RSD

Observations from the ACC Annual Meeting

Hello from Denver! We are wrapping up our presence at this year's annual meeting of the Association of Corporate Counsel (ACC). Early season snowflakes are flying, and conference attendees may end up spending a day or so more in Denver than originally planned. No time better than now to post some thoughts on the last three days.

We’ve not sponsored a booth, reception, or water cooler at ACC before. And while I’ve had numerous conversations with inside counsel (Chief Legal Officers, General Counsel, Assistant General Counsel, etc.) over the last year or so, I’ve never had the opportunity to talk to so many of these individuals at one time. I had dozens of interesting conversations with conference attendees, and learned quite a bit in the process.

Lesson 1: e-Discovery is not the issue I thought it was

One of the significant benefits of adopting an information governance solution like RSD GLASS is a significant, even measurable improvement in e-Discovery efficiency. And this makes sense. RSD GLASS provides a single source of search and access to governed records. These records are those most likely to be requested in the event of litigation, and / or those most likely to be scrutinized as a result of a compliance audit. By placing these records under governance ensures that records are managed in accordance with policy and relevant statutes, which likely results in a dramatic decrease inthe sheer volume of content to be searched and evaluated for potential relevancy. Counsel have a single solution for searching, accessing, and placing litigation holds on this content, across all governed repositories. The efficiency comes from not having to repeat the same search and hold process across countless file plans, repositories, and jurisdictions.

I thought this was going to be a compelling message for this audience. By and large, I was mistaken. Most of the attendees I spoke with already had an e-Discovery solution in place, in parallel with existing records management solutions and technologies. Some had spent significant sums of money purchasing and implementing these solutions, and most were still in the process of doing so. But the majority of conversations I had suggested that these folks were pleased with their e-Discovery solution, or, if not, had the expectation that they eventually would be happy with it.

The logical next step in this discussion is how information governance changes the way companies approach e-Discovery.

Lesson 2: "Information Governance" is a relatively empty label for this crowd

I am fond of describing RSD GLASS as an information governance platform. This allows me to expound on our unique approach to information governance, and also calls out the fact that RSD GLASS is more than a simple application or solution. As well it should be, given the complexities of the business and technical challenges it addresses.

Therefore, in answer to the question, “So what does RSD do?” I began by explaining how RSD GLASS solves information governance challenges, including multi-jurisdictional policy development, cross-repository enforcement, and secure information access. I was surprised at how poorly the topic of information governance resonated with inside counsel. In deepening the conversation, I learned that corporate counsel tends not to get inolved in solving information governance challenges. It's not so much that any of these individuals felt that these benefits were unimportant; no attorney is going to say that policy enforcement is unimportant (although many admit that, nevertheless, their company does not abide by its retention schedule). Rather, it is simply a matter of priorities. They told me their primary interest is in securing the tools, assets, resources and information they need to respond to litigation. This focus is singular and narrow, in sharp contrast to the global perspective addressed by information governance.

The good news is that, well, when it comes to helping handle litigation, we have good news for them as well. And this benefit opened a few eyes this week.

Lesson 3: Defensible Disposition is really, really difficult

RSD GLASS is a significant factor in establishing a legally defensible disposition program. Consider the position of corporate counsel who has implemented RSD GLASS. The conversation with the court can go something like this:

Court: “Give us all records related to this litigation.”

Corporate Counsel of an RSD GLASS Customer: “We have some records related to the matter, but not all of them.”

Court: “Why don’t you have everything that has been requested?”

RSDGCC: “Because we have a corporate information governance policy in place. We have enforced this policy on our records, regardless of their potential relevance to this matter. In fact, here are the full audit trails that show what policy was in place at the time these records were declared, and how the policy was enforced not just on these records you requested, but all records. Disposition is not haphazard; we consistently enforce our policy.”

Court: “Well then. Let’s proceed with what we’ve got.”

100% of the corporate counsel I spoke with these first two days of ACC were unable to have this conversation, because their corporate records management policy is either sporadically enforced, or not enforced at all.

100% of the corporate counsel I spoke with these first days of ACC wished they could have this conversation with the court. These people will greatly benefit from an information governance solution like RSD GLASS.

