[Federal Register Volume 63, Number 139 (Tuesday, July 21, 1998)]
[Notices]
[Pages 39196-39202]
From the Federal Register Online via the Government Publishing Office [www.gpo.gov]
[FR Doc No: 98-19468]


-----------------------------------------------------------------------

NATIONAL ARCHIVES AND RECORDS ADMINISTRATION


Electronic Records Work Group Draft Report; Appendix E

AGENCY: National Archives and Records Administration (NARA).

ACTION: Request for comment.

-----------------------------------------------------------------------

SUMMARY: This notice contains the Electronic Records Work Group's 
proposed general records schedule (GRS) to cover information technology 
records common to many or all Federal agencies. The proposed GRS would 
implement the Work Group's proposed recommendation that NARA should 
revise GRS 20 disposition authorities to cover only systems 
administration (or systems management) and operations records and that 
the new schedule should cover only administrative records. Agency 
systems records for program (mission-related) activities will not be 
covered by the proposed GRS.
    The Work Group intends to recommend to the Archivist a proposed new 
GRS for information technology records based on the comments received 
during this comment period. Because we expect a number of comments on 
fundamental issues relating to the approach that the GRS should take 
and the records that should be covered, we believe that the draft that 
will be submitted to the Archivist of the United States in September 
will require an additional Federal Register comment period before NARA 
issues it in final form.

DATES: Comments must be received on or before August 20, 1998.

ADDRESSES: Comments may be sent electronically to the e-mail address 
<[email protected]>. We ask that lengthy attachments be sent in 
ASCII, WordPerfect 5.1/5.2, or MS Word 6.0 format. If you do not have 
access to e-mail, comments may be mailed to Electronic Records Work 
Group (NPOL), Room 4100, 8601 Adelphi Rd., College Park, MD 20740-6001, 
or faxed to 301-713-7270.


[[Page 39197]]


FOR FURTHER INFORMATION CONTACT: Michael Miller at 301-713-7110, ext. 
229.

SUPPLEMENTARY INFORMATION: The proposed GRS is contained in Appendix E, 
which appears at the end of this document. Your comments are requested 
on the proposed GRS and in response to the following questions:
    E1. Do the items in the proposed GRS accurately describe records 
with which you are familiar? Please identify any items (series) that do 
not reflect systems administration records as currently practiced.
    E2. Unlike GRS 20, this proposal divides records into more detailed 
groupings and provides specific retentions for each. Is this helpful? 
Would agencies prefer this approach with greater detail and separate 
dispositions for each specific type of record, or an approach that 
combines multiple detailed items into larger series with a single 
disposition whenever appropriate?
    E3. The proposed GRS is not presented in the format normally used 
in the GRS. Do you find this chart format helpful?
    E4. Would fewer, more uniform retention periods better suit agency 
needs? Discussion: Some agencies have suggested that fewer, more 
uniform retention periods that are tied to a specific date (e.g., when 
3 years old) and not an event (e.g., after 3 backup cycles) are easier 
to implement for series covered by a GRS.
    E5. Does your agency have other information technology (IT) records 
relating to administrative functions not described in this proposed GRS 
that could be included in a GRS? You are reminded that the GRS will not 
cover an agency's program (mission-related) records. For a complete 
discussion of the distinctions between program records and 
administrative records, please see the introduction to the draft 
Appendix D, which is presented in a separate notice earlier in this 
separate part.

    Dated: July 16, 1998.
Lewis J. Bellardo,
Deputy Archivist of the United States.

Appendix E: Proposed General Records Schedule, Information 
Technology Records

    The Electronic Records Work Group has developed a preliminary draft 
of a General Records Schedule that would provide disposition 
authorities for records specifically related to the development, 
management and operation of computer systems, and digital networks. 
Records include those relating to system development and 
implementation, computer and network operations and technical support, 
office automation and user support, and data administration. The 
schedule is designed to conform with common practices in information 
technology (IT) management and operations.
    The most significant differences between this draft schedule and 
the 1995 version of GRS 20 is that the proposed draft GRS eliminates 
disposition instructions for:
    1. Electronic source records generated or received on e-mail and 
word processing applications for all program and agency-unique 
administrative records (items 13 and 14 in the 1995 GRS 20).
    2. Electronic records that support administrative housekeeping 
functions when the records are derived from or replace paper records 
authorized for disposal in an agency-specific schedule (item 3b in the 
1995 GRS 20).
    3. Electronic source records scheduled for disposal under one or 
more items in GRS 1-16, 18, and 23 (item 3a in the 1995 GRS 20).
    Under the Work Group's second recommendation, NARA will include 
coverage for the third item in revisions to those GRS (see appendix D), 
but the first two items will have to be included in agency specific 
schedules.
    This preliminary draft also covers a wider variety of IT 
operational records and the descriptions it includes more accurately 
mirror current records and terminology. Because we believe that the IT 
community should be encouraged to review the draft GRS, the Work Group 
has formatted it in a style that we hope will be more familiar to them 
than the traditional GRS format.
    The Work Group seeks comments on both the items to be included and 
the proposed retention periods, and reminds reviewers that GRS 
retention periods are mandatory unless the agency receives a specific 
exception from NARA.
    When NARA issues a final version that reflects Federal agency and 
public comments, it will follow the format normally used in the GRS.
Transmittal No. XX
General Records Schedule XX

