Agencies get advice on record retention in the cloud

Federal agencies face problems maintaining official records in cloud computing environments, according to new guidance from the National Archives and Records Administration (NARA).

Under various laws, rules and regulations, agencies are charged with identifying, maintaining and preserving official records. In a bulletin, National Archivist David Ferriero identified several factors to consider when agencies move records to the cloud.

NARA offered guidance on cloud recordkeeping in February, but this bulletin includes more detailed information now that agencies have made more forays into cloud computing.

Dump that data: Agencies need not preserve Web 2.0 content

Cloud computing is defined by the by the National Institute of Standards and Technology as providing on-demand access to a shared pool of configurable computing resources, including networks, servers, storage, applications and services.

According to Ferriero, cloud environments may have problems meeting various federal record rules because:

• Clouds may lack the capability to implement records disposition schedules, including the ability to transfer and permanently delete records or perform other records management functions.

• Cloud applications may have difficulty in maintaining records in such a way that maintains their functionality and integrity through the life cycle.

• Clouds may have problems maintaining links between the records and their metadata.

• Clouds may not be capable of transferring records to NARA or deleting temporary records under NARA schedules.

“Various cloud architectures lack formal technical standards governing how data are stored and manipulated in cloud environments,” Ferriero wrote. “This threatens the long-term trustworthiness and sustainability of the data.”

Ferriero advised agency heads to spell out their recordkeeping responsibilities with contractors so they can maintain the recordkeeping functions in the cloud, and to anticipate preservation needs even if and when a cloud's owner stops operating or goes out of business.