Lesson 4: Corporate Counsel are resourceful people

As we did last week with ARMA, we sponsored a hybrid scavenger hunt / marketing campaign around RSD GLASS. Conference attendees had the opportunity to come by the booth and grab buttons. Each button had a letter on it: G, L, A, or S. The first group of five who could spell GLASS all won iPads. We had no winners on the first day. In fact, given the audience, this was somewhat problematic, as we were accused of rigging the game, and not distributing a required letter. “We are litigators… a class action suit may result here, if you don’t have any winners.”

Yesterday morning, around 11:00 AM, we finally had our winning group. It started with a single individual who had not previously heard of RSD or our iPad giveway promotion, but quickly understood that the point of the exercise was an interactive one. Find others, whether you know them or not, and get them invested in the promotion. She recruited a handful of others, who then traded business cards and contact information. Within an hour or so, this group of strangers spelled out GLASS. iPads for five! They celebrated with much enthusiasm. It was fascinating to watch this group network.

Congrats to our winners, and thanks everyone for stopping by the booth.

Governing Cloud-Based Content – Both Easier and Harder than it Seems

Once in awhile, as we did this past Wednesday, we’ll talk to a forward-thinking customer who realizes that the question is inevitable, whether they are creating cloud-based content or not: how to govern it?

First the Good News

On its face, the question is simple enough. With RSD GLASS, customers can govern records of any format, regardless of where they reside and how they are stored. And we allow in-place governance, which means that our customers don’t have to migrate content from the existing repository / archive / email server / storage system / physical inventory / etc. to our system. If we can do this, can we not also govern cloud-based content? The answer is the same as for any other repository: it depends.

First, it depends on what kind of governance you wish to employ. Are we talking just simple retention and disposition? E-discovery activities and litigation holds? Or are there additional lifecycles you’d like to automatically enforce, such as storage, metadata, and security lifecycles?

Second, once the governance controls are understood, we then need to determine if the repository supports those controls. If so, and if there is a means for accessing those controls via an API or similar technical interface, then the answer is yes, we can govern that content.

And that is true for cloud-based content as well. Re-read the previous paragraph, substituting “repository” for “cloud provider”, and our position is clear: if the cloud provider supports the governance control, and if they provide a means for leveraging it, then yes, we can govern that content. Intuitively, this makes sense: the nebulous (heh, you see what I did there?) nature of cloud-based content refers mainly to how it is accessed: usually via hyperlink, if not through an application that hides the access from the user. In the back-end, the a cloud-based record still resides somewhere… perhaps in a SharePoint repository, or perhaps on a proprietary repository specific to the cloud provider. All the provider has to do is expose the services offered by the repository, and we’ve got ourselves governance.

Mind you, not all service providers support these types of controls; many did not take governance into account when architecting their offerings. If you are in the market for a Repository-As-A-Service type offering, and if you want the option of governing cloud content in place, these are important questions to ask before you sign.

 

Location, Location, Location

 

But hold on there, Sparky, there is an important consideration that is usually forgotten. But ignoring it can put your company at serious risk of violating important data privacy statutes. We know, despite how the information is accessed, that at the end of the day, it’s sitting there somewhere. Where? No really, WHERE? One of the key benefits of adopting an information governance approach such as the one enabled by RSD GLASS is the ability to demonstrate that you are managing your company information in accordance with applicable laws and regulations. Cloud providers may move data around their infrastructure to maximize internal resource utilization, and minimize cost. They have the ability to move information from, say, a server in France to another in India. From the user’s perspective, this migration is transparent. The same http or https still returns the requested record. From a compliance perspective, however, this could represent a specific violation of European data privacy laws. And no governance technology would be aware of the violation, nor would it be able to prevent it.

 

The Trend: More of This

I won’t lie to you: this doesn’t come up much. Of the customers and prospects I visit, maybe 1 in 5 currently keeps records (mostly email) on a cloud-based infrastructure. But the trend is clear: this issue looms on the horizon. Asking the right questions now will enable you to govern this content with the same confidence as content on traditional repositories and storage systems.

