A vital records program identifies and protects records containing vital information necessary for an organization to continue its key functions and activities in case of an emergency/disaster.
Vital Records Policy
All University records designated as vital or essential to the operation of the University and which if destroyed would seriously impair or disrupt normal University affairs, or which by their loss might place the University in a state of legal or fiscal jeopardy, are to be secured, either by microfilm or other comparable duplication or suitable backup method of protection.
University departments have the primary responsibility to keep records designated as vital records safe and secure on a continuing basis regardless of the media format on which it is stored. Departmental responsibility for vital records is defined in the Business Policy Manual under the guidelines of Records and Records Management, Policy #907.
Informational
Based on business document analysis and in light of various recent disasters, all programs, offices, departments, and laboratories must determine what information must be protected and how to protect it. Departments should develop a plan of action to respond to emergencies or disasters that may damage their business records and provide for the recovery of needed information.
Purpose/Foundation
This document was developed as a guide and is designed to be a tool you can use to help you:
- Develop a plan for identifying and protecting vital information
- Conduct an analysis of threats and risks
- Select protection methods
- Implement and maintain a vital records protection program for your department or program
Objectives
The objectives of a vital records program are to:
- Identify records needed to conduct business under emergency operating conditions (first 72 hours following a disaster)
- Identify records needed to perform or reconstruct the organization's most mission-critical functions
- Identify records protecting the legal and financial rights of the organization/institution, its employees, and the people it serves
- Develop and implement cost effective methods, including off-site storage and the application of technology, to protect and safeguard those records identified as vital from loss, misuse, and unauthorized access or modification
- Develop policies, procedures, and a plan of action to assess damage and to begin recovery of any records that may be affected by an emergency or disaster, regardless of the storage medium
Types of Vital Records
There are two types of vital records:
- Emergency operating records - Records essential to the continued functioning of an organization during (emergency response activities) and after an emergency to ensure the continuation of the organization, and
- Rights and interests records - Records essential to the protection of the legal and financial rights of an organization and of the individuals directly affected by the organization's activities.
Examples:
- Emergency operating records - list of UM recovery staff, system backups, emergency preparedness plans
- Rights and interests records - payroll records
Important Points
Establishing and maintaining a vital records program takes time, labor, and money. Vital records should be restricted to those records that really are crucial for start-up of operations after a disaster occurs.
Other points to remember:
A small percentage of business records are vital, that is, essential to emergency functioning and to business continuance, and are difficult or impossible to replace. ARMA International and the National Archives and Records Administration (NARA) estimates that in most organizations, only 1-10% of their records are deemed vital. Some units may have no vital records.
The length of time the records are kept (retention) does not necessarily indicate that a record is vital, nor does a record designated as vital always remain vital.
Vital records may be in any format or medium (paper, electronic, microfilm, etc.). The vital records copy may not be the "original" -- the information contained, not the medium, is most important.
If the information is contained in a medium other than paper, consideration must be given to the technology required to access the information and the availability of that technology in the event of a disaster.
The Records Center (RC) can store vital records, and can offer 24-hour access. In many cases, the RC may be the best place to store records for protecting the department's/institution's financial and legal rights, but not the best place for emergency operating records, unless housed in a special and separate location within that facility.
1. Developing a Plan
Task 1. Write an assessment plan.
- Review the current status of the vital records program in your office, if any
- Identify what is to be accomplished
- Outline how the program will be developed and administered
Task 2. Develop forms for gathering information.
- Forms to list vital functions and records supporting those functions
Task 3. Identify broad categories of potentially vital records.
- Categories may include part or all of a records series or group of records.
- Examples: personnel records, system documentation, credential files, etc.
Task 4. Obtain approval from management to begin implementation; get the highest level of authority possible.
Task 5. Coordinate with other offices, e.g., Emergency Coordinator, Facilities Management, Security, Information Management, Risk Management, etc.
Task 6. Establish and assign program responsibilities, positions, I.D. badges and job descriptions.
Examples:
- Facility Vital Records Officer - ensures the protection of organizational vital records and oversees the vital records program.
- Facility Vital Records Liaison - coordinates the vital records program in the backup position.
Task 7. Communicate the vital records plan initiative to all staff.
Examples:
- Announcements at management coordinators meetings, executive team meetings, and in directives and postings
- Memoranda to unit chiefs and/or all staff from management
- Newsletters
- Electronic mail announcements
Task 8. Develop a timeline for completion.
Outputs for Phase 1
- Vital records development and implementation plan
- Questionnaire and form for information collection
- List of potential vital records categories
- Modified position descriptions
- Handouts and reference materials for staff
- Memo informing staff of initiative
2. Identifying Vital Records
Task 1. Identify essential staff to complete task.
Examples:
- Vital records officer
- Unit managers
- Records coordinators/liaisons
- Local emergency operations officer
Task 2. Brief department managers.
Task 3. Train people who will interview temporary or student staff, if needed.
Task 4. Refine list of potential records documenting vital functions:
- Emergency procedures
- Business resumption records
- Legal and financial rights records
Outputs for Phase 2
- Completed questionnaires or interview notes
- Listing of potential vital records
- How they are protected, and how can we improve on methods
3. Assessing the Threat
Task 1. Review existing disaster recovery plans and consolidate where possible.
Task 2. Identify applicable threats and risks.
Examples:
- Fire damage
- Water damage (flood, water pipe break, etc.)
- Winds, storms/tornadoes
- Earthquake
- Sabotage or terrorism
- Human error or carelessness
- Building or equipment failure
- Power loss or electric surge
- Insects, rodents, and other pests
- Mold and mildew
- Media deterioration or break-down
- Civil emergencies (riots, war, etc.)
- Other: __________________
Outputs for Phase 3
Risk assessment reports
4. Selecting Protection Methods
Task 1. Review completed questionnaires and forms.
Task 2. Compare the list of vital records to the records retention authorizations to determine if the retention of the records have a bearing on decisions on how the records will be protected. For example, if the records are permanent and are microfilmed, microfilm copies may be the best protection method.
Task 3. Assess current on-site storage and practices. For example, there may already be fire-resistant cabinets in use for other reasons that could be used for vital records protection.
Task 4. Determine which records:
- Have "built-in" duplication or dispersal and identify the location(s) and media format
- Need to be duplicated and stored off-site and identify the type of duplication
- Need to be stored in fire-resistant equipment on-site
- Have special considerations such as records with confidential business information (CBI) or other sensitive information
Task 5. Create a resource list of disaster recovery firms in your geographic area. Talk to Risk Management and determine response times, approaches, and capabilities of those firms contracted by the University's insurance company. Update the information at least annually.
Task 6. Identify "hot" and "cold" sites to accommodate electronic records, including applications for running the systems and system documentation.
Task 7. Submit lists of vital records and protection methods for each type of vital record to unit managers for comments.
Task 8. Respond to comments and revise lists, as needed.
Task 9. Compile final list of vital records and protection methods.
Task 10. Obtain approval of final list from top management.
- Outputs for Phase 4
- Draft list of vital records and protection methods
- Comments from managers
- Final list of vital records and protection methods
- Staff notifications
Examples:
- Announcement at Executive Staff meeting
- Newsletter articles
- LAN messages
5. Implementation and Testing
Task 1. Select appropriate off-site and on-site storage space and equipment.
Examples:
- Records Center
- Other storage facilities
- Other agency offices, etc.
Task 2. Purchase a