Reference Publications

Managing Web Records Is Critical, NARA Says

Information Management Journal, Mar/Apr 2005

The National Archives and Records Administration (NARA) is advising webmasters and records managers to reuse their IT system risk assessments to establish records management controls. NARA also recommends performing a risk mitigation to ensure the authenticity, integrity, and usefulness of agency information on their Web sites.

The importance of risk assessments and mitigation were a major part of new guidance NARA released in January. The document, almost seven years in the making, is a high-level guide to improve and standardize the management of agency Web sites and online records, said Howard Lowell, director of NARA's modern records program.

"Managing Web records properly is essential to effective Web site operations, especially the mitigation of the risks an agency faces by using the Web to carry out agency business," NARA noted in the guidance.

The NARA guidance is divided into three sections - general background, responsibilities, and requirements; managing Web records; and scheduling Web records - and each part tries to answer common questions from web-masters and records officers.

Agencies should conduct a risk assessment of their Web sites by evaluating certain factors such as records management threats, visibility, consequences of compromised records, and sensitivity of the records.

Once an agency has determined its Web site vulnerabilities, NARA recommends mitigating those risks by

* documenting the systems used to create and maintain Web records

* ensuring that Web records are created and maintained in a secure environment

* implementing standard operating procedures for the creation, use, and management of Web records and maintaining adequate written documentation of those procedures

* creating and maintaining Web records according to these documented standard operating procedures

* training agency staff in the standard operating procedures

* developing a retention schedule for Web records and obtaining official NARA approval of that retention schedule.

NARA also suggests taking frequent snapshots of the Web site as historical documentation and tracking changes to the site between snapshots. Additionally, the agency addresses ways to preserve links to other sites and schedule Web record transfer to NARA.

To view the NARA report, visit www.archives.gov/records_management/policy_and_guidance/managing_web_records_index.html.>