City of Prescott Data Integrity Policy

Transcription

1 City of Prescott Data Integrity Policy Table of Contents Document History... 1 General Archive System Design... 1 Data Archiving Guidelines... 2 Archive Server Design System Backups... 2 Employee Data Archive Procedure... 3 Log Data Retention... 3 Document History Version Initial document creation in LaTeX format May 2006 Version Active Directory account handling updated July 2008 Version Document conversion to DocBook5 XML format March 2009 Version Exchange 2007 mailbox handling updated December 2009 Version Update for replacement of archive server with Tb archive server January 2011 Version archiving updates, VSS added, Exchange 2010 added, mention of Wuxing removed January 2013 Version Exchange version will be 2013, DPM will be backup method for Exchange 2013 with single day snapshot due to high availability architecture in this version July 2013 Version New policy regarding employee data requests added to Section 7 February 2014 General Archive System Design The City of Prescott stopped using tape based backups for City data in 2005 in favor of a disk to disk (D2D) based system. The following drawbacks with tape based archives wcre identified as the impetus for the change: Growth of backup data sets beyond tapc media capacity Cost ohape media drives Cost and complexity of tape backup software Data often stored in proprietary formats on tape Lack of transparency into backup system due to the nature of tapes Potentially slow data recovery in the face of a disaster recovery situation The merits of a backup or archiving system is only apparent when that system has to be used. The D2D system at the City of Prescott must address the operational deficiencies of a tape based backup system and our D2D systcm provides the following benefits: Elimination ohape drive and tapc media management treadmill

2 City of Prescott Data Integrity Policy Highly automated system Data is stored in the native format on the D2D system High level of notification and monitoring of the backup job environment Rapid data recovery possible from this system Data Archiving Guidelines The purpose of a backup or archiving system is to safely preserve data. This data may be retrieved in cases where an individual use or City business unit needs to recover a small piece of data such as a few files or directories. This data may also be retrieved in a case where one or more server systems suffer some sort of catastrophic failure. This presents two fundamentally different goals for an archive system which can be difficult to balance. In 2006 this question was raised by the Information Technology (IT) group. The nature of this inquiry was to determine how long IT at the City of Prescott should retain backup data. A secondary question was whether the City ofprescott should purchase a long-term archiving system to aid in public record requests. The city attorney (Gary Kidd at the time) issued a statement that IT should provide 30 days worth of backups for disaster recovery purposes. For the sake of operational efficiency, IT went ahead and matched non- archived data retention to 30 days as well. The net result is that IT maintains a rolling 30 days worth ofbackups for network data (which includes backups of the system) for disaster recovery purposes. It is the responsibility of individual City employees and departments to maintain backup copies of documents, , etc relative to State of Arizona guidelines and regulations. IT has submitted a capital improvement project in the City budget process for a long-term archiving system. Such a system would be separate from the existing 30 day and data backup system that IT currently administers. As part of the FY13 budget process funding was provided for an archiving system. IT will be meeting with key stakeholders to discuss how such a system should work to ensure that the needs of diverse groups such as Legal, City Clerk, and HR are met by any implemented archiving system. Archive Server Design We have two archive servers currently and this was brought about by our migration to Microsoft Exchange 2007 in November of2009. The non-exchange archive server currently consists of the following elements: FreeBSD 64-bit operating system Directly attached SAS storage in the 50 Tb capacity range Use of the ZFS file system under FreeBSD which eliminates file system inode exhaustion issues System Backups Backups of the Microsoft Exchange system are taken at 2 hour intervals using Microsoft Data Protection Manager (DPM). These snapshots are retained for 30 days on the DPM server and they are then discarded by the DPM system. 2

