# Presentation: 872586

## PKI & Electronic Records Management [ERM]

***PKI in Today’s Government - It’s a Matter of Trust***
**Dr. Mark D. Giguere **
**Computer Specialist (Policy, Planning & Mgmt)**

## Records Basics

**The move to e-Gov will change work processes**
**The move to e-Gov will create new records**
**GPEA-generated record material (paper **_**or**_** electronic) must have a NARA-approved disposition authority**
**Post-GPEA agency records schedules **_**must**_** reflect these changes**

## How Does GPEA Affect Records Management [RM]?

**Many GPEA records will be electronic and it will be **_**more**_** **_**cost**_**-**_**effective**_** to manage them electronically**
**GPEA records may have embedded digital signatures -- electronic records management [ERM] will enable you to maintain the trustworthiness those signatures over time**
**GPEA transactions will be audited -- ERM will support that function**

## What Types of PKI Records Are We (potentially)Talking About?

**Context**
**Documentation of individual identities**
**Trust verification records (audit trails)**
**Certificates**
**Certificate revocation lists [CRLs]**
**Trust paths **
**Certificate policies**
**Certificate practice statements**

## What Types of PKI Records Are We (potentially)Talking About?

**Structure**
**Hashing algorithms**
**Encryption algorithms**

## Which of These PKI Records You Manage is Determined by Your...

**Risk assessment**
**Approach to e-signature authentication**
**Maintaining adequate documentation at/near time of digital signing**
**Maintaining ability to re-validate digital signature**
**Creating audit trail entry of digital signature acceptability**

## What Do I Need to Do?

**Review the NARA GPEA guidacne**
***http://www.nara.gov/records/policy/gpea.html***
**Determine agency approach(es) to maintaining e-signature trustworthiness**
**Use your GPEA risk assessment to advise RM decisions**
**Develop an ERM action plan - i.e.,**
**IT solutions to manage GPEA e-records**
**Plan to update agency records schedules**

## How Do I Do It?

**Get your Agency Records Officer involved**
**Evaluate possibility of new e-Gov records created**
**Update your records schedules**
**Get your GPEA IT staff involved**
**Evaluate/develop IT solutions to capture and appropriately manage GPEA-related electronic records**

## How Can NARA Help?

**Clarifying NARA GPEA guidance**
**Providing training for agency Records Officers regarding GPEA RM requirements**
**Reviewing/approving agency records schedules containing GPEA records**
**Detailed PKI ERM guidance being jointly developed with FPKI SC by 10/01/02**

## What NARA Can’t Help With...

**Specifying a single government-wide ERM model for e-Gov...**
**...because e-Gov RM decisions are widely varying &  agency-specific**
**Advising agencies on specific ERM solutions for GPEA systems**

## Here Are Some Helpful Resources ...

**NARA’s web site CIO link**
***http://www.nara.gov/records/ciolink.html***
**Your agency’s NARA Lifecycle Mgmt Division Work Group**** ****	**
**Have your Agency Records Officer contact them for assistance**
**DoD 5015.2-STD (design criteria for records management applications)**
***http://jitc.fhu.disa.mil/recmgt/#standard***

## One Possible Solution...

**Integrate a DoD 5015.2-certified records management application solution into your GPEA IT implementation plan**
*http://jitc.fhu.disa.mil/recmgt/*
**Endorsed by NARA as “...one approach...” to ERM**
**Meets Federal regulatory/statutory requirements**

## Where Can I Learn More?

**Mark Giguere, Computer Specialist  Modern Records Programs****	****	****	****NARA****	****	****	****	****	****	****	****(301) 713-7110 x250****	****	****	****mark.giguere@nara.gov**
**Barry West - Chair****	****	****	****	****	****GSA- Office of e-Gov****	****	****	****Federal PKI Business Working Group****	****(202)208-3584**