TITLE 1 GENERAL GOVERNMENT ADMINISTRATION

CHAPTER 13 PUBLIC RECORDS

PART 3 MANAGEMENT OF ELECTRONIC RECORDS

1.13.3.1 ISSUING AGENCY: State Commission of Public Records - State Records Center and Archives

[1.13.3.1 NMAC - Rp, 1.13.3.1 NMAC, 6/30/2008]

1.13.3.2 SCOPE: all state agencies

[1.13.3.2 NMAC - Rp, 1.13.3.2 NMAC, 6/30/2008]

1.13.3.3 STATUTORY AUTHORITY: Section 14-3-6 of the Public Records Act (Chapter 14, Article 3, NMSA 1978) gives the state records administrator the authority to establish and maintain an active, continuing program for economical and efficient management of the public records of state government.

[1.13.3.3 NMAC - Rp, 1.13.3.3 NMAC, 6/30/2008]

1.13.3.4 DURATION: Permanent

[1.13.3.4 NMAC - Rp, 1.13.3.4 NMAC, 6/30/2008]

1.13.3.5 EFFECTIVE DATE: June 30, 2008 unless a later date is sited at the end of a section.

[1.13.3.5 NMAC - Rp, 1.13.3.5 NMAC, 6/30/2008]

1.13.3.6 OBJECTIVE: The objective of this rule is to establish an architecture for the management of public records on electronic media that:

A. ensures proper records and information management practices are implemented and adhered to by state government entities;

B. ensures uniformity and facilitates the accessibility of public records of government entities

C. maintains accountability and preserves electronic records; and

D. provides guidance to users and managers of electronic systems in New Mexico government about:

(1) the issues associated with managing electronic records, special record keeping and accountability concerns that arise in the context of electronic government;

(2) archival strategies for the identification, management and preservation of electronic records with enduring value; identification and appropriate disposition of electronic records with short-term value; and

(3) improving access to state government records.

[1.13.3.6 NMAC - Rp, 1.13.3.6 NMAC, 6/30/2008]

1.13.3.7 DEFINITIONS:

A. “Administrator” means the state records administrator (Section 14-3-2 NMSA 1978).

B. “Agency” means any state agency, department, bureau, board, commission, institution or other organization of the state government, including district courts. 14-3-2 and 14-3-15 NMSA 1978.

C. “Application” means a software program designed for end user to do work, such as word processing, accounting, or illustrating. Software programs such as wordperfect, excel, and pagemaker are examples of end user applications.

D. “Archives” means a place where public records or other historical documents are kept.

E. “Commission of public records” means the governing body of the state records center and archives.

F. “Computer” means an electronic device designed to accept data (input), perform prescribed mathematical and logical operations at high speed (processing), and supply the results of these operations (output). This includes, but is not limited to, mainframe computers, minicomputers, and microcomputers, personal computers, portable computers, pocket computers, tablet computers, telephones capable of storing information, PDAs, smart phones and other devices.

G. “Custodial agency” means the agency responsible for the maintenance, care, or keeping of public records, regardless of whether the records are in that agency’s actual physical custody and control.

H. “Custodian” means the person (guardian) responsible for the maintenance, care, or keeping of a public body’s records, regardless of whether the records are in that person’s actual physical custody and control. The statutory head of the agency using or maintaining the records or their designee.

I. “Custody” means the guardianship or records, archives, and manuscripts, which may include both physical possession (protective responsibility) and legal title (legal responsibility).

J. “Data” is the plural for “datum” which means a single piece of information. Data refers to a collection of information, electronic or non-electronic. Data can also refer to raw facts, figures, or symbols.

K. “Database” means a structured collection of records or data that is stored in a computer system. A database relies upon software to organize the storage of the data and to enable a person or program to extract desired information.

L. “Destruction” means the disposal of records of no further value by shredding, burial, incineration, pulping, electronic overwrite, or some other process, resulting in the obliteration of information contained on the record.

M. “Disposition” means the final action that puts into effect the results of an appraisal decision for a series of records; i.e., transfer to archives or destruction.

N. “Draft copies” means the working copies (rough versions) of documents prior to a draft final (conclusive document) being produced.

O. “Draft final” means the conclusive document produced.

P. “Electronic records” means records whose informational content has been encoded and recorded on a medium like magnetic tape, drums, discs, or punched paper tape and can be retrieved by finding aids known as software documentation. The encoded information is retrievable only with the help of a computer.

Q. “Filing” means the process of sequencing and sorting records to make them easy to retrieve when needed.

R. “General schedule” means records retention and disposition schedule that specifies the disposition of support records common to many offices or agencies within government

S. “Human readable form” means information that can be recognized and interpreted without the use of technology.

T. “Information” means data that has been transformed and made more valuable by processing.

U. “Information system” means an electronic framework by which hardware and software resources are coordinated to manipulate and convert inputs into outputs in order to achieve the objective of an enterprise.

