PAISC_Attachment C.pdf

Paying Agent-related Information Security Consultant (PAISC) Contract

PBGC Solicitation Number PBGC01-RP-12-0025

Attachment C

This attachment includes the following documents (in this order) as listed in section C – 1.3.2.3 Records

Management and 1.3.2.4 Privacy information and security:

PBGC Records Management Programi Guidance [Interim] (February 2012) Records Management Procedures Manualii (version 1.0) PBGC Directive IM 05-09, Privacy Programiii PBGC Directive IM 10-03, Protecting Sensitive Information

This attachment also includes the following two documents (in this order) which are not listed in the original Request for Proposal, since they are newly identified relevant documents that support this procurement:

PBGC Directive PM 05-01, PBGC Entrance on Duty and Separation Procedures for Federal and

Contract Employees PBGC Directive PM 05-06, Personnel Security and Suitability Program i Original Request for Proposal listed without the term “Program”, it is correctly listed here.

ii Original Request for Proposal listed as “PBGC Records Management Procedures”, it is correctly listed here as

“Records Management Procedures Manual”.

iii Original Request for Proposal listed as “Information Privacy Program”, it is correctly listed here.

Pension Benefit Guaranty Corporation

Interim Guidance Subject: PBGC Records Management Program

Effective Date: 2/9/12 Originator: CMO

Alice C. Maroni Chief Management Officer

1. PURPOSE: This interim guidance updates the Pension Benefit Guaranty Corporation’s (PBGC) Records Management Program.

This interim guidance establishes the responsibilities and requirements for managing PBGC records (informally, all materials, regardless of physical form, made or received by a Government agency or in connection with the transaction of public business) across all media to ensure that the Corporation (hereinafter the “Agency”) complies with Federal laws and regulations, PBGC policies, and best practices for managing records.

This interim guidance is intended to cover a period of great technology change.

Because of this, it must be dynamic and will change periodically. Please check back often for updated guidance.

The intent of the Records Management Program is to promote standard processes, procedures, practices, and guidelines that ensure the proper handling of PBGC records.

The specific objectives of the Records Management Program are to:

a. Establish requirements and responsibilities for implementing and maintaining an efficient and effective records management program throughout the Agency.

b. Provide support for the Agency’s mission of protecting pension benefits in private-sector defined benefit pension plans through:

1. Awareness that records management is the responsibility of every employee and contractor;

2. Adequate and proper documentation of PBGC activities, organization, functions, policies, decisions, procedures, and essential transactions;

3. Appropriate maintenance and use of PBGC records; and

4. Proper records disposition.

c. Comply with existing Federal laws, including the Federal Records Act and the laws, rules, and regulations.

d. Preserve the Agency’s historical information, thereby enabling employees, contractors, and their successors to retrieve the information needed to make informed decisions.

e. Set forth requirements and responsibilities for managing the Agency’s Controlled

Unclassified Information (CUI).

a. CANCELLATION: This Interim Guidance supersedes and cancels PBGC Directive IM-

15-1, P BGC Records Management Program.

2. SCOPE: This Interim Guidance applies to all PBGC employees and contractors.

This Interim Guidance serves to ensure that adequate controls are in place for managing records. The table below lists categories of internal controls that affect the

Records Management Program:

Category Purpose Record Creation Create records by following standard processes, procedures, practices, and guidelines that ensure reliable, usable records and content.

Record Distribution and Use

Share and use records in a manner that preserves the [overall] integrity of the record during the normal course of business in accordance with established PBGC policies.

Record Storage and Retrieval

Store and retrieve physical [on and off-site] and electronic records throughout their lifecycle in a manner that ensures accessibility and secures preservation.

Records Retention and Disposition Scheduling

Schedule and retain records in accordance with applicable guidelines and business needs, ensuring the usage of accurate National Archives and Records Administration (NARA) approved disposition authorities.

Record Retention Retain records for as long as necessary to meet the Agency’s business needs, legal and regulatory requirements.

Record Destruction Destroy records when appropriate, in accordance with established procedures designed to protect and dispose of PBGC information.

Permanent Records Transfer records that have been appraised by NARA as having archival value as listed on records disposition schedules.

Category Purpose Vital Records Identify, protect, and retrieve records that are essential to protecting PBGC and those of the Agency’s customers’ financial and legal rights and obligations.

Continuity of Operations Plan Emergency Records

Provide guidance to the Departments within PBGC for the creation and execution of their Continuity of Operations (COOP) Emergency Records Plans.

