by the 2.0 Goals of Electronic Records Management Program 3 ------- Recommended Framework for Policy Development and Dissemination Analysis of Management of Electronic Records Agency's senior management and given a high priority by management and program offi- cials. All staff must be made aware of the importance of records to the Agency and the nation, and of the legal consequences of not meeting responsibilities under the law. 2.1 Strategies For Meeting Goals Strategies to meet a program's goals are laid out in long-range plans. In the case of electronic records, strategies are determined in the planning and development stages of a new information system or upon the introduction of new information technologies. Often strategies are derived from statutory requirements or imposed by rules and regula- tions. Just as often, they are defined in steps taken to meet Agency mission or program objectives. Electronic records management strategies for EPA should include: Developing and implementing policies and procedures for a sound electronic re- cords management program at an Agency-wide level; Integrating, or linking to, existing or planned policies, guidance and procedures manuals which impact on, or are impacted by, electronic records requirements such as those,governing LANs, imaging systems, and personal computer security; Communicating responsibilities to staff; Fully integrating records management into IRM and incorporating records man- agement considerations in planning, budgeting, and systems design, development and implementation processes; Fully implementing Federal requirements and recommendations of the NARA evaluation; Retaining flexibility in policies and anticipating new technological circumstances; Issuing program/organizational level guidance and procedures as necessary in the Program Offices, Regions and Laboratories; and Incorporating electronic records policies, requirements, and guidance into State programs, as well as contracts and grants. Steps to implement these strategies will need to be established, and monitored, and their implementation incorporated in the IRM strategic planning process. 4 2.0 Goals of Electronic Records Management Program ------- Analysis of Management of Electronic Records Recommended Framework for Policy Development and Dissemination 2.2 Benefits of An Effective Electronic Records Management Program Benefits are derived from careful consideration of electronic recordkeeping in the design of systems and in an effective electronic records management program. The program will not only permit the Agency to meet statutory requirements, but will lead to manage- ment improvements, and help staff to do their jobs better. Though many requirements appear to involve additional initial costs, improved practices will offset, and in some in- stances, actually decrease costs now associated with the maintenance and retrieval of electronic and paper records. Attention to the entire life cycle of information will in- crease system performance by reducing the amount of unneeded information, provide up- to-date information for decision making, increase security of the system and ensure data integrity, support audits and management reviews, and provide for easy retrieval of im- portant information to satisfy agency or external needs. Developing records schedules re- quires consideration and documentation of the purpose, functions, scope and organization of a system, and will help to ensure that important data is saved and other data is dis- posed of when no longer required. Long-term value of the data determined in NARA appraisals helps to establish the importance of a system and determine the extent of con- trols, resource allocation, and management oversight to be applied to the system. In the years to come, EPA will increase its use of information technology to carry out many of its -regulatory, enforcement, research, and outreach responsibilities. Information generated in support of these activities will continue to grow, creating a large base of re- cords in electronic form. Printing and maintaining these records on paper involves costly duplication, and will negate the Agency's program to reduce the use of paper. EPA is positioned to lead Federal agencies in the acceptance and use of electronic re- cords to replace costly storage and maintenance of paper records. The Agency can dem- onstrate that well-defined policies and procedures governing electronic recordkeeping are essential to effective records management, and will improve staff productivity and re- duce costs. An electronic records architecture, defined in conjunction with the information technol- ogy architecture, will assist staff in making decisions on the cost effective use of elec- tronic media for the storage, maintenance, and use of the Agency's official records. Software that provides access to records stored on various media and in different sys- tems will support public access programs and, at the same time, ensure the preservation of valuable information for future use. Other software and applications will help users determine what is a record; permit routing of electronic mail or word processing docu- ments to archival servers on LANs or to the mainframe; and control decisions on reten- tion of drafts, reviews outside the originating office, and final disposition of the record. 2.0 Goals of Electronic Records Management Program 5 ------- Analysis of Management ot Electronic Records Recommended Framework for Policy Development and Dissemination 3.0 Roles and Responsibilities A major factor in the success of any program is a set of clearly defined roles and re- sponsibilities. NARA's evaluation indicated that roles and responsibilities related to elec- tronic records management are unclear in EPA. In developing and implementing a re- cords management program, there must be a balance among meeting Federal require- ments, responding to NARA's evaluations, and meeting the needs of EPA management and staff. To complicate matters, the increased use of computers will shift the responsi- bility for electronic records management to the records generators (users). Without clear and easy-to-follow procedures this diffusion of responsibility could easily result in docu- mentation problems. 3.1 NARA and GSA Assigned Responsibilities General responsibilities assigned to the head of each agency are defined in statute and implementing regulations by GSA and NARA. They include the duty to make and pre- serve adequate records and to establish and maintain an effective and efficient program for the management of all records that are created, received, maintained, used, or stored on electronic media. This entails: Ensuring compliance with Government-wide policies, procedures and standards, and applying requirements to electronic records created and maintained by con- tractors; Assigning responsibility for implementation of the records management program and notifying GSA and NARA of the designee; Integrating the management of electronic records with other records and IRM pro- grams, incorporating objectives and responsibilities in appropriate agency direc- tives, and disseminating them throughout the agency; Addressing records management requirements when approving systems or en- hancements or new systems; specifying the location, manner and media for elec- tronic records to meet operational and archival requirements; and ensuring ade- quate training for users in the operation, care and handling of equipment, software and media; Developing, securing NARA approval of, and implementing records disposition schedules; 3.0 Roles and Responsibilities 7 ------- Recommended Framework for Policy Development and Dissemination Analysis of Management of Electronic Records 6 2.0 Goals of Electronic Records Management Program ------- Recommended Framework for Policy Development and Dissemination Analysis of Management of Electronic Records Maintaining inventories of electronic records systems, and developing and main- taining up-to-date documentation about these systems to ensure access and use while in the agency and after transfer to NARA; Ensuring security controls over national security-classified, sensitive, proprietary, and Privacy Act records, and documenting operations to ensure integrity and trust- worthiness of records and processes; Periodically reviewing electronic records systems for conformance to Federal and agency policies, standards, and procedures. In addition, the General Accounting Office (GAO), in its Title 8 - "GAO Policy and Pro- cedures Manual for Guidance of Federal Agencies - Records Management" dated Febru- ary, 1991, requires that agencies protect and avoid unlawful disposal of site audit re- cords and that it approve retention schedules for fiscal records. 3.2 Roles and Responsibilities Identified Through Studies and Reports The emergence of interest in electronic records has resulted in a number of studies that define responsibilities of agencies related to these records. . In 1986, the Commission on Records of Government recommended additional responsibilities that should be assumed by agencies, including: Provision for records in all budgets from policy, administrative, and program of- fices (including-those for contractors); and In creating documents or data files, decisions should be made on where, how, and how long documents or files in electronic form are to be stored for continued ac- cessibility while avoiding costs of excessive retention. A NARA conference in Easton, Maryland in 1989 confirmed the need for agencies to en- sure that the transfer from paper to electronic format does not: o Affect the content of the information itself; Alter the availability of information for judicial review of agency compliance with records laws, or in any way alter the substance of records laws; Reduce the utility of information systems for performance of agency missions. e 3 0 Roles and Responsibilities ------- Analysis of Management of Electronic Records Recommended Framework for Policy Development and Dissemination The conference report urges agencies to conform to standards widely used in industry. In a University of Pittsburgh Law Review, Henry Perritt confirmed the need for estab- lished standards and stressed that agencies must retain records of public decisions, requir- ing that attention be paid to versions of drafts, as well as the recording of who saw and commented on a document and when. NARA in its "Managing Electronic Records" defined general roles and responsibilities for agencies and specifically defined responsibilities for three positions it believed were necessary within an agency's organizational structure, for the effective management of electronic records. These are reflected in Figure 1 NARA Responsibilities for Tar- geted Positions Encompassing Electronic Records Management. 3.3 EPA EPA has assigned specific records management responsibilities through a number of pol- icy directives and guidance documents, not all of them specific to records management. Appendix A - Related Policy, Procedure, and Guidance, Documents identifies Agency directives related to records management that were reviewed during this study. Overall responsibility for the records management program has been assigned to the As- sistant Administrator for Administration and Resources Management (OARM) and dele- gated to the Office of Information Resources Management (OIRM). OIRM responsibili- ties for carrying out the program have been assigned to the National Records Program Officer located in the Information Management and Services Division (IMSD). The Assistant Administrators in the administrative and program offices, Regional Admin- istrators, and Laboratory Directors share responsibility for the implementation of the elec- tronic records management program. EPA is a highly decentralized agency; records ac- tivities at the program, regional and laboratory level are carried out by records officers, record center directors, and record clerks. Records activities are coordinated through a records management network. 3.0 Roles and Responsibilities ------- Recommended Framework for Policy Development and Dissemination Analysis of Management of Electronic Records Information Systems Manager/Program Manager 1. Oversees creation and use of records in an information system. 2. Determines what information is needed to support program or administrative function. 3. Identifies the applications supported by automated systems by describing their purposes, their informa- tional content, and the main stages through which the data flow. 4. Develops and implements information system plans to meet agency needs. 5. Works with records manager to propose an adequate retention period for the information. 6. Determines when information in the system affects legal rights and interests of the agency and of persons affected by agency decisions and actions. 7. Notifies the records and information technology managers when planning new systems, new applica- tions, or substantial modifications. 8. Implements authorized disposition instructions for records in the system. 9. Performs regular reviews of the system's performance and compliance with legal and regulatory require- ments. Information Technology Manager/ADP Manager 1. Oversees purchase and technical operation of an information system. 2. Manages agency computer and telecommunication resources. 3. Identifies all program and administrative activities that use or need computer and telecommunications re- sources. 4. Notifies the system manager and the records manager of technology changes that affect record access methods or the retention of data and records. 5. Advises and assists in implementing authorized disposition instructions. Records Manager 1. Participates in planning for information systems and in reviewing their implementation to ensure that all records are scheduled for appropriate disposition. 2. Coordinates development of records schedules to ensure that all needed concurrences are obtained and to resolve conflicting requirements. 3. Serves as the primary liaison to obtain approval of proposed disposition instructions from higher eche- lons within the agency, if necessary, and to obtain authorization from NARA. 4. Advises agency officials, employees, and contractors on the development and implementation of records disposition instructions. 5. Reviews existing information systems to ensure that disposition of records in the systems has been authorized, to evaluate implementation of the schedule's instructions, and to identify any needed revi- sion of those instructions. 6. Oversees implementation of disposition instructions, including the timely transfer of all permanent re- cords to the National Archives. Figure 1 NARA Responsibilities for Targeted Positions Encompassing Electronic Records Management* * Responsibilities defined in "Managing Electronic Records," issued in 1990 by the National Archives and Records Administration (NARA). 10 3.0 Roles and Responsibilities ------- Analysis of Management of Electronic Records Recommended Framework for Policy Development and Dissemination 4.0 Vehicles for Communicating Electronic Records Management Requirements i Federal regulations require the adoption and wide dissemination of Agency policies and procedures for the proper handling of electronic records. Many studies have addressed the need to clearly define the electronic records management duties and responsibilities of management and staff. Successful communications vehicles used in some environ- ments include formal policy statements, procedures and guidance documents, and poli- cies and guidelines briefings, seminars, conferences, and training sessions for newly ap- pointed officials and staff. The primary vehicles for communicating electronic records management requirements within EPA are: 2100-Information Resources Management Policy Manual, Ch. 10 - Records Management. 