![\"Woman](\"https:\/\/www.tsl.texas.gov\/slrm\/blog\/wp-content\/uploads\/2024\/08\/Date-with-Data-300x170.png\")
<\/figure>\n<\/div>\n\n\nFind out if the database or software is…<\/h2>\n\n\n\n\n- On the Department of Information Resource’s contract list<\/a>, which is a search engine to find contracts that meet state purchasing requirements.<\/li>\n\n\n\n
- If applicable: FedRamp<\/a>, StateRAMP<\/a>, TX-Ramp<\/a> compliant.<\/li>\n\n\n\n
- Recommended by other entities. If not, is it because it wasn\u2019t helpful for their entity or did they have data security concerns?<\/li>\n<\/ul>\n\n\n\n
Ask the vendor or determine through research…<\/h2>\n\n\n\n\n- How do they backup the data? <\/li>\n\n\n\n
- Where is the data stored? <\/li>\n\n\n\n
- If the contract ends, what happens to the data?<\/li>\n<\/ul>\n\n\n\n
Check out TSLAC’s article “Electronic Records, Third-Party Systems, and Contracts”<\/a> for further considerations related to contracts with vendors.<\/p>\n\n\n\nAmong your entity, ask…<\/h2>\n\n\n\n\n\n\n- What is the business need for this database or software? Do you already have an approved database or software that suffices? <\/li>\n\n\n\n
- Who will be the custodian? Who will be the backup custodian? Custodians are the designated persons responsible for ensuring the data, information, and records are properly maintained for the entire lifecycle. We recommend designating custodians by their position.<\/li>\n\n\n\n
- Which departments are using the database or software? We strongly recommend creating an inventory of software and other databases that host your entity’s data. Within that inventory, we recommend for:\n
\n- Subject matter experts to explain the need for the software. <\/li>\n\n\n\n
- IT to review and determine the overall purpose of the software.<\/li>\n\n\n\n
- The entity to come to one overall summarization of the tool. This will help staff know if there is similar software already approved for use among your entity. The fewer software products implemented, the easier they are to manage.<\/li>\n<\/ul>\n<\/li>\n<\/ul>\n<\/div>\n\n\n\n\n
![\"Oliver](\"https:\/\/www.tsl.texas.gov\/slrm\/blog\/wp-content\/uploads\/2024\/08\/image.png\")
<\/figure>\n<\/div>\n<\/div>\n\n\n\n\n- What kind of data is being stored in the database or software?\n
\n- Public, confidential, sensitive? Here is a guide<\/a> to the different classifications of data. Are users aware of and trained on the different classifications and how the data should be managed based on the classification?<\/li>\n\n\n\n
- If any, which record series does the data fall in? The following resources will help determine if the data constitutes a record:\n
\n- “The Relationships Between Data, Information, and Records”<\/a> explains the difference in terms “data” versus a “record” and when data is a record.<\/li>\n\n\n\n
- “‘Transaction’ in Records Management”<\/a> walks through the definition of a local government record to determine if something is a record. For state agencies and public universities, the article is still applicable. The only difference is that the definition will also include if something was created on behalf of your entity. See Government Code, \u00a7441.180(11)<\/a> for the full definition of a “state record.”<\/li>\n\n\n\n
- “Classifying AI-Generated Records”<\/a>.<\/li>\n<\/ul>\n<\/li>\n<\/ul>\n<\/li>\n<\/ul>\n\n\n\n
\n- Is there anything that can affect getting access to the records for the duration of when you need these records? (In other words, will you have access to the records for their full retention period? If not, what will you do to ensure that you meet this requirement?)<\/li>\n\n\n\n
- Do you envision this data being exported out by staff? If so\u2026\n
\n- Will they be creating records? For help in determining this, see guidance above<\/a>.<\/li>\n\n\n\n
- How will you ensure they are deleting any convenience copies?\n
\n- For clarification on the term, “convenience copies,” checkout TSLAC’s article “Official Record Copy”<\/a>.<\/li>\n<\/ul>\n<\/li>\n<\/ul>\n<\/li>\n<\/ul>\n\n\n\n\n\n
![\"Boromir](\"https:\/\/www.tsl.texas.gov\/slrm\/blog\/wp-content\/uploads\/2024\/08\/image-3.png\")
<\/figure>\n<\/div>\n\n\n\n\n\n- If the data is floating around in various documents, is that a problem? <\/li>\n\n\n\n
