Scott Sackett

1
Washington State Archives
ESSENTIAL RECORDS PROTECTIONSECURITY BACKUP,
DISASTER PREPAREDNESS, RESPONSE AND RECOVERY

• Presented by
• Scott Sackett
• Electronic Records Management Consultant, Eastern
  Washington
• Washington State Archives,
• Central Region Branch

2
The Role of the Washington State Archives

• As provided by RCW 40.10
• Coordinate the Essential Records Protection
  Program
• Provide training materials, workshops and on-site
  technical assistance

3
Course Outline

• Introduction
• I. Essential Records Protection
• II. Planning
• III. Response and Recovery
• Course Summary

4
Manual available Essential Records Security
Backup, Preparedness and Response

• Covers all the basics of essential records
  protection and disaster preparedness.
• Includes procedures and templates

5
Definition

• Essential Records Records that an agency
• absolutely must have in order to
• Document legal authorities, rights, and
  responsibilities
• Resume or maintain operations in a disaster /
  emergency
• Document the rights of individuals

6
Essential Records Include

• Ordinances, resolutions, policy, procedures,
  oaths of office
• Disaster plans, as-built plans, recovery
  procedures
• Recorded documents, excise tax affidavits,
  binding site plans

7
(No Transcript)
8
Types of Disasters

• Earthquake
• Flood
• Fire
• Storm
• Terrorism / Vandalism
• Human Error
• Computer Viruses
• Power, Plumbing/Equipment Failure

9
Results of Disasters

• Water Damage
• Fire Damage
• Contamination
• Loss of Access to Records
• Loss of Electronic Data

10
Example
Thousands of Starbucks Corporation records were
flooded in the 2001 earthquake
11
Example Starbucks Corporation

• Lessons Learned
• Records Retention Schedules and the Essential
  Records Protection program were critical to
  recovery
• The walk-through was the first key element of
  recovery
• Documenting the damage to records and equipment
  is key
• Tracking records through pack-out, recovery and
  restoration is key
• Planning and teamwork were essential
• Recovery took time and money
• Electronic records were back in operation in 3
  days

12
Example
Eco Terrorism at the UW

• The Center for Urban Horticulture arson fire on
  May 21, 2001 at 300 AM.  The Earth Liberation
  Front took credit. 

13

• Lessons Learned
• Staff could not enter the building immediately
• Records werent stabilized in time to prevent
  mildew
• Paper documents were partially restored by
  freezing
• The restoration process took more than 4 months
• Electronic records were restored faster than paper

14
Team Approach

• Essential Records Coordinator
• Essential Records Protection and Recovery Team

15
Essential Records Coordinator

• Responsible for
• Essential Records Protection Plan
• Records Disaster Prevention, Response and
  Recovery Plan
• Records Disaster Response Team
• Coordination with Agency Emergency Management
  Plan
• Response and Recovery of Records from Specific
  Disasters
• Training Disaster Response Team and Other Key
  Personnel
• Test and updating plans

16
Essential RecordsProtection and Recovery Team

• Assists in Developing Essential Records
  Protection and Disaster Prevention, Response and
  Recovery Plans
• Participates in Response and Recovery from
  Records Disasters
• Individual Team Members Supervise Records
  Disaster Response and Recovery in their
  Departments or Work Units

17
Part I EssentialRecords Protection

• Essential Records Protection Plan
• Electronic Records Protection
• Risk Analysis

18
Essential Records
Protection Plan
Policies and procedures that enable an agency to
secure mission-critical records against loss.
Appendix B Page B-1
19
Five Basic Steps to Develop anEssential Records
Protection Plan

• 1. Identify Essential Records series
• 2. Select protection methods
• 3. Develop the Essential Records Schedule
• 4. Implement the protection measures
• 5. Test Annually

20
Step 1. Identify Essential Records

• Inventory Records Series held by your agency
• Identify records series that perform essential
• functions
• The Local Government General Records
• Retention Schedules identify Essential Records

