36 C.F.R. § 1220.32

Agencies must create and maintain authentic, reliable, and usable records and ensure that they remain so for the length of their authorized retention period. A comprehensive records management program provides policies and procedures for ensuring that:

(a) Records documenting agency business are created or captured;

(b) Records are organized and maintained to facilitate their use and ensure integrity throughout their authorized retention periods;

(c) Records are available when needed, where needed, and in a usable format to conduct agency business;

(d) Legal and regulatory requirements, relevant standards, and agency policies are followed;

(e) Records, regardless of format, are protected in a safe and secure environment and removal or destruction is carried out only as authorized in records schedules; and

(f) Continuity of operations is supported by a vital records program (see part 1223 of this subchapter).