mean you would not need to address disposal functionality within the system. Note: A yes response should be recorded for any systems that manage information identified as 'Retain as National Archives' (RNA) in an agency's approved record authority, and those systems that manage records that do not yet have disposal coverage. • whether access to the information is likely to decline over time. You will need to complete Module 3: Export/import and Module 4: Reporting. 1.6 Do or will you need to keep the information or data for longer than the expected life of the system? Consider: minimum retention periods for the information or data in the system the expected life of the system likely costs for maintaining the system after its active business use ends (for access purposes). You may be required to maintain a system even after you have stopped actively using it so that you can continue to access legacy information or data. For example, for a system managing short-term records that you must keep for at least 2 years, you may choose to maintain the system for 2 years after you stop using it so that the information can continue to be accessed until it can be destroyed. If you need to keep the records for longer than the time you expect to maintain the system, and you need to destroy records within a specific timeframe, you will need to export the records to manage the destruction accountably. Note: A yes response should be recorded for any systems that manage information or data identified as 'Retain as National Archives' (RNA) in an agency's approved record authority, and systems that manage information or data that do not yet have disposal coverage. Document the details of the information or data in the system including: • how long you expect the system to be in use . minimum retention periods for the information in the system • whether the information or data are in regular use, and • whether access to the information or data is likely to decline over time. You will need to complete Module 3: Export/import and Module 4: Reporting and any modules identified earlier. You will need to complete Module 4: Reporting and any other modules identified earlier.
Question Considerations Response (Y/N) For ‘Yes’ response For ‘No’ response 3.2 Where you have identified a risk or gap in Phase 2 by answering ‘No’ to an assessment question, is the Build in solution appropriate to reduce the risks or address any functionality gaps? Consider the cost of configuring, modifying or upgrading the system and if it is possible to reconfigure, modify or upgrade the system to build in missing information or data management functionality. For example, if you have identified that you cannot prove the information or data is authentic, you might build in this functionality by configuring metadata fields to capture additional information or data to support authenticity. What are the advantages and disadvantages to managing risks or gaps in this way? When and how the missing functionality could be built into the system eg is there an existing agreement with the vendor that outlines how changes to configuration or upgrades are managed? Consider whether a combination of solutions is necessary to address the risk or gap entirely. Document how you intend to: configure, modify or upgrade the system when it is likely to happen, and any risks associated with the upgrade/ reconfiguration. Document your plan to address risks or gaps in your . Continue to work through your list of identified and gaps that still need addressing. Continue to Solution 2.- Integration Examples of building in functionality include: Configure metadata fields to capture additional information to support authenticity. This may be populated automatically or manually (through data entry). Upgrade or modify the system to make audit logs available to appropriate end users. Configure audit logs to capture all relevant actions. Configure additional metadata fields to capture file structure and record/document relationships. Configure/write reports in the system that will call up the relevant data. Configure additional metadata fields to capture relevant information or data. Configure system to ensure that metadata is retained after ‘record content’ is destroyed. Ensure that metadata can be exported to be retained as a control record for the system the system is decommissioned. Configure the system to suspend all disposal action while disposal data is being updated.
Consider whether a combination of solutions is necessary to address the risk or gap entirely. Continue to work through your list of identified risks and gaps that still need addressing. Examples and other considerations for export activities include: Export and maintain the required metadata in an external system (ie spreadsheet, compliant information management system). Export and maintain additional metadata in an external system (ie catalogues, registers, spreadsheets), that captures information and data structures and relationships. Use agreed data exchange formats and structures to allow export to other systems. Use Extract Transform Load (ETL) software that can convert data into the necessary formats to facilitate export to external systems. Use ‘machine learning’ software for automated mapping of data structures to facilitate exporting data to external systems. Export the data periodically or as required into a format that allows you to interrogate the data (ie a business intelligence tool, spreadsheet). Maintain relevant data in an external system (e.g. a spreadsheet) and make scheduled checks against the data to determine if information management actions need to be taken. Prior to destruction, export a full manifest of system holdings so that data indexing and searching technologies can be used to scan the system. Solution 4 External (Governance) - managing any risk or gaps by implementing procedures and business For example, if the system cannot prevent unauthorised changes, consider controlling access to the system by using business rules and manual security protocols. Question Considerations Response (Y/N) For ‘Yes’ response For ‘No’ response 3.5 Where you have identified a risk or gap in Phase 2 by answering ‘No’ to an assessment question, is an External (Governance) solution appropriate to reduce Can the identified gaps be mitigated through implementing governance processes (e.g. procedures and business rules)? Managing any risk or gap by implementing procedures and business For example if the system cannot prevent unauthorised changes, consider controlling access to the system by using business rules and security protocols. What are the advantages and disadvantages of this approach? Document which business rules/ procedures need to be changed/implemented to manage risks and address gaps in the system. Document why this approach is not recommended or give details of the procedures and business rules that are already in place for the system.