Records Management Standard for the New Zealand Public Sector: requirements mapping document

Transcription

1 Records Management Standard for the New Zealand Public Sector: requirements mapping document Introduction This document maps the requirements in the new Records Management Standard to the requirements in the four current recordkeeping standards. In sections 1 through 4 it maps the requirements in each of the current standards forward to those in the new standard. In section 5, it maps the requirements in the new standard back to those in the current ones. Old and new requirements are related in one of several ways: one-to-one translation, with minor wording changes or slight changes in emphasis amalgamation of duplicated requirements amalgamation of requirements from different standards relating to similar products or procedures eg policies, tracking documents, monitoring systems amalgamation of requirements that can reasonably be assumed to be part of a coherent process eg disposal procedures include checking that any approved disposal authority is valid amalgamation of requirements, where one can reasonably be assumed to imply the other eg maintaining the link between records and metadata assumes doing so during migration between systems; regular disposal implies appraisal has taken place opening out of a few very high level requirements, particularly in Create and Maintain, and making them more specific. Several requirements from the Storage Standard and the Electronic Recordkeeping Metadata Standard have been downgraded. See below. 1

2 1. Create and Maintain vs Records Management Standard Current requirement New requirement CM 1 CM 2 CM 3 CM 4 CM 5 CM 6 CM 7 CM 8 (capture/systems) CM 9 CM 10/19 (metadata) Responsibility for recordkeeping compliance must be assigned and endorsed by the administrative head. Organisations must have a defined, documented and implemented policy for recordkeeping, which is regularly reviewed. Organisations must have defined, documented and implemented procedures for recordkeeping which are regularly reviewed. Recordkeeping responsibilities and resources must be defined, supported and assigned. A programme of internal recordkeeping, monitoring and compliance must be developed and implemented. The functions and business activities of an organisation must be identified and documented, including any functions contracted out. Records of business decisions and transactions must be created. All records of business activity must be captured routinely into an organisation-wide recordkeeping framework. Staff must receive appropriate, and regular, training for organisational recordkeeping responsibilities. Records must be authentic: organisations must accurately document their creation, receipt, and transmission. 7.1 Records management responsibilities must be assigned 7.4, , , 7.2, , , 7.1 through 7.8 Principles 2-7 define the outline of a recordkeeping framework 7.2, 7.3 Policy for records management must be set and documented Records management policies and processes must be implemented, monitored and regularly reviewed Records management policies and processes must be implemented, monitored and regularly reviewed Records management activities must be documented Records management responsibilities must be assigned Staff must be trained to create and maintain records Records management must be resourced Records management objectives must be defined and documented Records management policies and processes must be implemented, monitored and regularly reviewed Internal requirements and external obligations to create and maintain records of business activity must be identified and documented Records must be created and maintained to meet internal requirements and external obligations Records must be created in a timely manner Principle 7 (manage records systematically) 3.1 through 3.4 Principle 3 (metadata) Staff must be trained to create and maintain records Trained staff must be assigned to carry out records management functions and activities 2

3 CM 11 CM 12/18 (access) CM 13 CM 14 CM 15 (systems) CM 16 CM 17 (systems/storage) CM 18/12 (access) CM 19/10 (metadata) CM 20 (disposal) Records must have reliability and integrity and must be maintained unaltered. Records must be useable, retrievable and accessible. Records must be complete, recording the content and contextual information necessary to document an activity. Records must be comprehensive and provide authoritative evidence of all business activities. Records must be identified and captured within a recordkeeping framework. Records must be organised according to a business classification scheme. Records must be reliably maintained over time within a recordkeeping framework. Records must be useable, accessible and retrievable for the entire period of their retention Records contextual and structural integrity must be maintained over time. Retention and disposal actions must be applied systematically. 1.5, 6.1 The content of records must be fixed Records must be secure 4.1 through 4.4 Principle 4 (access) 1.3, Principles 2-7 define the outline of a recordkeeping framework through through 6.7 The content and structure of records must fit their purpose and audience Records must be classified and organised according to a business classification scheme The content and structure of records must fit their purpose and audience Principles through 4.4 Principle 4 (access) 3.1 through 3.4 Principle 3 (metadata) 5.1 through 5.6 Principle 5 (disposal) Records must be classified and organised according to a business classification scheme Principle 7 (manage records systematically) Principle 6 (maintain integrity) 3

