SD950 Web Management.pdf

SMITHSONIAN DIRECTIVE 950,

April 20, 2012

MANAGEMENT OF THE SMITHSONIAN WEB

Purpose 2 Scope 3 Guiding Principles 4 Definitions 5 Roles and Responsibilities 7

POLICY 10

Content Development 10

Unit Web Management Plans 10

Domain Names 10

Visitor Supplied Content 11

Recognition of Sponsorship 11

Links to External Websites 12

Links from External Websites 13

Site Assessments 13

Smithsonian Web Portal 14 Security 14

Payment Card Industry Data Security Standard 14

Security Certificates 15

Security Reviews 15

Security and Performance Testing 15 Privacy 16

Collecting Personally Identifiable Information 16

Privacy Reviews of Personally Identifiable Information 16

Children and the Internet 17

Privacy Notice 17

Tracking Technologies 18

Visitor Communication Opt In/Opt Out 19 Terms of Use and Permission Restrictions 20

Terms of Use Notice 20

Use of Copyrighted and Restricted Material 20

Release Forms 20 Accessibility 21

Smithsonian Directive 950, 04/20/12

Standard Plug-Ins and Web Applications 21

Consideration for Visitors with Disabilities 21

Search 22

Metadata 22

Portability of Information 22

Usability of Data 22 Development and Maintenance 23

Separation of Development and Production Environment 23

Web Infrastructure Review 23

Web Servers and Storage 25

Common Web Development Tools 25

Common Web Applications 25

Contracts and Purchase Orders 25

Donations of Software and Hardware 25

Content Provider Contact List 26 Records Management 26

Records Retention for Web 26

Capturing Websites for Archival Purposes 26

Appendix A: Sample Notice of PII Collection by a Third-Party Site

Purpose

All of the websites and Web applications of the Smithsonian Institution serve national and international audiences in broadening access to Smithsonian exhibitions, research, programs, staff, collections, and digital assets. The Smithsonian offers to the public opportunities to learn about its exhibitions, programs, research, and collections through its Web presence.

The policies and procedures set forth in this directive were developed to ensure the integrity of our content, reliability of our Web infrastructure, and usability of our websites while protecting the privacy of our visitors and the reputation of the Institution through proper Web management practices.

Web management includes all the processes involved in building and operating an organization’s Web presence. This includes managing content, applications, infrastructure, staff, and design; and following best practices, policies, and procedures

Purpose (continued) needed to maintain order and meet organizational goals. The development and maintenance of the Smithsonian Web presence is performed by Web practitioners across the Institution either as a primary or collateral duty or by third parties with whom the units contract to develop and maintain their sites. For purposes of this policy, units refer to museums, offices, and programs within the Smithsonian.

This directive establishes the framework of the Smithsonian’s Web management policy; and assigns responsibilities for all involved in the development and management of Smithsonian public-facing websites — including managing content and applications, infrastructure, design, implementing best practices, and the policies and procedures necessary to protect the interests of the public and the Institution — to meet Smithsonian goals.

Implementation details are documented in the 950-series of Information Technology Technical Notes.

Scope

This directive applies to all Smithsonian public-facing websites and Web and mobile applications, regardless of funding sources and whether or not they are hosted on Smithsonian servers.

It does not apply to internal websites not intended for the public (e.g., intranets such as Prism) or non- Smithsonian websites and applications on which the Smithsonian has chosen to place its content to broaden access to Smithsonian knowledge and digital assets (e.g., Flickr or Facebook). Smithsonian activities on social media sites are addressed by SD 814, Social Media Policy.

This directive does not apply to non-Smithsonian websites and applications in which the Smithsonian is a collaborator, such as the Encyclopedia of Life, or in situations where the Smithsonian is a service provider, such as Chandra’s website operated by the Smithsonian Astrophysical Observatory (SAO) on behalf of the National Aeronautics and Space

Scope (continued)

Administration (NASA). Under these circumstances, written agreements with the collaborating entity or entities will take precedence even though they may be informed by this policy.

Guiding Principles

The guiding principles for Web management are as follows:

1. Use the World Wide Web to help the Institution achieve its mission, vision, and goals. The Institution shall establish a world-class Web presence to enhance public outreach by providing online access to Smithsonian collections, exhibits, programs, research, and staff while employing practices that ensure the accuracy, integrity, and currency of its Web content.

