RIM_10_Vital Records and Business Continuity (Class)

(10_S-2) Handling Damaged Materials: Blueprints and Maps

1. Do not try to separate the items until they are dry. 2. Support individual flat drawings on a cardboard or wood-framed window screen. If the materials are stored in a map case, consider using the drawers for support and moving. 3. Support any rolled drawings in sections of PCV pipe or cardboard tubes. 4. Place groups of hanging drawings on clean, heavy cardboard and interleave cardboard between each set.

(10_S-2) Handling Damaged Materials: Audio and Video Tapes

1. Do not unwind the tapes or try to dry them. 2. Shake off any excess water. 3. Place the tapes with their boxes into a plastic bag, seal it tightly, and keep it cool. 4. Put the bags in a sturdy box and ship it within 24 hours by overnight express to a recovery center.

(10_S-2) Handling Damaged Materials: Photographic Materials

1. Keep all damaged materials cold and wet. Never let them dry out. 2. Rinse away any mud or particles. 3. Place the wet items in plastic bags. Seal and label the bags and keep them cold. 4. Put the bags in a sturdy box, label the box, and ship it by overnight express to a recovery center.

(10_S-2) Handling Damaged Materials: Magnetic Disks and Drives

1. Keep the disks and their sleeves together to preserve labeling information. 2. Place the wet disks in a plastic bag, seal it tightly, and freeze it. 3. Put the bag in a sturdy box and ship it within 24 hours by overnight express to a recovery center.

(10_S-2) Handling Damaged Materials: Documents and Books

1. Use cardboard "banker's box" for packing. 2. Handle wet materials carefully to avoid additional damage. 3. Rinse off any heavy mud or dirt. 4. Pack books with their spines down. Pack them only one width high. 5. Pack documents upright in the box. 6. When palletizing boxes, stack them only three high to prevent crushing the bottom layer during transport.

(10_S-1) What is a BIA?

A BIA determines the impact an organization faces when it loses the records that are critical to keeping the operation running. The analysis considers the declines in service levels, the areas of a company most likely to be impacted, an estimate of the effects, and the anticipated recovery time. Ultimately, the BIA builds a sound business case for the implementation and maintenance of a vital records program. In the BIA, you must value each function according to its critical worth. For instance, after a disaster, what functions would an organization want to resume the quickest? Below are three lists of specific business functions. Which list is in the proper priority order, from most important to least important? List 1 Payroll functions Customer service Marketing plan Performance reviews List 2 Customer service Payroll functions Marketing plan Performance reviews List 3 Customer service Marketing plan Payroll functions Performance reviews (List 2 is in the correct order. The customer service function will always be a high priority after a business disruption because the public, customers, and stakeholders will have lots of urgent questions.)

(10_S-3) Benefit: Reduced Insurance Costs

A disaster recovery plan is a close partner of business insurance and security. Inadequate insurance and security can be ineffective and costly. Same as an inadequate plan. A well-designed plan can translate into premium reductions for specific types of business insurance. Other types of insurance can also be reduced through improved security, maintenance, and training programs. If your organization has a plan in place, it may be able to reduce its insurance costs for business resumption and records restoration.

(10_S-1) Identify the Vital Records (VP)

A first step in the program is to identify the organization's vital records. You must analyze your own operations to determine what information is vital to its mission-critical functions. The ANSI/ARMA standard on vital records suggests asking four specific question when identifying vital records. 1. What records are absolutely necessary to resume operations? 2. What records are necessary to protect assets, protect the legal and financial status of the organization, and preserve rights and obligations of employees, customers, stockholders, and citizens? 3. Are there other sources inside or outside the organization from which the records can be retrieved or reconstructed? 4. Does the necessary information reside in more than one medium?

(10_S-1) Records Risk Analysis

A records risk analysis should include an appropriate method of scoring risks and impacts. A simple approach is to measure these as high, medium, or low on two levels: probability and impact. Those risks having high probability and high impact must be addressed through risk reduction, records transfer, or other appropriate methods. Low risks with low impacts can be accepted and monitored. The records risk analysis should support the records risk assessment and include detailed information as to what constitutes the risk or threat, as well as the consequences should it occur.

