CFR Subpart C

CFR Subpart C
in effect

36 C.F.R. § 1236.20 What are appropriate recordkeeping systems for electronic records?

(a) General. Agencies must use electronic or paper recordkeeping systems or a combination of those systems, depending on their business needs, for managing their records. Transitory e-mail may be managed as specified in § 1236.22(c). (b) Electronic recordkeeping. Recordkeeping functionality may be built into the electronic information system or records can be transferred to an electronic recordkeeping repository, such as a DoD-5015.2 STD-certified product. The following functionalities are necessary for electronic recordkeeping: (1) Declare records. Assign unique identifiers to records. (2) Capture records. Import records from other sources, manually enter records into the system, or link records to other systems. (3) Organize records. Associate with an approved records schedule and disposition instruction. (4) Maintain records security. Prevent the unauthorized access, modification, or deletion of declared records, and ensure that appropriate audit trails are in place to track use of the records. (5) Manage access and retrieval. Establish the appropriate rights for users to access the records and facilitate the search and retrieval of records. (6) Preserve records. Ensure that all records in the system are retrievable and usable for as long as needed to conduct agency business and to meet NARA-approved dispositions. Agencies must develop procedures to enable the migration of records and their associated metadata to new storage media or formats in order to avoid loss due to media decay or technology obsolescence. (7) Execute disposition. Identify and effect the transfer of permanent records to NARA based on approved records schedules. Identify and delete temporary records that are eligible for disposal. Apply records hold or freeze on disposition when required. (c) Backup systems. System and file backup processes and media do not provide the appropriate recordkeeping functionalities and must not be used as the agency electronic recordkeeping system.

36 C.F.R. § 1236.22 What are the additional requirements for managing electronic mail records?

(a) Agencies must issue instructions to staff on the following retention and management requirements for electronic mail records: (1) The names of sender and all addressee(s) and date the message was sent must be preserved for each electronic mail record in order for the context of the message to be understood. The agency may determine that other metadata is needed to meet agency business needs, e.g., receipt information. (2) Attachments to electronic mail messages that are an integral part of the record must be preserved as part of the electronic mail record or linked to the electronic mail record with other related records. (3) If the electronic mail system identifies users by codes or nicknames or identifies addressees only by the name of a distribution list, retain the intelligent or full names on directories or distributions lists to ensure identification of the sender and addressee(s) of messages that are records. (4) Some e-mail systems provide calendars and task lists for users. These may meet the definition of Federal record. Calendars that meet the definition of Federal records are to be managed in accordance with the provisions of GRS 23, Item 5. (5) Draft documents that are circulated on electronic mail systems may be records if they meet the criteria specified in 36 CFR 1222.10(b) of this subchapter. (b) Agencies that allow employees to send and receive official electronic mail messages using a system not operated by the agency must ensure that Federal records sent or received on such systems are preserved in the appropriate agency recordkeeping system. (c) Agencies may elect to manage electronic mail records with very short-term NARA-approved retention periods (transitory records with a very short-term retention period of 180 days or less as provided by GRS 23, Item 7, or by a NARA-approved agency records schedule) on the electronic mail system itself, without the need to copy the record to a paper or electronic recordkeeping system, provided that: (1) Users do not delete the messages before the expiration of the NARA-approved retention period, and (2) The system's automatic deletion rules ensure preservation of the records until the expiration of the NARA-approved retention period. (d) Except for those electronic mail records within the scope of paragraph (c) of this section: (1) Agencies must not use an electronic mail system to store the recordkeeping copy of electronic mail messages identified as Federal records unless that system has all of the features specified in § 1236.20(b) of this part. (2) If the electronic mail system is not designed to be a recordkeeping system, agencies must instruct staff on how to copy Federal records from the electronic mail system to a recordkeeping system. (e) Agencies that retain permanent electronic mail records scheduled for transfer to the National Archives must either store them in a format and on a medium that conforms to the requirements concerning transfer at 36 CFR part 1235 or maintain the ability to convert the records to the required format and medium at the time transfer is scheduled. (f) Agencies that maintain paper recordkeeping systems must print and file their electronic mail records with the related transmission and receipt data specified by the agency's electronic mail instructions.

36 C.F.R. § 1236.24 What are the additional requirements for managing unstructured electronic records?

(a) Agencies that manage unstructured electronic records electronically must ensure that the records are filed in a recordkeeping system that meets the requirements in § 1236.10, except that transitory e-mail may be managed in accordance with § 1236.22(c). (b) Agencies that maintain paper files as their recordkeeping systems must establish policies and issue instructions to staff to ensure that unstructured records are printed out for filing in a way that captures any pertinent hidden text (such as comment fields) or structural relationships (e.g., among worksheets in spreadsheets or other complex documents) required to meet agency business needs.

36 C.F.R. § 1236.26 What actions must agencies take to maintain electronic information systems?

(a) Agencies must maintain inventories of electronic information systems and review the systems periodically for conformance to established agency procedures, standards, and policies as part of the periodic reviews required by 44 U.S.C. 3506. The review should determine if the records have been properly identified and described, and if the schedule descriptions and retention periods reflect the current informational content and use. If not, agencies must submit an SF 115, Request for Records Disposition Authority, to NARA. (b) Agencies must maintain up-to-date documentation about electronic information systems that is adequate to: (1) Specify all technical characteristics necessary for reading and processing the records contained in the system; (2) Identify all inputs and outputs; (3) Define the contents of the files and records; (4) Determine restrictions on access and use; (5) Understand the purpose(s) and function(s) of the system; (6) Describe update cycles or conditions and rules for adding, changing, or deleting information in the system; and (7) Ensure the timely, authorized disposition of the records.

36 C.F.R. § 1236.28 What additional requirements apply to the selection and maintenance of electronic records storage media for permanent records?

(a) Agencies must maintain the storage and test areas for electronic records storage media containing permanent and unscheduled records within the following temperature and relative humidity ranges: (1) Temperature—62° to 68 °F. (2) Relative humidity—35% to 45%. (b) Electronic media storage libraries and test or evaluation areas that contain permanent or unscheduled records must be smoke-free. (c) For additional guidance on the maintenance and storage of CDs and DVDS, agencies may consult the National Institute of Standards and Technology (NIST) Special Publication 500-252, Care and Handling of CDs and DVDs at http://www.itl.nist.gov/iad/894.05/papers/CDandDVDCareandHandlingGuide.pdf, contact phone number (301) 975-6478. (d) Agencies must test magnetic computer tape media no more than 6 months prior to using them to store electronic records that are unscheduled or scheduled for permanent retention. This test should verify that the magnetic computer tape media are free of permanent errors and in compliance with NIST or industry standards. (e) Agencies must annually read a statistical sample of all magnetic computer tape media containing permanent and unscheduled records to identify any loss of data and to discover and correct the causes of data loss. In magnetic computer tape libraries with 1800 or fewer tape media, a 20% sample or a sample size of 50 media, whichever is larger, should be read. In magnetic computer tape libraries with more than 1800 media, a sample of 384 media should be read. Magnetic computer tape media with 10 or more errors should be replaced and, when possible, lost data must be restored. All other magnetic computer tape media which might have been affected by the same cause (i.e., poor quality tape, high usage, poor environment, improper handling) must be read and corrected as appropriate. (f) Before the media are 10 years old, agencies must copy permanent or unscheduled data on magnetic records storage media onto tested and verified new electronic media.

Starting a business? Corpus forms LLCs in all 50 states and DC.