§ 1236.42 - Records management requirements.

§ 1236.42 Records management requirements.

(a) Before starting a digitization project, agencies must establish intellectual control of the records that will be digitized. Intellectual control means having the information necessary to identify and understand the content and context of the records. One traditional records management technique to establish intellectual control is the creation of an inventory. The inventory must identify whether the records are complete, if there are any gaps in coverage or missing records, the presence of any mixed-media records, the disposition schedule under which the records fall, the date range when the records were created, any access or use restrictions that apply to the records, and the records' storage location.

(b) Agencies must identify any relationships between the source records in order to retain these relationships between the digitized versions. For example, are there case files that are associated by case number? Does a folder contain multiple documents that are stapled together? Are there digital components of a mixed-media file stored on removable media (DVD or USB drives)? What is the relationship of the folder to other folders in a box? Any relationships must be captured as part of the digitization process:

(1) Through metadata (See § 1236.54 for metadata requirements);

(2) By organizing the folder structure of a file system;

(3) By using file formats that allow for multi-page files, such as PDF or TIFF; or

(4) Through a combination of these approaches.

(c) In addition, the inventory can be used to identify all the elements of physical control needed for the records to be digitized. Physical control includes understanding the physical characteristics of source records. Physical characteristics determine a project's scope, and the image capture techniques and equipment to be used. For example, the type of paper, the type of printing, or the size of the records can impact what methods and equipment are used to digitize records.

(d) There are additional considerations for managing the source records during the digitization process:

(1) Ensure there are appropriate safeguards for the source records to prevent their loss or damage.

(2) Restrict access to source records while they are being digitized to minimize the risk of unauthorized additions, deletions, or alterations.

(3) Ensure there is a process to identify and document gaps in coverage or missing records.

(e) Agencies must ensure that records are free from unauthorized alteration, destruction, or deletion by complying with the mechanisms and controls specified in §§ 1236.10 and 1236.20:

(1) The agency may generate checksums using the SHA–256 hash algorithm and record them as technical metadata in a recordkeeping system for each image file when digitization is complete and the agency determines that the records are no longer in active use and the metadata are no longer subject to any changes that may result from ongoing business use. Use the checksums to monitor the digitized records for corruption or alteration and capture them as metadata as required in § 1236.54; or

(2) The agency may perform file integrity monitoring or file comparison audits.

(f) If there are born-digital records that are part of the record series within the project, follow the instructions for managing mixed-media records in § 1236.52.