Records Disaster Preparedness OAMR Conference

1. Records Disaster PreparednessOAMR Conference Matt Brown Records Management Analyst Oregon State Archives

2. Scope of Today’s Training • What is a Records Disaster? • Overview of Standards and Laws • Identify & Prioritize Essential Records • Assess Risks to Essential Records • Protect Essential Records

3. Out of Scope for Today’s Training • Creating a “canned” or “plug and play” plan • Items usually found in an agency’s Emergency Management Plan or Business Continuity Plan: • Life safety • Damage to buildings • Public order • Communications • Salvage

4. The Range of Disasters

5. Hurricane Katrina

6. Hurricane Katrina “The floodwaters also ruined the court records of thousands of criminal cases. After the Parish was finally evacuated, its prisoners were sent to facilities all over the state. Most arrived without identification or court documents, and were promptly forgotten. To make matters worse, the courthouse was closed for nine months, and Orleans Parish lost 80% of their public defenders.” Huffingtonpost.com

7. The Flood of 1996 (Tualatin River flooding Tualatin Commons) weather.gov

8. Small scale Thirdeyemom

9. “Wet boxes that were removed from the first storage room were placed in the aisles of the second storage area. By this time, the very wet records had been removed for freeze-drying and a center row of boxes had been removed to the off-site recovery room.” Lane Community College Archives

10. Disruption due to cleanup efforts Lane Community College Archives

11. Avoid Records Disasters and Mitigate Their Effects • Planning • Preparation • Staff training

12. Best Practices (ICS) • FEMA’s Incident Command System: • Is a standardized management tool for meeting the demands of small or large emergency or nonemergency situations. Represents "best practices" and has become the standard for emergency management across the country. May be used for planned events, natural disasters, and acts of terrorism. • Is a key feature of the National Incident Management System (NIMS).

13. Best Practices (NIMS) • National Incident Management System (NIMS) • Describe activities and methods for managing resources. • Identify and describe Incident Command System (ICS) organizational structures. Explain Emergency Operations Center (EOC) functions, common models for staff organization, and activation levels.

14. Essential Records • Essential Records are those that: • Specify how an agency will operate in an emergency or disaster; • Are necessary to the continued operations of the agency; or • Are needed to protect the legal and financial rights of the government and citizens • Essential Records, if damaged or destroyed, would: • Disrupt the agency’s operations & information flow • Cause considerable inconvenience • Require replacement or re-creation at considerable expense • Essential Records Program: one element of the Agency's Continuity of Operations (COOP) program

15. Benefits of an Essential Records Program • If a disaster occurs: • Get agency up and running quicker • Better decision making during disaster • Meet public need for information & communications during disaster • Save agency time and money • Smoother reconstruction following a disaster

16. Benefits of an Essential Records Program • If a disaster does not occur: • Improved general preparedness for responding to a disaster and better protection of information assets • Increased staff awareness of records management policies and procedures • Fewer lost records and wasted staff time searching for information

17. Public Records law • “Policy concerning public records… the state and its political subdivisions have a responsibility to insure orderly retention and destruction of all public records, whether current or noncurrent and to insure the preservation of public records of value for administrative, legal and research purposes.” ORS 192.001

18. Public Record • (A) Is prepared, owned, used or retained by a state agency or political subdivision; • (B) Relates to an activity, transaction or function of a state agency or political subdivision; and • (C) Is necessary to satisfy the fiscal, legal, administrative or historical policies, requirements or needs of the state agency or political subdivision. – ORS 192.005 (5)

19. OAR 166-200-0265 Contracts Contracts document the solicitation, negotiation and purchasing goods and services for cities and employees. • (5) Insurance Policy Records — Minimum retention: • (a) Group employee health and life, property, and liability insurance, retain 75 years after expiration if no claims pending; • (b) All other insurance records, retain 6 years after expiration if no claims pending.

20. Step 1: Identify your Agency’s Business Functions Answer the following: • What business functions are performed by your agency? • What are the statutory or legal requirements? • What are the program responsibilities? • What functions not normally performed by your agency might be required in an emergency? • What are the requirements in your COOP Plan, if any?

21. Step 2: Narrow to Essential Business Functions • More questions: • Is there anything that your agency or division does that is critical to other government agencies or the public? • Which of these critical functions are performed only by your own agency or division? • Is there an alternative method of carrying out these functions during the emergency and recovery periods? • After eliminating the business functions for which there are alternative methods of support, what functions are left? • These are your essential business functions.