4 2. Electronic Recordkeeping Metadata Standard vs Records Management Standard Current requirement New requirement ERMS 1 ERMS 2 ERMS 3 ERMS 4 ERMS 5 Records and information management policies and procedures must specify the role of recordkeeping metadata in ensuring authenticity, reliability, and integrity. Responsibility for: creating, maintaining and altering an organisation s recordkeeping metadata schemas and encoding schemes attribution and verification of point of capture recordkeeping metadata must be assigned, documented, communicated and regularly reviewed. Rules relating to changing recordkeeping metadata must be defined. Metadata schema and encoding schemes must be maintained, documented and communicated. Metadata in all business-critical systems/applications which create records must be mapped to the recordkeeping metadata schema established in the accompanying Technical Specifications. 7.6, , 7.1, , 7.6, Downgraded recommended in 3.2 Records management policies and processes must be implemented, monitored and regularly reviewed Records management activities must be documented Metadata management tools must be developed and maintained, and changes made to them must be tracked and documented Records management responsibilities must be assigned Trained staff must be assigned to carry out records management functions and activities The disposal of records management metadata must be managed systematically Records management policies and processes must be implemented, monitored and regularly reviewed Records management activities must be documented Metadata management tools must be developed and maintained, and changes made to them must be tracked and documented It may be more efficient for agencies to map systems directly to each other 4

5 Current requirement New requirement ERMS 6 ERMS 7 ERMS 8 Recordkeeping metadata must be assigned to or associated with all record objects and aggregations. Organisations must document their decisions about the attribution of recordkeeping metadata. At point of capture of a record object, the following minimum recordkeeping metadata must be attributed: a unique identifier a name date of creation who created the record what business is being conducted creating application and version The following minimum records management metadata must be assigned to records and aggregations of records (see also requirement 5.6): a unique identifier a name the date of creation the business activity documented by the record the creator (person or system) of digital records the name and version of the software application used to create digital records the subsequent actions, if any, carried out on the record, such as accessing, modifying or disposing the identification of the persons or systems carrying out those actions, and the dates those actions were carried out. Records management policies, processes and activities must be documented The following minimum records management metadata must be assigned to records and aggregations of records (see also requirement 5.6): a unique identifier a name the date of creation the business activity documented by the record the creator (person or system) of digital records the name and version of the software application used to create digital records the subsequent actions, if any, carried out on the record, such as accessing, modifying or disposing the identification of the persons or systems carrying out those actions, and the dates those actions were carried out. 5

6 Current requirement New requirement ERMS 9 ERMS 10 ERMS 11 ERMS 12 ERMS 13 ERMS 14 For each action undertaken on a record object the following minimum recordkeeping process metadata must be maintained: the date of the action the identification of the person or system undertaking the action what action was undertaken. Organisations must identify where requirements to extend the recordkeeping metadata exist. Recordkeeping metadata must be persistently linked with a record object for its entire period of retention. Recordkeeping metadata must accompany record objects being transferred from their original creating environment or system. Recordkeeping metadata must be subject to appraisal decisions prior to its disposal. Recordkeeping metadata must be protected from unauthorised disposal. 3.1 Downgraded recommended in The following minimum records management metadata must be assigned to records and aggregations of records (see also requirement 5.6): a unique identifier a name the date of creation the business activity documented by the record the creator (person or system) of digital records the name and version of the software application used to create digital records the subsequent actions, if any, carried out on the record, such as accessing, modifying or disposing the identification of the persons or systems carrying out those actions, and the dates those actions were carried out. Agencies will do this where there are obvious benefits. Records management metadata must be persistently linked to records and aggregations of records Records management metadata must be persistently linked to records and aggregations of records The disposal of records management metadata must be managed systematically The disposal of records management metadata must be managed systematically 6

7 Current requirement New requirement ERMS 15 After authorised disposal actions on a record are implemented (including transfer and destruction), the following minimum recordkeeping metadata must be retained for as long as is required by the business: point of capture metadata including a unique identifier, a name, date of creation, who created the record, what business is being conducted, and the creating application and version the date the disposal action took place the authority governing the record s destruction the person/role undertaking the disposal action. 5.6 The following minimum metadata must be generated or captured during the disposal process, and retained for as long as required to account for the disposal of records (see also requirements 3.1 and 3.4): a unique identifier a name the date of creation the business activity documented by the record the creator (person or system) of digital records the date of disposal the authority governing the disposal of the records, and the person/role carrying out the disposal. 7