General Records Schedule XX

Information Technology (IT) Records

    Information Technology (IT) records include general administration 
records of data processing units, systems development records, computer 
operation and technical support records, data administration support 
records, user and office automation support records, network and data 
communication services records, and, Internet services records. (GRS 
12, Communications Records is under review and will have to be modified 
at a later date to address redundancies.) As defined in the Information 
Technology Reform Act of 1996, the term ``information technology,'' 
with respect to an executive agency means ``any equipment or 
interconnected system or subsystem of equipment, that is used in the 
automatic acquisition, storage, manipulation, management, movement, 
control, display, switching, interchange, transmission, or reception of 
data or information by the executive agency.'' The term ``includes 
computers, ancillary equipment, software, firmware and similar 
procedures, services (including support services), and related 
resources.''
    This General Records Schedule for IT records does not cover 
electronic records that support the agency's mission-related (program) 
functions and activities. Program managers and staff are responsible 
for developing and applying retention schedules to those electronic 
records retained to meet program-specific requirements. Data processing 
units are often the physical custodian of program IT records. Program 
IT records must be retained to meet retention requirements specified by 
the program area.
    IT records not included in this schedule must be scheduled 
separately by the program having the responsibility and authority to 
determine their retention requirements and final disposition.
    This schedule covers the records described in the following chart, 
wherever located within an agency. Agencies should develop and 
implement procedures for effective purging of electronic records from 
automated information systems on a regular basis. Intermediate storage 
of electronic records covered by this GRS can include down-loading them 
to off-line storage media such as magnetic tapes or diskettes, prior to 
final disposition, i.e., deletion or erasure. Records should be 
destroyed when the retention period has been met, unless the records 
are being used in an audit or legal action. Obsolete records consume 
expensive office space and computer storage capacity, and they can 
hinder efficient access and retrieval of current records.

[[Page 39198]]