Governing Content on File Shares – Having Your Cake, and Eating It Too

Our customers come to us with a dizzying array and variety of Information Governance challenges. Many customers have unique needs… for example, one of our European customers has asked that we help them govern specific set of physical records: prototype parts created by their suppliers and R&D division, and stored away somewhere in crates in a large warehouse. (After all, not all physical records are documents.) We've also been asked to provide a governance solution for CAD Designs, Audio / Visual Records, and multi-component records comprised of many forms and supporting documents (discrete records in their own right).

Although there are often unique requirements such as these, there is also a consistent set of challenges voiced by nearly every customer and prospect we visit. These include:

• Multi-jurisdictional policy development
• Repository-agnostic policy enforcement
• Cross-repository search and records access

A significant percentage of our customers and prospects (95% or more) tell us that at least two of these issues are high-visibility challenges they must solve in the next year. RSD GLASS represents a unique approach companies are using today to address these problems. Customers, partners, and friends of RSD already know this, so I won’t go into much detail today* on how we solve these Information Governance challenges. 

* - That said, if you are new here, why not take a look at our webinars and other resources. Lots of good stuff there.

Rather, there is a common request I am hearing these days, and I would like to take a moment to explore it in depth. The question goes something like this: “Can you help us govern our content on our network and file shares?”

Peel That Onion, Try Not To Cry

On its face, the requirement seems harmless enough. The organization has some "stuff" on its network, network-addressable storage devices, and local C: drives. They want to apply their retention schedule to it. Unfortunately, when I start asking questions, and they look at the problem a little more closely, they often realize there are some unspoken requirements behind this request:

1. Little-to-no disruption. They usually want to govern the content in place. After all, legal and business users know where to find things on the network. (Don’t they?)
2. They want to automatically classify content. This means scrubbing metadata (which is file system metadata, not record metadata) and document content to infer whether it is a record or not. If a given document or file is a record, classify it according to the corporate taxonomy of records, and apply and enforce the appropriate retention. This is an especially important requirement for customers who have a poor sense as to what records are on their network.
3. Once a document is declared as a record, they want to block attempts to edit or delete the record outside of our governance platform. That is, they want to prohibit a user or system administrator from accidentally (or not) modifying or deleting the record from within the file system itself.

At this point in the conversation, the innocuous little request to govern content on file shares is now revealed to be a much more complex problem than first thought. On the one hand, the customer wants to employ all the necessary governance controls to meet regulatory and legal obligations. On the other hand, they want things to be exactly as they are today. What's so hard about that?

“One Word Can Really Bring You Round – Changes”

 The complexity behind the problem is the same problem ECM originally was supposed to help solve: the network / file share environment is inherently un-governable, from a Records Management perspective. Without specific and potentially very costly IT project work and ongoing administration, the required governance controls to identify, classify, and manage records is simply not possible at a technical level. More simply, a document or folder on a network can be changed or deleted. A record residing on a network or C: drive is not immutable. If it is not immutable, it is not a record.

And the Court will not admit it as such.

So Can This Be Done?

Thankfully, there are solutions. I’ve already suggested the most common solution: ask IT to solve it. IT defines and administers a set of permissions that describe who can read / write / access various drives and network directories where records may reside. They then trust their users (or their chosen auto-categorization technology) properly classify records. IT then applies the appropriate retention periods to these records, using a very small number of categories. To help, the network directory may mirror the taxonomy of corporate records. Enforcement is manual, entrusted to the IT / Network Administrator who periodically purges records with expired retention periods. The Audit Trail is the network log.

I’ve met a customers who have taken this approach; a few can make it work. Cost and complexity of administering such a program increase exponentially as they incorporate more than a few record types, business units, and / or jurisdictions. It can only work in relatively simple, localized, highly-cohesive environments, whose records are rarely, if ever subject to e-Discovery requests or litigation holds.

Most of the companies we talk to don’t fall in any of these categories. The records environment is complex. They lack unlimited IT and network administration budgets. IT and Records Management do not always work in lockstep. They are in highly regulated or litigious verticals. Their needs make it impractical or outrageously expensive to employ network technology as the RM enforcement mechanism. They know this; that’s why they bring us in.

