APPENDIX B - WEBSITE RECORDS
The following information is taken from several sources, including: National Historical Publications and Records Commissions (NHPRC) website ; and the National Archives of Australia's (NAA) publications: Archiving Web Resources - Guidelines and Archiving Web Resources - Policy. (For more complete and up- to-date information, check the following websites: NARA - U.S. National Archives and Record Administration and Analysis and Development of Model Quality Guidelines for Electronic Records Management on State and Federal Websites
Every state agency is accountable for resources delivered or made available over its public websites. Agencies use websites to publish information, give advice and instructions, and facilitate the provision of products and services. They create interaction between an agency and its clients or customers. It is vital that agencies establish policies, procedures and systems that ensure that full and accurate records of web-based activity are created and retained.
Websites contain and also generate public records that should be maintained to meet any legal obligations for evidence of present and past positions, advice, guidance, transactions or instructions on particular matters it delivers. These records must be authentic, reliable, accurate, and provide durable evidence of web-based activity. These same public records need to be inventoried and included on approved agency records retention schedules which provide authority for the retention and destruction or transfer of such records.
Website records document both the structure and the public face of the agency. Consequently, some of these records will have historical value and need to be transferred to the State Archives at the end of their retention periods.
It is recommended that the policies and procedures directives be developed, maintained, and updated regularly by a team comprised of records management staff, website administrators, and information technology staff. This combination of expertise will help the agency keep abreast with the dramatically and rapidly changing technologies, tools, formats and applications developed for website administration. Records that document the processes involved in planning, designing, producing and maintaining web resources should be captured and retained. Any changes to websites need to be tracked and recorded. These required decisions can only be made within each agency based on the context of a particular website.
Each agency should assess the business risk it faces in maintaining an online presence. The level of risk depends both on the nature of an agency's business and its public profile. The assessment should be used to guide the agency's retention of the public records created for or by its website. Periodic assessments should be made to insure that changes to the risk be reflected in the management of the records.
Some public records placed on websites already exist in a formal record keeping system. However, website content is increasingly being created for placement directly on websites. Agencies need to have procedures in place to capture these public records along with sufficient metadata documenting the content, context and structure of the records and their placement on the website.
Websites that are used as a means of conducting official business between agencies and its clients or customers need to capture and retain individual records into an established record keeping system. The system should help guarantee the authenticity, reliability and accessibility of the records. Without legally sustainable evidence that the record is authentic, a court of law may not admit the record into evidence. These sites are likely to also require the creation and capture of other records relating to site security, such as audit logs, which track use of the site.
Any log tracking changes to websites must have sufficient metadata to interpret the log over time. This metadata must remain useable as long as the associated information is retained.) Use appropriate log analysis software, as raw log files are confusing and often difficult to decipher. Most logs of website transactions will contain personal information about the user. The Governor's Executive Order 00-03 limits the collection of personal information "to that reasonably necessary for purposes of program implementation, authentication of identity, security, and other legally appropriate agency operations."
The NAA suggests various approaches to capturing web-based resources and activity. These could be either an object-driven or event-driven strategy. An object-driven strategy may include periodic snapshots of the website, its data objects and the associated metadata. An event-driven strategy would involve capturing transactions that occur between the website and the user and keeping track of the website changes to enable its full reconstruction at any given date. Often a combination of these two approaches is needed to preserve a complete record of the website and its activity.
A relatively static website comprised of simple documents with low interactivity will have different requirements for maintenance than complex web-based documents or a highly interactive website.
To determine the best strategy for maintaining records of web-based activity, the agency needs to perform an assessment of each of its websites and the type of activities occurring at the sites. Does the website simply offer information or are business transactions performed, or do both occur? How complex and diverse are the web-based activities? How frequently does the website change? What is the risk of the website information being challenged? What are the recordkeeping requirements for the information posted or created by the website? Can the agency's technological environment support the record keeping needs of the website records? Does the agency have the necessary resources?
Maintaining captured web-based records over time should include: ensuring that records are stored in widely accepted, technology-neutral storage and data interchange formats such as XHTML; maintaining master sets in different locations (and in two different formats where appropriate); refreshing the media regularly; and performing random spot checks to monitor functionality and integrity of the records. Any loss of functionality, content or appearance that occurs as a result of reformatting or migration should be fully documented.
Agencies may already be creating back-ups of the website as part of normal disaster recovery strategies. Back-ups are regularly overwritten and are not useful for record keeping purposes.
Websites are commonly used tools and are becoming more complex as technology advances. Agencies have a responsibility to citizens of the state of Washington to capture, maintain, and properly dispose of or transfer all public records of their agency. It is vitally important that this includes those public records that reside on or are generated by agency websites.