2. Maintain flexibility by allowing Smithsonian units to manage their Web content while also adhering to Smithsonian policies and benefiting from shared services. The creation of content for Smithsonian websites is the responsibility of individual Smithsonian units, with the directors of museums, research centers, and offices ultimately responsible for their organization’s Web content.

Units should leverage emerging Web technologies in their online exhibits to engage and draw visitors to Smithsonian collections and expertise. The Office of the Chief Information Officer (OCIO) is responsible for maintaining the Web infrastructure and providing technical guidance on current and emerging Web technologies in partnership with unit IT staff. The Office of Communications and External Affairs (OCEA) is responsible for maintaining SI.EDU and Smithsonian.org.

3. Promote a common image of the Smithsonian to the public through the Institution’s public-facing websites. Websites shall clearly be identifiable as belonging to Smithsonian units; they shall also use common themes, associations, branding, and visual identity.

Definitions

Content includes text, audio, video, and images, as well as applications providing interactive services over the Web and through new media.

Home Page is the webpage that serves as the front door of a website.

Informational Websites, for the purposes of this directive, are webpages other than those that comprise an online exhibit or Web/mobile application.

Informational websites often provide information about the Institution, its governance, museums, programs, research facilities, and research activities and findings.

Online Exhibits are exhibits that either complement an on-site exhibit or are a stand-alone virtual exhibit or run in a mobile application. Online exhibits may include a high usage of multi-media, plug-ins, and emerging Web technologies to entice and entertain while imparting knowledge.

Personally Identifiable Information (PII) is information about individuals maintained by the Smithsonian, including information which can be used to distinguish or trace an individual’s identity and any other information that is linked or linkable to an individual, such as medical, educational, financial, or employment information. Examples of PII include, but are not limited to: (a) general personal data such as full names, maiden names, aliases, and full dates of birth;

(b) address information such as street and email addresses; (c) personal identification numbers such as Social Security number, passport, driver’s license, taxpayer identification, financial account, and credit card numbers; (d) security information such as passwords, mother’s maiden name, etc.; and (e) personal characteristics that identify individuals, fingerprints, handwriting, etc., or biometric data such as retina scans, voice signatures, and facial geometry.

Smithsonian Public-facing Website is a website made available to the public by a Smithsonian unit, office, or program. The website is controlled by the Smithsonian; it may support collaboration with partners or accept user-generated content. The intended

(continued) audience is the public rather than Smithsonian staff.

Social media sites such as Facebook or YouTube, containing Smithsonian content, are accessible from Smithsonian public-facing websites; however, they are not part of that website for purposes of this policy.

Websites that the Smithsonian operates on behalf of a consortium or an independent organization are included in this definition only if they are hosted on Smithsonian-controlled Web servers and address audiences in addition to Smithsonian staff, in which case this directive will also apply to them.

Smithsonian Web Portal is the top level point of entry to the Smithsonian’s Web presence, www.si.edu, and the second-tier pages linked directly from this page.

Technical Reference Model (TRM) identifies a comprehensive set of information technology (IT) standards, services, protocols, and products that define the target technical environment for the acquisition, development, implementation, and support of IT systems and infrastructure. It includes a list of “Preferred Products” — commercial application software packages, hardware, and software components that conform to the TRM target architecture. See technical standard and guideline IT- 940-TN01, Technical Reference Model, for more information.

Web Application, for the purposes of this document, is either an application which gathers, stores, and processes user input through a Web interface; or which displays information on the Web generated in response to user input — excluding database-driven Web content. Web applications also include New Media applications with similar behaviors, such as smart phone applications.

Website is a set of interconnected webpages and applications that are intended by the site owner to be a collection of information accessed through a single site.

This includes database-driven websites.

World Wide Web is a system of Internet servers that http://www.si.edu/ support documents formatted in Hyper Text Markup Language (HTML) script, with links to other Web content.

Roles and Responsibilities

The Office of the Chief Information Officer (OCIO) is responsible for establishing technical standards related to the Web; designating preferred products for use in website design and content management; operating and maintaining Web infrastructure except for SAO and the Smithsonian Tropical Research Institute;

maintaining connectivity to Internet 1 and Internet 2;

registering Smithsonian domain names; updating the TRM; collecting usage statistics; and ensuring that computer security controls are in place.