V. “Information system database” means a subset of logically arranged data stored on media accessible by the computer.

W. “Life cycle” means the life span of a record from its creation or receipt to its final disposition.

X. “Medium, media” means the physical material on which information can be recorded.

Y. “Microforms” means microfilm media, including reels, fiche, jackets, and computer output microfilm (COM) containing micro images.

Z. “Non-records or non-essential records” means records listed on a records retention schedule for routine destruction, the loss of which presents no obstacle to restoring daily business. The following specific types of materials are non-records: extra copies of correspondence documents preserved only for convenience of reference blank forms or books which are outdated materials neither made nor received in pursuance of statutory requirements nor in connection with the functional responsibility of the office or agency preliminary and non-final drafts of letters, reports, and memoranda which may contain or reflect the working or deliberative process by which a final decision or position of the agency, board, department, or subdivision thereof is reached shorthand notes, stenographic tapes, mechanical recordings which have been transcribed, except where noted on agency retention schedules routing and other interdepartmental forms which are not significant evidence of the activity concerned and do not otherwise have value as described above stocks of publications already sent to archives and processed documents preserved for supply purposes only form and guide letters, sample letters, form paragraphs subject files, including copies of correspondence, memoranda, publications, reports, and other information received by agency and filed by subject (also referred to as reading files or information files).

AA. “Operating system” means the master control software that runs a computer. When the computer is turned on, the operating system is the first program that gets loaded into the memory of the machine.

BB. “Permanent records” means records considered being unique or so valuable in documenting the history or business or an organization that they are preserved in an archives.

CC. “Permanent archival records” means records identified in either general records retention and disposition schedule or a program records retention and disposition schedule possessing a retention requirement of transfer to the SRCA.

DD. “Personal digital assistant” means a handheld device that combines computing, telephone, fax, and networking features. PDAs are also called palmtops, hand-held computers and pocket computers. A PDA is a small computer that literally fits in your palm. Palmtops that use a pen rather than a keyboard for input are often called hand-held computers or PDAs. Because of their small size, most palmtop computers do not include disk drives. However, many contain slots in which you can insert disk drives, modems, memory, and other devices. Palmtops are also called PDAs, hand-held computers and pocket computers.

EE. “Program” means a coded set of instructions, written by humans, that directs a computer’s functions. The program can be stored on disk (in which case the program is software) or in a chip (which is firmware).

FF. “Public records” means all books, papers, maps, photographs, or other documentary materials, regardless of physical form or characteristics, made or received by any agency in pursuance of law or in connection with the transaction of public business, preserved or appropriate for preservation, by the agency or its legitimate successor as evidence of the organization, functions, policies, decisions, procedures, operations or other activities or the government, or because of the informational and historical value of data contained therein (14-3-2 NMSA 1978).

GG. “Records” means information preserved by any technique in any medium now known, or later developed, that can be recognized by ordinary human sensory capabilities either directly or with the aid of technology (1.13.70 NMAC).

HH. “Records center” means a facility designed and constructed to provide low-cost, efficient storage and reference service on records that have become inactive but have not reached their disposition date. The state records center, as defined by 14-3-2 (E), NMSA 1978, is the “...central records depository which is the principal state facility for the storage, disposal, allocation or use of non-current records of agencies, or materials obtained from other sources.”

II. “Records custodian” means the statutory head of the agency or their designee.

JJ. “Records liaison officer” means the individual in the custodial agency designated by the records custodian to cooperate with, assist, and advise the state records administrator in the performance of the administrator’s duties (14-3-4, NMSA 1978). The records liaison officer in an agency is responsible for implementing the records retention and disposition schedules within their agency. The records liaison officer is also responsible for authorizing the storage and or destruction of their agency’s records.

KK. “Records retention and disposition schedules” means rules adopted by the commission pursuant to Section 14-3-6 NMSA 1978 describing records of an agency, establishing a timetable for their life cycle and providing authorization for their disposition.

LL. “Records series” means file units, documents, or electronic records arranged according to a filing system or maintained as a unit because they relate to a particular subject or function, result from the same activity, have a particular form, or share some other relationship arising from their creation, receipt, or use.

MM. “Recycle bin” means an icon on a microsoft windows based operating system desktop that represents a directory where deleted files are temporarily stored. This enables and user to retrieve files that you may have accidentally deleted or delete the files permanently.

NN. “Scheduling” means the action of establishing retention periods for records and providing for their proper disposition at the end of active use.