8 3. Disposal Standard vs Records Management Standard Current requirement New requirement DS 1 DS 2 DS 3 DS 4 DS 5 DS 6 Disposal of public records and local authority protected records must be authorised by the Chief Archivist, in accordance with the Public Records Act Disposal of records must be approved by the controlling organisation. Disposal of records must be undertaken using a disposal authority that is current and relevant. Organisations must have policies and procedures for the disposal of records. Disposal of records must be undertaken on a regular and routine basis. Appropriate protection and preservation of records of archival value must be planned , 7.7 The correct statutory process for disposing of records must be followed A systematic internal process for disposing of records must be set up and followed A systematic internal process for disposing of records must be set up and followed Records management policies and processes must be implemented, monitored and regularly reviewed Records management activities must be documented 5.5 Records must be disposed of regularly 4.4, 5.4 (and Principle 6) Risks to the accessibility of records must be identified and mitigated A systematic internal process for disposing of records must be set up and followed Principle 6 (maintain integrity) 8

9 Current requirement New requirement DS 7 Disposal of records must be documented. 5.6, 7.7 The following minimum metadata must be generated or captured during the disposal process, and retained for as long as required to account for the disposal of records (see also requirements 3.1 and 3.4): a unique identifier a name the date of creation the business activity documented by the record the creator (person or system) of digital records the date of disposal the authority governing the disposal of the records, and the person/role carrying out the disposal. Records management policies, processes and activities must be documented Records management policies and processes must be implemented, monitored and regularly reviewed DS 8 Disposal activities must be regularly monitored and reviewed. Disposal activities must be carried out by personnel who have appropriate skills and knowledge. Methods used to dispose of records must comply with any privacy and security requirements. Everything necessary and practical must be done to ensure that the destruction of records is complete. 7.6 DS Trained staff must be assigned to carry out records management functions and activities DS , 6.1 Access to records must be managed appropriately Records must be secure DS A systematic internal process for disposing of records must be set up and followed 9

10 4. Storage Standard vs Records Management Standard Current requirement New requirement or technical specification 7.6, but this sits across a range of different principles and requirements SS 1 Records must be identified and registered in a system which controls the records and allows efficient retrieval. Records management policies and processes must be implemented, monitored and regularly reviewed SS 2 Records must be arranged in an orderly manner, and well managed so that order is maintained. 6.6 Physical records and digital records held on removable media must be stored in conditions that ensure their safe care and custody. These records must be: stored in buildings with fire protection systems and equipment compliant with the New Zealand Building Code stored above floor-level using shelving or equipment appropriate to the format of the records or the size of the storage media stored away from sunlight and artificial light stored away from magnetic interference, if they are digital records held on removable media arranged in an orderly manner, and retrieved, handled and reshelved in accordance with set procedures. Physical records and digital records held on removable media must be stored in conditions that ensure their safe care and custody. These records must be: stored in buildings with fire protection systems and equipment compliant with the New Zealand Building Code stored above floor-level using shelving or equipment appropriate to the format of the records or the size of the storage media stored away from sunlight and artificial light stored away from magnetic interference, if they are digital records held on removable media arranged in an orderly manner, and retrieved, handled and reshelved in accordance with set procedures. SS 3 Procedures must be in place for retrieving, handling and reshelving records, and for returning records to off-site storage

11 Current requirement New requirement or technical specification SS 4 Inactive records of archival value must be identified so that they can be stored appropriately. 6.7 Inactive physical records and inactive digital records held on removable media must be identified and stored in a dedicated storage area Inactive physical records and inactive digital records held on removable media must be identified and stored in a dedicated storage area Access to records must be managed appropriately Records must be accessible when required SS 5 Records that are not in active use must be stored in a dedicated storage area. 6.7 SS 6 Storage areas must allow ongoing access to the records by authorised users. Records must be stored in locations which reflect the characteristics of their format and their retention period. 4.1, 4.2 SS Records must be stored on appropriate media or hardware, and in suitable containers and locations SS 8 The building in which records are stored must comply with the New Zealand Building Code that applied at the time of construction and associated codes and standards, and be appropriate for use in storing records. 6.6 Physical records and digital records held on removable media must be stored in conditions that ensure their safe care and custody. These records must be: stored in buildings with fire protection systems and equipment compliant with the New Zealand Building Code stored above floor-level using shelving or equipment appropriate to the format of the records or the size of the storage media stored away from sunlight and artificial light stored away from magnetic interference, if they are digital records held on removable media arranged in an orderly manner, and retrieved, handled and reshelved in accordance with set procedures. 11