The Office of Communication and External Affairs (OCEA) maintains the Smithsonian portal (SI.EDU and SMITHSONIAN.ORG top pages); ensures that the content and branding of all Smithsonian public informational webpages adhere to Smithsonian style guidelines when implementing the optional Smithsonian templates, and follow documented Smithsonian standards for website design and usability; regularly conducts surveys on www.si.edu to determine the reasons that people visit the website, their educational levels and occupational interests, their needs with respect to content, and their location; and maintains an online listing available to the public of contact information for each unit’s rights and reproduction points of contact and the contact in the Office of Product Development and Licensing to be linked to from the Smithsonian’s Terms of Use webpage.

Accessibility Program staff provide guidance to assist with designing and testing websites for accessibility.

Directors of Museums, Research Centers, and Offices are responsible for ensuring that all units within their organizations adhere to Smithsonian Web policies, and for ensuring the integrity of the content in unit websites and online exhibits. Directors may designate staff to assume day-to-day responsibility and approval of content.

The Office of Contracting and Personal Property Management (OCon&PPM) will ensure that all contracts it awards to develop Web content incorporate compliance with this policy as a requirement in the successful delivery of a work product.

The Office of Advancement (OA)/Office of Corporate Relations approves recognition of corporate sponsorship and active links to sponsors’ commercial or corporate enterprises from Smithsonian Web content, and provides guidance and coordinates online fund raising across the Institution.

The Office of General Counsel (OGC) provides guidance on the legal aspects of use of the Web by the Smithsonian; is responsible for updating, as warranted, the Smithsonian’s standard website terms of use notice;

makes determinations on requests to waive or modify these notices; and advises on content-based restrictions.

The Office of Policy and Analysis (OP&A) reports on external awards/recognition of the Smithsonian Web presence in thrice-yearly reports to the Board of Regents, and reports on the number of website visitor sessions in the annual performance reports.

Smithsonian Institution Archives (SIA) manages, preserves, and makes accessible the official and historical records of the Institution. It also provides records management services, including record disposition schedules for unit websites, Web applications, and online exhibits. SIA is the central repository for storing the historical snapshots of Smithsonian websites and related content.

Smithsonian Enterprises (SE) approves recognition of commercial sponsors and active links to commercial or corporate enterprises from Smithsonian Enterprises’ Web content. SE will ensure that all contracts it awards to develop Web content incorporate compliance with this policy as a requirement in the successful delivery of a work product.

The Smithsonian Privacy Officer (SPO) conducts privacy reviews of Smithsonian websites and Web applications — and websites and Web applications operated on behalf of the Smithsonian — that collect, maintain, or disseminate PII; provides general advice on privacy matters; and coordinates with OGC to provide legal advice on privacy issues.

Web Content Teams are formed to support the development and ongoing maintenance for specific websites and online exhibits. The composition of the team varies based on the needs of the effort and may include representatives from departments and divisions

— representing relevant collections, research, education, exhibitions areas, and public affairs — as appropriate for the purpose of creating and reviewing Web content.

Web Management Offices are located in several larger units. Their primary responsibility is managing their unit’s websites. The exact responsibilities of this office are defined by the unit’s director, and may extend from basic Web content maintenance to website and applications development, the management of outsourced Web-related contracts, and policy, technical standards and strategic planning for the unit’s Web-based outreach. The composition of staff in this office varies by unit (e.g., project manager, content manager, user experience designer, graphic designer, database administrator, editor, programmer/application developer). Web content development and review are generally coordinated by this office with the other divisions within the unit.

Web Practitioners are responsible for implementing and maintaining the Web content and/or Web infrastructure both in OCIO and throughout the Institution — including within unit Web Management Offices, if a unit has a Web Management Office.

POLICY

Content Development

Smithsonian units determine and develop the content of their websites consistent with the Institution’s mission.

This section describes:

Unit Web Management Plans Units with at least one public-facing website are required to develop and maintain a Unit Web Management Plan describing the procedures by which it produces and manages its Web content, and its review practices regardless of where the site is hosted.

New content — including significant updates or additions — shall be reviewed and approved consistent with the unit’s written procedures prior to releasing it for public dissemination. The plan should be regularly updated as required to accurately address the level of detail warranted based on the scale and complexity of the unit’s websites.

OCIO shall provide units with guidance on the development of these plans. Each unit’s Web Management Plan will be approved by the unit director and submitted to OCIO. The website’s Web practitioner and/or the unit’s Web Management Office shall retain a copy of these plans.