OO. “Smart phones” means a phone that uses an identifiable operating system, often with the ability to add applications (e.g. for enhanced data processing, internet connectivity or electronic message).

PP. “Software” means the set of instructions for a computer to carry out a specified procedure.

QQ. “System” means an integrated framework that has one or more objectives and coordinates the resources needed to convert inputs to outputs. The word system often is used in a generic sense in referring to a computer setup--what type of computer and cpu operating system, how much hard disk space, how much memory, or what software package and peripherals are used.

RR. “Transfer” means moving inactive records to a records center or archives. Moving records into the SRCA also includes the transfer of custody from the custodial agency to the SRCA.

SS. “TIFF" means tagged image file format, a standardized format for storage of digitalized images, which contains a header or tag that defines the exact data structure of the associated image.

TT. “USB flash drives” means a small, portable flash memory card that plugs into a computer’s USB port and functions as a portable hard drive. USB flash drives are small and can plug into any computer with a USB drive.

UU. “Vital records” means records essential to the continuing operation of an agency. They are either intrinsically irreplaceable or irreplaceable because copies do not have the same value as the originals. They are essential to the continuity of services during a disaster or to the restoration of daily business when it has been interrupted. They are the records that would be required to protect the legal and financial interests of an agency, preserve the rights of the people, and resume operations after a major disaster like fire or flood.

VV. “Voice mail” means a telecommunication message that is digitized and can be stored and subsequently retrieved in audio or visual format.

WW. “Working copies” means the rough versions of documents prior to a conclusive document produced.

[1.13.3.7 NMAC - Rp, 1.13.3.7 NMAC, 6/30/2008]

1.13.3.8 ACRONYMS:

A. “BMP” stands for microsoft windows bitmap format.

B. “JPEG” stands for joint photographic experts group

C. “MPEG” stands for moving picture experts group.

D. “PDA” is short for personal digital assistant.

E. “PDF” stands for portable document format.

F. “RRDS” stands for records retention and disposition schedule.

G. “SGML” standard generalized markup language.

H. “SRCA” stands for the New Mexico state records center and archives.

I. “TIFF” stands for tagged image file format.

J. “USB” stands for universal serial bus.

[1.13.3.8 NMAC - Rp, 1.13.3.8 NMAC, 6/30/2008]

1.13.3.9 [RESERVED]

1.13.3.10 INTRODUCTION: ACCOUNTABILITY

A. Public acceptance of New Mexico state government and the roles of its employees depend on trust and confidence. This trust is founded on all of government being accountable for its actions. Access to full and accurate records is at the heart of the accountability process. Records are the means by which the evidence of past and current action, decisions, procedures and policy are preserved for future analysis and access.

(1) Records are fundamental tools in the business of government and their absence can lead to inefficiencies or failure in operational procedures. The absence of records can open agency employees to accusations of fraud and impropriety, political embarrassment and an inability to defend the state in cases of legal action or claims against the government.

(2) Records can also be transferred from one medium to another and from one context to another through copying, imaging or digital transfer. Electronic records are easily updated, deleted, altered and manipulated. If appropriate measures are not taken, the essential characteristics of records (content, structure, context) can be altered or lost in the process. Careful planning and system design are required to ensure that these characteristics of records are both captured and maintained.

(3) These guidelines are intended to provide guidance to agencies on the management of electronic records throughout their entire lifecycle, from initial system design to the final disposal or permanent preservation of state records. This "records lifecycle" view is critical in an electronic environment because, by the disposition stage (when actions are taken regarding records no longer needed for current government business), records may be irretrievable if not properly managed while they are in active use. The administrative rule covers records created using all types of computerized environments, including such diverse elements as personal computers, distributed networks, mainframes, spatial data systems, and multimedia systems.

B. Although there exists sensitive or confidential data, all data generated by a state or local government agency in New Mexico are public unless they have been legally declared closed to public inspection by state or federal statute. State agencies are not empowered to make exemptions to the Inspection of Public Records Act (Sections 14-2-1 through 14-2-12 NMSA 1978). Agency heads often have valid concerns about security and privacy rights, thus, questions related to concerns about specific sensitive information or data elements are more properly addressed to legal council for the agency or to the office of the attorney general for the state of New Mexico. Exceptions to this general rule exist throughout state and federal law.

C. In a court of law the evidence may be in documentary, oral, audio-visual, electronic or object form. It shall satisfy the tests of evidence and be admissible in that legal context. Evidence as a concept, however, is not confined to legal contexts. Within business and public sector environments, the evidence from previous actions and decisions is used as a basis for the formulation of new decisions and actions. Organizations keep records as evidence or proof that an activity or transaction did or did not occur. Beyond this more immediate use, researchers also use records as historical evidence on which to base their conclusions.

