Skip to main content
This is not an official U.S. federal government website. The Federal Modernization Workbook is independent technical analysis. It does not represent the position of, and has not been reviewed or endorsed by, any federal agency.

Federal Modernization Workbook · Book 13 · How

Chapter 13 — Records, Evidence and Retention

Four things the workbook calls a record (the authoritative technical record, audit evidence, a federal record and operational data) and how they differ; when audit evidence and logs are federal records and which General Records Schedule items commonly apply; disposition authority; legal holds and records freezes, including how to suspend an evidence purge or rotation; transfer at decommissioning; who owns what; how immutable storage interacts with disposition; and a likely records category for each kit’s evidence output.

The program calls three different things a record, and federal law has a fourth meaning that overrides the other three: whatever the scripts write as evidence, how long it lives and when it dies is a records decision, not an engineering default.

NoteIn this chapter

The four things the workbook means by “record”: the authoritative technical record, audit evidence, a federal record and operational data, and how they overlap. When audit evidence and logs are federal records, and the General Records Schedule items that commonly apply to them, checked against the National Archives on November 2, 2026. Disposition authority; legal holds and records freezes, with the steps to suspend an evidence purge or rotation; how immutable (write once, read many) storage interacts with disposition; transfer when a system is decommissioned; and who owns which decision. It closes with a likely records category for each kit’s evidence output, as design guidance to confirm with the agency records officer.

The book has used the word “record” in an architectural sense from the start. Chapter 03 makes the authoritative record the program’s source of truth. Chapter 07 makes the evidence record, produced by systems and chained by hash, the basis for an authorization. The kits now write those evidence records: the Ticket-to-Machine kit’s evidence export, the deployment scripts’ step records, and the drift pipeline’s evidence packages. None of them decides how long its output is kept, who may destroy it, or what happens to it when a lawyer says “keep everything.” Federal records law decides that, and it uses the word “record” in a sense of its own.

This chapter separates the meanings, says where federal records law reaches the program’s evidence, and gives each kit’s output a likely place in the General Records Schedules. Chapter 09 already names the records officer as the owner of the authoritative record’s retention. Book 00, Chapter 10 gives the decommissioning checklist for the directory-era systems, and Book 12, Chapter 10 covers security log retention. This chapter doesn’t repeat them; it covers the evidence the program itself produces.

Four things called a record

Authoritative technical record Audit evidence Federal record Operational data
What it is The governed repository, which holds the authority for each fact and the desired state; the system that owns a fact, such as the HR system of record for employment, holds the fact itself Proof that a control operated: the kits’ hash-chained JSON evidence records, drift reports, manifests, step outputs A legal status: recorded information an agency makes or receives and preserves, or should preserve, as evidence of its activities or for its informational value1 The working content of a running system: directory objects, workflow state, queue messages, caches, telemetry in flight
Defined by Program design (Chapter 03) Program design and the controls it supports (Chapter 07) 44 U.S.C. §3301 and 36 CFR 1220.18 and 1222.10234 The system’s own design
The question it answers Which copy is right? Did the control work, and can anyone re-check it? Must the agency keep it, for how long, and may it be destroyed? What is the system doing now?
Who decides how long it lives The records officer, inside the records schedule; the steward implements it The records officer, through the schedule; the ISSO says what the authorization needs The Archivist approves the schedule; the agency applies it56 The system owner, inside the records schedule that covers the system

The columns aren’t exclusive. “Federal record” isn’t a kind of data; it is a status that the other three can have. The authoritative record’s commit history documents who changed what and who approved it, and evidence bundles document how the agency operated its systems, so both are made and preserved “as evidence of the organization, functions, policies, decisions, procedures, operations, or other activities” of the government, in the statute’s words.7 Operational data can be a federal record too, but it is usually governed by the schedule for the system that holds it: the technology schedules, GRS 3.1 and 3.2, each say they don’t apply to “system data or content.”89

Three consequences follow (design guidance):

  • Treat audit evidence as a federal record by default. It is made to be preserved as evidence of operations, which is the statutory test. NARA’s regulations say that if a clear determination can’t be made, materials should be treated as records.10
  • A copy can be a record. Whether a document is a record “does not depend upon whether it contains unique information,” and duplicates can each have record status depending on how they are used.11 The copy of an evidence package that an ISSO reviews for an authorization decision is not automatically a convenience copy.
  • Unscheduled means permanent. Federal records whose disposition NARA hasn’t approved “must be treated as permanent until a final disposition is approved.”12 A new kind of evidence with no schedule item can’t be deleted on a rotation the engineers chose.

Only two exclusions in the statute matter here: library and reference material, and “duplicate copies of records preserved only for convenience.”13 NARA calls these nonrecord materials, requires agencies to keep them identifiable and segregable from records, and lets them be purged without NARA approval when no longer needed.14 A developer’s local out/ folder, after the package it produced is in the evidence store, is the usual example.

When audit evidence and logs are federal records

Audit evidence and security logs are almost always federal records. The narrower question is which records schedule item covers them, because the item sets the retention period. The Archivist issues the General Records Schedules for records common to several or all agencies, and their disposal authorizations are mandatory.15 An agency can also have its own NARA-approved schedule for records the GRS doesn’t fit.