Record Hold Preserve and produce records that are the subject of litigation (or reasonably anticipated litigation), government, or audit investigations. Record Holds supersede the normal records retention and disposition requirements found in PBGC records retention schedules.

Annual Record Review

Conduct an internal review of records to determine administrative value and ensure the application of records retention and disposition in accordance with the Records Management Policy.

Records Management Training

Provide training to all PBGC employees and contractors regarding the legal requirements of records management and basic strategies for identifying and managing PBGC records.

Controlled Unclassified Information (CUI)

Ensure that Controlled Unclassified Information is properly designated, marked, safeguarded, and disseminated.

3. AUTHORITIES: The following statutes, regulations, executive orders, and other authorities govern the PBGC Records Management Program.

35)

Federal Information Resources

h. Office of Management and Budget OMB Circular A-123, Management’s

Responsibility for Internal Control

i. National Archives and Records Administration (NARA), Records Management

Regulations (36 CFR chapter XII, Subchapter B)

j. General Services Administration (Creation, Maintenance and Use of Records), (41 CFR part 102–193)

k. Information Technology Management Reform Act of 1996 (Clinger-Cohen Act of

1996) (40 U.S.C. Subtitle III)

l. Executive Order 13556 – Controlled Unclassified Information (CUI) 11/4/2010

m. CUI Office. NARA Notice 2011-01: Initial Implementation Guidance for Executive Order 13556. 6/9/2011

4. BACKGROUND:

The Federal Records Act of 1950, as amended, requires all Federal agencies to make, manage and preserve records containing adequate and proper documentation of their organization, functions, policies, decisions, procedures, and essential transactions.

These records, which may exist in a variety of media, are Federal property and must be managed according to applicable laws and regulations. The Federal Records Act also requires agencies to establish a records management program, which means planning, controlling, directing, organizing, training, promoting, and other managerial activities involved with respect to records creation, records maintenance and use, and records disposition in order to achieve adequate and proper documentation of the policies and transactions of the Federal government and effective and economical management of PBGC operations. Records serve several important purposes including: facilitating administrative and program planning needs, documenting PBGC activities, protecting legal and financial rights, documenting the Agency’s history, and facilitating the continuation of key functions and activities in the event of an emergency or disaster. Records also serve as the Agency’s memory; they ensure that the organization continues to function effectively and efficiently.

5. DEFINITIONS:

a. CONTROLLED UNCLASSIFIED INFORMATION (CUI) - All unclassified information for which, pursuant to Federal statute or regulation, departmental or agency policy, there is a compelling requirement for safeguarding and/or dissemination controls.

b. CONTINUITY OF OPERATIONS EMERGENCY RECORDS PLAN – A written procedure that defines the measures taken to minimize the risks and effects of disasters, such as fire, flood, or earthquake, enabling employees to (protect) recover, save and secure vital records from adverse effects of the disaster.

c. DISPOSITION – Disposition is a comprehensive term that includes requirements for destruction, the long-term storage of temporary records, and the transfer of permanent records to NARA. These actions are taken with regard to Federal records that are no longer needed for current government business. Disposition authority and requirements are provided in the PBGC Simplified Records Schedules and in the General Records Schedules.

d. ELECTRONIC RECORDS – Any information that is recorded in a form that only a computer can process and that satisfies the definition of a Federal record in 44 U.S.C. § 3301.

e. ELECTRONIC MAIL (EMAIL) – A textual communication created or received on an electronic mail system that includes brief notes, formal or substantive narrative documents, and any attachments and other electronic documents, produced through word processing or other desktop software, which may be transmitted along with the message, and including associated metadata.

f. FILE PLAN – A classification scheme describing: different types of files maintained in an office; how they are identified; where they should be stored;

how they should be indexed for retrieval; and a reference to the approved records disposition schedule for each file.

g. INFORMATION SYSTEM OWNER – The Government official responsible for the overall procurement, development, integration, modification, or operation and maintenance of an information system.

h. METADATA – structured information that describes, explains, locates, or otherwise makes it easier to retrieve, use, or manage an information resource.

i. MIGRATION – The act of moving records from one system to another while maintaining the record’s authenticity, integrity, reliability, and usability. (Note:

migration is done to ensure continued access to information as the system or medium is replaced, becomes obsolete or degrades over time.)

j. NON-RECORD MATERIAL – U.S. Government-owned documentary materials excluded from the legal definition of records or not meeting the requirements of that definition: include extra copies of documents kept only for convenience of reference, stocks of publications and processed documents, and library or museum materials intended solely for reference or exhibition.

