About the National Archives

Search the
Records Schedule

April 28, 2015

These operational records relate to IT plans, acquisitions, operations and management, and to security of IT systems and services (including NARANET). This chapter also covers NARAs Web Program and IT project management. Electronic files and hard copy printouts created to monitor system usage of individual systems (e.g., log/audit files) are included under item 821. However, excluded are documentation, source documents, processing files, and output products (e.g., reports, printouts, microforms, and similar hard copy outputs) for individual IT systems. These records are scheduled with the related functional files (e.g., Performance Measurement and Reporting System [PMRS] in Chapter 1).

Chief Information Officer (CIO)

File #DescriptionDisposition
801-1

All records of the following functions:

  • Compliance;
  • Reporting to OMB or elsewhere, as required of the CIO;
  • CIO Council;
  • Information Assurance;
  • System Accreditation;
  • Audit Response/Resolution; and
  • Information Technology IT) Governance [i.e., Technical Review Group (TRG)].

Cut off files annually.

Destroy/delete 7 years after cutoff. (N1-64-08-12, item 1)

801-2

Enterprise Architecture. Identification of IT systems and networks required to perform NARA's mission, and the transitional processes required to implement comprehensive programs to support that mission.  Records may include technical reference models, diagrams, graphics, models, and narratives that describe NARA's baseline architecture, target architecture, and related sequencing plans.

Cut off files annually.

Destroy/delete 7 years after cutoff.  (N1-64-08-12, item 2)

IT Policy

File #DescriptionDisposition
802 IT Policy

This function pertains to developing and revising internal directives (policy directives, supplements, and interim guidances) in the applicable numbered series of the formal directives system.  Also included are records documenting development of and updates to other guidance products (outside the formal directives system) which are posted on the intranet.

Destroy/delete when superseded. (N1-64-08-12, item 3)

Capital Planning

File #DescriptionDisposition
803 Capital Planning

Integration of IT investments with NARA-wide strategic planning, budgeting, procurements, and management.  Case files, maintained by system, may include: routine and periodic reports on IT capital investments; capital asset plans; business cases for major investments, systems, acquisitions, or operational assets identified in NARA's capital investment portfolio; and clearance and review records.

Destroy/delete 5 years after system is retired. (N1-64-08-12, item 4)

Systems Development

File #DescriptionDisposition
804 Systems Development

Management of each IT system development project through its various stages: concept development, requirements gathering, procurement, implementation, system testing, "go-live," and hand-off to production.  Case files, maintained by system, may include:

  • Copies of approved product plan and approvals authorizing the project;
  • Project plans and other planning documents;
  • Copies of procurement documents kept for reference during the project and contract management records (official copies are maintained by the Contracting Officer in Acquisitions);
  • Communications with contractors;
  • Deliverables as specified by project;
  • Change control records; and
  • Closeout records.

Destroy/delete 5 years after system is retired. (N1-64-08-12, item 5)

Reserved (805)

Infrastructure Operations and Maintenance

File #DescriptionDisposition
806 Network Ownership
806-1

NARANET Planning Documents.

Cut off annually.

Destroy/delete when 5 years old. (N1-64-08-12, item 6)

806-2

Desktop Management/Software Approval.

Cut off annually.

Destroy/delete when 5 years old. (N1-64-08-12, item 7)

806-3

PC Baseline Management.

Destroy/delete records related to each specific baseline 5 years after baseline is superseded. (N1-64-08-12, item 8)

807 Network Support
807-1

All records EXCEPT for those filed under 807-2 and 807-3.

Destroy/delete when particular software, hardware, or network components is/are changed, modified, OR retired. (N1-64-08-12, item 9)

807-2

Incident Management (EXCLUDES IT security incidents).

Cut off when incident is resolved.

Destroy/delete when 1 year old. (N1-64-08-12, item 10)

807-3

System Test Plans.

