Achieving M-23-07 compliance (formerly M-19-21)

M-23-07 ASSESSMENT

Complying with M-23-07 is an investment. Approached strategically, the time and expense of attainingcompliance will yield dividends in the form of future cost savings and more efficient operations in the longhaul. Over the last 70 years, Iron Mountain has assisted more than 225,000 customers with their recordsmanagement plans. Leveraging our experience and best practices, we know that assessing records collectionsearly in the process positions an agency to establish a plan based on priorities and available budgets. Athorough review is an important step in ensuring the best use of funds. This assessment should include:

RETENTION REQUIREMENTS

Length of retention "“ whether 10, 20, or 100 years"“ is a key consideration for handling records inaccordance with a rigorous cost-benefit analysis.If the retention period is unknown, agencies mustidentify those retention parameters in order to takeproper action.

DIGITIZATION STATUS

Agencies usually have a mix of physical records,digital records, and records that exist in somecombination of the two. Understanding the purposebehind the mix of record types and an agency'sdigitization plans can determine the strategy fordigital transformation. For example, if there is aregulatory requirement to keep physical copies ofrecords that have been digitized, those physicalcopies can be stored almost anywhere.

UNDERSTAND ACTIVITY LEVELS

As agencies start to identify the records theyhave, they must also determine how thoserecords are being used. Knowing how oftenrecords are accessed "“ and in what ways "“ willinform the plan for securely storing those recordsand enabling efficient search and access.

GEOGRAPHIC LOCATION

Most agencies have records collections of varioussizes located at sites across the country, usuallybecause of mission-related or regulatory reasons.More often, records are stored where they arecreated. This is significant because rules andoptions for managing records sometimes varyby location. As such, agencies that have a betterunderstanding of geographical requirementscan navigate their digital journeys and makeinformed decisions about next steps.

A JOURNEY TO DIGITALIZATION& DATA ACCESSIBILITY

Transitioning to a fully electronic government is the ultimate goal, but each agency will likely have to employ multiple strategies and specific timelines to achieve compliance by the National Archives and Records Administration (NARA) and the Office of Management and Budget’s (OMB) deadline of June 30, 2024. With M-23-07 (an update to the previous M-19-21 memorandum), the goal is to modernize records and information management programs to enable agencies to refocus their staff on the mission, while improving efficiencies and saving costs.

According to the most recent Federal Agency Records Management Annual Report, “75% of agencieshave policies and procedures that instruct staff on managing permanent records in all formats, withanother 18% developing them. Less than one quarter (24%) of agencies said their permanent electronicrecords meet the transfer guidance, contain the appropriate metadata, have tested and/or successfullytransferred these records to the National Archives.”

To determine the optimal path towards compliance, agencies should think strategically, exploringpartnerships that provide key benefits, such as support for self-assessment, strategic consultation,physical storage, destruction, and digitization. Determining a clear path to digitization helps agenciesbecome more efficient, save money, and create a foundation for continuous digital transformation.

The journey for each agency involves understanding their own current environment and determining theappropriate options that fit their specific needs, budgets, and goals across the following four areas:

M-23-07 ASSESSMENT

Complying with M-23-07 is an investment. Approached strategically, the time and expense of attainingcompliance will yield dividends in the form of future cost savings and more efficient operations in the longhaul. Over the last 70 years, Iron Mountain has assisted more than 225,000 customers with their recordsmanagement plans. Leveraging our experience and best practices, we know that assessing records collectionsearly in the process positions an agency to establish a plan based on priorities and available budgets. Athorough review is an important step in ensuring the best use of funds. This assessment should include:

RETENTION REQUIREMENTS

Length of retention – whether 10, 20, or 100 years– is a key consideration for handling records inaccordance with a rigorous cost-benefit analysis.If the retention period is unknown, agencies mustidentify those retention parameters in order to takeproper action.

DIGITIZATION STATUS

Agencies usually have a mix of physical records,digital records, and records that exist in somecombination of the two. Understanding the purposebehind the mix of record types and an agency’sdigitization plans can determine the strategy fordigital transformation. For example, if there is aregulatory requirement to keep physical copies ofrecords that have been digitized, those physicalcopies can be stored almost anywhere.

UNDERSTAND ACTIVITY LEVELS

As agencies start to identify the records theyhave, they must also determine how thoserecords are being used. Knowing how oftenrecords are accessed – and in what ways – willinform the plan for securely storing those recordsand enabling efficient search and access.

GEOGRAPHIC LOCATION

Most agencies have records collections of varioussizes located at sites across the country, usuallybecause of mission-related or regulatory reasons.More often, records are stored where they arecreated. This is significant because rules andoptions for managing records sometimes varyby location. As such, agencies that have a betterunderstanding of geographical requirementscan navigate their digital journeys and makeinformed decisions about next steps.