Essential Records

What are Essential Records? ▪ Defined by Arizona State Statute § (4) ▪ (a) Records containing information necessary to the operations of government in the emergency created by a disaster. ▪ (b) Records containing information necessary to protect the rights and interests of persons or to establish and affirm the powers and duties of governments in the resumption of operations after a disaster. ▪ May also be referred to as Vital Records

What Are Essential Records? (contd.) ▪ 5 core types of essential records: ▪ Are necessary for emergency response ▪ Are necessary to resume or continue operations ▪ Protect the health, safety, property, and rights of residents ▪ Would require massive resources to reconstruct ▪ Document the history of communities and families ▪ Essential records can be found in any format and in any medium.

Differentiate Essential Records from Other Records ▪ Only a small percentage of records are essential, typically less than five percent. ▪ Its critical value during and/or after an emergency makes a record essential. ▪ As disruption time increases, more records become essential.

Which of Your City/Town’s Records Are Essential? ▪ Essential records differ by department. ▪ Each department must determine which of its records is or are essential. ▪ What you need to know to identify essential records: ▪ Your department’s essential functions ▪ The stakeholders ▪ Your department’s records ▪ Relevant statutes, regulations, and standards

Know Your City/Town’s Essential Functions ▪ Identification of essential records starts with understanding essential functions.

Know the Stakeholders ▪ Who depends on you? Who do you depend on? ▪ Individuals ▪ Other departments ▪ Outside organizations ▪ Who provides mission-critical support? ▪ Information technology ▪ Human resources ▪ Legal and accounting ▪ Emergency management, COOP

Know Your City/Town’s Records ▪ Importance of a good records management program ▪ Records inventories ▪ Records retention schedules

Know Relevant Statutes, Regulations, and Standards ▪ Statutes and ordinances that apply to your locality. ▪ Regulations issued by federal, state and local governments. ▪ Standards from federal agencies and national organizations. ▪ Guidance from state and federal agencies, professional and industry associations.

Determine Essential Functions ▪ During an emergency, essential functions: ▪ Provide vital services ▪ Exercise civil authority ▪ Maintain the safety and well-being of the general population ▪ Sustain the jurisdiction’s industrial economic base ▪ Essential functions must continue under all circumstances.

Steps to Determine Essential Functions ▪ Step 1: Identify and Analyze Your Department’s Business Functions ▪ Review the city/town and departmental statements, internal directives, laws, and/or regulations that may pertain to your department’s mission. ▪ Check with IT and Emergency Management ▪ Answer the following: ▪ What business functions are performed by your department? ▪ What are the statutory or legal requirements? ▪ What are the program responsibilities? ▪ What functions not normally performed by your department might be required in an emergency? ▪ What are the requirements in your COOP Plan, if any?

Steps to Determine Essential Functions (cont’d.) ▪ Step 2: Determine the Essential Business Functions 1. Is there anything that your department does that is critical? 2. Which of these critical functions are performed only by your own department? 3. Is there an alternative method of carrying out those functions during the emergency and recovery periods? 4. After eliminating the business functions for which there are alternative methods of support, what functions are left? These are your essential business functions.

Steps to Determine Essential Functions (cont’d.) ▪ Step 3: Determine the Essential Records That Support Those Functions ▪ Do you consider any of these records to be invaluable? ▪ Are there records that you create or maintain that the public would need in an emergency? ▪ How soon would you need access to duplicates of these records? ▪ Think about what records your department creates or maintains that may be essential to other agencies or emergency services. ▪ Check the records that support essential functions against the five core types of essential records.

Interview Stakeholders ▪ Interview key stakeholders and staff to get information about essential functions. ▪ Ask specific and pointed questions: ▪ Yes: “What if you didn’t have access to that series of records for 24 hours?” ▪ No: “How long could you operate without that series of records?” ▪ You may also want to use a questionnaire to gather information.

Protect Essential Records

Risk Assessment — Types of Risks ▪ Risks from loss of agency memory ▪ Can be physical loss or intellectual loss ▪ Risks related to emergencies ▪ Natural emergencies ▪ Technological emergencies ▪ Civil emergencies ▪ Risks related to records management ▪ Legal ▪ Security ▪ Business ▪ Accountability ▪ Technology ▪ Long-term preservation of records

Risk Assessment — Scope of Emergency ▪ Onsite ▪ Immediate vicinity ▪ Community- or region-wide Photo courtesy of NARA

Factors to Consider When Assessing Risk ▪ Existing risks to records ▪ Physical location of the essential records ▪ Security and controls already in place ▪ Vulnerable areas ▪ Timing

Risk Analysis — Method to Evaluate Risks ▪ Establish a rating system: ▪ Probability rating ▪ Impact rating ▪ Rate your risks. ▪ Evaluate your findings.

Step 1: Establish a Rating System Probability Rating ScaleCriterion HighThe event is expected to occur. Medium Similar events have occurred in the past. Low The event has little chance of occurring. Impact Rating ScaleCriterion High Catastrophic impact; devastating loss. Mediu m Serious/critical impact; significant loss. Low Minor/marginal impact; some loss.