Domain Names All new Smithsonian websites shall use the Smithsonian Institution domains of SI.EDU, SMITHSONIAN.ORG, SMITHSONIAN.MUSEUM, or SMITHSONIAN.COM, or such other top level domains as may be acquired and made available from time to time. Acquisition of new top level domain names for pan-institutional use shall be coordinated by the Office of Public Affairs (OPA) in OCEA, OCIO, and OGC. OCIO may grant exceptions to use other domain names for, but not limited to, e-commerce websites or websites created for tenant organizations or special projects, or with other non-profit organizations pursuant to a written agreement.

POLICY (continued)

Only OCIO is authorized to register and acquire domain names for the Smithsonian Institution, in consultation with OGC and OPA. All requests for new domain names or to acquire domain names from third parties — including the registration — shall go through this office unless this responsibility is delegated in writing from OCIO. OCIO will consult with OGC, as needed, in acquiring domain names from third parties.

When exceptions are granted to use a domain name other than one listed above, the Smithsonian units are responsible for paying these domain name registration fees, as applicable, for the duration of the time the domain names are needed, plus an additional dormancy period as set forth in OCIO Technical Note IT-950-TN02.

The OCIO and the OGC are responsible for responding to third-party misuse or infringement of the Smithsonian’s domain names, and trademarks, and other forms of cyber-squatting, including efforts to prevent others from using domain names that create the appearance of being associated with the Institution.

Visitor Supplied Content (aka User-Generated Content) Refer to SD 814, Social Media Policy, when using Web technologies to host areas that allow visitor supplied content from the general public, such as blogs or message boards, and visitor comments.

Recognition of Sponsorship Recognition of financial or “in-kind” support through an active link to a sponsor’s website or display of a sponsor’s logo is only permitted in accordance with SD 809, Philanthropic Financial Support.

Units should contact their development office for guidance on recognizing corporate sponsorship. If a unit does not have its own development office, then it should contact the Smithsonian’s OA for guidance.

Links to External Websites Smithsonian websites may use external links consistent with mission goals, visitor needs, and Web community best practices to improve engagement with the public. Smithsonian units may link to third-party websites that are relevant and appropriate to the purpose of the Smithsonian webpage on which the link will appear. As a general rule, the Smithsonian does not allow links to third-party commercial sites that promote goods or services in a manner that can be construed as a Smithsonian endorsement of such goods and services, unless there is a programmatic-related reason as set forth below.

Links from Smithsonian websites may include, but not be limited to:

a) Non-profit, non-governmental organizations, or educational websites, including schools and museums both domestic and foreign;

b) Governmental websites, including United States, state and local levels of government, and foreign governmental websites;

c) Official social media accounts maintained by the Institution (See SD 814);

d) Certain commercial sites providing the software required for viewing Smithsonian websites, such as Adobe®;

e) Vendors that offer products valuable to or necessary for visitors, such as ticketing agencies;

f) Companies, organizations or associations with a contractual relationship to the Smithsonian, in which the contract provides for linking to/from Smithsonian websites in furtherance of a Smithsonian program or activity (e.g., Smithsonian Associates linking to an online book retailer where the book retailer sells a book necessary for a specific program and provides the Smithsonian with a fee for each purpose, or links to the Smithsonian’s authorized product licensees);

g) Sponsors of Smithsonian exhibitions, programs, and activities, pursuant to a written sponsorship agreement, provided that links from the Smithsonian websites must not be made to a webpage on which the sponsor’s products or services are promoted, marketed, and sold;

h) External websites that enhance the content and/or broaden access of a Smithsonian website consistent with the mission and goals of the Institution. Examples include, but are not limited to:

— External websites and applications on which the Smithsonian chooses to display Smithsonian content.

— External websites that help Web users organize and share Smithsonian content with other users.

— Related content including both online and traditional publications.

i) Websites that collect personally identifiable information from members of the public (i.e., using SurveyMonkey to conduct a survey or using an e-commerce vendor to process donations) for Smithsonian use, subject to conformance with SI privacy policy requirements.

Units should consult with OGC and OCEA regarding external linking questions.

Links from External Websites The Smithsonian neither authorizes nor prohibits links to its website provided that such links do not connote an endorsement by or affiliation with the Institution.

Site Assessments

Smithsonian Web practitioners should regularly evaluate and assess customer satisfaction and website usability. To improve the Smithsonian’s Web presence, this assessment can be accompanied by gathering customer feedback and leveraging TRM-compliant automated tools to capture metrics reflecting visitor patterns and usage.

