Essential Records What are Essential Records Defined by

Essential Records

What are Essential Records? ▪ Defined by Arizona State Statute § 41 -151. 12(4) ▪ (a) Records containing information necessary to the operations of government in the emergency created by a disaster. ▪ (b) Records containing information necessary to protect the rights and interests of persons or to establish and affirm the powers and duties of governments in the resumption of operations after a disaster. ▪ May also be referred to as Vital Records

What Are Essential Records? (contd. ) ▪ 5 core types of essential records: ▪ Are necessary for emergency response ▪ Are necessary to resume or continue operations ▪ Protect the health, safety, property, and rights of residents ▪ Would require massive resources to reconstruct ▪ Document the history of communities and families ▪ Essential records can be found in any format and in any medium.

Differentiate Essential Records from Other Records ▪ Only a small percentage of records are essential, typically less than five percent. ▪ Its critical value during and/or after an emergency makes a record essential. ▪ As disruption time increases, more records become essential.

Which of Your City/Town’s Records Are Essential? ▪ Essential records differ by department. ▪ Each department must determine which of its records is or are essential. ▪ What you need to know to identify essential records: ▪ ▪ Your department’s essential functions The stakeholders Your department’s records Relevant statutes, regulations, and standards

Know Your City/Town’s Essential Functions ▪ Identification of essential records starts with understanding essential functions.

Know the Stakeholders ▪ Who depends on you? Who do you depend on? ▪ Individuals ▪ Other departments ▪ Outside organizations ▪ Who provides mission-critical support? ▪ ▪ Information technology Human resources Legal and accounting Emergency management, COOP

Know Your City/Town’s Records ▪ Importance of a good records management program ▪ Records inventories ▪ Records retention schedules

Know Relevant Statutes, Regulations, and Standards ▪ Statutes and ordinances that apply to your locality. ▪ Regulations issued by federal, state and local governments. ▪ Standards from federal agencies and national organizations. ▪ Guidance from state and federal agencies, professional and industry associations.

Determine Essential Functions ▪ During an emergency, essential functions: ▪ Provide vital services ▪ Exercise civil authority ▪ Maintain the safety and well-being of the general population ▪ Sustain the jurisdiction’s industrial economic base ▪ Essential functions must continue under all circumstances.

Steps to Determine Essential Functions ▪ Step 1: Identify and Analyze Your Department’s Business Functions ▪ Review the city/town and departmental statements, internal directives, laws, and/or regulations that may pertain to your department’s mission. ▪ Check with IT and Emergency Management ▪ Answer the following: ▪ What business functions are performed by your ▪ ▪ department? What are the statutory or legal requirements? What are the program responsibilities? What functions not normally performed by your department might be required in an emergency? What are the requirements in your COOP Plan, if any?

Steps to Determine Essential Functions (cont’d. ) ▪ Step 2: Determine the Essential Business Functions 1. Is there anything that your department does that is critical? 2. Which of these critical functions are performed only by your own department? 3. Is there an alternative method of carrying out those functions during the emergency and recovery periods? 4. After eliminating the business functions for which there alternative methods of support, what functions are left? These are your essential business functions.

Steps to Determine Essential Functions (cont’d. ) ▪ Step 3: Determine the Essential Records That Support Those Functions ▪ Do you consider any of these records to be invaluable? ▪ Are there records that you create or maintain that the public would need in an emergency? ▪ How soon would you need access to duplicates of these records? ▪ Think about what records your department creates or maintains that may be essential to other agencies or emergency services. ▪ Check the records that support essential functions against the five core types of essential records.

Interview Stakeholders ▪ Interview key stakeholders and staff to get information about essential functions. ▪ Ask specific and pointed questions: ▪ Yes: “What if you didn’t have access to that series of records for 24 hours? ” ▪ No: “How long could you operate without that series of records? ” ▪ You may also want to use a questionnaire to gather information.

Protect Essential Records

Risk Assessment — Types of Risks ▪ Risks from loss of agency memory ▪ Can be physical loss or intellectual loss ▪ Risks related to emergencies ▪ Natural emergencies ▪ Technological emergencies ▪ Civil emergencies ▪ Risks related to records management ▪ ▪ ▪ Legal Security Business Accountability Technology Long-term preservation of records

Risk Assessment — Scope of Emergency ▪ Onsite ▪ Immediate vicinity ▪ Community- or region-wide Photo courtesy of NARA

Factors to Consider When Assessing Risk ▪ Existing risks to records ▪ Physical location of the essential records ▪ Security and controls already in place ▪ Vulnerable areas ▪ Timing

Risk Analysis — Method to Evaluate Risks ▪ Establish a rating system: ▪ Probability rating ▪ Impact rating ▪ Rate your risks. ▪ Evaluate your findings.

