Chapter 08 Information Technology, (IT)

All records of the following functions:

• Compliance;
• Reporting to OMB or elsewhere, as required of the CIO;
• CIO Council;
• Information Assurance;
• System Accreditation;
• Audit Response/Resolution; and
• Information Technology IT) Governance [i.e., Technical Review Group (TRG)].

Cut off files annually.

Destroy/delete 7 years after cutoff. (N1-64-08-12, item 1)

Enterprise Architecture. Identification of IT systems and networks required to perform NARA's mission, and the transitional processes required to implement comprehensive programs to support that mission.  Records may include technical reference models, diagrams, graphics, models, and narratives that describe NARA's baseline architecture, target architecture, and related sequencing plans.

Cut off files annually.

Destroy/delete 7 years after cutoff.  (N1-64-08-12, item 2)

This function pertains to developing and revising internal directives (policy directives, supplements, and interim guidances) in the applicable numbered series of the formal directives system.  Also included are records documenting development of and updates to other guidance products (outside the formal directives system) which are posted on the intranet.

Destroy/delete when superseded. (N1-64-08-12, item 3)

Integration of IT investments with NARA-wide strategic planning, budgeting, procurements, and management.  Case files, maintained by system, may include: routine and periodic reports on IT capital investments; capital asset plans; business cases for major investments, systems, acquisitions, or operational assets identified in NARA's capital investment portfolio; and clearance and review records.

Destroy/delete 5 years after system is retired. (N1-64-08-12, item 4)

Management of each IT system development project through its various stages: concept development, requirements gathering, procurement, implementation, system testing, "go-live," and hand-off to production.  Case files, maintained by system, may include:

• Copies of approved product plan and approvals authorizing the project;
• Project plans and other planning documents;
• Copies of procurement documents kept for reference during the project and contract management records (official copies are maintained by the Contracting Officer in Acquisitions);
• Communications with contractors;
• Deliverables as specified by project;
• Change control records; and
• Closeout records.

Destroy/delete 5 years after system is retired. (N1-64-08-12, item 5)

NARANET Planning Documents.

Cut off annually.

Destroy/delete when 5 years old. (N1-64-08-12, item 6)

Desktop Management/Software Approval.

Cut off annually.

Destroy/delete when 5 years old. (N1-64-08-12, item 7)

PC Baseline Management.

Destroy/delete records related to each specific baseline 5 years after baseline is superseded. (N1-64-08-12, item 8)

All records EXCEPT for those filed under 807-2 and 807-3.

Destroy/delete when particular software, hardware, or network components is/are changed, modified, OR retired. (N1-64-08-12, item 9)

Incident Management (EXCLUDES IT security incidents).

Cut off when incident is resolved.

Destroy/delete when 1 year old. (N1-64-08-12, item 10)

System Test Plans.

Destroy/delete when 3 years old. (N1-64-08-12, item 11)

Security backups for NARANET desktop applications created and maintained to restore the system in event of system failure or other unintentional loss of data.  EXCLUDED are data copied for purposes other than for emergency system restoration and data copied for specific systems and/or applications which may or may not be accessible through NARANET.

Incremental Backups.  Daily backups (usually made after close of business) of system transactions made on that day only.

Destroy/delete at end of each week after full backup is made AND verified. (N1-64-02, 2, item 1)

Full Backups.  Full system backup (usually taken once a week after close of business week) which becomes a copy of the system for that point in time.

Destroy/delete each backup when 2 months old. (N1-64-02-2, item 2)

All records EXCEPT for those filed under 809-2 and 809-3.

Destroy/delete when 3 TO 5 years old. (N1-64-08-12, item 14)

NOTE: A retention band, although specifying a range of years, actually requires for the organization to select a specific retention period (within the band) for each series and keep the retention period in effect for an entire fiscal year.

Computer/Electronic Accommodations Program (CAP).  Textual records pertaining to requests for assistive technology.  May include forms, e-mails, medical documentation, and related records maintained by CAP Administrator.

