The Magic 5% You Can't Live Without

Introduction

Protection of business critical information may be the least well understood – or the least appreciated – area of records management. If you’re reading this paper, chances are you already know a great deal about managing records. Certainly this discipline has never been more critical, particularly in light of legislative and compliance requirements, such as the Freedom of Information Act (2000 and Scotland 2002), the Data Protection Act (1998), the Sarbanes Oxley Act (SOX) of 2002 and the growing body of European legislation designed to protect information. In addition, new laws have increased the cost and risk associated with legal discovery processes – a particularly worrisome area in today’s litigious world.

And, chances are you have devoted significant resources and effort to improving your records management strategy and procedures. But have you done enough?

One area of vulnerability for many organisations is ensuring the accessibility and usability of records. Comprising just five percent of an organisation’s total record population, these are vital to enterprise operations. They may contain information needed to ensure business continuity during or shortly after a crisis, for example. Or, they may document legal or financial status and preserve the rights of an organisation’s stakeholders. If critical information is managed properly, your organisation is protected. If it isn’t you’re exposed to risks, such as noncompliance, loss of asset value and high costs associated with restoration and duplication.

Longevity is the fundamental differentiator between business critical information and all other records. This information has enduring value that must be preserved for years or even centuries. Storing them in a box on a shelf somewhere is simply not enough. The preservation process must ensure that business critical information remains secure, accessible and usable over these extreme time frames. Business critical information includes information organisations need to continue operations during or shortly after a crisis. Some document legal and financial status, such as contracts, patents, deeds, x-rays, laboratory notebooks and blueprints. Others preserve the rights of stakeholders. Still others are one of a kind items with historical significance. Vital records are often physical records, such as paper or film. And, as detailed in the following section, every organisation has a uniquely defined set of business critical information.

How business critical information preservation impacts organisational risk

Once you’ve done the difficult work of thinking through your organisation’s mission and using that to define which records are critical, tactical decisions about how to protect them are much more straightforward. Your focus should be on minimising and avoiding the risks associated with inadequate protection of business critical information. And, the key here is preserving access to, and usability of these records.

Without proper preservation, records degrade over time and may be lost forever. The impact on your organisation can be severe. Consider the following risks:

• Loss of use, including the inability to produce business critical information during litigation or reuse/repurpose the record to bring additional revenues into the organisation.
• Costs associated with the outright loss or recovery/repair of improperly stored records. Paper may turn brittle and yellow, photographic images may fade, and film based dyes can fade, become distorted and shrink from “vinegar syndrome.” There’s no time to waste – materials are degrading while you are putting a plan in place. Costs associated with these types of loss will depend on the seriousness (or extent) of damage.
• Damage to corporate reputation, particularly in cases where shareholders have a reasonable expectation that records should have received the highest levels of protection and security.
• Negative impact on business continuance where inadequate analysis has been done to identify the probability of damage or loss of information and its impact on the business.
• Inability to comply with European, central and local government regulations and mandates, including the Freedom of Information Act (2000 and Scotland 2002), the Data Protection Act (1998), and the increased corporate and personal liability associated with such failures.
• Increased exposure during litigation due to the inability to produce requested documentation throughout the discovery process.

Examples of Vital Records

• Contracts
• Patents and intellectual property
• Leases
• Policy manuals
• Articles of incorporation
• Quality Assurance (QA) records
• Blueprints
• Drawings
• Maps
• Customer records
• Corporate papers
• Laboratory notebooks
• Policy or procedure manuals
• Deeds
• Audio tapes
• Video tapes
• Photographs and slides
• X-rays
• Advertisements
• Titles
• Cultural artifacts

Remember, what’s vital for one organization may not be for another. Use your organization’s mission as a guide for determining which records are truly vital.

Business critical information storage

Once you’ve identified your business critical information and know what materials must be preserved, the next step is determining the best way to care for them. Storage is the single most important factor determining the useful life of modern information media. Many organisations use off-site storage for records management. These sites are secure, accessible and offer the required redundancy. And, they are perfectly adequate for standard record retention. However, when it comes to business critical information – records of which long term survival must be ensured – traditional storage approaches are inadequate. Room temperature storage with unregulated humidity levels does not afford the special protection needed for business critical information. As noted earlier, in uncontrolled environments with variable room temperatures and relative humidity levels, paper turns brittle, ink fades and plastics may degrade quickly. In addition, standard storage does not afford maximum protection from catastrophic loss due to natural or man made disasters, including fire, floods and earthquakes. And, in many cases, it does not offer the highest levels of security needed for irreplaceable originals, such as works of art or special documents.