Step 1: Establish a Rating System Probability Rating Impact Rating Scale Criterion High The event is expected to occur. High Catastrophic impact; devastating loss. Medium Similar events have occurred in the past. Mediu m Serious/critical impact; significant loss. Low The event has little chance of occurring. Low Minor/marginal impact; some loss.

Step 1: Establish a Rating System (cont’d. ) ▪ Compile ratings to create your rating system Risk Analysis Rating System Impact of Risk High Medium Low Catastrophic impact; devastating loss The event has little chance of occurring. Similar events have occurred in the past. The event is expected to occur. Serious/critical impact; significant loss The event has little chance of occurring. Similar events have occurred in the past. The event is expected to occur. Minor/marginal impact; some loss The event has little chance of occurring. Similar events have occurred in the past. The event is expected to occur. Low Medium Probability of Risk High

Step 2: Rate Your Risks ▪ Rate each risk identified in your risk analysis. ▪ Example: Essential records in 2 nd-floor procurement office—identified risks: ▪ ▪ ▪ ▪ Debris blocking access to cabinets Debris and water from storm Mold and mildew Temperature and humidity—unstable environment Loss of data Fire damage Inability to access data Inability to communicate

Step 2: Rate Your Risks (cont’d. ) Identified Risk Probability Impact 1. Debris blocking access to cabinets High 2. Debris and water from storm High 3. Mold and mildew Medium High 4. Temperature and humidity—unstable environment Medium 5. Loss of data Medium High 6. Fire damage Low Medium 7. Inability to access data Medium High 8. Inability to communicate Medium High

Step 3: Evaluate Your Findings ▪ Determine your threshold for action Risk Analysis Rating System Impact of Risk High Medium Low Catastrophic impact; devastating loss The event has little chance of occurring. Similar events have occurred in the past. The event is expected to occur. Serious/critical impact; significant loss The event has little chance of occurring. Similar events have occurred in the past. The event is expected to occur. Minor/marginal impact; some loss The event has little chance of occurring. Similar events have occurred in the past. The event is expected to occur. Low Medium Probability of Risk High = Action = No action

Managing the Risk: Prioritizing Actions ▪ To prioritize your actions, rank the risks that require action. ▪ When prioritizing, consider: ▪ Cost to reconstruct the data ▪ Cost of defending against legal actions associated with loss

Document the Risks ▪ Document the results of your risk assessment, risk analysis, and prioritizing. ▪ Prepare a strategy to communicate your findings to your City/Town leaders so they can address the risks as: ▪ ▪ Part of the COOP planning Part of the essential records program planning Part of emergency planning Part of records management and information technology planning

Strategies for Handling Risk ▪ Acceptance ▪ Mitigation Consider the different formats available and the cost associated with each Photo courtesy of Tina Seetoo, Georgia Archives

Duplication of the Original Records Duplication formats: ▪ Microform ▪ Digital formats ▪ Backup tapes ▪ Paper

Storage of Essential Records ▪ On-site storage options: ▪ Vaults ▪ Secure central file rooms ▪ Fire-resistant containers ▪ Off-site storage options: ▪ Another office ▪ Agreement with another city/town ▪ Commercial storage facility ▪ “Hot” and “cold” sites Photo courtesy of NARA

Make Essential Records Available ▪ Cities/Towns must be prepared to access their essential records. ▪ Retrieval procedures should require only routine effort. ▪ All equipment needed to read essential records must be available.

Access Essential Records

Priority Levels and Timeframes for Accessing Essential Records ▪ Priority 1—First 12 hours ▪ Needed immediately, to respond to the incident ▪ Necessary to resume or continue operations ▪ Priority 2—First 12– 72 hours ▪ Needed to manage the incident and resume operations ▪ Protects the health, safety, property, and rights of residents ▪ Priority 3—After first 72 hours ▪ Needed to continue essential functions and for long-term recovery ▪ Requires massive resources to reconstruct ▪ Documents the history of communities and families

Access Priorities Table Level Priority 1 Priority 2 Priority 3 Definition Access Examples Timeframe for Access Records essential for response and emergency operations and therefore needed immediately Physical protective storage is close to disaster response site for immediate access. Electronic replication methods are available for immediate access to information. • • • Emergency action plan Business continuity plan Vital records manual Current facility drawings Personnel security clearance files Within the first 0– 12 hours Records essential for quick resumption and continuation of business following an emergency Physical protective storage is close to disaster recovery site for quick business resumption. Electronic methods are quickly accessible, and backups can be quickly restored. • • Current client files In-progress Accounts Payable and Accounts Receivable Research documentation Current contracts and agreements Within the first 12– 72 hours Physical protective storage is accessible and outside of the disaster area. • Accounts Payable and Accounts Receivable files Existing contracts and agreements Unaudited financial records After the first 72 hours Records needed to continue essential functions if normal agency information were unavailable for a prolonged period • • *Store in close proximity This chart is based in part on ARMA International, ANSI-ARMA 5 -2003 Vital Records: Identifying, Managing, and Recovering Business-Critical Records