Units should:

a) Collect and monitor customer feedback such as through Web usage statistics, customer surveys, and email inquiries.

b) Capture and report metrics, including site traffic, against unit goals.

c) Evaluate site traffic to identify and correct or remove underused content.

Smithsonian Web Portal All websites should clearly identify the Smithsonian unit, and at a minimum the website’s home page shall include a link labeled “Smithsonian” or “Smithsonian Institution” that points to the Smithsonian Web portal, www.si.edu.

The Smithsonian Web portal, www.si.edu, provides general information about the Institution, links to Smithsonian museums, research centers, and offices, terms of use, privacy policy, and certain other institutional policies. OPA is responsible for maintaining the content of the top-tier Smithsonian Web portal pages.

Security

Payment Card Industry Data Security Standard The Payment Card Industry Data Security Standard (PCI DSS) represents a common set of industry tools and measurements to help ensure the safe handling of sensitive card holder information to protect the security of consumers’ credit card information during the storing, processing, or transmitting of cardholder data. If credit cards will be accepted on a Smithsonian website, the website shall be developed and maintained in compliance with SD 309, Merchant Accounts, Payment Cards, and the PCI Data Security Standard, regarding PCI compliance.

All Smithsonian public-facing websites, whether or not they accept credit cards, are subject to PCI-compliance scans. Any third-party site authorized by the Smithsonian to process payment cards, on the Institution’s behalf, is also required to be PCI compliant.

Security Certificates

If a unit’s website or Web application collects any PII or financial information from a visitor, the communication shall be encrypted using secure socket layer (SSL) or other methods approved by the Smithsonian’s computer security manager, OCIO. The unit is responsible for the implementation of authentication technology, including security certificates, and for the initial costs of the security certificates for an individual website or application.

Security Reviews The OCIO director of computer security is responsible for conducting security reviews to identify authentication techniques or Web application vulnerabilities. These reviews are used to identify safeguards for protecting Smithsonian data and systems, and for protecting PII from unauthorized access and potential misuse.

The security review will ensure that the acquisition, access, use, and dissemination of PII comply with applicable Smithsonian security policies.

Security reviews will be conducted using tools approved by the Smithsonian computer security manager in OCIO for all websites, online exhibits, and Web applications. Where user authentication is warranted, an additional authentication review will be required to determine the appropriate authentication method.

Security and Performance Testing Before a new website, online exhibit, or Web application is moved to production, it shall pass security and performance testing requirements as established by the Smithsonian computer security manager and OCIO’s Web Services Division.

Security and performance testing is also required when there is a significant change — that is, not purely a content change.

Privacy

Collecting Personally Identifiable Information As a public trust, it is imperative that the Smithsonian collect, maintain, and disseminate personally identifiable information (PII) in a manner which does not adversely impact the integrity of, or the public’s confidence in, the Smithsonian, its work, or its mission.

If a website or application collects PII, it shall only collect the minimal information required to meet Smithsonian mission or business needs; and PII that is knowingly and voluntarily provided by the visitor.

If an external website is used to collect PII from members of the public (e.g., an online survey or an e-commerce vendor), it must be clear to the general public that they are leaving a Smithsonian website, and that the destination website’s terms of use and privacy policy will apply. Units should consult the SPO to develop disclaimer language and implementation methodology which will vary depending upon the facts and circumstances. (See Appendix A for sample language.)

PII must be protected in a manner commensurate with its sensitivity and the risk of harm to the individual from unauthorized use or exposure, regardless of the media type used to store it (i.e., paper or electronic).

Privacy Reviews of Personally Identifiable Information The SPO shall conduct privacy reviews of Smithsonian websites and websites operating on behalf of the Smithsonian that collect, maintain, or disseminate PII in electronic form from or about members of the public. The review will ensure that the collection, maintenance, and dissemination of PII comply with applicable Smithsonian privacy policies.

Children and the Internet While the Children’s Online Privacy Protection Act of 1998 (COPPA) does not apply to the Smithsonian, the Institution is committed to protecting children and follows the provisions of the Act as a best practice. Units should consult the SPO before launching any website collecting PII from children under 13 or targeting that audience.

Privacy Notice The SPO is responsible for maintaining a standard Smithsonian Web privacy notice to be posted to www.si.edu/privacy; for coordinating with OCIO to translate this privacy policy into a standardized machine-readable format1; and for updating this notice to reflect changes in the Smithsonian privacy policy in a timely manner. All Smithsonian websites (including those operated on behalf of the Smithsonian) must contain a link to the Smithsonian Privacy Notice or an SPO-approved Customized Privacy Notice.