Two cautions apply before the table. First, the security minimums don’t replace the schedule. OMB M-26-14 sets log retention minimums (searchable for 6 months, retrievable for a year) and says that meeting them “does not relieve agencies of the obligation to comply with other applicable requirements, such as those established by agency-specific or government-wide records schedules.”16 Second, the cybersecurity logging items are being revised. GRS 3.2 items 035 and 036 still cite the rescinded M-21-31, and NARA’s status page lists their revision, for M-21-31’s rescission and M-26-14’s issuance, as “Drafting” in Transmittal 38, as of October 2026.17 Until it is issued, how those two items apply is the records officer’s call.

General Records Schedule items that commonly apply

Each row was read in the current schedule on the National Archives site on November 2, 2026. Which item fits which artifact is the records officer’s decision; the table shows the candidates.

General Records Schedule items that commonly apply to audit evidence and logs, as read on November 2, 20261819202122
GRS item Covers (abridged) Disposition instruction Disposition authority
3.1, item 020 IT operations and maintenance records: asset and configuration management, change management, run reports, error and exception reporting, performance monitoring Temporary. Destroy 3 years after agreement, control measures, procedures, project, activity or transaction is obsolete, completed, terminated or superseded; longer retention authorized for business use DAA-GRS-2013-0005-0004
3.1, item 030 Configuration and change management records, including documents “identifying, requesting, and analyzing possible changes, authorizing changes, and documenting implementation of changes” Temporary. Destroy 5 years after the system is superseded by a new iteration, or is terminated, defunded or no longer needed; longer retention authorized for business use DAA-GRS-2013-0005-0005
3.1, item 040 IT oversight and compliance records: responses to findings and recommendations, reports of follow-up, metrics, vulnerability assessment reports, compliance reviews, data measuring compliance Temporary. Destroy 5 years after the project, activity or transaction is completed or superseded; longer retention authorized for business use DAA-GRS-2013-0005-0010
3.2, item 010 Systems and data security records: system security plans, network vulnerability assessments, risk surveys, service test plans, test files and data Temporary. Destroy 1 year after the system is superseded by a new iteration or when no longer needed for agency/IT administrative purposes DAA-GRS-2013-0006-0001
3.2, item 020 Computer security incident handling, reporting and follow-up records Temporary. Destroy 3 years after all necessary follow-up actions have been completed; longer retention authorized for business use DAA-GRS-2013-0006-0002
3.2, item 030 System access records (user profiles, log-in files, audit trail files and extracts), systems not requiring special accountability for access Temporary. Destroy when business use ceases DAA-GRS-2013-0006-0003
3.2, item 031 System access records, systems requiring special accountability for access Temporary. Destroy 6 years after password is altered or user account is terminated; longer retention authorized for business use DAA-GRS-2013-0006-0004
3.2, item 035 Cybersecurity logging records: full packet capture (legal citation M-21-31; under revision) Temporary. Destroy when 72 hours old; longer retention authorized for business use DAA-GRS-2022-0005-0001
3.2, item 036 Cybersecurity event logs (legal citation M-21-31; under revision) Temporary. Destroy when 30 months old; longer retention authorized for business use DAA-GRS-2022-0005-0002
3.2, items 040 and 041 System backups: incremental and full backup files Temporary. Destroy when superseded (040) or when the second subsequent backup is verified (041), or when no longer needed for restoration, whichever is later DAA-GRS-2013-0006-0005, -0006
4.1, item 020 Records management program records, including “disposal authorizations, schedules, and reports” Temporary. Destroy no sooner than 6 years after the project, activity or transaction is completed or superseded; longer retention authorized for business use DAA-GRS-2013-0002-0007
5.1, item 020 Non-recordkeeping copies of electronic records, kept after the record is in a recordkeeping system Temporary. Destroy immediately after copying to a recordkeeping system or otherwise preserving; longer retention authorized for business use DAA-GRS-2016-0016-0002
5.2, item 010 Transitory records: needed only a short time (generally less than 180 days) and not needed to “provide evidence of decision-making” Temporary. Destroy when no longer needed for business use, or according to an agency predetermined time period or business rule DAA-GRS-2022-0009-0001
5.2, item 020 Intermediary records: exist “for the sole purpose of creating a subsequent record,” including extracted data sets used as source records Temporary. Destroy upon creation or update of the final record, or when no longer needed for business use, whichever is later DAA-GRS-2022-0009-0002

Notes that change how the table is read:

  • The schedules come from different transmittals. GRS 3.1 is from Transmittal 30 (November 2019), GRS 3.2 from Transmittal 33 (January 2023), GRS 4.1 and 5.2 from Transmittal 34 (June 2023) and GRS 5.1 from Transmittal 28 (July 2017). Cite the item and its authority, not the transmittal, in the agency’s directive.
  • Significant incidents need their own schedule. GRS 3.2 item 020 notes that significant incidents “must be documented in program records,” scheduled separately with an SF 115.23 Evidence pulled into an incident investigation may move with it.
  • The transitory and intermediary items exclude evidence of decision-making. Both GRS 5.2 items apply only to records not required “to initiate, sustain, evaluate, or provide evidence of decision-making,” and item 010 excludes data extracts that significantly change the source content.24 A drift report that a go/no-go decision rested on isn’t transitory, however short its life in a pipeline.
  • “Longer retention is authorized if required for business use” appears in most items. It allows an agency to keep evidence longer for an authorization cycle or an audit; it doesn’t allow destruction earlier.