(10_S-1) Records Risk Assessment Procedures

A records risk assessment involves the following procedures: Conducting physical site surveys Conducting surveys of electronic storage tools Evaluating existing security and control measures Identifying probable threats to the records Identifying related vulnerabilities of the records with respect to these threats Identifying natural and other community-wide disasters the organization may be susceptible to

(10_S-1) Protection Methods: Storage

A second common method is protective storage, which uses fire-resistant and environmentally controlled equipment and vaults. Environmentally controlled storage must meet the relevant ANSI or ISO requirements. Further, fire-resistant file housings, standard records vaults, and file rooms must meet the rating requirements of the National Fire Protection Association Standard 232 Protection of Records.

(10_S-1) What a Vital Records Program Does

A vital records program does the following: + Identifies potential and existing exposures to risk + Establishes ways to measure and evaluate such risks + Determines appropriate actions to remove or reduce risks + Implements improved behaviors and conditions + Provides ongoing scrutiny against future risks

(10_S-2) 5. Resume Operations

After the crisis has been stabilized and recovery procedures completed, you may relocate the records in their normal operation facilities. Implementation actions associated with a return to normal operations include: + Informing all personnel that the emergency or threat no longer exists, and instructing them on how to resume normal operations + Supervising an orderly return to the normal facility or a move to a temporary or new permanent facility + Verifying that the organization can accomplish all essential functions at the new or restored facility + Conducting an after-action review, identifying areas for improvement, documenting these in your disaster recovery plan, and developing a remedial action plan as soon as possible

(10_S-2) Air Drying

Air drying is effective with a smaller volume of records that have humidity-related damage. Separate the records and spread them out to dry. Complete this within 72 hours.

(10_S-1) Collect Inventory Data

As you work with the business units to identify vital records, collect the following data: Record title or name Record series or retention schedule reference Reference activity and frequency 5 Location of the records Existing duplication and dispersal Existing protection Assessed vulnerabilities Information necessary to reconstruct or access the vital record Type of protection required Anticipated annual cost of maintaining protection Note also that your documentation of the vital records inventory becomes a vital record in its own right.

(10_S-2) Dehumidifying

Dehumidifiers and air movers are also useful, especially with larger quantities that have humidity damage. Leave the documents in their original containers and bring in dehumidifiers and air movers. Depending on the volume, this process can take weeks to complete.

(10_S-2) Removing Fire Damage

Fire-damaged records must have soot and smoke deposits removed and any odors neutralized. Charred records may have to be microfilmed or photocopied to retain the information, and the originals destroyed.

(10_S-2) Freezing

Freezing is helpful when documents have received direct water damage. Usually a restoration specialist places them in special containers in commercial freezers. Depending on the volume, this process often takes months to complete. While it's usually best to use a specialist to handle water-damaged documents, if you do freeze them in-house, make sure to begin the process within 48 hours to deter mold build-up. Low- temperature blasters result in smaller ice crystals, which makes for a better end product.

(10_S-1) Without Vital Records

If vital records are lost, an organization will suffer because the performance of its mission- critical functions is impaired. There are countless possible consequences, most of which are serious threats to an organization's survival. Can you think of the problems a pharmaceutical company would face if it lost its vital records? How about an equipment manufacturer? William Saffady in Managing Electronic Records lists potential consequences for these types of organizations and others. An equipment manufacturer would be unable to build, ship, or repair its products. A pharmaceutical company would be unable to develop, test, or prove the safety and efficacy of chemical compounds. A government agency would be unable to provide essential services to citizens. A financial institution would be unable to answer questions about customer accounts. An insurance company would be unable to process claims.

(10_S-2) 3. Begin Salvage Operations (VP)

If you already had a vital records program in place, your need to salvage materials would be greatly reduced or non-existent. Nonetheless, Jones and Keyes suggest several common techniques when salvaging vital records is necessary. We take a look at these techniques on the next several screens.

(10_S-2) Handling Damaged Materials: Microfilm, Microfiche, X-Rays

If you can ship the products the same day they get wet, then follow these instructions: 1. Put rubber bands around 35mm film boxes to keep the film reel and its box together to preserve labeling information. (Do not attempt to separate wet fiche.) 2. Place wet film or fiche in a plastic bag, seal it tightly, and keep it cold. 3. Put the bag in a sturdy cardboard box, label it, and ship it by overnight express to a designated recovery center.

