SOO - RIM Modernization.pdf

Records and Information Modernization

Information Solution and Services

Office of Records Management Policy (ORMP)

STATEMENT OF OBJECTIVES (SOO)

1 ELECTRONIC RECORDS MANGEMENT

Electronic Records Management (ERM) is a Departmental function devoted to the management of Department’s information throughout its lifecycle. This includes identifying, classifying, storing, securing, retrieving, tracking, and disposing of or permanently preserving records. The Federal Records Act, defines a federal record as “ all recorded information, regardless of form or characteristics, made or received by a Federal agency under Federal law or in connection with the transaction of public business and preserved or appropriate for preservation by that agency or its legitimate successor as evidence of the organization, functions, policies, decisions, procedures, operations, or other activities of the United States Government or because of the informational value of data in them.” 44 U.S. C. 3301 and the International Standard Organization (ISO) 15489-1: 2001 ("ISO 15489-1:2001") defines records as “the field of management responsible for the efficient and systematic control of the creation, receipt, maintenance, use and disposition of records.” These definitions describe both the baseline statutory and generally accepted definitions for records and cement the need for systematic management and control through the records lifecycle. These definitions also reinforce the need for capturing and maintaining evidence of information about business activities and transactions in the form of records. Records and Information Management (RIM) is part of the Department’s broader governance responsibility to retain its institutional memory, manage risk and ensure compliance by managing the evidence of its activities to ensure the capacity for mission success and re-use as evidence of transactions, and decisions.

2 STATEMENT OF NEED

ORMP desires modern, cost effective, secure Records Management capability that will enable the Department to modernize its records management functions across the organization through the entire lifecycle and progress toward a longer-term plan of sustaining and continuously improving its level of operational performance.

3 SCOPE OF WORK

Having examined many products and envisioned associated architectures, ORMP has identified several key characteristics for a new design.

3.1 Technical Characteristics

• A browser-based solution https://www.law.cornell.edu/definitions/uscode.php?width=840&height=800&iframe=true&def_id=44-USC-2009054788-1064351416&term_occur=999&term_src=title:44:chapter:33:section:3301

• Ability to support mobile devices

• Integration with M365

• Hosted in Microsoft’s Government cloud

• Commercial Off-the-shelf, low-code, configurable solution

• Agile project management and incremental solution delivery

• User training

• Technical support training

• Data transformation and migration

• Integration with existing and future source application and databases

• Operations Support Services

• Scalability across the Department

• Secure, scalable, and reliable Infrastructure

• FedRAMP hosting, Software as a Service (SaaS) solution

• Comprehensive user requirements

• Solution testing and certification by the vendor, product owner and User committee, key stakeholders, and end user component training and rollout

• User feedback prioritized refactoring from Department head and Components users

• Key performance indicators identified and used to identify trends

• Ongoing process reporting to increase efficiency and understanding of Department-wide correspondence activities

• Solution architecture integrated and exchanges data with the Departments’ Identify management, infrastructure security, PIV services, monitoring, intrusion detection logging services and tools

• Compliance with OMB Major IT investment and ISO 20k requirements and standards

• Users access the system using Single Sign On (SSO), Personal Identity Verification (PIV)

Card System Access

• Role based user permissions

• Scalable to support concurrent users without hindering performance or response time

• Comply with Section 508 guidelines for accessible electronic and information technology in conjunction with browser compatibility settings, and accessibility tools

• Role-based configurations of user permissions across the enterprise

• Contractor’s facilities capable to support the development, testing associated with the new System.

• Comply with zero trust architecture requirement.

3.2 Records Management Requirements

The modern records management functionality will provide DOJ users efficiencies in their day-to-day work through the following capabilities:

• Active Content Repository Management

• Record Retention Storage and Disposition Repository Processing

• Inventory Cataloging Services

• Advanced Document Search

• Records Maintenance Workflow Automation

• Content Collaboration

• Information Sharing

• Integrated Administrative Functions and Capabilities

• Automated Metadata Capture

• Advanced User Reporting

• Integration with and enhancing Microsoft’s 365 technologies

The System shall support Records Management through a standardized Department solution to achieve the following objectives:

• Comply with Federal electronic records management statutory and regulatory mandates and supports the mission.

• Support component’s ability to carry out missions and functions

• Support advancements in knowledge management across the department

• Manage electronic records, in place, across M365 and other record repositories,

• Reduce management costs related to maintaining redundant, obsolete, and trivial (ROT) materials to free up storage.

• Reduce risk associated with maintaining records longer than needed by implementing timely disposition.

