How to Build a Business Continuity Plan Around Your Records Management
Take Control of Your Records
Get a free consultation to simplify storage, scanning, retrieval, and secure destruction.
Get StartedA continuity plan covers records management when it names the records the organization cannot operate without, keeps duplicates far enough from the originals that one fire, flood, or outage cannot take both, and sets a deadline for getting them back. Federal guidance calls these essential records and expects them accessible within 12 hours of a continuity activation.
In July 1973, a fire at the National Personnel Records Center in St. Louis destroyed somewhere between 16 and 18 million Official Military Personnel Files. The National Archives describes the loss in its own Essential Records Guide without softening it: there were no duplicate copies, no microfilm copies, and no indexes created prior to the fire. Veterans and their families are still dealing with the consequences. The building had sprinklers on the drawing board and none installed on the sixth floor.
That is what a records failure looks like at the far end. Most organizations will never face anything close to it, which is exactly why records tend to fall out of continuity planning: the failure mode is rare, slow to surface, and impossible to demo. This article covers what belongs in the records half of a continuity plan, what the federal rules actually require, and how to set a recovery target you can test rather than assert.
What Counts as an Essential Record
Essential records are the records needed to keep the organization running during a disruption, plus the records that protect legal and financial rights. Everything else, however important on an ordinary Tuesday, is not essential in the continuity sense. The distinction is the whole point: it decides what gets duplicated, dispersed, and retrieved first.
The federal definition sits in 36 CFR Part 1223, and it is worth reading in the original because it is more precise than the version that circulates in vendor material. The regulation splits essential records into two groups. Emergency operating records are the ones needed to keep functioning or to reconstitute the organization during and after an emergency: succession orders, delegations of authority, staffing assignments, the program records behind the most critical operations. Legal and financial rights records are the ones that protect the rights of the organization and of the people affected by what it does: accounts receivable, payroll, retirement, insurance.
You will see both “vital records” and “essential records” in the literature, and they mean the same thing. The National Archives explains the switch in its guide: after Hurricane Katrina, state archives pointed out to FEMA that “vital records” already meant birth certificates, marriage licenses and death records in their world, so FEMA adopted “essential records” for the continuity sense. The regulation still says vital. The doctrine says essential. Nobody has reconciled the two, and you will meet both in the same audit.
Why Continuity Plans Skip Records
Most continuity templates treat continuity as an IT problem. FEMA’s own downloadable business continuity plan template contains no mention of records, vital records, or physical documents anywhere in it. Its only information section covers restoring networks, servers, laptops and data. Paper is simply absent from the form people fill in.
Here’s the part people miss. The gap isn’t that FEMA doesn’t care about records, it’s that FEMA publishes two different bodies of work and most organizations only ever see one. The small business facing material on Ready.gov is a template and a set of exercise documents, and it is thin on records. FEMA’s continuity doctrine for government, the Continuity Guidance Circular, is emphatic about them: essential records include hard copy, viable programs cover identifying and protecting and accessing them at primary and alternate sites, and organizations should hold multiple copies in several locations. If you build your plan from the template you get an IT plan. If you build it from the doctrine you get a records plan too. Same agency, two different answers, and the one most people download is the incomplete one.
Worth noting that Ready.gov retired the Business Continuity Planning Suite entirely. The page now carries a plain notice that it is no longer supported or available for download. If your plan was built on that tool, the tool is gone.
The Two Categories Decide Where Records Live
Emergency operating records have to come back fast. Legal and financial rights records do not. That single difference should drive two different storage decisions, and the regulation is explicit that anything qualifying as both gets treated as an emergency operating record.
This is the most useful idea in 36 CFR 1223 and the one most often skipped. Section 1223.22 says copies of emergency operating records must be accessible in a very short period of time for use in an emergency, while copies of legal and financial rights records may not be needed as quickly. Then it settles the ambiguous case: records with the properties of both categories are treated as emergency operating records.
