NARA Addresses Cloud Record Keeping

The National Archive and Records Administration (NARA) is reminding government agencies to be vigilante of their record keeping as they adopt cloud computing environments.

The document, posted on the NARA Web site, answers frequently asked questions about record keeping and cloud computing, and raises concerns about the difficulties of accurate record keeping for services in the cloud.

With the Obama administration pushing cloud computing as a major part of its IT directives, NARA officials thought it was a good time to weigh in on the topic of how to keep accurate records as IT architectures change, according to the document.

Government agencies have strict record-keeping requirements mandated by a NARA regulation known as 36 CFR 1236.ff. Among the requirements are to maintain records in a way that their functionality and integrity remain constant throughout the record's life cycle and that links between records and their metadata are maintained.

The regulation also calls for the transfer of archival records to NARA and the deletion of temporary records according to NARA-approved retention schedules.

The problem with cloud computing environments, according to NARA, is that the architecture itself lacks formal technical standards governing how data is stored and used, which makes it hard to maintain accurate records long term.

"This threatens the long term trustworthiness and sustainability of the data," NARA said on its Web site.

A lack of standards for data portability also may result in difficulty removing records to meet agency requirements and could complicate the transition of records from one environment to another, the administration noted.

NARA recommends government agencies consider using records management software that can be integrated with cloud computing services to help them keep records that are compliant with its regulations.

The administration also plans to issue a bulletin about cloud computing by Sept. 30, the end of the government's 2010 fiscal year. The bulletin will more deeply explore implications for federal record keeping in cloud computing environments, including topics such as statutory compliance and data governance.