D. There is no specification in the Inspection of Public Records Act (Sections 14-2-1 through 14-2-12 NMSA 1978) of any means which access to public records shall take. The means of access is left to the discretion of the public agency. The public should not be given direct access if such an action would compromise the security and safety of the records themselves. Common sense urges caution where valuable records are concerned. Hardcopy and digital file storage areas may contain both "open" and "closed" records material, and the alteration, destruction, or theft of files represent clear dangers to public records. If a member of the public demands access that the agency believes will compromise records security but that is not otherwise clearly prohibited in federal or state statutes, that agency is urged to contact their legal council or the office of the attorney general for guidance.

[1.13.3.10 NMAC - Rp, 1.13.3.10 NMAC, 6/30/2008]

1.13.3.11 SYSTEM RELIABILITY, THE CREATION AND CAPTURE OF ELECTRONIC RECORDS AND THE MAINTENANCE AND ACCESSIBILITY OF THE RECORDS

A. The electronic records system should be administered and configured with the best practices in mind for information and resource management to ensure the reliability of the records being produced. Towards this goal of reliability the life cycle of the records shall be taken into account where some records may finite life spans others may have an indefinite life may have to be viewed or regenerated forever. To this end there are four aspects: preservation- the information shall be in a form that can be physically preserved; the information shall possess the quality of accessibility; the information shall be able to be read (readability); and the information shall retain its comprehensibility - to be read and understood in their original context without question.

(1) Information shall be physically preserved. The information in an electronic system shall be preserved in a physical media that is of sufficient quality and capacity to contain the information being preserved. There are many ways to accomplish this and the commission of public records (state records center and archives) does not endorse, warrant, certify, or approve any particular hardware or software product or product combination used in any electronic records management activity. The implementation of these processes, including the specifications for products used therein, remains at the discretion of the individual public agency. However, the records should be full and accurate to the extent necessary to: facilitate action by current and future employees, at all levels; allow for proper scrutiny of the conduct of business by anyone authorized to undertake such scrutiny; and protect the financial, legal and other rights of the agency, its clients and anyone else affected by its actions and decisions. The agency shall provide convincing, documented evidence that the electronic records were created, protected, and otherwise managed in accordance with systems and procedures designed to ensure the reliability, accuracy, and security of both the records and the process or system used to produce the records. Many paper records are being eliminated when the information has been placed on magnetic, optical, or other data processing media. In these cases, the information on the data processing medium shall be retained for the length of time specified in records retention and disposition schedules and is subject to the same confidentiality and access restrictions as paper records.

(2) Information shall be accessible. When conducting transactions electronically, the first challenge is to maintain records in a way that will enable retrieval of all documents relevant to a transaction when they are needed. The second challenge is to ensure that the records are not retained for any longer than necessary, in order to avoid both overloading systems and to avoid indiscriminate dumping. A special problem with electronic records is that they lack familiar physical and visual clues about their origins, such as official letterhead, or their authenticity, such as written signatures. Special measures shall be taken to ensure that they are also reliable and authentic. Paper record-keeping systems have traditionally been employed to file letters, minutes, reports, spreadsheets, invoices, notes, etc. These systems employ classified and indexed files at a subject or transaction level to consolidate and co-locate the documents generated or received in the course of a business activity. Separate folders provide a business context and link the individual documents to a particular transaction and into the wider agency record-keeping system. In recent years, agencies have adopted records management, document management, workflow and imaging software. Regardless of the technology, however, the objective remains the same: capture records so that they can be easily retrieved at a later date, understood, and interpreted as evidence of what transpired in an agency.

(a) the record shall have information content that is (and continues to be) an accurate reflection of what actually occurred at a particular time in the function, activity or transaction in question; and

(b) be able to be reconstructed electronically when required, so that each component is brought together as a whole and presented in an intelligible way; and

(c) possess a unique identifier or indexing that facilitates in the access of the information through the use of folder naming conventions or through searches or queries; and

(d) have been officially incorporated (either actively or passively) into an agency's or person's record-keeping system.

(3) Information shall be readable. Electronic records may exist independently of their physical format; however, by reducing records to their essential characteristics, we can allow for the existence of records, regardless of the current technology. Systems shall link the content of a record to its administrative or business context. In electronic environments, the essential characteristics rarely sit neatly together in a single, format-based package. Though all of the elements of an electronic record may exist within a single computer file, they may also be distributed across the entire state network. The integrity of these elements and the links between them are much more important than where they physically reside. If one is not able to place records in their appropriate administrative context, then they have seriously diminished value as evidence. In order for records to serve as evidence, three essential characteristics shall be maintained. Whenever one of the characteristics is altered, the ability of records to accurately reflect the activities of an agency is diminished. This means that records shall posses the following essential characteristics:

(a) content, that which conveys information (e.g. text, data, symbols, numerals, images, and sound);

(b) structure, appearance and arrangement of the content (e.g. relationships between fields, entities, language, style, fonts, page and paragraph breaks, links and other editorial devices);

(c) context, be able to be placed in context so that the circumstances of its creation and subsequent use by an agency or person can be understood in conjunction with its information content.

