Note 1: If any maintenance activities have a major impact on a system or lead to a significant change, those records should be maintained as part of the Configuration and Change Management Records. Note 2: Records needed to support contracts should be in procurement files, which are scheduled under the GRS for General Financial Management Records. 030 Configuration and Change Management Records. Records created and retained for asset management, performance and capacity management, system management, configuration and change management, and planning, follow-up, and impact assessment of operational networks and systems. Includes records such as: data and detailed reports on implementation of systems, applications and modifications application sizing, resource and demand management records documents identifying, requesting, and analyzing possible changes, authorizing changes, and documenting implementation of changes documentation of software distribution (including COTS software license management files) and release or version management Note 1: If any maintenance activities have a major impact on a system or lead to a significant change, those records should be maintained as part of the Configuration and Change Management Records. Note 2: Per NARA practice, documentation for permanent electronic records should be transferred with the related records using the disposition authority for the related electronic records rather than the GRS disposition authority. Note 3: Agencies may retain a copy of documentation related to permanent electronic records. This copy may be destroyed at any time after the transfer request has been signed by the National Archives. Temporary. Destroy 5 years after system is superseded by a new iteration, or is terminated, defunded, or no longer needed for agency/IT administrative purposes, but longer retention is authorized if required for business use. 040 Information technology oversight and compliance records. Information Technology (IT) Oversight and Compliance records relate to compliance with IT policies, directives, and plans. Records are typically found in offices with agency-wide or bureau-wide responsibility for managing IT operations. Includes records such as: Temporary. Destroy 5 years after the project/activity/
recurring and special reports responses to findings and recommendations reports of follow-up activities statistical performance data metrics inventory of web activity web use statistics comments/feedback from web site or application users internal and external reporting for compliance requirements relating to the Privacy Act, and electronic and Information technology accessibility under Section 508 of the Rehabilitation Act system availability reports target IT architecture reports systems development lifecycle handbooks computer network assessments and follow-up documentation vulnerability assessment reports assessment and authorization of equipment Independent Verification and Validation (IV&V) reports contractor evaluation reports quality assurance reviews and reports market analyses and performance surveys benefit-cost analyses make vs. buy analysis reports on implementation of plans compliance reviews data measuring or estimating impact and compliance Note: Copies of security plans are scheduled under the GRS for Information Security Records. There may be copies interfiled within this series. transaction is completed or superseded, but longer retention is authorized if required for business use.
records, whether the records are part of an electronic system or stand-alone, that allows a user to understand or access the information. table and dependency descriptions taxonomies schemas registries source code physical data model logical data model is authorized if required for business use