| FILE NO. |
DESCRIPTION OF RECORDS |
AUTHORIZED DISPOSITION |
| 802 |
Reserved (as of March 28, 2007 Update) | |
| 803 |
Planning and System Development Files | |
|
Documents relating to the development of plans, policies, and procedures for agency and office IT systems and programs. Included are strategic information resources management (IRM) plans, feasibility studies, requirement analyses, cost and benefit studies, coordinating documents, approvals, disapprovals, charts, diagrams, and similar documents. | |
| 803-1 |
Files maintained by the Information Technology Services Division (NHT) and the Information Technology Policy and Administration Division (NHP). Arranged by subject. |
PERMANENT. Cut off annually. Transfer to NARA in 5-year blocks when 5 years old. (N1-64-87-1) |
| 803-2 |
Records maintained by other offices. | |
|
a. Strategic IRM Plan. |
Cut off annually. Destroy when 2 years old. (N1-64-87-1) |
|
b. Other records relating to studies. |
Cut off at end of study. Destroy when 2 years old. (N1-64-87-1) |
| 804 |
IT Hardware and Software Acquisition Case Files | |
|
Documents related to the initial planning, selection, evaluation, procurement, and installation of IT hardware and software. Included are feasibility studies, requirement analyses, initial system designs, specifications and reviews of system, vendor's proposals and evaluations, implementation reviews and performance evaluations, benchmark outputs, and related papers. | |
| 804-1 |
Case files maintained by NHT. | |
|
a. Transactions that exceed the simplified acquisition threshold ($100,000). |
Cut off inactive files annually and retire to records center 2 years thereafter. Destroy 6 years and 3 months after final payment. (GRS 3, item 3a[1][a]) |
|
b. Transactions at or below the simplified acquisition threshold ($100,000). |
Cut off inactive files annually and retire to records center 2 years thereafter. Destroy 3 years after final payment. (GRS 3, item 3a[1][b]) |
| 804-2 |
Copies of requisitions and supporting documentation maintained by other offices. |
Cut off at close of contract. Destroy when 2 years old. (N1-64-87-1) |
| 805 - 810 |
Reserved (withdrawn by CHGE 9) | |
| FILE NO. |
DESCRIPTION OF RECORDS |
AUTHORIZED DISPOSITION |
| 812 |
Oversight and Compliance Files | |
|
Records created and maintained while managing the functions for IT and NARANET operations. Records relate to compliance with IT policies, directives, and plans and include: recurring and special reports, responses to findings and recommendations, and reports of follow-up activities. | |
| 812-1 |
Performance measurements and benchmarks, including:
- Statistical performance data for systems and networks,
- System availability reports, and
- Sample performance indicators.
|
Destroy/delete when 5 years old OR 1 year after determination that there are no unresolved issues, whichever is longer. (GRS 24, item 1a) |
| 812-2 |
All other oversight and compliance records, including:
- Certification and accreditation of equipment,
- Quality assurance reviews and reports,
- Reports on implementation of plans,
- Compliance reviews, and
- Data measuring or estimating impact and compliance.
|
Destroy/delete when 3 years old OR 1 year after determination that there are no unresolved issues, whichever is longer. (GRS 24, item 1b) |
| 813 |
IT Infrastructure Design and Implementation Files | |
|
Records of individual projects designed to provide and support new agency IT infrastructure, systems, and services. IT infrastructure means the basic systems and services used to supply the agency and its staff with access to computers and data telecommunications. Components of IT infrastructure include:
- Hardware (e.g., printers, desktop computers, network and web servers, routers, hubs, and network cabling);
- Software (such as operating systems - e.g., Microsoft Windows and Novell NetWare);
- Shared applications (e.g., electronic mail [e-mail], word processing, and database programs); and
- Necessary services to design, implement, test, validate, and maintain such components.
Infrastructure design and implementation files include records documenting:
- Requirements for and implementation of functions, such as:
- Maintaining network servers, desktop computers, and other hardware;
- Installing and upgrading network operating systems and shared applications; and
- Providing data telecommunications;
- Infrastructure development and maintenance such as:
- Acceptance/accreditation of infrastructure components;
- Analysis of component options, feasibility, and costs/benefits; and
- Work associated with implementation, modification, and troubleshooting;
- Models, diagrams, schematics, and technical documentation; and
- Quality assurance reviews and test plans, data, and results.