12 Current requirement SS 9 The building in which records are stored must have adequate drainage systems to prevent flooding. New requirement or technical specification 6.8 Dedicated storage areas for inactive physical records or for inactive digital records held on removable media must ensure the survival of those records in a usable form. These storage areas must: be located in buildings which comply with the provisions of the New Zealand Building Code in force at time of construction and with any associated codes and standards have adequate floor loading capacity have drainage systems adequate to prevent flooding or must be located in buildings with drainage systems adequate to prevent flooding be insulated from the outside climate be protected from internal hazards be maintained over time in accordance with a documented maintenance programme be intruder resistant and have an alarm system or be located within buildings that are intruder resistant and have an alarm system, and be kept clean and free of pests such as rodents and insects. 12

13 Current requirement SS 10 The storage area must be insulated from the climate outside New requirement or technical specification 6.8 Dedicated storage areas for inactive physical records or for inactive digital records held on removable media must ensure the survival of those records in a usable form. These storage areas must: be located in buildings which comply with the provisions of the New Zealand Building Code in force at time of construction and with any associated codes and standards have adequate floor loading capacity have drainage systems adequate to prevent flooding or must be located in buildings with drainage systems adequate to prevent flooding be insulated from the outside climate be protected from internal hazards be maintained over time in accordance with a documented maintenance programme be intruder resistant and have an alarm system or be located within buildings that are intruder resistant and have an alarm system, and be kept clean and free of pests such as rodents and insects. 13

14 Current requirement SS 11 Storage areas must be protected against internal hazards. New requirement or technical specification 6.8 Dedicated storage areas for inactive physical records or for inactive digital records held on removable media must ensure the survival of those records in a usable form. These storage areas must: be located in buildings which comply with the provisions of the New Zealand Building Code in force at time of construction and with any associated codes and standards have adequate floor loading capacity have drainage systems adequate to prevent flooding or must be located in buildings with drainage systems adequate to prevent flooding be insulated from the outside climate be protected from internal hazards be maintained over time in accordance with a documented maintenance programme be intruder resistant and have an alarm system or be located within buildings that are intruder resistant and have an alarm system, and be kept clean and free of pests such as rodents and insects. 14

15 Current requirement New requirement or technical specification SS 12 A building maintenance programme must be in place. 6.8 Dedicated storage areas for inactive physical records or for inactive digital records held on removable media must ensure the survival of those records in a usable form. These storage areas must: be located in buildings which comply with the provisions of the New Zealand Building Code in force at time of construction and with any associated codes and standards have adequate floor loading capacity have drainage systems adequate to prevent flooding or must be located in buildings with drainage systems adequate to prevent flooding be insulated from the outside climate be protected from internal hazards be maintained over time in accordance with a documented maintenance programme be intruder resistant and have an alarm system or be located within buildings that are intruder resistant and have an alarm system, and be kept clean and free of pests such as rodents and insects. Records must be protected from natural and man-made hazards SS 13 Records are located as far as possible from natural and man-made hazards. A disaster management plan and procedures must be in place, kept current, and known to staff. Staff who are responsible for records must be trained in emergency procedures to protect and salvage the records. 6.2 SS Business continuity and disaster management planning must address the protection and salvage of records SS , 7.3 Records management responsibilities must be assigned Trained staff must be assigned to carry out records management functions and activities 15

16 Current requirement SS 16 SS 17 SS 18 There must be a comprehensive fire protection system and equipment for the building, in compliance with the New Zealand Building Code. Records which contain sensitive or classified information must be identified and protected. Access to records storage areas must be controlled and restricted to authorised staff. New requirement or technical specification Records must be secure Physical records and digital records held on removable media must be stored in conditions that ensure their safe care and custody. These records must be: stored in buildings with fire protection systems and equipment compliant with the New Zealand Building Code stored above floor-level using shelving or equipment appropriate to the format of the records or the size of the storage media stored away from sunlight and artificial light stored away from magnetic interference, if they are digital records held on removable media arranged in an orderly manner, and retrieved, handled and reshelved in accordance with set procedures. 4.1 Access to records must be managed appropriately 16