From our perspective, we prefer to take a step back, and examine this question as a business / cultrual one, not a technology one. We examine why they want to maintain records on the network. We remind our customers that, in all likelihood, much of what resides on the network is probably not a record. Then we focus on the small subset of documents that truly are records, and develop an Information Governance program that:

• Prevents the unwanted or unintentional editing or deletion of records
• Allows authorized access
• Automatically (if desired) enforces appropriate lifecycle actions, including declaration, disposition, and a whole host of intermediate actions between these milestones as required by privacy statutes and other policies
• Provides corporate counsel with defensible disposition, showing when, how, and why records were disposed
• Allows litigation holds to be placed on records, thereby freezing the lifecycle of potentially relevant records
• Maintains an audit trail of all actions

The specifics of how these benefits are achieved differ from one implementation to the next. It may be necessary to move records (or a subset of records) to a traditional repository that supports these types of governance controls. RSD GLASS includes a component specifically designed for providing business and legal users the secure cross-repository search and access they expect.

In other environments, the benefit of this kind of migration does not justify the cost of moving records. Instead, these customers ask us to leave those records in place, but still calculate and transmit lifecycle action messages that are then manually enforced by the relevant administrator. To ensure appropriate governance, we can require to manually verify that they have performed the required actions, and record this verification in the Audit Trail.

Often, we take a blended approach: migrating some records to be governed in a repository, and enabling manual governance on the remainder of records left on the network. The openness of our platform and repository-agnostic approach gives us great flexibility to architect the right solution. In the end, we can meet the needs and govern records currently residing on the network.

It’s just a little more complicated than it first seems.

The MER Rookie

The MER Conference was held in my backyard this past week. Hordes (well, hundreds) of industry experts descended upon Michigan Avenue and generally behaved themselves, much as you’d expect of a group of people with graduate degrees in Library Sciences.

We did not host a booth this year. Rather, we sponsored the MER Podcast Series. A number of my RSD colleagues had previously attended a dozen or MER Conferences, and recommended it enthusiastically. I’m glad they did. I attended a Pre-Conference Tutorial, and as many Case Studies and Panel Discussions as I could manage. Here are a couple of observations from a MER Rookie.

Orthodox Records Management 101

My Pre-Conference Tutorial was the AIIM Electronic Records Management Practitioner Certificate Program, facilitated by former Marine Drill Sergeant and Professional Chocolate Connoisseur Jessie Wilkins. For me, this was a useful and thoroughly welcomed introduction into traditional Records Management principles. It provided a nice foundation for the rest of the week’s sessions, as well as important context for my conversations with customers and prospects steeped in these concepts. This is exactly what I expected from this tutorial, and I was glad to get it.

What I was unprepared for was the extent to which the rest of the conference continued to beat on the same themes. In fact, a template for speaker abstracts might go something like this: “Tried and true RM practices will likely suffice, so long as you account for (insert session topic here).” More specifically, I heard the following specific tenets of orthodox RM in multiple sessions:

• Define a small number of very general and highly inclusive buckets of records. It’s just too hard to expect people to adhere to complex retention schedules.
• Manual retention enforcement means RM’s must be diligent about reminding people of the policy, and why they should be adhering to it.
• Event-driven retention, though useful, is very difficult. Instead, apply a broad time-based retention period that will likely meet your intent, even if that means over-retaining some content.
• Auto-classification doesn’t work well for unstructured content, regardless of what the vendors say. RM’s will spend more time reclassifying improperly classified content than they would have spent manually classifying it (or asking users to do so) in the first place.

To this MER Rookie, the irony was obvious: on the one hand, stay with the tried-and-true RM approaches. On the other, these approaches don’t address:

• Accounting for applicable laws, regulations, industry best practices, and internal standards and guidelines.
• Enforcing jurisdictional variances on these mechanisms.
• Making content readily and securely available for business users.
• Applying those policies across a heterogeneous landscape of repositories.

At the risk of channeling Solomon on you, is there nothing new under the sun? In fact, in the few instances where any of these items were mentioned, the speaker or panel did so in the context of how difficult it is to solve these problems. For example, I did hear Julie Gable mention that the future of RM is automatic enforcement of policy… but even here, she left me with the sense that she wistfully regarded this as an ideal future state we may reach some day, shortly after we solve cold fusion and everybody has flying cars.

