Record Retention and Destruction Policy Template

Current Rules and Regulations Regarding the Protection and Destruction of Confidential and Sensitive Documents require that any person or company that possesses or maintains such information to take reasonable measures to protect against unauthorized access to, or use of the information in connection with its disposal.  In addition Sarbanes-Oxley requires that records be retained for all audits and legal proceedings.

Some of the records types and retention time periods for physical and/or electronic records are:

The Record Management, Retention, and Destruction is a detail policy template which can be utilized on day one to create a records management process.  Included with the policy are forms for establishing the record management retention and destruction schedule and a full job description with responsibilities for the Manager Records Administration.

You areas included with this policy template are:

• Record retention requirements for SOX sections 103a, 302, 404, 409, 801a and 802.
• Policy
• Standard
  • Scope
  • Responsibilities
  • Record Management
  • Compliance and Enforcement
  • Email Retention and Compliance
• Job Description Manager Record Administrator
• 12 forms for Record Retention and Disposition Schedule

A record is essentially any material that contains information about your company’s plans, results, policies or performance. In other words, anything about your company that can be represented with words or numbers can be considered a business record – and you are now expected to retain and manage every one of those records, for several years or even permanently depending on the nature of the information. The need to manage potentially millions of records each year creates many new challenges for your business, and especially for your IT managers who must come up with rock-solid solutions to securely store and manage all this data.

“The Financial Modernization Act of 1999”, also known as Gramm-Leach-Bliley (GLB Act) applies to every business with 100 or more annual transactions, and gives authority to eight (8) federal agencies and each state, to administer and enforce the Financial Privacy Rule, Disposal Rule and the Safeguards Rule contained in the FACT Act.  The Federal Trade Commission is actively enforcing this Act in the following business segments:

• Financial institutions - lenders and traditional financial institutions, insurance companies, banks, securities firms are the primary targets of enforcement. Also receiving scrutiny are: auto dealers (leasing and financing departments, service and rental divisions), of particular interest to the enforcers are auto rental agreements, drivers license copies – used for test drives; mortgage brokers, real estate settlement companies, and those retailers who issue credit cards, gift cards or related items.
• Service institutions -payday lenders, check-cashing services, professional tax preparers, accountants, and electronic funds transfer networks, as well as credit counselors, independent psychologists, and related service firms are also targets.

There are hundreds of document types that may factor into an investigation or legal action.  Such records are assumed to be searchable and quickly available upon request, under the rules of SOX. This even applies to less official types of records, like Emails or instant messages.

DisasterRecovery and Business Continuity Planning Considerations for Email

Disaster recovery and business continuity planning considerations are crucial when deploying any email system. Not only is it important to have a plan in the event of a local outage, but careful consideration should also be given to the chance of an entire site failure. In the event of a disaster, the first system that needs to be brought online is communications. E-mail is the ideal method of communication, but users need access and the environment has to be able to withstand a major service interruption.

Issues include, failing over to the backup site is a manual process and most systems do not include a mechanism to fail back to the primary site. Getting the primary site back online is a labor- and network-intensive process. Another is that most email systems do not utilize compression, which results in additional network bandwidth consumption.

Now that you have a disaster recovery plan in place, you still have work to do.

• Test your disaster recovery plan at least quarterly. Simply having a plan in place is not enough. Develop and regularly (quarterly) test your plan so that the first time it is executed is not during an emergency. Remember to test under realistic conditions and make the plan robust enough to address extended recovery that may require utilization of new facilities, relocation of staff and involvement of outside personnel.
• Review and reassign responsibilities at least monthly. Factor in changes to your organization caused by recent layoffs and restructurings. Assign new responsibilities to employees based on the current organizational structure and available resources. Test this updated plan to ensure all tools and protocols are in place to operate during a disaster, reaching out to all parts of the organization and employee family members as well as vendors, government agencies and emergency responders.
• Update your notification system at least monthly. Critical during any potential interruption, notification should be an integral part of an organizationÂ’s disaster recovery plan. Make sure all contact numbers are up-to-date, allowing the organization to get in touch with key personnel in the event of an emergency. This will also help prioritize methods of communication and track which employees have received messages.
• Know where staff will work if you lose your facility. Employees are the heart of an organization; however, many human resources aspects are frequently overlooked in disaster recovery planning. Businesses must identify alternate locations where employees can go in the event a primary work location is unavailable and address the physical safety and psychological well-being of employees. Assign backup roles for the inevitable times when key players are not available or missing, and time-sensitive actions need to be taken. Employ cross training to have alternative contacts ready to go.
• If a Disaster is DECLARED EXECUTE your plan. If an organization has access to hot or cold back-up sites, a common mistake is to wait too long before declaring an emergency and relocating personnel. If an organization is located in an area for which a government evacuation order has been issued, it should declare and relocate immediately.
• Document your technology infrastructure. Develop procedures for technical recovery scripts that will be deployed to help get your IT infrastructure up and running. Make the scripts comprehensive and easy to understand so people who are not familiar with them can easily follow along.
• Update your vendor list at least monthly. Strictly enforce change management and control processes to help ensure vendor contacts are current so vital services will be quickly available when needed.
• Review the use of contractors and outsourced facilities. In the event of a disaster, will your vendors be able to perform their roles in supporting your critical technical infrastructure and business processes? Consider looking at secondary providers as a precaution. Take time to evaluate whether support or maintenance contracts need to be extended or have levels of support modified.
• Review and test readiness and completeness of offsite data storage. Paper records and backup tapes may be totally lost, destroyed or unavailable. Develop contingencies in the event delivery of offsite-stored data is delayed. Investigate using electronic media - through disk-to-disk backup - to help safeguard and provide backup information.
• Have a current plan in place to re-build your critical servers. Should a disaster occur, re-building servers from the ground up consumes time and stretches internal IT resources. Consider working with a third-party provider that can simplify these processes by rebuilding your operating systems on its own servers - enabling a speedy and more cost-effective recovery.