• Provide a combination of services/applications to accommodate the varying levels of component needs

• Eliminate the need for custom records management solutions across the Department.

• Enable more rapid identification and disposition of records across platforms and organizations.

• Create customizable dashboards, reports, and audit logs for tracking the lifecycle of a record.

• Provide the technical foundation for implementing comprehensive information governance Records Information Management (RIM).

3.3 Records Management Capabilities

3.3.1 Active Content Repository

The Active Content Repository is a database of digital content with an associated set of data management, search and access methods allowing application access to the content, rather like a digital library, but with the ability to store and modify content in addition to searching and retrieving. The content repository acts as the storage engine for content management, which adds a user interface on top of the repository's application interface.

3.3.2 Records Inventory and Schedule

The records inventory is a catalogue or list of agency records and nonrecorded materials conducted to develop records schedules and to support the management of content and identify various records management issues related to management. Records inventories identify all records created and maintained by an office, including scheduled and unscheduled records location, volumes, records series, media, and format, and other pertinent information.

The inventory should include all offices, all records, and all non-record materials to ensure adequate schedules and prevent the loss of control over the management of the records.

The records schedule provides a description of records, as well as identifying their retention and designating whether the records are temporary or permanent. Records schedules are approved by the National Archives and Records Administration (NARA).

3.3.3 Records Retention Storage, Disposition Repository and NARA Export

Record Retention is the length of time a record must be maintained by an agency in accordance with the applicable records retention schedule. The records retention schedule describes the records, determines whether the records are permanent or temporary, and sets the cut off from which the agency begins counting to calculate the end of the retention. The retention is based on the agency’s business need for retaining the records and the NARA appraisal of the records at the time the retention schedule is approved. the agency. The designated disposition may be temporary or permanent records as follows: Temporary - Records with a temporary disposition will eventually be destroyed or deleted when the records have reached the end of their retention. Permanent – Records with permanent retention will eventually be accessioned into the National Archives and Records Administration when the records have reached the end of their retention.

3.3.4 Searching and Reporting

The application shall provide users easy access to records data with a user-friendly interface.

Users will be provided basic and advanced natural language processing (NLP) and user defined keyword search integrating with AI predictive capabilities indexing metadata across multiple record repositories. Search will provide standard and user configurable report templates, configurable dashboards, and the ability for end user to share and save search criteria, custom dashboards, reports, and record export criteria.

3.3.5 Digitization and File Format Conversion

The system shall enable advanced document scanning and optical character recognition (OCR) of informed key words and AI functionality to capture record metadata that meets NARA scanning standards for accessioning.

3.3.6 Common Capabilities

• Create User Profiles: The ability to define sets of information and settings that can be associated with a user based on the required access of their role and responsibilities.

• Manage Schedules Throughout a Record's Lifecycle: The ability to administer and update a record's accompanying schedule throughout all phases of its lifecycle.

• Maintain Metadata Throughout a Record's Lifecycle: The ability to enable storage and tracking of a record's metadata throughout all phases of its lifecycle.

• Retain Records: The ability to continuously store records for as long as they are needed, including during changes to the solution or platform.

• Define Record's Business Context: The ability to state or describe the nature, scope, and meaning of the circumstances for which a record exists within DOJ.

• Streamline User Experience: The ability to design the system so that is maximizes a positive user experience through simplified and more efficient operating methods.

• Search: The ability to locate a record and its accompanying metadata by way of user defined input and Artificial Intelligence (AI) predictive indexing.

• Capture Record’s Activity History and Audit Logs: The ability to store a register of user actions and events that took place and impacted a record throughout its lifecycle

• Enable System Continuity: The ability to protect the solution from security risks, and enable continuity of operations during enhancements (i.e., software and hardware), security incidents, and routine maintenance.

• Integrate with Other Content Repositories: The ability to access information across DOJ and external record management systems so that it may be used in search, processing, and reporting activities.

• Enforce Access Rights and Permissions: The ability to impose permissions and restrictions across user's ability to read, write, add, and erase data dependent on the specific user.

• Perform Error Checking: The ability to identify inaccuracies across records and alert the user of any findings.

4 SECURITY REQUIREMENTS

Security requirements address the factors that protect the software from accidental or malicious access, use, modification, destruction, or disclosure. They also include requirements for maintaining an audit trail of changed data. Security requirements are established based on an assessment of the damage that may result if system security were compromised. Damages are classified as:

• Erasure or contamination of application data.

• Disclosure of Government secrets.

• Disclosure of personal or privileged information about individuals.