(4) Information shall retain its context. One of the major differences between electronic records and those on traditional media is that electronic records are not human-readable, thus their physical appearance alone does not provide sufficient information to determine their origin, purpose, uses or other aspects of the context in which they were created and maintained. Maintaining content, structure and context of electronic records is, therefore, both more vital and difficult than with traditional records. Meeting these conditions requires high quality records management and a sustained commitment, on the part of state agencies and the SRCA.

B. The creation and capture of electronic records.

(1) Strategies for capturing electronic records will differ, depending on the opportunities presented by an agency's hardware and software environment. The complexity of electronic records and the rapid acceleration of new formats and technologies provides the background for the creation of the myriad of electronic records that are being created from simple text records to modeling simulations. Even records that might be perceived as simple record formats can contain a complexity that underlies the information, for example a spreadsheet can be viewed on a monitor as figures; however, within the spreadsheet formulas can be found. Additionally, some records may require several elements at one to become a coherent record, for example a multimedia presentation consisting of audio, text, and video. The organizational environment will influence the point at which records are captured. This will include perceptions about what constitutes a record, assignment of responsibility, agency requirements to create records, and staff understanding of the technology involved and when and where a record should be captured and when a draft or non-record crosses the threshold and becomes a record.

(a) Local environment, where the initial work is done to create a draft. Often time, in the creation of correspondence the local environment will hold a copy of a finalized product, which is then printed, and the official copy is placed in a paper folder. What remains in the local environment is then a copy and can be considered a non-record.

(b) Group environment, where recognizable drafts are produced and maybe shared with peers and unit management. The record creator is responsible for capturing his or her own records and assigning management practices to them at the point of creation. This could be implemented as a screen the user fills in before documents can be saved or messages can be sent. A user interface could be designed so that users can choose between a number of icons representing business tasks or style templates, e.g., "send policy" or "make appointments." The choice of icon can engage the appropriate application, distribution lists, style sheets, and records disposal authorities. The sender thus affects scheduling but need not make conscious decisions about assigning retention periods to records.

(c) Corporate environment, where centralized applications such as databases and corporate level wide information are found.

(2) The reliability of a record, whether it is a traditional paper based record, analog or digital is dependent to varying degrees on a level of competence or skill of the creator of the record and formal training or support programs can ensure that staff understand and adhere to established policies and procedures. In the past, the need for grammar, spelling and typing skills were required in the business realm, currently the entry level skill of a person in a business environment requires a rudimentary understanding of computer systems. To this end varying levels of training, education, and skill are required from those creating records to those who are administering or maintaining electronic records systems. Training for the management of electronic records, all records creators should have, based on their level of responsibility in their respective agency, training in basic records management, advanced records management and archival preservation.

(3) Audit trails can provide a means to assist in accomplishing security related objectives such as individual accountability, the reconstruction of events, intrusion detection, and problem identification. An audit trail should include sufficient information to establish what events occurred and who or what caused them. The audit trail can also be used to document the reliability of a system as well as attest to the integrity of the records maintained in the system. Ideally, the audit trail should be generated by the system to include such things as the transaction, maintenance and disposition of records as well as the modification of records, fields or of the system itself.

(4) The storage of records on electronic media. Draft finales (or official copies of record) may be created and maintained solely in electronic media. Electronic records with a set retention that can be destroyed within 10 years may be sent to the SRCA for storage in the electronic media vault and upon meeting their retention may be destroyed by the SRCA per 1.13.30 NMAC Destruction of Public Records.

(5) Draft finales (or official copies of record) may be created and maintained solely in electronic media.

(6) Preservation- the records shall be in a form that can be physically preserved. Records created and maintained on local hard drive(s) are the working copies or draft copies of official records created by and for state government. Once a draft final is produced (paper, microfilm, electronic), these working copies or draft copies are no longer needed and are considered non-records. Final drafts shall be generated in paper, microform, or electronic media. Draft copies or working copies shall be transferred to recycle bin for destruction after no longer needed for reference.

