Principles for managing web-based information: ARMA International's Standards Development Program.

• Position: THE PRINCIPLES: GENERALLY ACCEPTED RECORDKEEPING PRINCIPLES[R]

[ILLUSTRATION OMITTED]

Although records management practices are grounded in the concept of managing information based on content and context, regardless of media, information created in or posted to web-based, collaborative applications deserve special attention. The Generally Accepted Recordkeeping Principles[R] provide a framework for managing this information.

Given the lack of standardization, no two web-based, collaborative technologies adhere to the same specifications. So, it is not surprising that records managers and information technology professionals struggle to keep pace with current practices.

Against this backdrop, the standard from which this article is excerpted--ANSI/ARMA 18-2011 Implications of Web-Based, Collaborative Technologies in Records Management--was developed by ARMA International to establish a framework, based in part on the General Accepted Recordkeeping Principles[R], to benefit organizations that are using or thinking of using web-based, collaborative technologies.

Each of the following sections taken from the standard states one of the Generally Accepted Recordkeeping Principles[R], tells how it applies to these technologies, and provides related requirements and recommendations.

For optimal results when implementing this advice, cooperation is needed from individuals in other functional areas within the organization, including human resources, information technology, legal, and marketing.

Organizations that use commercial social media services to supply web-based, collaborative technologies also will need satisfactory service level agreements as described in these sections. Absent such agreements or internally devised "work-arounds," organizations put their records and information at risk.

Accountability

Principle of Accountability

Principle/Requirement: An organization shall assign a senior executive who will oversee a recordkeeping program and delegate program responsibility to appropriate individuals, adopt policies and procedures to guide personnel, and ensure program auditability.

Application

Organizations choosing web-based, collaborative technologies should prepare policies and procedures to foster acceptable use of these applications and to limit risk exposure. The documents should include guidelines and recommendations for secure use, including policy controls, acquisition controls, training controls, and host and network controls.

Policies and procedures should not be focused on a specific, unique application or infrastructure, as technology changes rapidly. There should be a focus on user behavior, both personal and professional, and information confidentiality, integrity, and availability.

Policies and procedures should be reviewed and audited periodically to ensure applicability and verify compliance with industry-specific laws, regulations, and statutes.

Recommendations

1. Organizations should develop policies that specifically address web-based, collaborative technologies and social media.

2. A member(s) of senior management should be appointed with overall responsibility for the implementation and oversight of web-based, collaborative technologies and social media policies.

3. Policies and procedures should be reasonably designed to ensure that the associated persons who participate in social media sites for business purposes are appropriately supervised, have the necessary training and background to engage in such activities, and do not present undue risks to the organization.

4. The organization's policy should prohibit any associated person from engaging in business communications in a social media site that is not subject to the organization's supervision.

5. The organization's policy should require that only those persons who have received appropriate training on the web-based, collaborative technologies and social media policies and procedures may engage in the use of those technologies.

   Integrity

   Principle of Integrity

   Principle/Requirement: A recordkeeping program shall be constructed so the records and information generated or managed by or for the organization have a reasonable and suitable guarantee of authenticity and reliability.

   Application

   Applications utilizing web-based, collaborative technologies may contain both static and interactive content. The static content remains until it is changed by the organization or by an individual with specific...