Security requirements address the following areas to ensure the needed level of security is implemented based on the damage assessment.

Physical and Environmental Controls – Physical protection in the facility housing the system application and subsystems such as: locks on terminals, physical barriers, and site access controls.

Identification and Authentication – Determine access and accountability of users by PIV authentication controls such as password protection, PKI digital certificates and biometrics. It should describe the level of enforcement (network, operating system, application, data), and enforcement procedures.

Personnel Security – Personnel security will determine security clearances and background checks needed for analysts, administrators and other specified user groups, and the level of access granted by duty assignment.

Additional Security Requirements – Other security requirements may be determined in the areas of incident response, certification and accreditation policies, and security awareness and training.

4.1 Common Security Requirements

• System must operate in an environment that incorporates firewalls, providing only authorized users access to the system.

• The system must support the ability to define an "inactivity time-out" period.

• The system must protect, and secure PIV based user logons and passwords from unauthorized access.

• The system must support multiple levels of security access to information and system functionality based on user and user group profiles.

• The system must require authentication of all user IDs and passwords before allowing access to the system.

• The system must provide the ability to define user profiles and establish groups of users with like attributes and system rights. (i.e., changes to the group automatically apply to each individual user of that group).

• The system must be able to create user logons and passwords.

• System shall track the following information for all events/activities within a history of occurrences: user ID, date and time of access, date and time of terminated access, type of event (ex: insert, update, delete), data or transaction change.

• The system must support viewing, searching, and reporting on audit trails based on user-defined parameters.

• All system audit trail information will be available for a user-defined period then archived for a user-defined period, or the period specified in the system security plan.

• The system must log off a user when browser window closed.

• The system must close all browser windows when a user logs off.

• The system shall provide multiple layers of access based on the user's ID/password, role, and office assignment. The user role defines the type of access (update, insert, delete, read only).

• The system shall encrypt sensitive data, such as passwords, employee personal information and SSNs in the database.

• The system shall support zero trust architecture.

5 IMPROVEMENTS TO BUSINESS PROCESSES, BUSINESS CAPACITY

AND BUSINESS SCALABILITY

The system shall enable the Department to modernize its records control management function through the lifecycle and progress toward a longer-term plan of sustaining and continuously improving its level of operational performance. The modern records management function will provide DOJ users efficiencies in their day-to-day work.

The System shall support a standardized solution achieving the following improvements:

• Manage electronic records across all record repositories, while keeping records in place

• Free up storage and reduce management costs related to maintaining redundant, obsolete, and trivial (ROT) materials.

• Reduce risk associated with maintaining records longer than needed by implementing timely disposition.

• Eliminate the need for custom records management solutions across the Department.

• Enable more rapid identification and disposition of records across platforms and organizations.

• Create customizable dashboards, reports, and audit logs for tracking the lifecycle of a record.

• Provide the technical foundation for implementing comprehensive information governance Records Information Management (RIM).

• Comply with Federal electronic records management statutory and regulatory mandates.

6 QUESTIONS REGARDING ARCHITECTURE AND SOFTWARE

DOJ/JMD is interested in the vendor community’s experience with architectures supporting the features above to produce a notional “to be” solution diagram that provide answers to the following questions.

1. Is the notional architecture a known and effective practice?

2. Are there other changes, refinements or alternative solutions that will give similar business benefits?

3. What products best fulfill the roles of the various components of this architecture?

4. It is assumed that any new system will be solely supported in a VM environment. What recommendations are there with regard to the transportability of such a system between data centers?

5. Similarly, what recommendations are suggested for disaster recovery (DR)?

6. What is the nature of integration between various system components? Specifically, to what degree would proper implementation of such a system require software engineering in the forms of custom code or scripting?

7. What data center configurations are important? Should source records be co-located with discovery systems?

8. How important are physical storage architectures and what storage architectures will give best performance

7 QUESTIONS REGARDING OPERATIONS, STAFFING AND

PRODUCTIVITY

The replacement system shall be implemented with special care devoted to the total cost of operation.

1. Are any uncommon skills required to support a system of this design?

2. Would a typical low-level data gathering resource, or case scheduling and tracking staff require skills uncommon to other solutions?

3. Would staff assigned to specific cases generally be comfortable working a request end-to-end with a system like this?

4. Can such an architecture incorporate machine learning to improve productivity? How so? Would this also create risk of errors? Discuss mitigation strategies.

5. What would the training and operations overhead be for a system that incorporated machine learning?

6. What are best practices for defensibility? (E.g., Repeatable search, exact logging, intermediate work product, etc.)