Vital Records Protection Program Guide

A vital records program identifies and protects records containing vital information necessary for an
organization to continue its key functions and activities in case of an emergency/disaster.

Vital Records Policy

All University records designated as vital or essential to the operation of the University and which if
destroyed would seriously impair or disrupt normal University affairs, or which by their loss might place
the University in a state of legal or fiscal jeopardy, are to be secured, either by microfilm or other
comparable duplication or suitable backup method of protection.

University departments have the primary responsibility to keep records designated as vital records safe
and secure on a continuing basis regardless of the media format on which it is stored. Departmental
responsibility for vital records is defined in the Business Policy Manual under the guidelines of Records
and Records Management, Policy #907.

Informational

Based on business document analysis and in light of various recent disasters, all programs, offices,
departments, and laboratories must determine what information must be protected and how to protect
it. Departments should develop a plan of action to respond to emergencies or disasters that may damage
their business records and provide for the recovery of needed information.

Purpose/Foundation

This document was developed as a guide and is designed to be a tool you can use to help you:

Develop a plan for identifying and protecting vital information

Conduct an analysis of threats and risks

Select protection methods

Implement and maintain a vital records protection program for your department or program

Objectives
The objectives of a vital records program are to:

Identify records needed to conduct business under emergency operating conditions (first 72 hours
following a disaster)

Identify records needed to perform or reconstruct the organization's most mission-critical functions

Identify records protecting the legal and financial rights of the organization/institution, its employees,
and the people it serves

Develop and implement cost effective methods, including off-site storage and the application of
technology, to protect and safeguard those records identified as vital from loss, misuse, and
unauthorized access or modification

Develop policies, procedures, and a plan of action to assess damage and to begin recovery of any records
that may be affected by an emergency or disaster, regardless of the storage medium

Types of Vital Records

There are two types of vital records:

Emergency operating records - Records essential to the continued functioning of an organization during
(emergency response activities) and after an emergency to ensure the continuation of the organization,
and

Rights and interests records - Records essential to the protection of the legal and financial rights of an
organization and of the individuals directly affected by the organization's activities.

Examples:

Emergency operating records - list of UM recovery staff, system backups, emergency preparedness plans

Rights and interests records - payroll records

Important Points

Establishing and maintaining a vital records program takes time, labor, and money. Vital records should
be restricted to those records that really are crucial for start-up of operations after a disaster occurs.

Other points to remember:

A small percentage of business records are vital, that is, essential to emergency functioning and to
business continuance, and are difficult or impossible to replace. ARMA International and the National
Archives and Records Administration (NARA) estimates that in most organizations, only 1-10% of their
records are deemed vital. Some units may have no vital records.

The length of time the records are kept (retention) does not necessarily indicate that a record is vital, nor
does a record designated as vital always remain vital.

Vital records may be in any format or medium (paper, electronic, microfilm, etc.). The vital records copy
may not be the “original”—the information contained, not the medium, is most important.

If the information is contained in a medium other than paper, consideration must be given to the
technology required to access the information and the availability of that technology in the event of a
disaster.

The Records Center (RC) can store vital records, and can offer 24-hour access. In many cases, the RC may
be the best place to store records for protecting the department's/institution's financial and legal rights,
but not the best place for emergency operating records, unless housed in a special and separate location
within that facility.

1. Developing a Plan

Task 1. Write an assessment plan.

Review the current status of the vital records program in your office, if any

Identify what is to be accomplished

Outline how the program will be developed and administered

Task 2. Develop forms for gathering information.

Forms to list vital functions and records supporting those functions

Task 3. Identify broad categories of potentially vital records.

Categories may include part or all of a records series or group of records.

Examples: personnel records, system documentation, credential files, etc.

Task 4. Obtain approval from management to begin implementation; get the highest level of authority
possible.

Task 5. Coordinate with other offices, e.g., Emergency Coordinator, Facilities Management, Security,
Information Management, Risk Management, etc.

Task 6. Establish and assign program responsibilities, positions, I.D. badges and job descriptions.

Examples:

Facility Vital Records Officer - ensures the protection of organizational vital records and oversees the vital
records program.

Facility Vital Records Liaison - coordinates the vital records program in the backup position.

Task 7. Communicate the vital records plan initiative to all staff.

Examples:

Announcements at management coordinators meetings, executive team meetings, and in directives and
postings

Memoranda to unit chiefs and/or all staff from management

Newsletters

Electronic mail announcements

Task 8. Develop a timeline for completion.

Outputs for Phase 1

Vital records development and implementation plan

Questionnaire and form for information collection

List of potential vital records categories

Modified position descriptions

Handouts and reference materials for staff

Memo informing staff of initiative

2. Identifying Vital Records

Task 1. Identify essential staff to complete task.

Examples:

Vital records officer

Unit managers

Records coordinators/liaisons

Local emergency operations officer

Task 2. Brief department managers.

Task 3. Train people who will interview temporary or student staff, if needed.