Disposition authority

Every federal record, “including those created or maintained for the Government by a contractor,” must be covered by a NARA-approved agency schedule or the General Records Schedules, and applying an approved schedule is mandatory.2526 Disposition means the actions taken on records no longer needed for current business; a disposition authority is the legal authorization for keeping and disposing of them.27 Three rules matter for evidence:

  • The agency’s directive names the item. Agencies must issue disposition authorities through their internal directives within six months of approval, and the directive “must cite the legal authority (GRS or SF 115 and item numbers) for each schedule item.”28 An record class the program creates should appear in that directive, or in the records officer’s file plan under it, before its first purge.
  • Early disposal is unlawful destruction. NARA defines unlawful or accidental destruction to include disposal of an unscheduled or permanent record, disposal of a temporary record before the end of its approved retention period, and “disposal of a record subject to a FOIA request, litigation hold, or any other hold requirement.”29 Agency heads must report it to NARA, and the statute requires them to notify the Archivist of any actual, impending or threatened unlawful “corruption, deletion, erasure, or other destruction.”3031
  • An agency schedule and a GRS item can both reach the same records. The statute says that, as between the two, “application of the authorization providing for the shorter retention period shall be required,” subject to 44 U.S.C. §2909, under which NARA can also withdraw disposal authority.3233 The records officer resolves that; engineers shouldn’t pick the longer period on their own.

In the program’s design, each record class has a row in a retention register kept in the governed repository: the class, the kits and paths that write it, the GRS or agency item the records officer assigned, the disposition instruction in words, the event that starts the clock, and where the recordkeeping copy lives (design guidance). Purge jobs read the register; they don’t carry their own numbers. That is the same rule Book 12, Chapter 12 applies to log tables, and it keeps a retention change a governed edit (Chapter 04) rather than a script change.

Immutable storage and disposition

The program writes evidence once and keeps it in storage that can’t be changed or deleted until a retention interval ends: in the drift pipeline’s design, a container with a locked time-based retention policy (Book 19, Chapter 09 covers the platform settings). That serves records law well. NARA requires controls for electronic records that protect authenticity “against unauthorized addition, deletion, alteration, use, and concealment,” and integrity through audit trails that keep records “complete and unaltered.”41 Write-once storage and the hash chain from Chapter 07 provide both. It also interacts with disposition in five ways the records officer should hear about before the lock is set (design guidance):

  • A lock longer than the schedule blocks lawful destruction. Most items in the table allow longer retention for business use, so over-retention is usually permitted. It isn’t when a statute requires disposal or when the Privacy Act’s relevance test applies, and after a temporary extension ends the agency “must destroy” the records.42 Book 19, Chapter 09 notes that the drift pipeline’s locked policy can’t be shortened, so set the lock to the shortest period the schedule certainly requires, and extend it when needed.
  • A lock shorter than the schedule ends protection early. When the interval ends, the blob becomes deletable. Disposition still runs from the register, not from the lock’s expiry; a clean-up rule keyed to the lock would destroy temporary records early, which is unlawful destruction.43
  • A retention lock isn’t a hold. It runs out on its own date whatever is pending. Holds are applied separately, as in the steps above.
  • Storage isn’t a recordkeeping system on its own. NARA lists the functions electronic recordkeeping needs: declare, capture, organize (associate each record “with an approved records schedule and disposition instruction”), maintain security, manage access, preserve, and execute disposition, including holds.44 Immutable storage supplies one of them. The manifest, the retention register and the hold records supply most of the rest; the records officer decides whether the combination meets the agency’s recordkeeping requirements.
  • Backups don’t count. “System and file backup processes and media do not provide the appropriate recordkeeping functionalities and must not be used as the agency electronic recordkeeping system.”45 A snapshot of the evidence store is a backup under GRS 3.2 items 040 and 041, not a second recordkeeping copy.46

Transfer at decommissioning

Evidence often outlives the system that produced it. A configuration and change record under GRS 3.1 item 030 runs five years from the day the system is superseded or terminated, and a special-accountability access record under GRS 3.2 item 031 runs six years from the account’s termination.4748 Book 00, Chapter 10 gives the checklist for retiring the directory-era systems. For the program’s own evidence, the same rules add four points:

  • Plan the migration before the retirement. Agencies must determine whether the approved retention period is longer than the life of the system holding the records and, “If so, plan for the migration of the records to a new system before the current system is retired,” keeping the link between records and their metadata, and capturing metadata “for both the records and the migration process.”49 For evidence, the metadata includes the manifests, the chain heads and the retention register rows.
  • Keep the means to verify. A hash-chained package is only useful if someone can still recompute the chain. Records must be “located, retrieved, presented, and interpreted” for their whole retention period,50 so the verify commands (evidence_export.py --verify-dir, drift_pipeline.py verify, step_evidence.py --verify), or a documented equivalent such as sha256sum -c, are kept with the evidence store (design guidance).
  • Transfer permanent records to NARA. Permanent records are transferred when the schedule says or after 30 years, in electronic form with appropriate metadata since June 30, 2024, and with the documentation NARA’s transfer rules require.5152 None of the GRS items above is permanent; if the records officer finds evidence that is, or an agency schedule makes it so, it goes to NARA rather than to destruction.
  • File the disposition record. What was migrated, transferred or destroyed, under which item and on whose approval, goes to the records officer and into the G4 or G5 evidence packet, as step 9 of Book 00’s checklist says.