k. PERMANENT RECORDS – Records appraised by NARA as having sufficient historical or other value to warrant continued preservation by the Federal Government beyond the time they are needed for administrative, legal, or fiscal purposes. Permanent records will be transferred to the physical and legal custody of NARA in accordance with the instructions contained in the relevant records disposition schedule.

l. PERSONAL PAPERS – Documentary materials belonging to an individual that are not used to conduct official Agency business, related solely to an individual's own affairs, or used exclusively for that individual's convenience.

m. PRESERVATION – The processes and operations involved in ensuring the technical and intellectual survival of authentic records through time.

n. RECORDKEEPING – Making and maintaining complete, accurate, and reliable evidence of business transactions in the form of recorded information; the act or process of creating and maintaining records. Assumes the need for their proper disposition.

o. RECORD HOLD – A hold placed on the scheduled or routine destruction of records due to reasonably anticipated litigation, governmental investigation, audit, or other special organizational requirements.

p. RECORDS – Includes all books, papers, maps, photographs, machine readable materials, or other documentary materials, regardless of physical form or characteristics, made or received by an agency of the United States Government under federal law or in connection with the transaction of public business and preserved or appropriate for preservation by that agency or its legitimate successor as evidence of the organization, functions, policies, decisions, procedures, operations, or other activities of the Government or because of the informational value in them. Library and museum material made or acquired and preserved solely for reference or exhibition purposes, extra copies of documents preserved only for convenience of reference, and stocks of publications and of processed documents are not included. (44 U.S.C. chapter 33, Sec. 3301) Other attributes of records include:

(1) Adequate and proper documentation – a record of the conduct of Government business that is complete and accurate to the extent required to document the organization, functions, policies, decisions, procedures, and essential transactions of the agency and designed to furnish the information necessary to protect the legal and financial rights of the government and of persons directly affected by the agency's activities. (36 CFR 1220.18);

(2) Complete and accurate presentation – records must be authentic, reliable, complete, unaltered, useable and accessible over their lifecycle; and

(3) Assured integrity – all records are to be preserved in such a manner that the facilities and systems that store them must be able to protect them from unauthorized access and unauthorized modification over time.

q. RECORDS MANAGEMENT – The field of management responsible for the efficient and systematic control of the creation, receipt, maintenance, use, and disposal of records includes processes for capturing and maintaining evidence of and information about business activities and transactions in the form of records.

r. RECORDS CREATION – The first stage of the records life cycle in which records are made (captured, created, or received) by an office.

s. RECORD’ S LIFE CYCLE – Distinct phases of a record's existence from creation to final disposition.

t. RECORDS (RETENTION) SCHEDULE – A document, reviewed by NARA Staff and approved by the Archivist of the United States, that describes Agency records, establishes a period for their retention by the Agency, and provides mandatory instructions for what to do with them when they are no longer needed for current Government business.

u. RETENTION PERIOD – The time period records are kept according to operational, legal, regulatory, and fiscal requirements.

v. RETRIEVAL – The process of locating and withdrawing a record from a filing system or records center; the action of accessing information from stored data on a computer system.

w. STORAGE – The function of storing records for future retrieval and use.

x. TEMPORARY RECORDS – Records determined by the Archivist of the United States to have insufficient value (on the basis of current standards) to warrant its preservation by NARA. Temporary records have been approved by NARA for destruction after a specific time and/or trigger event.

y. TRANSITORY DOCUMENTS – Documents of short-term interest which have no documentary or evidential value. They are disposable because they do not pertain to the official activities of the Agency.

z. UNSCHEDULED RECORDS - Records for which no retention period ("schedule") has yet been determined.

aa. VITAL RECORDS – Records that are fundamental to the functioning of an organization and necessary to continue operations without delay under abnormal conditions; records necessary to protect the Government’s rights or the rights of its citizens.

bb. VITAL RECORDS PROGRAM – Policies, plans, and procedures developed and implemented and the resources needed to identify, use, and protect the essential records needed to meet operational responsibilities under national security emergencies or other emergency or disaster conditions or to protect the Government's rights or the rights of its citizens.

Note: Refer to the Records Management Common Terminology on the Records

Management Intranet website for a listing of applicable Records Management definitions.

6. POLICY

This Interim Guidance contains information regarding the management of Agency records in both hardcopy and electronic form. PBGC employees and contractors are responsible for ensuring that all PBGC records are managed in accordance with this Interim Guidance. Each department is responsible for maintaining its own records under the guidance of the PBGC Records Officer.