Destroy/delete when 3 years old. (N1-64-08-12, item 11)

808 System Backups

Security backups for NARANET desktop applications created and maintained to restore the system in event of system failure or other unintentional loss of data. Excluded are data copied for purposes other than for emergency system restoration and data copied for specific systems and/or applications which may or may not be accessible through NARANET.

 
808-1

Incremental Backups.  Daily backups (usually made after close of business) of system transactions made on that day only.

Destroy when interim backup is:

  • Superseded by a full backup; or
  • No longer needed for system restoration, whichever is later
(GRS 3.2, item 040 - supersedes N1-64-02-2, item 1)
808-2

Full Backups.  Full system backup (usually taken once a week after close of business week) which becomes a copy of the system for that point in time.

Destroy when:

  • Second subsequent backup is verified as successful; or
  • Full backup is no longer needed for system restoration, whichever is later.
(GRS 3.2, item 041 - supersedes N1-64-02-2, item 2)
809 IT Asset Management
809-1

All records EXCEPT for those filed under 809-2 and 809-3.

Destroy/delete when 3 TO 5 years old. (N1-64-08-12, item 14)

NOTE: A retention band, although specifying a range of years, actually requires for the organization to select a specific retention period (within the band) for each series and keep the retention period in effect for an entire fiscal year.

809-2

Computer/Electronic Accommodations Program (CAP).  Textual records pertaining to requests for assistive technology.  May include forms, e-mails, medical documentation, and related records maintained by CAP Administrator.

 
a.

Approved Requests.

Cut off at end of fiscal year in which CAP request is approved. 

Destroy when approved assistive technology item(s) is/are upgraded. (N1-64-08-12, item 15)      

b.

Denied Requests.

Cut off at end of fiscal year in which CAP request is denied. 

Destroy when no longer needed for administrative OR reference use. (N1-64-08-12, item 16)

809-3

CAP electronic tracking system. 

Delete data pertaining to a CAP request when data are no longer needed for administrative OR reference use. (N1-64-03-8, item 2)

810 IT Services Performance
 IT services performance records.

Destroy/delete 1 year after service level agreement, procedures, or measures is/are superseded OR terminated. (N1-64-08-12, item 18)

811 Help Desk Monitoring
811-1

All records EXCEPT for those filed under 811-2.

Destroy/delete when no longer needed for review AND analysis. (N1-64-08-12, item 22)

811-2

Contractor performance-related monitoring.

Destroy/delete 3 years after agreement, procedures, or measures is/are superseded OR terminated. (N1-64-08-12, item 23)

812 Files Relating to Monitoring System Usage
812-1

For individual systems, at a minimum, the following are included: log-in files, password files, audit trail files, system usage files, and cost-back files used to assess charges for system use.

Destroy/delete when determined that files are no longer needed for administrative, legal, audit, OR other operational purposes. (GRS 20, item 1c)

813 Telecommunications
813-1

Invoices and billing.

Destroy/delete when 7 years old. (N1-64-08-12, item 19)

813-2

Repair tickets.

Destroy/delete when 3 years old. (N1-64-08-12, item 20)

813-3

Site installation files.

Destroy/delete when superseded OR obsolete. (N1-64-08-12, item 21)

814 Acquisitions Support
814-1

Acquisitions at or below simplified acquisition threshold.

Cut off on final payment.

Destroy/delete when 3 years old. (N1-64-08-12, item 24)

814-2

Acquisitions above simplified acquisition threshold.

Cut off on final payment.

Destroy/delete when 7 years old. (N1-64-08-12, item 25)

Reserved (815 816)

IT Security

File #DescriptionDisposition
817 IT Security
817-1

User Awareness.

Destroy/delete when no longer needed for legal OR operational purposes. (N1-64-08-12, item 30)

817-2

System Certification and Accreditation (C&A).

Overwrite/delete superseded documentation for each system.

Annually, identify defunct systems and destroy/delete related documentation for these systems. (N1-64-08-12, item 29)

817-3

Intrusion Detection.

Cut off scan reports at end of fiscal year.

Destroy/delete 1 year after cutoff. (N1-64-08-12, item 26)

817-4

Incident Response.

 
a.