Who owns what

Chapter 09 assigns the authoritative record’s retention to the records officer, and Book 12, Chapter 10 does the same for security logs. The program applies the same split to its evidence. The records officer’s authority comes from regulation: agencies must assign records management responsibility “to a person and office with appropriate authority,” assign records responsibilities in each program area, and build records requirements into the design of electronic systems.53 The other rows are design guidance.

Role Owns Decides Doesn’t decide
Records officer The retention register’s legal column; the agency’s directive and file plan Which GRS or agency item covers each record class; when a class needs a new schedule; temporary extensions and NARA requests; whether evidence is permanent; destruction approvals What an authorization package must contain
ISSO What evidence the system’s authorization and continuous monitoring need The minimum the security documentation needs kept, for the authorizing official; whether a package is complete and verifies; when to escalate a gap The retention period, which can be longer than security needs but not shorter than the schedule
System owner The system that produces the evidence and its storage How the system implements the register: storage, locks, lifecycle rules, purge jobs that read the register and the holds Which schedule item applies, or whether to delete early
Steward The governed repository: the register, hold records, change history That every retention or hold change goes through the change path (Chapter 04) Retention values
Counsel and the FOIA office Holds for litigation and requests When a hold starts, its scope and when it is released How the hold is carried out in each system

The handoffs are where evidence is usually lost: a storage engineer shortens a retention interval to save cost, or an expiry rule nobody listed keeps deleting during a hold. Both are prevented by the same rule: retention numbers and holds live in the governed repository, and systems read them.

Each kit’s evidence output

The table maps each kit’s evidence output to a likely records category. The categorization is design guidance, not a records determination. Confirm each row with the agency records officer, who may assign a different GRS item or an agency schedule item, and record the result in the retention register before any of it is purged.

Each kit’s evidence output and a likely records category — design guidance, to confirm with the agency records officer
Kit Evidence output Likely records category (design guidance) Confirm with the records officer
Ticket-to-Machine (examples/servicenow-sailpoint), clients/python/evidence_export.py Per period: records.jsonl (one hash-chained record per closed identity finding), summary.json, manifest.json GRS 3.1 item 040: responses to findings, follow-up and compliance metrics Whether findings about specific accounts are system access records under GRS 3.2 item 030 or 031 instead; when the clock starts (period closed, or finding closed)
Ticket-to-Machine, deploy/ scripts Per stage, out/evidence/<stage>/: preflight, smoke test and rollback outputs, the workflows as deployed, and steps.jsonl, the hash-chained step log GRS 3.1 item 030: authorizing and documenting implementation of changes Whether the test-stage evidence (synthetic workers) is GRS 3.2 item 010 test files and data; that the 5-year clock runs from the system’s retirement, not the deployment
Deploy evidence in the other kits (examples/*/deploy, as each kit adds it) One evidence record per scripted runbook step, with the controls it supports, the hash of its output and the hash of the record before it GRS 3.1 item 030, as above The same as above; for privileged access steps, whether any record is a GRS 3.2 item 031 access record
Drift pipeline (examples/drift-pipeline), drift_pipeline.py package Per run: the validation kit run, drift-report.json, provenance from the other kits, EVIDENCE-MANIFEST.json, SHA256SUMS, in the immutable container GRS 3.1 item 040 (compliance reviews, vulnerability assessment reports) or GRS 3.2 item 010 (network vulnerability assessments, risk surveys) Which of the two; whether daily packages that only feed a monthly summary could be intermediary records (GRS 5.2 item 020), given that the exclusion for evidence of decision-making likely applies
Drift pipeline, hr_evidence.py, pa_evidence.py, npi_evidence.py Run packages and period assemblies for the HR lifecycle, privileged access and non-person identity kits GRS 3.1 item 040; for privileged access audit content, GRS 3.2 item 031 Whether person keys in HR evidence bring a system of records notice into play; the 6-year clock for item 031 runs per account, which a period package doesn’t track
Drift pipeline, workflow hand-off artifact and drafted issues drift-report.json kept as a pipeline artifact for 7 days; issue drafts GRS 5.2 item 020 for the artifact, once the package in the container holds the same report Whether the issues themselves, as the finding record, follow GRS 3.1 item 040
Validation kit, HCM-to-Entra, machine configuration, dynamic rules ValidationResults.json with ValidationManifest.json; provenance.json; check-results.json Inputs to the drift package; standalone copies are likely GRS 5.1 item 020 once the package is stored Which copy is the recordkeeping copy, and that it is the one in the evidence store
Any kit, local runs Working folders under out/ on a workstation or runner Nonrecord convenience copies, or GRS 5.1 item 020, after the package is stored That the agency’s recordkeeping requirements identify them as such and that they’re segregable from records54

Two things are the same for every row. Security logs that the same runs send to the SIEM are covered by Book 12, Chapter 10 and GRS 3.2 items 030, 031 and 036, with 036 under revision. And none of the kits writes a retention or hold check today; the purge jobs and storage settings that need one belong to the system owner, under the register.