- If so, what training, policies, and procedures should be implemented or updated?<\/li>\n<\/ul>\n\n\n\n
\n- TSLAC articles for guidance on internal training and policies:\n
\n- “Developing Internal Training”<\/a><\/li>\n\n\n\n
- “What Needs to be Addressed in a E-Records Management Policy?”<\/a><\/li>\n<\/ul>\n<\/li>\n<\/ul>\n<\/div>\n<\/div>\n\n\n\n
\n- How are you going to maintain any related policies, procedures, or training (e.g., designate a position that should review each annually)?<\/li>\n\n\n\n
- When does the contract end?<\/li>\n\n\n\n
- When the contract ends, how will you export the data that you need? Does IT need to be involved?<\/li>\n\n\n\n
- In general, does IT need to be involved with the software or database? If so, how?<\/li>\n\n\n\n
- If IT does need to be involved at any point, do they have the necessary tools, procedures, and awareness to make this a breeze? If it won’t be a breeze, what are the complications you may foresee? Are there any strategies you can use to mitigate these complications?<\/li>\n\n\n\n
- How will you let future staff know this data exists and ensure they always have access?<\/li>\n<\/ul>\n\n\n\n
Ask both the vendor and your entity… <\/h2>\n\n\n\n\n- Who has access to the data? Who should have access to the data? Do the two align?\n
\n- If not, what needs to be updated (e.g., contracts, terms and conditions, training, policies, procedures, etc.)?<\/li>\n<\/ul>\n<\/li>\n\n\n\n
- When your entity needs to destroy the data and\/or record because it has met retention, how will you confirm it is actually destroyed? Should you document the destruction? If so, how will this look?\n
\n- For state agencies and public universities, documenting destruction is required. How this look can be determined by your entity. <\/li>\n<\/ul>\n<\/li>\n<\/ul>\n\n\n\n
![\"Forest](\"https:\/\/www.tsl.texas.gov\/slrm\/blog\/wp-content\/uploads\/2024\/08\/image-1-300x172.png\")
<\/figure>\n<\/div>\n\n\n
\n\n\n\nWe hear and resonate with you. This keeping-your-heart-close-to-your-chest-and-asking-the-right-questions<\/em> approach isn’t the most alluring, but trust us, it will mitigate the risk of your data falling into the wrong hands.<\/p>\n
Ask the vendor or determine through research…<\/h2>\n\n\n\n\n- How do they backup the data? <\/li>\n\n\n\n
- Where is the data stored? <\/li>\n\n\n\n
- If the contract ends, what happens to the data?<\/li>\n<\/ul>\n\n\n\n
Check out TSLAC’s article “Electronic Records, Third-Party Systems, and Contracts”<\/a> for further considerations related to contracts with vendors.<\/p>\n\n\n\nAmong your entity, ask…<\/h2>\n\n\n\n\n\n\n- What is the business need for this database or software? Do you already have an approved database or software that suffices? <\/li>\n\n\n\n
- Who will be the custodian? Who will be the backup custodian? Custodians are the designated persons responsible for ensuring the data, information, and records are properly maintained for the entire lifecycle. We recommend designating custodians by their position.<\/li>\n\n\n\n
- Which departments are using the database or software? We strongly recommend creating an inventory of software and other databases that host your entity’s data. Within that inventory, we recommend for:\n
\n- Subject matter experts to explain the need for the software. <\/li>\n\n\n\n
- IT to review and determine the overall purpose of the software.<\/li>\n\n\n\n
- The entity to come to one overall summarization of the tool. This will help staff know if there is similar software already approved for use among your entity. The fewer software products implemented, the easier they are to manage.<\/li>\n<\/ul>\n<\/li>\n<\/ul>\n<\/div>\n\n\n\n\n
<\/figure>\n<\/div>\n<\/div>\n\n\n\n\n- What kind of data is being stored in the database or software?\n
\n- Public, confidential, sensitive? Here is a guide<\/a> to the different classifications of data. Are users aware of and trained on the different classifications and how the data should be managed based on the classification?<\/li>\n\n\n\n
- If any, which record series does the data fall in? The following resources will help determine if the data constitutes a record:\n
