the iper project

The IPER Project

This course,

Essential Records Seminar,

is part of

Slide 1-1

Recent Maryland Natural Disasters

• Hurricanes

• Floods

• Snow

• Tornadoes

• Power Outages related to these conditions

• Target audience:– Any government employee involved in creating, maintaining,

and protecting records, or in preparing for emergencies

• Training focuses on three functional areas:– Emergency management

– Records management

– Information technology

Slide 1-3

Course Objectives

By the end of this portion of the course, you will be able to:

• Identify the records that you need to designate as essential records

• Identify and evaluate risks to the essential records of an agency

• Identify and evaluate preparedness and mitigation strategies to protect and ensure continued access to essential records in case of natural emergencies or human-caused threats such as arson, vandalism, computer hacking, or terrorism

• Complete the Essential Records Template for incorporation into COOP Plans

Slide 1-4

What Are Essential Records?• Records are considered essential when they:

– Are necessary for emergency response– Are necessary to resume or continue operations– Protect the health, safety, property, and rights of residents– Would require massive resources to reconstruct– Document the history of communities and families

• Essential records require special protection strategies to ensure they are protected

and accessible. • Essential records can be found in any format and in any

medium.

Slide 1-5

Differentiate Essential Records from Other Records

• Only a small percentage of records are essential, typically less than five percent.

• Its critical value during and/or after an emergency makes a record essential.

• As disruption time increases, more records become essential.

Slide 1-6

Which of Your Agency’s Records Are Essential?

• Essential records differ by agency.• Each agency must determine which of its records

is or are essential. • What you need to know to identify essential

records:– Your agency’s essential functions– Your agency’s records– The stakeholders– Relevant statutes, regulations, and standards

Slide 1-7

Know Your Agency’s Essential Functions

• Identification of essential records starts with understanding essential functions.

Slide 1-8

Know Your Agency’s Records

• Importance of a good records management program

• Records inventories

• Records retention schedules

Slide 1-9

Know the Stakeholders

• Who depends on you? Who do you depend on?– Individuals– Other agencies– Outside organizations

• Who provides mission-critical support?– Information technology– Human resources– Legal and accounting– Emergency management, COOP

Slide 1-10

Interview Stakeholders

• Interview key stakeholders and staff to get information about essential functions.

• Ask specific and pointed questions:– Yes: “What if you didn’t have access to that series

of records for 24 hours?” – No: “How long could you operate without that series

of records?”

• You may also want to use a questionnaire to gather information.

Slide 1-11

Know Relevant Statutes, Regulations, and Standards

• Statutes and ordinances that apply to your state and locality.

• Regulations issued by state and local governments.

• Standards from federal agencies and national organizations.

• Guidance from state and federal agencies, professional and industry associations.

Slide 1-12

ActivityDetermine Essential Functions and

Identify Essential Records

Slide 1-13

Handout 1.7—Table 2: My Agency’s Essential Functions

and Essential Records

Risk Management Key Terms

• Hazard

• Risk

• Risk management

• Risk assessment

• Risk analysis

Slide 2-14

Flood in Oneonta, NY Photo courtesy of Mario R. Arevalo, Oneonta (NY) City Assessor

Risk Assessment—Identify Risks (cont’d.)

• Risks related to emergencies – Natural emergencies– Technological

emergencies– Civil emergencies

Slide 2-15

Tornado approaching La Plata, MD

Risk Assessment—Identify Risks (cont’d.)

• Scope of an emergency– Onsite– Immediate vicinity– Community- or

region-wide

Slide 2-16

Cologne Archives, March 2009

Risk Assessment Techniques

• Site survey can help you find:– Existing risks to records – Security and controls already in place– Vulnerable areas

• Expert interviews can help you find:– Physical location of the essential records – Timing, planning for off-hours disasters

• Brainstorming will assist in assessing risks

Slide 2-17

Step 1: Establish a Rating System• Rating system should contain two ratings:

– Probability rating– Impact rating

Slide 2-18

A sinkhole swallowing your building is not likely to happen – but the impact would be HUGE!

RISK ANALYSIS

Step 2: Evaluate Your Findings• Determine your threshold for action

Slide 2-19

RISK ANALYSIS

High Catastrophic impact; devastating loss

The event has little chance of occurring.

Catastrophic impact; devastating loss

Similar events have occurred in the past.


The event is expected to occur.