The privacy notice, whether standard or customized, must be available in both machine- and human-readable format (e.g., Platform for Privacy Preferences Project [P3P]).

The SPO may grant deviations from the privacy policy on a case-by-case basis. Any deviation must be documented and include SPO-approved terms.

These terms must include the duration of the deviation. The SPO shall review all waivers in event of a change in the Standard Privacy Policy.

1 Machine-readable Format is a statement written in standard computer language (e.g., XML instead of English text) that can be interpreted by an application such as a Web browser. The Platform for Privacy Preferences Project (P3P) is the format developed by the World Wide Web Consortium for this purpose.

http://www.si.edu/privacy

Tracking Technologies Persistent tracking technology includes any technology that is intended to maintain information about a visitor beyond one browser session, such as a cookie. Session cookies, which are by definition not persistent, may be used to facilitate a visitor’s activity within a single session and are not retained once the session has ended.

The Smithsonian allows the use of tracking technology on its websites for the purposes of:

a) Gathering aggregate information about website visits in order to understand visitor use and experience on the websites, with the goal of improving use and experience;

b) Allowing website visitors to register with Smithsonian websites and set their preferences;

c) E-commerce activity, such as allowing for shopping carts and check outs;

d) Marketing Smithsonian products and services to consumers;

e) Conducting market research;

f) Serving relevant advertising;

g) Collecting marketing information about visitors on Smithsonian e-commerce2 websites, including Smithsonian Enterprises’ websites;

h) Collecting PII about subscribers and donors from online fundraising and membership websites, which are clearly identified as such;

i) Customizing a website at the visitor’s request to enhance the experience.

Any new use of a cookie that collects PII, except as noted above, must be approved in advance by the SPO. Questions regarding whether the use of a persistent tracking technology requires a privacy review should be directed to the SPO.

2 E-Commerce is the buying and selling of goods and services over the Internet. Sites which require that the transaction be completed by faxing or mailing a payment are not considered e-commerce for the purposes of this directive.

Visitor Communication Opt In/Opt Out Communications initiated by the Smithsonian, such as mass emails (e.g., reminders for programs or content updates) and electronic newsletters, may allow visitors to “opt-in” or “opt-out” of such communications under the following definitions:

— Opt-in means visitors take an action to indicate their willingness to participate (i.e., visitors affirmatively “check” a box).

— Opt-out means visitors are deemed to have granted general permission to receive communications unless they affirmatively “check” a box asking to be removed or unsubscribed from the list (i.e., visitors must “uncheck” a “pre-checked” box).

Smithsonian websites may allow visitors to opt-in to receive information (e.g., newsletters and emails about events, offers, products, and other opportunities) sent from Smithsonian and non- Smithsonian entities. Email messages from non- Smithsonian entities shall be limited to those with whom the Smithsonian has a written agreement that specifies the terms under which such messages and information may be sent.

Each email sent from the Smithsonian disseminating information as described above must:

— clearly identify the sender as a recognizable

Smithsonian email address, and contain accurate header (e.g., “From,” “To,” and “Reply To”) information;

— include a subject line that accurately describes the message’s purpose;

— include the word “Smithsonian” in the text of the message;

— include instructions on how to “opt-out” of future receipt of similar email or newsletter correspondence; and

— not be misleading or deceptive, whether in the body or the subject line.

Terms of Use and Permission Restrictions

Web content shall comply with applicable law and Smithsonian policy on copyright, trademark, right of publicity, right of privacy, obscenity, defamation, and other legal and content-based considerations such as those identified in SD 609, Digital Asset Access and Use.

Terms of Use Notice Websites must include a link to either the Smithsonian’s standard Terms of Use Notice or an approved deviation. OGC is responsible for maintaining a standard Smithsonian Terms of Use notice. Only OGC may approve deviations from the standard terms of use on a case-by-case basis.

Use of Copyrighted and Restricted Material Smithsonian digital assets may be made available to the public unless they are subject to an allowable restriction category, as set forth in SD 609, Digital Asset Access and Use. Each unit is responsible for determining whether digital assets are subject to an allowable restriction category before posting or releasing digital assets.

