Number: 

DAO 205-16

SECTION 1. PURPOSE.

.01 This Order contains instructions, standards and guidelines for managing records and information in electronic form in conformance with policies established by the General Services Administration (GSA) and the National Archives and Records Administration (NARA).

.02 The objectives are to ensure the effective and efficient management of electronic records throughout their life-cycle from creation to final disposition; to preserve records needed for fiscal, legal, administrative, or historical purposes; to destroy in a timely manner information no longer needed; to ensure cost effective use of automated data processing equipment, storage media, and other resources; and to ensure electronically stored records can be retrieved.

SECTION 2. POLICY.

All records, including those in electronic form, shall contain adequate and proper information regarding the functions, organization, policies, procedures, decisions, and essential transactions they are intended to document; be sufficient to protect the legal and financial rights of the Government and of persons directly affected by the Department's actions; be easily retrievable and usable; be protected from unauthorized access, loss, removal, or theft; be protected from unauthorized disclosure; and be disposed of only in compliance with approved records control schedules.

SECTION 3. REFERENCES.

.01 Federal Information Resources Management Regulation (FIRMR) Bulletin 23, Electronic Recordkeeping, states requirements and guidelines for electronic recordkeeping that GSA expects Commerce and other agencies to establish and follow. This bulletin was also issued simultaneously as NARA Bulletin 85-2 because of that agency's interest in ensuring the preservation of historically valuable records for research by scholars and other members of the public. This Department Administration Order (DAO) provides supplementary instructions for the effective implementation of those bulletins.

.02 The National Bureau of Standards has issued the following Federal Information Processing Standards Publications (FIPS PUBS) that are particularly relevant to records creation, storage, and transmission using personal computers or other electronic office equipment. Copies of these standards may be obtained from the National Technical Information Service (NTIS), U.S. Department of Commerce, 5285 Port Royal Road, Springfield, Virginia 22161. (Note.--FIPS PUBS with an asterisk are mandatory standards that are implemented in FIRMR, 41 CFR 201-8.)

a. FIPS PUB 46* Data Encryption Standard.

b. FIPS PUB 48 Guidelines on Evaluation of Techniques for Automated Personal Identification.

c. FIPS PUB 51* Magnetic Tape Cassettes for Information Interchange 3.810mm (o.150 in.) Tape at 32 BPMM (800 BPI) Phase Encoded.

d. FIPS PUB 52* Recorded Magnetic Tape Cartridge for Information Interchange, 4-Track (6.30mm (1/4 in.)), (63 BPMM (11600 BPI)), Phase Encoded.

e. FIPS PUB 54 Computer Output Microform (COM) Formats and Reduction Ratios, 16mm and 105mm.

f. FIPS PUB 65 Guidelines for ADP Risk Analysis.

g. FIPS PUB 73 Guidelines for Security of Computer Applications.

h. FIPS PUB 74 Guidelines for Implementing and Using the NBS Data Encryption Standard

i. FIPS PUB 81* DES Modes of Operation.

j. FIPS PUB 82 Guideline for Inspection and Quality Control for Alphanumeric Computer-Output Microform.

k. FIPS PUB 83 Guideline on User Authentication Techniques for Computer Network Access Control.

l. FIPS PUB 91* Magnetic Tape Cassettes for Information Interchange, Dual Track Complementary Return-to-bias (CRB). Four-States Recording on 3.81mm (0.150 in.) tape.

m. FIPS PUB 93* Parallel Recorded Magnetic Tape Cartridge for Information Interchange, 4-Track, 6.30 (1/4 in.) 63BPMM (1600 BPI), Phase Encoded.

n. FIPS PUB 108 Alphanumeric Computer Output Microform Quality Test Slide.

o. FIPS PUB 1-1 Code of Information Interchange (ASCII).

.03 The Federal Records Act of 1950 (44 U.S.C. 3101) requires agency heads to "make and preserve records containing adequate and proper documentation of the organization, functions, policies, decisions, procedures, and essential transactions of the agency and designed to furnish the information necessary to protect the legal and financial rights of the Government and of persons directly affected by the agency's activities."

.04 The Paperwork Reduction Act of 1980 (44 U.S.C. 3501) calls for the coordination and integration of automatic data processing, telecommunications, and records management policies and procedures. All three of these elements are present in electronic recordkeeping systems.