21
Step 2. Select Protection Methods

• Protect the Facility
• Protect Essential Records On-Site
• Duplicate Essential Records Off-Site

22
Protect the Facility

• Fire Resistant File Cabinets and Safes
• Sprinkler Systems
• Smoke and Intrusion Alarms
• Fire Resistant Vaults
• Key Control

23
Protect Essential Records On-site

• Minimize the time they are maintained in office
  space
• Locate them on the office floor plan
• Keep them separate from other records
• Keep them close together
• Locate them near an exit
• Keep them off desks
• Keep them off the floor
• Keep them in metal file cabinets
• Keep them out of bottom file drawers
• Use fire- and water-resistant file drawer labels

24
Duplicate Essential Records Offsite

• Existing Duplicates
• Paper Copies
• Microfilm Duplicates
• Digital Duplicates

25
Step 3. Develop An Essential Records Protection
Schedule

• Each Essential Records Series
• Office of Record
• Media
• Update Cycle/Total Retention
• Protection Instructions
• See Appendix B, Page B-1 for template

26
Step 4. Implement the Plan

• Implement in each agency office
• Implement update cycle for each series
• The more frequent the update cycle, the better
  the protection

27
Step 5. Test the System

• Test the effectiveness annually. Check to see
  that
• Facilities are secure
• Essential records are stored properly
• Security copies exist
• Security copies are stored offsite
• Security copies are updated according to schedule
• Copies held by other offices still exist

28
Know the Agencys IT System Is there a central
IT department in the agency? Does IT have a
disaster plan and/or backup procedures? Are
Essential Records included? Are smaller
workgroup-level servers or PCs included?
29

• Protect Data on Small Systems
• Back up data to the LAN, if possible, Daily or
  Weekly
• Otherwise, back up routinely onto removable media
• Store backup data off-site
• Store copies of applications and programs
  off-site
• Store copies of procedures and instructions
  off-site

30

• Risk Analysis

• Functional Analysis
• Physical Threat Assessment
• See Appendix B

31
Functional Analysis

• Balances Risk and Value
• Probability Number Scale 1- 5
• Consequence Number Scale 1-5
• Risk Number Probability x Consequence
• Scale 0 Low Risk 25 Highest Risk

32
Physical Threat Assessment Identify physical
threats to office and records storage areas.

• Examples
• Building Security
• Earthquake Bracing
• Fire Alarms
• Water Lines and Drains
• Fire Suppression System

33
Part II Planning
Records Disaster Prevention and Recovery Plan
A plan that includes actions and procedures to
reduce the risk of, respond to, and recover from
records disasters.
34
Benefits

• Speed
• Correct Decisions
• Response Team
• Coordination
• Policy, Authority, Delegations
• Resources
• Communications

35
Key Elements
Washington State Archives

• Complete Template in Appendix A
• Policy (Management Approval and Support)
• Authority and Responsibility
• Training and Supplies
• Support
• Communications
• Essential Records Schedule Appendix B-2
• Preparedness and Prevention Procedures Appendix
  B
• Response and Recovery Procedures Appendices C,
  D, E

36
Testing
Page 24

• Desktop Test
• Large Scale Test

37

• Desktop Test
• A small exercise for single Disaster Recovery
  Team
• Write a scenario
• Call relevant Disaster Team Members and Staff
• Assemble the Disaster Recovery Team
• Assess damage
• Plan appropriate response
• Evaluate results

38

• Large Scale Test
• Fully developed test
• Wider participation
• Simulated records damage
• Write Scenario
• Assemble teams
• Test operations center
• Detailed assessment of damages
• Test IT restoration procedures
• Plan appropriate response
• Move records to simulated repair and storage area
• Test documentation procedure
• Test availability of supplies
• Return and shelve restored records
• Evaluate results