NOTE: Records relating to specific systems that support or document mission goals are NOT covered by item 813 and must be scheduled individually by submission of an SF 115. | |
| 813-1 |
Records for projects that are NOT implemented. |
Destroy/delete 1 year after final decision is made. (GRS 24, item 11a) |
| 813-2 |
Records for projects that are implemented. |
Destroy/delete 5 years after project is terminated. (GRS 24, item 11b) |
| 813-3 |
Installation and testing records. |
Destroy/delete 3 years after final decision on acceptance is made. (GRS 24, item 11c) |
| 814 |
Financing of IT Resources and Services | |
| 814-1 |
Agreements formalizing performance criteria for quantity and quality of service, including definition of responsibilities, response times and volumes, charging, integrity guarantees, and non-disclosure agreements. |
Destroy/delete 3 years after agreement is superseded or terminated. (GRS 24, item 9a) |
| 814-2 |
Files related to managing third-party services, including records that document control measures for reviewing and monitoring contracts and procedures for determining their effectiveness and compliance. |
Destroy/delete 3 years after control measures or procedures are superseded or terminated. (GRS 24, item 9b) |
| 814-3 |
Records generated in IT management and service operations to identify and allocate charges and track payments for computer usage, data processing, and other IT services. EXCLUDES records that are part of NARA's cost accounting system. |
Destroy/delete records with no outstanding payment issues when 3 years old. (GRS 24, item 9c) |
| 815 |
IT Operations Records | |
| 815-1 |
Workload schedules, run reports, cycle time reports, and schedules of maintenance and support activities. |
Destroy/delete when 1 year old. (GRS 24, item 8a) |
| 815-2 |
Problem reports and related decision documents relating to the software infrastructure of NARANET or an individual system. |
Destroy/delete 1 year after problem is resolved. (GRS 24, item 8b) |
| 815-3 |
Reports on operations, including:
- Measures of benchmarks, performance indicators, and critical success factors;
- Error and exception reporting;
- Self-assessments;
- Performance monitoring; and
- Management reports.
|
Destroy/delete when 3 years old. (GRS 24, item 8c) |
| 816 |
IT Customer Service Files | |
| 816-1 |
Records related to providing help desk information to customers, including: pamphlets, responses to "Frequently Asked Questions," and other documents prepared in advance to assist customers. |
Destroy/delete 1 year after record is superseded or obsolete. (GRS 24, item 10a) |
| 816-2 |
Help desk logs and reports and other files related to customer query and problem response; query monitoring and clearance; customer feedback; and related trend analysis and reporting. |
Destroy/delete when 1 year old OR when no longer needed for review and analysis, whichever is later. (GRS 24, item 10b) |
| 817 |
Computer/Electronic Accommodations Program (CAP) | |
|
Records regarding requests for assistive technology, devices, and services, offered through CAP (a Department of Defense program), as part of NARA's reasonable accommodations program. To the extent that CAP records are accessible by personal identifiers, the records must be maintained in accordance with the Privacy Act of 1974 (5 U.S.C.§ 552). | |
| 817-1 |
Textual records pertaining to requests from individuals and offices: Forms, e-mails, medical documentation, and related records maintained by the CAP Administrator. |
Cut off the records at the end of the fiscal year in which the CAP request is approved or denied. Destroy the records 5 years after cutoff OR when the requested item(s) is/are upgraded, whichever is sooner. (N1-64-03-8, item 1) |
| 817-2 |
Electronic tracking database. |
Delete data pertaining to the CAP request when the data are no longer needed for administrative or reference use. (N1-64-03-8, item 2) |
| 818 |
IT Facility, Site Management, and Equipment Support Services | |
|
Records maintained by offices responsible for the control and operation of buildings and rooms where IT equipment, systems, and storage media are located. Includes:
- Files identifying IT facilities and sites,
- Files concerning implementation of IT facility/site management, and
- File concerning implementation of equipment support services provided to specific sites.