.05 Office of Management and the Budget (OMB) Circular No. A-130 implements the Paperwork Reduction Act of 1980 and provides guidance for the integration of record management with other information resources disciplines. It reaffirms that "information" includes records in any form and that agency heads must create, maintain and dispose of records in accordance with the Federal Records Act of 1950.

.06 Title 18 U.S.C. 2071 establishes criminal penalties for the unlawful removal or destruction of Federal records.

.07 Title 18 U.S.C. 793, 794, and 798 forbids unlawful disclosure of certain information pertaining to national security.

SECTION 4. DEFINITIONS

.01 Records. The Federal Records Act of 1950 (44 U.S.C. 3301) defines records as "...all books, paper, maps, photographs, machine readable materials, or other documentary materials regardless of physical form or characteristics, made or received by an agency of the United States Government under Federal law or in connection with the transaction of public business and preserved or appropriate for preservation by that agency or its legitimate successor as evidence of the organization, functions, policies, decisions, procedures, operations, or other activities of the Government or because of the informational value of data in them. Library and museum material made or acquired and preserved solely for reference or exhibition purposes, extra copies of documents preserved only for convenience of reference and stocks of publications and of processed documents are not included." These latter items are referred to as "non-record."

.02 Electronic Records. Electronic records consist of any information, including textual documents, that are created, used, maintained, transmitted, and disposed of in electronic form. Such records may be stored in computer memory (random access memory) or on such storage media as magnetic tapes, optical disks, or flexible disks. They may or may not have paper backup. Electronic records are also referred to as machine readable records because they require machine processing for conversion to human readable form. Electronic records are official records as defined by the Federal Records Act of 1950 and are subject to the management program established by DAO 205-1, "Records and Other Documents Disposition Management Program."

.03 Electronic Recordkeeping. Electronic recordkeeping is the procedures and systems for creating, using, maintaining, transmitting, and disposing of records in electronic form.

.04 Electronic Filing. Electronic filing is that aspect of electronic recordkeeping that concerns the transmittal and entry into an electronic system of records or information received from the public or other sources outside the Department, e.g., the electronic filing of patent and trademark applications and related information.

SECTION 5. RESPONSIBILITIES.

.01 Office of Management and Organization. The Departmental Office of Management and Organization is responsible for conducting the Departmentwide records management program. This program shall:

a. Develop policies, standards, and general procedures for the creation, maintenance, us, and disposition of records and information in all forms, including electronic and machine readable records;

b. Ensure compliance with Government-wide policies and standards for electronic recordkeeping;

c. Ensure efficient and effective use of electronic recordkeeping throughout the Department;

d. Establish and implement policies and procedures to guard against the unauthorized destruction, loss, removal, or theft of electronic records;

e. Review and evaluate operating unit records management programs to ensure they are implementing established policies and standards governing electronic records management; and

f. Develop or review all requests for the disposition of electronic records created and maintained by operating units that have given this responsibility to IMD and forward such requests to NARA for final approval.

.02 Operating Unit Records Management Officers. Each operating unit records management officer shall:

a. Ensure compliance with the provisions of this DAO and all other records management policies;

b. Maintain an effective program for the management of electronic records;

c. Develop and approve all requests for the disposition of electronic records and forward such requests to NARA for final approval;

d. Act as liaison with the Department in matters regarding the management and disposition of electronic records; and

e. Perform periodic evaluations of electronic recordkeeping systems to ensure compliance with applicable laws, regulations, and Departmental and operating unit policies, standards, and procedures.

.03 Program Managers. All program managers (system owners) who currently operate an electronic system of records or plan to develop a new system of records are responsible for ensuring that the requirements of this DAO are implemented for their systems. Program managers will coordinate electronic records system activity with their operating unit records management officer in order to:

a. Identify the official office of record for the records being created;

b. Determine if the data being created are records or nonrecord material;

c. Determine in what form the official record will be maintained for its life-cycle; i.e., paper, microform, tape, disk, or diskette;

d. Establish procedures for identifying, cataloging, and labeling records when they are created;

e. Establish an appropriate filing and retrieval system;

f. Apply appropriate disposition instruction for the files being created;

g. Ensure that adequate system documentation is created and maintained for as long as the records to which it relates.

.04 ADP Managers and Contractors. It is the responsibility of both ADP managers and contractors to accommodate the requirements of this DAO in developing electronic record systems, ensure adequate documentation, apply authorized disposition, and provide system security to prevent unauthorized disclosure of the data contained in the system.

