Smart NQA-1 Storage Strategies for Nuclear Records Security August 8, 2009 Among the information management professionals I have worked with over the past 25 years, those in the nuclear industry always stand out, especially when it comes to vigilantly protecting the integrity of records. While they stay on the cutting edge of information management, security of information assets is always the ultimate requirement for the program. As a result, the IT community, as well as other records management and storage providers, are continually challenged to find ideal solutions in the nuclear arena. Throughout this era of IT advancements, comprehensive records management principles have aided in developing workable solutions to many potential security problems. Nuclear information management professionals continue to implement static security with a focus on the full cycle of records management from creation to long-term storage. Clearly, this is an important element in the proven success now being so widely recognized in the nuclear energy industry. Supporting the NQA-1 Standard The nuclear industry has understandably ventured with exceptional caution among new records management technologies, as any loss of information assets is totally unacceptable. Whole industries are trying to emulate the security model represented by NIRMA and the time-tested stability of the records platform required by federal laws and NQA-1 standards. Major offsite records centers have undergone NQA-1 certification and seek to educate other service providers in the benefits of following the nuclear industry model for records protection for their many offsite clients. Pressure to convert to electronic records will continue. This is clear in the nuclear industry and others, as the federal government requires health records to be in electronic format. As we are discovering, managing and migrating these records will require new strategies. For example, the old-style storage vault capable of protecting only paper will become obsolete. Protection for media and microfilm which are destroyed at a much lower temperature than paper must be implemented in vaults, as well as insulation against earthquake and hurricane damage. Disposition strategies for records will be implemented and encryption and security will need to be designed into new programs. New Protection Against Risks Serious risks are directed at corporations weekly. For example, in 2008 there were over 285 million records compromised in just 90 recorded breaches. Undisclosed thefts, hacking, virus attacks, bots and indiscriminate sabotage are just a few of the risks records managers defend against. New portals for information loss appear without warning. It is up to companies to take steps to protect their vital information assets and make the theft of this information more difficult. Industry leaders like First Energy, Constellation Energy, Santee Cooper and South Carolina Electric, to name just a few, have worked hard to develop prototype secure records storage environments where paper and media are provided the appropriate level of fire protection and security. Because media is destroyed at a much lower temperature than paper, as is microfilm, their vaults must deliver a Class 125 Media Protection Fire rating. Layering in magnetic shielding and seismic protection for these archives to ensure that they can resist catastrophic destruction from specific threat by geographic region are also necessary and are designed into the vault chamber. The same is true for vaults in hurricane-prone areas. "What is important in the nuclear industry is consistently demonstrating quality in performance of its high standards," said John Miller of Westex Document Inc., an NQA-1 certified records storage provider. "If a disaster ever strikes a nuclear facility, the files, records, and plans will be available tomorrow or 80 years from now if they are stored in an NQA-1 commercial records vault." Establishing High Security Zones Perimeter security is a given in the nuclear arena but many recent case histories reveal that insider threats are a major risk. Segregating the records into secure zones, limiting access to these zones to select employees reinforced with biometric or card access barriers, and effective use of digital video surveillance help to minimize risk exposure. Tracking the records via special software has proven effective, and radio-frequency identification (RFID) technology may also be integrated into the solution. Modular and relocatable "records centers in a box" is a new technology for the growing nuclear site methodology. Introducing new contractors onto a site can be time consuming, and construction work onsite is often slow due to the intense security of the site. A concept of dropping a ready-made records center into the site for active records and transitory records makes sense. The unit comes onsite complete and ready for records protection. This concept, in conjunction with a secure NQA-1 offsite storage contractor, provides an ideal combination. The security expected onsite becomes the model for the offsite center as well. Distributed storage can also limit access to all the files in one location. All access to the records can now be controlled through records management, as the records are now offline. Sophisticated software can track who is accessing certain information. When that agent also seeks to procure the offsite collection, the security of a redundant model is placed at risk. Alarms can be designed into the software to make the owner aware of such a breach in protocol. This requires a combined effort from IT and records management to create this heightened level of security. Comprehensive Vault Protection Too often, theft of information assets is accompanied by an arson fire to cover the crime. In addition, the stressful world we live in today is breeding a new type of arsonist: "the Disgruntled Employee!" This trend is evidenced by the 300,000 fires last year according to the National Fire Protection Association, with arson being the leading cause of fires. Effective programs on nuclear sites have been developed by a combined effort from fire protection, risk management and audit departments working in concert with records management, and information technology to create a secure model of business continuity and disaster prevention. The move by many sites to install vaults capable of protecting microfilm and media, as well as paper is a trend that will continue just as the number and type of threats for the nuclear industry will likely continue to increase.