Home / Library / Archives / Records

Information Technology Records

Institutional Records Management

This Schedule applies to records in all media, unless otherwise specified.

  • Items - a sample listing of items found within a series. Other related records not listed may also be part of a series.
  • Disposition - all dispositions are minimum requirements and include, where applicable, transfer to the custody of the University Archives for appraisal and final disposition.
  • Destruction - takes place in the office. Any record with confidential or sensitive information shall be properly destroyed by shredding or by means to ensure that the records cannot be physically recreated.
  • Original and Reference Copy -original copy (also known as a record copy) is the official authorized copy kept by the office charged with creating or maintaining the record copy. Reference copies (also known as convenience copies) are preserved for the convenience of reference or ease of access.

No destruction of records may take place if litigation or audits are pending or reasonably anticipated or foreseeable.

Refer to prefatory material for additional instructions or contact your university's records officer for clarification.


Computer and Information Security

  • GU118 Access and Security Policies and Security Documentation
  • GU119 Computer Security Incident
  • GU120 Computer System Review
  • GU121 Computer Usage
  • GU122 Disaster Preparedness & Recovery Planning
  • GU123 Internet Service Logs (External)
  • GU124 Network Usage (Internal)
  • GU125 System Backup
  • GU126 System Users Access Records
Computer Operations and Technical Support

  • GU127 Audit Trail
  • GU128 Automated Off-Line Storage System
  • GU129 Destruction of Files Reports
  • GU130 Off-Line Control Records
  • GU131 Operating System & Hardware Conversion PlanningGU132  Summary Usage Reports
  • GU132 Summary Usage Reports
Data Administration
  • GU133 Data / Database Dictionary
  • GU134 Indexes / Tracking Systems
  • GU135 System Validation
IT General Systems and Applications Development
  • GU136 Application Development Project
  • GU137 Application System Operations
  • GU138 Metadata Documentation
  • GU139 Quality Assurance
  • GU140 Source Code
  • GU141 Technical Program Documentation
Network/Data Communications Services
  • GU142 Network Implementation Project
  • GU143 Network / Circuit Installation and Service
  • GU144 Network Circuit Inventories
  • GU145 Network / Site Equipment Support
User/Office Automation Support
  • GU146 Help Desk Logs & Reports
  • GU147 Site / Equipment & Software Support