SECTION 6. CHARACTERISTICS OF ELECTRONIC RECORDS.
.01 Electronic records differ from records on other media in three ways:

a. The media on which electronic records are usually recorded are erasable, reusable, and used for rapid manipulation of data. This characteristic allows for economic creation of a variety of updated outputs tailored to specific needs.

b. The media on which electronic records are recorded are fragile. Therefore, these records must be protected early in their life-cycle. Ideally, protection should start when a system is created and the first records are entered.

c. Because electronic records must be electronically processed for conversion to human readable form, the procedures controlling such processes must be stored with the electronic records. These procedures, called "documentation," are usually in textual form, but should include any unique source programs or data base management systems required to use the records.

.02 The media on which electronic records are recorded have significant economic value because they are reusable. This potential for cost avoidance can only be realized by efficient records control scheduling authorizing the disposal of the current information on the media.

.03 Electronic records of long-term or permanent value should be checked periodically. The information may require transfer to new media as older media deteriorates. The following standards should be used to prevent loss of information:

a. When magnetic media will be used to record information that will be kept longer than one year, they should be checked six months before the information is recorded to ensure they do not contain errors or flaws that will affect the information to be recorded;

b. When information is to be copies onto magnetic media, the operator should check the media to ensure they do not contain errors or flaws that will affect the information to be copies;

c. A three percent sample of all magnetic media containing permanent electronic records should be read annually to identify loss of information and to find the cause. Measures should be taken to eliminate the cause of error or loss. Magnetic media with 10 or more errors should be replaced and, when possible, the information restored;

d. To prevent loss of information due to changing technology or to the aging of the storage medium, files should be rewritten or transferred to another machine-readable medium when required;

e. Programs and system documentation must be kept for the same time as related files in order to read and retrieve the data;

f. Reference service by Federal record centers normally consists of returning electronic records on a loan basis. Thus, retiring offices must keep adequate documentation for information retrieval and servicing, and keep or arrange for use of compatible equipment for display purposes until the electronic records are transferred to other media or destroyed. If this cannot be done, consider transferring permanent records to the National Archives. Long-term, non- permanent records should be written to a new system or printed out as hard copy.

SECTION 7. CREATING ELECTRONIC RECORDS.

.01 In establishing a system of electronic records, the full life-cycle (creation through disposition) of the records maintained in the system must be considered. System designers shall contact their operating unit records management officer in the initial design stage. This will enable the designers to correctly determine and incorporate disposition requirements into the system programming, thereby avoiding potentially costly changes after the system is established. Early involvement of the records management officer is especially critical in the case of major systems that may contain permanent records.

.02 If the records to be maintained in the system contain information about individuals, and can be retrieved by the individual's name or other personal identifier, such as Social Security Administration Number, the records will be subject to the Privacy Act of 1074. The operating unit Privacy Act officer should be contacted for requirements on documenting and publishing a description of the system of record.

.03 If the records to be maintained in the system contain proprietary data or information about individuals, or are security classified, the system design must include safeguards adequate to protect against unauthorized access and disclosure. Of course, system designers must also install safeguards on fiscal records to ensure against monetary theft and to provide an audit trail.

SECTION 8. LABELING ELECTRONIC RECORDS.
.01 The need to retrieve electronically stored records requires adequate and accurate labeling during the creation of the records. Each tape, disk, or diskette should include sufficient information for the records to be retrieved or disposed of not only by the user, but also by a colleague, a successor, or, if appropriate, NARA.

a. Tape Labels. External tape labels should include the organization responsible for the data; file title(s); dates of creation and coverage; recording density (number of bits or characters recorded per inch (bpi) or (cpi)); type of internal labels, if applicable; volume series number; number of tracks and track bit assignments; character code/software dependency; record length; block size (e.g. fixed, variable, or mixed); disposition instructions; reel sequence if the file is part of a multi-reel set; and security determination.

b. Disk/Diskette Labels. Disk/Diskette labels should include the file or subject name and/or number; date, if appropriate; software and equipment dependency; and disposition instructions.

.02 If the label requirements above are contained in an automated management system, output from that system will suffice.

SECTION 9. INDEXING ELECTRONIC RECORDS.

