NEW: Feith's RMA iQ is now available SaaS to Federal agencies, In Process on the FedRAMP Marketplace!

5 reasons why agencies struggle to meet their FOIA goals

When it comes to Freedom of Information Act requests, it is mandatory to disclose information on time.  Content must be collected, reviewed, and packaged as a response.  That is easier said than done when agency data is scattered, hard to search through, or difficult to collaborate around.   Deadlines are missed, critical records are lost, and sensitive information can spill.

When agencies work their FOIA caseload manually, they struggle to meet their objectives. Here are 5 main reasons why agencies fall short of their goals.

 

1.  There is no uniform solution across the agency.

Many agencies leave staff without a uniform solution to create FOIA deliverables.  If organizations use legacy desktop clients to house that information, systems can’t communicate with each other, and staff are left to sift through them for content.

Even if systems are connected, IT needs to continuously integrate them to ensure knowledge workers’ access.  That much administrative work consumes human resources.   Documents are searched through manually, information gets lost, and budgets are strained. 

Agencies need a centralized system to meet FOIA deadlines.  The single workbench approach allows knowledge workers to access anything and everything they need to manage FOIA cases.

 

2.  There are too many complexities to handle FOIA requests manually

The sheer volume of data that agencies capture, process, and archive increases every day.  It is time-consuming to manually search through that much information.  Once captured, agency rules mandate different kinds of redaction for different types of content.  Without the right tools to create a pixel-by-pixel replacement, redacted information may not be redacted at all.  Sensitive data is left visible and released by accident.

When there are hundreds of FOIA requests to create, package, and deliver, it is a challenge to track all of their statuses. There is no way to pinpoint which of those hundreds of requests are more urgent, and which of those due dates are closer.

Automation is the only way to fix this. When cases are automatically created and the content in them can be automatically redacted, time is freed up for knowledge workers to focus on more critical tasks.

 

3.  Collaboration Challenges

The outcome of a FOIA request is dependent on the communication among those assigned to the case.  The past year has challenged the government to do a large portion of this work from home.  Often the contents of FOIA requests are cross-departmental or even cross-agency, which creates a line of communication between SME’s in different locations.   When there are problems or questions, knowledge workers must ask SME’s for assistance via email.  These emails are often left for several days in the SME’s inbox without an answer, and dead stops put the agency at risk of missed deadlines. 

Knowledge workers must be able to communicate with each other and with the requestor.  When the case is opened, the team assigned to it must keep up communication with the requestor and give them estimates, status updates, and the ability to track the case through its lifecycle.  When this process is done through phone or email, communication is not transparent.  No one knows what the FOIA team has already communicated to the requestor, or what still needs to be said. 

Another hurdle that agencies struggle over is collaborative access.  With no system in place to allow group work, team members will not be able to interact with systems at the same time for collection.  Without the tools to control access, FOIA teams can’t permission content or control who can see what within the case.  When agencies can’t control who can see what sensitive information, FOIA goals are not met.

 

4.  Poor Access to Data

It is a challenge to keep information organized when there are multiple data types and sources.  Email is a source now, with social media and chat to become sources in the future.  Email search and retrieval is sub-par and will take a considerable amount of time when compared to advanced search features.  Once the information is collected, there is also no way to see both text and metadata at the same time.  If knowledge workers find that they need more information from the eDiscovery side, they have fallen short of their FOIA goals.

When workers cannot interact with their cases, time is wasted.  SME’s should be able to connect to their workstation from any location and on any device.  If they know where they need to work and can get into their cases, the collection process can start immediately.   

A lack of a real Records Management system lives at the heart of this challenge.  With a repository in place, knowledge workers have access to collect and create deliverables.

 

5.  No Oversight/Accountability

At the end of every FOIA case is a potential audit process.  The work that FOIA teams complete should be entirely defensible. There needs to be a visual tally of everything done to create the deliverable.  Vaughn indexes display that tally of case actions and guarantee transparency.  Certain solutions can create Vaughn indexes automatically, but if there is no solution in place then it is up to an individual to create one by hand.  That process can take up mission-critical time and put the agency at risk of falling short of its FOIA objectives.

