{"id":2679,"date":"2020-02-04T12:16:16","date_gmt":"2020-02-04T18:16:16","guid":{"rendered":"https:\/\/www.wisconsin.edu\/compliance\/?page_id=2679"},"modified":"2020-02-04T12:16:16","modified_gmt":"2020-02-04T18:16:16","slug":"records-management-guidelines-for-information-technology-systems","status":"publish","type":"page","link":"https:\/\/www.wisconsin.edu\/compliance\/records-management\/records-management-resources\/records-management-guidelines-for-information-technology-systems\/","title":{"rendered":"Records Management Guidelines for Information Technology Systems"},"content":{"rendered":"\n\t\t\t\t\t<div id=\"cfct-build-2679\" class=\"cfct-build grid\">\n\t\t\t\t\t\t<div class=\"row\"><div class=\"col-md-12 cfct-block\">\n\t\t\t<div class=\"cfct-module uwsa-rich-text\">\n\t\t\t\t<div class=\"cfct-mod-content copy\"><div id=\"cfct-module-bc34d8fb5918627393ab80b4db9c4054\" class=\"cfct-module-border\">\n<div class=\"cfct-module cfct-heading\">\n<h1 class=\"cfct-mod-title\"><span style=\"font-size: 16.8px;font-weight: bold;letter-spacing: 0.06em;text-transform: uppercase\">RECORDS MANAGEMENT WITHIN INFORMATION SYSTEMS<\/span><\/h1>\n<\/div>\n<\/div>\n<div id=\"cfct-module-eb4b0ac22811661bf9b48c964a956ab5\" class=\"cfct-module-border\">\n<div class=\"cfct-module uwsa-rich-text\">\n<div class=\"cfct-mod-content copy\">\n<p>Information systems are organized sets of procedures and techniques designed to store, retrieve, manipulate, analyze, and display information. Recordkeeping systems are organized to support the functions of creating, storing, managing, and accessing records.<\/p>\n<p>Information systems and recordkeeping systems are not necessarily the same thing.\u00a0Properly configured and with appropriate functionality, it is possible for information systems to meet recordkeeping needs for an entity.\u00a0As an increasing percentage of University records are produced by electronic information systems and are likely to remain a part of such systems, it is important for those with responsibility for records to understand how information systems operate and their relationship to recordkeeping.<\/p>\n<p>If the information system can not meet recordkeeping needs, then an alternative strategy needs to be developed to secure the records.\u00a0Wisconsin\u2019s Administrative Rule 12 sets forth requirements for information systems that will serve as recordkeeping systems.<\/p>\n<\/div>\n<p>&nbsp;<\/p>\n<div class=\"cfct-mod-content copy\">\n<p><a href=\"https:\/\/docs.legis.wisconsin.gov\/code\/admin_code\/adm\/12\">Wisconsin Department of Administration, Chapter Adm 12 (\u201cElectronic Records Management \u2013 Standards and Requirements\u201d)<\/a>\u00a0states that state and local agencies shall \u201cmaintain electronic public records that are accessible, accurate, authentic, reliable, legible, and readable throughout the record life cycle\u201d; and develop policies, assign responsibilities, and develop mechanisms for maintaining public records throughout the record life cycle.\u00a0The record life cycle in this context means the total length of time the records will be retained, as defined by the approved records retention schedule.<\/p>\n<p>In administering information technology systems the University of Wisconsin System is committed to<\/p>\n<ul>\n<li>Complying with current federal, state and agency policies regarding records retention;<\/li>\n<li>Achieving efficiencies in records management through the use of information technology systems records retention schedules;<\/li>\n<li>Improving services to records users;<\/li>\n<li>Safeguarding all personally identifiable information about individuals; and<\/li>\n<li>Implementing electronic records management in the most cost effective manner<\/li>\n<\/ul>\n<p>Managing electronic records requires the integration of records management concepts with the information technology system that creates, manages, stores, etc. the information\/records. The purpose of this section of the guidelines is to provide assistance in the implementation of this policy for information technology systems.\u00a0These systems range in size, cost and scope from a single e-mail package or messaging utility to a large ERP application and include software and sometimes hardware components.