2160-Records Management Manual, Ch. 8 - Documentation and Preservation of Electronic Records. NDPD Operational Directive 200.01 - Archiving Tapes and Data Sets. NDPD Operational Directive 200.02 - NDPD Records Management. The first two policy and guidance documents are applicable Agency-wide. The two NDPD directives define operational responsibilities for NDPD staff and contractors and users of the National Computer Center (NCC). In addition to those above, there are a number of EPA documents that impact, or are im- pacted by, electronic records management concerns. These were identified and de- scribed in Appendix C of the "Analysis of Current EPA Electronic Records Policies and Procedures and Identification of Policy Issues," and included: Model Regional Records Management Manual - suggests a procedures and guid- ance framework for the handling of electronic records in the Regions. Guidance for Developing Image Processing Systems - incorporates the Image Processing System (DPS) Policy Directive 90-01. 4.0 Vehicles for Communicating Electronic Records Management Requirements 11 ------- Recommended Framework for Policy Development and Dissemination Analysis of Management of Electronic Records Information Security Manual for Personal Computers - incorporates the Informa- tion Security policy from Chapter 8 of the IRM Policy Manual (2100). Electronic Reporting Policy (Federal Register, July 30, 1990) - prescribes stand- ards and requires conformance to existing data dictionaries. Local Area Networks (LANs) of Personal Computers (OIRM Policy Directive 88- 02) - requires protection of data from improper access, use, alteration, or disclo- sure. NCC IBM Mainframe Data Management (NDPD Operational Directive 210.09) - defines data retention time frames and procedures for data storage and restoration. LAN Hardware and Software Configuration Management (NDPD Operational Di- rective 310.02) - prevents modification of directories and system file organiza- tions without approval of the Director of NDPD. LAN Data Management (NDPD Operational Directive 310.05) - requires backups and tests of recovered data. LAN Naming Conventions (NDPD Operational Directive 310.07) - defines spe- cific codes for use by EPA offices. EPA Email System Data Management (NDPD Operational Directive 320.07) - re- quires that email not be used to transmit or store confidential materials, long docu- ments, or materials requiring an official signature. LAN Planning and Design Guidelines (NDPD 401/001) - emphasizes the need for security to provide data confidentiality and integrity, and for training. Backup and change control procedures are identified. A recent Booz Allen and Hamilton (BAH) study for the Agency recommended an ex- panded records management framework which would include a new set of Records Man- agement Policy Directives. One of them is an "Electronic Records Policy Directive." The study report "Management Support and Analysis of Records Management Policy, Procedures and Guidance Documents," July 6, 1992, recommended a series of special topic manuals (including one on "Electronic Records Program Administration") to com- plement the Agency-wide "Records Management Manual" (2160). In addition, it recom- mended a separate series of office-specific manuals that would guide day-to-day opera- tions in headquarters organizations, regional offices and the laboratories. Though the audiences for these policy and guidance documents are agency-wide, few out- side the IRM community read them. It is essential that additional lines of communica- tion to staff be established, including high level briefings, bulletin boards, email alerts, 12 4.0 Vehicles for Communicating Electronic Records Management Requirements ------- Recommended Framework for Analysis of Management of Electronic Records Policy Development and Dissemination specialized mandatory training sessions, and special events focusing on electronic re- cords. 4.0 Vehicles for Communicating Electronic Records Management Requirements 13 ------- Recommended Framework for Policy Development and Dissemination Analysis of Management of Electronic Records 14 4.0 Vehicles for Communicating Electronic Records Management Requirements ------- Analysis of Management of Electronic Records Recommended Framework for Policy Development and Dissemination 5.0 Relationships Among EPA Policies, Procedures, and Guidelines Due to the IRM organizational structure in EPA and the decentralized environment in which the Agency's IRM activities are carried out, a large number of policy statements, procedures, and guidelines issued by other offices have implications for the electronic re- cords management program. These other policies and guidelines may overlap or contra- dict each other, or the requirements of the primary policy and guidelines. In others, they play an appropriate role in implementing Agency-wide policies at various levels of the organizationin Program Offices, Regions, and Laboratories. The major duplication in electronic records policies occurs between the Information Man- agement and Services Division (IMSD) and the National Data Processing Division (NDPD) in Research Triangle Park, North Carolina. Generally, NDPD governs opera- tions of the National Computer Center (NCC), but NDPD directives may incorporate re- quirements inconsistent with primary policy directives. In the case of NDPD 200.02, the division has attempted to address more specific requirements of NARA's electronic records regulations than can be found in 2160. The NDPD policy on electronic mail states that "official signatures cannot be transmitted via email" and that this service is not to be used to transmit documents that would require signatures. EPA 2160 requires that policy (often long-term and permanent) documents transmitted via electronic mail be printed for retention purposes. A large set of EPA policy and guidance documents included in the "IRM Policy Inven- tory" draft dated February 2, 1993, have electronic records management implications. These should incorporate specific records requirements or be linked to the appropriate re- cords management policy, procedure and guidance documents by reference. Appendix A identifies related documents. 5.0 Relationships Among EPA Policies, Procedures, and Guidelines 15 ------- Recommended Framework for Policy Development and Dissemination Analysis of Management of Electronic Records 16 5.0 Relationships Among EPA Policies, Procedures, and Guidelines ------- Analysis of Management of Electronic Records Recommended Framework for Policy Development and Dissemination 6.0 Addressing the Issues The NARA evaluation of EPA's electronic recordkeeping practices identified a number of requirements related to electronic records that were not being met. This study re- viewed Federal requirements and identified those that were being met in EPA's policies and guidance documents as well as those that were missing. It confirmed NARA's find- ings, and identified a number of EPA staff requirements that were not addressed, at least at a very specific level. An effort must be made to simplify and integrate electronic re- cords management policy and procedures to meet all three sets of requirements. 6.1 What's Included in EPA Policy, Procedures, and Guidance Documents EPA has incorporated the following high level requirements that are not media specific, and that apply equally to records in paper or electronic formats. These are included either in its general information resources management policy and guidance, or in its spe- cific records management and electronic record guidance. Its policy and guidance in- clude a discussion of the characteristics of electronic records, various elements of the definition and scope of electronic records, and the assignment of responsibilities for re- cords created, received, maintained, used, and stored in electronic media. They require that only information necessary for performance of agency functions be collected; that general records schedules (GRS) be applied to electronic records; that those not covered by GRS be scheduled; and that NARA approval of the schedules be obtained. They pro- hibit the destruction of electronic records without NARA approval. The guidance re- quires the management of records throughout the life cycle, an appropriate level of secu- rity to protect the integrity of the records, and the preservation of records that document organization and functions and furnish information to protect the rights of the agency and those affected by its actions. Guidance which is clearly more operational in nature is provided in still other EPA direc- tives. Management and staff are required to determine if word processing and electronic mail records are to be printed and retained, and to comply with policies, procedures, and standards of the OMB, GSA, GAO, NARA, and NIST. The agency must maintain an in- ventory of records systems and establish procedures for identifying and labeling elec- tronic records on tapes or diskettes when they are created. Security procedures to pre- vent unauthorized access and addition, modification, or deletion of records must be devel- oped. Appropriate backup and recovery, protection against such problems as power out- ages, and training on safeguarding sensitive or classified records are required. Policy also requires that users be notified when technology changes and be encouraged to con- vert storage media to provide compatibility with current hardware and software and en- 6.0 Addressing the Issues 17 ------- Recommended Framework for Policy Development and Dissemination Analysis of Management of Electronic Records sure against loss of information. Maintenance procedures for rewinding and statistically sampling 3% of the stored magnetic tapes are defined, smoking and eating in tape stor- age libraries and test areas are prohibited, and magnetic media used for sensitive or pro- prietary information are required to be properly degaussed before reuse. The X12 and EDIFACT standards have been specified for EDI systems. 6.2 What's Not Included in EPA Guidance EPA's primary records management policies, procedures, and guidance documents do not address many of the Federal requirements defined in statute or NARA and GSA im- plementing regulations, either directly or by reference. A clear definition and scope of "electronic records" and guidance on how to segregate records from non-records in an electronic environment is needed. Agency responsibilities that require a plan for process- ing, transmitting, using, protecting, providing access, disseminating, storing, retrieving, and disposing of information before its collection are not defined. Requirements that prohibit destruction of records which are covered under a GAO audit, court proceedings, or the subject of an FOIA request are not included. Policy and guidelines do not re- quire notification to NARA and GSA of the name and title of the individual assigned re- cords responsibilities. Requirements for the use of standards for preserving, protecting, and disposing of records are not specifically defined, nor is the requirement for compli- ance with the Privacy Act, FOIA, and other relevant legislation. There is no require- ment to integrate electronic records management with other records and IRM programs (though this in effect has taken place), nor to provide training on electronic records man- agement responsibilities. These are the principal Federal statutory and regulatory requirements missing from EPA's policies and guidance. A more complete listing of missing requirements is found in Figure 2 Requirements Missing in EPA Policies and Guidance. 6.3 NARA's Evaluation The NARA evaluation of EPA's recordkeeping practices identified a number of prob- lems relating to electronic records and recommended steps that the Agency should take to implement an effective electronic records management program. These included the revision and expansion of EPA guidance for the creation, maintenance, use, and disposi- tion of electronic records, inclusion of NARA's regulations and handbook requirements in agency guidance, and the wide dissemination of this policy and guidance within the Agency. Other recommendations center around the need for implementation of many of the Federal requirements identified above. Figure 2 contains a summary listing of the ad- ditional recommendations that must be addressed within the framework of Agency pol- icy and guidance. 18 6.0 Addressing the Issues ------- Analysis of Management of Electronic Records Recommended Framework for Policy Development and Dissemination FEDERAL REQUIREMENTS Procedures for addressing electronic records before new or enhanced systems development efforts are un- dertaken. Includes need to address the entire life cycle, establishment of a records management plan and approval by the Agency's records manager, scheduling of records systems, and incorporation of disposition instructions. Adequate documentation of the record or the system to permit use and transfer to NARA. Methods for controls on proprietary, sensitive, or classified records, or those covered by the Privacy Act. Training in the operation, care, and handling of equipment, software, and media used in the creation, use and storage of electronic records., GAO requirements for financial records. Application of electronic records requirements to records created or maintained by contractors. Review of the electronic records systems. Implementation of NARA-approved disposition schedules. Internal audit controls to protect records from destruction or alteration. Documentation of, and controls on, the recordkeeping system's operations to ensure that trustworthiness can be established for evidence in court proceedings. Requirements for official text documents. Data necessary to permit personnel to retrieve, protect, or carry out disposition of documents. Correlation of related records on paper, microform, or other media. Appropriate filing and retrieval system. Electronic records security in computer systems plans (Computer Security Act); segregation of public infor- mation subject to release under FOLA; identification of systems with sensitive information. Criteria to be applied to the selection of the appropriate media and systems to store agency records. Avoidance of use of floppy disks for long-term storage of permanent and unscheduled records; labeling of disks with disposition instructions. Testing of tapes prior to use for permanent and unscheduled records; verification of error free tapes; tem- perature and humidity controls for adequate maintenance of tapes; statistical sample size for tape libraries; tape testing and replacements before 10 years old; labeling data elements for tapes and numeric data files. Written procedures for direct access storage devices and labeling of diskettes and removable disks. Procedures for scheduling and transfer of electronic records, indexes, and documentation to NARA. Requirements for recopying, reformatting, and