Recordkeeping and the cloud June 9, 2011

Blue Sky with Clouds
Creative Commons License photo credit: shaire productions

At Future Proof, the digital recordkeeping question that we are most commonly asked at the moment relates to the cloud and recordkeeping. So, on International Archivists Day and @AskArchivists Day, we thought we’d blog about all the cloud-related advice available on our website in case you were interested but too shy to ask!

Overview of cloud recordkeeping issues

Our two page flyer, ‘Managing recordkeeping risk in the cloud’, contains a summary of the key issues to consider in relation to cloud computing and a short checklist to help you get prepared –  see /resources/

Legal authorisation for cloud-based management in NSW

General Authority 35 is the general disposal authority that permits records to be stored out of the state providing certain conditions are met – see http://www.records.nsw.gov.au/recordkeeping/government-recordkeeping-manual/rules/general-retention-and-disposal-authorities/general-authority-for-transferring-records-out-of

This authorisation is required because under the terms of the State Records Act, it is illegal to take records of government out of the state without authority. Cloud storage obviously usually takes records out of NSW and so this document gives the legal authorisation to store government records in the cloud. However, it does specify that certain conditions have to be met before this can be done. Specifically it says that:

Public offices must:

  • assess and address the risks involved in taking and sending records out of the State for storage with or maintenance by service providers based outside of NSW
  • ensure the service providers facilities and services conform to requirements in standards issued by State Records
  • ensure contractual arrangements and controls are in place to ensure the safe custody and proper preservation of records
  • ensure that the ownership of the records remains with the public office
  • monitor the arrangement to ensure the service provider is meeting relevant requirements.

Certain classes of records are excluded from coverage by this authority. The exclusion that applies most specifically to the cloud is that which excludes records that are:

  • inaccessible because they are not adequately controlled (i.e. not sufficiently described or tagged with metadata in compliance with standards issued by State Records)

So, if records are to be moved to the cloud they need good metadata that will enable them to be searched, used and managed appropriately (ie disposed of appropriately, have their technical dependencies monitored, their security and any privacy considerations managed etc)

More advice on how to meet the requirements of GA35 is contained in RIB54 Storage of State Records with service providers outside of NSW at http://www.records.nsw.gov.au/recordkeeping/government-recordkeeping-manual/guidance/recordkeeping-in-brief/storage-of-state-records-with-service-providers

This short, easy to read document highlights the importance of risk management in relation to cloud storage as well as a range of other considerations. With risk assessments, you need to look at the information you are considering locating in the cloud and consider its security and sensitivities. If it’s super secret and super sensitive, can your cloud provider meet your management requirements or is this data best left in house?

Other recordkeeping advice on cloud issues

The Australian Digital Recordkeeping Initiative has developed some useful guidelines you may want to look at: http://www.adri.gov.au/products/ADRI_statement_re_cloud_computing_v1-0_July_2010.doc

Last year all CEOs across NSW government were also sent an overview of the issues and recordkeeping risks to consider when using cloud services as part of the regular Future Proof CEOs newsletter. See http://www.records.nsw.gov.au/recordkeeping/resources-for/chief-executives/Future%20Proof%20News%20Issue%203%20Nov%202010.pdf

The Archives and Records Association UK and Ireland has issued a really comprehensive Cloud Computing Toolkit. It contains a comprehensive overview of the range of cloud computing services available and the recordkeeping considerations that apply to each. See: http://www.archives.org.uk/ara-in-action/best-practice-guidelines.html

Common problems we’ve heard about so far

The main problems we’ve encountered with the outsourced management of digital records relate to format compatibilities. Sometimes when organisations have had their records returned to them at the conclusion of an outsourcing arrangement, they have not been in a format that the owning organisation can readily access or use. Some organisations have been faced with the need to purchase expensive software in order to access and reuse their data.

Under the terms of authorised retention and disposal authorities, a large number of government records have long retention periods and a fairly large proportion are classified as State archives. This means that a lot of records sent to the cloud will need to be kept for very long periods of time, and so the ability of the service provider to return your data to you is important in terms of your own business needs and your legal requirements.

Another common problem is the ability of the service provider to perform and then document any records management operations you may want done, most frequently registration and disposal actions.

And remember all the good stuff about the cloud

Finally, it’s important to consider all the good things that can come from cloud arrangements. If you are going to be in the position of building a new storage environment you could take the opportunity to design a really robust, user-friendly environment in the cloud that uses all the functionality available from your provider to create fantastic classifications and management structures for your users, to improve access and useability as well as automate some of your records management rules.

It’s really important for IT and records staff to work together on establishing these types of infrastructures because so much can be achieved if recordkeeping considerations that facilitate broad information management objectives are built collaboratively into cloud-based outsourcing projects from the outset.

Remember to contact us if you’d like any further advice or if you want to discuss your organisation’s plans for the cloud. We’re always happy to chat!

One Comments
Storage Letchworth October 22nd, 2011

I work in a voluntary capacity for my local council over here in England and your article caught my eye with the mention of storing out of state and the regulations relating to that. I think I need to check that we are complying with our own articles and regulations with our own cloud storage. Thanks for the tip!

Leave a Reply

You must be logged in to post a comment.