CAP electronic tracking system. 

Delete data pertaining to a CAP request when data are no longer needed for administrative OR reference use. (N1-64-03-8, item 2)

Destroy/delete 1 year after service level agreement, procedures, or measures is/are superseded OR terminated. (N1-64-08-12, item 18)

All records EXCEPT for those filed under 811-2.

Destroy/delete when no longer needed for review AND analysis. (N1-64-08-12, item 22)

Contractor performance-related monitoring.

Destroy/delete 3 years after agreement, procedures, or measures is/are superseded OR terminated. (N1-64-08-12, item 23)

For individual systems, at a minimum, the following are included: log-in files, password files, audit trail files, system usage files, and cost-back files used to assess charges for system use.

Destroy/delete when determined that files are no longer needed for administrative, legal, audit, OR other operational purposes. (GRS 20, item 1c)

Invoices and billing.

Destroy/delete when 7 years old. (N1-64-08-12, item 19)

Repair tickets.

Destroy/delete when 3 years old. (N1-64-08-12, item 20)

Site installation files.

Destroy/delete when superseded OR obsolete. (N1-64-08-12, item 21)

Acquisitions at or below simplified acquisition threshold.

Cut off on final payment.

Destroy/delete when 3 years old. (N1-64-08-12, item 24)

Acquisitions above simplified acquisition threshold.

Cut off on final payment.

Destroy/delete when 7 years old. (N1-64-08-12, item 25)

User Awareness.

Destroy/delete when no longer needed for legal OR operational purposes. (N1-64-08-12, item 30)

System Certification and Accreditation (C&A).

Overwrite/delete superseded documentation for each system.

Annually, identify defunct systems and destroy/delete related documentation for these systems. (N1-64-08-12, item 29)

Intrusion Detection.

Cut off scan reports at end of fiscal year.

Destroy/delete 1 year after cutoff. (N1-64-08-12, item 26)

Incident Response.

Security Audit Logs.  Extracts of audit logs ("audit trails") pulled from NARANET and NARANET-hosted applications via automated audit analysis tools.  Extracts are used to trace users' actions, reconstruct events, detect intrusions, and identify other problems.

NOTE: For security audit logs in individual applications, see either file no. 812 or file numbers for specific applications, as appropriate.

Destroy/delete extracted data 1 calendar year after pulling of data via an automated tool.  (GRS 20, item 1c)

Records are maintained by system project.

Destroy/delete 5 years after system OR technology is retired. (N1-64-08-12, item 33)

All records EXCEPT for those filed under

821-2.

Destroy/delete when superseded. (N1-64-08-12, item 31)

System-specific data management (files maintained by system).

Destroy/delete 3 TO 5 years after system is retired. (N1-64-08-12, item 32)

NOTE: A retention band, although specifying a range of years, actually requires for the organization to select a specific retention period (within the band) for each series and keep the retention period in effect for an entire fiscal year.

All records EXCEPT for those filed under

822-2.

Destroy/delete when superseded. (N1-64-08-12, item 37)

Forms Case Files (maintained by form number).

Destroy/delete forms case file 5 years after specific form is cancelled. (GRS 16, item 3a)

NOTE: If a form is superseded (assigned a new form number), file related records in case file for successor form.

Cut off when approval/renewal period expires. 

Destroy/delete no SOONER than time of expiration, BUT NO LATER than 3 years after expiration of succeeding renewal period. (N1-64-08-12, item 39)

Cut off at end of fiscal year.

Destroy/delete when 3 years old. (N1-64-08-12, item 40)

• Record data about how users access the web servers, navigate and/or query NARA's web pages, and use the search engine;
• Record which scripts are used and how; and/or
• Compile other statistics about use.

• Users' Internet Protocol (IP) addresses;
• Uniform Resource Locators (URLs) of pages that lead users to the NARA site; and
• Counts of web hits and user sessions, search requests, and systems used by visitors to the web site.