other necessary maintenance to ensure retention and usabil- ity throughout authorized life cycle. Ensure protection of sensitive, proprietary, or national security information in disposing of records. NARA EVALUATION RECOMMENDATIONS Centralize control over data files; assign specific responsibility for their documentation and disposition. Include records maintained on all types of systems: micro, LANs, minis, and mainframe computers. Assign clear responsibility for developing and maintaining documentation for electronic records. Develop comprehensive and up-to-date inventory of records and systems of records. Include information about documentation in inventory. Identify permanent or long-term records not covered by the GRS and schedule their disposition. Determine if records on microcomputers are scheduled or covered by GRS. Determine current status of permanent, older series records created on mainframes and identify documenta- tion (start with data stored at NCC and going to users for documentation). Involve headquarters records managers in planning new electronic records systems or modifications. Ensure all necessary and appropriate documentation is created and maintained. Develop evaluation program and include review of documentation of permanent and long-term records. Include segments on managing electronic records in records management training sessions. Develop presentations for IRM officials and program staff informing them of their responsibilities in rela- tion to electronic records, particularly to build in maintenance and disposition at systems development phase, and creating and maintaining appropriate documentation. Determine who is responsible for documentation: Program Managers believe it is RTP, but RTP says docu- mentation is responsibility of program system managers. Prepare disposition schedules on TAPP and GICS system if not already available; purge data from older TAPP and GICS systems per disposition schedules. Prepare guidance to Regions from Headquarters; develop records schedules on systems in Regions. Define difference between back-ups and records retention and preservation. Figure 2 Requirements Missing in EPA Policies and Guidance 6.0 Addressing the Issues 19 ------- Recommended Framework for Policy Development and Dissemination Analysis ot Management of Electronic Records 6.4 Issues from EPA Staff Interviews A large number of issues relating to electronic records were also identified in interviews with Agency staff during the course of this study. These are real-life problems for EPA staff that need to be addressed through electronic recordkeeping programs. Many of the Federal requirements, when met, will also satisfy the needs of EPA staff; other needs should be addressed in implementing policies and guidance at the Agency or specific of- fice level. Costs of conversion from paper to electronic format is a recurring concern of EPA staff. An analysis of the costs associated with these conversions and those necessary to bring the Agency's records management program into compliance with Federal requirements is outside the scope of this project. However, the framework study does include the need for policies to require consideration of costs and cost-benefits in all new electronic re- cords applications. Another area of concern centers around the FOLA requests, which are more and more fre- quently asking that the information be provided in electronic format. The Agency has re- ceived requests for searches for electronic mail documents, and their retrieval is a seri- ous and costly problem. Other agencies are also struggling with this. Several have im- plemented systems to support information in electronic form in response to FOIA re- quests. Scientific records create special problems for EPA. These records result from scientific experiments, modeling, and the automatic collection of scientific data from monitoring stations. It is difficult to correlate electronic data with its related information in other formats. The data may have been collected or reside on older, specialized information technology that cannot be maintained and which is expensive to convert. Data collected by individual scientists are not controlled in centralized or shared systems. The first step in resolving these issues is to determine what types of information need to be re- tained to conduct Agency business and adequately document Agency activities. OERM and ORD will need to address these specialized issues and offer guidance to the scien- tists at Headquarters and in the laboratories. Public access to the Agency's information is essential to the fulfillment of its mission. Thus, careful attention must be paid to appropriate storage and retrieval mechanisms that will permit ease of location and use. These same requirements will be supported by, and often can be met through, an effective electronic records management program. Therefore, policies that provide for hardware and software independent data, good lay- outs, and descriptions and other appropriate documentation of the data and the system are essential if public access, and transfer to NARA, are to be accomplished effectively. 20 6.0 Addressing the Issues ------- Analysis of Management of Electronic Records Recommended Framework for Policy Development and Dissemination A full description of these issues is included in the Phase II and III reports, and they are summarized in Figure 3 EPA User Requirements. The issues identified in this study will need to be factored into the development, expan- sion, or revision of electronic recordkeeping policies, procedures, and guidance. The ap- propriate vehicle will need to be identified for each requirement, and priorities estab- lished for the development of new or revised statements. Priorities for development, re- vision and issuance of the policies and guidance should be established based on the need: To meet Federal requirements; To address specific agency needs; To implement recommendations of NARA evaluation; and For "reality-based" decisions based on budget and other resources. 6.0 Addressing the Issues 21 ------- Recommended Framework for Policy Development and Dissemination Analysis of Management of Electronic Records Specific coverage for electronic mail, bulletin boards and LANs. Clear and understandable definition of a record. Can the decision-making on what is a record be supported by an expert system or other automated technique? Word processing documents (textual) and other records created in WordPerfect Office systems. Can vari- ous versions of documents be tracked and maintained? Life cycle guidance for electronic records. Standards for use of codes, naming conventions, metadata, and definitions of data elements. Hardware and software considerations for electronic recordkeeping. Media considerations, specifically those related to image systems and optical disk. Backups are scheduled for all EPA systems, but these are not done for records management or archival pur- poses; there are no procedures in place that prevent records disposal without proper authorization. How should retention of data scheduled for permanent or long-term retention be handled, whether on mainframe, LAN, or image system? Security concerns, addressed up front in systems design for LANs, mainframe use for public access, and electronic filing. Disposition scheduling of electronic records, databases and systems. Transferring electronic records to NARA - who, when, and in what format. Ownership of State-generated records. Contractor and grantee records. Special considerations for Superfund records. Regional records that may not enter the central NDPD computer. Often these enter into issues of aggre- gated and disaggregated data, and which are desirable for long-term or permanent retention. Admissability of electronic records in court proceedings. Electronic filing; electronic signatures. Spatial data. Large scientific databases; other scientific records. Costs associated with electronic recordkeeping; particularly those associated with retention, maintenance of tapes and disks, and storage, as well as software and servers for LAN management of records. Who will pay? How to handle compound and complex, multi-media documents that include text, and charts. Models and analytical tools, where data is included. Careful attention to auditability, system liability, and accountability due to Agency's regulatory and en- forcement functions. Impact of possible Departmental status on Agency recordkeeping. Use of LANS and computer files to reduce the amount of paper used in carrying out Agency functions. Figure 3 EPA User Requirements 22 6.0 Addressing the Issues ------- Analysis of Management of Electronic Records Recommended Framework for Policy Development and Dissemination 7.0 A Blueprint for an Effective System of Policies, Procedures and Guidance on Electronic Records Management for EPA The elements of a blueprint for EPA's electronic recordkeeping policies, procedures and guidance include: Structure of electronic records management policy, procedures, and guidance; ve- hicles for addressing Federal requirements, EPA issues, and NARA recommenda- tions. Stakeholders in developing, reviewing, receiving, and implementing Agency poli- cies and guidance. Establishment of plan for addressing issues and developing policies and guidance based on priorities. Schedule and maintenance of an effective electronic records management policy, procedures and guidance system. Potential impact of meeting requirements on individual Agency offices and ADP operations. Methods to ensure compliance with policies. 7.1 ' Structure of Electronic Records Management Policy, Procedures, and Guidance The current structure for providing Agency-wide policy and guidance on electronic re- cords management has proven to be ineffective and has led to a determination by NARA that policy and guidance is unclear and not widely disseminated. A structure should be developed that is understandable and known to all staff; one that addresses pol- icy at the highest level, with implementing guidance and procedures directed to Program and Administrative Office levels and staff, similar to that recommended by the BAH study. A possible structure, and the documentation vehicles to support this structure, are suggested in Figure 4 Directives Structure for Electronic Records Management. To effectively meet Federal requirements, implement NARA evaluation recommenda- tions, and address the issues identified earlier by EPA staff, a decision will need to be 7.0 A Blueprint for an Effective System of Policies, Procedures and Guidance on Electronic Records Management for EPA 23 ------- Recommended Framework for Policy Development and Dissemination Analysis of Management of Electronic Records Agency-Wide Policy Electronic records management policy (a separate policy based on NARA and GSA regulations). Gen- eral policy now included in the IRM Policy Manual (2100) and the overall Records Management Man- ual (2160). Guidance Electronic records management directive (similar to the 2163 guidance document recommended by BAH). General guidance provided in Records Management Manual (2160). Procedures Electronic records management manual or handbook (consists of operating procedures, related policies, procedures and guidance documents, either in full or as references). Administrative and Program Offices Regions and Laboratories Guidance/Procedures Electronic records management manual or handbook incorporating office, region, or laboratory specific applications of Agency-wide policy, guidance, and procedures. Incorporate or refer to related policies, procedures, and guidance that apply Agency-wide or to the specific office. State Agencies Incorporate guidance and procedures on electronic records in policies and guidance provided to States on delegated activities. Contractors and Grantees Boilerplate guidance and procedures on records generated under EPA contracts and grants incorporated in the text of the contract or grant. Figure 4 Directives Structure for Electronic Records Management 24 7.0 A Blueprint for an Effective System of Policies, Procedures and Guidance on Electronic Records Management for EPA ------- Analysis of Management of Electronic Records Recommended Framework for Policy Development and Dissemination made on whether to incorporate, in total, the text of NARA and GSA regulations in the Agency-wide policies and guidance, or to draw on these requirements to establish policy at one level and define guidelines and procedures at still another level. This latter ap- proach reflects the belief that Agency-wide policy should be general in nature. Agency- wide guidance should be somewhat more specific, but at the same time permit adminis- trative and programmatic offices, regions and laboratories to develop guidance that is ap- propriate to their own requirements. To ensure clarity, understanding, and acceptance of the policies, procedures, and guidance provided, issuances affecting electronic records must be coordinated among all the major stakeholders in the program. 7.2 Stakeholders in Developing, Reviewing, Receiving and Implementing Agency Policies, Procedure and Guidance Documents A major problem identified in this study is the number of EPA policies, procedures, and guidance documents that relate to, impact, or are impacted by, electronic recordkeeping considerations. Often those who have critical need for specific guidance do not know of the existence of all guidance. In some instances, the requirements may overlap; in oth- ers they may contradict. The problem stems in part from the decentralized nature of EPA, but also from the lack of coordination in the development and dissemination of policy and guidance. The primary players in electronic records management in EPA are: Director, OIRM and Director, IMSD - overall supervision and policy direction for the records management program. Director, National Data Processing Division (NDPD) - operation of the National Computer Center (NCC), LANs, and image processing programs. National Records Management Program (NRMP) Manager in IMSD - responsible for the development and communication of overall policy guidance in records management Agency-wide. Senior Information Resources Officials (SIRMOs) - provide specific implement- ing guidance on records management to EPA office, regional, and laboratory staffs. Records Officers, Records Center Managers, and Records Clerks in the Adminis- trative/Programmatic Offices, Regions, and Laboratories - implement Agency and office-specific records management requirements. 7.0 A Blueprint for an Effective System of Policies, Procedures and Guidance on Electronic Records Management for EPA 25 ------- Recommended Framework for Policy Development and Dissemination Analysis of Management of Electronic Records Systems Managers, LAN Administrators, PC Site Coordinators, and other techni- cal managers. With the exception of NDPD, these players have general records management responsi- bilities, of which electronic records management is a subpart. NDPD and OIRM agreed that OIRM policies and NDPD operational directives will be cross-referenced. In most cases, the OIRM policies will outline general policies, and the NDPD operational direc- tives will provide specific details. Because of the nature of electronic records manage- ment, all staff in EPA become major players. Decision-making responsibilities on what is a record have been moved to the individual at his or her workstation; scheduling takes place at the systems manager level rather than at an office level; and all staff are in some way responsible for the preservation of important data created or received by the Agency. 