Federal Records Management

Bulletin 2012-02

December 06, 2011

TO: Heads of Federal Agencies

SUBJECT: Guidance on Managing Content on Shared Drives

EXPIRATION DATE: Expires when revoked or superseded

1. What is the purpose of this Bulletin?
NARA recognizes agencies have long used shared drives to store content. Agencies have had varying degrees of success in managing the Federal records on shared drives. This Bulletin outlines the records management implications and challenges, agency responsibilities, and benefits of organizing and managing content stored on shared drives.

NARA bulletins provide fundamental guidance to Federal agencies, who must then determine the most appropriate ways to incorporate recordkeeping requirements into their business processes and identify the specific means by which their agencies will fulfill their responsibilities under the Federal Records Act.

2. What is a shared drive?
Shared drives, also known as network drives, are typically used to store and share content such as word-processing documents, scanned and photographic images, audio, video, spreadsheets, presentations, and databases. Agencies have also used shared drives to group and store content by function, project, committee, or other logical category. The use of shared drives poses recordkeeping challenges because agencies may store content that includes Federal records and non-record materials.

3. Can a shared drive be a recordkeeping system?
Recordkeeping systems must meet the requirements in 36 CFR 1236. On its own, a shared drive does not provide the functionality of an electronic recordkeeping system. Through a combination of manual and automated policies and procedures a shared drive can be a recordkeeping system. Managing records on a shared drive requires intervention and will be a challenge. Specific challenges include:

  • Ensuring records are covered by NARA-approved records schedules and are managed in accordance with their approved disposition
  • Identifying and managing the record copy when multiple copies and versions exist
  • Implementing controls to protect the trustworthiness of records and the related metadata
  • Structuring folders, sub-folders, and files within a shared drive to associate records with their approved records schedule
  • Implementing and maintaining audit trails to track use of the records
  • Organizing records and related dispositions when offices change, merge, or cease to exist
  • Monitoring the record copies of long-term temporary or permanent records to ensure they do not become technologically obsolete

Small units or individual offices within an agency can successfully meet some of these challenges when using a shared drive for records management activities. However, scaling this across a large organization is difficult.

4. What are the records management responsibilities when Federal agencies decide to store records on a shared drive?

Agencies are responsible for managing their records in accordance with 36 CFR Part 12 Subchapter B. Specifically, 36 CFR 1236.20 describes requirements for electronic recordkeeping. The following functionalities are required when managing records on a shared drive throughout their lifecycle:

  • Declare, Capture, and Organize
    • Identify and file the record copy within the shared drive
    • Associate the records with an approved records schedule
  • Preserve, Maintain Security, and Manage Access
    • Prevent the unauthorized access, modification, or deletion of declared records, and ensure that appropriate audit trails are in place to track use of the records
    • Ensure that all records in the system are retrievable and usable for as long as needed to conduct agency business
    • Develop procedures to migrate records and related metadata to stable storage media and sustainable formats
  • Disposition
    • Dispose of temporary records according to the records control schedule
    • Identify permanent records for transfer to NARA

If agencies are using a shared drive, they also need to manage non-record content (see 36 CFR 1222.14 and 1222.16). For instance, agencies should review and delete obsolete materials when no longer needed for reference (see question #5 for tips on removing obsolete materials).

5. What are the benefits of organizing shared drives?
Agencies that lack policies and procedures to control the content stored on a shared drive are likely to have large volumes of unmanaged files spanning many years. As a result, the task of identifying, removing, and organizing files will be time consuming and costly. Once a shared drive has been organized, it will be easier to retrieve and store information and ensure records are properly managed and protected from unauthorized destruction.

In addition to the records management benefits, organizing the shared drive can free up network space, potentially lower operational and migration costs, and improve the ability to respond to e-discovery and FOIA requests. Organizing shared drives can also be the first step toward moving to an automated recordkeeping solution. For some suggested approaches to organizing a shared drive, please see Appendix A.

6. What are some strategies and best practices for managing content on a shared drive?
NARA has identified some strategies and best practices for managing content on a shared drive.

  • Develop and maintain policies and procedures that govern the use of shared drives, including permissions, access controls, and acceptable formats for filing records needed for long periods of time (i.e., non-transitory)
  • Establish points of contact responsible for shared drive management
  • Perform a risk analysis to determine if the shared drive can provide a sufficient audit trail
  • Identify personal materials and non-records (e.g., extra copies or reference materials) to ensure they are maintained separately from Federal records
  • Identify the record copy and maintain it in an area designated for Federal records
  • Establish and enforce naming conventions applicable at folder, sub-folder, and file level
  • Structure folder and sub-folders to associate any records with the corresponding records schedules including cutoff and disposal instructions
  • Use metadata, file plans, and other tools to link related files in all media
  • Work with Information Technology staff to ensure the integrity of the shared drive is maintained
  • Train staff in the use of the shared drive and in their records management responsibilities

Some of these strategies and best practices for managing content on shared drives rely on manual intervention to provide the records management activities that an electronic system could do automatically.