Unclassified Systems.

Cut off at end of fiscal year.

Destroy/delete 1 year after cutoff. (N1-64-08-12, item 27)

b.

Classified Systems.

Cut off at end of fiscal year.

Destroy/delete 3 years after cutoff. (N1-64-08-12, item 28)

817-5

Security Audit Logs.  Extracts of audit logs ("audit trails") pulled from NARANET and NARANET-hosted applications via automated audit analysis tools.  Extracts are used to trace users' actions, reconstruct events, detect intrusions, and identify other problems.

 

NOTE: For security audit logs in individual applications, see either file no. 812 or file numbers for specific applications, as appropriate.

Destroy/delete extracted data 1 calendar year after pulling of data via an automated tool.  (GRS 20, item 1c)

Reserved (818 819)

System Engineering

File #DescriptionDisposition
820 Systems Engineering

Records are maintained by system project.

Destroy/delete 5 years after system OR technology is retired. (N1-64-08-12, item 33)

Data Management

File #DescriptionDisposition
821 Data Management
821-1

All records EXCEPT for those filed under

821-2.

Destroy/delete when superseded. (N1-64-08-12, item 31)

821-2

System-specific data management (files maintained by system).

Destroy/delete 3 TO 5 years after system is retired. (N1-64-08-12, item 32)

 

NOTE: A retention band, although specifying a range of years, actually requires for the organization to select a specific retention period (within the band) for each series and keep the retention period in effect for an entire fiscal year.

Forms Management

File #DescriptionDisposition
822 Forms Management
822-1

All records EXCEPT for those filed under

822-2.

Destroy/delete when superseded. (N1-64-08-12, item 37)

822-2

Forms Case Files (maintained by form number).

Destroy/delete forms case file 5 years after specific form is cancelled. (GRS 16, item 3a)

 

NOTE: If a form is superseded (assigned a new form number), file related records in case file for successor form.

Information Collections

File #DescriptionDisposition
823 Office of Management and Budget (OMB) Information Collections
Office of Management and Budget (OMB) Information Collections

Cut off when approval/renewal period expires. 

Destroy/delete no SOONER than time of expiration, BUT NO LATER than 3 years after expiration of succeeding renewal period. (N1-64-08-12, item 39)

Reserved (825 839)

Information Quality

File #DescriptionDisposition
824 Information Quality
Information Quality Files

Cut off at end of fiscal year.

Destroy/delete when 3 years old. (N1-64-08-12, item 40)

Web Program

File #DescriptionDisposition
840 NARA Web Function
The NARA Web function comprises the designing, implementing, and maintaining of NARA's web sites. These records fall into one broad functional area (Program Operation) and are created in the course of operating NARA's Web Program.  
840-1 Includes, but NOT limited to, files relating to: designing, populating, testing, implementing, and maintaining NARA's web sites (including Presidential libraries' web sites).  
a. As performed by organizations responsible for web functions.
Destroy/delete when 3 to 10 years old. (N1-64-06-2, item 1)
b. As performed by offices proposing and preparing content for posting.
Destroy/delete when no longer needed. (N1-64-03-6, item 1a[2])
840-2 Reference Documentation.  
a. Technical documentation, subject reference files, and demonstration copies of the web site.
Destroy/delete when no longer needed for reference. (N1-64-03-6, item 1b[1])
b. Version retrieval files.
Destroy/delete no later than 60 days after posting. (N1-64-03-6, item 1b[2])
840-3 Web Server and Search Engine Log Files. Server, search engine, and statistical analysis tools generating automated logs that:
  • Record data about how users access the web servers, navigate and/or query NARA's web pages, and use the search engine;
  • Record which scripts are used and how; and/or
  • Compile other statistics about use.
The logs collect the following personal information:
  • Users' Internet Protocol (IP) addresses;
  • Uniform Resource Locators (URLs) of pages that lead users to the NARA site; and
  • Counts of web hits and user sessions, search requests, and systems used by visitors to the web site.
 
