062 PKI transaction-specific records. Temporary. Records relate to transaction-specific records that are generated for each transaction using PKI digital Destroy/delete when 7 item signature technology. Records are embedded or referenced within the transaction stream and may be years 6 months to 20 13b appended to the transaction content or information record. Along with PKI administrative and other years 6 months old, administrative records, transaction-specific records are part of the PKI trust documentation set that based on the maximum establish or support the trustworthiness of a They may vary from transaction level of operation of the and agency-to-agency. When retained to support the authentication of an electronic transaction content appropriate CA and record (information record), PKI digital signature transaction records are program records. after the information record the PKI is Note: Extreme care must be taken when applying the GRS-PKI to transaction records. Destruction of the designed to protect transaction-specific and administrative records embedded in the transaction stream prior to the and/or access is authorized retention of the information record that they access/protect will render the PKI incapable of destroyed according to performing what it is designed to do-protect and provide access to the information record. Due to the an authorized schedule, relative newness of PKI technology, both from an implementation and a litigation perspective, it is or in the case of recommended that agencies identify all PKI transaction records (including PKI select administrative permanent records, records embedded in the transaction stream and transaction-specific records) to be retained as part of when the record is the trust documentation for the records the PKI is designed to protect and or access and link the retention transferred to NARA of the transaction records with that of the information record it protects/accesses. Transaction records legal custody. Longer must be retained as trust documentation set records together with the content/information record. retention is authorized if the agency determines that transaction-specific PKI records are needed for a longer period.
062 PKI transaction-specific records. Records relate to transaction-specific records that are generated for each transaction using PKI digital signature technology. Records are embedded or referenced within the transaction stream and may be appended to the transaction content or information record. Along with PKI administrative and other administrative records, transaction-specific records are part of the PKI trust documentation set that establish or support the trustworthiness of a They may vary from transaction and agency-to-agency. When retained to support the authentication of an electronic transaction content record (information record), PKI digital signature transaction records are program records. Note: Extreme care must be taken when applying the GRS-PKI to transaction records. Destruction of the transaction-specific and administrative records embedded in the transaction stream prior to the authorized retention of the information record that they access/protect will render the PKI incapable of performing what it is designed to do-protect and provide access to the information record. Due to the relative newness of PKI technology, both from an implementation and a litigation perspective, it is recommended that agencies identify all PKI transaction records (including PKI select administrative records embedded in the transaction stream and transaction-specific records) to be retained as part of the trust documentation for the records the PKI is designed to protect and or access and link the retention of the transaction records with that of the information record it protects/accesses. Transaction records must be retained as trust documentation set records together with the content/information record. Temporary. Destroy/delete when 7 years 6 months to 20 years 6 months old, based on the maximum level of operation of the appropriate CA and after the information record the PKI is designed to protect and/or access is destroyed according to an authorized schedule, or in the case of permanent records, when the record is transferred to NARA legal custody. Longer retention is authorized if the agency determines that transaction-specific PKI records are needed for a longer period. item 13b
grs03-2.docx