Disaster planning is an essential component of preserving your enterpriseÂ’s assets. With a written disaster plan, your enterprise can reduce the risk of disaster and minimize losses. The Janco Disaster Recovery Plan Template is perfect for small and medium-sized institutions that do not have in-house preservation staff.  The Janco Disaster Recovery Plan Template is also valuable for large enterprises that need to develop separate but related plans for multiple buildings, locations, or branches.

The Janco Disaster Recovery Plan Template can help you create a plan for disaster prevention and response. Enter data into the online template to create a customized disaster plan for your enterprise. This plan will help you:

• Prevent or mitigate disasters,
• Prepare for the most likely emergencies,
• Respond quickly to minimize damage if disaster strikes, and
• Recover effectively from disaster while continuing to provide enterprise services to your customers and clients

According to Janco Associates, the primary factor in the activiation of Disaster Recovery and Business Continuity Plans is computer hardware failure.

When the World Health Organization (WHO) raises the pandemic threat alert to Level 6 what affect does that have on business continuity?  Enterprises will have to do more than tell sick employees to stay home and healthy ones to wash their hands.

When a pandemic strikes your enterprise the business continuity and disaster recovery plans need to allow IT workers to manage computer systems from home.  There is no other alternative but to have them in the office.

A Level 6 alert means that company officials will be asked by the U.S. Centers for Disease Control and Prevention to undertake a number of efforts to fight any pandemic -- including the appointment of a workplace Pandemic Coordinator or team.

The Pandemic Coordinator is responsible for monitoring employees to ensure they follow basic rules of hygiene, such as washing hands, and to make sure that breathing masks are available. If a worker becomes sick, the Pandemic Coordinator must ensure they go home.

The real issue is not sick employees, but an inability to get supplies and deliveries.

If your enterprise is in a locality that gets to pandemic levels of infection your enterprise is going to see issues like suppliers not being able to get deliveries to you because they are sick.  This will be a regional issue, even if your organization is not directly affected by the flu.

In an effort to drive profitability and rein in costs, businesses are continually seeking to improve operational capabilities. Primary to this objective are today's burgeoning network infrastructures, which are continually being asked to do more. Applications are becoming more sophisticated and mission-critical. More software is written to take advantage of dynamic IP parameters. In addition, an economic slowdown has companies relying on network-based technologies that reduce Total Cost of Ownership (TCO) and save money. Consolidation is another trend bolstering IT efficiencies. Servers and storage are often the first affected by a consolidation initiative. However, data center consolidation is just as important in terms of optimizing infrastructure security, compliance and integrity. The flourishing area of unified communications (UC) offers further testimony to the increased significance of the network. UC provides substantial benefit to the enterprise in terms of capabilities that allow staff to collaborate in real time, access critical information and communicate seamlessly with coworkers and customers -- regardless of location.

Whether you are a for profit business, a bank, a government agency, hospital the risk of compromising private information is very high.  Business relies heavily on technology today and business risk often is technology dependent. The possibility of litigation is part of business. There has always been a risk in doing business, but because technology and today's business are so intertwined, business risk has a higher threat level. This has prompted many to encrypt workstations and mobile computers in order to protect critical business data.

If you have rolled out encryption, how do you maintain your IT service quality when the hard disk drive fails? How do you plan and prepare for a data loss when the userÂ’s computer is encrypted?  These are all issues that should be considered when putting together a data disaster plan. In addition, data recovery, one of the more common missing elements of a disaster recovery plan, should also be factored in because it can serve as the “Hail Mary” attempt when all other options have been exhausted.