While the Records Management Processes and Procedures provide specific guidelines about particular matters, the overall Records Management Interim Guidance requires that employees and contractors:

usability, and reliability

c. Promptly discard records that have no lasting value in accordance with established retention and disposition guidelines

d. Retain all records legally required to be retained for as long as required in accordance with established retention and disposition guidelines

e. Regularly review stored records to ensure they are being managed and dispositioned properly.

Compliance with this Interim Guidance will be achieved through the implementation of the PBGC Records Management Program Procedures, the PBGC Records Management Procedures Manual, and appropriate training.

7. ROLES and RESPONSIBILITIES:

a. The Director of PBGC, or his or her delegee is responsible for:

(1) Ensuring that the organization makes and preserves records containing adequate and proper documentation of organizational functions, policies, decisions, procedures, and essential transactions of the Agency. This recordkeeping function enables the Agency to furnish the information necessary to protect the legal and financial rights of the Government and of persons directly affected by the Agency's activities.

(2) Establishing and maintaining an active, continuing program for the economical and efficient management of the Agency’s records.

(3) Establishing and maintaining safeguards against the removal or loss of records.

(4) Notifying Agency officials and employees of the requirements of the Records Management policy and the penalties for failing to comply with it.

(5) Ensuring that the Records Management strategy for PBGC is in alignment with the NARA guidance.

(6) Notifying the Archivist of the United States of any actual, impending, or threatened unlawful destruction of records and assisting in the recovery of such records.

(7) Assigning records management responsibility to a person and office with appropriate authority within the Agency to coordinate and oversee implementation of the Agency’s comprehensive records management program.

(8) Designating a Senior Agency Official for the implementation of the

Controlled Unclassified Information Program and associated activities.

b. The Chief Management Officer (CMO) is responsible for:

(1) Establishing PBGC Records Management policies and related procedures for the creation, use, maintenance, safeguarding, and disposition of records.

(2) Providing management oversight of the PBGC Records Management

Program.

(3) Periodically evaluating the Records Management Program’s compliance with NARA regulations, including records creation; maintenance and use of records; and records disposition.

(4) Serving as the Senior Agency Official for the implementation of the Controlled Unclassified Information Program and associated activities.

(5) Monitoring PBGC’s compliance with the requirements to review the

Agency’s Records Schedules.

c. The Director of the Facilities and Services Department (FASD) is responsible for:

(1) Designating a Records Officer with the responsibility for the daily administration and management of all facets of the PBGC Records

Management Program.

the PBGC Records Management Program.

(4) Overseeing and assisting with the implementation and performance of the

Records Management Program.

(5) Assessing and improving records management compliance with, and performance of records management responsibilities.

(6) Serving as a principle point of contact, supervising the implementation of the Controlled Unclassified Information Program and associated activities.

d. The Records Officer is responsible for:

(1) Implementing and maintaining an Agency-wide Records Management

Program.

procedures.

(4) Keeping senior management officials advised of records management activities.

(5) Ensuring that the Records Management Program remains viable while meeting operational, legal, and regulatory requirements.

(6) Conducting and coordinating a 3-year review cycle, updating and re-approval this Interim Guidance.

of PBGC’s records management activities.

(9) Ensuring records and other types of required documentary materials are not unlawfully destroyed, or removed from PBGC by current or departing officials, employees, or contractors.

(10) Providing input to the information technology organizations relating to records management requirements for all new or updated IT systems purchased and/or developed, and deployed.

(11) Serving as the Agency’s Vital Records Manager and in cooperation with the PBGC Department Contingency Plan Coordinators, assures that Vital Records needed during a Continuity of Operations Plan Emergency Records event are appropriately identified.

acceptable language/clauses to make sure that government contractors maintain records that document government activities. This includes the delivery of background and supporting information that may have reuse value to PBGC.

(14) Assisting PBGC business units and departments with records management to include:

(a) Creating and maintaining a Records Retention and Disposition

Schedule to instruct departments on how long to maintain PBGC records; also providing overall guidance on any recordkeeping requirements.

Emergency and Vital Records Plans.

(d) Developing guidance for business units to conduct Annual Records

Management Compliance Reviews.

(e) Providing feedback on all records management activities conducted by the business units/departments.

products provided by outside vendors.

(13) Serving as a principle point of contact for the implementation of the

Controlled Unclassified Information Program and associated activities.

e. The Records Management Business Council is responsible for:

(1) Providing input and expertise to ensure that goals of the Records

Management Strategic Plan are met.

(2) Attending and actively participating in all regularly scheduled Records Management Business Council meetings.

organizations.