------------------------------------------------------------------------
                                                         Authorized     
       Item No.          Description of Records         Disposition     
------------------------------------------------------------------------
1....................  GENERAL ADMINISTRATION      .....................
                        RECORDS                                         
                       General Administration      .....................
                        includes IT fiscal and                          
                        personnel administration,                       
                        planning, and the                               
                        coordination of                                 
                        activities within IT                            
                        units and between an IT                         
                        unit and other parts of                         
                        an agency.                                      
1  a.................  General Information         Destroy when 2 years 
                        Technology Administrative   old.1               
                        Files. Correspondence and/                      
                        or subject files relating                       
                        to internal operation and                       
                        administration of IT                            
                        services matters not                            
                        covered elsewhere in this                       
                        schedule or in another                          
                        GRS.                                            
1  b.................  Information Resources       Destroy 3 years after
                        Management (IRM) and Data   the plan is         
                        Processing Services         completed,          
                        Plans. Data processing      superseded, or      
                        services plans, and         revised. Destroy    
                        related records used to     copies, drafts, and 
                        plan for information        routine material    
                        systems development,        when no longer      
                        technology acquisitions,    needed by agency.   
                        data processing services                        
                        provision, or related                           
                        areas.                                          
                       Records Not Covered:        .....................
                       IRM strategic plans and     .....................
                        Information Technology                          
                        Investment Reviews are                          
                        program records and must                        
                        be scheduled separately                         
                        by the agency.                                  
1  c.................  Data Processing Policies.   Destroy 3 years after
                        Records of data             policy is withdrawn,
                        processing policies         revised, updated, or
                        including those covering    superseded.         
                        access and security,                            
                        systems development, data                       
                        retention and                                   
                        disposition, and data                           
                        ownership.                                      
                       Records Not Covered:                             
                       1. Data processing          .....................
                        policies for specific                           
                        mission systems, which                          
                        must be scheduled                               
                        separately by the agency.                       
                        (Data processing policies                       
                        for specific systems that                       
                        are central to the                              
                        conduct of the agency's                         
                        mission may be permanent                        
                        records.).                                      
                       2. Data processing                               
                        operating procedures (see                       
                        item 3a).                                       
1 \2\  d.............  Data Center Records of      Destroy when 3 years 
                        Calculating Charge--backs   old.                
                        to Data Processing                              
                        Services Users.                                 
                        Electronic and manual                           
                        records used to document,                       
                        and calculate costs, for                        
                        computer usage and data                         
                        processing services.                            
                        These records are also                          
                        used for cost recovery,                         
                        budgeting, or                                   
                        administrative purposes.                        
1 \3\  e.............  Data Center Billing         Destroy when 3 years 
                        Records. Reports and        old.                
                        other records detailing                         
                        charges for use of                              
                        computer services                               
                        including monthly billing                       
                        reports, copies of                              
                        vouchers and bills.                             
                       Note: Before disposing of   .....................
                        these records, agencies                         
                        must ensure that no legal                       
                        actions have been                               
                        initiated which might                           
                        require access to them.                         
                        If a case-by-case review                        
                        of files is impractical,                        
                        the records should be                           
                        retained an additional 3                        
                        months beyond the minimum                       
                        retention period.                               
2....................  SYSTEMS DEVELOPMENT         .....................
                        RECORDS                                         
                       Systems development covers  .....................
                        the IT functions related                        
                        to the development,                             
                        redesign, modification,                         
                        procurement, and testing                        
                        of administrative systems                       
                        as well as to maintaining                       
                        the documentation                               
                        generated by these                              
                        processes.                                      
                       Note: Records documenting                        
                        specific agency mission                         
                        systems are NOT covered                         
                        by items 2a through 2c,                         
                        and will need to be                             
                        scheduled separately by                         
                        the agency.                                     
2  a.................  Systems Development         Destroy 3 years after