\u00a0Information technology systems create and maintain records and as such need to be designed, implemented, and maintained with records management requirements in mind.<\/p>\n<p>For information technology systems, there are two general categories of records: those records that are associated with the actual creation, maintenance and retirement of the information technology system itself and those records that comprise the data content of the system. Each of these sets of records must be managed in concert with the other. The records management requirements for the data content of the system are the same as if the records were kept in a non-electronic medium with the additional requirement that technologies must be maintained that enable the records to be accessible, accurate, authentic, reliable, legible, and readable throughout the life of the data record. Records required for the creation and maintenance of the information technology system itself include implementation project documents such as procurement proposals and system support documentation. The records management requirements and retention schedules will likely vary between these two categories of records.<\/p>\n<p>Information technology system implementation, maintenance, and retirement include a myriad of processes often called the software development lifecycle. Using a modified Enterprise Unified Process (EUP) software development lifecycle model, phases of an information technology system\u2019s life include:<\/p>\n<ul>\n<li>Business Modeling and Requirements and Planning<\/li>\n<li>Analysis and Design<\/li>\n<li>Implementation<\/li>\n<li>Testing\/Business Simulation<\/li>\n<li>Deployment<\/li>\n<li>Review<\/li>\n<li>Production<\/li>\n<li>Retirement<\/li>\n<\/ul>\n<p>Each of these phases includes the need to identify records and take steps to ensure that records are adequately managed.\u00a0What follows is a list of potential questions to ask at each stage of the information system\u2019s life.\u00a0(This is not an attempt at a comprehensive list of all such questions, which will differ for each local situation).<\/p>\n<h4>PHASE ONE \u2013 BUSINESS MODELING AND REQUIREMENTS AND PLANNING<\/h4>\n<h5>RECORDS MANAGEMENT ACTIVITY: INCORPORATING RECORDS MANAGEMENT FUNCTIONALITY<\/h5>\n<p>The first phase encompasses but is not limited to the determining the scope of the business process,\u00a0identifying records associated with the business process, modeling the process, determining system requirements, making the decision whether to buy or build, acquiring\u00a0the technology, achieving executive buy-in, documenting business process,\u00a0gathering technical requirements, and organizing the project.\u00a0Some factors to consider during this phase include:<\/p>\n<ul>\n<li>Does the proposed system maintain its data in an open or flexible format to\u00a0facilitate retention, storage, and retrieval of the records\/data it creates?<\/li>\n<li>Has a records retention schedule been prepared?<\/li>\n<li>If a purchase is considered, does the Request For Proposal (RFP) speak to this requirement?<\/li>\n<li>Are project sponsors convinced of the need to invest time and resources to building out this area of functionality?<\/li>\n<li>Is anyone on the project tasked with not only safeguarding the records produced by the project, but also ensuring that the new technology satisfies the requirements vis-a-vis the future management of its data?<\/li>\n<\/ul>\n<h4>PHASE TWO \u2013 ANALYSIS AND DESIGN<\/h4>\n<h5>RECORDS MANAGEMENT ACTIVITY: IDENTIFICATION OF RECORDS AND RECORDKEEPING REQUIREMENTS<\/h5>\n<p>Analysis and Design steps include\u00a0training the core project team, fit-gap analysis, developing process (and identifying process changes), and developing a data migration plan.\u00a0Some factors to consider during this phase include:<\/p>\n<ul>\n<li>Have records creation\/retention needs been identified as a \u2018fit\u2019 or \u2018gap\u2019?<\/li>\n<li>Have the records created during this phase of the project themselves been preserved?