7.3 Addressing Issues Through Policies and Guidance A large number of Federal requirements are currently not covered in EPA policy and guidance documents; many of these were also identified in the NARA evaluation. In ad- dition, EPA staff raised an even larger number of issues that should be addressed in pol- icy, procedures or guidance documents to meet their concerns related to electronic record- keeping. All three sets of requirements can, and should, be met together through a care- fully planned system of policies and guidance. Appendix B - Chart Defining Major Requirements consists of a chart which defines the major requirements to be incorpo- rated in Agency policy and guidance and provides a recommendation on the guidance structure best suited for incorporating these requirements. Both Federal requirements and NARA's recommendations stress the importance of mak- ing management and staff aware of their responsibilities and the requirements contained in policy, procedures, and guidance documents issued by the Agency. The following ap- proaches to the dissemination of requirements are suggested: Make compilations of records management policies, guidance, and procedures available on-line or on CD-ROM. Distribute policies, guidance, and procedures to account holders on the minicom- puters, mainframes, and LANs through use of electronic mail, bulletin boards, or videotext. Incorporate policies, guidance, and procedures in hardware, software, applica- tions, security, and records management training programs. Conduct briefings for Systems Managers and User Groups. 26 7 0 A Blueprint for an Effective System of Policies, Procedures and Guidance on Electronic Records Management for EPA ------- Analysis of Management of Electronic Records Recommended Framework for Policy Development and Dissemination Include Records Managers in all User Groups. Include Records Managers at all levels of the organization in strategic planning and IRM budgeting sessions. Distribute policies to SIRMOs and Alternates in printed or other formats. Train Records Managers in electronic records regulations and policy. Provide orientation sessions for top Agency officials and new staff. Make these critical to their positions. Develop and distribute "tool kits" relating to application of electronic recordkeep- ing to use of new systems and technology. Produce videotapes explaining Federal requirements and their implementation in EPA; stress consequences of not meeting them. 7.4 Maintenance of, and Scheduling for, an Effective Electronic Records Management Policy, Procedures, and Guidance System Policies and procedures for electronic recordkeeping do not stand still. They are af- fected by many changes taking place in the information resources management arena, both in the Federal and private sectors. Many separate professional areas and disciplines are coming closer together due to advances in technology and the ability of the technol- ogy to process, store, and make available large amounts of information in various for- mats and media. In addition, there will continually be evolutions in Agency mission and technology; policies should be flexible enough to provide for these changes. It is therefore important not only to define steps which can be taken to meet current require- ments through the development and/or revision of electronic records policy, procedure, and guidance documents, but to provide for reviews and future up-dating and revision of these documents. 7.5 Impact of Meeting Requirements on Individual Agency Offices and Information Systems and ADP Operations Requirements identified in this study are based in statute, and are not simply supportive of better management practices. The Agency must ensure that management and staff of 70 A Riuonrinf fnr pn Pff ootive Svstpm of Policies Procedures and Guidance on Electronic Records Management for EPA 27 ------- Recommended Framework for Policy Development and Dissemination Analysis of Management of Electronic Records all organizational elements understand the legal implications of not complying with Fed- eral statutes and regulations. Meeting Federal and NARA requirements and meeting the needs of EPA staff will not come without cost. It will mean changing the way many of the staff work and carry out their responsibilities. It will require a rethinking of the value of information, not only to the performance of Agency mission, but to future generations. It will primarily require top management attention and support. It will require the integration, or linking, of a large number of policy directives to ensure that various programmatic and adminis- trative requirements that impact on, or are impacted by, electronic records considerations are recognized and included. Primarily, meeting Federal requirements for electronic recordkeeping will impact informa- tion systems managers in the Administrative and Program Offices, the Regions and the Laboratories, and the IRM staffs and contractors charged with the design, development, and operations of systems applications. The impact will be felt in the manner in which policies and guidance are implemented and procedures are put in place to ensure compli- ance with Agency-wide policies and guidance. But the major impact will be in the in- itial costs of systems, software, hardware, and other information technologies necessary to effectively manage electronic records. Much has been written about the role of the mainframe in the future, and one scenario has the mainframe housing the organization's archives. Data and information in active use would reside on LANs, in image systems, and on individual workstations. As the data and information are no longer required for use on a day-to-day basis it would be moved to the mainframe, where it would still be accessible for periodic agency use in an electronic records center. The mainframe would be used to poll other information storage systems for inactive file transfer to the archival system and for those permanent records for transfer to the National Archives. Such use of a mainframe would be sub- stantial in cost, both for the contractor and agency staff necessary for the maintenance of the archival disks and tapes, the records series, and the equipment and software neces- sary to preserve and protect the records. LANs offer a greater opportunity for the proper retention of permanent and long-term re- cords than that available through individual workstations, provided that the software and systems are available for maintenance of these records in a shared, designated archival server. Image systems also offer mechanisms for storage of large data sets, data bases, and other records series. However, both of these technologies represent significant in- vestment of resources and centralized funding is currently not available for either. Thus, Administrative and Program Office information system managers would need to be per- suaded that the costs were justified to ensure long-term preservation of the data that might be required to support research, standard-setting, monitoring, and enforcement ac- tivities of the Agency. 28 7.0 A BlueDrint for an Effective Svstem of Policies. Procedures and Guidance on Electronic Records Manaaernent for EPA ------- Analysis of Management of Electronic Records Recommended Framework for Policy Development and Dissemination It is important to recognize that the least costly conversion of paper records to electronic format requires dealing effectively with the paper prior to conversion of the records. This can be accomplished in a number of ways, but should include: selection of official records of long-term importance for early conversion; determination of whether all records in a series should be converted; selection of offices whose records are primary to convert; disposal of paper as soon as the records retention schedule permits; immediate conversion and transfer to NARA of longer term and permanent re- cords which have been retained for five years or more; and establishment of a cut-off date after which paper will no longer be generated The impact on resources, both staff and budget, are important considerations before elec- tronic records management policy, procedures, and guidance are issued for the Agency. Careful planning and budgeting for electronic recordkeeping and archival systems will be required to ensure that unrealistic requirements are not placed on the Agency and its staff. Cost-benefit analyses for each new system application should be required in Agency policy and direction. 7.0 A Blueprint for an Effective System of Policies, Procedures and Guidance on Electronic Records Management for EPA 29 ------- Recommended Framework for Policy Development and Dissemination Analysis of Management of Electronic Records 30 7.0 A Blueprint for an Effective System of Policies, Procedures and Guidance on Electronic Records Management for EPA ------- Analysis of Management of Electronic Records Recommended Framework for Policy Development and Dissemination 8.0 Recommendations The following recommendations are based on an analysis of Federal requirements for electronic records, EPA's current policies and procedures, and EPA user requirements. It is important to note that a number of these are currently being addressed in the broader OIRM policy development initiatives. They are provided here as a reminder of their importance to the fulfillment of Federal requirements for electronic records manage- ment policies. a. Review, consolidate and simplify Agency policies, procedures, and guidance. Adopt a coordinated or integrated structure for electronic records directives and procedural guidance, with general policy and guidance at the agency-wide level, and guidance and procedures at the office-specific, regional, and laboratory levels. Meet specific Federal requirements not currently included in EPA policy, guidance, and procedures by incorporating all Federal requirements at the appro- priate level of the structure. Ensure that the structure and the content of the direc- tives and procedures meet NARA and EPA requirements and are reality-based. Ensure that directives address issues identified in staff interviews. Define a mechanism to gather feedback from staff on new issues as they develop. Ensure that guidance and standards promote uniform behavior Agency-wide. (Refer to Appendix B for coverage of major requirements in specific guidance vehicles.) Coordinate agency-wide policy and guidance formulation with operational di- rectives of NDPD to avoid duplication. Establish a mechanism for joint issu- ances of operational guidance involving electronic records management. Define internal controls necessary to ensure that records are not destroyed without NARA authorization; identify responsibilities for meeting these requirements in policy and operational directives. Develop a program to link or integrate related policy and guidance. Identify promulgators of related policies identified in Appendix A and work to ensure in- tegration of, or linkages with, electronic records management requirements in re- visions to these policies. Encourage announcement of the intent to develop policy to primary players in electronic records management (i.e., SIRMOs, Records Man- agement Network, NDPD, systems managers, and others on specific topics); and obtain feedback on issues to be addressed, and problems anticipated in approval of issuances and in later implementation. Strengthen working relationships with IRM staffs responsible for data administration, standards, and documentation to ensure that impacts of, or on, electronic recordkeeping practices are recognized in 8.0 Recommendations 31 ------- Recommended Framework for Policy Development and Dissemination Analysis of Management of Electronic Records agency guidance in these areas. Participate in the development of systems life cy- cle guidance to ensure electronic records management considerations are included. Clarify issues and develop guidelines on use of Agency records as evidence. Develop guidelines on confidentiality, integrity, and legality. Incorporate require- ments for admissibility of electronic records and electronic signatures in court pro- ceedings. Work with OPPE to include these concerns in electronic reporting guid- ance. Establish a schedule and system for the development, revision, and mainte- nance of electronic records management guidance. Follow new developments relating to electronic records and Federal and Agency requirements and incorpo- rate in interim directives. Provide for the issuance of interim directives in the schedule. Anticipate Agency mission and technological changes. b. Make EPA staff aware of their responsibility to create and maintain adequate and proper documentation of electronic records in any media. Develop a method to disseminate policies and guidance, and to make employ- ees aware of the responsibility for proper documentation of government ac- tivities. Develop records awareness programs to strengthen compliance with Agency and Federal requirements in electronic recordkeeping. Discuss impor- tance of record and systems documentation, and record disposition requirements at SERMO meetings involving representatives from all Agency components. In- corporate electronic records requirements in office automation and PC and LAN training. Work with the Human Resources Office to incorporate electronic re- cords management responsibilities in standard job descriptions as appropriate, par- ticularly those for information systems managers. Develop specific electronic records guidance for contractors and grantees (in- cluding States), and incorporate in boilerplate for contracts and grants. Investigate systems and other mechanisms that would automatically assist us- ers in meeting Federal requirements for electronic recordkeeping, such as ex- pert systems, systems to alert managers to the need for disposition decisions, sys- tems to manage disposition schedules and transfer of permanent records to NARA, and systems for inventorying electronic records - useful at all levels of ar- chitecture. Include these in information system design. Make staff aware of such systems in procedural guidance. Identify offices with large volumes of permanent records in paper form and determine likelihood of these becoming electronic over time. Office-specific guidance should identify those offices with primary responsibilities for ensuring that specific requirements for long-term and permanent records are met. Deter- 32 8.0 Recommendations ------- Analysis of Management of Electronic Records Recommended Framework for Policy Development and Dissemination mine those offices in key decision-making roles and likely to create, receive, and maintain large volumes of official records. These official record series, whether in electronic mail, word processing files, PCs, laptops and/or LANs, must be scheduled to ensure protection and preservation of long-term and permanent re- cords. Improve internal incentives for compliance with established policies and pro- cedures; gain support of top Agency management and senior program managers, and demonstrate direct benefits. c. Incorporate electronic records