(5) Making recommendations to the Executive Steering Committee on an as-needed basis.

The Records Management Business Council is comprised of managers and/or specialists from Office of Equal Employment Opportunity, Chief Insurance Program Officer, Chief Information Officer, Office of the General Counsel, Chief Operating Officer, Chief Financial Officer, Chief Management Officer, Office of the Director, and the Records Officer, who serves as The Chair.

f. The Office of General Counsel (OGC) is responsible for:

(1) Notifying the appropriate PBGC departments and/or employees of a Record Hold and directing affected employees and contractors to retain any potentially relevant records.

(2) Notifying the appropriate PBGC departments and/or employees of a release of record holds after the settlement of a matter.

a. Directing affected employees to resume managing records according to the Agency retention schedules.

(3) Providing legal advice and counsel to offices on all matters arising in the administration of this Interim Guidance.

(4) Reviewing and approving the Agency’s proposed records schedules prior to their submission to NARA.

(5) Determining if data can be disclosed based on PBGC disclosure guidelines and Executive Order 13556, Controlled Unclassified Information, and other applicable regulations and Executive Orders.

Records Management procedures with assistance from the Records Officer.

(3) Overseeing the development and maintenance of an accurate record inventory and Records Schedules for all records for which the department is the Custodian or Office of Record in conjunction with the Records Officer.

(4) Facilitating the fulfillment of record requests by regulators, auditors (both internal and external), the OGC, or any other functional area that requires access to records as they request them.

(5) Ensuring that the vital records inventory and designations for their department are current and complete.

(6) Ensuring that Controlled Unclassified Information in the Department is identified, designated, marked, safeguarded, and disseminated in accordance with this Interim Guidance.

(7) Designating Records Coordinators.

h. The Records Coordinators are responsible for:

(1) Acting as a liaison between its department and the Records Officer on all Records Management issues.

(2) Coordinating the transfer of records to and from the approved offsite records storage facilities.

(3) Overseeing the scheduling of Records Management training for departmental employees.

control.

(7) Notifying the Records Officer of new or unscheduled records found within the department.

(8) Coordinating acquisition of Records Management equipment, services, and supplies.

(9) Coordinating all vital records and Continuity of Operations Plan Emergency

Records related tasks.

(10) Coordinating all Controlled Unclassified Information related tasks in its

Department or business unit.

i. The Chief Information Officer (CIO) is responsible for:

(1) Reviewing records management policies and procedures for records in electronic formats.

(2) Reviewing records management policies and procedures for those systems that generate and/or retain electronic records to ensure they are developed, maintained, and consistent with the Agency's Records Management Program.

(3) Recommending to the Records Officer or Director, if appropriate, the resolution of issues and problems related to electronic records and those systems that generate and/or retain electronic records.

(4) Ensuring that policies, procedures, and systems are in place to enable effective and compliant management of electronic records and those systems that generate and/or retain electronic records.

(5) Performing periodic reviews of the effectiveness and efficiency of all PBGC electronic systems associated with, or part of, the Records Management program.

(6) Ensuring that records management requirements are addressed in the design, development, and implementation of new or updated electronic information systems.

(7) Assisting the Records Officer with assessments and audits that involve electronic records and systems that generate and/or retain electronic records.

(8) Developing management procedures for the Agency’s web site and social media operations and the records that document those operations.

(9) Ensuring that required website and social media management and operations records are created and maintained.

(10) With regard to new IT investments, development efforts, commercial off-the-shelf software projects, or any project with a focus on removal, archival, or clean up of data, ensuring authorization and guidance from the PBGC Records Officer.

(11) Ensuring electronic records have a media migration plan and schedule that ensures they are accessible during their full lifecycle period.

(12) Ensuring that procedures and processes are in place to enable effective and compliant management of Controlled Unclassified Information in systems that contain such information.

j. The Senior Agency Information Security Officer (SAISO) is responsible for:

(1) Establishing appropriate information security procedures to ensure the implementation of this policy as it relates to Controlled Unclassified Information.

k. The Information Systems Owners are responsible for:

(1) Adhering to all approved records management procedures, processes, practices, and guidelines as they relate to a particular business function or process, as well as Agency guidance on the management of Agency information including Controlled Unclassified Information.

(2) Ensuring that information identified as Controlled Unclassified Information is appropriately designated, marked, safeguarded, and disseminated in accordance with this Interim Guidance.