\u00a0Typically the documentation at the analysis and design stage is critical for understanding the way the system is created as it is, and the underlying assumptions are useful for the implementation of future projects.<\/li>\n<li>As information workflow is modeled in the new system, has the potential needs for records retention been modeled as a component of the life cycle of data in the new system?<\/li>\n<li>Are procedures in place to prove the authenticity of the records?<\/li>\n<li>Are there a security plan in place to restrict access to private information and an accessibility plan to make public information readily accessible?<\/li>\n<li>Can the records be exported to another system?\u00a0Can the records be purged automatically from the system in compliance with the retention schedule? Removed from the system?<\/li>\n<li>Has a records management program for data and business processes been designed?<\/li>\n<li>Does the system meet University, State and Federal requirements that may apply to the particular operational area?<\/li>\n<li>Has a cost analysis been done that takes into consideration staff resources needed to implement and provide ongoing support, as well as potential savings, costs containment and\/or improved service benefits?<\/li>\n<\/ul>\n<h4>PHASE\u00a0THREE \u2013\u00a0IMPLEMENTATION<\/h4>\n<h5>RECORDS ACTIVITY: RECORDS CREATION AND METADATA<\/h5>\n<p>Once\u00a0the Analysis and Design phase is completed, the implementation phase begins with creating detailed design documents,\u00a0data conversion, creating detailed project implementation plans,\u00a0documenting issues or risks, developing software and creating test plans and scripts for all business processes.\u00a0Some records management questions to consider during this phase include:<\/p>\n<ul>\n<li>Have data elements comprising the records been identified?<\/li>\n<li>Has appropriate metadata been developed and approved?\u00a0Metadata should include the appropriate retention time.<\/li>\n<li>What are the storage and retrieval options?\u00a0Warehouse?\u00a0Repository?<\/li>\n<li>What are the long term preservation strategies for all records?\u00a0These include:<\/li>\n<\/ul>\n<p>a. Project documents as well as business documents<br \/>\nb. Decisions and why they were made<br \/>\nc. Conversion decisions and data mapping<br \/>\nd. Design architecture<\/p>\n<h4>PHASE\u00a0FOUR \u2013 TESTING<\/h4>\n<h5>RECORDS ACTIVITY: RECORDS MANAGEMENT TESTING<\/h5>\n<p>The\u00a0Testing phase involves loading preliminary data to test newly defined business processes in preparation for cut-over to production.\u00a0This phase involves testing new business practices, obtaining user acceptance, certifying that data mapping and conversion scripts are complete, testing the go-live conversion, and training end-users.\u00a0Some questions to consider during this phase include:<\/p>\n<ul>\n<li>Does the project have documented training plans, user acceptance testing for functionality, and testing of strategic use cases?<\/li>\n<li>Will there be conversion audits and mock conversions prior to production cutover?<\/li>\n<li>Is there version control, for rollback to a previous testing environment?<\/li>\n<\/ul>\n<h4>PHASE\u00a0FIVE \u2013 DEPLOYMENT<\/h4>\n<h5>RECORDS ACTIVITY: RECORDS CAPTURE AND VITAL RECORDS PLANNING<\/h5>\n<p>The Deployment phase places the system into a live, production environment; training is complete (or ongoing), and risk factors are assessed in the new environment.\u00a0Contingency\/backup plans are evaluated for the need to execute other options.\u00a0Any remaining issues are resolved. Some questions to consider during this phase include:<\/p>\n<ul>\n<li>Who is responsible for safeguarding the 2 categories of records: those associated with the system itself and those associated with the system data content?<br \/>\nAre business continuity (disaster recovery) systems documented and in place?<br \/>\nHave records management procedures been extended to other environments (if needed \u2013 e.g. testing, development)?<br \/>\nIs end-user documentation ready, and is there a procedure for changes to this over time?