External partner persons add four evidence items to the same register, each confirmed with the records officer like the rows above: drift findings on the partner configuration and the partner list, the record of each suspension, the record of each termination, and the approval for each partner guest (who approved, the named sponsor, the expiry). The partner list is reconciled against the per-partner record, and the readiness checks and their evidence are in Book 03, Chapter 15.

TipContinue the book

← Previous: Chapter 12 — Governance at Scale and the Continuous-Monitoring Program · Book index · Next: Chapter 14 — Applications, Secrets and Configuration Drift →

  1. 44 U.S.C. §3301, “Definition of records,” subsections (a)(1)(A), (a)(1)(B) and (b), United States Code, 2023 edition, https://www.govinfo.gov/content/pkg/USCODE-2023-title44/html/USCODE-2023-title44-chap33-sec3301.htm (accessed Nov 2, 2026).↩︎

  2. 44 U.S.C. §3301, “Definition of records,” subsections (a)(1)(A), (a)(1)(B) and (b), United States Code, 2023 edition, https://www.govinfo.gov/content/pkg/USCODE-2023-title44/html/USCODE-2023-title44-chap33-sec3301.htm (accessed Nov 2, 2026).↩︎

  3. 36 CFR 1220.18 (definitions of disposition, disposition authority, records, temporary record and unscheduled records) and 1220.34(a), (d) and (e), https://www.ecfr.gov/current/title-36/chapter-XII/subchapter-B/part-1220 (accessed Nov 2, 2026).↩︎

  4. 36 CFR 1222.10(b), 1222.12(d) (“Record status of copies”), 1222.14(b) and 1222.16(b)(1)–(3), https://www.ecfr.gov/current/title-36/chapter-XII/subchapter-B/part-1222 (accessed Nov 2, 2026).↩︎

  5. 44 U.S.C. §3303a, subsections (b) (authorizations mandatory; the shorter retention period applies as between an agency schedule and a General Records Schedule, subject to §2909) and (d) (schedules for records common to several or all agencies), United States Code, 2023 edition, https://www.govinfo.gov/content/pkg/USCODE-2023-title44/html/USCODE-2023-title44-chap33-sec3303a.htm (accessed Nov 2, 2026).↩︎

  6. 36 CFR 1226.10 (schedules mandatory), 1226.12(a) (directive cites the GRS or SF 115 item), 1226.16 (NARA withdrawal of disposal authority), 1226.18(a)–(c) (temporary extension, Privacy Act consistency, destruction when circumstances elapse) and 1226.20(a) (when NARA written approval is needed), https://www.ecfr.gov/current/title-36/chapter-XII/subchapter-B/part-1226 (accessed Nov 2, 2026).↩︎

  7. 44 U.S.C. §3301, “Definition of records,” subsections (a)(1)(A), (a)(1)(B) and (b), United States Code, 2023 edition, https://www.govinfo.gov/content/pkg/USCODE-2023-title44/html/USCODE-2023-title44-chap33-sec3301.htm (accessed Nov 2, 2026).↩︎

  8. National Archives and Records Administration, General Records Schedule 3.1, General Technology Management Records, Transmittal No. 30, November 2019, introduction (“This schedule does not apply to system data or content”) and items 020, 030 and 040, https://www.archives.gov/files/records-mgmt/grs/grs03-1.pdf (accessed Nov 2, 2026).↩︎

  9. National Archives and Records Administration, General Records Schedule 3.2, Information Systems Security Records, Transmittal No. 33, January 2023, introduction and items 010, 020 (with its note on significant incidents), 030, 031, 035, 036, 040 and 041, https://www.archives.gov/files/records-mgmt/grs/grs03-2.pdf (accessed Nov 2, 2026).↩︎

  10. 36 CFR 1222.10(b), 1222.12(d) (“Record status of copies”), 1222.14(b) and 1222.16(b)(1)–(3), https://www.ecfr.gov/current/title-36/chapter-XII/subchapter-B/part-1222 (accessed Nov 2, 2026).↩︎

  11. 36 CFR 1222.10(b), 1222.12(d) (“Record status of copies”), 1222.14(b) and 1222.16(b)(1)–(3), https://www.ecfr.gov/current/title-36/chapter-XII/subchapter-B/part-1222 (accessed Nov 2, 2026).↩︎

  12. 36 CFR 1220.18 (definitions of disposition, disposition authority, records, temporary record and unscheduled records) and 1220.34(a), (d) and (e), https://www.ecfr.gov/current/title-36/chapter-XII/subchapter-B/part-1220 (accessed Nov 2, 2026).↩︎