(3) Work with OIT and the Records Officer to ensure that, when appropriate, systems are designed and built to properly manage records throughout their life cycle, or that there are proper procedures in place to properly manage records throughout their life cycle.

l. The Users and Record Owners (Employees) are responsible for:

PBGC “Big Bucket” records schedules and into OIT created departmental records folders.

(4) Adhering to all approved records management procedures, processes, or practices and all guidelines as they relate to a particular business function or process, as well as Agency guidance on the management of Agency information including Controlled Unclassified Information.

(5) Using and administering records in accordance with approved processes and procedures.

(6) Alerting or updating their Department Directors or Managers when new record types are created so that retention, storage, and destruction requirements can be assessed and assigned.

m. The Procurement Department is responsible for:

(1) Ensuring that contracts involving work with Controlled Unclassified

Information include appropriate information and vendor requirements for identifying, designating, marking, safeguarding, and disseminating

Controlled Unclassified Information in accordance with this policy.

(2) Ensuring that Controlled Unclassified Information obtained, including confidential bid or proposal information, submitted to PBGC is identified, designated, marked, safeguarded, and disseminated in accordance with this Interim Guidance.

(3) Ensuring that all contracts include a records management clause indicating that contractor-created records are Federal records.

n. The Disclosure Officer is responsible for:

(1) Ensuring that Controlled Unclassified Information to be disclosed is disseminated in accordance with this Interim Guidance.

o. The Chief Privacy Officer is responsible for:

(1) Ensuring that Controlled Unclassified Information to be disclosed is identified, designated, marked, safeguarded in accordance with this Interim Guidance.

8. INTERIM GUIDACNE REQUIREMENTS:

a. Record Creation

(1) All records created by PBGC employees or that become PBGC records by virtue of law or third party agreements, are the sole property of PBGC and not the property of individual employees.

(2) Every department has the responsibility to create records detailing the transactions of Agency business as well as documenting decisions made by the Agency. Any record created within PBGC should document PBGC functions, policies, decisions, procedures, and/or transactions and must be retained in accordance with approved records schedules.

(3) In order to ensure the accuracy and integrity of PBGC information, records must be created using PBGC approved programs, systems, and equipment internally or in conjunction with approved business partners.

(4) Record content must be factual, to the best of the record creator’s knowledge, and must not contain any misrepresentations.

(5) Record owners must ensure that required information is captured when the record is created to allow users to search for and retrieve content quickly and accurately during the normal course of business.

(6) New records must be added to the Department File Plan under the appropriate record categories. If no appropriate record category exists, a new record category must be created and added to the Department File Plan.

(7) New record categories must be added to the De partment File Plan with the following information:

(8) All PBGC record information must be originated by employees, Plan

Participants, or an approved PBGC business partner or contractor.

b. Record Distribution and Use

environment without specific authority from the OGC or the Department Director or Manager. This authorization, if granted, must be documented and kept on file with the Department Directors (or Managers) and the Records Officer.

(3) Employees participating in telework or flexiplace arrangements shall secure all records in accordance with PBGC information security policies and procedures, a s well as their Telework Agreement.

c. Record Storage and Retrieval

(1) Storage

(a) All records, regardless of format or media, must be stored in a manner that facilitates quick, reliable, and accurate retrieval for the entire lifecycle of the record.

(b) Records filing, indexing, and storage systems shall be designed, implemented, and documented to the extent necessary to maximize their usefulness and facilitate access and retrieval for the life of the record.

(c) Each Department shall have a File Plan whereby records shall be organized and indexed in a manner that permits employees with a need to access and retrieve the records to do so efficiently and effectively, as documented in the Department’s File Plan.

(d) Departments shall create standardized filing, indexing, organizing, and storage procedures, processes, and practices to facilitate the efficient and effective retrieval of records. These procedures, processes and practices shall be documented and approved by the Records Officer.

(e) All records scheduled to be stored at the approved off-site storage facility must be processed in the following manner:

i. The Records Coordinator must ensure that all paper-based records are grouped according to record series, retention period, and destruction method prior to being removed from their respective departments. For example, a single box of records sent to off-site records storage is required to contain records that are of the same series and must be destroyed within the same period and in the same manner.

ii. The Records Coordinator is required to conduct a review and inventory of the Off-site Storage Transmittal Form to ensure that all required fields are completed.

(f) Record storage technology reviews are required every 3 to 5 years, to ensure that the overall readability, retrievablility, and integrity of the records are not compromised. Reviews of records storage technologies are conducted under the guidance of OIT.

(g) The Records Officer will work with OIT to identify conditions that necessitate a review of records storage technologies and the business owner of the implicated technology will be notified.