(10_S-2) 4. Begin Restoration Procedures

If your operating site has suffered severe damage, it must be restored before you can use it. Listed below are common procedures for restoring your facility: Repair or replace damaged file housing, retrieval equipment, and computers. Clean and disinfect your HVAC systems, floors, walls ceilings, carpets, furniture, equipment, draperies, and records housing. Remove all traces of moisture, soot, smoke damage, chemical residue, and odor. Re-label new file folders, microfilm, CDs, etc. Duplicate your vital records as needed.

(10_S-3) Implementation: Technology (VP)

Implementation of a sound vital records program includes technology that backs up the data on a regular basis and incorporates the most appropriate protection methods, such as routine dispersal, mirroring, and encryption, to name a few. Again, it's important to collaborate with IT to ensure that electronic protection measures are in place and monitored. RIM must drive the conversation when technology such as an ECM or electronic data management system (EDMS) is purchased and configured.

(10_S-2) Five Steps to Disaster Recovery

In Emergency Management for Records and Information Management Programs, Jones and Keyes describe in great detail the five steps to disaster recovery for records. 1. Assess the damage 2. Stabilize the situation 3. Begin salvage operations 4. Begin restoration procedures 5. Resume operations Next, we briefly discuss each step.

(10_S-1) Business Continuity Phases

In Emergency Management for Records and Information Management Programs, Virginia A. Jones, CRM, FAI, and Kris E. Keyes, list four phases in a BCP: mitigation, preparedness, response, and recovery. These phases are represented by the two main components of a BCP: a vital records program and a disaster recovery plan. For the remainder of this course we'll look more closely at these components, beginning with the vital records program.

(10_S-1) Protection Methods: Dispersal

In a vital records program you also determine the best protection methods. Choose a method based on the media type, the available resources, and the environmental and security requirements. One very common method for all media formats is dispersal, which is the planned distribution of duplicate copies of records to locations different from where the originals are housed. Routine dispersal is part of normal business practice for both vital records and non-vital. Routinely dispersed records are maintained in two or more locations, and possibly on more than one medium. Designed dispersal is a routine duplication procedure intended specifically to protect vital information.

(10_S-1) Sample BIA Questions

In her article "Prepared or Not: That is the Vital Question," Barb Rike, CRM, suggests the types of questions to ask when conducting a BIA: If the online computer systems were not available, how would the department continue to operate? What is the minimum office space the organization needs to continue to operate? Could the organization operate without most of its office equipment for five days?

(10_S-1) Potential Threats

In her article, Rike also lists many potential threats to vital records. Technical and mechanical hazards: Power outage, gas leak, software failure, sewage failure, structural failure, electrical shortage, toxic spill, radiation contamination, biological contamination, train derailment, airplane crash. Human activities and threats: Computer error, misfiling, vandalism, theft, bomb threat, civil disorder, strikes, kidnapping, terrorism, sabotage, loss of personnel, epidemic. Natural threats and hazards: Fire, flood, hurricane, earthquake, lightning strike, tornado, snow, ice storms, wind, tidal wave, typhoon, mold, mildew, insects, rodents.

(10_S-3) Benefits of a Disaster Recovery Plan

In lockstep with selling the vital records program, you may need to communicate to senior management the value of a disaster recovery plan as well. The following list cites several benefits from having a strong disaster recovery plan in place. Each is described on the next five screens. Quick resumption of operations Improved safety Reduced insurance costs Improved security Reduction of human errors under stress

(10_S-1) Vital and Important Records (VP)

In many organizations, the loss of certain records may disrupt business but not jeopardize the mission. These records are considered important or useful, but not vital. Important records support the business operations and help it meet its responsibilities. The loss of such records may cause delays or confusion that impede a business unit's work, but it will not bring mission-critical operations to a halt. If destroyed, these records are replaceable at a moderate cost. Therefore, these important records don't require special protection.