management in Agency IRM planning, budget- ing, and review processes. Develop a strategy to ensure that electronic records management is ad- dressed in the IRM strategic planning process. Incorporate electronic recordkeeping program requirements in budgeting for information systems. Consider centralized funding of archival technologies that will permit the Agency to meet Federal and EPA requirements for preserva- tion, use, maintenance, and transfer of long-term and permanent electronic re- cords. Incorporate electronic recordkeeping and system documentation require- ments in life cycle guidance in EPA. Work with the current project team in the development of guidance in this area. Develop or adopt a set of questions to support a biennial review of the elec- tronic records management program and incorporate in procedural guid- ance as part of a complete records review. d. Institutionalize electronic records management in all program mission and IRM activities. Include records managers in system development efforts to ensure that legal, fiscal, and Federal retention requirements are addressed. Develop or adopt a set of questions relating to electronic recordkeeping that should be asked in the de- sign of information systems, and incorporate these in guidance to agency staff. Consider records officers as users of the records; include them as a member of de- sign and requirements analysis teams. Develop functional requirements for major systems, documents, electronic mail, and other systems to identify what data and/or documents must be kept, under what conditions, for how long, in what format, and what to do with them when they become inactive. Issue guidance on electronic records 8.0 Recommendations 33 ------- Recommended Framework for Policy Development and Dissemination Analysis of Management of Electronic Records contained in electronic mail and word processing systems, on PCs, LANs, and lap- tops, and in imaging systems, as interim bulletins, or ensure their early incorpora- tion in revised Agency-wide electronic records management policies. Define considerations to be addressed in determining appropriate time- frames for transfer of permanent electronic records to NARA and incorpo- rate guidance in directives. Amend regulations to ensure that ultimate "owner- ship" and disposition of data are covered as a matter of course. Review information systems request forms; match these to NARA's system description form 14028 to determine suitability of merging them. Use a form to notify the Agency's Records Manager of new information systems and data sets and provide information necessary in the scheduling process. Incorporate re- quirements for use of resultant forms in appropriate directives, as well as the need for documentation of each step of the system and records life cycle. Consider us- ing resulting information in the next information systems inventory. Work with NDPD to define an architecture to support electronic recordkeep- ing; specifically that which will permit retention of information and data scheduled for permanent or long-term retention in the Agency. Identify con- siderations (including budget) for use in selecting media, software, and hardware for records storage, use, and transfer to other formats/media, and retrieval of stored electronic records; incorporate in appropriate procedural guidance. ft f) Pooommonrtatinn^ ------- Recommended Framework for Analysis of Management of Electronic Records Policy Development and Dissemination Appendix A - Related Policy, Procedure, and Guidance Documents Appendix A - Related Policy, Procedure, and Guidance Documents ------- Recommended Framework for Policy Development and Dissemination Analysis ot Management ot Electronic Records Appendix A - Related Policy, Procedure, and Guidance Documents ------- EPA IRM-RELATED POLICIES REQUIRING INCORPORATION OF ELECTRONIC RECORDS CONSIDERATIONS GUIDANCE/STANDARDS POLICIES ADP Resource Management (2100, Ch.6) Data Administration (Draft?) Information Data Standards (2100, Ch.5) Electronic Reporting Information Collection (2100, Ch. 9) Information Security (2100, Ch. 8) IRM Clause of EPA Acquisition Regulation (EPAAR) IRM Management Controls (2100, Ch. 1) IRM Policy Manual (2100) & Chapters, Appendices - A - Glossary, B'- Federal Statutes Locational Data (2100, Ch. 13) Mission Based Planning (2100, Ch. 2) Policy Directive on Use of GSA 171 in Electronic Format Policy on Oversight of Dele- gated Environmental Programs Biological Taxonomy Data Standard CAD Data Exchange Standards CAS Registry Number Data Standard (2180.1) Central Data Base Environ- ment Standards Data Element Attribution Data Element Naming Conventions Data Standards for the Electronic Transmission of Laboratory Measurement Results (2180.2) Environmental Information Management; a State Resource Guide (220-R-92-001) EPA IRM Hardware & Software Standards Facility ID Standard (2180.3) Formulation of Data Definitions GIS Guidelines Document (88-01) Guidance for Developing Image Processing Systems in EPA (SDDG Suppl) PROCEDURES/MANUALS Access EPA (220-B-92-014) Administrative Systems Strategy Plan Agency Catalog of Data Policies & Standards (21M-1019) CICS Application Development Procedures Manual Common User Interface (CUI) Guidance Manual Data Administration Procedures Guide DB2 Application Development Procedures Delivery Order Project Officer's Guide to IRM Contracts EPA LAN Procedures & Operations Manual Facility ID Data Standard Implementation Plan Freedom of Information Manual (1550) Forms Management Manual (1355) GPS Primer A-l ------- POLICIES GUIDANCE/STANDARDS PROCEDURES/MANUALS Privacy Act (2100, Ch. 11) Public Access (Draft) Rulemaking Docket (2100, Ch. 14) Software Management (2100, Ch. 4) State/EPA Data Management (2100, Ch. 3) Synopsis of Significant Agency Policies Applicable for Inclu- sion and/or Reference in Agency Statement of Work for FIP Services TSCA-CBI Guide to NCC Services Information Systems Inventory (ISI) - (Scheduling information) IPS Contract Users' Guide LAN Administrator's Technical Reference Guide (397/001) LAN User's Guide Minimum Set of Data Elements for Ground Water (7500.1) Guide for ADP Reviews (2115) Information Security Manual Information Security Manual for PCs Instructions for Preparing Information Collection Requests (ICRs) IRM Strategic Plan, 1993-97 (220-R-92-003) IRM Support Services Delegation Authority (DPA) Guide OSWER Systems Life Cycle LAN User Manual Management Guidance (OSWER 9028.00c) SDMySystems Development LANSYS Procedure Manuals Methodology Locational Data Policy Implementation Guidance (Guide) NDPD Change Management NDPD Operational Policies Manual Operations & Maintenance Manual Prime Administrator's Guide Prime/SNA Administrator's Guide (8908-2LA) Privacy Act Manual (2190) Public Access: A "How To" Guide (220-B-92-021) Spatial Data Management Plan A-2 ------- POLICIES GUIDANCE/STANDARDS PROCEDURES/MANUALS Systems Design and Development Guidance (21M-1011) TSCA CBI Manual (7700) WIC/RIC Services A-3 ------- Records Management Specific POLICIES GUIDANCE/STANDARDS PROCEDURES/MANUALS Records Management (2100, Ch. 100) Model Regional Records Manage- ment Operating Procedures Manual (IMSD-91-020) Records Management Manual (2160) Records Management Series - Index to Agency Records Control Schedules (EPA-1MSD-91-007) Records Management Series - Using the Federal Records Center Guide (EPA-IMSD-91-004) A-4 ------- Recommended Framework (or Analysis of Management of Electronic Records Policy Development and Dissemination Appendix B - Chart Defining Major Requirements Appendix B - Chart Defining Major Requirements ------- Recommended Framework for Policy Development and Dissemination Analysis of Management of Electronic Records Appendix B - Chart Defining Major Requirements ------- MAJOR REQUIREMENTS TO BE COVERED IN EPA IRM-RELATED POLICIES, PROCEDURES AND GUIDANCE REQUIREMENT SOURCE* VEHICLE** definition and scope of electronic records, clear and F, E PL, G, PR understandable Agency responsibilities for electronic recordkeeping F PL, G, PR prohibit destruction of records under GAO audit, F PL, G court proceedings, or subject of FOIA request notify MARA and GSA of the name and title of F PL individual assigned records responsibilities standards for preserving, protecting and disposing of F PL, G records ensure compliance with the Privacy Act, FOIA and other F PL relevant legislation requirement to integrate electronic records management F PL with other records and IRM programs provide training on electronic records management and F, N G, PR responsibilities address electronic records management considerations F PL, G, PR before new or enhanced systems development efforts are undertaken address the entire life cycle; provide life cycle guidance F, E PL, G, PR establish records management plan; obtain approval of F PL, G Agency's records manager, identify permanent or long-term retention records not F, N, E PL, G, PR covered by the GRS and schedule their disposition, especially those records on microcomputers; schedule records, databases and systems incorporate disposition instructions and other electronic F G, PR recordkeeping decisions in the system design * F - Federal; N - NARA Evaluation Recommendations; E - EPA User Requirements ** PL - Policy; G - Guidance; PR - Procedure level directives B-l ------- REQUIREMENT SOURCE* VEHICLE* * necessary and adequate documentation of the record or F, N PL, G, PR the system to permit use and transfer to NARA; assign responsibility methods for controls on records that are proprietary, F G, PR sensitive, classified or covered by the Privacy Act definition of data elements required for disposition F G, PR training in the operation, care and handling of F PL, G, PR equipment, software and media used in the creation, use and storage of electronic records GAO requirements for financial records F PL, G application of requirements to records created or F, E PL, G maintained by contractors and grantees (E) review of the electronic records systems; develop F, N PL, G, PR evaluation program, including documentation implementation of NARA approved disposition F G, PR schedules internal audit controls to protect records from destruction F PL, G, PR or alteration documentation of, and controls on, the recordkeeping F PL, G, PR system's operations to ensure trustworthiness for evidence in court proceedings. requirements for official text documents F PL, G data necessary to permit personnel to retrieve, protect F G, PR or carry out disposition of documents correlation of related records on paper, microform or F PL, G, PR other media establishment of an appropriate filing and retrieval F G, PR system electronic records security in computer systems plans, F PL, G (per Computer Security Act of 1987) segregation of public information subject to release F PR under FOIA B-2 ------- REQUIREMENT SOURCE* VEHICLE** identification of systems containing sensitive F G, PR information criteria for selection of the appropriate media and F, E G, PR systems to store agency records avoidance of use of floppy disks for long-term storage F G of permanent and unscheduled records labeling of disks with disposition instructions F PR testing of tapes prior to using them for permanent and F PR unscheduled records verification of error free tapes F PR temperature and humidity controls necessary for F PR adequate maintenance of tapes tatistical sample size for tape libraries F PR tape testing and replacements before 10 years of age F PR data elements for labeling tapes and numeric data files F G, PR written procedures for direct access storage devices and F PR labeling of diskettes and removable disks procedures and schedule for transfer of electronic F PL, G, PR records, indexes and documentation to NARA procedures for recopying, reformatting, and other ' F PR necessary maintenance to ensure retention and usability throughout authorized life cycle ensure protection of sensitive, proprietary or national F PL, G, PR security information when disposing of electronic records revision and expansion of EPA guidance for the creation, N PL, G maintenance, use and disposition of electronic records inclusion of NARA's regulations and handbook require- N PL, G ments in agency guidance, and the wide dissemination of the policy and guidance within the Agency implement Federal requirements identified above N PL, G B-3 ------- REQUIREMENT SOURCE* VEHICLE* ~ centralize control over data files and assign specific N PL, G, PR responsibility for their documentation and disposition include records maintained on all types of systems: N PL, G micro, LANs, minis and mainframe computers develop comprehensive and up-to-date inventory of N G, PR records and systems of records include information about documentation in inventory N G, PR determine current status of permanent, older series N PR records created on mainframes and identify documen- tation (start with data at NCC and go to users for documentation) involve headquarters records management staff in N G planning new electronic records systems or modifications develop presentations for IRM officials and program N PR staff including responsibilities in relation to build in maintenance and disposition at systems development phase, and create and maintain appropriate documentation purge data from older TAPP and GICS systems per N 0 schedules prepare guidance to Regions from Headquarters; develop N G, PR records schedules on systems in Regions define difference between back-ups and records retention N, E G, PR and preservation (N); backups are scheduled for all EPA systems, not for records management or archival purposes; no procedures in place to prevent records disposal without proper authorization. How should retention of data scheduled for permanent or long-term retention be handled, whether on mainframe, LAN or image system? (E) specific coverage for electronic mail, bulletin boards and E G, PR LANs word processing documents (textual) and other records E G, PR created in WordPerfect Office systems. Can various versions of documents be tracked and maintained? standards for use of codes, naming conventions, E G, PR metadata and definitions of data elements B-4 ------- REQUIREMENT SOURCE* VEHICLE*« address security concerns in systems design for LANs, E PL, G mainframe use for public access, and electronic filing transferring electronic records to NARA - who, when E PL, G, PR and in what format. ownership of State generated records E PL, G special considerations for Superfiind records E G, PR regional records that may not enter the central NDPD E G, PR computer, (issues of aggregated and disaggregated data and their archival status) admissibility of electronic records in court proceedings E PL, G careful attention to auditability, system liability and E PL, G accountability to support Agency's regulatory and enforcement functions electronic filing; electronic signatures E PL, G large scientific databases and models; other scientific E PL, G, PR records costs associated with electronic recordkeeping; E PL, G particularly that associated with retention, maintenance of tapes and disks, and storage, as well as software and servers for LAN management of records. Who will pay? how to handle compound and complex, multi-media E G, PR documents that include text, charts, graphics and visuals models and analytical tools, where data is included E G, PR (Included here as well are such major systems as CERCLIS which contains analytical data, but is not a model or analytical tool) impact of possible Departmental status on Agency E PL recordkeeping use of LANS and computer files to reduce the paper used E PL, G in carrying out Agency functions how to transfer/move records between offices when E PL, G, PR organizational and other changes take place B-5 ------- Recommended Framework (or Analysis ot Management of Electronic Records Policy Development and Dissemination Appendix C - Bibliography Appendix C - Bibliography ------- Recommended Framework for Policy Development and Dissemination Analysis of Management of Electronic Records Appendix C - Biblioaraphy ------- BIBLIOGRAPHY LEGISLATIVE, NARA, GSA, OMB, GAO and NIST REQUIREMENTS Computer Security Act of 1987, P.L. 100-235, January 8, 1988. Computer Systems Laboratory. Electronic data interchange (EDI). Gaithersburg, MD, National Institute of Standards and Technology, March 29, 1991. FIPS PUB 161. Computer Systems Laboratory. Federal information processing standards publications (FIPS PUBS) index. Gaithersburg, MD, October 1991. NIST publications list 58. Digital signature standard. CSL Bulletin fNIST), January 1993, pp. 1-6. General Accounting Office. Title 8 - GAO policy and procedures manual for guidance of Federal agencies - records management. Washington, DC, February 1991. Transmittal sheet no. 8-8. General Records Schedules, GRS 20 and 23. Washington, DC, National Archives and Records Administration. General Services Administration. Creation, maintenance, and use of records. Federal Information Resources Management Regulation (FIRMR), Part 201-9. October 1990. Amendment 1. General Services Administration. Electronic records management. Federal Information Resources Management Regulation (FIRMR), Part 201-45.2. March 1990. Amendment 18. General Services Administration. Electronic Records Management. 