Sprehe: FBI gets it right

The FBI has received a truckload of bad press recently. So it is a pleasure to dwell on some good news coming out of the agency. In May, the FBI received an Archivist's Achievement Award from the National Archives and Records Administration for its electronic recordkeeping certification project.

The project is modeled on a widely used certification and accreditation process for information technology security. All FBI systems that process federal information must be certified and accredited as complying with a specific records management standard.

To be compliant, a system must be able to export records and associated metadata to an electronic records management system within the agency that is certified under the Defense Department's 5015.2-STD. Alternatively, an electronic records management system certified under the DOD standard can be part of a larger IT system.

An FBI records officer and the IT system owner must work together to determine whether a system processes federal records. Just as with security certification and accreditation, an FBI system that handles federal records cannot receive the authority to operate until it is certified and accredited as an electronic recordkeeping system.

Initially, the FBI's rule is being applied to new IT systems, but eventually, the Records Management Division will apply the process to existing systems.

The process allows a system to receive interim authority to operate if it will take some time to carry out the changes required to make it compliant. Under the same process, a designated official can grant emergency authority to operate systems that need to be created quickly to deal with emergencies, such as the sniper attacks in the Washington, D.C., region in 2002.

Most agencies put the onus on the records officer to ensure appropriate handling of electronic records. The FBI's novel approach shifts much of the burden to the source of the information — the IT system that contains the records and the system's owner.

In the interest of full disclosure, I served as a consultant to the contractor that helped develop the FBI's project. All of the ideas for the process, however, originated in the bureau's Records Management Division.

I believe that the FBI has a superb idea that has value for every government agency. The idea is so good, in fact, that the Office of Management and Budget should consider incorporating it into everyone's favorite pest, OMB's Exhibit 300.

I recommend deleting the lines in Exhibit 300 under IT investments that pertain to electronic records and the Government Paperwork Elimination Act. That act has only limited applicability to public information collections. The Exhibit 300 form could be modified to ask: Does this investment implement electronic transactions or recordkeeping covered by the Federal Records Act? If so, is the system certified as being in compliance with 5015.2-STD?

That one change could largely solve the problem of capturing federal electronic records. Whether or not OMB acts on my suggestion, kudos to the FBI for developing and applying an effective way of managing federal records that are born digital.

Sprehe is president of Sprehe Information Management Associates in Washington, D.C. He can be reached at jtsprehe@jtsprehe.com.


  • People
    Dr. Ronny Jackson briefs the press on President Trump

    Uncertainty at VA after nominee withdraws

    With White House physician Adm. Ronny Jackson's withdrawal, VA watchers are wondering what's next for the agency and its planned $16 billion health IT modernization project.

  • Cybersecurity

    DHS floats 'collective defense' model for cybersecurity

    Homeland Security Secretary Kirstjen Nielsen wants her department to have a more direct role in defending the private sector and critical infrastructure entities from cyberthreats.

  • Defense
    Defense Secretary James Mattis testifies at an April 12 hearing of the House Armed Services Committee.

    Mattis: Cloud deal not tailored for Amazon

    On Capitol Hill, Defense Secretary Jim Mattis sought to quell "rumors" that the Pentagon's planned single-award cloud acquisition was designed with Amazon Web Services in mind.

Stay Connected

FCW Update

Sign up for our newsletter.

I agree to this site's Privacy Policy.