17 Current requirement New requirement or technical specification SS 19 Storage areas must be intruder resistant and have an intruder alarm system. 6.8 Dedicated storage areas for inactive physical records or for inactive digital records held on removable media must ensure the survival of those records in a usable form. These storage areas must: be located in buildings which comply with the provisions of the New Zealand Building Code in force at time of construction and with any associated codes and standards have adequate floor loading capacity have drainage systems adequate to prevent flooding or must be located in buildings with drainage systems adequate to prevent flooding be insulated from the outside climate be protected from internal hazards be maintained over time in accordance with a documented maintenance programme be intruder resistant and have an alarm system or be located within buildings that are intruder resistant and have an alarm system, and be kept clean and free of pests such as rodents and insects. Physical records and digital records held on removable media must be stored in conditions that ensure their safe care and custody. These records must be: stored in buildings with fire protection systems and equipment compliant with the New Zealand Building Code stored above floor-level using shelving or equipment appropriate to the format of the records or the size of the storage media stored away from sunlight and artificial light stored away from magnetic interference, if they are digital records held on removable media arranged in an orderly manner, and retrieved, handled and reshelved in accordance with set procedures. SS 20 Records must be stored using shelving or equipment appropriate to the format and size of the items

18 Current requirement SS 21 Inactive records of archival value must be packaged in containers which are clean, in good condition and appropriate to the format and retention period of the records. SS 22 Records must be stored away from light. 6.6 SS 23 Magnetic media must be stored away from magnetic fields. New requirement or technical specification Records must be stored on appropriate media or hardware, and in suitable containers and locations Physical records and digital records held on removable media must be stored in conditions that ensure their safe care and custody. These records must be: stored in buildings with fire protection systems and equipment compliant with the New Zealand Building Code stored above floor-level using shelving or equipment appropriate to the format of the records or the size of the storage media stored away from sunlight and artificial light stored away from magnetic interference, if they are digital records held on removable media arranged in an orderly manner, and retrieved, handled and reshelved in accordance with set procedures. Physical records and digital records held on removable media must be stored in conditions that ensure their safe care and custody. These records must be: stored in buildings with fire protection systems and equipment compliant with the New Zealand Building Code stored above floor-level using shelving or equipment appropriate to the format of the records or the size of the storage media stored away from sunlight and artificial light stored away from magnetic interference, if they are digital records held on removable media arranged in an orderly manner, and retrieved, handled and reshelved in accordance with set procedures. 18

19 Current requirement SS 24 Storage areas must be kept clean. 6.8 SS 25 SS 26 SS 27 SS 28 Records of short-term value must be stored in conditions which ensure preservation until they are no longer required. Inactive records of archival value must be stored in conditions where the relative humidity is never above 60% or below 30%. Inactive records of archival value must be stored in conditions where the temperature is never above 25 degrees centigrade. Archives must be stored in conditions where the relative humidity does not fluctuate by more than 10% in a 24 hour period, or 20% in a year. New requirement or technical specification 6.3 Downgraded Downgraded Downgraded Dedicated storage areas for inactive physical records or for inactive digital records held on removable media must ensure the survival of those records in a usable form. These storage areas must: be located in buildings which comply with the provisions of the New Zealand Building Code in force at time of construction and with any associated codes and standards have adequate floor loading capacity have drainage systems adequate to prevent flooding or must be located in buildings with drainage systems adequate to prevent flooding be insulated from the outside climate be protected from internal hazards be maintained over time in accordance with a documented maintenance programme be intruder resistant and have an alarm system or be located within buildings that are intruder resistant and have an alarm system, and be kept clean and free of pests such as rodents and insects. Records must be stored on appropriate media or hardware, and in suitable containers and locations 19

20 Current requirement New requirement or technical specification SS 29 Archives must be stored in conditions where the temperature does not fluctuate by more than 4 degrees centigrade over a 24 hour period or 10 degrees centigrade over a year. Downgraded SS 30 Environmental conditions for records of archival value must be regularly monitored, and records of monitoring must be kept. Downgraded 20

