The Functional Requirements to Ensure the Creation, Maintenance, and Preservation of Electronic Records were developed to communicate to program and information technology managers what organizations must achieve to ensure that electronic records are created, maintained, and preserved to support their operational, informational, and evidentiary needs. These requirements should be implemented in any system developed to support an organization's business processes. The Functional Requirements rest on a concise definition of a 'record.' We define a 'record' as the complete set of documentation required to provide evidence of a business transaction.

Underpinning all three functional requirements is the concept of 'compliance.' The laws, regulations, and policies that authorize or define a specific government business process, either explicitly or implicitly, define the records management requirements for that process. The requirements identify the records that must be created and may define requirements for records management, access, content, and structure. Many professions or disciplines also have established standards or best practices for records management related to their fields. An organization must identify these requirements and determine how they will be implemented. In addition, changes in the legal and regulatory environment and in professional standards need to be monitored and reflected in modifications to the requirements. Each requirement can be mapped to a compliance factor based in law, regulation, standard, or best practice. The use of the term 'best practice' refers to practices formally adopted or generally accepted by a profession or discipline. Examples of best practices include Generally Accepted Accounting Principles and the American Health Information Association's Recommended Practices for Information and Documentation.

A 'record' is the complete set of documentation required to provide evidence of a business transaction.

Records are created or captured and identified to support the business process and meet all recordkeeping requirements.

Justification: Organizations must capture or create records necessary to carry out a business process and to meet the specific recordkeeping requirements tied to that process. The capture and creation of electronic records requires that the system supporting the business process can capture or create records in the required form including required informational content and contextual elements (e.g., authorizations, date stamps). Records must also be identified when they are captured to ensure their accessibility, usefulness, and preservation.

Electronic records are maintained so that they are accessible and retain their integrity for as long as they are needed.

Justification: Agencies are required to retain electronic records to meet minimal legal retention requirements imposed by business process specific administrative needs and legal or regulatory requirements. Records need to be maintained so that they are reliable and authentic. In addition, they should be legally disposed of only under an authorized disposition plan. Agencies also need to ensure that records remain accessible and useable to support the primary purposes for which they were created and any predicted secondary purposes for as long as the records must be legally retained. Records designated as 'archival' must be preserved in an accessible and useable form on a continuing basis by the agency or transferred to the relevant archival authority.

System should be administered in line with best practices in the information resource management (IRM) field to ensure the reliability of the records it produces.

Justification: The acceptance of records for legal, audit, and other purposes is contingent on establishing their authenticity and reliability by demonstrating the trustworthiness of the system used to produce them. Systems that produce records must be shown to do so in the normal course of business and in an accurate and timely manner. System administration must incorporate established best practices in the data processing field. Policies, procedures, training and support programs, and controls must be documented.