(10_S-1) BIA Components

In the following list are components that are commonly found in a BIA: 1. Identify all business functions. 2. Identify the processes that support the business functions. 3. Determine the critical point in the business cycle of each process. 4. Determine if the process is mission critical. 5. Estimate the possible impact and recovery timelines. 6. Rank the mission-critical processes.

(10_S-1) Inventory Exercise

In this scenario, assume you're consulting with personnel from the accounting department. They've identified dozens of records they consider to be vital. In the following list is a sample of these records. You decide if each is vital or non-vital. Procedures for team meetings These are merely useful records. They do not support any mission-critical functions. In case of emergency, these records would not be pegged for urgent recovery. Accounts receivable documentation These records directly affect an organization's cash flow and are therefore vital. The most recent annual report An annual report is never a vital record, but some may consider it highly useful because it can be a quick source for finding mission statements, financial highlights, and other accomplishments. Insurance records These are considered vital because they provide proof of payment and the details of coverage an organization has. In case of disaster, there'd be a high priority in recovering them quickly. Internal auditing schedule Such a schedule could be easily recreated as needed, and the information on it would not be of high value during or after a disaster. Internal audits are important to an organization, but they don't directly support its mission-critical business functions and therefore are not vital.

(10_S-2) Removing Hazards

Information on records damaged by hazardous chemicals must be transferred to another media, and the original records destroyed.

(10_S-2) Handling Damaged Materials

Janie Wait, CRM, has special expertise in the topics of disaster recovery and business continuity. On the next few screens we feature her advice for handling damaged materials in-house or preparing them for the recovery specialists.

(10_S-3) Implementation: People

Many employees create dozens of records at their desktops every day, in e-mail programs, on hard drives, and in enterprise content management (ECM) systems, for instance. But too often they don't know how to store these records properly. Your vital records program is essentially worthless if the users don't understand and implement it. These suggestions can help make sure your team adheres to the program: Tell them what they need to do and make it easy for them or they may not do it. As best you can, embed the vital records protection into your processes and systems. Show the relationship between protected vital records and organizational stability. Convey that if there's a disaster even a low-level one, such as a power outage their salvaging efforts will be easier if they've followed the protection program. Make proper handling of the vital records a part of the performance evaluations for RIM personnel and possibly everyone who creates and handles records.

(10_S-3) Benefit: Improved Safety

Material and supplies can be replaced; personnel are nonrecoverable. An important component of a disaster recovery plan is training and risk assessment - these steps will help keep everyone safe. Training provides the knowledge to allow employees to act safely and effectively. It also takes the surprise out of response activities.

(10_S-3) Monitoring the Program

Once the program has been implemented, it must be monitored on a regular basis for completeness and effectiveness. To ensure legal sufficiency, counsel should periodically review the plan. The legal team may also recommend when additional revisions are necessary. Remember: Organizations are in constant flux, so your vital records program must be dynamic as well. It will need to be updated often, especially when new systems or functions are added, when there's key staff turnover, and when the organizational structure changes.

(10_S-1) Business Loss Considerations

Once the vital records have been identified and inventoried, focus on their business value. Consider what the actual risks are and how they could impact your operations. A common method is to conduct a business impact analysis (BIA).

(10_S-3) Benefit: Quick Resumption of Operations

One key advantage is a quick resumption of operations. When these plans are established, personnel are trained, preparedness activities are completed, and the plans are tested, everyone within the organization has a good chance of controlling the emergency so it does not become a records disaster. Being able to reduce downtime will result in continued customer satisfaction. It also leads to continued profitability or revenue flow.

(10_S-2) Removing Pest Damage

Paper records damaged by roaches and silverfish can usually be cleaned and microfilmed. Paper records damaged by rodents or termites are usually unsalvageable.

(10_S-1) Business Continuity

Plans for the protection and recovery of vital records often fall under the "business continuity" umbrella. Business continuity refers to an organization's ability to continue to operate in case of a disaster or disruption. A business continuity plan (BCP) is a written, approved, implemented, and periodically tested program that includes all actions to be taken to reduce the risk of avoidable disaster and to minimize the loss if a disaster occurs.