41 CFR Part 201- 45. Federal Register, vol. 53, no. 233, December 5, 1988. pp. 48947-48939. General Services Administration. Evaluating electronic recordkeeping. Government Imaging, vol. 2, no. 2, March-April, 1993. pp. 11+. General Services Administration. Information resources procurement and management reviews (IR/PMR) handbook. Washington, DC, September 1992. General Services Administration. Management of records. Federal Information Resources Management Regulation (FIRMR), Part 201-45. March 1990. Amendment 18. C-l ------- General Services Administration. Predominant considerations. Federal Information Resources Management Regulation (FIRMR), Part 201-6. October 1990. Amendment 1. General Services Administration, Office of General Counsel. Memorandum to Claudine J. Weiher, Assistant Archivist for Program Support, subject: Admissibility of microformed and electronic records in formal legal proceedings. Washington, DC, August 20, 1984. General Services Administration, Information Resources Management Service. Applying technology to record systems; a media guideline. Washington, DC, May 1993. KML-93-1-R. General Services Administration, Information Resources Management Service. Electronic recordkeeping (a handbook). Washington, DC, General Services Administration, July 1989. General Services Administration, Information Resources Management Service. Records management and the development of automated information systems. Washington, DC, General Services Administration, August 1991. General Services Administration, Information Resources Management Service, Office of Innovative Office Systems. Electronic recordkeeping handbook (draft). Washington, DC, General Services Administration, October 1987. General Services Administration, Information Resources Management Service, Office of Innovative Office Systems. Evaluating electronic recordkeeping; a self-inspection guide for agencies. General Services Administration, November 1990. National Archives and Records Administration. 3480 class tape cartridge drives and archival data storage: technology assessment report, by Thomas E. Weir, Jr. Washington, DC, National Archives and Records Administration, June 1988. National Archives Technical Information Paper No. 4. National Archives and Records Administration. Electronic recordkeeping. Washington, DC, June 18, 1985. NARA Bulletin No. 85-2. National Archives and Records Administration. Electronic recordkeeping. Washington, DC, February 11, 1987. NARA Bulletin 87-5. National Archives and Records Administration. Electronic records management issues. Washington, DC, n. d. C-2 ------- National Archives and Records Administration. Functional requirements covering the information life-cycle to meet records management and archival needs (draft). Washington, DC, April 1992. National Archives and Records Administration. Memorandum to Agency Records Officers: Identifying, describing, and scheduling electronic records. Washington, DC, August 22, 1986. NI 10.86 National Archives and Records Administration. Machine-readable records. 44 U.S.C. Chap. 35 National Archives and Records Administration. Preservation of facsimile transmissions as Federal records. Washington, DC, June 26, 1991. NARA Bulletin 91-6. National Archives and Records Administration. Records management regulations; final rules...36 CFR Part 1220 et al. Federal Register, vol. 55, no. 127, July 2, 1990, pp. 27422-27439. National Archives and Records Administration. Strategy for electronic records. Washington, DC, July 31, 1991. National Archives and Records Administration. Use of optical disk systems to store permanent Federal records. Washington. DC, October 29, 1990. NARA Bulletin 91-2. National Archives and Records Administration, Archival Research and Evaluation Staff. A national archives strategy for the development and implementation of standards for the creation, transfer, access, and long-term storage of electronic records of the federal government. Washington, DC, National Archives and Records Administration, June 1990. National Archives and Records Administration, Office of Records Administration. Disposition of Federal records; a records management handbook. Washington, DC, 1992. National Archives and Records Administration, Office of Records Administration. Federal records management; laws and regulations. Washington, DC, 1991. National Archives and Records Administration, Office of Records Administration. Managing electronic records. Instructional Guide Series. Washington, DC, 1990. National Archives and Records Administration, Records Administration Information Center. Managing electronic records; an information package. Washington, DC, National Archives and Records Administration, 1986. C-3 ------- National Archives and Records Administration Act of 1984. Public Law 98-497, October 19, 1984. National Archives and Records Administration and General Services Administration. Electronic records management; final rules....36 CFR Part 1234 and 41 CFR Part 201- 45. Federal Register, vol. 55, no. 89, May 8, 1990, pp. 19216-10224. Office of Management and Budget. Electronic data interchange Federal programs and policies. Washington, DC, n. d. Presentation charts by Peter N. Weiss. Office of Management and Budget. Notice of (proposed) policy guidance on electronic collection of information. Washington, DC, August 7, 1987. Paperwork Reduction act of 1980. 44 U.S.C. 101. Washington, DC, December 11, 1980. Paperwork Reduction Act of 1993. Congressional Record, March 10, 1993, pp. S2663- 2672. President's Council on Management Improvement and the President's Council on Integrity and Efficiency. Model framework for management control over automated information systems. Washington, DC, Office of Management and Budget, January 1988. Security issues in the use of electronic data interchange. CSL Bulletin, June 1991, pp. 1-6. C-4 ------- U. S. ENVIRONMENTAL PROTECTION AGENCY Booz Allen & Hamilton, Inc. Analysis of current records management policy and identification of policy issues. Bethesda, MD, April 1, 1992. Delivery order 105 to Office of Information Resources Management. Booz-Allen and Hamilton, Inc. Management support and analysis of records management policy, procedures and guidance documents. Washington, DC, July 6, 1992. Delivery Order 105. Booz Allen & Hamilton, Inc. Recommended Framework for Policy Development and Dissemination. Bethesda, MD, June 10, 1992. Delivery Order 105. Chapter 8 - Documentation and preservation of electronic records (draft). Washington, DC, July 30, 1985. Electronic mail message, subject Highlights of RTP trip. Message from Michael Miller to Brigid Rapp and Daiva Balkus, 18 September 1992. Electronic mail message, subject Washington, DC Action items from OUTREACH visit. Message from Donald W. Fulford to Distribution, 3 September 1992. Electronic mail message, subject LANs and records retention. Message from Lisa Jenkins to Michael Miller, 10 July 1992. Electronic mail message, subject LAN news article: preserving E-Mail messages as records. Message from Lisa Jenkins to Gwen Wilder, 19 October 1992. Electronic mail message, subject MIS management group meeting held. Message from Sandra Martin to Alvin Pesachowitz, 13 October 1992. Electronic mail message, subject OSWER Bulletin Board. Message from Lynn Calvin to Michael Miller and Lisa Jenkins, 21 July 1992. Electronic mail message, subject Records management. Message from Deb Singer to Michael Miller, 6 August 1992. EPA's Privacy Act Systems of Records - 1974-1992. Information Management and Services Division. 2160 - Records management manual, 1984 edition. Washington, DC, July 13, 1984. Information Management and Services Division. 2160 - records management manual, change 1. Washington, DC, January 6, 1986. C-5 ------- Information Management and Services Division. Model regional records management operating procedures manual. Washington, DC, November 1991. EPA/IMSD-91-020. Information Management and Services Division. National records management program, (brochure). Washington, DC, August 1991. EPA/IMSD/91-009. Information Management and Services Division. Records management 1992: implementing a records management program at EPA Headquarters. Headquarters Records Management Conference. Rosslyn, VA, March 17, 1992 Information Management and Services Division, Information Access Branch. Access EPA - Records management programs (Draft). Washington, DC, May 24, 1991. EPA/IMSD-91-004, 1991 edition. Information. Management and Services Division, National Records Management Program. Headquarters records management in 1992 (briefing charts). Washington, DC, 1992. Information Management and Services Division, National Records Management Program, Information Access Branch. Practical guide to personal papers. Washington, DC, December 1992. EPA Records Management Technical Leaflet #3. EPA-220-F-92- 019. Information Management and Services Division. IRM policy inventory (draft). Washington, DC, February 2, 1993. OAR/OIRM/IMSD. Inspector General. Computer systems integrity: EPA must fully address longstanding information resources management problems. Washington, DC, September 28, 1992. Audit report no. E1NMF1-15-0032-2100641. (with cover memorandum to William K. Reilly). Inspector General. Memorandum to Christian R. Holmes and Richard D. Morgenstern from Kenneth A. Konz - Report of audit - computer systems integrity: EPA must fully address longstanding information resources management problems, (draft) Washington, DC, September 28, 1992. Audit report no. E1NMF1-15-0032. Justice, Department of. Letter from Steven Novick to Andy Gordon (EPA) re: admissibility of documents reproduced from optical disk records. Washington, DC, March 4, 1993. Memorandum from Michael L. Miller, National Program Manager for Records Management, to Jean Sammon, IMSD, dated April 19, 1991, subject: NDPD policies 200.01 and 200.02. C-6 ------- National Data Processing Division, Architectural Management & Planning Branch. Environmental Protection Agency information technology architecture, revision. Research Triangle Park, NC, November 1990. National Data Processing Division. Archiving tapes and data sets. Research Triangle Park, NC, July 24, 1991. NDPD operational policies manual no. 200.01. National Data Processing Division. Environmental Protection Agency Information Technology Architecture. Research Triangle Park, NC, November 1990, revised. National Data Processing Division. EPA E-mail system data management. Research Triangle Park, NC, February 23, 1989. NDPD Operational Policies Manual no. 320.07. National Data Processing Division. EPA LAN planning and design guidelines (review copy). Research Triangle Park, NC, February 1, 1990. National Data Processing Division. EPA-NCC IBM data management plan. Research Triangle Park, NC, April 2, 1993. National Data Processing Division. IPS data management. Research Triangle Park, NC, February 56 1991. NDPD Operational Policies Manual no. 250.10. National Data Processing Division. LAN manual. Research Triangle Park, n. d. National Data Processing Division. LAN security (draft). Research Triangle Park, NC, n. d. ' National Data Processing Division. LAN system management. Research Triangle Park, NC, U. S. Environmental Protection Agency, June 21, 1991. NDPD Operational Policies Manual no. 310.03. National Data Processing Division. NCC IBM mainframe data management. Research Triangle Park, NC, U. S. Environmental Protection Agency, May 22, 1990. NDPD Operational Policies Manual no. 210.09. National Data Processing Division. NCC VAX cluster data management. Research Triangle Park, NC, U. S. Environmental Protection Agency, August 1, 1989. NDPD Operational Policies Manual no. 230.09. National Data Processing Division. NDPD records management. Research Triangle Park, NC, U. S. Environmental Protection Agency, July 1, 1991. NDPD Operational Policies Manual no. 200.02. C-7 ------- National Data Processing Division. Proposed policy and procedures for record management. October 18, 1991, Memo #794. New York State Archives and Records Administration (SARA) Electronic records program status report.. Albany, March 29, 1993. Office of Administration and Resources Management. Index to Agency records control schedules; records management series. Washington, DC, July 1991. EPA/IMSD/91- 007. Office of Administration and Resources Management. Information security manual for personal computers. Washington, DC, December 1989. Office of Administration and Resources Management. IRM strategic plan 1991-1995. Washington, DC, November 1990. Office of Administration and Resources Management. IRM strategic plan, 1993-1997; managing our information resources, the "common currency" of EPA's approach to environmental management. Washington, DC, July 31, 1992. Office of Information Resources Management. Archives and records, electronic records, information resources management. Washington, DC, U. S. Environmental Protection Agency, n. d. EPA/OIRM 2160.1, interim bulletin. Office of Information Resources Management. Documentation and preservation of electronic records of the records management manual. Washington, DC, U.S. Environmental Protection Agency, April 9, 1986. 