Supervisors need oversight tools to be able to meet their own FOIA goals.  When they are unable to see who completed what task or what the status of their case is, there is no accountability.  Cases are not tracked across their lifecycles, and there is no way to tell which action officers are busy and which can take on more work.

 

 

Take Control of the FOIA Process

Agencies that manage their FOIA requests with outdated systems and manual practices are in a situation where it is difficult to meet their turn-around time goals.  When it takes hours to search for content and days to hear back from SME’s, time is wasted.

When agencies utilize FOIA solutions to manage their caseloads, their goals are achievable.  Information can be accessed, searched for, collected, redacted on, and packaged for delivery before the deadline.  Teams can work together on content at the same time.  Security features keep sensitive information from the wrong hands, and oversight features allow supervisors to monitor their workers progress and steer them in the right direction.

COVID-19: Records Management as a function of Business Continuity

Many companies do not give adequate attention to their Business Continuity plans.  This is likely due to the “normalcy bias” — the assumption that a disaster is unlikely because the chance of any one disaster happening is low, and because one hasn’t experienced a disaster recently.

Why is it flawed?  Mere statistics. To illustrate: the probability of flipping a quarter ten times in a row and getting heads every time is extremely low, 0.09%.  However, if you try it daily for three years, it becomes almost certain that it will happen at least once.

Similarly, each possible cause of outage or disaster is individually unlikely.  But over a long period of time, many unlikely things add up to a certainty.  That some form of disaster (whether hurricane, cyber-attack, or epidemic) will occur is a “when, not if” situation. 

When a disaster does happen, 40 to 60 percent of effected businesses will never re-open according to research from FEMA.  Companies would be well advised to prepare for all identified risks. 

At the time of writing this, we may have just such an identified risk: the novel coronavirus SARS-CoV-2 (or COVID-19).  The Center for Disease Control and the Department of Homeland Security told businesses last week to begin preparing for disruptions due to an increasingly likely outbreak in the US. 

Records Management as
Business Continuity

FEMA lists a comprehensive records management plan as one of three most important recovery tools to deal with a disaster.

Why? It’s simple. An organization’s memory resides in its records.

Business continuity stretches from simple decisions like backups and DR software, to the steps that it takes to get a business back to a normal state.  First among those is the need to understand what normal consists of.  Our repositories are not just as an asset to protect during a disaster, but a system to help us know what needs to get done.

It is more likely now than ever that company leadership will proactively invest in business continuity projects.  If there was a time for Records Managers to make the case that RM is an essential part of a company’s Business Continuity planning, it is now.

An Electronic Document and Records Management System (EDRMS) strategy supports your Business Continuity efforts, getting you back to “business as usual” as quickly as possible. 

If you’re ready to bring Records Management into your Business Continuity planning, here’s some questions to ask yourself:

1. How will our employees access their records if they must work from home?

During a major outage, employees will need to have access to their regular working files to stay productive. Electronic Document and Records Management systems allow your employees to continue working off-site, while protecting your content through fine-tuned ABAC and RBAC permissions.

2. Are manual processes putting us at a higher risk?

During a disaster, employees may be unable to perform their normal duties: manual processes that weren’t explicitly documented are lost without their presence or experience.  A complete records repository means that you can recover these lost processes by examining the files and communications employees produce surrounding them.

Modern ERM systems support the creating of Forms and Workflows on the fly.  During a disaster, being able to structure your processes digitally means faster time to recovery, maintaining continuous operations even with a workforce working out of office.  This supports conducting business and delivering services efficiently, even during disruptions.

3. Is our data digitized, archived and backed-up properly for Disaster Recovery situations?
Records Management systems will capture your documents and data, replicating them to disaster-safe storage.  With Disaster Recovery mechanisms in place for Records Management systems, major outages are unlikely to result in significant data loss.
Modern ERM systems allow for easy integration with your LOB servers and platforms, meaning you can support Disaster Recovery objectives even for systems that are not natively DR-ready.

