Jump to main content.

Protecting Your Records
A 5-Step Vital Records Plan for Your Office

A certain subset of the Agency's records are vital, meaning that they are absolutely essential in an emergency. It is difficult to decide which records are vital, and some instructions for doing so are presented in this guidance. In making this determination, the most crucial question is: Are these records vital to continuing the Agency's mission of protecting public health and the environment?

While all of the work that we do supports these efforts, some records are simply critical for continuation of functions and cannot be lost even in the most drastic situation in which access to records are lost for a prolonged period of time. Because of this, these vital records must be duplicated and stored off-site.

There are two types of vital records:

Could you access the critical information your office needs to perform its key functions in the case of an emergency? Does your office have contingency plans in place for protecting its vital records in the case of a disaster?

If the answer to these questions is "no," you need to establish and maintain a vital records protection program for your office. A vital records program identifies and protects records and information necessary for the EPA to continue its key functions and activities in an emergency, and all Federal agencies are required by regulation (36 CFR 1223) to have one. The time to implement a vital records program is before you need it! This document outlines the steps you need to follow to establish and maintain a program for your office.

Step 1 - Identify your office's vital records.

The first thing you need to do is to review the information and records maintained in your office and determine which ones would be needed in an emergency. There are three tiers of vital records protection. Tier 1 protects those records necessary in the first few hours of a crisis. Tier 2 records are necessary to respond to the emergency at hand. These records involve only that work which is necessary to handle the crisis. It is assumed that no day-to-day work will be done until the building is reopened or you have complete access to your records. Tier 3 records involve activities which are the most critical to the Agency mission. This assumes that your records are completely inaccessible for a prolonged period of time and the few most critical activities will need to be continued off-site without interruption.

Here are some examples:

Tier One: Those records necessary in the first few hours of a crisis.

Records that may be needed immediately

Many of these records will be included in the office's COOP plan. For this reason, they are also known as "COOP vital records."

Tier Two: Those records necessary to respond to an emergency. These records involve only that work which is necessary to handle the crisis; it is assumed that no day-to-day work will be done until the building is reopened, and/or there is complete access to the records.

Records that may be needed to respond to the crisis

Records that may be needed to provide employee benefits

Records that may be needed to get back into the office

Tier Three - Those records involving specific activities which are the most critical to the Agency mission. This assumes that the normal Agency records are unavailable for a prolonged period of time due to an emergency which causes long-term displacement of personnel and equipment from the work site to a new operating location. Most of the day-to-day work in this catastrophic situation would need to be recreated.

Any program-specific records on activities that are deemed to be of critical importance, in which case the work cannot be interrupted, even if, as in the worst case, the building has been destroyed and all of the Agency records are lost. The determination of tier three records must be made by each office. If an office decides that none of their work rises to this level of importance, there will be no tier three records.

There is a link between vital records and the COOP. Therefore, one of the criteria that can be used to determine an office's Tier 3 vital records is what the office has defined in its COOP as its "essential functions." Any records deemed necessary in supporting the office's essential functions should be a part of the office's set of vital records.

The acid test for vital records is as follows: for each record thought to be vital, ask:

Step 2 - Prepare an inventory of vital records.

Next you need to prepare a listing, or inventory, of the records identified in Step 1. Decide who needs to have copies and establish a procedure to ensure the inventory is updated and sent to the appropriate people.

Everyone's cooperation is needed when preparing the inventory. It is necessary for the following people to be involved:

Sample Vital Records Inventory (PDF) (1 pg, 7K, about PDF)

Step 3 - Determine how the records will be protected.

Now that you know which records in your office are vital and where they are located, you need to determine how to protect them. There are two basic choices: (1) duplicate them and store them offsite; or (2) collect them from other sources and recreate them.

The following is a list of questions that will assist you in making your decision.

Note: If you will be duplicating information, use electronic media whenever possible since the cost to reproduce and store information electronically will be less than duplicating and storing paper. It is also critical to have a backup in case the primary electronic system fails. This can be accomplished by copying onto CD-ROMs.

However, electronic media does have some potential pitfalls. Here are some issues to consider:

Step 4 - Designate an offsite storage location.

Based on the decisions made in Step 3, it is likely you will need to find an offsite location to store duplicates. A facility has been identified for Headquarters staff. Those of you in the Regions and Labs will have your own facilities. Here are some things to consider when selecting a location:

Step 5 - Protect the records.

Finally, once you have decided how the records are to be protected, add the information to your inventory. The inventory should show:

Records should be updated as often as possible. Consider the risk to the recovery effort if the information is out of date. Consider the cost of keeping it updated.

Ensure that any other documents which contain information related to the office's vital records program, such as the office's COOP, reflect the most updated vital records program-related information.

Create a resource list of disaster recovery firms for your geographic area and update the information at least annually.

Don't forget to test your plan to be sure the recovery runs smoothly. Include drills on using the equipment, supplies, and procedures for vital records recovery.

Local Navigation

Jump to main content.