1. (1) Cybersecurity Records: Series documents the security of an agency’s information systems and network infrastructure. Records may include employee access requests, access authorizations, system access logs, documentation of security incidents and responses, and related documentation. SEE ALSO: Risk Management Records section; Internal Policies and Procedures; and Data Breach Records. Minimum Retention: (a) System access logs, 3 years, or longer if required by statute or regulation; (b) Cybersecurity incident records related to a data breach, retain per Data Breach series in this section; (c) Cybersecurity incident records not related to a data breach, 5 years after incident resolved; (d) All other cybersecurity records, 3 years after superseded or authorization expired.
2. (2) Data Breach Records: Series documents the investigation, assessment, and disclosure notification of breaches in agency computer systems. Records document the response to an unauthorized access to computerized data possibly compromising the security, confidentiality, or integrity of personal information as required by ORS 646A.600 to 646A.628. Records may include documentation of the unauthorized access of the information security system, potentially affected personal information or data elements, incident reports, investigation reports, consultation reports, and disclosure notifications. SEE ALSO: Cybersecurity Records. Minimum retention: (a) If incident requires notification, 10 years after completion of investigation; (b) If incident does not require notification, 5 years after completion of investigation.
3. (3) Dataset Inventory Records: Series documents the location, structure, and use of agency datasets. Minimum retention: Until superseded or obsolete.
4. (4) Information System Application Documentation Records: Series documents the addition, modification, or removal of operating systems, in-house build applications, and other software from agency information systems. Records may include system overviews, operations logs, job listings, instruction manuals, system development logs, system specifications and changes, conversion notes, dataset logs, dataset record layouts, programming logs, program specifications and changes, control program table documentation, and program listings. SEE ALSO: Information System Maintenance Records; Information System Planning and Development Records; and Software Management Records. Minimum retention: (a) Migration plans, until superseded or obsolete; (b) Routine system-generated metadata and operational logs, until no longer needed; (c) All other records, 1 year after life of system.
5. (5) Information System Architecture Records: Series documents the structural design of agency information systems, including interrelationships between data in different systems throughout the agency. Records may include plans, diagrams, and related documentation. SEE ALSO: Dataset Inventory Records; and Information System Planning and Development Records. Minimum retention: 1 year after superseded or obsolete.
6. (6) Information System Maintenance Records: Series documents the maintenance of an agency’s computer systems and is used to ensure compliance with any warranties or service contracts, schedule regular maintenance, diagnose system or component problems, document system backup procedure, and migrate information from the former system to a new system. Records may include computer equipment inventories, hardware performance reports, component maintenance records (warranties, maintenance logs, maintenance reports, and related records), system backup reports and procedures, backup tape inventories, and related documentation. Minimum retention: (a) Records related to system or component repair or service, 1 year after life of system or component; (b) Records documenting system backup procedures, 1 year after superseded or obsolete.
7. (7) Information System Planning and Development Records: Series documents the planning and development of agency information systems. Records may include information technology plans, feasibility studies and cost-benefit analyses, agency studies and surveys, system specifications and revisions, software evaluations, component proposals, technical literature, vendor literature and proposals, and related documentation. Note: For records related to administration of project see Project Management Records. Minimum retention: (a) Implemented systems, for the life of the system; (b) Unimplemented systems, 3 years.
8. (8) Information System Wiring Records: Series documents the wiring of an agency’s information system network. Records may include blueprints or diagrams of information system wiring, cables, computer equipment connections, and related documentation. Minimum retention: Until superseded or obsolete.
9. (9) Microfilm and Imaging Quality Control Records: Series documents that microfilm or digital images produced by or for counties and special districts conforms to the specifications required by OAR 166. Records may include microfilmed and digitally imaged records lists, microfilm reel indexes, service bureau transmittals, film inspection reports, methylene blue certifications, camera/processor/duplicator inspection reports, equipment and operator logs, and related documentation. Minimum retention: (a) Microfilm quality control records, life of documented film; (b) Digital imaging quality control records, until images pass initial quality checks.
10. (10) Software Management Records: Series documents the use of software in agency information systems to ensure that agency software packages are compatible, that license and copyright provisions are complied with, and that upgrades are obtained in a timely manner. Records may include software inventories, software licenses, site licenses, and related documentation. SEE ALSO: Work Order Records. Minimum retention: 1 year after software disposed of or upgraded.
11. (11) Telecommunications System Management Records: Series documents the creation, modification, or disposition of agency telecommunications systems. Records may include equipment records, Federal Communications Commission records, system planning records, telecommunications maintenance contracts, telecommunications service and repair orders, and related documentation. SEE ALSO: Work Order Records. Minimum retention: 1 year after life of system.
12. (12) User Support Records: Series documents troubleshooting and problem-solving assistance provided by the agency’s information systems personnel to users of the systems (computer, telecommunications, etc.) Records may include assistance requests, resolution records, and related documentation. Minimum retention: (a) Routine assistance records, until problem resolved; (b) Records with ongoing reference value, until superseded or obsolete.

Statutory/Other Authority

ORS 192.005–192.170 & ORS 357.805–357.895

Statutes/Other Implemented

ORS 192.005–192.170 & ORS 357.805–357.895

History

OSA 7-2025, amend filed 11/05/2025, effective 11/05/2025
OSA 4-2004, f. & cert. ef. 9-1-04