Types of records may include:
- Reviews and site visit reports,
- Trouble reports,
- Equipment service histories,
- Reports of follow-up actions, and
- Related correspondence.
|
Destroy/delete when 3 years old OR when superseded or obsolete, whichever is longer. (GRS 24, item 2) |
| 819 |
IT Asset and Configuration Management Files | |
| 819-1 |
Inventories of IT assets, network circuits, and building or circuitry diagrams, including equipment control systems such as databases of barcodes affixed to IT physical assets. |
Destroy/delete 1 year after completion of the next inventory. (GRS 24, item 3a) |
| 819-2 |
Records created and retained for asset management, performance and capacity management, system management, configuration and change management, and planning, follow-up, and impact assessment of operational networks and systems. | |
|
a. Records include, but are NOT limited to:
- Data and detailed reports on:
- Implementation of systems, applications, and modifications;
- Application sizing; and
- Resource and demand management;
- Documents identifying, requesting, and analyzing possible changes, authorizing changes, and documenting implementation of changes;
- Documentation of software distribution and release/version management; and
- Records of maintenance activities that have a major impact on a system or lead to a significant change.
|
Destroy/delete 1 year after termination of system. (GRS 24, item 3b[1]) |
|
b. Records of routine IT maintenance on the network infrastructure documenting preventative, corrective, adaptive and perfective (enhancement) maintenance actions. Includes requests for service, work orders, service histories, and related records. |
Destroy/delete when 3 years old OR 1 year after termination of system, whichever is sooner. (GRS 24, item 3b[2]) |
| 820 |
NARANET System Backups | |
|
Security backups for NARANET desktop applications, both incremental and full, created and maintained to restore the system in the event of a system failure or other unintentional loss of data. EXCLUDES data copied for purposes other than for emergency system restoration and data copied for specific systems and/or applications which may or may not be accessible through NARANET. | |
| 820-1 |
Incremental Backups: Daily backups (usually made after the close of business) of system transactions made on that day only. |
Destroy at the end of each week after full backup is made and verified. (N1-64-02-2, item 1) |
| 820-2 |
Full Backups: Full system backup (usually taken once a week after the close of the business week) which becomes a copy of the system for that point in time. |
Destroy each backup when 2 months old. (N1-64-02-2, item 2) |
| 821 |
Files Relating to Monitoring System Usage | |
|
Electronic files and hard-copy printouts for individual systems include, but are NOT limited to: log-in files, password files, audit trail files, system usage files, and cost-back files used to assess charges for system use. |
Delete/destroy when determined that files are no longer needed for administrative, legal, audit, or other operational purposes. (GRS 20, item 1c) |
| 822 - 829 |
Reserved | |
| FILE NO. |
DESCRIPTION OF RECORDS |
AUTHORIZED DISPOSITION |
| 830 |
Files Related to Maintaining the Security of Systems and Data | |
| 830-1 |
System Security Plans and Disaster Recovery Plans. Records may include:
- Computer technical manuals,
- Continuity of operations (COOP) plans,
- Disaster exercise evaluations and disaster exercises,
- Disaster recovery plans,
- Risk surveys,
- Security plans for IT infrastructure,
- Vulnerability assessments by the Inspector General, and
- Vulnerability assessments/studies.
|
Destroy/delete 1 year after system is superseded. (GRS 24, item 5a) |
| 830-2 |
Documents identifying IT risks and analyzing their impact, risk measurements and assessments, actions to mitigate risks, implementation of risk action plan, service test plans, test files, and data. Records may include:
- Risk management analyses,
- Security directives,
- Security policy analyses,
- Virus handbooks, and
- Vulnerability analyses.
