Protecting records--what the standards tell us: key standards have been developed that aid in determining the best methods, rationale, environment, and housing for protecting valuable records.

• Author: Jones, Virginia A.
• Position: Management Wise - Records and information management

At the Core

This article

* discusses key standards that comprise a good foundation for records protection

* defines RIM professionals' role in protecting records

One of the key competencies of the records and information management (RIM) profession is the appropriate management of inactive and vital records. Efficient and protective storage procedures, tasks, and processes are important to the success of any RIM program. Records should be available for access throughout their complete life cycle, regardless of the retention value assigned.

Historical records require additional processes not only to protect, but to also preserve the information for future reference. Records protection is also an integral part of a vital records and disaster prevention program. National and international standards have been developed that aid in determining the best methods, rationale, environment, and housing for protecting valuable records.

Foundation for Records Protection

Several key standards interact one with another to form a good foundation for records protection. These standards include

* ISO 15489-1: Information and Documentation--Records Management--Part 1: General

* ISO/TR 15489-2: Information and Documentation--Records Management--Part 2: Guidelines (although this is a technical report and not a standard, it is used in conjunction with the Part 1 standard)

* NFPA 75: Standard for the Protection of Electronic Computer/Data Processing Equipment 1999 Edition

* NFPA 232: Standard for the Protection of Records 2000 Edition

* NFPA 909: Code for the Protection of Cultural Resources 2001 Edition

As with any good investigation or analysis, these standards help resolve the who, what, when, where, and why of RIM protection. Each of the documents cover some aspect of "what" those responsibilities may be, and the meat of each of these documents covers the "when, where, and why." In general, the primary responsibility of developing, implementing, and managing a records and information program includes protecting records and information.

ISO 15489-1 and 15489-2 discuss the entire lifecycle program of records and information. NFPA 75 pertains to the protection from fire of electronic computer/data processing equipment and computer areas, and includes sections on records storage within or immediately outside a computer room. NFPA 232 very specifically applies to protecting all records from loss due to fire. Its requirements cover a range from "useful" short-term records to preservation protection of historical records. It includes separate requirements for vital records protection. NFPA 909 pertains to culturally significant structures, such as museums and libraries, and their contents. For the most part, records storage requirements in this standard point back to NFPA 232.

Some of the requirements are very specific, and others set general guidance for record protection decisions. Each applies to a specific aspect of records and information management.

ISO 15489-1: Information and Documentation--Records Management--Part 1: General

Part 1 of ISO 15489 "provides guidance on managing records of originating organizations, public or private, for internal and external clients." It specifically pertains to managing all records, in all formats and media, for the entire life cycle of the records and information. The standard describes all the elements of an adequate records management program that accurately creates, captures, and manages the records and information.

Clause 6.3 of ISO 15489-1 clearly designates records management professionals as responsible for all aspects of records management within an organization. This includes the "design, implementation, and maintenance of records systems and their operations." Implementing measures for records and information protection is clearly a part of this responsibility.

Records protection is covered in two clauses. Clause 8--Design and Implementation of a Records System includes a section on storage media and protection. Section 8.3.3--Physical Storage Medium and Protection requires consideration of appropriate storage environments for the record media, appropriate storage media for the required retention value of the record, appropriate handling procedures for records protection, and appropriate storage systems for the record value and media. The section also suggests that disaster preparedness is addressed to ensure that risks are identified and mitigated.

Clause 9--Records Management Processes and Controls includes a section on the storage and handling of records...