In practice that means your essential records inventory produces two tiers, not one list. The fast tier is small, digitized, and reachable without a truck. The slower tier can sit in secure offsite document storage with next day or scan on demand retrieval, because nobody needs the 2019 payroll file within the hour. Organizations that put everything in the fast tier pay for speed they will never use. Organizations that put everything in the slow tier discover the problem at the worst possible moment.
Twelve Hours, and Why That Number Matters
The National Archives sets a concrete recovery target: staff at continuity facilities should have access to their essential records within 12 hours of a continuity plan activation, regardless of the media or format the records are in. That is a target you can rehearse against, which is more than most continuity plans give you.
The phrase that earns its keep there is “regardless of media or format.” A twelve hour target is easy if everything is a file on a server. It is a real design constraint once part of the collection is paper in cartons two states away, and that constraint is the point: it forces the question of which records genuinely need to be digital before an emergency rather than after one.
Run it as a tabletop exercise and it becomes obvious very quickly whether the plan works. Pick three essential record series, activate on paper, and time the retrieval. Most organizations find that the answer depends entirely on whether one specific person is reachable, which is itself the finding.
What Protection Actually Means
Protection comes down to two mechanisms in the federal rules: duplication and dispersal. Duplicate the record, then put the copy far enough away that the same event cannot take both. Everything else, including the storage medium and the retrieval process, is detail underneath those two decisions.
Section 1223.22 sets it out plainly. Duplication can be to the same medium or a different one. Once duplicated, copies must be dispersed to sites a sufficient distance away to avoid being subject to the same emergency. “Sufficient distance” is deliberately not a number in the federal rule, though some states do put one on it: the California Secretary of State’s records management handbook tells agencies to keep a duplicate at least twenty miles from the main office, or in cloud storage, or in a fireproof safe.
On the mechanism for getting paper into a form you can disperse, Ready.gov is unusually direct. Its IT disaster recovery guidance says backing up hard copy vital records can be accomplished by scanning paper records into digital formats and allowing them to be backed up along with other digital data. That is federal guidance endorsing high-volume scanning as the continuity mechanism for paper, not a vendor claim.
FEMA’s essential records brochure adds the other half, and it is the half people forget once they have a scanner. Pre-positioning hard copies at alternate sites ensures an organization is not reliant on electronic equipment to access records. Vaults and fire resistant storage appear in the same list. A plan that converts everything and keeps nothing physical has swapped one single point of failure for another. For collections held on backup tape, microfilm or audio-visual masters, that physical layer needs environmental control as well as security, which is what climate-controlled media vault storage is for.
Right-Size the Scope Before You Start
Essential records are typically a small portion of what an organization holds, though the share varies enormously by function. The failure mode at this stage is not missing something. It is designating so much that the designation stops meaning anything.
The California Secretary of State puts it in one line worth stealing: if everything is essential, nothing is essential. Washington’s state archives is careful about the proportion, noting that essential records are typically a small portion of an agency’s records, but that in some agencies most of the records may be essential, courts and county recorders being the obvious examples.
You will find confident percentages quoted around this question. Treat them carefully. The widely repeated “one to seven percent” figure traces back to a 1996 National Archives publication that hedged it as what a review of the available literature suggests, and the page carrying it now sits behind a notice from the National Archives saying the information is no longer accurate. The current Essential Records Guide contains no percentage at all. Size your own inventory instead of importing someone else’s ratio.
What the Standards Do and Do Not Require
ISO 22301 does not contain a records management clause. It is a 21 page management system standard whose only documentation requirement governs the documentation of the management system itself. If you have been told the standard mandates a vital records program or offsite storage, you have been told something the standard does not say.
This matters because the misquote is common enough to shape budgets. ISO 22301:2019 is the current edition, published October 2019, and its contents run from context of the organization through leadership, planning, support, operation, performance evaluation and improvement. The documentation requirement sits at clause 7.5, which is the same harmonized boilerplate that appears in ISO 9001 and ISO 27001 and covers creating, updating and controlling the documented information the management system needs. Whether that leads you to offsite paper storage is an outcome of the business impact analysis you run under clause 8.2, not a requirement handed down by the standard. Worth knowing too that ISO moved the standard to “to be revised” in December 2025, with a third edition now in committee draft.