21 5. Records Management Standard vs current standards New requirement Current requirement Internal requirements and external obligations to create and maintain records of business activity must be identified and documented Records must be created and maintained to meet internal requirements and external obligations The content and structure of records must fit their purpose and audience CM 6 CM Records must be created in a timely manner CM The content of records must be fixed CM Business activities must be documented in a business classification scheme Records must be classified and organised according to a business classification scheme CM 13, CM 14 CM 6 CM 13, CM 16; SS 2 The functions and business activities of an organisation must be identified and documented, including any functions contracted out. Records of business decisions and transactions must be created. Records must be complete, recording the content and contextual information necessary to document an activity. Records must be comprehensive and provide authoritative evidence of all business activities. All records of business activity must be captured routinely into an organisation-wide recordkeeping framework. Records must have reliability and integrity and must be maintained unaltered. The functions and business activities of an organisation must be identified and documented, including any functions contracted out. Records must be complete, recording the content and contextual information necessary to document an activity. Records must be organised according to a business classification scheme. Records must be arranged in an orderly manner, and well managed so that order is maintained. 21

22 New requirement Current requirement The following minimum records management metadata must be assigned to records and aggregations of records (see also requirement 5.6): a unique identifier a name the date of creation the business activity documented by the record the creator (person or system) of digital records the name and version of the software application used to create digital records the subsequent actions, if any, carried out on the record, such as accessing, modifying or disposing the identification of the persons or systems carrying out those actions, and the dates those actions were carried out. Metadata management tools must be developed and maintained, and changes made to them must be tracked and documented CM 10, CM 19; ERMS 6, ERMS 8, ERMS 9 CM 10, CM 19; ERMS 2, ERMS 4 Records must be authentic: organisations must accurately document their creation, receipt, and transmission. Records contextual and structural integrity must be maintained over time. Recordkeeping metadata must be assigned to or associated with all record objects and aggregations. Records must be authentic: organisations must accurately document their creation, receipt, and transmission. Records contextual and structural integrity must be maintained over time. Metadata schema and encoding schemes must be maintained, documented and communicated. Responsibility for: o creating, maintaining and altering an organisation s recordkeeping metadata schemas and encoding schemes o attribution and verification of point of capture recordkeeping metadata must be assigned, documented, communicated and regularly reviewed. 22

23 New requirement Current requirement Records management metadata must be persistently linked to records and aggregations of records The disposal of records management metadata must be managed systematically Access to records must be managed appropriately CM 10, CM 19; ERMS 11, ERMS 12 CM 10, CM 19; ERMS 3, ERMS 13, ERMS 14 CM 12, CM 18; SS 1, SS Records must be accessible when required CM 12, CM 18; SS 1, SS 6 Records must be authentic: organisations must accurately document their creation, receipt, and transmission. Records contextual and structural integrity must be maintained over time. Recordkeeping metadata must be persistently linked with a record object for its entire period of retention. Recordkeeping metadata must accompany record objects being transferred from their original creating environment or system. Records must be authentic: organisations must accurately document their creation, receipt, and transmission. Records contextual and structural integrity must be maintained over time. Rules relating to changing recordkeeping metadata must be defined Recordkeeping metadata must be subject to appraisal decisions prior to its disposal. Recordkeeping metadata must be protected from unauthorised disposal. Records must be useable, retrievable and accessible. Records must be useable, accessible and retrievable for the entire period of their retention Records must be identified and registered in a system which controls the records and allows efficient retrieval. Storage areas must allow ongoing access to the records by authorised users. Records must be useable, retrievable and accessible. Records must be useable, accessible and retrievable for the entire period of their retention Records must be identified and registered in a system which controls the records and allows efficient retrieval. Storage areas must allow ongoing access to the records by authorised users. 23