4. How can we stay compliant during disasters?

Having a complete records system makes tying up the loose ends during and after any outages or disaster recovery situations much easier. This includes proving losses and damages for insurance claims with documentation, as well as monitoring for fraud.

During and after a disaster, organizations will need to prove their compliance with regulation and law, all while showing that they took the necessary steps to reduce loss of life or damage to property.  This is essential from both a legal standpoint, as well as a Public Relations one.

The message is clear: 
Records Management is a critical Business Continuity initiative. To ensure your company has a comprehensive plan, make sure they see the critical role of Records Management. The steps you take today will keep critical processes operational during a crisis, reduce process downtime, and reduce the risk your company faces.

Extra Credit Reading:  The Australian Capital Territory produced a significant guide to Records Management and Business Continuity back in August 2008.  It’s as relevant today.

What is Records Management?

The goal of a records manager is to figure out what documents are important for a company to keep. For example, some important documents for a company to keep are the W-2s of their employees. Another important type of document that all companies have are contracts with their suppliers.

Documents which are important to keep are called records. Thus, Records Management refers to the practice of properly controlling these important documents, and Records Managers are the people who do this job.

Additionally, Records Managers have another important task. They need to figure out how long the law requires a company to keep certain types of documents. For example, US Law requires that employers keep copies of all job applications for at least one year. Determining how long to keep a record is called retention, and an important document called a retention schedule is the list of how long each type of record must be kept.

Keeping records for the correct amount of time is important, since improperly destroying records can come with both big legal fines and also long court cases.

Over the years, companies and governments realized that there were other types of information besides documents which needed to be managed. That’s when the term, Records and Information Management was created (“RIM”). Today, Records Managers control and manage all of a company’s information, including information which is and is not a record.

What is the Records Management Lifecycle?

An important concept in Records Management is the Records Management Lifecycle. The records management lifecycle is the entire process that a record can go through, from the day the record is created to the day it is destroyed. Destroying a record is called disposition. Listed below are the 4 parts of the Records Management Lifecycle:

1. Creating Records and Receiving Them From Other Systems

Records have more than one way to get into an organization. For example, if you fill out a job application while in the Human Resources Department, that was created while you were visiting that department. If you apply for a job online, your job application will be forwarded to them electronically. It wasn’t something they created but they received it and it is a record they must keep.

2. Using Records When They’re In The System and Modifying Them During Use

Records can be used by many people. Some records may be used for the information in it. No changes will be made to them. An example would be a sales report. Other records may be modified over time. Your employee file is a prime example. When you become an employee, they start an employee file just for you. During the time you work there, other records may be added to the file. An example would be a job review or a notice of promotion.

3.  Maintaining Your Records and Protecting Them from Unauthorized Use

This part of the records management lifecycle stores records in the correct place. It also protects them from people that should not see them.

  • Maintain – Records are stored in places called a repository. You can have more than one repository to store records. For example, there may be one repository for Human Resource records. There may be another for Contracts. The Records Manager will decide how any repositories are needed.They will also decide which records go in each of the repositories. As records are created, they will make sure the records go to the correct repository. Records will stay here until they can be destroyed
  • Protect – Records need to be protected from people that should not see them.Records may contain sensitive information. Let’s use your employee file as an example. It will contain your name, home address, phone number, email address, social security number, and your annual income. Only certain people should be able to see that information. Access to records is granted by the Records Manager. For your employee file, access could be restricted to Human Resources employees. Employees in Purchasing or IT would not need access. Granting access only to specific employees, protects your organization. It also protects your employees and your customers.

4.  Disposition of Records

The final step in the Records Management Lifecycle is disposition. Disposition is what we do with a record when we’re done using it. Depending on the type of record, what we do with it when we’re done using it may differ. There is destruction, preservation, and accession. Each one disposes of a record differently.