<\/li>\n<\/ul>\n<h4>PHASE\u00a0SIX \u2013 REVIEW<\/h4>\n<h5>RECORDS ACTIVITY: RECORDS MANAGEMENT AUDIT<\/h5>\n<p>The Review phase is to evaluate\u00a0the new business processes and the overall solution. The new system\u00a0should be assessed for any performance tuning.\u00a0Documentation produced during this phase includes\u00a0recommendations to project sponsors and management, \u201clessons learned\u201d,\u00a0and planning considerations for future phases of this project or similar future projects.\u00a0Some factors to consider during this phase include:<\/p>\n<ul>\n<li>What system configuration and change management records are required? Who is responsible for maintaining these records?<\/li>\n<li>Will there be arrangements for a periodic records management audit?<\/li>\n<li>Are the records useable and understandable? Has sufficient contextual information been captured? Have all the component parts of a record been appropriately migrated?<\/li>\n<\/ul>\n<h4>PHASE SEVEN \u2013 PRODUCTION<\/h4>\n<h5>RECORDS ACTIVITY: RECORDS MAINTENANCE AND USE<\/h5>\n<p>The Production phase is the useful life of the information system.\u00a0Typically, periodic upgrades to the system are needed; major ones go through many of the same steps outlined above and present similar records management challenges.\u00a0Special records management questions to consider at the Production stage include:<\/p>\n<ul>\n<li>What factors will determine the need for changes to the system?<\/li>\n<li>Does the updated software for system upgrades and patches also adhere to the records management requirements of the initial system development phases?<\/li>\n<li>How will changes over time to authorization\/authentication be documented?<\/li>\n<\/ul>\n<h4>PHASE EIGHT \u2013 RETIREMENT<\/h4>\n<h5>RECORDS ACTIVITY: RECORDS DISPOSITION AND PRESERVATION<\/h5>\n<p>Retiring an information system requires detailed planning around the survival (via archiving or migration), or deletion, of data and records that it may contain.\u00a0Retirement of a system may pose the following questions:<\/p>\n<ul>\n<li>What allowances have been made for continued access to records generated by this system (in accordance with their respective schedules)?<\/li>\n<li>If the records managed by the system document a core institutional function or provide archival information about the institution\u2019s programs or policies, has a long term preservation strategy been developed?<\/li>\n<li>Does the current system contain information that will not be converted to any new system, and not archived?\u00a0Is the deletion of this information in accordance with its schedule?<\/li>\n<li>For the data that will be preserved, has sufficient metadata been identified and transmitted with the data to the archival digital repository?<\/li>\n<li>How will the digital archiving be accomplished?<\/li>\n<\/ul>\n<\/div>\n<\/div>\n<\/div>\n<\/div>\n\t\t\t<\/div><\/div><\/div>\n\t\t\t\t\t<\/div>\n\t\t\t\t\t","protected":false},"excerpt":{"rendered":"","protected":false},"author":3171,"featured_media":0,"parent":922,"menu_order":0,"comment_status":"closed","ping_status":"closed","template":"","meta":{"footnotes":""},"class_list":["post-2679","page","type-page","status-publish","hentry","cfct-can-haz-build"],"_links":{"self":[{"href":"https:\/\/www.wisconsin.edu\/compliance\/wp-json\/wp\/v2\/pages\/2679","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/www.wisconsin.edu\/compliance\/wp-json\/wp\/v2\/pages"}],"about":[{"href":"https:\/\/www.wisconsin.edu\/compliance\/wp-json\/wp\/v2\/types\/page"}],"author":[{"embeddable":true,"href":"https:\/\/www.wisconsin.edu\/compliance\/wp-json\/wp\/v2\/users\/3171"}],"replies":[{"embeddable":true,"href":"https:\/\/www.wisconsin.edu\/compliance\/wp-json\/wp\/v2\/comments?post=2679"}],"version-history":[{"count":10,"href":"https:\/\/www.wisconsin.edu\/compliance\/wp-json\/wp\/v2\/pages\/2679\/revisions"}],"predecessor-version":[{"id":2852,"href":"https:\/\/www.wisconsin.edu\/compliance\/wp-json\/wp\/v2\/pages\/2679\/revisions\/2852"}],"up":[{"embeddable":true,"href":"https:\/\/www.wisconsin.edu\/compliance\/wp-json\/wp\/v2\/pages\/922"}],"wp:attachment":[{"href":"https:\/\/www.wisconsin.edu\/compliance\/wp-json\/wp\/v2\/media?parent=2679"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}