While it numbers just five percent of an organisation’s total
record population, business critical information and how
you care for it, can have a big impact on your business.
This information requires special preservation measures – ones
that aren’t found in ordinary on and off site storage facilities.
Whether a legal document, photograph, customer record, x-ray,
blue print, patent, corporate article or one of a kind object, when
it comes to business critical information storage is the single
most important factor in determining it’s useful life.
How do you identify what information is critical to your organisation? What
measures should you take to ensure it’s long term protection? How does the
material of which a record is made influence its longevity – and guide your
choice of storage solution?
The question remains, have you done enough to preserve your organisation’s
business critical information, and irreplaceable, five percent? This white paper
will help you define what your business critical information is, understand
the risks associated with inadequate preservation, evaluate storage options
and implement an effective business critical information programme for
What is business critical information?
Business critical information is fundamental to an organisation’s ability to function.
Certain business critical information
contains information vital to the
continued operation or survival of an
organisation during or immediately
following a crisis.
Such records are necessary to continue operations without delay under abnormal conditions. They contain information necessary to recreate an organisation’s legal and financial status and preserve the rights and obligations of stakeholders, including employees, customers, investors and citizens.
Some business critical information may be unique and difficult or prohibitively expensive to reproduce. However, they may be required in their original form to meet or fulfil evidential requirements.
Records should be classified as vital only for as long as they support critical business processes and fulfil the requirements described above. Once they have fulfilled this role, they should be reclassified.
Source: Vital Records: Identifying, Managing, and Recovering Business Critical Records, ARMA International.
Protection of business critical information may be the least well understood – or the least appreciated – area of records management. If you’re reading this paper, chances are you already know a great deal about managing records. Certainly this discipline has never been more critical, particularly in light of legislative and compliance requirements, such as the Freedom of Information Act (2000 and Scotland 2002), the Data Protection Act (1998), the Sarbanes Oxley Act (SOX) of 2002 and the growing body of European legislation designed to protect information. In addition, new laws have increased the cost and risk associated with legal discovery processes – a particularly worrisome area in today’s litigious world.
And, chances are you have devoted significant resources and effort to improving your records management strategy and procedures. But have you done enough?
One area of vulnerability for many organisations is ensuring the accessibility and usability of records. Comprising just five percent of an organisation’s total record population, these are vital to enterprise operations. They may contain information needed to ensure business continuity during or shortly after a crisis, for example. Or, they may document legal or financial status and preserve the rights of an organisation’s stakeholders. If critical information is managed properly, your organisation is protected. If it isn’t you’re exposed to risks, such as noncompliance, loss of asset value and high costs associated with restoration and duplication.
Longevity is the fundamental differentiator between business critical information and all other records. This information has enduring value that must be preserved for years or even centuries. Storing them in a box on a shelf somewhere is simply not enough. The preservation process must ensure that business critical information remains secure, accessible and usable over these extreme time frames. Business critical information includes information organisations need to continue operations during or shortly after a crisis. Some document legal and financial status, such as contracts, patents, deeds, x-rays, laboratory notebooks and blueprints. Others preserve the rights of stakeholders. Still others are one of a kind items with historical significance. Vital records are often physical records, such as paper or film. And, as detailed in the following section, every organisation has a uniquely defined set of business critical information.
How business critical information preservation impacts organisational risk
Once you’ve done the difficult work of thinking through your organisation’s mission and using that to define which records are critical, tactical decisions about how to protect them are much more straightforward. Your focus should be on minimising and avoiding the risks associated with inadequate protection of business critical information. And, the key here is preserving accessto, and usability of these records.
Without proper preservation, records degrade over time and may be lost forever. The impact on your organisation can be severe. Consider the following risks:
- Loss of use, including the inability to produce business critical information during litigation or reuse/repurpose the record to bring additional revenues into the organisation.
- Costs associated with the outright loss or recovery/repair of improperly stored records. Paper may turn brittle and yellow, photographic images may fade, and film based dyes can fade, become distorted and shrink from “vinegar syndrome.” There’s no time to waste – materials are degrading while you are putting a plan in place. Costs associated with these types of loss will depend on the seriousness (or extent) of damage.
- Damage to corporate reputation, particularly in cases where shareholders have a reasonable expectation that records should have received the highest levels of protection and security.
- Negative impact on business continuance where inadequate analysis has been done to identify the probability of damage or loss of information and its impact on the business.
- Inability to comply with European, central and local government regulations and mandates, including the Freedom of Information Act (2000 and Scotland 2002), the Data Protection Act (1998), and the increased corporate and personal liability associated with such failures.
- Increased exposure during litigation due to the inability to produce requested documentation throughout the discovery process.
Examples Of Business Critical Information
- Patents and intellectual property
- Poddcy manuals
- Articles of incorporation
- Quaddty Assurance (QA) records
- Customer records
- Corporate papers
- Laboratory notebooks
- Poddcy or procedure manuals
- Audio tapes
- Video tapes
- Photographs and sdddes
- Cultural artifacts
Remember, what is business critical information for one organisation may not be for another. Use your organisation’s mission as a guide for determining which records are truly vital.
Business critical information storage
Once you’ve identified your business critical information and know what materials must be preserved, the next step is determining the best way to care for them. Storage is the single most important factor determining the useful life of modern information media. Many organisations use off-site storage for records management. These sites are secure, accessible and offer the required redundancy. And, they are perfectly adequate for standardrecord retention. However, when it comes to business critical information – records of which long term survival must be ensured – traditional storage approaches are inadequate. Room temperature storage with unregulated humidity levels does not afford the special protection needed for business critical information. As noted earlier, in uncontrolled environmentswith variable room temperatures and relative humidity levels, paper turns brittle, ink fades and plastics may degrade quickly. In addition, standard storage does not afford maximum protection from catastrophic loss due to natural or man made disasters, including fire, floods and earthquakes. And, in many cases, it does not offer the highest levels of security needed for irreplaceable originals, such as works of art or special documents.