(10_S-1) Protective Methods for Electronic Records

Protective storage of original electronic data that's not on tape, optical disk, or compact disk involves transferring duplicate electronic data to an alternate processing or electronic storage site. Electronic vaulting Transferring the vital records to another computer server, usually maintained by a vendor. Data replication Duplicating data between sites, such as a primary processing site and an alternate site that can be accessed if the primary site is unavailable. This method is best used when continuous availability of data is required. Transaction-aware replication This is accomplished by electronically transmitting database or file changes to the secondary site and applying those changes to a replicated dataset. Mirroring A method of data replication that maintains a replica of electronic records, such as those found in databases or file systems, by applying changes at the secondary site in lockstep with changes at the primary site. Mirroring requires significantly more network bandwidth than shadowing. Shadowing A method of data replication that maintains a replica of electronic records such as those found in databases or file systems. Typically, shadowing is done by continuously capturing changes and applying them at the recovery site. Migration The process of translating data from one format to another. This is often done when an organization decides to use a new computing system or a database management system that is not compatible with the old system. Password protection or encryption These methods make a data file irretrievable by unauthorized persons. While these methods are effective, they can also be risky if the authorized persons are not available following a disaster. Data archiving This method is done for long-term preservation of data that is expected to have enduring or continuing value. Typically, the inactive data is transferred to secondary media repositories.

(10_S-1) Vital Electronic Records and IT

RIM professionals must collaborate closely with the IT department to help ensure the protection of vital electronic records. Often the protection of these records is lumped into the "computer security" category, but RIM must be a central player in designing the procedures to protect this data. In Managing Electronic Records, Saffady lists the components for a vital records program for electronic records. Essentially, his list mirrors that of the components for a vital records program, regardless of media or format. 1. Formal establishment of the program by senior management with the responsibility and authority for protection of vital electronic records assigned to the records manager, to be coordinated with related contingency planning activities. 2. The identification and enumeration of vital electronic records. 3. Risk analysis to determine the extent to which specific vital records are threatened by hazards and to calculate exposure. 4. The selection and implementation of appropriate loss prevention and records protection methods. 5. Employee training and compliance auditing.

(10_S-1) Vital Records Program

Saffady defines a vital records program as a set of policies and procedures for the systematic, comprehensive, and economical control of losses associated with vital records. A vital records program prepares your organization for nearly any threatening situation, and the costs incurred in developing such a program will likely pale in comparison to the expenses associated with losing vital records.

(10_S-0) Course Outline

Section 1: The Vital Records Program and Business Continuity Section 2: Disaster Recovery Section 3: Selling and Implementing Business Continuity

(10_S-3) Responsibilities of Senior Management

Senior management bears the ultimate responsibility for the assurance of business continuity and the protection of vital records. Specific responsibilities include: Determine the acceptable level of risk for the company Make sure that authorized individuals design effective plans for loss control and disaster recovery Allocate sufficient resources to vital records protection.

(10_S-3) Laws and Regulations

Senior management is compelled by law to protect its vital records. Certain laws and regulations require most organizations to provide preventive and protective measures for their records and data. For example, the Sarbanes-Oxley (SOX) Act of 2002 was enacted in response to high-profile financial scandals in several large corporations. The act protects shareholders and the general public from accounting errors and fraudulent practices in publicly traded companies. The act sets strict audit guidelines for organizations to prove that financial data is reported completely and accurately. Another pertinent law is HIPAA, the "Health Insurance Portability and Accountability Act" (1996). HIPPA regulations consist of national standards designed to force health care to comply with strong security and privacy standards to protect personal health information. It also contains language that requires disaster recovery and business continuity planning for quick recovery of any data.

(10_S-2) 2. Stabilize the Situation

Stabilizing the situation may occur at the same time - or even before - the damage assessment. The key is to make sure personnel are safeguarded. Some potential measures include turning off gas or water leaks, turning off electricity, removing outstanding water, removing debris that's blocking access to the site, establishing security, and reactivating alarms. As the environment becomes stable, begin removing and relocating damaged materials. If salvaging is necessary, this usually takes place at an alternative site or a designated disaster recovery site.

