Similar to Dwight's comments, the issues of "Access to and Ownership of
Records"  are first and foremost in the minds of any Contractors performing
work for a Federal Agency.

We, (as third party providers) are responsible for managing EVERY RECORD we
generate or receive during the conduct of our work in compliance with both
the Agency requirements and the requirements of NARA, which are in Title 36
of the CFR.  Of course with that said, the Agency we are under Contract to
is ALSO responsible for funding the costs for us to comply with these
requirements.

I think this is where the issue gets fuzzy with private industry when you
have contractors (third parties) performing work on your behalf and you want
to pass along requirements for them, with respect to managing your
information/records or other requirements.  Your bid documents have to
clearly identify WHAT a record is and HOW it is to be managed, and that on
completion of the Contract (or at specified points during the Contract)
those assets are to be turned over to the client in an agreed upon
form/format.  

And if the contractor agrees to the terms and conditions in the bid, and
ultimately in the Contract, their bid should include the cost to comply with
these requirements.  And yes, you should periodically validate they are
complying with this, just like any other facet of work they are performing
under contractual obligations.

It may end up being a case of "be careful what you ask for" though, because
the cost required to comply with these requirements may be far higher than
expected.  As an example, you may require that your information be stored
independent of that belonging to other clients or the contractor themselves,
and that they are to avoid commingling data in backup tapes. And because of
privacy concerns, this may be a real requirement- the last thing you'd want
is for another client of theirs to be sued, be subject to an e-discovery
request, and your data to be included in that production order.

So think long and hard about what you need AT A MINIMUM for the management
of your information assets that are in the care and control of others, and
ensure the obligations you place on them aren't in excess of those you
exercise yourself, or beyond what you're wiling to pay for.

Larry

List archives at http://lists.ufl.edu/archives/recmgmt-l.html
Contact [log in to unmask] for assistance
To unsubscribe from this list, click the below link. If not already present, place UNSUBSCRIBE RECMGMT-L or UNSUB RECMGMT-L in the body of the message.
mailto:[log in to unmask]