24 New requirement Current requirement 4.3 The use of records must be promoted 4.4 Risks to the accessibility of records must be identified and mitigated CM 12, CM 18; SS 6, SS 7 underpin this idea, but it is a slight change in emphasis from current guidance CM 12, CM 18; SS 6, SS 7; DS The value of records must be appraised CM 20; DS 5 (implied) Retention periods and disposal actions for records must be defined and documented The correct statutory process for disposing of records must be followed CM 20; DS 5 (implied) CM 20; DS 1; ERMS 13, ERMS 14 Records must be useable, retrievable and accessible. Records must be useable, accessible and retrievable for the entire period of their retention Records must be identified and registered in a system which controls the records and allows efficient retrieval. Storage areas must allow ongoing access to the records by authorised users. Records must be useable, retrievable and accessible. Records must be useable, accessible and retrievable for the entire period of their retention Records must be identified and registered in a system which controls the records and allows efficient retrieval. Storage areas must allow ongoing access to the records by authorised users. Appropriate protection and preservation of records of archival value must be planned Retention and disposal actions must be applied systematically. Disposal of records must be undertaken on a regular and routine basis. Retention and disposal actions must be applied systematically. Disposal of records must be undertaken on a regular and routine basis. Retention and disposal actions must be applied systematically. Disposal of public records and local authority protected records must be authorised by the Chief Archivist, in accordance with the Public Records Act Recordkeeping metadata must be subject to appraisal decisions prior to its disposal. Recordkeeping metadata must be protected from unauthorised disposal 24

25 New requirement Current requirement 5.4 A systematic internal process for disposing of records must be set up and followed CM 20; DS 2, DS 3, DS 6, DS Records must be disposed of regularly CM 20; DS The following minimum metadata must be generated or captured during the disposal process, and retained for as long as required to account for the disposal of records (see also requirements 3.1 and 3.4): a unique identifier a name the date of creation the business activity documented by the record the creator (person or system) of digital records the date of disposal the authority governing the disposal of the records, and the person/role carrying out the disposal. CM 20; ERMS 15; DS 7 Retention and disposal actions must be applied systematically. Disposal of records must be undertaken using a disposal authority that is current and relevant. Disposal of records must be approved by the controlling organisation. Disposal of records must be undertaken using a disposal authority that is current and relevant. Appropriate protection and preservation of records of archival value must be planned. Everything necessary and practical must be done to ensure that the destruction of records is complete. Retention and disposal actions must be applied systematically. Disposal of records must be undertaken on a regular and routine basis. Retention and disposal actions must be applied systematically. After authorised disposal actions on a record are implemented (including transfer and destruction), the following minimum recordkeeping metadata must be retained for as long as is required by the business: o point of capture metadata including a unique identifier, a name, date of creation, who created the record, what business is being conducted, and the creating application and version o the date the disposal action took place o the authority governing the record s destruction o the person/role undertaking the disposal action. Disposal of records must be documented. 25

26 New requirement Current requirement 6.1 Records must be secure CM 17; DS 10; SS Records must be protected from natural and man-made hazards Records must be stored on appropriate media or hardware, and in suitable containers and locations At-risk records must be identified and managed appropriately Business continuity and disaster management planning must address the protection and salvage of records CM 17; SS 13 CM 17; SS 7, SS 21, SS 25 CM 17. This is a general requirement which emphasises the importance of storing records appropriately SS requirements. CM 17; SS 14: slight extension to include business continuity planning Records must be reliably maintained over time within a recordkeeping framework. Methods used to dispose of records must comply with any privacy and security requirements. Records which contain sensitive or classified information must be identified and protected Records must be reliably maintained over time within a recordkeeping framework. Records are located as far as possible from natural and manmade hazards. Records must be reliably maintained over time within a recordkeeping framework. Inactive records of archival value must be packaged in containers which are clean, in good condition and appropriate to the format and retention period of the records. Records must be stored in locations which reflect the characteristics of their format and their retention period. Records of short-term value must be stored in conditions which ensure preservation until they are no longer required. Records must be reliably maintained over time within a recordkeeping framework. Records must be reliably maintained over time within a recordkeeping framework. A disaster management plan and procedures must be in place, kept current, and known to staff. 26

