1Records Management ISCR DAT3 Self-Assessment
Please use this form to assess your office’s compliance with Ohio State University’s Records Management Policy andto guide your Information Security Control Requirement DAT3 review. Consider paper, electronic, and any otherrecords formats as you complete the form. Use the comment field to expand on your compliance practices response,or make note of where improvements or assistance are needed. Submit the form to lib-records@osu.edu for
university records manager approval.
Office/Department/Unit:

Assessment Date:

Name of person completing assessment:

Signature:

Position of person completing assessment:

Email:Name of senior manager approving review:

Signature:

Position of senior manager:

Email:

University records manager:

Approval Date:

11.23.2022

v3.0

2

Part I – ISCR DAT3 Annual Review
The following series of questions and comments should be completed and submitted for the annual records
management review, as required in DAT3. The results must be approved by senior unit management and University
Records Management.

Below is a summary of the Information Security Control Requirement DAT3:
A. Review the applicable university records retention schedules to determine if there have been any changes;
B. Assess if there have been any organizational, technology, or regulatory changes that would change theorganization’s records retention requirements;
C. Verify that records are not being discarded or destroyed before the authorized disposition date;
D. Ensure the routine destruction of records once the retention period, authorized via retention schedules, haspassed;
i. verify certificates of records destruction are submitted to University Records Management prior to records
destruction; orii. work with University Records Management to ensure the system captures and can report on
appropriate destruction metadata; andE. Assess whether the organization needs to take action to be in compliance with all applicable record retention
requirements.
Note: In responding to the questions below, it is important to reach out to managers, supervisors, administrators,
administrative assistants and others who have a responsibility for and knowledge of the records management
processes as part of unit operations.

11.23.2022

v3.0

3
DAT3
Control
AA, B

A, B
C
DC, DC, DEE

11.23.2022

Questions

Yes

NoAnswers/Comments/Questions

Does your office have a unit-unique retention schedule?
a. If yes, when was your retention schedule last created or updated?
b. If no, do all of your unit’s records fall under record series listedon the OSU General Records Retention Schedule?
Does your unit-unique retention schedule need updated or should one becreated?
a. Are there records that your office creates or maintains that are notcovered under a retention schedule (unique or general)?
b. Are there records on your retention schedule that you no longer
create or maintain?
c. Have there been any organizational or technology changes that affectretention requirements?
Within the last 12 months have any laws or regulations changed that could
affect retention periods on your retention schedule?
a. If yes, what are the citations?
Have records been destroyed/deleted prior to the expiration of the appropriate
retention period in your retention schedule?
Have Certificates of Records Destruction been submitted to and approved by
University Records Management prior to each destruction, including
destruction of records stored offsite and/or electronic records deletions?
Are electronic records, structured and unstructured, regularly disposed ofwhen the retention period has been met?
Do any systems or vendors have auto-delete, overwrite or disposition turnedon?
a. Is this in line with current retention schedules?
b. Can a disposition report be generated from the system?
Is your office applying retention schedules and records management principles
to all University records, regardless of media or format (i.e., paper, electronic,electronic communications, etc.?)
Are records in office files, shared servers, desk drawers, individual computers,
portable media, and information systems (on-premise, hosted, cloud, etc.) incompliance with the retention schedule?

v3.0

4Part II – Additional Records Management Assessment (optional)
The following questions are not required as part of the ISCR DAT3 Records Management review, but will help your unit
work toward higher Records Management Policy and ISCR compliance; mature your records management program; andidentify areas of risk to be addressed. Records Management will also use responses to this portion to better guide thedirection of our services.
Retention Schedules
Does your unit have an accreditingbody? (and if so, please attach a copyof any guidelines/standards.)

Yes

No

Comments

YesNo

Comments

If yes, which accreditation body?
If yes, does the accrediting body haverecords retention standards?
Disposition
Are records being retained (physicallyor electronically) longer than theretention schedule specifies for a given
record?
If yes, what is the reason forretaining the records longer?
Do your electronic record-keeping
systems have the functionality to queryrecords eligible for disposition or apply
automated disposition?

11.23.2022

v3.0

5Disposition (cont.)
Are inactive paper/hardcopy records
being sent to an off-site storage facility?

YesNoComments

YesNo

Comments

If yes, which facility?
Are the records being destroyedwhen retention has expired?
Are CRDs being submitted toUniversity Records Management
before destruction is requested?
Is the vendor sending certificatesof destruction once they havedestroyed the requested records?
Does your office routinely transfer
records to the University Archives whenindicated on the retention schedule?
Media Formats/Filing
Structures/Naming Conventions
When your office creates or receives
records, do faculty and staff know
where to file them?
Does your office have a centralized,structured filing system for electronicrecords?

11.23.2022

v3.0

6Media Formats/Filing
Structures/Naming Conventions(cont.)

YesNoComments

YesNo

Comments

Does your office follow a standard
naming convention for electronic files?
Can your office quickly find information
when you need it?
Does your office routinely reformatrecords?
ScanPrint
Microfilm
What systems are electronic records
stored in? (ex. Teams, Shared Drive,
Outlook, OneDrive, Carmen, OnBase,etc.)
Security and Compliance
Has each record series on yourretention schedule been classified S1S4 according to the Institutional Data
Policy?
Are any records currently under any
preservation hold?

11.23.2022

v3.0

7

Security and Compliance (cont.)

Yes

NoComments

YesNo

Comments

Do you have a way of tracking
records under preservation holds,
including records of separated ortransferred employees?
(Electronic systems, paper,offsite storage, etc.)
Is there a process for releasing
records when a hold is lifted?

Responsibility and Training
Does your office have records
management training for new
employees?
Is records management training
needed?
Does your unit have procedures for
managing the records of separating
employees?
Did someone in your unit attend Paper& Bytes within the last 12 months?
If yes, who?

11.23.2022

v3.0

8Responsibility and Training (cont.)

YesNoComments

Do you have a records management
unit-ambassador to the University
Records Management Program?
If yes, who?

Key Documents:•••

Records Retention ScheduleCertificates of Records Destruction
Unit Policies and Procedures:
o General records managemento Separation procedureso Filing structureo Naming conventions

https://library.osu.edu/osu-records-management
https://library.osu.edu/osu-records-management/guidance

Please reach out to the University Records Team with any questions:
Pari Swift
University Records Manager
614-292-4092
Swift.102@osu.edu

11.23.2022

Beth Crowner
Records Management Coordinator614-688-2934
Crowner.7@osu.edu

v3.0