Information Technology Records

Computer and Information Security

Series # Series Title Series Description Items Disposition
GU118 Access, Security Policies and Security Documentation Comply with applicable provisions of G.S. 132-6.1(c), Health Insurance Portability and Accountability Act (HIPAA), 42 U.S.C. 1320 et seq., regarding confidentiality of computer-related and privacy-related records. security policies, standards, guidelines, procedures, security plans Destroy in office 3 years after superseded or obsolete.
GU119 Computer Security Incident Incidents involving unauthorized attempted entry, probes, and/or attacks on data processing systems, information technology systems, telecommunications networks, and electronic security systems, including associated software and hardware. Comply with applicable provisions of G.S. 132-6.1(c) and HIPAA regarding confidentiality of computer-related and privacy-related records. reports, logs, extracts and compilations of data Destroy in office 5 years after incident is resolved.
GU120 Computer System Review Logs, computer reports and review reports regarding the maintenance and security of the computer system. Comply with applicable provisions of G.S. 132-6.1(c) and HIPAA regarding confidentiality of computer-related and privacy-related records. firewall logs, system auditing logs, reports, reviews Destroy in office computer reports and logs when review report is completed. Destroy in office review report and supporting data after 3 years.
GU121 Computer Usage Monitor computer system usage. Comply with applicable provisions of G.S. 132-6.1(c) regarding confidentiality of computer-related records. log-in files, system usage, charge backs, data entry logs, security logs Destroy in office after completion of applicable review and verification procedures, if no litigation, claim, audit or other official action involving the records has been initiated. If official action has been initiated, destroy after completion of action and resolution of issues involved.
GU122 Disaster Preparedness and Recovery Planning Comply with applicable provisions of G.S. 132-6.1(c) regarding confidentiality of computer-related records.   Destroy in office when superseded or obsolete.
GU123 Internet Service Logs (External) Monitor access and use of services provided via the Internet. Comply with applicable provisions of G.S. 132-6.1(c) regarding confidentiality of computer-related records. website logs, mail server logs, FTP logs, Telnet logs, antivirus/anti-spam mail service logs Destroy in office after completion of applicable review and verification procedures, if no litigation, claim, audit or other official action involving the records has been initiated. If official action has been initiated, destroy after completion of action and resolution of issues involved.
GU124 Network Usage (Internal) Monitor network usage. log-in files, system usage files, reports, firewall logs Destroy in office after completion of applicable review and verification procedures, if no litigation, claim, audit or other official action involving the records has been initiated. If official action has been initiated, destroy after completion of action and resolution of issues involved.
GU125 System Backup Copies of master files or databases, application software, logs, directories needed to restore a system in case of a disaster or inadvertent destruction.   Destroy in office in accordance with your office's established backup plan and procedures - See Security Backup Files as Public Records in North Carolina: Guidelines for the Recycling, Destruction, Erasure and Re-Use of Security Backup Files, at http://www.ah.dcr.state.nc.us/records/.
Backups used to document transactions or retained for purposes other than system security should be scheduled separately by the responsible program unit. For fiscal systems, monthly system backups are often retained for the entire fiscal year to provide an audit trail and annual requirements in lieu of copies of the individual master files or databases. If these records are covered by specific Federal audit requirements requiring longer records retention, they should be scheduled separately by the appropriate program unit. It is advisable that for many application systems multiple copies of backups be produced during each cycle.
GU126 System Users Access Records Monitor individual access to a system and its data. user account records Destroy in office 1 year after user is withdrawn from system.

Computer Operations and Technical Support

Series # Series Title Series Description Items Disposition
GU127 Audit Trail Data generated during the creation of a master file or database used to validate the integrity of a master file or database during a processing cycle. Comply with applicable provisions of G.S. 132-6.1(c) regarding confidentiality of computer-related records.   Destroy in office when administrative value ends.
GU128 Automated Off-Line Storage System List of backup tapes. Comply with applicable provisions of G.S. 132-6.1(c) regarding confidentiality of computer-related records.   Destroy in office after related records or media are destroyed or withdrawn from the media library.
GU129 Destruction of Files Reports Comply with applicable provisions of G.S. 132-6.1(c) regarding confidentiality of computer-related records.   Destroy in office when superseded or obsolete.
GU130 Off-Line Storage Control Records Comply with applicable provisions of G.S. 132-6.1(c) regarding confidentiality of computer-related records.   Destroy in office when superseded or obsolete.
GU131 Operating System and Hardware Conversion Planning Replacement of equipment or computer operating systems that support the creation of non-permanent records. Comply with applicable provisions of G.S. 132-6.1(c) regarding confidentiality of computer-related records.   Destroy in office 1 year after completion of conversion.
GU132 Summary Usage Reports Summary reports documenting computer usage for reporting or cost recovery purposes. Comply with applicable provisions of G.S. 132-6.1(c) regarding confidentiality of computer-related records.   Destroy in office after 3 years.

Data Administration

Series # Series Title Series Description Items Disposition
GU133 Data / Database Dictionary Comply with applicable provisions of G.S. 132-6.1(c) regarding confidentiality of computer-related records. data element definitions, data structures, file layout, reports Destroy in office 3 years after discontinuance or modification of the related application and after application data has been destroyed or transferred to new structure or format.
GU134 Indexes / Tracking Systems Comply with applicable provisions of G.S. 132-6.1(c) regarding confidentiality of computer-related records. electronic indexes, lists, registers Destroy in office when related paper or electronic records have been destroyed or transfer in accordance with the disposition of the related paper or electronic records as appropriate.
Indexes and tracking systems of program units other than data processing units should be scheduled by the responsible program unit in conjunction with the related program records.
GU135 System Validation Used to update and/or document a transaction in a database or master file. Comply with applicable provisions of GS 132-6.1(c) regarding confidentiality of computer-related records. log, update file Destroy in office when administrative value ends.