  • Destruction – Records falling into this category will be destroyed. That means paper records will be shredded to a size they cannot be read. Electronic records will be deleted from the system they were saved in. After destruction you will not be able to access and read them again.
  • Preservation – Some records may be kept permanently because the law tells us they must be kept forever. Other records may be kept after their retention life is expired. One reason is for historical purposes. For example, the founding documents of an organization. This could be their company charter or original bylaws. Another reason to keep records is for reference material. Engineering plans are a great example. Engineers refer back to see how something was built. The original records would give the engineer that detail.
  • Accession – Accession means sending records from a government agency to NARA (National Archives and Records Administration). The records legal life in the government agency is complete. The records are sent to NARA. NARA will follow their retention schedule for the disposition of these records.

From these four steps, companies develop rules to control and protect records and information from the beginning to the end of the Records Management Lifecycle.

Feith for Chat Records

NARA-Compliant Messaging

Instant messaging has become a major form of business communication. Chat programs are a great way for people to collaborate at a distance, but they have some drawbacks. One challenge is that chat programs lack archiving, records retention and compliance features. Many companies and government agencies are mandated to capture and store all communications regardless of their format in a secure and compliant manner. Companies with tens of thousands of employees send millions of messages every day. Finding a specific message is borderline impossible without the right tools.

Feith gives you the means to safely record and archive messages in their entirety

  • Capture messages automatically from many messaging platforms
  • Store and view chats and their metadata as conversations 
  • Keep messages and other electronic records in a single repository 
  • Set Retention Policies to delete stored messages 
  • Export from the Feith archive in shareable formats 
  • Create cases for internal review
  • Flag content based on keyword – get alerted when conversations need to be reviewed and escalated 
  • Create legal holds or record packages with a single click 
  • Archive all conversations in a secure repository 
  • Encrypt messages while in transit and at rest 
  • Search by message type, person or phrase with fast results

Capture and Archive from Multiple Platforms

With Feith’s DoD certified archive, messages are captured directly from the source in their conversational context.  Everything is ingested including log-ins, log-outs, edits, deletes, and replies, and stored exactly the way they were made. Conversations can be recorded from a variety of communication platforms; Microsoft Teams, Yammer, SharePoint, OneDrive, Skype, Zoom, Slack, Jabber, Blackberry, and more.  Feith captures and archives millions of messages daily, helping businesses of any size.  

  

Organize records for easy retrieval  

The Records Manager uses Feith to create and execute classification schemes.  Their efforts, combined with the right tools, put structure to the company or agency’s records and saves time on retrieval.  Archived messages can be found by looking for what the message says, who sent it, or when it was sent.    

 

Keep track of messages through their entire lifecycle 

The Records Manager creates retention policies which control when messages get deleted.  The system watches the clock and notifies the Records Manager when the time comes to dispose of a conversation log. Once the Records Manager has given approval, the system will automatically delete the messages at the end of their lifecycle. 

End-to-End Compliance and Oversight Tools

Feith’s customizable internal panels, policies, and multi-tier review queues help a business to personalize their compliance experience.  Compliance officers can work together while collecting conversations into cases for internal review.  Feith alerts the compliance officers if a message needs to be reviewed and escalated.  With a single click, deletion will be suspended on a record or collection of records for legal holds.    

 

Flag and freeze inappropriate conduct  

Administrators are able to define workflow rules to send notifications.  Compliance specialists can create policies to automatically flag conversations based on keywords, enabling them to act on explicit or racially charged conduct before it becomes a legal liability.    

 

 

Back up and protect important messages  

With Feith, assurance options guarantee that all chat data is properly backed up in the event of a disaster.  Conversation logs are encrypted both in-transit and at rest. Once captured, they are stored in a DoD 5015.02 certified archive.  Chats can always be found and exported for public records requests.   

 

Fast, Advanced Text Search and Retrieval

Not only does Feith allow you to record, archive, and dispose of records; it also assists in using, finding, and analyzing stored records.  Feith’s Automatic indexing adds structure  tomassive volumes of message logs by capturing and organizing conversation metadata. Once captured, that metadata and the message contents can be searched to pinpoint a conversation or range of conversations. 