On the other standard people cite, NFPA 1600 no longer exists as a standalone document. It was consolidated into NFPA 1660, current edition 2024, together with NFPA 1616 and NFPA 1620. If your plan or your policy references NFPA 1600 by number, the reference is stale.
The Operating Rhythm That Keeps It Current
A records continuity program is a recurring cycle, not a document. The federal model names an owner, inventories the records, updates the inventory annually, certifies it by a fixed date each year, reviews the program annually, and exercises it. Miss the cycle and the plan degrades quietly, because nothing visibly breaks until the day it is needed.
The EPA’s essential records procedure, signed by its CIO in August 2024, is a clean template for anyone building this outside government. It requires the organization to identify essential records and prepare an inventory, develop and implement a protection and access plan, update the inventory at least annually, remove and destroy outdated copies, certify the inventory through senior management by October 1 each year, review the program annually for new security issues and missing records, and participate in continuity exercises.
Two details there are easy to skim past and worth keeping. The first is the fixed certification date: an annual obligation without a date on it becomes a two year obligation. The second is removing outdated duplicates, which is the step that keeps the essential records set from silently growing into a second uncontrolled archive. Both belong in your retention policy rather than living only in the continuity plan, so that the two documents cannot drift apart. If the underlying program is not yet in place, our guide to records governance covers the framework this sits inside.
Frequently Asked Questions
What are essential records in a business continuity plan?
Essential records are the records an organization needs to keep operating during a disruption, plus those that protect legal and financial rights. Federal regulation splits them into emergency operating records, such as succession orders, delegations of authority and the program records behind critical operations, and legal and financial rights records, such as payroll, accounts receivable, retirement and insurance files. The terms “vital records” and “essential records” refer to the same thing.
How quickly should essential records be available after a disaster?
The National Archives sets the benchmark at 12 hours: staff at continuity facilities should have access to essential records within 12 hours of a continuity plan activation, regardless of the media or format those records are in. Emergency operating records must meet that window. Records that only protect legal and financial rights can be retrieved more slowly, which is why most organizations end up with a fast tier and a slower tier rather than one undifferentiated set.
Does ISO 22301 require offsite records storage?
No. ISO 22301:2019 is a 21 page management system standard with no records management clause. Its only documentation requirement, clause 7.5, governs the documented information the management system itself needs, and it is shared boilerplate with other ISO management system standards. Offsite storage may well be the right answer for a given organization, but it comes out of the business impact analysis run under clause 8.2, not from a requirement in the standard.
How far away should duplicate records be stored?
Federal regulation requires copies to be dispersed to sites a sufficient distance away to avoid being subject to the same emergency, without setting a number. Some states are more specific: California instructs agencies to keep a duplicate at least twenty miles from the main office, in cloud storage, or in a fireproof safe on site. The practical test is whether a single flood, fire, storm or outage could reach both the original and the copy.
What percentage of records in an organization are essential?
There is no reliable figure, and the commonly quoted percentages do not hold up. The often repeated “one to seven percent” comes from a 1996 National Archives publication that presented it as what the available literature suggested, and that page now carries a notice from the National Archives stating the information is no longer accurate. Essential records are typically a small portion of a collection, but functions like courts and recorders can be mostly essential. Size the inventory against your own operations.
Build the Records Half of Your Plan
A continuity plan that names its essential records, splits them by how fast they are needed, duplicates and disperses them, and rehearses the retrieval is doing the work. One that restores servers and assumes the paper will be there is not. GRM handles both sides of that: enterprise records management with indexed offsite storage and logged retrievals, scanning to move the fast tier into digital form, and vault storage for media that needs environmental control. Request a quote to work through your essential records inventory with us.