Bulletin 2014-06

ATTENTION! This page has been superseded. The information listed below is no longer accurate. For NARA's current guidance please visit http://www.archives.gov/records-mgmt/bulletins. Please note that this page is available only as a technical and historical reference.

September 15, 2014

TO: Heads of Federal Agencies

SUBJECT: Guidance on Managing Email

EXPIRATION DATE: Expires when revoked or superseded

1.  What is the purpose of this Bulletin?

This Bulletin reminds Federal agencies about their records management responsibilities regarding email. This is especially important in light of the requirement in the Managing Government Records Directive (OMB M-12-18) for all email to be managed electronically by December 31, 2016. In addition, recent disclosures by agencies have put this issue into more prominent focus. NARA will continue to issue guidance that assists agencies in meeting the goals of the Directive and Federal records management requirements under the Federal Records Act and associated regulations.

2. Are emails Federal records?

NARA has issued many bulletins, FAQs, regulations, and agency records management training sessions that provide guidance on Federal email management (see list in Question 9). Each has stated emails that are Federal records must be managed for their entire records life cycle. The statutory definition of Federal records is found at 44 U.S.C. 3301 and is further explained in the Code of Federal Regulations at 36 CFR 1222.10.

All agency-administered email accounts are likely to contain Federal records. This includes email accounts with multiple users (such as public correspondence email addresses) or email accounts for an individual on multiple systems (such as classified and unclassified email accounts). In addition, agency officials may create Federal records if they conduct agency business on their personal email accounts. Email sent on personal email accounts pertaining to agency business and meeting the definition of Federal records must be filed in an agency recordkeeping system.

3. What are agency responsibilities for email management?

Agencies must have policies in place to identify emails that are Federal records. These policies must ensure that emails identified as Federal records are filed in agency recordkeeping systems. Failure to identify and manage email as Federal records can result in their loss. In addition, agencies’ policies and practices for email management must comply with other statutes and obligations, such as the Freedom of Information Act and discovery in litigation. Furthermore, the Managing Government Records Directive requires that Federal agencies manage all their email electronically by December 31, 2016.

4. What is the role of Federal employees in email management?
Currently, in many agencies, employees manage their own email accounts and apply their own understanding of Federal records management. This means that all employees are required to review each message, identify its value, and either delete it or move it to a recordkeeping system. Some email, such as spam or all-staff announcements, may be deleted immediately. On the other hand, substantive policy discussions conducted in email may be appropriate for preservation for several years or ultimate transfer to NARA.

NARA recognizes that placing the responsibility on employees to make decisions on an email-by-email basis can create a tremendous burden. As a result, NARA recommends that agencies immediately begin to adopt automated or rules-based records management policies for email management, such as the Capstone approach.

5. What is Capstone?

Capstone is an approach to managing email. It is not a type of technology. (See NARA Bulletin 2013-02: Guidance on a New Approach to Managing Email Records.) When adopting the Capstone approach, agencies must identify those email accounts most likely to contain records that should be preserved as permanent. Agencies will determine Capstone accounts based on their business needs. They should identify the accounts of individuals who, by virtue of their work, office, or position, are likely to create or receive permanently valuable Federal records. Capstone officials will generally be the top-level senior officials of an agency, but may also be other key decision makers at lower levels of the agency.

Following this approach, an agency can schedule all of the email in Capstone accounts as permanent records. The agency could then schedule the remaining (non-Capstone)email as temporary and retain all of them for a set period of time based on the agency’s needs. The Capstone Bulletin addresses additional options and best practices.

Establishing the appropriate retention periods for email will help an agency determine the best approach to implement for recordkeeping and backup systems to ensure that the agency can access their email for business needs, including in response to congressional, FOIA, or discovery requests.

6. How long should emails be kept?

As Federal records, emails must be kept for specific periods of time as mandated in records disposition schedules. Some schedules allow for transitory emails to be deleted immediately or when no longer needed. Some schedules require emails to be kept in agencies for decades and then transferred to NARA for permanent preservation. Some schedules allow agencies to delete emails after having been moved to a recordkeeping system.  

In addition, NARA recommends agencies determine the minimum time frame all their email must be kept electronically - in a searchable and retrievable manner - in order to meet immediate business and access needs. For example, an agency may decide to use journaling tools to keep all email for one year to meet audit and access requirements.

7. How can agencies mitigate against loss of email records?

Continued use of the “print and file” method of managing email puts agencies at risk of losing records, not having them available for business needs, and allegations of unauthorized destruction. Converting to automated email management will reduce the risks involved in human management of email. The decision to manage email electronically needs to involve Senior Agency Officials for Records Management, Records Officers, General Counsels, Chief Information Officers, and others. Until such conversion, agencies must ensure email management policies are in place and that staff are following them. Oversight can be done through training, audits, and supervisory controls.

Agencies should also ensure that electronic records backup policies and practices are adequate, including what backups are needed and how long to maintain the backup. Backups are not recordkeeping systems, but they can help restore records in the case of a technology or other type of failure. If computers or mobile devices are not backed up, then emails and other Federal records should not be stored on them.

8. How do agencies report email loss?

In accordance with the Federal Records Act (44 U.S.C. §§ 2905(a) and 3106) and its implementing regulations (36 CFR Part 1230), when an agency becomes aware of an incident of unauthorized destruction, they must report the incident to the Office of the Chief Records Officer for the U.S. Government. The report should describe the records, the circumstances in which the unauthorized destruction took place, and the corrective steps being taken to properly manage the records in the future. If NARA learns of the incident before the agency has reported it, NARA will notify the agency and request similar information. The goal of this process is to ensure that the circumstances that may have led to the loss of Federal records are corrected and that similar losses do not occur in the future.

9. What other related guidance does NARA provide?

NARA has issued many bulletins, FAQs, regulations, and training on Federal email management and related technologies. Regulations on electronic records and email are found in 36 CFR 1236. NARA training and guidance on email is available online here.

NARA guidance on email and related technologies include:

• NARA Bulletin 2014-04: Revised Format Guidance for the Transfer of Permanent Electronic Records specifies which file formats are acceptable when transferring permanent electronic records to NARA.
   
• NARA Bulletin 2013-03: Guidance for Agency Employees on the Management of Federal Records, Including Email Accounts, and the Protection of Federal Records from Unauthorized Removal reaffirms that agencies and agency employees must manage Federal records appropriately and protect them from unauthorized removal from agency custody. Also, this Bulletin clarifies records management responsibilities regarding the use of personal email accounts for official business and the use of more than one Federal email account.
   
• NARA Bulletin 2013-02: Guidance on a New Approach to Managing Email Records provides agencies with a new records management approach, known as “Capstone,” for managing Federal record emails electronically. This Bulletin discusses the considerations that agencies should review if they choose to implement the Capstone approach to manage their email records.
   
• NARA Bulletin 2011-03: Guidance Concerning the Use of Email Archiving Applications to Store Email provides guidance to Federal agencies on using email archiving applications and similar technologies.
   
• NARA Bulletin 2010-05: Guidance on Managing Records in Cloud Computing Environments addresses records management considerations in cloud computing environments and is a formal articulation of NARA’s view of agencies’ records management responsibilities.
   
• NARA FAQ on instant messaging answers questions about the management of instant messaging in Federal agencies.

10. Whom should I contact for more information?

If additional information is needed, or if you have any questions, please contact your agency Records Officer or the NARA Appraisal Archivist or records management contact with whom you regularly work. Please refer to the List of NARA Contacts for Your Agency.

DAVID S. FERRIERO
Archivist of the United States