(10_S-3) Standards

Standards Several standards provide senior management and RIM with guidance on protecting vital records. In the following list are a few examples. Australia/New Zealand standard AS/NZS 4360, which provides instruction for managing risk. ISO 27002, which provides guidance for developing organizational security standards and effective security management and business continuity practices. ISO's "Committee Draft of ISO 31000 Risk Management," which provides guidelines on risk management that can be used by any type of organization. BSI's standard BS 25999-1, which focuses on business continuity management in case of a major disruption.

(10_S-3) Implementing a Vital Records Program

Successful vital records programs consider three key elements during implementation: people, processes, and technology. We discuss each of these facets on the next few screens.

(10_S-1) CFR Definition of Vital Records

The Code of Federal Regulations (CFR) definition helps illustrate the point that some types of vital records will be common to all types of organizations while others will be more organizational specific. Note how the following definition is specific to governmental agencies and therefore it highlights national security emergencies: Vital records mean essential agency records that are needed to meet operational responsibilities under national security emergencies or other emergency or disaster conditions (emergency operating records) or to protect the legal and financial rights of the government and those affected by government activities (legal and financial rights records). Likewise, a company with stockholders would place additional emphasis on records that documented its obligations to the stockholders, as well as to its customers and employees.

(10_S-3) Implementation: Processes

The following steps can help you ensure the processes in your vital records program are effective: Analyze your business functions to identify the mission-critical ones. Determine the processes that are needed to protect your vital records. o Is a built-in dispersal plan adequate?If not, what additional steps are needed? o Is there a mechanism in place to rotate or cycle the vital records as they lose their vital value, in order to keep the quantity down? o What role can technology play to help automate the process and make decisions? Document the results and make clear the roles and responsibilities.

(10_S-3) Benefit: Improved Security

The process of preparing a disaster recovery plan includes a review of present security procedures to protect an organization's vital assets. For example, the plan includes detailed procedures to monitor and control access to the facilities that contain vital records and information. Security is an important part of the prevention phase in developing your organization's plan.

(10_S-2) Disaster Recovery Plan (VP)

The second prime component in business continuity is the disaster recovery plan, which is an approved course of action to take after a disaster strikes. It describes how to restore critical business functions and reclaim damaged records. You cannot realistically prepare your organization for every disaster scenario. Reviewing, refining, and testing the disaster plan will improve your response during the chaos of a real event. The success of a disaster recovery plan relies largely on how well RIM professionals manage the vital records program before a crisis occurs.

(10_S-2) 1. Assess the Damage

There are three points for this step: 1. To begin damage assessment, contact your recovery service promptly. 2. Perform an initial damage assessment of your vital records. 3. Determine the recovery priorities based on your vital records' priorities. Of course, if your organization already had a vital records program in place, then you could quickly identify priorities in your recovery efforts because you've already identified the mission- critical records. Further, your damage would likely be minimal. Duplicate copies of records would be safe and easily accessed in an offsite location, thereby greatly reducing the need for salvage operations. This is just one example of the cost-effectiveness of having a vital records program.

(10_S-1) Types of Risk Assessment

There are two common types of risk assessment: 1. Qualitative risk assessment is particularly useful for identifying and categorizing physical security problems and other issues. It's based on a physical survey of locations where vital records are stored, combined with a review of security procedures already in place. 2. Quantitative risk assessment relies on site visits, discussions, and other analysis to identify risks. It uses numeric calculations to estimate the likelihood and impact of losses associated with specific vital records series. The losses are expressed as dollar amounts, which can be related to the cost of proposed protection methods.

(10_S-1) Inventory the Vital Records

To inventory the vital records, you must leave your office and conduct research. Speak with those who handle records in each department. While only a small percentage of a business unit's records are truly vital, expect the personnel to identify virtually all of their useful and important records as vital records. It is RIM's responsibility to help them distinguish between vital and non-vital records by identifying those documents that are crucial to the company's core functions and obligations. In the process, it may be helpful to consult the department's mission statement, its retention schedules, and its procedural documentation. To inventory the vital records, you must leave your office and conduct research. Speak with those who handle records in each department.