For questions regarding the content-based restrictions applicable to digital assets, as set forth in SD 609, contact OGC or the unit’s rights and reproductions office.

Release Forms When recording a speaker or performer who is not Smithsonian staff, the speaker or performer must be requested to sign a release form that gives the Smithsonian permission to disseminate and share the video either live or for later viewing (e.g., webcasts, streaming video). Units shall use the most recent dated speaker/performance release form template approved by OCon&PPM and OGC (and available on the OCon&PPM webpage), and contact OCon&PPM or OGC prior to engaging speakers and performers when clarification is required on the content of the release form.

Accessibility

Efforts should be made to make websites accessible to all visitors, including those with disabilities and with limited English proficiency. Websites shall be designed, developed, and tested for a broad range of visitors, including those with lower-end hardware and software capabilities.

Standard Plug-Ins and Web Applications The use of plug-ins is permitted provided that their use is free and supported on multiple platforms and they are TRM-compliant or the unit has obtained a waiver from OCIO. The webpage shall provide links to websites where the appropriate plug-in can be downloaded if the visitor does not already have the plug-in installed.

Because the Smithsonian’s mission is best met by diffusing knowledge among the largest number of visitors, non-standard plug-ins and technology are discouraged. If used at all, non-standard technology should be weighed carefully against any risks of reducing the number of visitors to the online exhibit or usage of the Web application due to increased bandwidth requirements, incompatibility with popular client browser technology, and/or incompatibilities with assistive technologies such as screen readers.

The use of technology and plug-ins that are not listed in the TRM as “preferred” requires a waiver (see IT-940-TN01).

Consideration for Visitors with Disabilities New websites and Web applications shall be accessible by visitors with disabilities in accordance with SD 215, Accessibility for People with Disabilities Policy. During each major redesign of existing webpages and applications, the appropriate design changes shall be incorporated to make them accessible by visitors with disabilities.

The Smithsonian’s Accessibility Program staff can provide guidance to assist with designing and testing websites for accessibility. The Accessibility

Program staff should be contacted early in the planning of any new development or significant redesign when it is easiest and most cost effective to incorporate accessibility design considerations.

Search Webpages and Web applications shall be constructed to facilitate searching by the Smithsonian’s search appliance and external Internet search engines (e.g., Google, Yahoo, Bing) to increase their findability.

Metadata Every webpage — created or modified after the effective date of this directive — shall contain at a minimum the following common meta tags for use by the Smithsonian’s search engine:

a) Title (of the page)

b) Creator (Smithsonian unit name)

c) Language

d) Date (published to this website)

e) Subject

f) Keywords

g) Description (of the page)

Portability of Information

Websites and Web applications shall be designed and developed, when practical, to take the Smithsonian Web experience and share it on mobile and emerging platforms. At a minimum, the information when ported to a mobile or emerging platform should degrade gracefully (e.g., the page should still function even though its layout may not be optimal).

Usability of Data

Many technologies allow users to take data from one website and combine it with data from another, commonly referred to as “Mashups.” Smithsonian public-facing websites are encouraged, to the extent practicable for intended purposes, to provide all data in an open industry standard format that permits users to aggregate, disaggregate, or otherwise manipulate and analyze the data to meet their needs.

Development and Maintenance

Separation of Development and Production Environment Webpages, online exhibits, Web applications, and databases shall be developed and modified in a non-production environment; and tested prior to being deployed onto the production environment to the extent possible. Once deployed to the production environment, the new content should be retested to ensure that it is functioning properly.

Web Infrastructure Review OCIO will work with the units to assess trends and requirements in order to plan the evolution of the Institution’s centralized Web infrastructure and development of shared services.

Units will coordinate their plans with OCIO for a new or significant redesign of a public-facing website, online exhibit, or Web application, to:

a) Ensure that its infrastructure requirements — including Web development tools and applications — are supportable by Smithsonian infrastructure and staff, if necessary, at a later date;

b) Determine whether the unit needs to request any waivers to the TRM in accordance with IT-940- TN01; and

c) Conduct this required review, regardless of where the site will be hosted, to inform the Web practitioner up front of any risk and/or additional cost that may be expected during the life span of the site.

