CDIA Compliance Standards 4 — Questions and Answers
Question 1: The DoD 5015.02-STD (now superseded by related NARA guidance) primarily addressed records management requirements for:
- Commercial banking document imaging
- Department of Defense electronic records management software (Correct answer)
- Healthcare imaging system interoperability
- State government archives
Correct answer: Department of Defense electronic records management software
DoD 5015.02-STD specified design criteria for records management application (RMA) software used within the Department of Defense.
Question 2: What is a 'disposition authority' in the context of records compliance?
- The software module that deletes documents after their retention period
- Official authorization from NARA or an agency head that governs what happens to records at end of retention (Correct answer)
- The system administrator role responsible for purging old files
- A compliance officer's written approval to image paper documents
Correct answer: Official authorization from NARA or an agency head that governs what happens to records at end of retention
A disposition authority is the official legal authorization — typically a records schedule — that specifies what must happen to records at end of their retention period.
Question 3: An organization scanning personnel files must comply with EEOC recordkeeping requirements. What is the general retention period for personnel records related to a terminated employee under EEOC regulations?
- Six months
- One year (Correct answer)
- Three years
- Seven years
Correct answer: One year
EEOC regulations generally require retention of personnel records for one year from the date of the personnel action for terminated employees.
Question 4: Which technical control in a document imaging system directly supports non-repudiation of electronic records?
- Lossy image compression
- Digital signatures applied at the time of document creation or capture (Correct answer)
- Automatic document classification
- High-speed duplex scanning
Correct answer: Digital signatures applied at the time of document creation or capture
Digital signatures bind the signer's identity cryptographically to the document, making it impossible to deny having signed or created it.
Question 5: Under SEC Rule 17a-4, broker-dealers storing electronic records must use a storage system that is:
- Cloud-based with geographic redundancy
- Non-rewriteable and non-erasable (WORM) for the required retention period (Correct answer)
- Encrypted using AES-256 encryption
- Indexed using full-text search capability
Correct answer: Non-rewriteable and non-erasable (WORM) for the required retention period
SEC Rule 17a-4(f) requires broker-dealers to use WORM (Write Once, Read Many) storage to ensure records cannot be altered or deleted during the retention period.
Question 6: FERPA (Family Educational Rights and Privacy Act) primarily impacts document imaging systems at educational institutions by governing:
- Retention of financial aid records for ten years
- Access to and disclosure of students' education records (Correct answer)
- Image resolution requirements for academic transcripts
- Encryption of faculty personnel files
Correct answer: Access to and disclosure of students' education records
FERPA protects the privacy of student education records, controlling who may access them and requiring institutional policies on disclosure.
Question 7: What is the key difference between a 'record' and a 'non-record' in the context of US federal records compliance?
- Records are paper-based; non-records are digital
- Records document agency functions and activities and are subject to retention schedules; non-records are convenience copies or transitory items (Correct answer)
- Records are classified; non-records are unclassified
- Records require digital signatures; non-records do not
Correct answer: Records document agency functions and activities and are subject to retention schedules; non-records are convenience copies or transitory items
Under the Federal Records Act, records document official agency activities and require formal management, while non-records (extra copies, drafts, personal notes) do not.
CDIA Compliance Standards 4
The DoD 5015.02-STD (now superseded by related NARA guidance) primarily addressed records management requirements for: