Guidebook To Long-Term Retention Part 1: Challenges And Effective Approaches
0 likes66 views
This white paper, the first in a series, addresses the definition and challenges of long-term record retention in organizations, emphasizing that any record meant to be stored for over 10 years qualifies as a long-term record. It provides strategies for managing electronic records, including converting them to standard formats and conducting regular reviews to improve retention practices. Additionally, it highlights common pitfalls that can undermine long-term records management, such as retaining unnecessary documents and lacking targeted email management.
Guidebook To Long-Term Retention Part 1: Challenges And Effective Approaches
- 1. What constitutes a long-term record? How should organizations manage records with long retention periods, and assure such records are accessible many years into the future? This white paper, the first in a four-part series, focuses on the definition and basic challenges of long-term record retention and introduces the topics discussed in the following papers. DISTINGUISHING LONG-TERM RECORDS FROM ALL THE REST What is the temporal threshold that defines a long-term record? Record retention requirement periods vary, depending on the information’s value to the business, regulations and jurisdictions. To a certain extent, organizations with a “keep everything” culture may find that most of their records are long- term. Every organization will define long-term records differently as well as the media types used for retention and storage. Archive solutions will also vary. Despite these differences, there are some simple guidelines to help determine your organization’s long-term record threshold: »» Any record designated as “permanent” qualifies as long-term (see sidebar), as do those records considered historical for the corporation. These records may not always be in paper or electronic format, but may include physical artifacts of the organization’s history. »» Those records with the longest retention periods in the Records Retention Schedule (RRS) as mandated by business continuity, law or regulation, typically 10 years or longer. »» “Event-based” records whose retention may not begin for a long time after they are created or received. »» Records whose value continues past their retention period, by transitioning to a “big data lake” where the information can be used for analytics. »» Records housed in systems with older technology that may become obsolete during the retention period of the record itself. (See sidebar on page 2 regarding common long-term formats for electronic records.) While the exact definition of long-term records may vary based on an organization’s specific business drivers, media format and storage solutions, in general, any record that needs to be stored for more than 10 years can be considered a long-term record. CONTENTS —— Introduction —— Distinguishing Long-Term Records From All the Rest —— Retention Strategies for Long-Term Electronic Records —— Practices that Undermines Long-Term Records Management —— Management Strategies for Long-Term Records —— Conclusion WHITE PAPER GUIDEBOOK TO LONG-TERM RETENTION PART 1: CHALLENGES AND EFFECTIVE APPROACHES PERMANENT RECORDS Permanent records document significant transactions, policies, decisions or services and retain legal, administrative and historical value without regard to any timeframe. They should be routinely committed to a secure archive in order to provide accessibility for future users.
- 2. 2800.899.IRON | ironmountain.com RETENTION STRATEGIES FOR LONG-TERM ELECTRONIC RECORDS Changing technologies will have an effect on the management of long- term electronic records. The main considerations are predictable hardware obsolescence, ever-changing software platforms and releases, obsolete data formats and questionable integrity of storage media. These considerations can force a change in the way you store your records. Below are some strategies for meeting these challenges: »» Convert records from proprietary or potentially obsolete formats to standard archival formats (see sidebar on PDF/A and NARA 2014-10: Appendix A). »» Extract electronic records from obsolete software, hardware and other media into a central repository appropriate for long-term retention, so that records can be moved from retired systems or media with a short shelf life. »» Consolidate and/or regularly migrate electronic records to the most current version of the record format to ensure that they will be readable in the future (e.g, Microsoft Office application files). »» Convert records from digital to analog, by printing out digital records and storing them along with physical record — for instance, adding a small amount of email correspondence documenting contract negotiations with a set of hard copy contracts. Each of these approaches has advantages and disadvantages. Before undertaking a conversion or consolidation, it is wise to raise the subject with your information governance council or seek legal advice and make sure the new format will maintain any metadata necessary to prove its authenticity. The bottom line is that organizations should have a strategy for dealing with the inevitable obsolescence of software and hardware systems in place today and provide for archiving and managing records for the long term. PRACTICES THAT UNDERMINE LONG-TERM RECORDS MANAGEMENT While all organizations face the challenges of long-term records management, certain practices can make things even more problematic. Here are some situations that could exist: »» Retention of records far beyond their required period because an organization does not want to manage event-driven or conditional retention periods. As an example, a company decides to keep all employee records for 30 years. While the turnover rate is low, managing the records for according to the retention schedule (i.e., 10 years after employee