\n- “The Relationships Between Data, Information, and Records”<\/a> explains the difference in terms “data” versus a “record” and when data is a record.<\/li>\n\n\n\n
- “‘Transaction’ in Records Management”<\/a> walks through the definition of a local government record to determine if something is a record. For state agencies and public universities, the article is still applicable. The only difference is that the definition will also include if something was created on behalf of your entity. See Government Code, \u00a7441.180(11)<\/a> for the full definition of a “state record.”<\/li>\n\n\n\n
- “Classifying AI-Generated Records”<\/a>.<\/li>\n<\/ul>\n<\/li>\n<\/ul>\n<\/li>\n<\/ul>\n\n\n\n
\n- Is there anything that can affect getting access to the records for the duration of when you need these records? (In other words, will you have access to the records for their full retention period? If not, what will you do to ensure that you meet this requirement?)<\/li>\n\n\n\n
- Do you envision this data being exported out by staff? If so\u2026\n
\n- Will they be creating records? For help in determining this, see guidance above<\/a>.<\/li>\n\n\n\n
- How will you ensure they are deleting any convenience copies?\n
\n- For clarification on the term, “convenience copies,” checkout TSLAC’s article “Official Record Copy”<\/a>.<\/li>\n<\/ul>\n<\/li>\n<\/ul>\n<\/li>\n<\/ul>\n\n\n\n\n\n
<\/figure>\n<\/div>\n\n\n\n\n\n- If the data is floating around in various documents, is that a problem? <\/li>\n\n\n\n
- If so, what training, policies, and procedures should be implemented or updated?<\/li>\n<\/ul>\n\n\n\n
\n- TSLAC articles for guidance on internal training and policies:\n
\n- “Developing Internal Training”<\/a><\/li>\n\n\n\n
- “What Needs to be Addressed in a E-Records Management Policy?”<\/a><\/li>\n<\/ul>\n<\/li>\n<\/ul>\n<\/div>\n<\/div>\n\n\n\n
\n- How are you going to maintain any related policies, procedures, or training (e.g., designate a position that should review each annually)?<\/li>\n\n\n\n
- When does the contract end?<\/li>\n\n\n\n
- When the contract ends, how will you export the data that you need? Does IT need to be involved?<\/li>\n\n\n\n
- In general, does IT need to be involved with the software or database? If so, how?<\/li>\n\n\n\n
- If IT does need to be involved at any point, do they have the necessary tools, procedures, and awareness to make this a breeze? If it won’t be a breeze, what are the complications you may foresee? Are there any strategies you can use to mitigate these complications?<\/li>\n\n\n\n
- How will you let future staff know this data exists and ensure they always have access?<\/li>\n<\/ul>\n\n\n\n
Ask both the vendor and your entity… <\/h2>\n\n\n\n\n- Who has access to the data? Who should have access to the data? Do the two align?\n
\n- If not, what needs to be updated (e.g., contracts, terms and conditions, training, policies, procedures, etc.)?<\/li>\n<\/ul>\n<\/li>\n\n\n\n
- When your entity needs to destroy the data and\/or record because it has met retention, how will you confirm it is actually destroyed? Should you document the destruction? If so, how will this look?\n
\n- For state agencies and public universities, documenting destruction is required. How this look can be determined by your entity. <\/li>\n<\/ul>\n<\/li>\n<\/ul>\n\n\n\n
<\/figure>\n<\/div>\n\n\n
\n\n\n\nWe hear and resonate with you. This keeping-your-heart-close-to-your-chest-and-asking-the-right-questions<\/em> approach isn’t the most alluring, but trust us, it will mitigate the risk of your data falling into the wrong hands.<\/p>\n
Check out TSLAC’s article “Electronic Records, Third-Party Systems, and Contracts”<\/a> for further considerations related to contracts with vendors.<\/p>\n\n\n\n We hear and resonate with you. This keeping-your-heart-close-to-your-chest-and-asking-the-right-questions<\/em> approach isn’t the most alluring, but trust us, it will mitigate the risk of your data falling into the wrong hands.<\/p>\nAmong your entity, ask…<\/h2>\n\n\n\n
\n
\n
<\/figure>\n<\/div>\n<\/div>\n\n\n\n\n
\n
\n
\n
\n
\n
<\/figure>\n<\/div>\n\n\n\n\n
\n
\n
\n
Ask both the vendor and your entity… <\/h2>\n\n\n\n
\n
\n
\n
<\/figure>\n<\/div>\n\n\n
\n\n\n\n
![\"Like](\"https:\/\/www.tsl.texas.gov\/slrm\/blog\/wp-content\/uploads\/2020\/08\/512x512.png\")
\r\n <\/a>\r\n