(7) Records may be created and maintained on a system network drive(s). Records placed on a network drive(s) are meant to be shared by the users of the network. Users not creating a record (document) may only have read and copy access to the record. Records on the network drive(s) may be draft copies or final drafts of agency documents. Electronic records from outside sources may also be placed on an agency’s network drive(s) as a means of disseminating information. Records placed on network drive(s) are not the agency’s official copies of record. They are placed on network drives to disseminate information only and are considered non-records. Non-records may be destroyed by the custodial agency when the record no longer has any informational value to the agency. However, if a record has been created on a network drive, it shall be copied to paper, microform or electronic media and maintained until its retention has been met. To ensure that records maintained on a network drive(s) are accessible and to ensure that proper records and information management principles are followed, the following guideline shall be adhered to.

(a) Electronic file folders shall be created on the network drive(s) for filing electronic records (documents). The electronic records may be draft copies (working copies) or draft finals.

(b) Names of electronic file folders shall correspond to record series listed and described in records retention and disposition schedules issued by the state records center and archives.

(c) If final draft has been created on network drive, generate copy in paper, microform, or electronic media and retain elsewhere until minimum retention has been attained. When retention has been met, destroy record per 1.13.30 NMAC Destruction of Public Records and Non-records.

(d) Electronic files that are located on a network share and are deleted from a user’s desktop computer, they are deleted permanently and are never transferred to a recycle bin. For information on the destruction of records, see 1.13.30 NMAC Destruction of Public Records and Non-records.

(8) To insure the agency always has available the necessary electronic records to conduct its agency’s program requirements, agency shall backup all electronic records and databases at appropriate time periods and in an appropriate manner to insure that electronic records and databases are protected from accidental or deliberate loss. Electronic records and databases should be backed up, at minimum, on a weekly basis. If major changes or additions are made to electronic records or database groups during the week, backups should be made immediately instead of waiting for the normally scheduled backup. Electronic records and databases that are seldom changed or updated would need to back up only as major changes to the information occur. For cycle rotation of system backup refer to RRDS for General Administrative Records, operations system backup 1.15.2.302 NMAC.

(9) Different backup media (floppies, reels, cassettes, optical disks, disk packs, USB flash drives) retain information for different periods of time before deterioration of the information may begin. The longer the backup media will be retained without replacement of information, the more stable the backup media needs to be.

C. The maintenance and accessibility of electronic records. Agencies shall safeguard all electronic records to insure that individuals do not alter, erase, or in any way change the content of the record for fraudulent purposes. In addition to safeguarding against deliberate tampering with records, agencies shall also guard against storage media deterioration and technology changes that can leave electronic records inaccessible over a period of time because of hardware or software obsolescence. To eliminate the possibility of creating a situation where information can no longer be retrieved, agencies shall provide for future record accessibility by migrating all electronic records when there are major changes to the next generation of hardware or software; or migrating only current electronic records to new hardware or software, and converting records not migrated to “human readable form”.

(1) The migration of information on electronic media. Agencies shall safeguard all electronic records to insure that individuals do not alter, erase, or in any way change the content of the record for fraudulent purposes. In addition to safeguarding against deliberate tampering with records, agencies shall also guard against storage media deterioration and technology changes that can leave electronic records inaccessible over a period of time because of hardware or software obsolescence. To eliminate the possibility of creating a situation where information can no longer be retrieved, agencies shall provide for future record accessibility by:

(a) migrating all electronic records when there are major changes to the next generation of hardware or software; or

(b) migrating only current electronic records to new hardware or software, and converting records not migrated to “human readable form”.

(2) Backup of electronic records. To insure the agency always has available the necessary electronic records to conduct its agency’s program requirements, agency shall backup all electronic records and databases at appropriate time periods and in an appropriate manner to insure that electronic records and databases are protected from accidental or deliberate loss.

(a) Backup frequency. Electronic records and databases should be backed up, at minimum, on a weekly basis. If major changes or additions are made to electronic records or database groups during the week, backups should be made immediately instead of waiting for the normally scheduled backup. Electronic records and databases that are seldom changed or updated would need to back up only as major changes to the information occur. For cycle rotation of system backup refer to RRDS for General Administrative Records, operations system backup 1.15.2.302 NMAC.

(b) Backup media. Different backup media (floppies, reels, cassettes, optical disks, disk packs, USB flash drives) retain information for different periods of time before deterioration of the information may begin. The longer the backup media will be retained without replacement of information, the more stable the backup media needs to be.

(3) Permanent, permanent-archival, or long-term records on electronic media. Permanent public records are either maintained permanently by and at the custodial agency or by the custodial agency in an appropriate environmental setting. Permanent-archival records are scheduled in the custodial agency’s records retention and disposition schedule to be transferred to the SRCA permanently or transferred to the SRCA for review and final disposition.