  13. 44 U.S.C. §3301, “Definition of records,” subsections (a)(1)(A), (a)(1)(B) and (b), United States Code, 2023 edition, https://www.govinfo.gov/content/pkg/USCODE-2023-title44/html/USCODE-2023-title44-chap33-sec3301.htm (accessed Nov 2, 2026).↩︎

  14. 36 CFR 1222.10(b), 1222.12(d) (“Record status of copies”), 1222.14(b) and 1222.16(b)(1)–(3), https://www.ecfr.gov/current/title-36/chapter-XII/subchapter-B/part-1222 (accessed Nov 2, 2026).↩︎

  15. 44 U.S.C. §3303a, subsections (b) (authorizations mandatory; the shorter retention period applies as between an agency schedule and a General Records Schedule, subject to §2909) and (d) (schedules for records common to several or all agencies), United States Code, 2023 edition, https://www.govinfo.gov/content/pkg/USCODE-2023-title44/html/USCODE-2023-title44-chap33-sec3303a.htm (accessed Nov 2, 2026).↩︎

  16. Office of Management and Budget, M-26-14, Ensuring Effective and Efficient Agency Logging and Network Visibility to Defend Against Evolving Cyber Threats, May 22, 2026, Appendix B, item 1, https://www.whitehouse.gov/wp-content/uploads/2026/05/M-26-14-Ensuring-Effective-and-Efficient-Agency-Logging-and-Network-Visibility-to-Defend-Against-Evolving-Cyber-Threats.pdf (accessed Nov 2, 2026).↩︎

  17. National Archives and Records Administration, “GRS Status Updates” (as of October 2026; page last reviewed October 20, 2026), GRS Transmittal 38: “GRS 3.2, Information Systems Security Records — Revision to items 035-036 (related to rescission of OMB Memo M-21-31 and issuance of OMB M-26-14) — Drafting,” https://www.archives.gov/records-mgmt/grs/grs-status-updates (accessed Nov 2, 2026).↩︎

  18. National Archives and Records Administration, General Records Schedule 3.1, General Technology Management Records, Transmittal No. 30, November 2019, introduction (“This schedule does not apply to system data or content”) and items 020, 030 and 040, https://www.archives.gov/files/records-mgmt/grs/grs03-1.pdf (accessed Nov 2, 2026).↩︎

  19. National Archives and Records Administration, General Records Schedule 3.2, Information Systems Security Records, Transmittal No. 33, January 2023, introduction and items 010, 020 (with its note on significant incidents), 030, 031, 035, 036, 040 and 041, https://www.archives.gov/files/records-mgmt/grs/grs03-2.pdf (accessed Nov 2, 2026).↩︎

  20. National Archives and Records Administration, General Records Schedule 4.1, Records Management Records, Transmittal No. 34, June 2023, item 020, https://www.archives.gov/files/records-mgmt/grs/grs04-1.pdf (accessed Nov 2, 2026).↩︎

  21. National Archives and Records Administration, General Records Schedule 5.1, Common Office Records, Transmittal No. 28, July 2017, item 020 and its Note 1, https://www.archives.gov/files/records-mgmt/grs/grs05-1.pdf (accessed Nov 2, 2026).↩︎

  22. National Archives and Records Administration, General Records Schedule 5.2, Transitory and Intermediary Records, Transmittal No. 34, June 2023, items 010 and 020 with their exclusions, https://www.archives.gov/files/records-mgmt/grs/grs05-2.pdf (accessed Nov 2, 2026).↩︎

  23. National Archives and Records Administration, General Records Schedule 3.2, Information Systems Security Records, Transmittal No. 33, January 2023, introduction and items 010, 020 (with its note on significant incidents), 030, 031, 035, 036, 040 and 041, https://www.archives.gov/files/records-mgmt/grs/grs03-2.pdf (accessed Nov 2, 2026).↩︎

  24. National Archives and Records Administration, General Records Schedule 5.2, Transitory and Intermediary Records, Transmittal No. 34, June 2023, items 010 and 020 with their exclusions, https://www.archives.gov/files/records-mgmt/grs/grs05-2.pdf (accessed Nov 2, 2026).↩︎

  25. 36 CFR 1225.10, https://www.ecfr.gov/current/title-36/chapter-XII/subchapter-B/part-1225 (accessed Nov 2, 2026).↩︎

  26. 36 CFR 1226.10 (schedules mandatory), 1226.12(a) (directive cites the GRS or SF 115 item), 1226.16 (NARA withdrawal of disposal authority), 1226.18(a)–(c) (temporary extension, Privacy Act consistency, destruction when circumstances elapse) and 1226.20(a) (when NARA written approval is needed), https://www.ecfr.gov/current/title-36/chapter-XII/subchapter-B/part-1226 (accessed Nov 2, 2026).↩︎

  27. 36 CFR 1220.18 (definitions of disposition, disposition authority, records, temporary record and unscheduled records) and 1220.34(a), (d) and (e), https://www.ecfr.gov/current/title-36/chapter-XII/subchapter-B/part-1220 (accessed Nov 2, 2026).↩︎