Step 1: Establish a Rating System (cont’d.) ▪ Compile ratings to create your rating system HighCatastrophic impact; devastating loss The event has little chance of occurring. Catastrophic impact; devastating loss Similar events have occurred in the past. Catastrophic impact; devastating loss The event is expected to occur. MediumSerious/critical impact; significant loss The event has little chance of occurring. Serious/critical impact; significant loss Similar events have occurred in the past. Serious/critical impact; significant loss The event is expected to occur. LowMinor/marginal impact; some loss The event has little chance of occurring. Minor/marginal impact; some loss Similar events have occurred in the past. Minor/marginal impact; some loss The event is expected to occur. LowMediumHigh Probability of Risk Risk Analysis Rating System Impact of Risk

Step 2: Rate Your Risks ▪ Rate each risk identified in your risk analysis. ▪ Example: Essential records in 2nd-floor procurement office—identified risks: ▪ Debris blocking access to cabinets ▪ Debris and water from storm ▪ Mold and mildew ▪ Temperature and humidity—unstable environment ▪ Loss of data ▪ Fire damage ▪ Inability to access data ▪ Inability to communicate

Step 2: Rate Your Risks (cont’d.) Identified RiskProbabilityImpact 1. Debris blocking access to cabinetsHigh 2. Debris and water from stormHigh 3. Mold and mildewMediumHigh 4. Temperature and humidity — unstable environment Medium 5. Loss of dataMediumHigh 6. Fire damageLowMedium 7. Inability to access dataMediumHigh 8. Inability to communicateMediumHigh

Step 3: Evaluate Your Findings ▪ Determine your threshold for action HighCatastrophic impact; devastating loss The event has little chance of occurring. Catastrophic impact; devastating loss Similar events have occurred in the past. Catastrophic impact; devastating loss The event is expected to occur. MediumSerious/critical impact; significant loss The event has little chance of occurring. Serious/critical impact; significant loss Similar events have occurred in the past. Serious/critical impact; significant loss The event is expected to occur. LowMinor/marginal impact; some loss The event has little chance of occurring. Minor/marginal impact; some loss Similar events have occurred in the past. Minor/marginal impact; some loss The event is expected to occur. LowMediumHigh Probability of Risk Risk Analysis Rating System Impact of Risk = Action = No action

Managing the Risk: Prioritizing Actions ▪ To prioritize your actions, rank the risks that require action. ▪ When prioritizing, consider: ▪ Cost to reconstruct the data ▪ Cost of defending against legal actions associated with loss

Document the Risks ▪ Document the results of your risk assessment, risk analysis, and prioritizing. ▪ Prepare a strategy to communicate your findings to your City/Town leaders so they can address the risks as: ▪ Part of the COOP planning ▪ Part of the essential records program planning ▪ Part of emergency planning ▪ Part of records management and information technology planning

Strategies for Handling Risk ▪ Acceptance ▪ Mitigation Consider the different formats available and the cost associated with each Photo courtesy of Tina Seetoo, Georgia Archives

Duplication of the Original Records Duplication formats: ▪ Microform ▪ Digital formats ▪ Backup tapes ▪ Paper

Storage of Essential Records ▪ On-site storage options: ▪ Vaults ▪ Secure central file rooms ▪ Fire-resistant containers ▪ Off-site storage options: ▪ Another office ▪ Agreement with another city/town ▪ Commercial storage facility ▪ “Hot” and “cold” sites Photo courtesy of NARA

Make Essential Records Available ▪ Cities/Towns must be prepared to access their essential records. ▪ Retrieval procedures should require only routine effort. ▪ All equipment needed to read essential records must be available.

Access Essential Records

Priority Levels and Timeframes for Accessing Essential Records ▪ Priority 1—First 12 hours ▪ Needed immediately, to respond to the incident ▪ Necessary to resume or continue operations ▪ Priority 2—First 12–72 hours ▪ Needed to manage the incident and resume operations ▪ Protects the health, safety, property, and rights of residents ▪ Priority 3—After first 72 hours ▪ Needed to continue essential functions and for long-term recovery ▪ Requires massive resources to reconstruct ▪ Documents the history of communities and families

Access Priorities Table LevelDefinitionAccessExamples Timeframe for Access Priority 1Records essential for response and emergency operations and therefore needed immediately Physical protective storage is close to disaster response site for immediate access. Electronic replication methods are available for immediate access to information. Emergency action plan Business continuity plan Vital records manual Current facility drawings Personnel security clearance files Within the first 0–12 hours *Store in close proximity Priority 2Records essential for quick resumption and continuation of business following an emergency Physical protective storage is close to disaster recovery site for quick business resumption. Electronic methods are quickly accessible, and backups can be quickly restored. Current client files In-progress Accounts Payable and Accounts Receivable Research documentation Current contracts and agreements Within the first 12–72 hours Priority 3Records needed to continue essential functions if normal agency information were unavailable for a prolonged period Physical protective storage is accessible and outside of the disaster area. Accounts Payable and Accounts Receivable files Existing contracts and agreements Unaudited financial records After the first 72 hours This chart is based in part on ARMA International, ANSI-ARMA Vital Records: Identifying, Managing, and Recovering Business-Critical Records

“Grab and Go” Kits ▪ Certain City/Town officials will be on call immediately following the emergency. ▪ They should have “Grab and Go” kits that contain specific essential records. ▪ Develop procedures to keep “Grab and Go” kits up-to-date ▪ Use cycling to replace records that are changing to ensure you have current information

Develop Procedures to Ensure Access to Essential Records ▪ To ensure access, City/Towns should develop and document: ▪ Policies ▪ Delegations of authority ▪ Responsibilities of agency officials ▪ Procedures governing the essential records program ▪ Incorporate your essential records into your COOP plan

Don’t Forget Your Stakeholders ▪ Your network of stakeholders is invaluable for integrating your essential records emergency planning with your current COOP Plan ▪ COOP Manager ▪ Emergency Managers ▪ Agency head ▪ IT director ▪ Legal and accounting staff ▪ Records management personnel ▪ Custodians of archival records ▪ Agencies or outside organizations