                        Project Files. Records      completion of       
                        created and used in the     project.            
                        development, redesign, or                       
                        modification of an                              
                        automated system for                            
                        administrative functions                        
                        including project                               
                        management records,                             
                        status reports, draft                           
                        system or subsystem                             
                        specifications, draft                           
                        user requirements and                           
                        specifications, and                             
                        memoranda and                                   
                        correspondence.                                 
2 \4\  b.............  Data Systems                Destroy 3 years after
                        Specifications. User and    discontinuance or   
                        operational documentation   replacement of the  
                        for administrative          system, or after all
                        systems describing how a    records on the      
                        system operates from a      system are either   
                        functional user and data    successfully        
                        processing point of view    migrated to a new   
                        including records           system or final     
                        documenting data entry,     disposition actions 
                        manipulation, output and    on them are         
                        retrieval (often called     completed, whichever
                        ``system documentation      is later.           
                        records''), records                             
                        necessary for using the                         
                        system, including user                          
                        guides, system or sub-                          
                        system definitions,                             
                        system flowcharts,                              
                        program descriptions and                        
                        documentation, job                              
                        control or work flow                            
                        records, system                                 
                        specifications, and input                       
                        and output specifications.                      
2  c.................  Data Documentation. Data    Destroy 3 years after
                        system and file             discontinuance of   
                        specifications created      system or after     
                        during development or       system's data is    
                        modification of             destroyed or        
                        administrative systems      transferred to a new
                        and necessary to access,    structure or format,
                        retrieve, manipulate and    whichever is later. 
                        interpret data in an                            
                        automated system.                               
                        Includes data element                           
                        dictionary, information                         
                        directories, database                           
                        directories, file layout,                       
                        code book or table, and                         
                        other records that                              
                        explain the meaning,                            
                        purpose, structure,                             
                        logical relationships,                          
                        and origin of the data                          
                        elements.                                       
                       Note: In some cases,                             
                        agencies will retain data                       
                        for extended periods,                           
                        sometimes off-line. It is                       
                        essential that they                             
                        retain related                                  
                        documentation in an                             
                        accessible format.                              
2 \5\  d.............  Automated Program Listing/  Retain for 3 system  
                        Source Code. Automated      update cycles after 
                        program code which          code is superseded  
                        generates the machine-      or replaced, then   
                        language instructions       destroy.            
                        used to operate an                              
                        automated information                           
                        system.                                         
                       Note: This item coincides                        
                        with item 3e, System                            
                        Backup Files. It assumes                        
                        that the files are                              
                        maintained (backed-up)                          
                        and disposed in                                 
                        accordance with accepted                        
                        data processing practice;                       
                        i.e., that 3 generations                        
                        of backups be retained                          
                        (see item 3e). If this                          
                        item is adopted into the                        
                        GRS, there will be a note                       
                        excluding code created to                       
                        ``fix'' Year 2000                               
                        problems.                                       
2  e.................  Technical Program           Destroy 1 year after 
                        Documentation. Paper copy   replacement,        
                        of program code, program    modification, or    
                        flowcharts, program         related programs    
                        maintenance log, system     cease to be used.   
                        change notices, and other                       
                        records that document                           
                        modifications to computer                       
                        programs.                                       
2 \6\  f.............  Information Technology                           
                        Procurement Files.                              
                        Records used in the                             
                        procurement of system                           
                        hardware and software                           
                        including request for                           
                        proposals, proposals,                           
                        quotations and bids,                            
                        benchmark/acceptance                            
                        testing information,                            
                        correspondence, duplicate                       
                        copies of contracts,                            
                        purchase orders,                                
                        technical reviews, and                          
                        vendor information                              
                        including references and                        
                        literature on the firm or                       
                        product line..                                  