This review applies to all purchases and donations of hardware, software, and support services, regardless of the funding source, including in-kind donations. The review shall:

a) Address storage requirements, security concerns, estimated network traffic load, and methods of content deployment to the public Web servers.

b) Identify the possibility of leveraging common tools already in use by other Smithsonian websites.

c) Explore any risk associated with introducing any new Web technologies to an existing Web server.

d) Identify any necessary Web infrastructure enhancements required to support their planned Web content if hosted within the Smithsonian’s centralized Web infrastructure. This may include identifying a need for the unit to fund these enhancements.

e) Determine if the project requires review by the Institution’s Technical Review Board or Change Control Board, based on the scale, novelty, or sensitivity of the project.

If a unit later decides to move the site, application, or online exhibit from an off-site location to an OCIO-maintained server, the unit may be required to fund the cost of any modifications to its site or application so that it may be supported by OCIO.

OCIO provides support for TRM-compliant systems.

A waiver to the TRM granted to a unit does not indicate OCIO operational support.

Cosmetic or content only changes do not require

OCIO review. If the Web practitioner belongs to a unit with a Web Management Office, the Web practitioner should coordinate the site’s requirements with this office before contacting

OCIO.

Smithsonian Enterprises (SE) is not required to coordinate its review with OCIO. Instead, SE shall conduct its own Web infrastructure review that addresses the same issues as the OCIO-conducted review, but with respect to SE’s infrastructure environment.

Web Servers and Storage Web servers and data storage will be consolidated, use off-site backups in case of an emergency, and should be designed with built-in redundancy to handle variations in traffic volume.

Common Web Development Tools Web development software tools shall be compliant with the TRM and the common Web infrastructure unless a waiver has been granted by the Chief Information Officer or designee.

Common Web Applications Websites and Web applications shall conform to Smithsonian standards, including the TRM, unless a waiver has been granted by the Chief Information Officer or designee.

Contracts and Purchase Orders Contracts and purchase orders awarded to develop, maintain, and operate Smithsonian websites, online exhibits, and Web applications, regardless of the amount, shall be obligated by OCon&PPM for SI units other than SE, unless a unit employee is authorized to do so by the Director, OCon&PPM.

Obligations for such SE contract and purchase order awards shall be made by the President, SE, unless an SE employee is authorized to do so by the President, SE. Consult Form OCon-6, Restrictions on Purchasing List, for further guidance regarding contracts and purchase orders.

Donations of Software and Hardware Gift agreements that include in-kind donations of software and hardware must be coordinated with the unit’s development office and reviewed by OGC and OCIO prior to acceptance, to ensure that the appropriate warranties, service, maintenance, compatibility, and other protections are provided as part of the gift. If a unit does not have its own development office, contact the Smithsonian’s OA for guidance. For more information about in-kind gifts, refer to SD 809.

Content Provider Contact List Each unit will maintain a current listing of individuals designated as the points of contact for the content of each of its websites, Web applications, and online exhibits, regardless of where they are hosted. This information will be provided at least to OCIO and OPA for purposes such as training, license/software purchases, communication, security, and maintenance issues; and to Smithsonian Institution Archives (SIA) to timely capture and retain these official and historical records of the Smithsonian.

Contacts are encouraged to participate in the Webmaster Listserv and other Institution-wide collaboration vehicles to stay up to date on new developments within and outside the Smithsonian.

Records Management

Smithsonian websites, Web applications, online exhibits, and associated social media such as blogs and wikis, or excerpts thereof, deemed to have historical value, may be archived, as appropriate, by SIA in accordance with SD 501. Smithsonian websites often include functionality which allows scholars and the general public to interact with the Institution. Significant elements of these records consist of the user experience (design elements and the content), including user-generated comments.

Records Retention for Web Web practitioners should notify the SIA prior to launching a website or implementing a major change or addition to a website. SIA will evaluate the new website content or application to determine its record retention requirements. SIA will coordinate any necessary activity to transfer a copy of the website to SIA. Units are responsible for maintaining the currency of all supporting documentation.

Capturing Websites for Archival Purposes

SIA will capture Smithsonian websites deemed by SIA as having historical value at regular intervals based on the frequency of significant changes. Web practitioners should contact SIA to request special captures of their Web content outside of the regular schedule.

Before websites are retired, the Web practitioner shall notify SIA, which will evaluate the website or the retired portion(s) to determine its disposition. If the retired website/website section(s) is determined by SIA to have historical value and has not been transferred to SIA in its current version, it shall be transferred to SIA along with its supporting documentation.

CANCELLATION: None INQUIRIES: Office of the Chief Information Officer (OCIO) RETENTION: Indefinite. Subject to review for currency 24 months from date of issue