NVRA CM Certified Master cheat sheet

A records management program charter must define scope, authority, reporting line, budget, and the accountable executive; without a named owner the program has no enforceable authority.

The records management policy is the top-tier document; standards, procedures, and work instructions sit beneath it and must trace upward to a policy clause.

ISO 15489-1 defines records as information created, received, and maintained as evidence and information by an organization in pursuance of legal obligations or in the transaction of business.

The records manager owns the schedule and policy; the legal department owns privilege and litigation decisions; IT owns infrastructure; business units own content accuracy. Overlap without written assignment is the most common governance failure.

A records and information management steering committee should include legal, IT, compliance, business operations, and privacy, and should meet on a fixed cadence with documented minutes.

Compliance monitoring requires periodic audits with sampling, a findings log, corrective action tracking, and escalation thresholds defined in advance.

Key performance indicators include percentage of records under an approved retention rule, disposition backlog, training completion rate, and legal hold acknowledgement turnaround.

A records management gap assessment compares current state against a control framework (for example ISO 15489 or ARMA's Generally Accepted Recordkeeping Principles) and produces a prioritized remediation plan.

Generally Accepted Recordkeeping Principles: accountability, transparency, integrity, protection, compliance, availability, retention, and disposition.

A retention schedule states, per record series, the retention period, the trigger event that starts the clock, the disposition action, and the authority cited.

The retention trigger is the event that starts the clock (creation, supersession, contract termination, employee separation), not the calendar year, unless the schedule explicitly says so.

Retention periods are usually set to the longer of the operational need and the legal or regulatory minimum; conflicts resolve to the longest applicable period.

Legal hold suspends disposition for identified records and custodians; it overrides the schedule and must be documented with scope, date, issuing authority, and release approval.

A defensible disposition process requires documented approval, a certificate of destruction, and an audit trail linking the destroyed series to the schedule.

Spoliation is the destruction or alteration of evidence relevant to reasonably anticipated litigation; the duty to preserve can attach before a complaint is filed.

Hold release requires written confirmation from counsel that the matter is closed and that no appeal, audit, or related matter keeps the hold alive.

Retention of records subject to a hold must be tracked separately from routine retention so that a schedule update does not silently purge held content.

Disposition methods include secure destruction, transfer to an archive, transfer to a successor organization, and return to the record owner; each must be recorded.

Electronic records must satisfy the same authenticity, reliability, integrity, and usability requirements as paper; the medium does not change the evidentiary standard.

Metadata is part of the record: creation date, author, version, classification, retention rule, and disposition status must persist with the content.

A system of record is the authoritative source for a given data element; when multiple systems hold copies, the system of record must be designated in writing.

Migration between systems requires validation that content, metadata, links, and audit trails survive intact, with a documented pre- and post-migration comparison.

Audit trails must be tamper-evident, time-stamped, and retained for the life of the record plus any applicable hold period.

Data governance assigns ownership of data quality, definitions, and access; records management governs lifecycle and disposition. Both are needed and neither substitutes for the other.

Cloud and SaaS records remain the organization's responsibility; contracts must address export format, deletion certification, subpoena cooperation, and data location.

Classification schemes (taxonomy and file plan) must map business functions to record series so retention rules can be applied automatically.

Digitization that substitutes for originals requires a documented imaging standard, quality control sampling, and a legal admissibility assessment before originals are destroyed.

Classify records by sensitivity (public, internal, confidential, restricted) and tie each level to handling, storage, transmission, and destruction rules.

Apply least privilege and role-based access; access rights must be reviewed on a defined cycle and revoked at separation.

Personal information retention must be limited to what is necessary for the stated purpose; privacy law generally requires deletion when the purpose is exhausted, subject to legal retention obligations.

A privacy impact assessment is required before a new system or process collects personal information, and it should document purpose, data elements, retention, and access.

Breach response requires detection, containment, assessment, notification per applicable law, and a post-incident review with corrective actions.

Encryption at rest and in transit, plus key management, protects confidentiality; encryption does not satisfy retention or disposition obligations by itself.

Confidential destruction requires cross-cut shredding, pulping, or certified digital wiping; certificates of destruction should name the method and date.

Third-party processors must be bound by contract to confidentiality, security controls, breach notification timelines, and return or destruction of records at termination.

Storage environments must meet environmental specifications: temperature, relative humidity, light exposure, and pollutant control, with monitoring logs retained.

Media have finite life; magnetic and optical media require scheduled refresh or migration before the manufacturer's rated life expires.

Backup is not archiving: backups are for recovery and are typically short-cycle, while archival copies preserve records for their full retention period.

Conversion projects require a documented standard, a sampling QC rate, an exception log, and a decision on whether originals are retained or destroyed.

Chain of custody documentation tracks records from creation through storage, retrieval, transfer, and destruction, and is essential for evidentiary purposes.

Offsite storage contracts must specify retrieval turnaround, environmental controls, inventory reporting, and destruction authorization procedures.

Legacy media retirement requires reading the media, verifying content, migrating to the target format, validating, and only then destroying the source.

Inventory reconciliation between the records management system and physical or cloud storage should occur on a defined cycle with discrepancies resolved and logged.