|
Destroy/delete 1 year after system is superseded. (GRS 24, item 5b) |
| 831 |
User Identification, Profiles, Authorizations, and Password Files | |
| 831-1 |
Systems requiring special accountability (e.g., those containing information that may be needed for audit or investigative purposes and those that contain classified records). EXCLUDES records relating to electronic signatures. |
Whichever action is later, destroy/delete an inactive file either:
- 6 years after user account is terminated or password is altered, OR
- When no longer needed for investigative or security purposes. (GRS 24, item 6a)
|
| 831-2 |
Routine systems (e.g., those NOT covered by item 831-1). EXCLUDES records relating to electronic signatures. |
Destroy/delete when determined that files are no longer needed for administrative, legal, audit, or other operational purposes. (GRS 20, item 1c) |
| 832 |
Computer Security Incident Handling, Reporting, and Follow-up Records
| |
|
Includes reports and documentation of web site defacement, hacks, break-ins, improper usage by staff, misuse of system, security breaches, security break-ins, security failures, unauthorized intrusions, and virus threats. |
Destroy/delete 3 years after all necessary follow-up actions have been completed. (GRS 24, item 7) |
| 833 - 839 |
Reserved | |
| FILE NO. |
DESCRIPTION OF RECORDS |
AUTHORIZED DISPOSITION |
| 840 |
NARA Web Function | |
|
The NARA Web function comprises the designing, implementing, and maintaining of NARA's web sites. These records fall into one broad functional area (Program Operation) and are created in the course of operating NARA's Web Program. | |
| 840-1 |
Includes, but NOT limited to, files relating to: designing, populating, testing, implementing, and maintaining NARA's web sites (including Presidential libraries' web sites). | |
|
a. As performed by organizations responsible for web functions. |
Destroy/delete when 3 to 10 years old. (N1-64-06-2, item 1) |
|
b. As performed by offices proposing and preparing content for posting. |
Destroy/delete when no longer needed. (N1-64-03-6, item 1a[2]) |
| 840-2 |
Reference Documentation. | |
|
a. Technical documentation, subject reference files, and demonstration copies of the web site. |
Destroy/delete when no longer needed for reference. (N1-64-03-6, item 1b[1]) |
|
b. Version retrieval files. |
Destroy/delete no later than 60 days after posting. (N1-64-03-6, item 1b[2]) |
| 840-3 |
Web Server and Search Engine Log Files. Server, search engine, and statistical analysis tools generating automated logs that:
- Record data about how users access the web servers, navigate and/or query NARA's web pages, and use the search engine;
- Record which scripts are used and how; and/or
- Compile other statistics about use.
The logs collect the following personal information:
- Users' Internet Protocol (IP) addresses;
- Uniform Resource Locators (URLs) of pages that lead users to the NARA site; and
- Counts of web hits and user sessions, search requests, and systems used by visitors to the web site.
| |
|
a. Raw data pertaining to server logs. |
Retain 30 days of log data, one tape per day. Cycle tapes by overwriting the oldest data with new data on a daily basis. (N1-64-03-6, item 1c[1]) |
|
b. Security audit logs. |
Create one summary master copy of all raw data pertaining to server logs at the conclusion of each month. Retain for 12 months. Cycle tapes by overwriting the oldest data on "Month 13 tape" with the most recent data. (N1-64-03-6, item 1c[2]) |
|
c. Search engine log data and aggregated log data imported to statistical database. |
Hold 3 fiscal years of data. Delete oldest fiscal year files when 4 years old. (N1-64-03-6, item 1c[3]) |
| 841 |
"Live" Web Sites - Production Environment | |
| 841-1 |
Archives.gov (www.archives.gov) - NARA's main public web site, consisting of content files stored on production mirrored servers. Content files include: written, graphical, video, and/or audio content; style sheets, scripts, and code supporting functionality and delivery of content; and boot sector files residing on production servers. |
Overwrite or destroy elements OR entire web site when no longer needed. (N1-64-06-1, item 1) |
| 841-2 |
NARA@work (www.nara-at-work.gov) - NARA's intranet web site, consisting of content files stored on production mirrored servers. Content files include: written, graphical, video, and/or audio content; style sheets, scripts, and code supporting functionality and delivery of content; and boot sector files residing on production servers. |
Overwrite or destroy elements OR entire web site when no longer needed. (N1-64-06-1, item 2) |
| 841-3 |
Our Documents (www.ourdocuments.gov) - a public web site providing reference copies of documents for use especially by teachers and students. The project was created in partnership with National History Day and the USA Freedom Corps. Content files include: written, graphical, video, and/or audio content; style sheets, scripts, and code supporting functionality of the web site; and boot sectors residing on production servers. |
Overwrite or destroy when no longer needed. (N1-64-06-1, item 3) |
| 841-4 |
Guide to the 1930 Census (1930census.archives.gov) - an online portal providing guidance, replicated from other NARA sources, regarding research methods using the 1930 census. This web site does NOT provide copies of NARA holdings. Content files include: written, graphical, video, and/or audio content; style sheets, scripts, and code supporting functionality and delivery of content; and boot sectors (mirrored drives) residing on production mirrored servers. |
Overwrite or destroy when no longer needed. (N1-64-06-1, item 4) |
| 841-5 |
Emergency Federal Register (www.emergency-federal-register.gov) - a web site with simple interfaces providing contingency public access to the online Federal Register in rare cases of national emergency and as authorized by the President of the United States. The web site consists of content files, code and templates, forms, and instructions supporting posting and viewing of the Federal Register in emergency circumstances. |
Overwrite or destroy when no longer needed. (N1-64-06-1, item 5) |