  28. 36 CFR 1226.10 (schedules mandatory), 1226.12(a) (directive cites the GRS or SF 115 item), 1226.16 (NARA withdrawal of disposal authority), 1226.18(a)–(c) (temporary extension, Privacy Act consistency, destruction when circumstances elapse) and 1226.20(a) (when NARA written approval is needed), https://www.ecfr.gov/current/title-36/chapter-XII/subchapter-B/part-1226 (accessed Nov 2, 2026).↩︎

  29. 36 CFR 1230.3(b) (definition of unlawful or accidental destruction), 1230.10 and 1230.14 (reporting to NARA), https://www.ecfr.gov/current/title-36/chapter-XII/subchapter-B/part-1230 (accessed Nov 2, 2026).↩︎

  30. 36 CFR 1230.3(b) (definition of unlawful or accidental destruction), 1230.10 and 1230.14 (reporting to NARA), https://www.ecfr.gov/current/title-36/chapter-XII/subchapter-B/part-1230 (accessed Nov 2, 2026).↩︎

  31. 44 U.S.C. §3106(a), “Unlawful removal, destruction of records,” United States Code, 2023 edition, https://www.govinfo.gov/content/pkg/USCODE-2023-title44/html/USCODE-2023-title44-chap31-sec3106.htm (accessed Nov 2, 2026).↩︎

  32. 44 U.S.C. §3303a, subsections (b) (authorizations mandatory; the shorter retention period applies as between an agency schedule and a General Records Schedule, subject to §2909) and (d) (schedules for records common to several or all agencies), United States Code, 2023 edition, https://www.govinfo.gov/content/pkg/USCODE-2023-title44/html/USCODE-2023-title44-chap33-sec3303a.htm (accessed Nov 2, 2026).↩︎

  33. 36 CFR 1226.10 (schedules mandatory), 1226.12(a) (directive cites the GRS or SF 115 item), 1226.16 (NARA withdrawal of disposal authority), 1226.18(a)–(c) (temporary extension, Privacy Act consistency, destruction when circumstances elapse) and 1226.20(a) (when NARA written approval is needed), https://www.ecfr.gov/current/title-36/chapter-XII/subchapter-B/part-1226 (accessed Nov 2, 2026).↩︎

  34. 36 CFR 1230.3(b) (definition of unlawful or accidental destruction), 1230.10 and 1230.14 (reporting to NARA), https://www.ecfr.gov/current/title-36/chapter-XII/subchapter-B/part-1230 (accessed Nov 2, 2026).↩︎

  35. 36 CFR 1236.10(b)–(d) (authenticity, integrity, usability controls), 1236.14(a) and (b)(3) (migration before retirement; records and metadata), 1236.20(b) (electronic recordkeeping functionalities, including (3) organize and (7) execute disposition, “Apply records hold or freeze on disposition when required”) and 1236.20(c) (backup systems), https://www.ecfr.gov/current/title-36/chapter-XII/subchapter-B/part-1236 (accessed Nov 2, 2026).↩︎

  36. 36 CFR 1226.10 (schedules mandatory), 1226.12(a) (directive cites the GRS or SF 115 item), 1226.16 (NARA withdrawal of disposal authority), 1226.18(a)–(c) (temporary extension, Privacy Act consistency, destruction when circumstances elapse) and 1226.20(a) (when NARA written approval is needed), https://www.ecfr.gov/current/title-36/chapter-XII/subchapter-B/part-1226 (accessed Nov 2, 2026).↩︎

  37. 36 CFR 1226.10 (schedules mandatory), 1226.12(a) (directive cites the GRS or SF 115 item), 1226.16 (NARA withdrawal of disposal authority), 1226.18(a)–(c) (temporary extension, Privacy Act consistency, destruction when circumstances elapse) and 1226.20(a) (when NARA written approval is needed), https://www.ecfr.gov/current/title-36/chapter-XII/subchapter-B/part-1226 (accessed Nov 2, 2026).↩︎

  38. 36 CFR 1226.10 (schedules mandatory), 1226.12(a) (directive cites the GRS or SF 115 item), 1226.16 (NARA withdrawal of disposal authority), 1226.18(a)–(c) (temporary extension, Privacy Act consistency, destruction when circumstances elapse) and 1226.20(a) (when NARA written approval is needed), https://www.ecfr.gov/current/title-36/chapter-XII/subchapter-B/part-1226 (accessed Nov 2, 2026).↩︎

  39. National Archives and Records Administration, General Records Schedule 4.1, Records Management Records, Transmittal No. 34, June 2023, item 020, https://www.archives.gov/files/records-mgmt/grs/grs04-1.pdf (accessed Nov 2, 2026).↩︎

  40. 36 CFR 1226.10 (schedules mandatory), 1226.12(a) (directive cites the GRS or SF 115 item), 1226.16 (NARA withdrawal of disposal authority), 1226.18(a)–(c) (temporary extension, Privacy Act consistency, destruction when circumstances elapse) and 1226.20(a) (when NARA written approval is needed), https://www.ecfr.gov/current/title-36/chapter-XII/subchapter-B/part-1226 (accessed Nov 2, 2026).↩︎