2160 chg 2. Office of Information Resources Management. Guidance for developing image processing systems in EPA: EPA system design and development guidance: supplement to volumes A & B. Washington, DC, February 1991. Office of Information Resources Management. Information resources management policy manual. Washington, DC, n. d. EPA/OIRM 2100. Especially Chapter 10 - records management. Office of Information Resources Management. OIRM records management procedures manual. Washington, DC, U. S. Environmental Protection Agency, December 1985. Office of Information Resources Management. EPA info access - records network communications. Washington, DC, various issues. C-8 ------- Office of Information Resources Management, Information Access Branch, National Records Management Program. Response to the National Archives and Records Administration (NARA) evaluation of EPA's records management program. Washington, DC, U. S. Environmental Protection Agency, July 1992. EPA 220-F-92- 014. Office of Information Resources Management, National GIS Program. Spatial data management plan (draft). Washington, DC, U.S. Environmental Protection Agency, November 1992. Office of Policy, Planning and Evaluation. Policy on electronic reporting; ERS policy statement. Federal Register. July 30, 1990, pp. 31030-31032. Records management in the Environmental Protection Agency; a NARA evaluation. Washington, DC, National Archives and Records Administration, February 1992. System design and definition for the EPA data quality indicator system: assessment of efforts to improve quality data sharing, final. Fairfax, VA, Ogden/ERC Government Systems, January 8, 1993. Deliverable no. 2. Technology Planning and Management Corporation. Analysis of management of electronic records, project management plan (final). Prepared for U.S. Environmental Protection Agency, National Data Processing Division, Information Technology Architectural Support, by the Viar Team. Durham, NC, February 25, 1993. ITAS8-271 (1-1). C-9 ------- GENERAL Administrative Conference of the United States. Electronic records management by Federal agencies, Committee on Governmental Processes draft recommendation. Washington, DC, October 18, 1990. Admissibility of electronically filed federal records as evidence. Government Information Quarterly, vol. 9, no. 2, 1992, pp. 155-167. American Management Systems, Inc. Critical success factors for systems modernization; a primer for senior managers in government. Washington, DC, General Services Administration, n. d. Automating the U. S. Patent and Trademark Office. McLean, VA, PRC, Inc. Ball, D. L. Data storage technology. Federal Data Center Issues 1991 - A View to the Future, pp. II-E-5 - II-E-20. Bass, Brad. EDGAR info on disc incites policy fight. Federal Computer Week, n. d., p. 4. Bearman, Davis. Electronic records guidelines; a manual for policy development and implementation. Archives and Museum Informatics, 1988. Canada. National Archives. Management of information in integrated office support systems (IOSS); preliminary functional specifications. Ottawa, May 24, 1988, third draft. Center for Electronic Records. Information about the Center for Electronic Records. National Archives and Records Administration, 1991. General Information Leaflet 36. Clinton Transition Team. The responsibilities of the National Archives and Records Administration: a framework for assessment. December 17, 1992. Commission on Physical Sciences, Mathematics and Applications. Proposal for planning meeting for a study of the long-term retention of scientific and technical records. Washington, DC, National Academy of Sciences, National Research Council. Committee on the Records of Government report. Sponsored by the American Council of Learned Societies, the Social Research Council, and the Council on Library Resources. Washington, March 1985. C-10 ------- Computer Systems Laboratory. Announcement of a workshop on security procedures for the Interchange of electronic documents, November 12 and 13, 1992. Gaithersburg, MD, National Institute of Standards and Technology, March 24, 1992. Computer Systems Laboratory. Computer systems publications. Gaithersburg, MD, National Institute of Standards and Technology, February 1993. NIST publications list 88. Cook, Terry. The electronic records archival programme at the National Archives of Canada: evolution and critical factors of success. Prepared for the CART/CIT Meeting, Washington, 22 April 1993. [Ottawa], March 19, 1993. Council of Federal Data Center Directors. Federal Data Center issues 1991; a view to the future. Washington, DC, n. d. Department of Defense, General Services Administration, and National Aeronautics and Space Administration. Federal acquisition regulation (FAR); rights in technical data. Federal Register, vol. 55, no. 199, October 15, 1990. Dollar, Charles and Weir, Thomas E., Jr. Archives administration, records management, and computer data exchange standards: an intersection of practices (draft). Washington, DC, National Archives and Records Administration, n. d. "Electronic Record" survey; synopsis of results. Washington, DC, U. S. Department of Justice, November 30, 1989. Fingerlund, Lisa. Management of electronic records in the United Nations. Prepared for the joint meeting of the NAGARA Committee on Information Technology and the SAA Committee on Automated Records and Techniques. New York, United Nations, Archives and Records Management Section, March 1993. General Services Administration, Information Resources Management Service. Optical disc; a Federal progress report. Washington, DC, September 1992. KMP-92-3-1. Greenhalg, Howard and Nelson, Mary S. Managing electronic records. Federal Data Center Issues 1991 - A View to the Future, pp. II-D-1 - II-D-4. Greeves, Robert, Chairman. Memorandum to IAC/IRM Members, subject: electronic recordkeeping study. Washington, DC, Interagency Committee on Information Resources Management, February 19, 1987. Hedstrom, Margaret L. Archives and manuscripts: machine-readable records. Chicago, Society of American Archivists, 1984. SAA Basic Manual Series. C-ll ------- Helsing, Cheryl, Marianne Swanson and Mary Anne Todd. Computer user's guide to the protection of information resources. Gaithersburg, MD, National Institute of Standards and Technology, October 1989. NIST special publication 500-171. Helsing, Cheryl, Marianne Swanson and Mary Anne Todd. Executive Guide to the protection of information resources. Gaithersburg, MD, National Institute of Standards and Technology, October 1989. NIST special publication 500-169. Helsing, Cheryl, Marianne Swanson and Mary Anne Todd. Management guide to the protection of information resources. Gaithersburg, MD, October 1989. NIST special publication 500-170. Information Management and Technology Division. Space operations; NASA is not properly safeguarding valuable data from past missions. Washington, DC, General Accounting Office. GAO/IMTEC-90-1. Inter-University Consortium for Political and Social Research. [Description]. Interagency Committee on Information Resources Management. Final report of the Special Task Group on electronic recordkeeping. Washington, DC, January 1987. Introduction to electronic data interchange. Alexandria, VA, Data Interchange Standards Association, Inc., September 1991. Jacobs, Richard A. Records disposition and magnetic tape, transcript of training lecture no. 56. Washington, DC, General Services Administration, April 1961. Justice, Department of; Justice Management Division, Systems Policy Staff. Admissibility of electronically filed Federal records as evidence (October 1991). Justice, Department of; Justice Management Division, Systems Policy Staff. Admissibility of electronically file Federal records as evidence: a guideline for Federal records managers or custodians. Washington, DC, U.S. Department of Justice, October 1990. Kellett, Richard N. Integrating legal requirements into electronic data interchange applications. Prepared in partial fulfillment of J.D. degree. Washington, DC, 1993. Kentucky Department for Libraries & Archives, Public Records Division. Electronic records program summary. April 4, 1993. C-12 ------- Kondos, George S. Admissibility of electronic records as evidence: a guideline for Federal records managers or custodians (draft). Washington, DC, U. S. Department of Justice, Justice Management Division. Office of Information Technology, Systems Policy Staff, November 6, 1986. Lundgren, Terry D. and Lundgren, Carol A. The extent and nature of computer-based records management in the United States. Information Resources Management Journal. Winter 1992, pp. 1-7. Memorandum for Trail Boss Graduates from Virginia Banister, Director, Planning and Develop Staff, General Services Administration, Information Resources Management Service, subject: New technologies and records management study, April 13, 1993. Memorandum from David M. Pritzker to persons interested in the Administrative Conference study of electronic records management by Federal agencies, subject: draft recommendation. Washington, DC, Administrative Conference of the United States, October 25, 1990. National Academy of Public Administration. The archives of the future: archival strategies for the treatment of electronic databases; a report for the National Archives and Records Administration. Washington, DC, The Academy, [1991]. National Academy of Public Administration. The effects of electronic recordkeeping on the historical record of the U. S. Government. Washington, DC, The Academy, January 1989. National Academy of Sciences, National Research Council, Commission on Physical Sciences, Mathematics, and Applications. Proposal for planning meeting for a study of the long-term retention of scientific and technical records. Washington, DC, n.d. National Bureau of Standards. Guidelines for documentation of computer programs and automated data systems for the initiation phase. Gaithersburg, MD, August 1, 1979. FIPS Pub. 64. NAPA study of electronic recordkeeping. Briefing charts created by the National Archives and Records Administration. Washington, DC, n. d. National Archives and Records Administration. Management, preservation and access for electronic records with enduring value; response to recommendations in "Taking a byte out of history: the archival preservation of Federal computer records". Washington, DC, July 1, 1991. National Archives and Records Administration. The National Archives and document management in integrated office systems (briefing material). Washington, DC, n. d. C-13 ------- National Archives and Records Administration. Summary of actions related to the recommendations of the National Academy of Public Administration study , "The effects of electronic recordkeeping on the historical record of the U.S. government". Washington, DC, August 1990. National Archives and Records Administration, Office of Records Administration. The management of electronic records in the 1990s; a report of a conference held June 21- 23, 1989, Easton, MD, August 1990. National Archives and Records Administration, Special Archives Division, Machine- Readable Branch Charge and limitations applying to Reproduction Services related to databases in the custody of the Machine-Readable Branch Washington, DC, n. d. National Historical Publications and Records Commission. Research issues in electronic records; report of the working meeting. St. Paul, Minnesota Historical Society, 1991. Office of Information and Regulatory Affairs. OMB circular no. A-130; proposed revisions. Briefing charts. Washington, DC, Office of Management and Budget, n. d. Office of Legal Policy, Office of Information and Privacy. Memorandum from Richard L. Huff and Daniel J. Metcalfe, Office of Information and Privacy to principal FOIA legal and administrative contacts at all Federal agencies, subject: Survey regarding "Electronic record" issues. Washington, DC, U. S. Department of Justice, May 1, 1989. Oliva, Lawrence. The world of paperless information. Information Management Bulletin, vol. 5, no. 1 & 2, 1992. Paperwork Reduction Act of 1993 as introduced by Sen. Nunn. Congressional Record - Senate. March 10, 1993, S2663-S2672. Paperwork Reduction Act Revisions - Recommendations of the NAGARA Institute on Electronic Records, June 1990. IRAC Journal, vol. 1, no. 3-90, September 1990, pp. 9- 11. Pennsylvania Historical and Museum Commission. Program. Performance guideline for the legal acceptance of records produced by information technology systems. Part I - Performance guideline for admissibility of records produced by information technology systems as evidence. Silver Spring, MD, Association for Information and Image Management, cl992. AIIM TR 31-1992. Perritt, Henry H., Jr. Electronic records management and archives. University of Pittsburgh Law Review, vol. 53, no. 4, Summer 1992, pp. 963-1024. C-14 ------- Perritt, Henry H., Jr. Report and recommendations on Federal Agency electronic records management and archives. Washington, DC, Administrative Conference of the United States, August 1990. Personnel electronic records management system (brochure). McLean, VA, PRC, Inc., n. d. President. National security information. Executive Order 12356, April 2, 1982. Federal Register, vol. 47, no. 66, April 6, 1982. PRC, Inc. Automating the U. S. Patent and Trademark Office, brochure. McLean, VA, PRC, Inc. Responsibilities of the National Archives and Records Administration: A framework for Assessment. Clinton Transition Team, December 17, 1992. Shea & Gardner. Discovery of computerized litigation support systems in Federal court. Prepared for Melvyn J. Goldenberg. Aspen Systems Corporation. Rockville, MD, Aspen Systems Corporation, December 30, 1987. Skaggs, Deborah. Alabama electronic records program status report. NAGARA Committee on Information Technology Meeting, April 23, 1993. Skupsky, Donald S. Legal requirements for microfilm, computer, and optical disk records. Englewood, CO, Information Requirements Clearinghouse, 1992. Sprehe, J. Timothy. The significance of "Admissibility of electronically filed federal records as evidence". Government Information Quarterly, vol. 9, no. 2, 1992, pp. 153- 154. U. S. House of Representatives, Committee on Government Operations. Taking a byte out of history: the archival preservation of Federal computer records. Twenty-fifth report by the Committee. Washington, DC, Government Printing Office, 1990. House Report 101-978. Use of optical disks for public records, technical report. Silver Spring, MD, Association for Information and Image Management, 1990. AIIM TR25-1990. Van Kirk, Doug. Downsizing host applications. INFO WORLD, December 28, 1992/ January 4, 1993, pp. 39, 42. Weiss, Peter N. Law and technology ~ can they keep abreast? presented to the 1991 Records Administration Conference "Electronic records management and the law". Washington, DC, May 22, 1991. C-15 ------- Wisconsin's electronic records work, 1991-1993. Wisconsin State Historical Society, Wisconsin's Archives Division. C-16 ------- AGENCY ELECTRONIC RECORDS DIRECTIVES Agency for International Development. Electronic recordkeeping requirements, chapter 8 of "AID Handbook". April 15, 1992. Agriculture, Department of. Information Management Division, Office of Information Resources Management. Electronic records management program. April 21, 1989. DR 3040-1. Agriculture, Department of. Food and Nutrition Service. Electronic recordkeeping, in Records Management Program. December 14, 1988. FNS instruction 270-1, rev. 2, ch. 5. Agriculture, Department of. Forest Service. Electronic office handbook. 1986. FSH 1309.15. Air Force, Department of the. Management of electronic records. 