Essential Records

1. Essential Records

2. What are Essential Records? • Defined by Arizona State Statute §41-151.12(4) • (a) Records containing information necessary to the operations of government in the emergency created by a disaster. • (b) Records containing information necessary to protect the rights and interests of persons or to establish and affirm the powers and duties of governments in the resumption of operations after a disaster. • May also be referred to as Vital Records

3. What Are Essential Records? (contd.) • 5 core types of essential records: • Are necessary for emergency response • Are necessary to resume or continue operations • Protect the health, safety, property, and rights of residents • Would require massive resources to reconstruct • Document the history of communities and families • Essential records can be found in any format and in any medium.

4. Differentiate Essential Records from Other Records • Only a small percentage of records are essential, typically less than five percent. • Its critical value during and/or after an emergency makes a record essential. • As disruption time increases, more records become essential.

5. Which of Your City/Town’s Records Are Essential? • Essential records differ by department. • Each department must determine which of its records is or are essential. • What you need to know to identify essential records: • Your department’s essential functions • The stakeholders • Your department’s records • Relevant statutes, regulations, and standards

6. Know Your City/Town’s Essential Functions • Identification of essential records starts with understanding essential functions.

7. Know the Stakeholders • Who depends on you? Who do you depend on? • Individuals • Other departments • Outside organizations • Who provides mission-critical support? • Information technology • Human resources • Legal and accounting • Emergency management, COOP

8. Know Your City/Town’s Records • Importance of a good records management program • Records inventories • Records retention schedules

9. Know Relevant Statutes, Regulations, and Standards • Statutes and ordinances that apply to your locality. • Regulations issued by federal,state and local governments. • Standards from federal agencies and national organizations. • Guidance from state and federal agencies, professional and industry associations.

10. Determine Essential Functions • During an emergency, essential functions: • Provide vital services • Exercise civil authority • Maintain the safety and well-being of the general population • Sustain the jurisdiction’s industrial economic base • Essential functions must continue under all circumstances.

11. Steps to Determine Essential Functions • Step 1: Identify and Analyze Your Department’s Business Functions • Review the city/town and departmental statements, internal directives, laws, and/or regulations that may pertain to your department’s mission. • Check with IT and Emergency Management • Answer the following: • What business functions are performed by your department? • What are the statutory or legal requirements? • What are the program responsibilities? • What functions not normally performed by your department might be required in an emergency? • What are the requirements in your COOP Plan, if any?

12. Steps to Determine Essential Functions (cont’d.) • Step 2: Determine the Essential Business Functions • Is there anything that your department does that is critical? • Which of these critical functions are performed only by your own department? • Is there an alternative method of carrying out those functions during the emergency and recovery periods? • After eliminating the business functions for which there are alternative methods of support, what functions are left? These are your essential business functions.

13. Steps to Determine Essential Functions (cont’d.) • Step 3: Determine the Essential Records That Support Those Functions • Do you consider any of these records to be invaluable? • Are there records that you create or maintain that the public would need in an emergency? • How soon would you need access to duplicates of these records? • Think about what records your department creates or maintains that may be essential to other agencies or emergency services. • Check the records that support essential functions against the five core types of essential records.

14. Interview Stakeholders • Interview key stakeholders and staff to get information about essential functions. • Ask specific and pointed questions: • Yes: “What if you didn’t have access to that series of records for 24 hours?” • No: “How long could you operate without that series of records?” • You may also want to use a questionnaire to gather information.

15. Protect Essential Records

16. Risk Assessment — Types of Risks • Risks from loss of agency memory • Can be physical loss or intellectual loss • Risks related to emergencies • Natural emergencies • Technological emergencies • Civil emergencies • Risks related to records management • Legal • Security • Business • Accountability • Technology • Long-term preservation of records

17. Risk Assessment — Scope of Emergency • Onsite • Immediate vicinity • Community- or region-wide Photo courtesy of NARA

18. Factors to Consider When Assessing Risk • Existing risks to records • Physical location of the essential records • Security and controls already in place • Vulnerable areas • Timing

19. Risk Analysis — Method to Evaluate Risks • Establish a rating system: • Probability rating • Impact rating • Rate your risks. • Evaluate your findings.

20. Step 1: Establish a Rating System

21. Step 1: Establish a Rating System (cont’d.) • Compile ratings to create your rating system Risk Analysis Rating System Impact of Risk Probability of Risk

22. Step 2: Rate Your Risks • Rate each risk identified in your risk analysis. • Example: Essential records in 2nd-floor procurement office—identified risks: • Debris blocking access to cabinets • Debris and water from storm • Mold and mildew • Temperature and humidity—unstable environment • Loss of data • Fire damage • Inability to access data • Inability to communicate

23. Step 2: Rate Your Risks (cont’d.)

24. Step 3: Evaluate Your Findings • Determine your threshold for action Risk Analysis Rating System = Action = No action Impact of Risk Probability of Risk

25. Managing the Risk: Prioritizing Actions • To prioritize your actions, rank the risks that require action. • When prioritizing, consider: • Cost to reconstruct the data • Cost of defending against legal actions associated with loss