 

 

Search tools for every department 

The Records Manager has the option to filter by person, message type, and phrase. They can also save time on eDiscovery by looking in a single repository that centralizes the company or agency’s electronic records. When searching for information, teams can gather every piece of relevant data, including chats and messages, emails, documents, and much more 

 

Narrow results down to the letter 

Feith’s advanced search tools can instantly spot keywords or key phrases, and even find near-matches and spelling errors. Search results are lightning-fast, and favorite search criteria can be bookmarked for later.  

 

Seamlessly find and export messages 

Discovery policies can also be made to detect keywords and key phrases. Captured messaging content is presented in its entirety in a natural, easy to read conversational format. Metadata is captured along with chat logs for discovery and retrieval. If chats are captured to the Feith archive they can be accessed and exported instantly, and in whatever file format is needed.  

Feith gives businesses the tools to master their chat records

Feith has the tools to manage your organization’s mountain of messages.  With Feith, a business can record and store conversations in an easy-to-read, easy-to-find format. Once archived, all messages can be searched and controlled with the same tools used to meet your electronic document and records compliance goals.  Feith lets you bring enterprise-grade Records Management to chat 

 

VIDEO: The Path to an Electronic Records Management Solution

Bimonthly Records and Information Discussion Group
Dedicated to the Improvement of Federal Records Management

The Path to an Electronic Records Management Solution Susan Little, CIO, US Access Board

Social Media Records Management

Federally-compliant Records Management for Social Media

Since the first presidential tweet in January 2010, sent by then President Barack Obama, the medium has exploded as a way for government officials to make public announcements.  Since his inauguration in 2017, President Trump has made Social Media not just a means, but perhaps the means, for his office’s announcements.

This shift follows the trends at large, as Social Media overtakes print for the first time in global advertising revenue earlier this year. Traditional radio announcements, TV ads and print media, are still useful ways to reach out to the broader public, but many budgets simply can’t afford traditional media’s high-cost per impression, and its comparative effectiveness is increasingly up for debate.

Social media is now recognized as a powerful and inexpensive tool for engaging the public, to make announcements, and to educate, no matter what size the agency or their budget.  It’s no wonder that every agency and office up to the President has begun to leverage these effective tools for low-cost/high-impact outreach.   

But be forewarned — many agencies forget that Social Media posts constitute official government records and need to be managed according to the letter of the law. 

NARA Bulletin, ‘Guidance on Managing Social Media Records’
The Federal Records Act (44 U.S.C. 3301) defines Federal records as any material that is recorded, made or received in the course of Federal business, regardless of its form or characteristics, and is worthy of preservation. Social media content that meets this definition must be managed according to the applicable laws and regulations.” 

NARA makes the point very clearly, but it may underplay the concrete importance of Social Media as record.

As of March 2019, 73% of Americans interviewed by Pew Research Center report that they get some or all of their news from Social Media.  It’s clear that Social Media constitutes a strategically significant method for agencies to make announcements to the public, but if they’re going to use Social Media for official business they’ll have to align with NARA’s guidance.

Feith will ensure your social media presence remains compliant with all federal records regulations and guidelines.  Reach out today to learn more about our new Social Media archive solution, backed by our complete Government Records platform:  more-info@feith.com

The Deadline is Approaching: OMB/NARA M-19-21

The US Government knew they needed to get a handle on the inefficiencies they experienced with paper records. Several factors influenced the decision to improve record management processes, including the business case need for electronic record keeping (ERK), and the alignment of ERK with the agency’s mission and strategic initiatives.

Additional factors, such as legal, statutory, and regulatory requirements also played a part in the verdict. Ultimately, agencies determined they needed a more up to date system for managing enormous amounts of records. 

To modernize government record keeping, NARA and the Whitehouse decided to create a new, 21st-century framework for government record management. In conjunction with their colleagues at NARA, the White House issued the NARA M-19-21 mandate.

By the end of 2019, Federal Agencies must manage all permanent  records electronically. By 2022, they must also manage temporary records the same way. This mandate applies to all electronic records, regardless of where they live. Although this law applies mostly to Senior Agency Officials for Record Management (SAORM), and Agency Records Officers, it’s essential that all government employees take proactive measures to safeguard records per this new policy.