  41. 36 CFR 1236.10(b)–(d) (authenticity, integrity, usability controls), 1236.14(a) and (b)(3) (migration before retirement; records and metadata), 1236.20(b) (electronic recordkeeping functionalities, including (3) organize and (7) execute disposition, “Apply records hold or freeze on disposition when required”) and 1236.20(c) (backup systems), https://www.ecfr.gov/current/title-36/chapter-XII/subchapter-B/part-1236 (accessed Nov 2, 2026).↩︎

  42. 36 CFR 1226.10 (schedules mandatory), 1226.12(a) (directive cites the GRS or SF 115 item), 1226.16 (NARA withdrawal of disposal authority), 1226.18(a)–(c) (temporary extension, Privacy Act consistency, destruction when circumstances elapse) and 1226.20(a) (when NARA written approval is needed), https://www.ecfr.gov/current/title-36/chapter-XII/subchapter-B/part-1226 (accessed Nov 2, 2026).↩︎

  43. 36 CFR 1230.3(b) (definition of unlawful or accidental destruction), 1230.10 and 1230.14 (reporting to NARA), https://www.ecfr.gov/current/title-36/chapter-XII/subchapter-B/part-1230 (accessed Nov 2, 2026).↩︎

  44. 36 CFR 1236.10(b)–(d) (authenticity, integrity, usability controls), 1236.14(a) and (b)(3) (migration before retirement; records and metadata), 1236.20(b) (electronic recordkeeping functionalities, including (3) organize and (7) execute disposition, “Apply records hold or freeze on disposition when required”) and 1236.20(c) (backup systems), https://www.ecfr.gov/current/title-36/chapter-XII/subchapter-B/part-1236 (accessed Nov 2, 2026).↩︎

  45. 36 CFR 1236.10(b)–(d) (authenticity, integrity, usability controls), 1236.14(a) and (b)(3) (migration before retirement; records and metadata), 1236.20(b) (electronic recordkeeping functionalities, including (3) organize and (7) execute disposition, “Apply records hold or freeze on disposition when required”) and 1236.20(c) (backup systems), https://www.ecfr.gov/current/title-36/chapter-XII/subchapter-B/part-1236 (accessed Nov 2, 2026).↩︎

  46. National Archives and Records Administration, General Records Schedule 3.2, Information Systems Security Records, Transmittal No. 33, January 2023, introduction and items 010, 020 (with its note on significant incidents), 030, 031, 035, 036, 040 and 041, https://www.archives.gov/files/records-mgmt/grs/grs03-2.pdf (accessed Nov 2, 2026).↩︎

  47. National Archives and Records Administration, General Records Schedule 3.1, General Technology Management Records, Transmittal No. 30, November 2019, introduction (“This schedule does not apply to system data or content”) and items 020, 030 and 040, https://www.archives.gov/files/records-mgmt/grs/grs03-1.pdf (accessed Nov 2, 2026).↩︎

  48. National Archives and Records Administration, General Records Schedule 3.2, Information Systems Security Records, Transmittal No. 33, January 2023, introduction and items 010, 020 (with its note on significant incidents), 030, 031, 035, 036, 040 and 041, https://www.archives.gov/files/records-mgmt/grs/grs03-2.pdf (accessed Nov 2, 2026).↩︎

  49. 36 CFR 1236.10(b)–(d) (authenticity, integrity, usability controls), 1236.14(a) and (b)(3) (migration before retirement; records and metadata), 1236.20(b) (electronic recordkeeping functionalities, including (3) organize and (7) execute disposition, “Apply records hold or freeze on disposition when required”) and 1236.20(c) (backup systems), https://www.ecfr.gov/current/title-36/chapter-XII/subchapter-B/part-1236 (accessed Nov 2, 2026).↩︎

  50. 36 CFR 1236.10(b)–(d) (authenticity, integrity, usability controls), 1236.14(a) and (b)(3) (migration before retirement; records and metadata), 1236.20(b) (electronic recordkeeping functionalities, including (3) organize and (7) execute disposition, “Apply records hold or freeze on disposition when required”) and 1236.20(c) (backup systems), https://www.ecfr.gov/current/title-36/chapter-XII/subchapter-B/part-1236 (accessed Nov 2, 2026).↩︎

  51. 36 CFR 1235.12 (when permanent records are transferred) and 1235.48 (documentation transferred with electronic records), https://www.ecfr.gov/current/title-36/chapter-XII/subchapter-B/part-1235 (accessed Nov 2, 2026).↩︎

  52. Office of Management and Budget and National Archives and Records Administration, M-23-07, Update to Transition to Electronic Records, December 23, 2022, §1.2, https://www.archives.gov/files/records-mgmt/policy/m-23-07.pdf (accessed Nov 2, 2026).↩︎

  53. 36 CFR 1220.18 (definitions of disposition, disposition authority, records, temporary record and unscheduled records) and 1220.34(a), (d) and (e), https://www.ecfr.gov/current/title-36/chapter-XII/subchapter-B/part-1220 (accessed Nov 2, 2026).↩︎

  54. 36 CFR 1222.10(b), 1222.12(d) (“Record status of copies”), 1222.14(b) and 1222.16(b)(1)–(3), https://www.ecfr.gov/current/title-36/chapter-XII/subchapter-B/part-1222 (accessed Nov 2, 2026).↩︎

Back to top