[[Page 39199]]

                                                                        
                       (1) Contract-related        Destroy 6 years after
                        records.7.                  expiration of the   
                                                    contract.           
                       (2) All other records.....  Destroy 3 years after
                                                    completion of the   
                                                    purchase.           
2  g.................  Test Database/Files.        Destroy after user   
                        Routine or benchmark data   accepts and         
                        sets, related               management reviews  
                        documentation, and test     and approves test   
                        results constructed or      results, or when no 
                        used to test or develop a   longer needed for   
                        system.                     operational         
                                                    purposes, whichever 
                                                    is later.           
3....................  COMPUTER OPERATIONS AND     .....................
                        TECHNICAL SUPPORT RECORDS                       
                       Computer operation and      .....................
                        technical support covers                        
                        the IT functions related                        
                        to operating systems,                           
                        maintaining hardware and                        
                        software, system                                
                        security, data input                            
                        services, system backup,                        
                        tape library operations,                        
                        job and production                              
                        control, monitoring                             
                        system usage, and liaison                       
                        with hardware and                               
                        software vendors.                               
3  a.................  Data Processing Operating   Destroy 3 years after
                        Procedures. Records of      procedure is        
                        procedures for data         withdrawn, revised, 
                        entry, the operation of     updated, or         
                        computer equipment,         superseded.         
                        production control, tape                        
                        library, system backup,                         
                        and other aspects of a                          
                        data processing operation.                      
3  b.................  Data Processing Hardware                         
                        Documentation.                                  
                       (1) Records documenting     Destroy after the    
                        the use, operation, and     agency no longer    
                        maintenance of an           uses related        
                        agency's data processing    hardware and all    
                        equipment including         data is transferred 
                        operating manuals,          to and made useable 
                        hardware/operating system   in new hardware     
                        requirements, hardware      environment.        
                        configurations, and                             
                        equipment control systems.                      
                       (2) Routine records that    Destroy when one year
                        do not contain              old.                
                        substantial information                         
                        on the maintenance                              
                        history or equipment.                           
3  c.................  Operating System and        Destroy 1 year after 
                        Hardware Conversion         successful          
                        Plans. Records relating     conversion.         
                        to the replacement of                           
                        equipment or computer                           
                        operating systems.                              
3 \8\  d.............  Disaster Preparedness and   Destroy after        
                        Recovery Plans. Records     superseded by       
                        related to the protection   revised plan.       
                        and reestablishment of                          
                        data processing services                        
                        and equipment in case of                        
                        a disaster.                                     
                       Note: Agencies should       .....................
                        store disaster                                  
                        preparedness and recovery                       
                        plans in a secure area                          
                        off-site from the                               
                        computer installation to                        
                        which they refer.                               
3  e.................  System Backup Files.        Destroy after 3      
                        Copies of master files or   system backup       
                        databases, application      cycles.             
                        software, logs,                                 
                        directories, and other                          
                        records needed to restore                       
                        a system in case of a                           
                        disaster or inadvertent                         
                        destruction.                                    
                       Records Not Covered:        .....................
                       Backups used to document    .....................
                        transactions or retained                        
                        for purposes other than                         
                        system security should be                       
                        scheduled by the                                
                        responsible program. For                        
                        fiscal systems, monthly                         
                        system backups are often                        
                        retained for the entire                         
                        fiscal year to provide an                       
                        audit trail, and annual                         
                        system backups are                              
                        retained to meet all                            
                        legal and fiscal                                
                        requirements in lieu of                         
                        copies of the individual                        
                        master files or                                 
                        databases. These records                        
                        should be disposed using                        
                        items from General                              
                        Records Schedule 7--                            
                        Expenditure Accounting                          
                        Records, or, if they are                        
                        covered by specific                             
                        Federal audit                                   
                        requirements requiring                          
                        longer records retention,                       
                        scheduled separately by                         
                        the appropriate program.                        
                       Note: It is advisable that                       
                        for many application                            
                        systems 2 or 3 copies of                        
                        backups be produced                             
                        during each cycle.                              
3 \9\  f.............  System Users Access         Destroy after the    
                        Records. Electronic or      individual no longer
                        textual records created     has access to the   
                        to control or monitor       system and after    
                        individual access to a      audit requirements  
                        system and its data         for the records     
                        created for security        modified by that    
                        purposes, including but     individual have been
                        not limited to user         met.10              
                        account records, security                       
                        logs, and password files.                       
                       Note: Computer Usage                             
                        Records (item 3g) may                           
                        also serve some security                        
                        purposes                                        
3  g.................  Computer Usage Files.       Destroy after 3      
                        Electronic files or         system backup       
                        automated logs created to   cycles.             
                        monitor computer system                         
                        usage including but not                         
                        limited to log-in files,                        
                        system usage files,                             
                        charge-back files, data                         
                        entry logs, and records                         
                        of individual computer                          
                        program usage.                                  
                       Records Not Covered:                             
                       Security logs and related                        
                        records (see item 3f)                           
3  h.................  Summary Computer Usage      Destroy when 1 year  
                        Reports. Summary reports    old.                
                        and other paper records                         
                        created to document                             
                        computer usage for                              
                        reporting or cost                               
                        recovery purposes.                              
3  i.................  Computer Run Scheduling     Destroy when 1 year  
                        Records. Records used to    old.                
                        schedule computer runs                          
                        including daily                                 
                        schedules, run reports,                         
                        run requests, and other                         
                        records documenting the                         
                        successful completion of                        
                        a run.                                          
3  j.................  Data Processing Unit's      Destroy after output 
                        Copies of Output Reports.   is distributed.     
                        Data processing unit's                          
                        copy of output reports                          
                        produced for client                             
                        programs.                                       
3  k.................  Tape Library Records......                       
                       (1) Automated System        Destroy after related
                        Files. Automated records    records or media are
                        used to control the         destroyed or        
                        location, maintenance,      withdrawn from the  
                        and disposition of          tape library.       
                        magnetic media in a tape                        
                        library.                                        
                       (2) Tape Library Control    Destroy after        
                        Records. Records used to    superseded.         
                        control the location,                           
                        maintenance, and                                
                        disposition of magnetic                         
                        media in a tape library                         
                        including list of                               
                        holdings and control logs.                      
3  l.................  Reports on the Destruction  Destroy after        
                        of Files (``Scratch         superseded or (if   
                        Reports''). Records         required) management
                        containing information on   review and approval.
                        the destruction of files                        
                        stored on electronic                            
                        media in a tape library.                        
4....................  RECORDS CREATED TO                               
                        FACILITATE, OR CREATED IN                       
                        THE COURSE OF, PROCESSING                       
                        OR TRANSMITTING                                 
                        ELECTRONIC RECORDS                              