IT General Systems and Applications Development

Series # Series Title Series Description Items Disposition
GU136 Application Development Project Development, redesign or modification of an automated system or application. Comply with applicable provisions of G.S. 132-6.1(c) regarding confidentiality of computer-related records. project management, status reports, drafts, specifications, correspondence Transfer to University Archives 5 years after project is completed.
GU137 Application System Operations User and operational documentation describing how an application system operates. Comply with applicable provisions of G.S. 132-6.1(c) regarding confidentiality of computer-related records. flowcharts, program descriptions, documentation, user's guides, specifications Destroy in office 3 years after discontinuance of all systems, and after all data created by every system instance has been destroyed or migrated to new operating system.
GU138 Metadata Documentation Metadata concerning the development and/or modification of and the access, retrieval, manipulation and interpretation of data in an automated system. Comply with applicable provisions of G.S. 132-6.1(c) regarding confidentiality of computer-related records. data dictionary, file layout, code book Destroy in office 3 years after discontinuance of system or application, and after system's or application's instance data have been destroyed or migrated to a new structure or format.
GU139 Quality Assurance Adherence of applications and systems development procedures and products to established policies, processes, architectures, deliverables, performance metrics, budgetary allocations and deadlines. Comply with applicable provisions of G.S. 132-6.1(c) regarding confidentiality of computer-related records. reviews, assessments Destroy in office 3 years after source code is upgraded or becomes obsolete.
GU140 Source Code Comply with applicable provisions of G.S. 132-6.1(c) regarding confidentiality of computer-related records.   Destroy in office 3 years after upgraded or obsolete.
GU141 Technical Program Documentation. Comply with applicable provisions of G.S. 132-6.1(c) regarding confidentiality of computer-related records. program code, program flowcharts, program maintenance log, system change notices Destroy in office 1 year after program is upgraded or obsolete.

Network/Data Communications Services

Series # Series Title Series Description Items Disposition
GU142 Network Implementation Project Comply with applicable provisions of G.S. 132-6.1(c) regarding confidentiality of computer-related records. reports, justifications, working diagrams, wiring schematics Destroy in office when superseded or obsolete.
GU143 Network / Circuit Installation and Service Comply with applicable provisions of G.S. 132-6.1(c) regarding confidentiality of computer-related records. work orders, correspondence, work schedules, building / circuit diagrams Destroy in office 2 years after completion of work.
GU144 Network Circuit Inventories Comply with applicable provisions of G.S. 132-6.1(c) regarding confidentiality of computer-related records. circuit number, vendor, cost per month, type of connection, terminal series, software, Destroy in office when superseded or obsolete.
GU145 Network / Site Equipment Support Comply with applicable provisions of G.S. 132-6.1(c) regarding confidentiality of computer-related records. site visit reports, trouble reports, service history, correspondence Destroy in office service histories and other summary records when superseded or obsolete. Destroy in office remaining records when administrative value ends.

User/Office Automation Support

Series # Series Title Series Description Items Disposition
GU146 Help Desk Logs and Reports Comply with applicable provisions of G.S. 132-6.1(c) regarding confidentiality of computer-related records.   Destroy in office after 2 years.
GU147 Site / Equipment and Software Support Support service records. Comply with applicable provisions of GS. 132-6.1(c) regarding confidentiality of computer-related records. site visit reports, program reports, equipment service reports, service history correspondence Destroy in office service histories and other summary records when superseded or obsolete. Destroy in office remaining records after 3 years.