(2) Retrieval

(a) Departments must follow the documented records management procedure to locate and retrieve archived records from off-site storage.

(b) All records retrieved from any PBGC off-site storage vendor must be tracked in the following manne r:

i. All off-site storage retrieval and accession requests must be forwarded through the designated Records Coordinator.

ii. The Records Coordinator possesses exclusive authorization to process records for off-site storage and retrieval for its department.

With the exception of the Department Directors or Managers, o r their designee, no other employees or contractors may contact the off-site storage vendor for the shipping and receiving of records or creation of a new account.

iii. The Records Coordinator shall track all record shipping and receiving activity in a manner that provides the immediate ability to locate off-site storage records.

iv. With the exception of records that are subject to legal, audit, or regulatory holds, any records received from off-site storage may not be maintained on-site by any PBGC department for more than 60-calendar days after the records are no longer needed.

(c) The Records Coordinator shall conduct an accounting of all records retrieved from offsite storage on a semi-annual basis to ensure that no off-site storage records are being maintained beyond the 60-calendar day limitation that do not meet the legal, regulatory or audit hold exception criteria.

d. Records Retention and Disposition Scheduling

(1) All PBGC records must be retained in accordance with NARA-approved PBGC records schedules and/or NARA issued General Records Schedules (GRS), which is available at http://intranet/records_management/RM_Docs/N1-465-09-1.pdf.

(2) All records must be retained in a readily accessible form. Records retention and disposition schedules will take into consideration the following conditions:

governing the record and/or business process;

(c) The retention period can exceed Federal laws and regulations governing the record if the associated business needs warrant it and approval is granted by NARA;

(d) Records retention and disposition requirements may only be suspended by a Record Hold communicated by the OGC, OCC, or other applicable authority;

(e) Each department shall identify unscheduled Agency records on an ongoing basis and promptly report them to the Records Officer so that the new records can be added to the PBGC records schedules; and

(f) Unscheduled Federal records may not be destroyed or deleted.

e. Records Retention

(3) All PBGC records must be retained in accordance with the current PBGC Records Schedules, which is available at http://intranet/records_management/RM_Docs/N1-465-09-1.pdf.

records hold communicated by the OGC, OCC, or other applicable authority.

(6) If, during the course of business, a Department creates a new business process or otherwise finds records that do not appear in the PBGC records schedules, they shall notify the Records Officer so that the new records can be added to the PBGC records schedules.

f. Record Destruction

(1) No record may be destroyed before the expiration of the designated retention period.

http://intranet/records_management/RM_Docs/N1-465-09-1.pdf http://intranet/records_management/RM_Docs/N1-465-09-1.pdf

(2) Records, including copies that fall under a Record Hold may not be deleted, disposed of, or destroyed until the hold is lifted. Once the hold is removed, the official record must be maintained for the required retention period.

(3) Copies of records can be destroyed immediately. Employees must not destroy any records, including record copies, that are relevant or potentially relevant to an ongoing lawsuit, audit or regulatory/government investigation. Employees must not destroy records if there is reason to believe that the record may be relevant to reasonably anticipated litigation, an audit or regulatory/government investigation.

(4) Destruction of all eligible records must be conducted in a manner that renders them irretrievable.

(5) No PBGC employee may destroy records internally. All records eligible for destruction must be placed in an authorized destruction container or staging area located in a designated area, as determined by the Agency’s Records Officer for removal and destruction by an authorized offsite storage vendor.

(6) A Retrieval and Destruction Request must be made by the Records Coordinator and submitted to the Records Officer, in order to arrange for the pick-up and destruction of records.

(7) Local departmental shredders are NOT to be utilized for the destruction of records without written authorization from the Records Officer. Local shredders may be used for the destruction of Transitory Documents only.

(8) Under no circumstance should anyone destroy or hide or fail to disclose existence of records when there is a reasonable anticipation of litigation, or and audit or investigation.

(9) The authorized off-site storage vendor will be instructed to adhere to the record destruction guidelines in this Interim Guidance.

(10) Each PBGC department must maintain approved certifications for all records that it has destroyed in accordance with the retention schedule and the manner of destruction, e.g., certifications from an outside vendor, reports from a tracking system, or Records Management Certificate of Destruction form.

(11) Any suspected or known instances of unlawful or accidental destruction, removal, defacing, or alteration of records shall be reported to the Records Officer.

g. Permanent Records

(1) Permanent records shall be promptly transferred to the custody of the National Archives in accordance with the instructions of the PBGC Records Schedules.

