NASA Procedural Requirements

NPR 1441.1E Effective Date: January 29, 2015 Expiration Date: May 23, 2025

Subject: NASA Records Management Program Requirements (Updated w/Change 3)

Responsible Office: Office of the Chief Information Officer

CHAPTER 5. Requirements for Management of Records in E-mail, Cloud, and Social Media

5.1 Determining Records in Electronic Formats or Media

5.1.1 Electronic content may constitute a Federal record if it meets the definition of records, regardless of whether it takes the form of an e-mail or other electronic communication such as a text or instant message, or if the content was created using social media applications internal and external to the Agency, including collaborative environments.

5.1.2 Content generated using communication or social media applications is likely a Federal record if there is an affirmative answer to one or more of the following non-exhaustive list of questions when considered in conjunction with the definition of Federal records:

a. Does it contain unique evidence of the Agency's policies, business, or mission?

b. Is the information available only on this social media site?

c. Does the Agency use the tool to convey official Agency information?

d. Is there a business need for maintenance of the information?

5.1.3 Employees may consult with their Center Records Manager when in doubt as to whether content constitutes record material. The default assumption is that the content does constitute record(s).

5.2 Managing Information in Cloud Computing

5.2.1 If NASA information/data processed or maintained via cloud services meets the definition of a Federal record, RM functionality is required in the cloud environment, or alternative plans are required for meeting established records requirements.

5.2.2 If the cloud is used only as space in which the Agency is storing data and performing functions with the data using non-cloud furnished capabilities, then RM functionality does not need to be addressed in the agreement. However, issues that should be addressed before entering into a cloud initiative agreement include such things as cloud environment security in compliance with NASA IT security policies and the destiny of any Agency data/records stored therein should the cloud provider cease operation.

5.2.3 NASA Service Executives establishing service-level agreements for cloud initiatives shall consult their Center Records Manager in considering whether an agreement should include records management requirements.

5.3 Managing Social Media Content

5.3.1 Social media should not be used external to the Agency for creation or posting of content that rises to the definition of Agency records unless, in consultation with the Center CIO, a plan is established for how the records will be harvested or captured and managed by the Agency in accordance with the NRRS.

5.3.2 When internal social media applications contain NASA records, application owners shall either provide RM functionality that provides the controls required by 36 CFR 1236 and the functionalities discussed in IT-HBK-1440.01, or establish written procedures that are approved by the Center Records Manager for how the records will be managed and disposed of in accordance with the NRRS.

5.4 Managing E-Communications Records

5.4.1 The content and metadata of e-mail messages created and used in the conduct of official Agency business are considered official Federal records if the information content meets the definition of Federal records as described in Section 1.1. See Table A for basic criteria to assist with determining which messages are records. There are many messages that may be sent or received by NASA employees that do not conduct Agency business and, therefore, are nonrecords.

a. Whether a message constitutes a record and; if so,

b. Appropriate retention for the message before disposition.

Table A. Basic Criteria Determining E-mail Record Status and Retention

5.4.2 Table A provides basic criteria to aid individuals and offices in determining the record status and retention of their messages. However, NRRS 1441.1 is always the authoritative source for determining retention.

5.4.3 NASA utilizes a type of "Capstone" approach to capture and manage e-mail records in accordance with NARA-issued Bulletin 2013-02. Using this approach, the Agency categorizes and schedules all e-mail of certain senior managers, based on the work and/or position of the e-mail account owner.

5.4.4 In NASA's implementation of this Capstone approach, the following are required:

a. Each Center Records Manager shall maintain an up-to-date list of senior managers whose e-mail records are permanent as described by NRRS 1/22.A.1 or NRRS 8/101 of NRRS 1441.A. With concurrence of the NASA Records Officer, updates to the senior management list are provided to the Agency e-mail service provider as Center personnel changes occur. The list may be found under "Electronic Records Management" on the internal NASA Records Management Website.

b. The NASA CIO shall require the e-mail service provider to capture the e-mails and accompanying metadata of e-mail account holders specified as senior managers by Center Records Managers or the NASA Records Officer, so their records may be transferred to the National Archives.

5.4.5 The Agency has implemented a two-pronged approach for managing all other NASA users' e-mail records (with longer than 180-day retention) as follows:

a. The NASA CIO shall maintain an Agency-wide recordkeeping solution that automatically captures, manages and disposes of e-mail records using the Capstone approach of position-based retention.

b. Individual users with nasa.gov e-mail accounts who have not been migrated to the Agency-wide solution will maintain, as described below, e-mail records of longer duration than transitory (180 day retention) value in accordance with the retention schedule appropriate to the subject and content of the message.

(1) Content and attachments of an e-mail record, together with date/time sent and distribution metadata, are to be captured by the individual user, and retained in the same system in which the user's related non-e-mail official records are stored or in systems/locations where their protection, retention, and recovery can be ensured. This is true whether the e-mail is associated with the user's individual account or a functional or other NASA business e-mail account for which the user is responsible (e.g., NASA-PAOfficer@nasa.gov).

(2) These messages may be captured and stored in Outlook Personal Storage Table (PST) files or Portable Document Format (PDF) files, as approved by the Center RM. PST files (personal folders) are located on a user's personal and/or network storage device that is regularly backed up. Include the word "Records" in the PST file name for any folder that contains e mail records. Messages are saved in PDF using "File-Save" or "File-Print" (select Adobe PDF as the printer) options from the e-mail. When saved as a PDF file, the user shall also ensure preservation of any attachment(s).

(3) Before an employee separates from the Agency, they should ensure any e-mail records of longer duration than transitory value are captured in one of the methods specified above. If e-mail records are stored in "Records" PST files, the departing employee will provide their organizational IT point of contact notice of that fact prior to their departure.

5.4.6 Employees shall not create or send a record using a non-NASA electronic messaging account (i.e., e-mail), unless the employee does one of the following: (1) copies the employee's official nasa.gov account or (2) forwards a complete copy of the record, with any attachment(s), to their official NASA account no later than 20 days after the original creation or transmission of the record. Employees may be subjected to disciplinary action for intentional violation of this provision. Nothing in this provision supersedes other NASA policies concerning use of non-NASA services for the processing of NASA information.

5.4.7 NASA business users shall not use instant messaging and text messaging services to create business communication records of Agency retention value greater than 180 days. In the event that communication of longer retention value is created, the sender and recipient have responsibility for capturing the content of and attachments to the message, together with date/time sent and distribution metadata, and saving it in the same system in which their related non-e-mail official records are stored or in systems/locations where their protection, retention, and recovery can be ensured.

DISTRIBUTION:
NODIS

This document does not bind the public, except as authorized by law or as incorporated into a contract. This document is uncontrolled when printed. Check the NASA Online Directives Information System (NODIS) Library to verify that this is the correct version before use: https://nodis3.gsfc.nasa.gov.