Proper preservation of business critical information calls for a storage solution that provides the following highly specialised features:
- Controlled environments tailored to meet the special requirements of the materials to be preserved, most importantly highly stable temperatures and relative humidity
- Temperature options should range from 18 to 24 degrees Celsius
- Relative humidity options should range from 20 to 50 percent
- Advanced gaseous fire suppression systems to eliminate the risk of water damage
- Multiple levels of security, including 24/7 access control
- Computerised transaction control systems that provide flexible access and chain of custody control to ensure security
- Optional low particulate and contaminant environments via High Efficiency Particulate Air (HEPA) and gas filtration
Traditional Storage Solutions
- Improve business continuity with secure, off site records storage
- Reduce the costs associated with storing and administering records on site
- Provide 24/7 access to records
- May include:
- Records indexing and retrieval capabilities at the box, file or document level
- Highly secure transportation and destruction services
- Inadequate environmental controls – temperature and humidity levels – don’t offer the protection needed for long term record preservation and/or protection against the risk of mould and mildew in certain climates
- More susceptible to disasters, such as fire, floods and earthquakes
Business Critical Information Storage Solutions
- All of the advantages of traditional storage solutions, plus
- Improve long term preservation via controlled temperatures and humidity levels and “bulletproof” facilities
- Provide additional levels of security to guard against theft of sensitive or one of a kind objects
- More costly than traditional storage – but that cost must be weighed against the risks associated with the loss of improperly stored business critical information
Implementing your Business critical Information Programme
When it comes to business critical information, every organisation has three options:
- Do nothing. Business critical information is treated the same as standard information. The information is accessible – for now… maybe. This is the least expensive and highest risk alternative
- Create a partial plan. Some information is protected with various solutions, such as duplication, dispersal and controlled storage. This hit or miss approach may actually incur more risk, because some people and areas of the organisation are afforded more protection than others
- Develop a clear business critical information programme. Business critical information is identified, assessed and protected using the approaches identified in this paper. This option takes a strong corporate and financial commitment, yet reduces risk and maximises protection for the organisation in the long term.
To develop a successful business critical information programme – and protect that magic five percent of records your organisation cannot function without – take the following steps:
- Identify. Using your organisation’s mission as a guide, determine which information is business critical.
- Assess. Evaluate the materials this information comprised of and their current condition.
- Research. Given the materials and their condition, investigate the best approaches and optimal conditions for long term preservation. The Image Permanence Institute offers many helpful resources for doing so—at little to no cost, including:
- IPI Media Storage Quick Reference
- IPI Storage Guide for Acetate Film
- A Consumer Guide to Traditional and Digital Print Stability
- The Storage Guide for Colour Photographic Materials
- Document. Identify the processes, develop the associated business case and obtain organisational buy-in to ensure supportfor long term business critical information preservation.
- Protect. Implement your business critical information programme, including:
- Protective storage using the most secure, environmentally safe and economical means
- Duplication and/or dispersal with geographic separation
- Reassess. Continually monitor programme effectiveness and periodically revisit your mission to ensure that business critical information is identified in light of ongoing changes.
The National Archives is the UK government’s official archive, containing almost 1,000 years of history, with records ranging from parchment and paper scrolls through to digital files and archived websites. The National Archives give detailed guidance to government departments and the public sector on information management, in order to ensure the survival of records, and advise others throughout the public and private sectors about the care of historical archives. They also publish all UK legislation and advise upon and encourage the re-use of public sector information. On the TNA website you can find numerous resources, including publications that can be downloaded for free. Visit www.nationalarchives.gov.uk
ARMA International is a nonprofit professional association and the authority on managing records and information – both paper and electronic. ARMA offers many publications on its web site (www.arma.com), including:
- Vital Records: Identifying, Managing, and Recovering Business Critical Records
- What Are Vital Records?
The Image Permanence Institute (IPI) is a university based, nonprofit research laboratory devoted to scientific research on the preservation of visual and other forms of recorded information. It is the world’s largest independent laboratory with this specific scope. IPI was founded in 1985 through the combined efforts and sponsorship of the Rochester Institute of Technology and the Society for Imaging Science and Technology. There are many resources on the IPI Web site, including publications you can download for free. Visit www.imagepermanenceinstitute.org.
Tom Benjamin Manager, Vital Records Program, Iron Mountain
Tom joined Iron Mountain with the National Underground Storage (NUS) merger in 1998. He holds a B.A. from Slippery Rock University and has worked in Iron Mountain’s underground facility for the past 17 years. As an expert on vital records, Tom has been invited to present to the National Archives and Records Administration (NARA), Nuclear Information and Records Management Association (NIRMA), Society of American Archivists (SAA) and numerous local ARMA chapter groups.
James m. Reilly Director, Image Permanence Institute (IPI)
Jim is well known for his research on the effects of temperature and humidity on library, archives, and museum collections, deterioration of 19th Century photographic prints, environmental monitoring and control, management of film archives, and the major causes of image deterioration. He is the codirector of the Advanced Residency Programme in Photograph Conservation at George Eastman House. Jim is a consultant to numerous museums and government agencies and is sought after worldwide as a teacher and seminar speaker. He has written extensively on preservation issues, and in 1998 received a Technical Achievement Award from the Academy of Motion Picture Arts and Sciences.