[[Page 39200]]

                                                                        
                       Records created solely to                        
                        support computer                                
                        processing or                                   
                        communications. Excludes                        
                        all records needed to                           
                        document program or                             
                        administrative functions.                       
4  a.................  Input Documents.            Destroy after all    
                        Electronic and hard copy    data has been       
                        of records or forms         entered into the    
                        designed and used solely    system and, if      
                        for data input and          required, verified. 
                        control when the data                           
                        processing unit provides                        
                        centralized data input                          
                        services and original                           
                        records are retained by                         
                        the program.                                    
                       Records Not Covered:        .....................
                       Input records retained for                       
                        fiscal audit or legal                           
                        purposes, or, containing                        
                        information needed by a                         
                        program, should be                              
                        scheduled by the                                
                        responsible program.                            
                        Input records which serve                       
                        a fiscal audit purpose                          
                        may be covered by items                         
                        in General Records                              
                        Schedule 7--Expenditure                         
                        Accounting Records.                             
4  b.................  Work/Intermediate Files.    Destroy after the    
                        Records used to             transaction is      
                        facilitate the processing   completed.          
                        of a specific job/run or                        
                        to create, update,                              
                        modify, transfer,                               
                        manipulate, or sort data                        
                        within an automated                             
                        system when all                                 
                        transactions are captured                       
                        in a master file, central                       
                        file, valid transaction                         
                        file, or database, and                          
                        the file is not retained                        
                        to provide an audit trail.                      
                       Records Not Covered:                             
                       Intermediate files                               
                        retained to document                            
                        valid transactions, to                          
                        serve as an audit trail,                        
                        or needed for system                            
                        recovery backup.                                
4 \11\  c............  Valid Transaction Files.    Destroy after 3      
                        Records used to update      database/master file
                        and/or document a           backup cycles.      
                        transaction in database                         
                        or master file including                        
                        valid transaction files,                        
                        Data Base Management                            
                        System (DBMS) log, update                       
                        files, and similar                              
                        records, and not retained                       
                        to document a program                           
                        action or for fiscal                            
                        audit purposes.                                 
                       Records Not Covered:                             
                       Records used to document a                       
                        program's actions (e.g.,                        
                        receipt of a voucher,                           
                        issuance of a check), as                        
                        opposed to a strictly                           
                        data processing                                 
                        transaction, or needed                          
                        for fiscal audit or legal                       
                        purposes, should be                             
                        separately scheduled by                         
                        the responsible program.                        
4 \12\  d............  Print Files (Not Used to    Destroy after all    
                        Document a Transaction).    print runs are      
                        Source output data          completed, output   
                        extracted from the system   verified (if        
                        to produce hard copy        required), and      
                        publications, printouts     agency has no need  
                        of tabulations, ledgers,    to reproduce the    
                        registers, reports, or      report.             
                        other documents.                                
4  e.................  Database Audit Trails.      Destroy after 3      
                        Data generated during the   database/master file
                        creation of a master file   backup cycles.      
                        or database used to                             
                        validate a master file or                       
                        database during a                               
                        processing cycle.                               
4  f.................  Summary Data Files.         Destroy after data is
                        Summary or aggregate data   distributed.        
                        from a master file or                           
                        database and created                            
                        solely to distribute data                       
                        to individuals or                               
                        programs for reference                          
                        and use, but not altered                        
                        or augmented to support                         
                        program-specific needs.                         
                       Records Not Covered:                             
                       Summary files altered or                         
                        augmented to support                            
                        program-specific needs                          
                        should be separately                            
                        scheduled by the                                
                        responsible program.                            
4  g.................  Extracted Data Files.       Delete when the      
                        Electronic files            agency determines   
                        consisting solely of        they are no longer  
                        records extracted from a    needed for          
                        single master file or       administrative,     
                        data base.                  legal, audit, or    
                                                    other operational   
                                                    purposes.           
                       Records Not Covered:                             
                       Extract files (1) produced                       
                        as disclosure free files                        
                        to allow public access to                       
                        data; or (2) produced by                        
                        an extraction process                           
                        which changes the                               
                        informational content of                        
                        the source master file or                       
                        data base; or, (3)                              
                        records consisting of                           
                        extracted information                           
                        created from a master                           
                        file or data base that is                       
                        unscheduled; or (4)                             
                        extracted from a                                
                        permanent master file                           
                        that cannot be accessed                         
                        or no longer exists.                            
                        These extract records                           
                        should be separately                            
                        scheduled by the                                
                        responsible program.                            
4  h.................  Finding Aids (Indexes) or   Destroy after the    
                        Tracking Systems.           related hard copy or
                        Electronic indexes,         electronic records  
                        lists, registers, and       have been destroyed.
                        other finding aids used                         
                        only to provide access to                       
                        the temporary hard copy                         
                        and electronic records in                       
                        the custody of the data                         
                        processing unit.                                
                       Records Not Covered:                             
                       Finding aids and tracking                        
                        systems of programs other                       
                        than data processing                            
                        units should be scheduled                       
                        by the responsible                              
                        program in conjunction                          
                        with the related program                        
                        records                                         
5....................  DATA ADMINISTRATION                              
                        RECORDS                                         
                       Data administration covers                       
                        IT functions related to                         
                        data administration                             
                        support including the                           
                        maintenance of data                             
                        standards, corporate data                       
                        models, and data                                
                        definitions and                                 
                        dictionaries.                                   
5 \13\  a............  Data/Database Dictionary    Destroy after        
                        Records. Usually in an      discontinuance or   
                        automated system, used to   modification of the 
                        manage data in an           related application 
                        agency's information        or after the        
                        systems including           application's data  
                        information on data         is destroyed or     
                        element definitions, data   transferred to a new
                        structures or file          structure or format,
                        layout, code tables, and    whichever is later. 
                        other data attribute                            
                        information or records                          
                        that explain the meaning,                       
                        purpose, logical                                
                        relationships, ownership,                       
                        use, or origin of data.                         
5  b.................  Data/Database Dictionary    Destroy when         
                        Reports. Periodic           superseded or when  
                        printouts from a data/      data/database       
                        database dictionary         dictionary system is
                        system including data       changed or          
                        element attribute           eliminated.         
                        reports, database schema,                       
                        and related records used                        
                        for reference purposes.                         
                       Records Not Covered:        .....................
                       The official copy of        .....................
                        essential data                                  
                        documentation is covered                        
                        by either item 2c or item                       
                        5a.                                             
6....................  USER/OFFICE AUTOMATION                           
                        SUPPORT RECORDS                                 

[[Page 39201]]