a. Raw data pertaining to server logs.
Retain 30 days of log data, one tape per day. Cycle tapes by overwriting the oldest data with new data on a daily basis. (N1-64-03-6, item 1c[1])
b. Security audit logs.
Create one summary master copy of all raw data pertaining to server logs at the conclusion of each month. Retain for 12 months. Cycle tapes by overwriting the oldest data on "Month 13 tape" with the most recent data. (N1-64-03-6, item 1c[2])
c. Search engine log data and aggregated log data imported to statistical database.
Hold 3 fiscal years of data. Delete oldest fiscal year files when 4 years old. (N1-64-03-6, item 1c[3])
841 "Live" Web Sites - Production Environment
841-1 Archives.gov (www.archives.gov) - NARA's main public web site, consisting of content files stored on production mirrored servers. Content files include: written, graphical, video, and/or audio content; style sheets, scripts, and code supporting functionality and delivery of content; and boot sector files residing on production servers. Overwrite or destroy elements OR entire web site when no longer needed. (N1-64-06-1, item 1)
841-2 NARA@work - NARA's intranet web site, consisting of content files stored on production mirrored servers. Content files include: written, graphical, video, and/or audio content; style sheets, scripts, and code supporting functionality and delivery of content; and boot sector files residing on production servers. Overwrite or destroy elements OR entire web site when no longer needed. (N1-64-06-1, item 2)
841-3 Our Documents (www.ourdocuments.gov) - a public web site providing reference copies of documents for use especially by teachers and students. The project was created in partnership with National History Day and the USA Freedom Corps. Content files include: written, graphical, video, and/or audio content; style sheets, scripts, and code supporting functionality of the web site; and boot sectors residing on production servers. Overwrite or destroy when no longer needed. (N1-64-06-1, item 3)
841-4 Guide to the 1930 Census (1930census.archives.gov) - an online portal providing guidance, replicated from other NARA sources, regarding research methods using the 1930 census. This web site does NOT provide copies of NARA holdings. Content files include: written, graphical, video, and/or audio content; style sheets, scripts, and code supporting functionality and delivery of content; and boot sectors (mirrored drives) residing on production mirrored servers. Overwrite or destroy when no longer needed. (N1-64-06-1, item 4)
841-5 Emergency Federal Register (www.emergency-federal-register.gov) - a web site with simple interfaces providing contingency public access to the online Federal Register in rare cases of national emergency and as authorized by the President of the United States. The web site consists of content files, code and templates, forms, and instructions supporting posting and viewing of the Federal Register in emergency circumstances. Overwrite or destroy when no longer needed. (N1-64-06-1, item 5)

Reserved (842 898)

Electronic Copies of Records Contained in this Chapter

File #DescriptionDisposition
899 Word Processing Files and E-mail Records
899-1 Word Processing Files. Documents such as letters, memoranda, reports, handbooks, directives, and manuals recorded on electronic media, such as hard disks or floppy diskettes, after they have been copied to an electronic recordkeeping system, paper, or microform for recordkeeping purposes. Delete from the word processing system when no longer needed for updating or revision. (GRS 20, item 13; N1-64-03-5, item 4a; N1-64-03-6, item 2a; and N1-64-03-8, item 3a)
899-2 E-mail Records. Senders' and recipients' versions of e-mail messages that meet the definition of Federal records, and any attachments to the record messages after they have been copied to an electronic recordkeeping system, paper, or microform for recordkeeping purposes. Delete from the e-mail system after copying to a recordkeeping system. (GRS 20, item 14; N1-64-03-5, item 4b; N1-64-03-6, item 2b; and N1-64-03-8, item 3b)

NOTE: Along with the message text, the recordkeeping system must capture the names of sender and recipients and date (transmission data for recordkeeping purposes) and any receipt data when required.

 

Office of Management and Budget (OMB) Information Collections
About the National Archives >

The U.S. National Archives and Records Administration
1-86-NARA-NARA or 1-866-272-6272

.