Just because your disaster recovery business continuity plan includes  a plan for backing up your data to a outsource provider does not mean that your enterprise is safe.

Carbonite, EMC's Mozy, and Amazon's Simple Storage Service (S3) are providers in the growing online backup market. The services let consumers and enterprises back up their data over the Internet for later retrieval if a hard drive or another component should fail. Carbonite targets its service toward home and small-business users.

Carbonite is suing storage vendor Promise Technology, saying repeated failures of Promise gear have caused "significant data loss" at Carbonite.

In the lawsuit, Carbonite said it bought more than $3 million (US Dollars) worth of Promise VTrak Raid products beginning in 2006. In several incidents starting in January 2007, the service provider suffered data loss because the Promise gear failed to support recovery from physical drive errors and array errors. The data losses caused "substantial damage" to Carbonite's business, the company alleged.

Mail and calendaring are playing an increasingly critical role in day-to-day business communication and work flow. Mailing, scheduling, task assignment, shared resource
allocation and file storage are often done with a mail server hosted at an enterprises data center. An outage of that server can disrupt business workflow by making it difficult for employees to communicate with each other as well as with customers and suppliers. An organization's IT department is also severely impacted when "fire drills" are necessary to bring services back online quickly. An outage of the email server can severely disrupt normal business operations and result in significant costs to an organization. A Company's reputation can also be damaged and revenue affected by loss of prospects and disruption of the billing system. The companyÂ’s stock price may even be affected. It is crucial that email administrators be aware of the possible interruptions caused by local or regional disasters as well as scheduled downtime and have a plan to mitigate the impact.

The types of issues that the administrators need to plan for are

• Component failure
• Software defects
• Operator error
• Malicious users
• System outages
• System maintenance
• Local disaster
• Regional disaster

Tape backup has been the traditional solution for backing up data on computer systems since the  late 1960Â’s. While tape backup remains a viable long-term archiving method for most large and small organizations, many issues limit its usefulness.

First, with the huge growth in data volumes, mandated requirements for longer retention and faster access, and greater reliance on data and technology backup windows are shrinking.  Second, because backing up is not easy or quick, many organizations do not backup often enough to protect themselves.  Third, tape is not the most reliable medium – hardware failures, media failures, and human errors are common. Tape management is a constant IT headache and administrative costs are high.

Organizations now are looking for new solution that provide a continuum of protection schemes that include storage array-based data protection, remote replication for recovery after a failure or disaster, and business continuity during outages and common IT maintenance procedures.

Every IT manager knows the importance of having an effective and fast disaster recovery (DR) plan. Organizations without an adequate plan may find themselves out of business quickly after experiencing a major disaster. Organizations that ensure survival following a disaster understand the basics of creating a good plan. 

A disaster recovery is a response to a declared disaster or a regional disaster. It is the restoration or recovery of an entire Agent computer. A disaster recovery plan describes how an organization is to deal with potential disasters. Just as a disaster is an event that makes the continuation of normal functions impossible, a disaster recovery plan consists of the precautions taken so that the effects of a disaster will be minimized, and the organization will be able to either maintain or quickly resume mission-critical functions. Typically, disaster recovery planning involves an analysis of business processes and continuity needs; it may also include a significant focus on disaster prevention.

The Disaster Recovery Planning Template (DRP) can be used for any sized enterprise.  The template and supporting material have been updated to be Sarbanes-Oxley compliant.  The complete package includes:

• Disaster Recovery Plan Template
• Business and IT Impact Analysis Questionnaire
• Work Plan

The keywords for disaster recovery and business continuity (DR/BC)are copies and distance. For DR/BC, you must have more than one data copy, and copies must be stored some distance away from the primary data center on different physical machines - remote replication is the standard for DR/BC.

Deciding how and where to replicate depends on your needs and your available locations. Some organizations will replicate from the primary data center to one remote location; others replicate the same data to multiple locations. Organizations with branch offices often replicate from each branch to a central DR site, and then backup data from there.

Configuring DR/BC implementation depends on two important factors that each organization must identify - recovery time objectives (RTO) and recovery point objectives (RPO). RTO defines how quickly data can be restored. Some operations and data types can tolerate very little time to recover, while others can survive longer delays. RPO defines how much data loss can be tolerate,d and that determines how often data is replicated. Many organizations define different RTOs and RPOs across the enterprise - uniformity is not important as long as you can easily and affordably match data types to protection levels.

© 1999 - 2009 Janco Associates, Inc. - ALL RIGHTS RESERVED  --  Revised: 06/16/09.