22. Step 3: Match Records with Each Critical Function • Do you consider any of these records to be invaluable? • Are there records that you create or maintain that the public would need in an emergency? • How soon would you need access to duplicates of these records? • Think about what records your agency creates or maintains that may be essential to other agencies or emergency services. • Check the records that support essential functions against the types of essential records.

23. Identify Essential Records

24. Identify Essential Records

25. Identify Essential Records

26. Identify Essential Records

27. Essential Records • Emergency Operations Records = Needed During an Emergency • Examples • Continuity of Operations Planning (COOP) • Staff contact and assignment information • Certain essential databases • Paper, or electronic at an alternate site. For immediate retrieval in the event computer systems go down

28. Essential Records • Rights and Obligations Records = essential to protect the legal and financial rights of the Government and of the individuals affected by its activities. Not needed in the first 24 hours, so may not need to be held on-site • Examples • Payroll and accounts receivable • Social Security and retirement • Titles, deeds, and contracts

29. Essential Records • Each department lists its essential functions, then identifies records critical to continuing those essential functions

30. Risk Management • The entire process of assessing risks, evaluating risks, and then deciding on priorities for actions and informing the agency, so that resources are available and actions can be taken to manage the risk.

31. Assess Risk • Risk Assessment = the identification of risks • Disaster risks range widely, from minor water leak, to 9.0 Earthquake • Prepare for a range of disasters

32. Assess Risk • Risk assessment should include: • Types of risks and probability of occurrence • Types and extent of damage likely to occur • Consequences for the agency

33. Assess Risk (Risk Types) • Environmental Risks • Nature and weather-related factors such as earthquakes, floods, windstorms and humidity • Risks to facilities including plumbing, wiring, inadequate alarm systems, heating/air conditioning systems and leaking roofs • Mold, insects and animals

34. Assess Risk (Risk Types) • Technological Risks • Electronic records’ physical hazards include power surges, static electricity, improper grounding, poor virus protection, prolonged power outage, and heat • Inadvertent deletion of data, backup failures, improper storage for disks/tapes and incomplete software documentation, and lack of technical knowledge • Breaches & hacks (Unauthorized access to data)

35. Assess Risk 1. Make a list of potential disasters. 2. Estimate the probability of a disaster occurring. 3. Identify the damage and estimate the consequences to the agency’s records. 4. Complete the assessment by determining risk

36. Evaluation of Building Condition

37. Assess Risk (Risk Matrix 1)

38. Assess Risk (Risk Matrix 2)

39. Risk Analysis Rating System

40. Protect Essential Records • Different types of records and information media present their own challenges • Distinctive conditions for protecting info contained on each media type (paper, electronic) require special attention

41. Protect Essential Records • Electronic media require additional forms of protection because they can be affected by: • Power outages • Electrical surges • Unauthorized intrusion • Static electricity • Software that records were created on is obsolete

42. Protect Essential Records • Electronic copies of fixed-format (paper, microfilm/fiche, photographic) records created as “backups” or for off-site access should NOT be considered appropriate for long-term preservation unless they have been created to archival standards. These records may become inaccessible without special attention.

43. Protect Essential Records 1. Protection Strategies Based on Information Status

44. Protect Essential Records 2. Protection Strategies Based on Volume of Records

45. Protect Essential Records 3. Protection Strategies Based on Timeframe for Recovery

46. Protect Essential Records

47. Protect Essential Records (Dispersal) • Routine Dispersal – Done in the course of routine business processes • Records must be kept updated • Usually low or no cost • Designed Dispersal – Copies created specifically for protection purposes • More costly

48. Protect Essential Records (Duplication) • Duplicate Records, stored in a secure, off-site location • Remote storage of back-ups

49. Protect Essential Records (On-site protection (OAR 166-020)) • Fire-resistant safes & vaults • Secure central file rooms • Environmental controls • Electronic protective storage (vaulting & data replication)

50. Protect Essential Records (Off-site Storage) • Based on your agency’s risk assessment and analysis, you will need to determine the appropriate distance away from your facility that will protect your agency’s essential records adequately • If your agency has a working relationship with another agency or agencies, you may reach reciprocal agreements to store each other’s essential records. • Off site in a commercial storage facility: • Numerous vendors provide storage and services for essential records. You must ensure that their facilities meet the relevant standards for the protection of records(OAR 166-020-0015)