Task 4. Refine list of potential records documenting vital functions:

Emergency procedures
Business resumption records

Legal and financial rights records

Outputs for Phase 2

Completed questionnaires or interview notes

Listing of potential vital records

How they are protected, and how can we improve on methods

3. Assessing the Threat

Task 1. Review existing disaster recovery plans and consolidate where possible.

Task 2. Identify applicable threats and risks.

Examples:

Fire damage

Water damage (flood, water pipe break, etc.)

Winds, storms/tornadoes

Earthquake

Sabotage or terrorism

Human error or carelessness

Building or equipment failure

Power loss or electric surge

Insects, rodents, and other pests

Mold and mildew

Media deterioration or break-down

Civil emergencies (riots, war, etc.)

Other: __________________

Outputs for Phase 3

Risk assessment reports

4. Selecting Protection Methods

Task 1. Review completed questionnaires and forms.

Task 2. Compare the list of vital records to the records retention authorizations to determine if the
retention of the records have a bearing on decisions on how the records will be protected. For example,
if the records are permanent and are microfilmed, microfilm copies may be the best protection method.

Task 3. Assess current on-site storage and practices. For example, there may already be fire-resistant
cabinets in use for other reasons that could be used for vital records protection.

Task 4. Determine which records:

Have “built-in” duplication or dispersal and identify the location(s) and media format

Need to be duplicated and stored off-site and identify the type of duplication

Need to be stored in fire-resistant equipment on-site

Have special considerations such as records with confidential business information (CBI) or other
sensitive information

Task 5. Create a resource list of disaster recovery firms in your geographic area. Talk to Risk Management
and determine response times, approaches, and capabilities of those firms contracted by the University's
insurance company. Update the information at least annually.

Task 6. Identify “hot” and “cold” sites to accommodate electronic records, including applications for
running the systems and system documentation.
Task 7. Submit lists of vital records and protection methods for each type of vital record to unit managers
for comments.

Task 8. Respond to comments and revise lists, as needed.

Task 9. Compile final list of vital records and protection methods.

Task 10. Obtain approval of final list from top management.

Outputs for Phase 4

Draft list of vital records and protection methods

Comments from managers

Final list of vital records and protection methods

Staff notifications

Examples:

Announcement at Executive Staff meeting

Newsletter articles

LAN messages

5. Implementation and Testing

Task 1. Select appropriate off-site and on-site storage space and equipment.

Examples:

Records Center

Other storage facilities

Other agency offices, etc.

Task 2. Purchase and maintain supplies and equipment for recovery of records after a disaster.

Examples:

Rolls of plastic sheeting

Work gloves

Protective face masks

Task 3. Develop a rotation schedule and procedures for transfer of duplicates.

Who will over see the transfer

What media will be transferred

When will it be transferred and how

Task 4. Include basic training for new staff and others.

Task 5. Transfer backup copy of vital records to off-site and safe on-site storage equipment.

Task 6. Test the program for one or two months prior to drafting final plan.

Choose one or two departments or units for testing

Rotate duplicates on a predetermined schedule

Include drills on use of equipment, supplies, and procedures for recovery of records on all media

Task 7. Upon successful completion of the testing, implement the program throughout the facility.

Outputs for Phase 5

Written procedure for duplicating vital records at time of creation and predetermined backup schedule

Written procedure for transferring vital records to off-site or on-site storage, including transmittal forms

Instructional materials for all units to facilitate vital records protection training

Other duplicate copies of vital records should have predetermined dispositions

6. Documenting the Program

Task 1. Identify each facility's department's vital records procedures by highlighted tabs in each plan
manual. Include a list of the vital records with location and method of protection.

Task 2. The facility's Continuity/Disaster Plan is not complete without the Vital Records Protection and
Retention Plan.

Task 3. Write final report on the development, implementation, testing and management of this two-fold
vital records and disaster prevention plan manual.

Outputs/Off-sites for Phase 6

Final report

Section for unit procedure manual

Possible title: Disaster Recovery and Vital Records Protection Plan Manual

A copy of the complete plan should go to each facility department, top management, off-site backup,
Fire and Police Departments, all team leaders, other team members and a copy to Campus Archives

7. Maintaining the Program

Task 1. Transfer duplicates of vital records to off-site and on-site storage facilities (hot site and cold site)
on an ongoing basis according to an established rotation schedule.

Task 2. Dispose of duplicates that have reached their destruction date as directed by the
rotation/retention schedule.

Task 3. Perform periodic audits and testing of the plan and established procedures (once a year or more).
Identify and evaluate alternate protection techniques as they become available

Identify additional records to be included or records to be removed from the program

Simulate a disaster (desktop exercise)

Retrieve the necessary records

Ensure the capability of re-establishing operations from the backup resources

Outputs/Off-sites for Phase 7

Duplicate copies of vital records that have no other backup or protection method

File of transmittal forms for off-site backups

Audit report file by date performed