3 City of Prescott Data Integrity Policy Work is currently underwayto implement a availability architecture for Exchange Such a system would use Exchange 2013 Database Availability Groups (DAG) to provide mailbox availability. DPM will be used to provide off-site long term (30 day) access to backups for disaster recovery purposes. Employee Data Archive Procedure The following will take place when an employee leaves the City of Prescott: Network accounts are disabled at the end ofbusiness on the last day of employment Network accounts are removed from City systems with 45 days (the first day of the next full month after deactivation) Employee's Q-drive (My Documents) contents are archived and stored for I calendar year Employee's mailbox is detached from their network account and kept for 30 days by the system It is important to note that the contents of an employee's Q-drive or mailbox represent the state of the element at the end of employment. The primary purpose of keeping Q-Drive contents is to aid in position succession where the archived contents of person X are transferred to person Y. The I year duration of storage allows for simple management and purging of these files after I year ofstorage. If IT is notified of a legal hold situation (by the Legal department) the employee's mailbox contents and Q-drive files are exported optical media and turned over to the Legal department. The original digital copies of this data are kept in a holding area until they are authorized for release by the City Legal department. Log Data Retention There are two additional log data types that should be mentioned: system logs Internet access logs system logs are used to verify the delivery (or in some cases non-delivery) of via the SMTP protocol. These logs are kept for 7 days on a rotating basis and are strictly used for diagnostic purposes to determine the disposition ofa message or a group of messages to/from the Internet to/from City employees. sent/received between City employees is not contained in these SMTP logs unless an outside party is included in the message itself. The reason for this is that sent between City employees does not use the SMTP protocol for delivery. Logging this information is not generally useful for the administration and troubleshooting ofan system. Internet access logs through the City of Prescott's Blue Coat and WebTitan firewalls are collected and retained for 6 months. Access to the Internet is logged based on the network 10 of the person requesting access to a given resource through the firewall. Internet access logs are retained for use in reporting by City department heads, Human Resources, etc on an ad hoc basis once approved by the Legal Department. 3

4 APPENDIXC RETENTION POLICY As of I. PURPOSE The purpose of this policy is to provide guidelines for retention, preserving ed records, and establishing an active retention policy. II. SCOPE This Policy applies to all full and part-time employees, volunteers and elected officials; for the purpose of said policy they shall be referred to as "employees." III. RESPONSIBILITIES All employees of the City of Prescott are responsible for reading, understanding, and following the Retention Policy. IV. POLICY Anything, on any medium that is created for any governmental purpose, is subject to the terms of the public records law. Consequently, all messages sent or received for a government purpose are public records and are subject to record retention requirements. This policy includes all copies of and text messaging from text-capable devices such as cell phones and smart phones (iphones, Droids, Blackberry), regardless of where they reside. Instant messages that are public records shall be converted to by the user and saved pursuant to this policy. A. Records Created with Electronic mail systems transmit a wide variety of information. The length of time that an is retained varies according to the content of the . In short, the content and not the medium, determines how long an has to be retained. messages fall within two broad categories: Transitory/Duplicate messages, and Retainable records. 1. Transitory/Duplicate messages or casual and routine communications are not retained. Public officials and employees sending or receiving such communications should delete transitory and duplicate messages immediately. Most s are transitory.

5 2. Retainable records are defined as documentation of the informational, communicative, or decision making process of government that is; made or received in connection with the transaction of the public business or government functions; and which is created, received, retained, maintained or filed by the agency as evidence of its activities or because of the informational value of the data in the document. Retainable records are classified by a less than permanent or permanent retention period. B. Defining Transitory, Duplicate, and Retainable Records 1. Transitory messages do not: a) set policy; b) establish guidelines or procedures; c) certify a transaction; d) become a receipt; or e) include any substantive information or provide direction or instructions on a job duty or work task. Transitory documents serve to convey information of temporary importance. The following types of can be deleted because they are transitory: Incoming listserv messages Personal s unrelated to City business Spam or unsolicited advertisements or sales promotions Non-policy announcements Telephone messages Published reference materials Scheduling meetings; invitations and responses to meetings Thank-yous Replies to routine questions, "we're open 8 to 5", "our address is... ", lithe deadline is... " Out of Office auto replies Attachments to that are identical to records that are stored and managed outside the system pursuant to approved record retention schedules. 2. Internal Duplicate Records: as a medium promotes expedited communication to multiple users with great ease. Consequently, frequently contains duplicates of records, APP. C - 2

6 such as copies or extracts of documents distributed for convenience and/or references. If retention is required of the original, the sender has the obligation. Otherwise, all duplicates should be deleted. For example, if an employee is "cc'd" on an e mail, he/she may delete it after reading. 3. Retainable Public Records: Records created for any governmental purpose with a less than permanent retention period. Retainable records include but are not limited to: (reference the Retention and Disposition Schedule for more examples) Activity reports Audit trail reports Project work plans Status reports Correspondence for recovery records Expense accounting records Requests for proposals Case management files Records that contain substantive information, direction or instruction on a job duty or work task 4. Examples of message categories requiring some level of retention include the following: Containing information developed or necessary in preparing position papers, reports, studies or staff memos, or necessary to take action on City business, including personnel matters Reflecting official actions taken or directions or instructions given in the course of conducting City business, including, for example, personnel matters Conveying information on City programs, policy decisions, and essential transactions APP. C - 3