[1.13.3.11 NMAC - Rp, 1.13.3.11 NMAC, 6/30/2008]

1.13.3.12 PERMANENT ELECTRONIC RECORDS MAINTAINED BY THE CUSTODIAL AGENCY. If the custodial agency opts to maintain their permanent electronic records on-site, the custodial agency shall develop and implement guidelines and procedures that address the following elements of an on-site archival program.

A. Policy. Develop an archives repository written policy for access to agency permanent electronic records that addresses the following areas:

(1) program objectives;

(2) system reliability;

(3) custody - legal and physical;

(4) rationale for alternatives adopted;

(5) processibility;

(6) migration;

(7) archives repository or outsource implementation; and

(8) audit for compliance.

B. Quality control. Develop written quality control procedures that take into account the following:

(1) utilization of the functionalities of an archival preservation system software;

(2) document any action taken with regard to facilitating long-term access to electronic records;

(3) insert documentation records into the encapsulation wrapper that contains the relevant electronic records; and

(4) periodic quality control audits.

C. Environmental control and monitoring program recommendation. Ensure the continued readability of electronic records by putting in place a program that provides for a stable storage environment and good care and handling procedures. Such a program should include the following:

(1) maintain a stable storage environment in which the temperature is 59 plus or minus 5 degrees fahrenheit and the relative humidity (RH) is 40 percent;

(2) install a filter system to remove airborne dust particles and gas pollutants;

(3) prohibit the consumption of food and beverages and smoking in the storage facility;

(4) implement a program to read annually a statistical sample of the storage media to identify real or impending catastrophic loss of information;

(5) select all storage units (e.g., videocassette tapes, computer disks) annually if there are fewer than 50 of them;

(6) select a 20 percent random sample of the storage media when the total number of storage units. ranges between 50 and 1809;

(7) select a random sample of 381 items of the storage media when the total number of storage media is 1810 or greater; and

(8) rewind all tapes under constant tension after processing.

D. Transfer of records. Guidelines for the transfer of electronic records that include the following:

(1) select up to three storage media that are widely used by agencies in their current operations (e.g., 3480 tape cartridges, digital linear tape, and CR-ROM) that may be used to transfer electronic records to the archives repository;

(2) select a standard archival storage medium and encourage agencies and organizations to use it when transferring electronic records; and

(3) all electronic records transferred shall be encoded with a standard encoding scheme such as ASCII.

E. Reformat electronic records. Guidelines for the reformatting of electronic records that include the following:

(1) select either digital linear tape or other suitable tape cartridges as the storage medium;

(2) reformat electronic records at the time of their transfer to the archives repository or when new storage devices and media are installed;

(3) ensure the authenticity of reformatted electronic records by employing a strict quality control procedure that may include bit or byte comparisons, comparisons of hash-digest, or digital time stamping;

(4) utilize the functionalities of an archival preservation system software where possible in order to document fully all actions taken when reformatting electronic records; and

(5) at the time of reformatting, create two copies, one of which would be considered a "backup" that is stored at an off-site location.

F. Copy electronic records. Guidelines for the periodic copying of electronic records that include the following:

(1) copy electronic records at the time of their transfer to the archives repository;

(2) copy electronic records every ten years in the absence of the installation of new storage devices and media;

(3) copy electronic records when the annual readability sample discloses ten or more temporary or read "errors" in a dataset;

(4) ensure the authenticity of copied electronic records by employing a strict quality control procedure that may include bit/byte comparisons, comparisons of hash-digest, or digital time stamping;

(5) utilize the functionalities of an archival preservation system software where possible in order to document fully all actions taken when copying electronic records; and

(6) at the time of copying, create two copies, one of which would be considered a "backup" that is stored at an off-site location.

G. Convert electronic records. Guidelines for the conversion of electronic records that include the following:

(1) the conversion of authentic electronic records from one software environment to another shall not result in the loss of any structure, content, or context;

(2) convert authentic electronic records whenever there is a software upgrade or a new software application environment is installed;

(3) adopt TIFF, PDF or SGML as a standard storage format; at the time of conversion encapsulate aggregated electronic records along with relevant documentation as SGML records;

(4) ensure the authenticity of converted electronic records by employing a strict quality control procedure that may include bit/byte comparisons, comparisons of hash-digest, or digital time stamping; utilize the functionalities of an archival preservation system software where possible in order to document fully all actions taken when converting electronic records;

(5) exercise the option of non-conversion of authentic electronic records only as a last resort when the risk of the loss of authenticity or processibility is acceptable; and

(6) at the time of conversion, create two copies, one of which would be considered a "backup" that is stored at an off-site location.