                                                                        
                       User/Office Automation      .....................
                        Support refers to IT                            
                        functions that provide                          
                        work station support to                         
                        users of a mainframe or                         
                        office automation system,                       
                        including assisting users                       
                        to solve software and                           
                        hardware problems,                              
                        installing hardware or                          
                        software, providing                             
                        training, and the review                        
                        and recommendation of                           
                        software for agency use.                        
6 \14\  a............  Site/Equipment Support      .....................
                        Files. Records                                  
                        documenting support                             
                        services provided to                            
                        specific data processing                        
                        equipment or                                    
                        installations.                                  
                       (1) Site visit reports,     Destroy when 3 years 
                        problem and equipment       old.                
                        service reports, and                            
                        routine correspondence                          
                        and memoranda.                                  
                       (2) Service histories and   Destroy after the    
                        other summary records.      related equipment is
                                                    no longer in use.   
6 \15\  b............  Help Desk Telephone Logs    Destroy when 1 year  
                        and Reports. Records used   old.                
                        to document requests for                        
                        technical assistance and                        
                        responses to these                              
                        requests as well as to                          
                        collect information on                          
                        the use of computer                             
                        equipment for program                           
                        delivery, security, or                          
                        other purposes.                                 
6  c.................  Training Course             Destroy when 5 years 
                        Information. Memoranda,     old or 5 years after
                        flyers, catalogues,         completion of a     
                        registration forms,         specific training   
                        rosters, and other          program.            
                        records relating to                             
                        training courses run by a                       
                        data processing user                            
                        support or office                               
                        automation support unit.                        
6  d.................  Software Review and         Destroy after        
                        Recommendation Files.       software is no      
                        Records related to the      longer used by      
                        review and                  agency.             
                        recommendations for                             
                        software for agency use                         
                        including vendor                                
                        information, manuals,                           
                        software reviews, and                           
                        related material.                               
7 \16\...............  NETWORK/DATA COMMUNICATION                       
                        SERVICES RECORDS                                
                       Network and Data            .....................
                        Communication Services                          
                        covers IT functions                             
                        related to installing and                       
                        maintaining networks,                           
                        diagnosing and                                  
                        coordinating problems on                        
                        the network, monitoring                         
                        circuit usage, and                              
                        liaison with General                            
                        Services Administration                         
                        and other network                               
                        providers. For related                          
                        records, see General                            
                        Records Schedule 12,                            
                        Communications Records.                         
7  a.................  Network Site/Equipment      .....................
                        Support Files. Records                          
                        documenting support                             
                        services provided to                            
                        specific sites and                              
                        computer to computer                            
                        interfaces on a network                         
                        including site visit                            
                        reports, trouble reports,                       
                        service histories, and                          
                        correspondence and                              
                        memoranda.                                      
                       (1) Site visit reports,     Destroy when 3 years 
                        trouble reports, and        old.                
                        routine correspondence                          
                        and memoranda.                                  
                       (2) Service histories and   Destroy after the    
                        other summary records.      related equipment or
                                                    site is no longer in
                                                    use.                
                       (3) Routine records that    Destroy on an annual 
                        do not contain              basis.              
                        substantial information                         
                        on the maintenance                              
                        history or site.                                
7  b.................  Inventories of Circuits.    Destroy after the    
                        Automated or paper          circuit is no longer
                        records containing          used by agency.     
                        information on network                          
                        circuits used by the                            
                        agency including circuit                        
                        number, vendor, cost per                        
                        month, type of                                  
                        connection, terminal                            
                        series, software, contact                       
                        person, and other                               
                        relevant information                            
                        about the circuit.                              
7 \17\  c............  Network or Circuit          Destroy 1 year after 
                        Installation and Service    request is filled or
                        Files. Copies of requests   repairs are made.   
                        for data communication      Records that are    
                        service, installation, or   related to a legal  
                        repair and related          action are removed  
                        records including work      from the file and   
                        orders, correspondence,     filed elsewhere.    
                        memoranda, work                                 
                        schedules, copies of                            
                        building or circuitry                           
                        diagrams, and copies of                         
                        fiscal documents.                               
7  d.................  Network Usage Files.        Destroy after 3      
                        Electronic files or         system backup cycles
                        automated logs created to   after creation.     
                        monitor network usage                           
                        including but not limited                       
                        to log-in files and                             
                        system usage files.                             
7  e.................  Network Usage Reports.      Destroy 1 fiscal year
                        Summary reports and other   after creation.     
                        records created to                              
                        document computer usage                         
                        for reporting or other                          
                        purposes.                                       
7  f.................  Network Implementation      Destroy after        
                        Project Files. Agencies'    superseded.         
                        records used to plan and                        
                        implement a network                             
                        including reports,                              
                        justifications, working                         
                        diagrams of proposed                            
                        network, wiring                                 
                        schematics, and diagrams.                       
8....................  INTERNET SERVICES RECORDS   .....................
                       Internet Services covers    .....................
                        records related to                              
                        providing and monitoring                        
                        services delivered and                          
                        received via the Internet.                      
8  a.................  Agency Internet Services    Destroy after 3      
                        Logs. Electronic files or   backup cycles, and  
                        automated logs created to   after relevant audit
                        monitor access and use of   and documentation   
                        agency services provided    requirements have   
                        via the Internet,           been met, whichever 
                        including, but not          is later.           
                        limited to, services                            
                        provided via an agency                          
                        gopher site, FTP (file                          
                        transfer protocol), or                          
                        World Wide Web agency                           
                        intranets/extranets, or                         
                        via agency Telnet                               
                        services.                                       
8  b.................  Employee Internet Use       Destroy after 3      
                        Logs. Electronic files or   backup cycles, and  
                        automated logs created to   after review and    
                        monitor and control use     verification,       
                        of the Internet WWW,        whichever is later. 
                        intranets, and extranets                        
                        by agency employees and                         
                        non-employee use logs of                        
                        agency extranets.                               
------------------------------------------------------------------------
\1\ Disposition authorities are stated in this draft as ``destroy when  
  __ years old'' or ``destroy __ years after [event]. The file should be
  closed or ``cut off'' at the end of a fiscal year for the former types
  of records and destroyed __ years later. The file should be closed or 
  cut off after the event for the latter types of records and destroyed 
  __ years after the end of the fiscal year in which the file was cut   
  off.                                                                  
\2\ ISSUE: The records in item 1d are often more than ledger entries.   
  For example, item d can include charts correlating data processing    
  unit operational costs to: (1) the customer's actual or estimated     
  hours of use, (2) the customer's number of full time employees, or (3)
  the customer's percentage of organization size. The Work Group seeks  
  comments on how agencies use these records to assist NARA in          
  determining whether item 1d should (A) be eliminated, (B) refer the   
  reader to GRS 7, item 2, or (C) changed the retention to ``Destroy 6  
  years and 3 months after the close of the fiscal year involved.''?    
\3\ ISSUE: Should this item be deleted because the records already are  
  covered by GRS 6, Item 1a?                                            
\4\ ISSUE: There are concerns about (1) splitting the developmental and 
  technical documentation, and (2) differentiating between systems and  
  applications for administrative functions.   One of the challenges in 
  information technology is the documentation of systems and            
  applications to permit the engineers and programmers to make further  
  use of accumulated knowledge. Is there a way to encourage the         
  retention of information that will preclude ``reinventing the wheel'' 
  with applications and systems engineering?                            