Proper preservation of business critical information calls for a storage solution that provides the following highly specialised features:

• Controlled environments tailored to meet the special requirements of the materials to be preserved, most importantly highly stable temperatures and relative humidity
• Temperature options should range from 18 to 24 degrees Celsius
• Relative humidity options should range from 20 to 50 percent
• Advanced gaseous fire suppression systems to eliminate the risk of water damage
• Multiple levels of security, including 24/7 access control
• Computerised transaction control systems that provide flexible access and chain of custody control to ensure security
• Optional low particulate and contaminant environments via High Efficiency Particulate Air (HEPA) and gas filtration 

Traditional storage solutions

Business critical information storage solutions

Implementing your business critical information programme

When it comes to business critical information, every organisation has three options:

• Do nothing. Business critical information is treated the same as standard information. The information is accessible – for now… maybe. This is the least expensive and highest risk alternative
• Create a partial plan. Some information is protected with various solutions, such as duplication, dispersal and controlled storage. This hit or miss approach may actually incur more risk, because some people and areas of the organisation are afforded more protection than others
• Develop a clear business critical information programme. Business critical information is identified, assessed and protected using the approaches identified in this paper. This option takes a strong corporate and financial commitment, yet reduces risk and maximises protection for the organisation in the long term.

To develop a successful business critical information programme – and protect that magic five percent of records your organisation cannot function without – take the following steps:

• Identify. Using your organisation’s mission as a guide, determine which information is business critical.
• Assess. Evaluate the materials this information comprised of and their current condition.
• Research. Given the materials and their condition, investigate the best approaches and optimal conditions for long term preservation. The Image Permanence Institute offers many helpful resources for doing so—at little to no cost, including:
  • IPI Media Storage Quick Reference
  • IPI Storage Guide for Acetate Film
  • A Consumer Guide to Traditional and Digital Print Stability
  • The Storage Guide for Colour Photographic Materials
• Document. Identify the processes, develop the associated business case and obtain organisational buy-in to ensure support for long term business critical information preservation.
• Protect. Implement your business critical information programme, including:
  • Protective storage using the most secure, environmentally safe and economical means
  • Duplication and/or dispersal with geographic separation
• Reassess. Continually monitor programme effectiveness and periodically revisit your mission to ensure that business critical information is identified in light of ongoing changes.

Additional resources

The National Archives is the UK government’s official archive, containing almost 1,000 years of history, with records ranging from parchment and paper scrolls through to digital files and archived websites. The National Archives give detailed guidance to government departments and the public sector on information management, in order to ensure the survival of records, and advise others throughout the public and private sectors about the care of historical archives. They also publish all UK legislation and advise upon and encourage the re-use of public sector information. On the TNA website you can find numerous resources, including publications that can be downloaded for free. Visit www.nationalarchives.gov.uk

ARMA International is a nonprofit professional association and the authority on managing records and information – both paper and electronic. ARMA offers many publications on its web site (www.arma.com), including:

• Vital Records: Identifying, Managing, and Recovering Business Critical Records
• What Are Vital Records?

The Image Permanence Institute (IPI) is a university based, nonprofit research laboratory devoted to scientific research on the preservation of visual and other forms of recorded information. It is the world’s largest independent laboratory with this specific scope. IPI was founded in 1985 through the combined efforts and sponsorship of the Rochester Institute of Technology and the Society for Imaging Science and Technology. There are many resources on the IPI Web site, including publications you can download for free. Visit www.imagepermanenceinstitute.org.

Author

Tom Benjamin Manager, Vital Records Program, Iron Mountain

Tom joined Iron Mountain with the National Underground Storage (NUS) merger in 1998. He holds a B.A. from Slippery Rock University and has worked in Iron Mountain’s underground facility for the past 17 years. As an expert on vital records, Tom has been invited to present to the National Archives and Records Administration (NARA), Nuclear Information and Records Management Association (NIRMA), Society of American Archivists (SAA) and numerous local ARMA chapter groups.

Technical Advisor

James m. Reilly Director, Image Permanence Institute (IPI)

Jim is well known for his research on the effects of temperature and humidity on library, archives, and museum collections, deterioration of 19^th Century photographic prints, environmental monitoring and control, management of film archives, and the major causes of image deterioration. He is the co-director of the Advanced Residency Programme in Photograph Conservation at George Eastman House. Jim is a consultant to numerous museums and government agencies and is sought after worldwide as a teacher and seminar speaker. He has written extensively on preservation issues, and in 1998 received a Technical Achievement Award from the Academy of Motion Picture Arts and Sciences.