(2) Appropriate staff, in cooperation with the Records Officer, shall ensure that information copies of SF-258s used to document transfer of permanent records to the National Archives are provided to the Agency’s Records Officer in a timely manner.

(3) Permanent records shall be created, maintained, and stored in media and formats that adhere to NARA standards contained in 36 CFR § 1235.

h. Vital Records

(1) Vital Records are records that contain information necessary to re-establish the organization in the event of a hazard or disaster, including information needed to rebuild PBGC’s legal and financial information base.

(2) Any record classified as vital must be secured in a manner that completely preserves and protects the integrity of the record. Examples of securing vital records include locking fireproof file cabinets, safes, or other fireproof storage devices, using an offsite storage facility to store official backup copies, and/or using an offsite data recovery/backup center.

(3) The Department Directors or Managers must ensure that methods used to protect and safeguard the department’s vital records from loss, misuse, and unauthorized access or modification are created and implemented in accordance with the Records Management Interim Guidance.

i. Continuity of Operations Plan Emergency Records

(1) All PBGC departments must complete a Continuity of Operations

Emergency Records Plan (the COOP Vital Records Requirements, included as an appendix to the department’s COOP Plan) for their records, for the level of protection needed, and the speed in which the records must be retrieved in the event of a hazard or disaster. The plan must include roles and responsibilities and provide detailed instructions describing what role-based actions must take place in the event of a hazard or disaster affecting records, regardless of storage location.

(2) All Continuity of Operations Emergency Records Plans must be reviewed by the FASD Director, OGC, COOP Contingency Plan Specialist, the

Records Officer and the Department Directors or Managers, or his or her designee, prior to distribution and implementation.

(3) The Records Management Continuity of Operations Plan Emergency

Records Plan is to be stored in a format and a secure location that is readily accessible in the case of an event that necessitates the use of the plan. The plan must be compliant with the PBGC records management policies and procedures as well as the PBGC Continuity of Operations policy. An additional copy is to be submitted to the Records Officer and the original kept on file.

(4) The Records Management Continuity of Operations Emergency Records Plan must be managed as a vital record.

j. Record Holds

(1) PBGC employees must preserve records and any other materials relevant to any inquiry, or investigation, litigation, reasonably anticipated litigation, and/or are the subject of a pending record request or subpoena. If there are any doubts or concerns about whether to retain such records, the employee immediately must preserve the records or other materials and seek guidance at once from the OGC.

(2) When OGC or OCC learn about the existence any inquiry, or investigation, litigation, or reasonably anticipate litigation, all affected PBGC departments will be contacted. The OGC communication will describe the nature of the proceeding in sufficient detail to enable the affected departments to understand which records and other related materials must be preserved.

(3) It is the responsibility of the Department Directors or Managers to take every possible step to ensure that procedures concerning litigation, inquiries and investigations are followed, including imposing suspension of routine record destruction policies and procedures.

k. Annual Record Reviews

(1) It is the responsibility of each Department Director or Manager to ensure that the department conducts an Annual Records Compliance Review.

(2) The Annual Records Compliance Reviews are to be conducted and submitted to the Records Officer no later than November 30 of each year.

(3) The Annual Records Compliance Review must be conducted utilizing the Records Compliance Checklist provided by the Records Officer.

(4) Key Records Management compliance questions to be addressed in the

Compliance Checklist are as follows:

Prevention and Recovery Plan

(5) All PBGC departments must access the Intranet or contact the Records

Officer to obtain copies of the Records Compliance Checklist and the

Records File Plan templates.

l. Records Management Training

(1) The Agency shall provide records management orientation training to new employees and adequate training to other employees to ensure they are, and continue to be, aware of their responsibilities to maintain and safeguard Agency records as well as Controlled Unclassified Information.

(2) Additional role-based training for the Records Officer, Records Coordinators, and additional roles, as appropriate, is also required to ensure PBGC records are successfully managed in accordance with this Interim Guidance and NARA requirements.

m. Controlled Unclassified Information (CUI)

information requiring safeguarding or dissemination controls as set forth in law, regulation, or Government-wide policy.

(b) If there is significant doubt about whether information should be designated as CUI, it shall not be so designated.

information that requires safeguarding or dissemination controls. Such markings shall only be authorized when controls are required pursuant to and consistent with applicable law, regulations, and Government-wide policies.

(b) All CUI markings shall be in conformance with the instruction contained within the Controlled Unclassified Information (CUI) Office (NARA) Notice 2011-01: Initial Implementation Guidance for Executive Order 13556.