7. Can agencies transfer to NARA permanent records stored on a shared drive?
Yes, NARA's transfer guidance applies to permanent records regardless of location. Once records stored on a shared drive are organized and associated with a records schedule, it will be easier to identify permanent records for transfer to NARA.

8. What other NARA resources are available?
NARA has the following additional resources that may be useful:

  • Toolkit for Managing Electronic Records: A resource for agencies to share and access records management guidance and best practices. Examples include tools that address the creation of business rules for managing shared drives, instructions for structuring a shared drive, and naming conventions for content stored on shared drives.
  • Records Express Blog: The official blog of the National Records Management Program (NRMP) at NARA highlights guidance and upcoming events. It also discusses how the NRMP is working with our agency partners to improve records management in the Federal government.
  • Frequently Asked Questions about Records Management: Provides a list of FAQs on noteworthy records management topics.

9. Whom can I contact for more information?
Agency staff should contact their agency records officer to discuss managing content stored on a shared drive. A list of agency records officers can be found on the NARA web site at http://www.archives.gov/records-mgmt/agency/officers-lists.html. Your agency's records officer may contact the NARA appraisal archivist with whom your agency normally works. The list of the appraisal contacts is posted on the NARA web site at http://www.archives.gov/records-mgmt/appraisal/.

Appendix: Approaches for Organizing a Shared Drive

Task Description
Plan the project When developing a project plan, consider the following:
  • Developing a communications plan
  • Identifying the shared drives to be organized
  • Identifying and procuring services and technologies to assist in the process. If procuring a contractor, conduct a market survey, interview vendors, and prepare a statement of work
  • Conducting a pilot to test the process and develop rules for the rest of the organization
  • Documenting lessons learned from the pilot
Identify key stakeholders and establish roles and responsibilities Successful organization and maintenance of shared drives involves many stakeholders:
  • Senior management to serve as champions for the project
  • Records management staff to ensure records management policies and procedures are followed
  • Information technology staff to manage network operations, information security, and helpdesk services
  • Subject matter experts (SMEs) and end-users to provide information about existing content
  • Staff responsible for litigation holds and pending information requests (e.g., FOIA, Privacy Act) to prevent the deletion of responsive content
Evaluate the current state of the shared drive Organization of shared drives involves analysis of the current shared drive structure and practices:
  • Review the IT platforms, enterprise architecture, and security requirements to understand impacts on project
  • Collect data regarding current status:
    • Number of shared drives within the organization
    • Volume of content stored on each shared drive
    • Directory structure of each shared drive
    • File types and formats found on shared drives
    • File dates, such as date created or last modified
  • Identify pending IT plans that may impact the project, such as planned migration, consolidation, or technology refreshes
  • Identify and review any controls currently in place, such as naming conventions, version management, file plans, and applied metadata
  • Interview SMEs and various stakeholders to understand shared drive use
Identify unwanted content Consider utilizing rules and queries to identify unwanted content, such as:
  • System-generated backup files, temp files, old applications, and old install files
  • Multiple copies that contain identical content and may be in different formats
  • Digital photos and videos that could be stored in another location or on other media
  • Personal files with no business value
Review and remove the unwanted content Work with SMEs to review and remove the unwanted content:
  • Establish deadlines for reviewing the files
  • Schedule meetings to review files as a group
  • Document lessons learned to assist in developing future policies and procedures
Manage the remaining content Work with SMEs to identify to review remaining content:
  • Identify records
  • Apply appropriate disposition authorities
  • File related records appropriately (e.g., case files, disposition authorities, etc.)
  • Develop a standardized folder/directory structure
  • Implement the office-level file plan
  • Execute disposition actions in accordance with NARA-approved schedules
Develop day-forward policies and procedures Develop policies and procedures to maintain an organized shared drive:
  • Configure the network to attribute file properties correctly
  • Develop maintenance strategies (e.g., running periodic queries and reports, annual clean-up day)
  • Implement folder structure and naming conventions
  • Develop written guidance and reference materials for shared drive users
  • Provide staff training on the proper use of shared drives
  • Include shared drives in internal records program reviews
  • Establish clear roles and responsibilities for the maintenance of the shared drive