7 Conveying statements of policy or the rationale of official decisions or activities Documenting oral exchanges, such as meeting or telephone conversation, during which policy was discussed or formulated calendars reflecting the daily appointments of officials conducting City business Distribution lists for City business mail 5. Public retainable records created for any governmental purpose with a permanent or permanent/archival retention period include but are not limited to: (reference the Retention and Disposition Schedule for many examples) V. City-Wide Procedures Executive correspondence that sets or discusses policies Disaster Recovery Plans Continuity Plans A. Procedures for managing s that are retained. 1. Each employee is exclusively responsible for managing all the e mail sent and received and this duty will be part of the employee's performance evaluation. Each employee must sort, file, retrieve, and retain or delete the in accordance with the municipal retention schedule approved by the Arizona State library, Archives and Public Records, or by exception, such as litigation Holds for records required in a lawsuit, whichever is longest. Under no circumstances should City business s be sent to an employee's personal account; however, if they are received on an employee's personal computer they are then subject to the Public Records laws and this policy. 2. Sorting: sorting involves promptly deleting by the applicable record retention schedule. Sorting also involves routinely filing e mail that must be retained for the applicable retention period. To avoid wasting computer storage space, should be deleted promptly if it is not a record and it has no further value. APP. C-4

8 3. Filing: Filing for short-term storage (less than 30 days) involves moving the into folders created within the software (Outlook). that qualifies as a retainable record must be retained outside the system in accordance with the applicable record retention schedule. Acceptable outside storage includes printing and filing hard copies of in a paper file or storing the on the network. The content of the will determine which record series applies. A permanent or historical record series should be printed and stored in a paper file. All non-permanent or non-historical records should be stored on the network. 4. Retrieving: Upon receipt of a public records request. the City Clerk will work with respective employee(s) who must promptly retrieve e mail stored in an alternative medium. The employee is exclusively responsible for the requested and must find and retrieve it in a timely manner just as he or she must be able to quickly retrieve and produce a proper paper document in his or her possession or control. 5. Retaining and deleting: Retaining and deleting filed must be done according to the Arizona Municipalities Record Retention Schedule. Retaining involves the long-term storage of a record, including any original link(s) and/or attachments(s) included in the . a. The content of the determines the applicable retention period. Record retention schedules are maintained by each City department and coordinated through the City Clerk's Office. b. At times a record may be part of a law suit. This requires the City preserve the record even if a record retention schedule allows for its destruction. Such records are subject to a Litigation Hold by the City Clerk's Office, Legal Counselor Risk Management, which holds will be issued to all affected employees at the time a lawsuit or a claim is filed or reasonably anticipated. Records subject to such holds should be retained throughout the course of the lawsuit or claim administration until further instructed by the City Clerk, Legal Counsel/City Attorney or Risk Management. B. Procedure for managing when employees leave. Supervisors are responsible for ensuring that their staff completes the final organization of before leaving. Supervisors are also responsible for managing. filing. retrieving and archiving the of their former staff. APP. C-5

9 C. Exceptions to the Public Records requirements and confidentiality. Every written or received while fulfilling the duties of a public employee or elected official is considered to be a public record in accordance with the City's Records Management Program. This means the public has a right to inspect and copy every that a public employee or elected official writes or receives in the official capacity of the employee's duties unless the fits a specific exception to public disclosure. An example of an that would not be a public record is attorney client privileged information. To ensure that confidential information is properly protected, employees should take the following precautions to ensure confidentiality: 1. Clearly label the as confidential and warn the recipient not to forward the to anyone who is not authorized to receive it. Labeling in the subject line of the as confidential assists the City Clerk's Office, Legal Department, Risk Management, and the IT Department when releasing records. Records that do not meet the confidential criteria are released regardless of label. 2. Name in the the exception(s) to disclosure for the claim of confidentiality, including the statutory citation. 3. Confirm whether a more secure form of communication is available or appropriate. D. Procedures for backing up the system. The IT Department is responsible for performing a back-up for the recovery of the system in case of a catastrophic failure. This back-up is not intended as an retention plan. VI. Definitions Lismerv: An electronic mailing list software application, consisting of a set of e mail addresses for a group in which the sender can send one and it will reach a variety of people. Public Record: A.RS defines a public record as: All books, papers, maps, photographs, or other documentary materials, regardless of physical form or characteristics... made or received by governmental agency in pursuance of law or in connection with the transaction of public business and preserved. or appropriate for preservation, by the agency or its legitimate successor as evidence of the organization, functions, policies, decisions, procedures, operations or other activities of the government, or because of the informational historical value of the data contained therein. APP. C - 6

10 Non Record: Material made or acquired solely for reference or exhibition purposes, extra copies of documents preserved only for convenience of reference and stocks of publications or documents intended for sale or distribution to interested persons are not included within the definition of records. Reference: AR.S APP. C-7