26. Document the Risks • Document the results of your risk assessment, risk analysis, and prioritizing. • Prepare a strategy to communicate your findings to your City/Town leaders so they can address the risks as: • Part of the COOP planning • Part of the essential records program planning • Part of emergency planning • Part of records management and information technology planning

27. Strategies for Handling Risk • Acceptance • Mitigation Consider the different formats available and the cost associated with each Photo courtesy of Tina Seetoo, Georgia Archives

28. Duplication of the Original Records Duplication formats: • Microform • Digital formats • Backup tapes • Paper

29. Storage of Essential Records • On-site storage options: • Vaults • Secure central file rooms • Fire-resistant containers • Off-site storage options: • Another office • Agreement with another city/town • Commercial storage facility • “Hot” and “cold” sites Photo courtesy of NARA

30. Make Essential Records Available • Cities/Towns must be prepared to access their essential records. • Retrieval procedures should require only routine effort. • All equipment needed to read essential records must be available.

31. Access Essential Records

32. Priority Levels and Timeframes for Accessing Essential Records • Priority 1—First 12 hours • Needed immediately, to respond to the incident • Necessary to resume or continue operations • Priority 2—First 12–72 hours • Needed to manage the incident and resume operations • Protects the health, safety, property, and rights of residents • Priority 3—After first 72 hours • Needed to continue essential functions and for long-term recovery • Requires massive resources to reconstruct • Documents the history of communities and families

33. Access Priorities Table This chart is based in part on ARMA International, ANSI-ARMA 5-2003 Vital Records: Identifying, Managing, and Recovering Business-Critical Records

34. “Grab and Go” Kits • Certain City/Town officials will be on call immediately following the emergency. • They should have “Grab and Go” kits that contain specific essential records. • Develop procedures to keep “Grab and Go” kits up-to-date • Use cycling to replace records that are changing to ensure you have current information

35. Develop Procedures to Ensure Access to Essential Records • To ensure access, City/Towns should develop and document: • Policies • Delegations of authority • Responsibilities of agency officials • Procedures governing the essential records program • Incorporate your essential records into your COOP plan

36. Don’t Forget Your Stakeholders • Your network of stakeholders is invaluable for integrating your essential records emergency planning with your current COOP Plan • COOP Manager • Emergency Managers • Agency head • IT director • Legal and accounting staff • Records management personnel • Custodians of archival records • Agencies or outside organizations

37. Records Emergency Planning and Response

38. Overview of Emergency Planning and the REAP

39. Phases of Emergency Management

40. Federal Guidance on Emergency Preparedness and Response • National Response Framework (NRF) • National Incident Management System (NIMS) • Incident Command System (ICS) • Developing and Maintaining State, Territorial, Tribal, and Local Government Emergency Plans—Comprehensive Preparedness Guide 101 (CPG 101) • FEMA Continuity Guidance for Non-Federal Entities • Continuity Guidance Circular 1 (CGC1) • Continuity Assistance Tool (CAT)

41. Emergency Response—How it Works at the Local Level • Response always starts at the local level. • Each state government has its own emergency response plan. • Several levels of government may become involved. • NIMS ensures that all responders are operating and communicating under the same protocols for incident management. • ICS ensures a clear chain of command. • CGC1 and CAT ensure that operations will resume.

42. What is a Records Emergency Action Plan (REAP)? • A REAP is a written, approved, implemented, and periodically tested plan that includes the information and actions needed to respond to and recover from a records emergency. • All response and recovery players should participate in developing, approving, and testing the plan. • The REAP is part of a larger disaster plan. • It is not the disaster plan itself; it is only an element of the plan. • The portion of your disaster plan that includes records

43. Six Keys to Successful Response and Recovery A detailed REAP Committed management Educated and trained staff Timely initial response Effective communication Quick, informed decisions

44. Preparing a Records Emergency Action Plan

45. Identify the Disaster Plans and People Relevant to Your City/Town • Identify the disaster plans in place so your REAP can: • Tie into those plans most effectively • Address any records-specific shortcomings they may have • Identify and meet your emergency planning personnel to inform them about your REAP planning project.

46. Forming an Action Team • Identify the members: • Select staff who are flexible and capable of performing well under pressure. • Select employees at all levels. • Select employees who represent all functions. • Assign responsibility. • Select team leadership.

47. Components of the REAP • Introduction • Policy Statement • Responsibilities and Authorities • Communication Plan • Emergency Contact Directory • Locations of Essential Records • Records Salvage Priorities • Supplies • Financial or Funding Information • Vendors and Suppliers • Contractor Statement of Work • Facility Information • Staging Space • Preparedness, Response, and Recovery Procedures • Training, Testing, and Updating • Appendixes

48. Introduction • States the purpose of the REAP and the entire preparedness program • Includes information about: • The scope of the plan (what functional units it covers) • How to use the document • The date of creation or revision • How to revise the document

49. Policy Statement • A clear, dated policy statement or directive • From the most senior officer in the agency • Approves the plan and identifies it as an official agency policy

50. Responsibilities and Authorities • Delegation of authority and chain of command • Roles and responsibilities for various activities • REAP Teams • Records Response and Recovery Manager • Other assignments