(10_S-0) Course Learning Objectives

Upon completing this course, you will be able to: 1. Define a vital records program 2. Explain the business case for a vital records program 3. Describe protective methods for vital records 4. Summarize the steps in a disaster recovery plan 5. List the benefits of a disaster recovery plan

(10_S-3) Learning Objectives

Upon completing this course, you will be able to: 1. Describe the responsibilities of senior management in a vital records program 2. List the benefits of a disaster recovery plan 3. Summarize the proper monitoring of a vital records program

(10_S-1) Learning Objectives

Upon completing this course, you will be able to: 1. Distinguish between vital records and important records 2. Summarize how to identify vital records 3. Define a business impact analysis 4. Describe the two types of records risk assessment 5. Identify protection methods for vital records

(10_S-2) Learning Objectives

Upon completing this course, you will be able to: 1. Summarize the steps in a disaster recovery plan 2. Describe the common salvaging methods

(10_S-2) Vacuum Drying

Vacuum-drying wet paper records helps prevent mold or mildew and the swelling of bound volumes. It also prevents further deterioration while recovery and restoration procedures are carried out. (For books and documents that are saturated, freezing is often the measure taken. We discuss this in a moment.)

(10_S-1) What are Vital Records?

Vital records are the records that are fundamental to the functioning of an organization and necessary to continue operations without delay under abnormal conditions. If these records are destroyed, your operations would come to a grinding halt. They typically contain information needed to recreate your legal and financial status and to preserve the rights and obligations of stakeholders, including employees, customers, shareholders, business partners, and citizens. Examples include current accounts payable and receivable data, safety-testing documentation, insurance certificates, current contracts, and current personnel records, to name only a few. Vital records can be active or inactive, and they might be vital for only a portion of their life cycle.

(10_S-0) Course Introduction

Vital records contain information that's essential to an organization's mission-critical operations. If you lose your vital records, you run the risk of a shut-down because your ability to serve your customers, stakeholders, and employees will be greatly impaired. In this course, we demonstrate how a vital records program as part of a business continuity plan can help prevent such disastrous consequences. The program mitigates risk and prepares the organization for fast resumption of its critical business functions. The course also covers how to sell, implement, and monitor a vital records program; and it introduces the basic elements of a disaster recovery plan. Please note that this course applies more to the actual loss or damage of records than it does to responding to inadequate records or to compliance issues. For a more thorough discussion of records risk management, see our online course Assessing and Mitigating Risk.

(10_S-1) Risk Management Considerations (VP)

Vital records programs typically contain a risk- management component. Risk is the exposure to the potential of injury or loss. The cost of mitigating the risk must be weighed against the value of the information itself. Risk management is the process that ensures an organization does not assume an unacceptable level of risk. It includes records risk analysis and assessment procedures. Because identifying and mitigating every risk can be time consuming and expensive, the organization must set its level of risk tolerance. This is the maximum exposure to risk that is acceptable based on the benefits and costs.

(10_S-3) A Difficult Sell

Vital records protection can be difficult to sell to decision makers. It is costly but makes no direct contribution to revenues, product development, or improvement of services. It provides no benefits unless a disaster occurs. As an added complication, many threats to vital records have a low probability of occurrence. Senior management may thus ignore them in favor of more pressing business concerns.

(10_S-3) Selling Your Plan to Senior Managers

When making your case to senior management, demonstrate the following: How you have ranked the mission-critical activities and their related records How the program will provide protection in cost-effective ways How even low-level occurrences - such as power outages - can have a major impact, and how the program minimizes the impact

(10_S-1) On-site vs. Off-site Storage

While on-site storage allows vital records to be maintained near users, it is not a recommended protection method. Off-site storage refers to protective storage in a location separate from the organization. Of course, the location must be distant enough so that a widespread disaster would not affect both locations. While on-site storage allows vital records to be maintained near users, it is not a recommended protection method. Off-site storage refers to protective storage in a location separate from the organization. Of course, the location must be distant enough so that a widespread disaster would not affect both locations.

(10_S-3) Benefit: Reduction of Human Errors Under Stress

Without a plan, your employees will react haphazardly to an emergency. Some people will make mistakes due to insufficient or incorrect information. Some people will not react at all. Exercises or drills place people in a "what if" situation that increases their awareness of how to behave in a real emergency. Training employees and providing a plan for them to read and understand will result in them behaving more effectively.