“Grab and Go” Kits ▪ Certain City/Town officials will be on call immediately following the emergency. ▪ They should have “Grab and Go” kits that contain specific essential records. ▪ Develop procedures to keep “Grab and Go” kits up-to-date ▪ Use cycling to replace records that are changing to ensure you have current information

Develop Procedures to Ensure Access to Essential Records ▪ To ensure access, City/Towns should develop and document: ▪ ▪ Policies Delegations of authority Responsibilities of agency officials Procedures governing the essential records program ▪ Incorporate your essential records into your COOP plan

Don’t Forget Your Stakeholders ▪ Your network of stakeholders is invaluable for integrating your essential records emergency planning with your current COOP Plan ▪ ▪ ▪ ▪ COOP Manager Emergency Managers Agency head IT director Legal and accounting staff Records management personnel Custodians of archival records Agencies or outside organizations

Records Emergency Planning and Response

Overview of Emergency Planning and the REAP

Phases of Emergency Management

Federal Guidance on Emergency Preparedness and Response ▪ National Response Framework (NRF) ▪ National Incident Management System (NIMS) ▪ Incident Command System (ICS) ▪ Developing and Maintaining State, Territorial, Tribal, and Local Government Emergency Plans—Comprehensive Preparedness Guide 101 (CPG 101) ▪ FEMA Continuity Guidance for Non-Federal Entities ▪ Continuity Guidance Circular 1 (CGC 1) ▪ Continuity Assistance Tool (CAT)

Emergency Response—How it Works at the Local Level ▪ Response always starts at the local level. ▪ Each state government has its own emergency response plan. ▪ Several levels of government may become involved. ▪ NIMS ensures that all responders are operating and communicating under the same protocols for incident management. ▪ ICS ensures a clear chain of command. ▪ CGC 1 and CAT ensure that operations will resume.

What is a Records Emergency Action Plan (REAP)? ▪ A REAP is a written, approved, implemented, and periodically tested plan that includes the information and actions needed to respond to and recover from a records emergency. ▪ All response and recovery players should participate in developing, approving, and testing the plan. ▪ The REAP is part of a larger disaster plan. ▪ It is not the disaster plan itself; it is only an element of the plan. ▪ The portion of your disaster plan that includes records

Six Keys to Successful Response and Recovery 1. A detailed REAP 2. Committed management 3. Educated and trained staff 4. Timely initial response 5. Effective communication 6. Quick, informed decisions

Preparing a Records Emergency Action Plan

Identify the Disaster Plans and People Relevant to Your City/Town ▪ Identify the disaster plans in place so your REAP can: ▪ Tie into those plans most effectively ▪ Address any records-specific shortcomings they may have ▪ Identify and meet your emergency planning personnel to inform them about your REAP planning project.

Forming an Action Team ▪ Identify the members: ▪ Select staff who are flexible and capable of performing well under pressure. ▪ Select employees at all levels. ▪ Select employees who represent all functions. ▪ Assign responsibility. ▪ Select team leadership.

Components of the REAP ▪ Introduction ▪ Financial or Funding Information ▪ Policy Statement ▪ Vendors and Suppliers ▪ Responsibilities and Authorities ▪ Contractor Statement of Work ▪ Communication Plan ▪ Facility Information ▪ Emergency Contact Directory ▪ Staging Space ▪ Locations of Essential Records ▪ Preparedness, Response, and ▪ Records Salvage Priorities ▪ Supplies Recovery Procedures ▪ Training, Testing, and Updating ▪ Appendixes

Introduction ▪ States the purpose of the REAP and the entire preparedness program ▪ Includes information about: ▪ ▪ The scope of the plan (what functional units it covers) How to use the document The date of creation or revision How to revise the document

Policy Statement ▪ A clear, dated policy statement or directive ▪ From the most senior officer in the agency ▪ Approves the plan and identifies it as an official agency policy

Responsibilities and Authorities ▪ Delegation of authority and chain of command ▪ Roles and responsibilities for various activities ▪ REAP Teams ▪ Records Response and Recovery Manager ▪ Other assignments

Communication Plan ▪ Identify multiple communication strategies to be used during an emergency. ▪ List the modes of communication to be used during an emergency. ▪ Include Phone Tree and emergency contact directory.