39
How does the Records Disaster Prevention and
Recovery Plan fit in?

• Must be compatible with overall Agency Disaster
  Plan
• Must be compatible with IT Disaster Plan
• Must cover IT recovery in the absence of an IT
  Disaster Plan
• Should be referenced in Agency Disaster IT
  Disaster Plans
• Should not duplicate other Agency disaster
  directives

40
Part III Disaster Response and Recovery

• Six Keys to Success
• Responding to Disasters
• Recovering from Disasters

41
Six Keys to Successful Response and Recovery

1. A detailed Disaster Recovery Plan
2. Committed management
3. Educated and trained staff
4. Timely initial response
5. Effective communication
6. Quick, informed decisions

42
Responding to Records Disasters

• Strategic Response
• Tactical Response
• Stabilize Environment and Records
• Select Drying and Repair Options
• Assemble Recovery Resources

43
Page 25
Strategic Response

• Gain access to the site
• Assemble the Recovery Team
• Establish Controls
• Make an Initial Damage Assessment
• Establish Communications

44
Page 26
Tactical Response

• Choose Methods for Stabilizing the Environment
  and Records
• Stabilize the Environment
• Re-Assess Recovery Priorities as Necessary
• Choose methods for drying and recovery
• Assemble Necessary Supplies

45
Stabilize Records

• Get or Make a Records Inventory, including
• Records Series
• The Office of Record
• Location
• Avoid Moving Storing Valueless Records

46
Select Drying Repair Options
Drying Options Air Drying Interleaf
Drying Desiccant Drying Freeze Drying Vacuum
Thermal Drying Vacuum Freeze Drying
Factors to Consider Volume Media State and Degree
of Damage Sensitivity of Media Location of Drying
Facilities Reference Accessibility Decision Logic
Charts (Figures 6a. and 6b.)
47
Assemble Recovery Resources

• Use Lists of Staff, Volunteers and Temporary Help
• Use Pre-Arranged Spending and Hiring Authorities
• Move Supplies and Equipment to the Damage Site
• Contact and Bring Recovery Contractors on Site as
  Necessary

48
Page 31
Washington State Archives
Recovering from Records Disasters

• Recovery Defined
• Recovery Rules of Engagement
• Basic Recovery Procedures
• Post Recovery

49

• Records Recovery
• Actions and treatments that restore records to a
  usable state
• Establish intellectual and physical control
• Pack out records
• Dry wet records or freeze them for later recovery
• Repair or replace charred records
• Duplicate and destroy documents contaminated or
  damaged beyond repair
• Use the Essential Records Schedule to determine
  if copies or backups available
• Replace records with security copies
• Retrieve and install electronic record backups
• Destroy unnecessary records
• Repair salvageable records using appropriate
  conservation techniques
• Store undamaged records
• Re-house salvaged records

50

• Recovery Rules of Engagement
• Do not enter a site or remove records without a
  plan
• Work safely
• Watch for contamination
• Know what you have

51

• Basic Recovery Procedures
• Pack out and recover essential records first
• Inspect the site and undamaged records for mold
  and other contamination
• Pack records according to how they will be
  recovered (Appendices C-4 C-6)
• Recovery of paper records by water, fire, mold
  (Appendices C5 C6)
• Recovery of contaminated records (Appendix C-7)
• Recovery of film and photographs (Appendix C-9)
• Recovery of electronic records (Appendix C-10)

52
Post-Recovery Returning Recovered Records to
Office and Storage Spaces Disasters traumatize
and physically change records Recovered records
may need more containers/more space Sterilize
records storage area before returning
records Inspect for residual contamination Make
follow-up inspections for at least 1
year Recovery Analysis and Reporting Determine
and remedy causes of the disaster Meet with the
Records Disaster Team to review response and
recovery Evaluate Records Disaster and Essential
Records Protection Plans Report findings to
policy makers
53
Thank you!

• Scott Sackett
• Electronic Records Management Consultant, Eastern
  Washington
• ssackett_at_secstate.wa.gov
• [phone] [phone]