departure) would result in more efficient disposition. »» Consolidation of all records in a department into a single “high watermark” retention period (i.e., 12 years) where the majority of the records could be defensibly destroyed in five years or less. THE PDF/A DEFINITION OF “LONG-TERM” Here’s some food for thought: long-term can be regarded as “…the period of time long enough for there to be concern about the impacts of changing technologies, including support for new media and data formats, and of a changing user community, on the information being held in a repository, which may extend into the indefinite future.”1 LEGAL IMPLICATIONS OF FORMAT CONVERSION Rules 1001 and 1003 of the Federal Rules of Evidence state that a duplicate of a document is legally admissible unless a genuine question is raised about the original’s authenticity. Similar guidelines apply in other countries. Duplicates of long- term records must be accurate and trustworthy representations of the originals, securely stored along with relevant metadata. So, are long-term records that are converted or migrated from one format (e.g., native format to PDF) to another legally admissible? Perhaps, but before embarking on a conversion, involve legal counsel in the decision. 1 Source: ISO 19005-1:2005 (PDF/A-1)
- 3. 3 800.899.IRON | ironmountain.com »» All information for a single activity is kept, regardless of the legal or regulatory requirements, multiple versions and drafts, correspondence and other trivial information that was not separated from the record content. »» Blanket legal holds are widely used to preserve records, as opposed to targeted groups of records. »» No formal email management program. In all of these scenarios, it is very difficult if not impossible for Records and Information Management (RIM) professionals, without the assistance of technology, to identify the legitimate long-term records they should preserve and remove the duplicate, obsolete or transient information from the storage media or physical container. There is no question that saving everything for the long- term drives up storage costs and increases the expense and risk of legal discovery. MANAGEMENT STRATEGIES FOR LONG-TERM RECORDS In many ways, the practices and procedures for managing long-term records should differ little from those used to manage any other kind of records. These strategies should come as no surprise to RIM professionals. »» Start with an up-to-date and media-agnostic enterprise- wide records retention schedule and corporate classification plan. Business, regulatory and legal requirements are always changing, so the classification plan and schedule should be reviewed at least annually and updated as needed. »» Classify long-term and permanent records using repeatable processes, assisted classification or automated classification as much as possible. This process is much easier when first creating or receiving the information rather than later on when it is no longer actively used. »» Segregate short-term and long-term data. Do not simply apply a generic, long retention rule to all records created from a single activity or department. »» Use a modern data management system, coupled with defined reviews or periodic processes to manage your event-based and conditional electronic data and prevent over-retention of records. »» Prepare an index of inactive information needed to be retained for a long period of time to make it easier to retrieve the occasional record when required for legal, regulatory or business productivity. »» When feasible and to reduce ambiguity, the term “permanent” should be replaced with a measureable time period (i.e., 30 years). »» Create an overall strategy for dealing with the eventual obsolescence of your business applications so the appropriate records and transactions can be indexed and stored in a long-term format that can be accessible for the life of the retention period. This strategy will ensure that your records are available when needed, and greatly reduce the number of obsolete applications being managed CONCLUSION Records and Information Management departments face many challenges when dealing with the organization, retrieval, disposition and preservation of long-term records. Consistent strategies for each of the major challenges and continual governance and review of your information environment can greatly reduce both the cost and risk of long-term retention. Subsequent papers in this series will go into greater detail on the key issues of long-term retention to outline procedures, technologies and practical strategies for addressing these issues, including: »» Developing an effective media strategy for long-term retention »» Managing long-term retention of event-based or conditional records »» Management and disposition of long-term records in databases and structured applications
- 4. US-RM-EXT-WP-073115-001 800.899.IRON | ironmountain.com ABOUT IRON MOUNTAIN Iron Mountain Incorporated (NYSE: IRM) is a leading provider of storage and information management services. The company’s real estate network of over 67 million square feet across more than 1,000 facilities in 36 countries allows it to serve customers around the world. And its solutions for records management, data management, document management, data center management and secure shredding help organizations to lower storage costs, comply with regulations, recover from disaster and better use their information. Founded in 1951, Iron Mountain stores and protects billions of information assets, including business documents, backup tapes, electronic files and medical data. Visit www.ironmountain.com for more information. © 2015 Iron Mountain Incorporated. All rights reserved. Iron Mountain and the design of the mountain are registered trademarks of Iron Mountain Incorporated in the U.S. and other countries. All other trademarks and registered trademarks are the property of their respective owners.