27 New requirement Current requirement Physical records and digital records held on removable media must be stored in conditions that ensure their safe care and custody. These records must be: stored in buildings with fire protection systems and equipment compliant with the New Zealand Building Code stored above floor-level using shelving or equipment appropriate to the format of the records or the size of the storage media stored away from sunlight and artificial light stored away from magnetic interference, if they are digital records held on removable media arranged in an orderly manner, and retrieved, handled and reshelved in accordance with set procedures. Inactive physical records and inactive digital records held on removable media must be identified and stored in a dedicated storage area SS 16 SS 3 SS 20 SS 22 SS 23 SS 2 CM 17; SS 4, SS 5 There must be a comprehensive fire protection system and equipment for the building, in compliance with the New Zealand Building Code. Procedures must be in place for retrieving, handling and reshelving records, and for returning records to off-site storage. Records must be stored using shelving or equipment appropriate to the format and size of the items. Records must be stored away from light. Magnetic media must be stored away from magnetic fields. Records must be arranged in an orderly manner, and well managed so that order is maintained. Records must be reliably maintained over time within a recordkeeping framework. Inactive records of archival value must be identified so that they can be stored appropriately. Records that are not in active use must be stored in a dedicated storage area 27

28 New requirement Current requirement Dedicated storage areas for inactive physical records or for inactive digital records held on removable media must ensure the survival of those records in a usable form. These storage areas must: be located in buildings which comply with the provisions of the New Zealand Building Code in force at time of construction and with any associated codes and standards have adequate floor loading capacity have drainage systems adequate to prevent flooding or must be located in buildings with drainage systems adequate to prevent flooding be insulated from the outside climate be protected from internal hazards be maintained over time in accordance with a documented maintenance programme be intruder resistant and have an alarm system or be located within buildings that are intruder resistant and have an alarm system, and be kept clean and free of pests such as rodents and insects. Records management responsibilities must be assigned Staff must be trained to create and maintain records CM 17 SS 8 SS 9 SS 10 SS 11 SS 12 SS 19 SS 24 CM 1, CM 4 CM 4, CM 9 Records must be reliably maintained over time within a recordkeeping framework. The building in which records are stored must comply with the New Zealand Building Code that applied at the time of construction and associated codes and standards, and be appropriate for use in storing records. The building in which records are stored must have adequate drainage systems to prevent flooding. The storage area must be insulated from the climate outside Storage areas must be protected against internal hazards. A building maintenance programme must be in place. Storage areas must be intruder resistant and have an intruder alarm system. Storage areas must be kept clean. Responsibility for recordkeeping compliance must be assigned and endorsed by the administrative head. Recordkeeping responsibilities and resources must be defined, supported and assigned. Recordkeeping responsibilities and resources must be defined, supported and assigned. Staff must receive appropriate, and regular, training for organisational recordkeeping responsibilities. 28

29 New requirement Current requirement Trained staff must be assigned to carry out records management functions and activities Policy for records management must be set and documented Records management objectives must be defined and documented Records management policies and processes must be implemented, monitored and regularly reviewed CM 9; SS 15; DS 9; ERMS 2 CM 2 CM 5 CM 2, CM 3, CM 5; DS 4; ERMS 1, ERMS 3 Staff must receive appropriate, and regular, training for organisational recordkeeping responsibilities. Staff who are responsible for records must be trained in emergency procedures to protect and salvage the records. Disposal activities must be carried out by personnel who have appropriate skills and knowledge. Responsibility for: o creating, maintaining and altering an organisation s recordkeeping metadata schemas and encoding schemes o attribution and verification of point of capture recordkeeping metadata must be assigned, documented, communicated and regularly reviewed. Organisations must have a defined, documented and implemented policy for recordkeeping, which is regularly reviewed. A programme of internal recordkeeping, monitoring and compliance must be developed and implemented. Organisations must have a defined, documented and implemented policy for recordkeeping, which is regularly reviewed. A programme of internal recordkeeping, monitoring and compliance must be developed and implemented. Recordkeeping responsibilities and resources must be defined, supported and assigned. Organisations must have policies and procedures for the disposal of records. Records and information management policies and procedures must specify the role of recordkeeping metadata in ensuring authenticity, reliability, and integrity. Rules relating to changing recordkeeping metadata must be defined. 29

30 New requirement Current requirement 7.7 Records management activities must be documented 7.8 Records management must be resourced CM 4 CM 3; ERMS 1, ERMS 3, ERMS 7; DS 4, DS 7 A programme of internal recordkeeping, monitoring and compliance must be developed and implemented. Records and information management policies and procedures must specify the role of recordkeeping metadata in ensuring authenticity, reliability, and integrity. Rules relating to changing recordkeeping metadata must be defined. Organisations must have policies and procedures for the disposal of records. Disposal of records must be documented. Recordkeeping responsibilities and resources must be defined, supported and assigned. 30