Professional Documents
Culture Documents
Arian D. Ravanbakhsh Electronic Records Policy Specialist RACO Chicago August 24, 2010
Outline
Context/Background re. Cloud Computing Use scenarios RM Challenges Tactics to solve challenges
Intervening at procurement
Questions?
NARA Issuances
Frequently Asked Questions About Managing Federal Records In Cloud Computing Environments
February 2010 http://www.archives.gov/records-mgmt/faqs/cloud.html
Rapid elasticity
Measured Service
Cloud systems automatically control and optimize resource use by leveraging a metering capability at some level of abstraction appropriate to the type of service (e.g., storage, processing, bandwidth, and active user accounts). Resource usage can be monitored, controlled, and reported providing transparency for both the provider and consumer of the utilized service.
Community cloud
The cloud infrastructure is shared by several organizations and supports a specific community that has shared concerns (e.g., mission, security requirements, policy, and compliance considerations). It may be managed by the organizations or a third party and may exist on premise or off premise.
Public cloud
The cloud infrastructure is made available to the general public or a large industry group and is owned by an organization selling cloud services.
Hybrid cloud
The cloud infrastructure is a composition of two or more clouds (private, community, or public) that remain unique entities but are bound together by standardized or proprietary technology that enables data and application portability (e.g., cloud bursting for load-balancing between clouds).
(All definitions are from NIST Definition of Cloud Computing, Version 15, 10-07-2009)
Federal
Department of Defense, Defense Information Systems Agency
IaaS Forge.mil
State
State of New Jersey, NJ Transit Authority
SaaS - Customer relationship management http://www.nj.com/news/index.ssf/2008/05/nj_transit_to_test_o nline_sugg. Local
Local
City of Miami, FL
PaaS City-wide 311 http://gcn.com/articles/2010/03/10/city-of-miami-microsoftazure
So Is There A Problem?
Potentially
If the benefits of the drivers outweigh perceptions of records management responsibilities If cloud solutions are procured without consideration of records management requirements If particular cloud deployments present insurmountable obstacles to exercising records management
What are some of the records management challenges associated with cloud computing?
Cloud applications may lack the capability to implement records disposition schedules, including the ability to transfer and permanently delete records or perform other records management functions. Therefore specific service and deployment models may not meet all of the records management requirements of 36 CFR part 1236 (formerly 36 CFR part 1234). Examples of these requirements include: Maintaining records in a way that maintains their functionality and integrity throughout the records full lifecycle Maintaining links between the records and their metadata Transfer of archival records to NARA or deletion of temporary records according to NARA-approved retention schedules.
What are some of the records management challenges associated with cloud computing?
Depending on the application, vendors of a public cloud or managers of a private cloud may not be able to ensure the complete deletion of records. Records are often stored in more than one cloud location for access and backup. When an agency orders that records be deleted, not every location may take that action. This will complicate an agencys responsiveness to discovery or FOIA requests. Various cloud architectures lack formal technical standards governing how data are stored and manipulated in cloud environments. This threatens the long-term trustworthiness and sustainability of the data.
What are some of the records management challenges associated with cloud computing?
A lack of portability standards may result in difficulty removing records for recordkeeping requirements or complicate the transition to another environment. This could affect the ability of agencies to meet their recordkeeping responsibilities for temporary or historically valuable records being transferred to NARA.
Given these, early cloud adopters will still need to adopt tactics to address RM in the cloud
Intervention at Procurement
Draft RM-related Terms of Service [ToS] clause to append to any CC procurement
E.g.,
The Entity [adopting CC services] acknowledges that use of Providers site and services may require management of records. Usergenerated content in the form of comments, contributions to drafts, and other materials may also meet the definition of records as determined by the Entity. If the provider holds records, the Entity and the Provider must manage records in accordance with all applicable records management laws and regulations, including cite your specifics here. Managing the records includes, but is not limited to, secure storage, retrievability, and proper disposition of all records including transfer of permanently valuable records in a format and manner acceptable to insert A/RM authority here at the time of transfer at the time of transfer. The Entity is responsible for ensuring that the contractor is compliant with applicable records management laws and regulations through the life of the contract.
Questions?