According to the National Archives and Records Administration: Criteria for Successfully Managing Permanent Electronic Records, there are four high-level view components to successfully managing electronic records. The first criteria suggest administering company-wide polices that explain how employees are expected to manage electronic records. Next, to help with educating employees about record responsibilities, training programs should be enforced, and record requirements need to be considered throughout the development process to make sure that the selected automated system supports these requirements. Secure record keeping is vital, but agency employees should also be able to access records when needed. Furthermore, documents must be transferred to NARA in the appropriate format with the correct metadata.

In addition to high-level view components, there are also operational activities and universal electronic records management requirements that NARA recommends for successfully managing permanent electronic records. For example, at an executive level, agencies should regularly review record schedules to assess whether records have become obsolete or superseded, consult stakeholders to confirm the owners of permanent electronic records, and maintain the ERM system for the duration of their retention periods.

NARA cites several more examples, and agencies should visit NARA’s website to view the complete list of suggested activities and requirements. 

Feith’s experts can help guide M-19-21 compliance

For agencies who still need to digitalize and manage their records, the mandate’s deadline is swiftly approaching; the time to act is now. Agencies should consider Feith’s solution to help successfully digitalize and manage their records.

The Feith team has helped guide many agencies during their transition from paper to electronic records.  To learn more about how we can help tackle the mandate, contact the Feith team today!

Universal ERM Requirements

The Universal ERM Requirements serve as a resource for agencies looking to use a technology solution to assist with managing their records. By referring to these guidelines, agencies can determine what ERM functions are critical, while also considering their personal needs and financial priorities.

Agencies should refer to this document when they’re deciding on an ERM system. The protocols are broken down into “must have” and “should have” recommendations, and agencies must make sure their ERM system, at least, complies with the “must have” requirements.

With the M-12-18 deadline approaching, agencies who haven’t tackled their electronic records yet should consider the solution offered by Feith Systems & Software Inc. The Feith team of subject

matter experts have guided countless government agencies during their transition to managing electronic records across their lifecycle. Furthermore, Feith’s software ensures that agencies comply with both NARA’s Must Haves and recommendations – Feith supports every requirement of the new Universal ERM Requirements.

Here are some examples of how Feith’s system can help your agency align with NARA Universal ERM Requirements:

NARA Recommendation:

“The record system must have the ability to prevent illegal access, alteration, or deletion of records.”

  • Full Attribute-Based and Role-Based Access controls for every document and data row in the system.
  • Set legal-holds to prevent deletion of records.
  • Meets the DoD 5015.02 standard for managing controlled, classified, and sensitive documents.

How Feith Helps Agencies Align With This Requirement:

“Any actions changing the level of access, altering the record, or changing the location of the record must be documented and tracked into an audit log.”

  • The Feith platform contains a full audit-trail of every change in the system. No action in the system flies under the radar of the audit system.
  • Full system log contain who, what, when, where, and how a setting or piece of metadata was changed.
  • Track and dashboard individual users, groups, roles, and their respective actions.

“Records of current and former employees must be managed in a manner that supports searching in response to information requests, including FOIA and agency business needs.”

  • Full-text and content search across all documents, including emails and their attachments.
  • Adjust search parameters to simplify search processes.
  • Advanced search allows Power Users to find things in creative ways.

“Ensuring usability of records includes converting records to usable formats and maintaining the link between the records and their metadata through the conversion process.”

  • Captures records in their native formats, but will also generate readable PDF formats for web review, redactions, and production for legal.
  • Transfers files in correct file format and with complete metadata to NARA.

“Ensuring usability of records includes carrying out system upgrades of hardware and software while maintaining the functionality and integrity of the electronic records created in them.”

  • Maintains records for entire lifecycle.
  • Whether On-Premises or in the Cloud, the system is easy to upgrade, and the records are provably secure throughout the process.

Government agencies should make sure their ERM system adheres to the Universal ERM Requirements established by NARA; Feith’s solution makes it simple for agencies to comply with these regulations.  

To learn more about how Feith helps agencies meet the NARA M-12-18 mandate and Universal ERM requirements, contact the Feith team!