[[Page 39202]]

                                                                        
\5\ Programming changes can appear to work initially, but prove to have 
  problems over a longer period of time. The Work Group specifically    
  invites comments on whether 3 system cycles is sufficient for all     
  administrative systems. Retention of basic programming information can
  be crucial with problems like the Year 2000 conversions. In contrast  
  to item 3e which contains ``copies of master files or databases,      
  application software, logs, directories, and other records needed to  
  restore a system in case of a disaster or inadvertent destruction,''  
  2d deals with the very basic operating system program. (2d is the     
  frame and foundation of the house; 3e is the brick, aluminum siding,  
  and drywall.)                                                         
\6\ This is not the official contract file maintained by the agency     
  procurement office and covered by GRS 3, item 3. Documentation        
  pertaining to system requirements in the RFP, the language used by the
  vendor in proposals and quotes, and the benchmark/acceptance testing  
  information can substantially impact assessment of vendor performance.
  Further, this can impact the specifications of future IT acquisitions.
\7\ ISSUE: Should this item be deleted because GRS 3, Item 3, already   
  covers all? Another alternative that has been proposed is to leave the
  description here, but provide a cross reference to GRS 3, Item 3c.    
\8\ Please see Schedule 18, Item 27.                                    
\9\ Items 3 f, g, and h could be collapsed into one item. Comments on   
  the advisability of doing so are invited. For this draft, item 3f is  
  separate because it focuses upon an individual user (for example, a   
  procurement officer leaves the organization). Item 3g is a general log
  used to spot substantial differences in volume of traffic. Use of item
  3g may trigger an audit of item 3f records (for example, a 40%        
  increase in one unit's use may raise questions about why the increase;
  next step, a look at item 3f). Item 3h is a summary report, used for  
  billing purposes.                                                     
\10\ ISSUE: Can this retention period be easily applied? Is it          
  appropriate for all administrative systems, including security-       
  classified ones?                                                      
\11\ Validity checks are routines in a data entry program that test the 
  input for correct and reasonable conditions, such as numbers falling  
  within a range and correct spelling, if possible. Valid transaction   
  files are the reports of those validity checks.                       
\12\ ISSUE: Disposition of item 4d is impossible to implement in the    
  case of print files that are automatically generated and deleted by   
  applications software. This may be a policy issue as to whether those 
  files should be automatically deleted by the applications software.   
\13\ The disposition for Item 5a is for the operating system records;   
  Item 2c covers the records for planning the system.                   
\14\ In contrast to Item 2, which deals with systems application and    
  development, Item 6 addresses end user support records.               
\15\ These logs can be invaluable in resolving customer complaints,     
  providing appropriate follow-up service, and spotting problem trends  
  in systems and networks.                                              
\16\ GRS 12, Communications Records, is under review and will have to be
  modified at a later date to address redundancies.                     
\17\ Network installation records are included because the history of   
  wiring in buildings, locations of switches, etc., has been a problem. 
  Recent building renovations have revealed that agencies have unused   
  phone lines, which are still live and costing money. Employees had    
  moved to new offices, received new phone numbers, and never had the   
  old phone lines disconnected.                                         

[FR Doc. 98-19468 Filed 7-20-98; 8:45 am]
BILLING CODE 7515-01-P