Medium Serious/critical impact; significant loss


Serious/critical impact; significant loss




Low Minor/marginal impact; some loss


Minor/marginal impact; some loss




Low Medium High

High Catastrophic impact; devastating loss






Medium Serious/critical impact; significant loss






Low Minor/marginal impact; some loss






Low Medium High

Probability of Risk

Risk Analysis Rating System

Impa

ct o

f Ris

k

Document the Risks• Document the results of your risk assessment,

risk analysis, and prioritizing.

• Prepare a strategy to communicate your findings to your agency so it can address the risks as:– Part of the COOP planning– Part of the essential records program planning– Part of emergency planning – Part of records management and information

technology planning

Slide 2-20

Activity

Identify and Evaluate Risks

Slide 2-21

Strategies for Handling Risk

• Avoidance

• Acceptance

• Mitigation

Slide 3-22

Photo courtesy of Tina Seetoo, Georgia Archives

Preparedness and Mitigation Measures

• Dispersal

• On-site protection

• Evacuation

• Tape backup

• Data replication

• Mirroring

Slide 3-23

Materials for the Activity

Slide 3-24

Handout 3.2—Table 2:My Agency’s Protection Strategies

and Measures Handout 2.3—Table 3:

My Agency’s Risk Matrix

Make Essential Records Available

• Agencies must be prepared to access their essential records. – Retrieval procedures

should require only routine effort.

– All equipment needed to read essential records must be available.

Slide 4-25

Priority Levels and Timeframes for Accessing Essential Records

• Priority 1—First 12 hours– Needed immediately, to respond to

the incident

• Priority 2—First 12–72 hours– Needed to manage the incident and

resume operations

• Priority 3—After first 72 hours – Needed to continue essential functions

and for long-term recovery

Slide 4-26

Access Records in Storage• Priority 1

– Store in close proximity and have 24‑hour availability

• Priorities 2 and 3– Store in facilities farther away, with less need

for quick access

Slide 4-27

Photo courtesy of NARA

Cycling• Cycling entails periodically replacing or updating

obsolete copies of essential records with current copies.

• Cycling may be done:– Daily– Weekly– Quarterly– Annually

• Develop a duplication schedule.

Slide 4-28

Develop Procedures to Ensure Access to Essential Records

• To ensure access, agencies should develop and document:– Policies– Delegations of authority – Responsibilities of agency officials– Procedures governing the essential records

program

Slide 4-29

Materials for the Activity

Slide 4-30

Handout 4.3—Table 1:DPR’s Priorities and Timeframes for Accessibility

• IPER supports a fundamental component of Continuity of Operations (COOP):– Ensuring that state and

local governments can access and use records needed to restore essential services

Slide 1-31

Photo courtesy of NARA

The COOP Process

• Too often, the COOP process neglects the identification and protection of essential records.

• Records custodians must be prepared to protect their essential records so that, in the event of an emergency, their offices can recover quickly and return to service for the residents of their state or locality.

Slide 1-32

Essential Records Template

Slide 4-33

Essential Record

Format(s) of Record

Access Priority Level

(See key)

Access Timeframe

Location of Original (include computer name & path for

electronic records)

Accessible at

Alternative Facility?

Backed Up at Third Location

Maintenance Frequency

Prevention/ Mitigation Strategies

EXAMPLE:

Delegation of Authority

Hardcopy and .pdffile

Priority 1 Immediately, within 0–12 hours of the event

Deputy Administrator’s Office, Washington Grove facility. GBaxter on ‘gandalf\userdirs$\My_Documents\Disaster\DofA’

Records storage facility

Office of the Administrator, Springfield Facility, 2nd

floor, Office 213b, top drawer of file cabinet next to secretary’s desk

Bi-weekly Backup tapes of Gandalf server

Essential Record

Format(s) of Record

Access Priority Level

(See key)

Access Timeframe

Location of Original (include computer name & path for

electronic records)

Accessible at

Alternative Facility?

Backed Up at Third Location

Maintenance Frequency

Prevention/ Mitigation Strategies

EXAMPLE:

Delegation of Authority

Hardcopy and .pdffile

Priority 1 Immediately, within 0–12 hours of the event

Deputy Administrator’s Office, Washington Grove facility. GBaxter on ‘gandalf\userdirs$\My_Documents\Disaster\DofA’

Records storage facility

Office of the Administrator, Springfield Facility, 2nd

floor, Office 213b, top drawer of file cabinet next to secretary’s desk

Bi-weekly Backup tapes of Gandalf server

Don’t Forget Your Stakeholders• Your network of stakeholders is invaluable for integrating

your essential records emergency planning with your agency’s current COOP Plan– COOP Manager– Emergency Managers– Agency head– IT director– Legal and accounting staff– Records management personnel– Custodians of archival records– Agencies or outside organizations

Slide 4-34