Vital records are those essential to continue operations and protect legal and financial rights during and after a disruption; they are a subset of all records.

Vital records protection methods: dispersal (duplicate copies at another location), duplication (backup copy), and protected storage (vault or hardened facility).

A business impact analysis identifies critical functions, their dependencies, recovery time objectives, and recovery point objectives; vital records are selected from its results.

Recovery time objective is the maximum acceptable downtime; recovery point objective is the maximum acceptable data loss measured in time.

Vital records inventories must be reviewed and updated on a schedule and after major organizational change.

Business continuity and disaster recovery plans must be tested on a defined cadence, with results documented and corrective actions tracked.

Vital records programs must include succession for the records manager role, since unavailability of the program owner is itself a continuity risk.

Emergency response procedures for records should address salvage priorities, water and fire damage response, and vendor call-out contacts.

A records management project charter should state scope, objectives, deliverables, stakeholders, budget, timeline, and success measures before work begins.

Work breakdown structure decomposes the project into deliverables; for records projects, typical workstreams are inventory, schedule development, policy, training, and system implementation.

Stakeholder analysis maps influence against interest to determine engagement strategy; legal and IT are typically high-influence stakeholders.

Change readiness depends on awareness, desire, knowledge, ability, and reinforcement; training alone addresses only knowledge and ability.

Adoption metrics for records programs include classification compliance rate, on-time disposition rate, and help desk ticket volume by category.

Resistance is commonly rooted in perceived workload increase or loss of local control; mitigation is to show the operational benefit and to reduce steps in the workflow.

Pilot before enterprise rollout: a pilot on one business unit surfaces workflow gaps at low cost and generates internal advocates.

Project closure requires handover of ownership to operations, documentation of lessons learned, and confirmation that benefits are measurable.

Accountability is the Generally Accepted Recordkeeping Principles element that requires a senior executive to be responsible for the program.

The records management policy hierarchy runs policy, then standard, then procedure, then work instruction; each lower document must trace to a higher one.

An audit finding requires a documented corrective action with an owner and a due date; open findings must be reported to the steering committee.

Program performance measures should include coverage of records under an approved retention rule and the volume of overdue disposition.

Compliance obligations come from statute, regulation, contract, and internal policy; the schedule should cite the specific authority for each series.

A retention schedule entry must specify the record series, the retention period, the trigger event, the disposition action, and the legal authority.

When two retention requirements conflict, the longer period controls until the conflict is formally resolved in the schedule.

A legal hold must be issued in writing, tracked by matter, acknowledged by custodians, and released only on written counsel approval.

Defensible disposition requires documented approval, an audit trail, and a certificate of destruction for each disposed series.

Spoliation risk arises when records are destroyed after litigation is reasonably anticipated, even before a formal complaint is filed.

Metadata that must persist with an electronic record includes creator, creation date, version, classification, and retention rule.

A system of record must be designated in writing for each data element when multiple systems hold copies.

System migration requires pre- and post-migration validation of content, metadata, links, and audit trails.

Audit trails must be tamper-evident and retained for the life of the record plus any hold period.

Cloud records remain the organization's responsibility; contracts must cover export format, deletion certification, and subpoena cooperation.

Sensitivity tiers (public, internal, confidential, restricted) must each have defined handling, storage, transmission, and destruction rules.

Access follows least privilege and role-based assignment, with periodic review and revocation at separation.

Personal information may be kept only as long as necessary for the stated purpose, subject to overriding legal retention obligations.

A privacy impact assessment precedes any new collection of personal information and documents purpose, elements, retention, and access.

Confidential destruction requires a named method (cross-cut shred, pulp, certified wipe) and a certificate recording method and date.

Storage areas require monitored temperature, relative humidity, light, and pollutant control with retained monitoring logs.

Magnetic and optical media must be refreshed or migrated before the manufacturer's rated life expires.

Backups serve recovery and are short-cycle; archival copies preserve records for the full retention period and are not interchangeable.

Conversion projects require a documented standard, a defined QC sampling rate, an exception log, and a decision on retaining originals.

Chain of custody documentation must cover creation, storage, retrieval, transfer, and destruction of records.

Vital records are the subset of records essential to continue operations and protect legal and financial rights during a disruption.

Vital records protection methods are dispersal, duplication, and protected storage.

Recovery time objective is maximum acceptable downtime; recovery point objective is maximum acceptable data loss measured in time.

A business impact analysis identifies critical functions and their dependencies, and from it the vital records are selected.

Continuity and disaster recovery plans must be tested on a defined cadence with documented results and tracked corrective actions.

A project charter must state scope, objectives, deliverables, stakeholders, budget, timeline, and success measures before work starts.

A work breakdown structure decomposes deliverables; typical records workstreams are inventory, schedule, policy, training, and system.

Stakeholder analysis maps influence against interest to set engagement strategy; legal and IT are typically high influence.

Change readiness requires awareness, desire, knowledge, ability, and reinforcement; training alone addresses only knowledge and ability.

Piloting in one business unit surfaces workflow gaps at low cost and creates internal advocates before enterprise rollout.