.01 Electronic records need to be indexed if they are going to be retrieved. Sometimes system software provides a way to accomplish this. How complex the indexing system needs to be is a function of the volume of records, how long the records must be remained, and how familiar the persons retrieving the records are with the records. Do not assume that since the current users are very familiar with the records that no index or only a limited one is needed. Consider the likely personnel turnover in the originating office from the time the records are created until they are no longer needed for current operations. Also consider what indexes will be required by persons to whom the records may be transferred.

.02 The electronic indexes should be able to assist in locating the records based upon the characteristics of the particular record. These would include such things as date, subject, sender, recipient, and number (case, contract, purchase order, project, award, social security, etc.). How the index operates should be an easily accessible part of the system documentation.

.03 In addition to the electronic index to the records, indexes to diskettes may be required. If the diskettes are properly labeled, they may be largely self-indexing if there are only a few of them. If there are more, the physical file of them may need to be logically subdivided in order to aid retrievability. Additionally, the diskette indexes should be printed out to ensure easy access to them.

SECTION 10. RETRIEVING ELECTRONIC RECORDS.

.01 Personnel should be able to easily retrieve electronically stored records until their authorized disposition. This requirement is important when an existing automated system is upgraded or replaced with a new one. Records stored on the old system should be converted, or the new system should be designed, so that these records continue to be usable until their authorized disposition date. One possibility is to design systems that are compatible with a variety of other systems. An alternative is to contract with a commercial services which will convert records from one format to another.

.02 Permanent records which are to be transferred to NARA and which are stored on disks or diskettes should be either converted to magnetic tape (see 35 CFR 1228.188) or converted to paper or microform. (Microforms should meet the standards in 36 CFR Part 1230). The first alternative, although possibly more technically complicated, may be of assistance to future users of the records particularly if the records contain data which the user may want to manipulate. NARA staff and the operating unit records management officer should be involved in the decision on the conversion process and on the record sequence which would be in the best interest of the Government.

SECTION 11. ENSURING THE RETENTION OF RECORDS.

.01 The ease with which electronically stored records can be erased or changed increases the risk of unauthorized destruction of official documentation and information. Since electronic records are official records of the Federal government, they may not be destroyed without proper authorization from NARA.

.02 The fact that information is created or stored electronically has no bearing upon whether that information is record or non-record. Record status is determined by the same criteria for all information, regardless of the medium on which it is created or stored. But, ensuring the retention of records stored electronically is not as simple as ensuring the retention of records stored on microform or paper.

.03 The decision about whether an electronic document is a record needs to be made earlier than for paper because of the ease of erasing or changing the record. For this reason the operating unit records management officer should be consulted during the initial design phase of a new automated system.

.04 The record status of electronically stored drafts of policy documents should be re-evaluated as changes are made. Substantive updates to such electronic records probably constitute new records while minor changes probably do not.

.05 Many electronic mail systems automatically erase information after the recipient has read it. Therefore, operating unit personnel should take positive action, at the time they receive electronic messages, to retain any records received in this manner in a medium which will satisfactorily store the record until its disposition date. Many electronic mail messages will not contain enough substance to be considered official records.

.06 If the same information is stored on more than one medium, such as paper and disk, operating units, in consultation with NARA and their records management officer, should schedule the disposition of all copies.

SECTION 12. MAINTAINING LONG-TERM ELECTRONIC RECORDS.

.01 Information stored on disks/diskettes has a relatively short life expectancy estimated from one to five years. Consequently, such information should be converted to another medium to ensure its continued maintenance and readability.

.02 Office correspondence, such as letters, memoranda, reports, similar correspondence should always be printed out in hard copy (paper) form so that a copy may be filed in the office files. In addition, the legend on this file copy should include an identification of the disk/diskette on which the document is located. This will assist in retrieval of the disk/diskette copy in case the document must be revised.

.03 Other long-term records stored on disks/diskettes should be converted to magnetic tape, paper, or microform. If conversion to magnetic tape is the best alternative, the conversion process and record sequence should be coordinated with the operating unit record management officer and NARA.

SECTION 13. TRANSFERRING ELECTRONIC RECORDS.

.01 NARA and their Federal Records Centers (FRCs) will not accept disks/diskettes for transfer.

