Review/Approval History
- 11/08/2017 ISC&ET Subcommittee Reviewed and approved
- 01/13/2021 ISET Subcommittee Reviewed and approved
- 02/17/2021 ITGEC Reviewed and approved
The CSUSB supplemental information retention schedule applies to those records that are not specified in the CSU Records/Information Retention and Disposition schedules (http://www.calstate.edu/recordsretention). The following table provides a campus schedule for electronic records generated by the university. When in doubt, CSU Records/Information Retention schedules have precedent over this schedule.
Definitions:
Records Custodian: The individual with responsibility for the maintenance and disposition of official/original copies of records maintained by his/her department/area.
Record Disposal: The intentional discarding, abandonment or destruction of information. Record Disposal is most often associated with the sale, donation, transfer, or discarding of any medium upon which information is stored, including computer equipment.
Record Retention: The maintenance of records for prescribed time periods.
Retention Period: The period of time that a record should be kept.
Record Value: Records may have value in one or more of the following areas:
- Operational: Required by a campus/department to perform its primary function.
- Legal: Required to be kept by law or regulation, or may be needed for litigation or a government investigation.
- Fiscal: Related to the financial transactions of the campus, especially those required for accounting, audit or tax purposes
- Historical: Of long-term value to document past events.
- Vital: Critical to maintain to ensure operational continuity for the campus after a disruption or disaster. Vital records or information may fall into any one of the above value categories.
| Record | Record Description | Custodian | Record Value |
Retention Period |
Disposal |
|---|---|---|---|---|---|
| 1 | Activity and systems logs from information systems and applications. | CIO | O,L | No less than 180 days | Industry Best practice |
| 2 | Network and security devices logs | CIO |
O,L |
No less than 180 days | Industry Best practice |
| 3 | Email transaction logs | CIO |
O,L |
No less than 30 days | Industry Best practice |
| 4 | Digital investigation reports, including digital forensic images and physical evidence. | ISO | O, L | Seven years from the date of preservation unless it is requested to preserve the information for a longer period of time. | Follow standard university procedures for the disposal of Level 1 information. Will not dispose of any preserved information during the retention period without the approval of the requester or appropriate entity on campus. |
| 5 | Digital Millennium Copyright Act notifications | ISO |
O, L |
3 years from the date of notification. | Industry Best practice |
| 6 | Employees electronic communication such as e-mail content and attachments, digital documents stored in university central servers such as file servers, web servers, cloud computing services. |
CIO |
O, L |
30 days from official date of separation from the university. Unless it is requested to preserve the information for a longer period of time, or there is a litigation hold on the information. | Industry Best practice |
| 7 | Email archive containing employee's email only. |
ISO |
O, L |
Retain last 30 days of all incoming and outgoing university email. | Rolling archive of 30 days |
| 8 | Employees voice mail recordings | CIO |
O, L |
180 days from date of message, dispose upon separation from the university. Unless it is requested to be preserved for a period of time or there is a litigation hold in the information. |
Industry Best practice |
| 9 | Employees Zoom recordings | CIO |
O, L |
120 days from recording. Unless it is requested to preserve the information for a longer period of time, or there is a litigation hold on the information. | Rolling automatic deletion of 120 days |