Emergency Contact Directory ▪ Include: ▪ ▪ ▪ ▪ Agency staff Emergency responders Facility contractors Key parent agency staff, other administrative contacts Insurance providers Salvage and restoration vendors and contractors Other contacts

Locations of Essential Records ▪ Include the essential records inventory. ▪ Necessary information: ▪ ▪ ▪ ▪ Title Location Retention period Container ID Format and media Volume Location of master copy (if one exists)

Records Salvage Priorities ▪ Prioritize records for recovery in an emergency. ▪ Determine which records will require attention first, and which ones can wait. ▪ Essential records and permanent records have priority. ▪ Temporary records should be prioritized based on their retention period. ▪ Organized in three parts: ▪ First Priority ▪ Second Priority ▪ Third Priority Photo courtesy of NARA

Supplies ▪ List supplies you may need in the event of an emergency. ▪ Supplies needed to prevent further damage to records ▪ Supplies needed to aid in packing out records for further recovery ▪ Include where to purchase the supplies. ▪ Document the location(s) of the supplies. ▪ List contractors for food, water, and personal care supplies.

Financial or Funding Information ▪ How to obtain funds that may be required ▪ Tracking system for expenses ▪ Establish special codes for labor, equipment, and supplies.

Vendors and Suppliers ▪ List vendors and suppliers of records emergency services and supplies. ▪ Consider developing standing contracts. FEMA/Win Henderson—New Orleans— 2005

Statement of Work, Contract, and Memorandum of Understanding ▪ A generic draft Statement of Work (SOW), ready to use ▪ Obtained from your Procurement Office ▪ Signed contracts or Memorandums of Understanding (MOU)

Facility Information ▪ Provide all relevant facility information: ▪ Evacuation plans ▪ Location of, operating instructions for, and/or shutoffs for electrical systems, water sources, HVAC systems, etc. ▪ Locations of keys, hazardous materials, etc.

Staging Space ▪ Identify and make arrangements for use of building space. ▪ Keep contact information up-to-date. ▪ Outline: ▪ The procedures you will use to transfer or obtain office equipment and supplies ▪ The services you will need (electricity, water, communications, computers, etc. )

Preparedness, Response, and Recovery Procedures ▪ This is the largest and most detailed section of your REAP. ▪ Detail the procedures covering each phase of the emergency: ▪ Preparedness ▪ Response ▪ Recovery ▪ Indicate when an emergency status is upgraded from one phase to the next.

Assessment Team Roles and Responsibilities ▪ Assessment Team consists of the people knowledgeable about the facility, the emergency response, and the records involved. ▪ When establishing the Assessment Team: ▪ Detail specific responsibilities. ▪ Outline clear lines of authority. ▪ Remember that one person may play more than one role.

Response Team Roles and Responsibilities ▪ Response Team members may be responsible for: ▪ ▪ ▪ ▪ Separating records Moving records Packing records Drying material Maintaining tracking logs Maintaining documentation of records Labeling or relabeling boxes

Training, Testing, and Updating ▪ Training ▪ Document the goals and objectives. ▪ Document specific training programs for responders and specialized teams. ▪ Testing ▪ Document the testing goals and objectives. ▪ Document the schedule and plan for conducting testing activities. ▪ Updating ▪ Document any changes made to the REAP. ▪ Indicate who will be responsible for distributing updated versions.

Appendixes ▪ Information which is needed for the effective execution of the REAP, but which should be kept separate from the main narrative of the Plan

“d. Plan” Pocket Response Plan (Pre. P) Heritage Preservation’s Field Guide and Wheel

Distribute the REAP ▪ After management approval, the REAP is ready for distribution. ▪ Each team member should receive all or part of the REAP. ▪ Protect confidential information.

Promote the REAP ▪ All employees need to know their roles in implementation in the event of an emergency. ▪ Possible promotion methods: ▪ ▪ ▪ Agency newsletter Intranet Periodic emails Staff meetings Training

Train REAP Team Members and All Personnel ▪ REAP Teams need training specific to their roles. ▪ Some functions may require special training. ▪ Train team alternates. ▪ All agency personnel must have an orientation to the REAP.

Test and Validate the REAP ▪ A REAP is not effective unless it is tested and validated. ▪ The object is to validate and improve the REAP. ▪ Testing should occur at least annually. ▪ Methods include: ▪ ▪ Drill Tabletop activity Functional activity Full-scale activity ▪ Include all REAP Team members.

Review and Update the REAP ▪ Regularly review and update information contained in the REAP to ensure that it is accurate and current. ▪ Establish a schedule. ▪ Regularly check and update all dynamic data, especially in appendixes. ▪ Distribute updates immediately.

Resources for Help ▪ IPER Resource Center: http: //www. statearchivists. org/resourcecenter/iper ▪ ▪ ▪ Federal agencies and programs State agencies and programs Non-governmental agencies Regional conservation centers Commercial vendors Response and recovery procedures for each region, state, or locale