.02 They will accept magnetic tapes provided:

a. They are covered by an approved records control schedule or, in the case of permanent, historically valuable records, are offered directly to NARA.

b. The file recorded on the tape is inactive or the creating office cannot provide proper care and handling of the tape to ensure the preservation of the information it contains.

c. Tapes to be transferred to a FRC or NARA shall be on one-half inch 7 or 9 track tape reels (preferably 9 track), written in ASCII or EBCDIC, with all extraneous control characters removed from the data (except record length indicators for variable length records, or marks designating a datum, word, field, block or file), blocked no higher than 30,000 bytes per block, at 800, 1600 or 6250 bpi.

d. The tapes shall be new or recertified tapes which have been passed over a tape cleaner before writing and shall be rewound under controlled tension.

e. Documentation adequate for servicing and interpreting the records shall be transferred with them. The documentation shall include, but is not limited to a completed Standard Form 277, Computer Magnetic Tape File Properties, or its equivalent; and the codebook specifications defining the data elements and their value that match the new format of the data. If the specifications are contained in an automated data element dictionary, hard copy output from that system will suffice.

.03 NARA and their FRCs will also accept microfilm, computer output microfilm (COM), and other microforms provided the standards in 41 CFR 101---11.5 are adhered to. Operating units planning to transfer microform copies of electronic records should consult their records management and micrographics management officers.

SECTION 14. DESTROYING ELECTRONIC RECORDS.

.01 When information is converted from paper to electronic form, the nature, usefulness, and accessibility of the information changes. Therefore, the disposition of the information when maintained in electronic form may differ from the disposition when maintained in paper form. Electronic records derived from paper records must be separately scheduled. Although paper records may already be schedules, the retention time should be reviewed for earlier disposition at the time the records are converted to electronic form.

.02 Records authorized for destruction should be destroyed promptly when they become eligible for destruction. Program managers should be aware that the provisions of the Freedom of Information Act (FOIA) apply to all records still in existence, regardless of their physical form or whether they are eligible for immediate destruction.

.03 To effectively destroy electronic records, the tapes or disks/diskettes must be erased. It is not sufficient to command the system to delete them. Only by erasure, or by using a program which will completely overwrite the data to be destroyed, can operating units protect against unauthorized access to records which have been approved for destruction.

.04 Electronic records not covered by an approved records control schedule may not be destroyed or transferred. Program officials responsible for such records should contact their operating unit records management officer to arrange for scheduling of these records and determining an appropriate retention period.

SECTION 15. SECURITY OF ELECTRONIC RECORDS.

.01 Special precautions may be needed to ensure the security of electronically stored information. To determine the level of security protection required a risk analysis shall be performed in accordance with the standards in the Department of Commerce Automated Data Processing Security Manual, which is included in the Department's Information Technology Management Handbook (DAO 212-1).

.02 Program managers having electronically stored information are responsible for ensuring that data integrity is maintained. This includes, but is not limited to, protecting electronic records against unauthorized destruction and taking steps, in coordination with their operating unit records management officer, to ensure that all their electronic records are covered under an approved records control schedule.

SECTION 16. JUDICIAL USE OF ELECTRONIC RECORDS.

.01 Properly created and maintained computer based records pose no greater legal problems than do paper or microphotographic records unless there are specific statutory or regulatory requirements for paper records (as may be the case with certain medical records, for example). The Federal Rules of Evidence (Rule 803 (8)) provide that official records may be admitted as evidence in lieu of the personal appearance of the official responsible for the activity. The text of the rule is:

"The following are not excluded by the hearsay rule, even though the declarant is available as a witness:

... (8) Public records and reports.--Records, reports, statements, or data compilations, in any form, of public offices or agencies, setting forth (A) the activities of the office or agency, or (B) matters observed pursuant to duty imposed by law as to which matters there was a duty to report, excluding, however, in criminal access matters observed by police officers and other law enforcement personnel, or (C) in civil actions and proceedings and against the Government in criminal cases, factual findings resulting from an investigation made pursuant to authority granted by law, unless the sources of information or other circumstances indicate lack of trustworthiness."

.02 Under this rule, if the only record is electronic, agencies (Commerce) must ensure that the procedures are established and followed so that (a) the date of the record can be determined; (b) the date of any alteration s will be automatically recorded by the system; (c) it will be evident that the document was authorized to be issued ("signed") by an appropriate agency official. If these steps are not taken, the trustworthiness of the records could easily be called into question, and it could be refused as evidence.

Signed by: Assistant Secretary for Administration

Office of Primary Interest: Office of Management and Organization

Index Changes:

Add.

Electronic Records, Managing

Managing Electronic Records

Records, Managing Electronic