31 July 1991. AFR 4-35. Commerce, Department of. Managing electronic records. May 12, 1987. DAO 205-16. Commerce, Department of. National Oceanographic and Atmospheric Administration. Interim NOAA policy on management of environmental data and information. January 29, 1992. Drug Enforcement Agency. Managing electronic records, n. d. Energy, Department of. Electronic records management program (draft). June 4, 1992. DOE 1324.6A. Energy, Department of. Management of scientific and technical information. February 27, 1992. DOE 1430.1C. Federal Communications Commission. Electronic recordkeeping. January 21, 1991. FCCINST 1113.7. Federal Deposit Insurance Corporation. Electronic records. July 14, 1987. DACS circular 1210.10. Federal Emergency Management Agency. Records management electronic recordkeeping. October 11, 1990. FEMA manual 5450.1. C-17 ------- Federal Energy Regulatory Commission (FERC). FERC procedures governing use of electronic mail (E-Mail). Washington, DC., n.d. FERC Procedural manual (PM) 4-7. Federal Energy Regulatory Commission (FERC). FERC electronic mail utilization policies. Washington, DC, n. d. FERC Administrative Directive 4-7. Health and Human Services, Department of. Electronic records management, part 4 of "IRM manual". January 19, 1993. DHHS IRM circular #22. Interior, Department of. Managing records in electronic form. December 9, 1985. 382 DM 11.1. Interior, Department of, Bureau of Land Management. Electronic records administration, 1270-1 of "BLM Manual". September 17, 1992. Justice, Department of. Justice Management Division. Identification and maintenance of nondisposable machine-readable records (withdrawn 10/92). October 5, 1983. (National Aeronautics and Space Administration). Saving the right stuff. August 1985. Nuclear Regulatory Commission. NRC records management program, "Records Management". September 17, 1992, directive 3.53 Securities and Exchange Commission, Office of Filings, Information and Consumer Services. Electronic records. May 23, 1991, SECR 7-6. Small Business Administration. SBA electronic record disposition schedule (draft proposal), n. d. State, Department of. Electronic recordkeeping and the Department of State. Summer 1985. Transportation, Department of. Electronic recordkeeping (draft), chapter 10-2 of "Records Management". December 31, 1992. DOT HI350.2. Treasury, Department of. Bureau of Alcohol, Tobacco and Firearms. Records management program and records control schedule. December 23, 1987. ATF 0 1324.2A. Veterans Affairs, Department of. Electronic recordkeeping extracts from Record Management Program Manual. December 3, 1984. C-18 ------- Summary of Comments Recommended Framework for Policy Development and Dissemination Summary of Comments on Recommended Framework for Policy Development and Dissemination A complete listing of EPA management and staff those who reviewed and commented on the draft report is included in Appendix A Listing of Commenters. General com- ments, and the author's responses, are as follows. Several individuals commented on the length and verboseness of the Executive Summary and report. The Executive Summary is being shortened considerably. The text of the re- port is being edited to make it less verbose, to identify misuse of tenses, and to correct typographical errors. An effort is being made to clarify meaning where necessary. Text changes have been made to clarify the intent-that paper and cost savings can be ob- tained by moving records from storage of paper to electronic media. This conversion is also consistent with the Agency's pollution prevention initiatives. References to pre- vious reports have been strengthened. An effort has been made to point more clearly to the differences between paper and electronic records. Reductions in text will not be evident because the final report will be printed in a larger type size. One commenter felt that a standard framework was required (not just the general guid- ance in the report) for effective electronic records management. In response, the final re- port states that Agency-wide policy should be reinforced through guidance in appropriate manuals, with program specific guidance provided by the Program Offices, as indicated below: IRM Policy Manual (2100) - Agency-wide, containing chapters covering specific IRM policy areas: - Records Management Policy (2100, Chapter 10) - Agency-wide - Records Management Manual (2160) - Agency-wide - Electronic Records Policy - Agency-wide (recommended) - Electronic Records Manual - Agency-wide (recommended) - Electronic Records Directives - Program and Administrative Office Specific (recommended) - Electronic Records Procedures Manuals - Program and Administrative Office Specific (recommended) - Related Policy - Imaging, LAN, PC, etc. - impacted by, or impacting, elec- tronic records management - agency-wide. 1 ------- Recommended Framework for Policy Development and Dissemination Summary of Comments Examples: - Spatial data management plan, draft. November, 1992. - Guidance for developing image processing systems in EPA: EPA system de- sign and development guidance: supplement to volumes A & B. February 1991. - EPA LAN planning and design guidelines (review copy). NDPD, February 1, 1990. - Related Policy Manuals - Imaging, LAN, PC, etc. - agency-wide. - Related Directives and Procedures Manuals - Imaging, LAN, PC, etc. - Pro- gram and Administrative Office Specific. Many reviewers were confused or concerned by the draft's discussion of the need for co- ordinating related policies. We have examined other IRM policies and their impact on electronic records management or impact by electronic records management. In these policies, little if any attention was paid to recordkeeping issues. A major effort to revise existing policies is now underway in OIRM. This provides an opportunity to incorpo- rate electronic recordkeeping concerns by reference or by including a paragraph recogniz- ing the impacts. At present, only the Image Systems Guidance Manual stresses the im- portance of proper recordkeeping before conversion to an electronic image format. Several commenters felt that there were too many recommendations and that there was no order to them. They have now been grouped into four larger recommendations, with subsets of them spelling out in more detail what is covered in each. Review, consolidate, and simplify Agency policies, procedures and guidance. Make EPA staff aware of their responsibility to create and maintain adequate and proper documentation of government activities in any media. Incorporate electronic records management in Agency IRM planning, budgeting, and review processes. Institutionalize electronic records management in all mission program and IRM activities. Another set of comments expressed a concern for the costs that would be involved in electronic records management. These concerns are valid and the framework study does include the need for policies to require consideration of costs. However, the scope of this project did not permit cost-benefit analyses, determination of specific costs associ- ated with conversion of paper to electronic format, or the overall costs to bring the Agency's records management program to a level that fully meets Federal requirements. 2 ------- Summary of Comments Recommended Framework for Policy Development and Dissemination The Agency, is moving towards more electronic records and systems for adminis- trative and program support. This trend has cost implications regarding whether the determination is made that older records will need to be converted or the sys- tems will only incorporate current records forward. Policies should require that cost savings be documented before a conversion is undertaken. The requirements and costs for personnel and other resources associated with an agency-wide move to electronic records were not specifically addressed in the draft report, but an effort has been made in the final report to stress their impor- tance in policies and direction to Agency staff. More than one commenter pointed out that hardware and software for storage, use and transfer are costly and consideration of these costs will involve both OIRM and NDPD. Staff resources, as well as actual budget dollars, will need to be considered in any cost analyses. It is important to note, however, that there are a number of "lessons learned" documents from the GSA that report significant savings in the move to electronic from paper records. In addition, as one commenter pointed out, there will be savings in time and resources over time, and the savings in FOIA alone will be substantial. The impacts of FOIA on EPA's electronic records management program were not empha- sized in the draft report. An effort has been made to point to this major area of concern in a number of portions of the final report. It is certain that more and more FOIA re- quests will include electronic records, particularly those contained in electronic mail sys- tems. Procedures to maintain and locate such records will be essential. A number of other agencies have initiated systems which are meeting this need. These and others may need to be examined by the Agency in an effort to quickly address this problem area. The need for flexibility and the ability to change policies, procedures, and strategies with continuing evolutions in technology and Agency mission is addressed more suc- cinctly in the final report, as is the requirement for careful documentation of the elec- tronic record itself. Both record and systems documentation is required for longer term and permanent records to ensure their usability. Systems documentation should be tied into the Agency's life cycle guidance. The Agency's Records Officer should work with the task force currently charged with developing life cycle guidance to make sure that electronic records requirements are fully covered. Scientific records create a special problem within EPA. Many of these records are cre- ated by staff conducting experiments, others by investigators assigned to a specific pro- ject, and still others are generated automatically through laboratory instruments and com- puters. It is often difficult to correlate the electronic records with related records in other formats. In addition, it is often more difficult to bring an individual scientist's re- ------- Recommended Framework for Policy Development and Dissemination Summary of Comments cords under the same controls as those imposed on larger scientific systems, such as modeling projects. Thus, schema need to be devised for labelling and identifying those records which have longer term value, and provision made for their adequate storage. OIRM and ORD will need to work together to resolve many of these problems, A number of current IRM initiatives, such as public access and the imaging of dockets, have been added to the text of the final report. Pollution prevention as it impacts elec- tronic records is referred to in the report, though no separate section of the report is de- voted to the topic. The OIRM is currently undertaking a number of initiatives related to planning and data administration; both of these have implications for electronic record- keeping. Likewise, a number of policies are being revised. It is anticipated that these will incorporate electronic records management requirements recommended in the final report. Steps involved in the management of electronic records are the same as for paper re- cords, including scheduling permanent and non-permanent records, setting file date breaks, establishing separate records series, etc. However, for electronic records it is im- portant that media and transfer mechanisms be defmed early, and that both the records and the system containing the records be carefully documented. A major concern of more than one commenter related to the difficulty in identifying records and non-re- cords. The final report attempts to address this issue more clearly. There were a number of instances in the draft report that referred to the confusion be- tween OIRM policies and NDPD operational policies. These have been clarified in the final report, particularly those that relate to electronic mail and signatures. The new agreement between OIRM and NDPD on the coordination of policy and guidance will help with these issues in the future. A number of comments related to the need for mandatory guidance, the fact that policies and directives are only read by IRM people, that the electronic records policies should be made available in electronic form, that there needs to be an enforcement of the poli- cies, and that dissemination of policies and guidance needs to be improved. The report now attempts to provide some insights into how these can be accomplished, though the report's purpose is to provide a framework for the policies and not to tell the Agency how to enforce the policies. However, several of the comments offer guidance in how awareness of records responsibilities can be increased and how and where guidance might be provided. Where these have not been incorporated in the report, they are pointed out in this response to comments. Several suggestions included: Briefings at all levels and categories of the organization. Briefings through federal executive seminars, conferences, and training sessions should be mandatory. ------- Summary of Comments Recommended Framework for Policy Development and Dissemination Mandatory orientation sessions for top Agency officials. Specific advice on how to set up directories on hard drives, by record series. LAN volumes might be set up so that documents could be put there when files are broken, to be backed up and stored/archived as part of the dispositioning pro- gram. Such programs should be Agency-wide. Format for policy and guidance should be easily "digestible", user friendly. Mass mailings. VTX available off All-in-one, though not everyone is on the same electronic mail, bulletin board, etc. Documents prepared under WordPerfect Office or cc-mail are not archived centrally. A carefully planned system of policies and guidance, developed by OIRM. Records management concerns incorporated in OIRM data calls. Strengthened dissemination through the SIRMO network. Guidance that addresses the need to deal with existing paper prior to conversion of records of any kind. A large number of other specific comments on the draft report have been addressed in the final report. ------- Recommended Framework for Policy Development and Dissemination Summary of Comments 6 ------- Summary of Comments Recommended Framework for Policy Development and Dissemination Appendix A - Listing of Commenters ------- Recommended Framework for Policy Development and Dissemination Summary of Comments ------- Summary of Comments Recommended Framework for Policy Development and Dissemination Appendix A - Listing of Commenters Alcock, Joan Region 5 Bonina, George A. OPPTS - IMD Calvin, Lynn Region 5 - PMD, RRO Clore, Joseph Region 2 - OARAPM Greenstreet, Willis E. RTP - OARM Gregory, Gordon Region 7, OARAPM Hall, Clinton W. Ada, Oklahoma Hathaway, William B. Region 6, ARA for Management Hufford, Steve OIRM - IMSD Hughes, Margaret Region 10 - HWD Jenkins, Lisa OSWER - RMIS Johnson, Richard J. RTP - OARM, OIRM Jones, John C. Office of Inspector General Newland, Letitia OARM - Cine Palmer, Margo Region I - PMD Ross, Deborah L. Office of Water - RMO Rusincovitch, Frank SIRMO, Office of Executive Support Sammon, Jean OIRM - IMSD Singer-Redner, Deborah RTP - OARM, NDPD Whittington, Jim Region 4 - OPM ------- Recommended Framework for Policy Development and Dissemination Summary of Comments 2 ------- |