The National Archives and Records Administration (NARA) is warning agencies about the implication of mobile devices for records management. Beth Cron, a policy analyst at NARA opened discussion about the mobile challenge on NARA’s blog, Records Express.
“When employees use devices without following agency policies or lack mobile device management tools, they open themselves and their agencies up to information, transmission, and operational security risks,” wrote Cron. Those risks include lost or stolen devices containing federal records and legal issues related to e-discovery. From a records management perspective, the challenges include:
- Identification of records when content may be located in multiple places
- Capture of complete records in a manner that ensures their authenticity and availability when records frequently change and are located in many places
- Data being stored or replicated on the device or in an application instead of only being accessible from a central repository
- Development and implementation of records schedules, including the ability to transfer and permanently delete records, apply legal holds, or perform other records management functions when it is unclear where records reside
- Sources and formats of records will continue to change and it may be difficult for agency records management policies, processes, and technology to keep up
One of the first things agencies can do, Cron said, is recognize that employees have records management responsibilities when working on a mobile device. Second, they can look for best practices emerging in the federal community regarding mobile devices; some may be useful to records management as well. Third, agencies may consider establishing mobility policies that address the question of records management in a mobile environment.
The ARMA International technical report Mobile Communications and Records and Information Management (ARMA TR 20-2012) advises IT and records management to consider the following activities associated with deploying a mobile device management (MDM) strategy:
- Acquisition and implementation of MDM software to provide overall management of mobile communications systems at an enterprise level
- Ability to track lost or stolen devices using geo-location technology
- Ability to remotely wipe all data from lost or stolen devices
- Ability to remotely lock or trigger alarms on lost or stolen devices
- Ability to install, update, and remove applications, as well as remotely patch/upgrade operating systems and push out policy revisions (Note: Records proving these activities have occurred need to be managed. Records include documentation or electronic communications from IT confirming that administrative activities have taken place, along with any logs showing evidence of ongoing maintenance. Those records should be entered into the organization’s recordkeeping systems, and appropriate retention schedules should be applied.)
- Ability to perform inventory tracking, such as compilation of a roster of device manufacturers, model numbers, and serial numbers
- Ability to prohibit activities such as roaming or exceeding certain bandwidth levels, if desired
- Ability to conduct audits to monitor compliance and initiate quality improvements
- Ability to use PIN-to-PIN messaging via mobile devices, with appropriate security measures in place, in emergency situations when the organization’s servers might be inoperable.
Mobile Communications and Records and Information Management (ARMA TR 20-2012) is available for purchase from the ARMA International online bookstore.