H. Migrate electronic records. Procedures for the migration (or non-migration) of electronic records that include the following:

(1) establish guidelines that unambiguously delineate the circumstances under which migration of electronic records will be carried out;

(2) establish guidelines that unambiguously delineate the circumstances under which non-migration of electronic records will be carried out;

(3) incorporate into the migration procedure the following ten steps for migrating electronic records from legacy information systems:

(a) incrementally analyze the legacy information system;

(b) incrementally decompose the legacy information system structure;

(c) incrementally design the target interfaces;

(d) incrementally design the target applications;

(e) incrementally design the target database;

(f) incrementally install the target environment;

(g) incrementally create and install the necessary gateways;

(h) incrementally migrate the legacy databases;

(i) incrementally migrate the legacy applications;

(j) incrementally migrate the legacy interfaces;

(k) incrementally cut over to the target information;

(4) establish migration quality control procedures that include testing the migration software with a sample of records to confirm that no degradation in the records occurs;

(5) validate migrated electronic records with records in the source legacy information system to ensure that no errors occur;

(6) if financial or technical resources preclude the migration of electronic records without some loss in content, structure, or context, document all the activities undertaken in order to establish the reliability of the new records that come into existence;

(7) in executing a "non-migration" option that transfers electronic records to paper or microfilm a visual inspection of a sample of these records should be compared with their electronic counterparts.

I. Starting a long-term electronic records access program. Guidelines and procedures that include the following:

(1) develop a policy that calls for an integrated information technology plan that serves the overall goals and mission of the archival repository;

(2) develop a five to seven year information technology plan that is based upon a realistic assessment of the financial resources that are likely to be available to the organization;

(3) design a system that is geared to the specific needs and resources of the archival repository and for which computer literate and technically competent staff is available; and

(4) assess the long-term costs and benefits of a "scaled back program" and where the benefits are marginal consider other storage alternatives such as paper or microfilm.

J. Multi-institutional cooperative programs. Guidelines and procedures that include the following:

(1) develop a formal organizational structure for the participating archives repositories and a formal agreement (and legally binding) with the cooperative electronic records archives repository;

(2) guarantee funding of the program for five years;

(3) delineate explicitly the tasks to be carried out within specified time periods;

(4) require that the findings and recommendations of this report be incorporated into the policy and procedures; and

(5) contract with a competent, independent third party to conduct an annual information technology audit of the cooperative electronic records repository and deliver a report with recommendations to the participating archives repositories.

[1.13.3.12 NMAC - Rp, 1.13.3.12 NMAC, 6/30/2008]

1.13.3.13 DISPOSITION OF ELECTRONIC RECORDS

A. The disposition of electronic record can have two possible avenues, either the information and the record media are destroyed or the information is obliterated. Unlike paper-based records the media for electronic records can remain useful and only the information needs to be destroyed thus the resulting best practices for the destruction of information. An agency will select the best practice based on the media, and the nature or sensitivity of the information. For a local hard disk, items one and two should be sufficient, for other magnetic, optical, or solid-state storage media, agency information systems staff should be consulted:

(1) erasure from electronic media and all back up media;

(2) emptying of electronic trash receptacle;

(3) witnessed overwriting of reusable magnetic media multiple times such as suggested by the US department of defense;

(4) witnessed degaussing of the magnetic media; and

(5) witnessed physical destruction of the media.

B. Permanent-archival records on electronic media transferred to the SRCA. Permanent-archival records are scheduled in the general records retention and disposition schedule or the custodial agency’s records retention and disposition schedule to be transferred to the SRCA permanently or transferred to the SRCA for review and final disposition. When permanent public records on electronic media are transferred to the SRCA, the custodial agency shall meet the following criteria.

(1) Media. Records shall be transferred only on optical disc, adhering to the international organization for standardization 9660 or high sierra standard for readability using eight-dot three file naming.

(2) Format. Since data formats can become obsolete, only those formats with the widest support, and greatest permanence shall be used to store public records. The nature of the information stored shall dictate its storage format. For example:

(a) Audio information. Format this information as MPEG files.

(b) Audio and visual information. Format this information as MPEG files.

(c) Picture or graphic files. Format these files as JPEG, BMP, or TIFF files.

(d) General business information files. Format per the architectural configuration requirement published by the state information and technology management office regarding software utilized by state agencies.

(3) Metadata. Metadata shall be provided on either individual records (documents) or on the entire records series. Records shall be transferred with the following essential metadata fields:

(a) title

(b) subject;

(c) originator (name of custodial agency);

(d) dates (inclusive dates of records, dates records created);

(e) identifier (i.e., RRDS code, RRDS section number, schedule item number).

[1.13.3.13 NMAC - Rp, 1.13.3.13 NMAC, 6/30/2008]

HISTORY OF 1.13.3 NMAC:

History of Repealed Material:

1.13.3 NMAC, Management of Electronic Records, filed 6/30/2003 - Repealed, 6/30/2008.