Records Managers as Salespeople

This theme cut across multiple sessions; there was no single session (that I am aware of) dedicated to this topic. In a nutshell, the takeaway for me was that RM’s need to constantly sell their organization and colleagues on the value of adherence to good RM principles. The difficulty here is that people, including executives, legal, and accounting professionals who should know better, are predisposed to over-retain their records. “Abide by the retention schedule” is not something people want to hear.

In the past, the sales message has been focused on the doom and gloom side. “If we don’t behave ourselves here and consistently apply our retention schedule, bad things will happen.” I sensed widespread agreement that there needs to be a positive side to this message, focusing on improved competitiveness or operational efficiency. I found no information on how to build a business case around this, except for the usual mention of reducing storage costs. In Teresa Drabenstadt’s outstanding session on a RIM Program she helped institute at CUNA Mutual, she cited some impressive storage cost savings as a key benefit. Otherwise, the storage argument seemed unpersuasive to me.

The best friend RM’s have in this process is an enlightened, supportive, and empowered executive sponsor. Indeed, every successful case study mentioned executive support as a key factor. NOBODY, however, had any insight into how to get your executive team on board with an RM / IG program, if the idea wasn’t spawned at the executive level in the first place. Failing this, the best an RM can hope for is incremental improvement in adherence to the retention schedule.

Next Year

I’m absolutely looking forward to returning to MER next year. However, knowing what I know from this year’s conference, I think it may also be beneficial for me as an individual and RSD as a company to assume the role of friendly agitator. MER, and the field of Records Management, needs this. In my informal conversations with fellow attendees, I sensed frustration in the lack of new messages and themes.

As a MER Rookie and RSD employee, I am not disappointed by this. If anything, it is further confirmation of our strategy and positioning of RSD GLASS. After this week, I’m more convinced than ever that our approach is unique and revolutionary. I believe an RSD GLASS customer success story will make for a useful and informative Case Study session.

We are well positioned to lead the conversation away from the shortcomings and pitfalls of traditional Records Management approaches. We’d rather focus on the benefits of a repository agnostic Information Governance platform on which you can define fine-grained, multijurisdictional policies that account for laws and regulations, and automatically enforces these in your file plans.

What a Week in Information Governance

It’s been awhile since I posted a new blog. Things have been quite busy for me – traveling around the globe to talk with customers and partners about the information governance imperative. It’s a very exciting time @ RSD. There are two incidents that occurred this week regarding information governance.

Social Security Statements Goes Electronic

Not only am I the vendor, I am also a user. I have been using electronic bill presentment and payment for years – saving postage and print costs while making my life much easier. This week, the Social Security Administration made a big announcement indicating they were going to stop printing and mailing annual statements. It's an ongoing effort to reduce costs and drive more people to their website. Information governance challenges/concerns:

• Retention/disposition – Without mailing the annual statements out, the preservation duty has shifted to the agency. These are the statements that show how much we get when we retire @ 62, 66, and 70. How long is the agency planning to keep these statements around? The Associated Press estimate about 150 million statements are mailed out each year. Agency needs an information governance program to ensure proper retention/disposition is being applied across these 150 million annual statements.
• Security, security, security – Information governance is ensuring 360 degree protection. I am confident with the right controls, processes, and technologies, the agency will be able to securely deliver the statements over the Web.
• Accessibility – Not sure how many people in the senior community have access to a computer or an iPad. Information governance ensures the right people get the right information in the right format. I am sure there are plenty of advocates handing this issue.

Popular E-mail Service Gets Hacked

In the last 7 days, I received six separate e-mails from credit card companies and vendors I have done business with alerting me there was a data breach which may have exposed my e-mail address to unauthorized third parties. It appears a company called Epsilon had a massive data breach as a result of a phishing attack. It’s good to know this incident did not involve other account or personally identifiable information.

There are tons of statistics from the Ponemon Institute on the costs of data breaches. An information governance program includes the business processes and information lifecycle practices which include more than just retention and disposition. It incorporates data privacy rules and attributes.

Let the spam begin!

{photo courtesy of Flickr ToastyKen}

Gruppo BPER Realizes a 253% ROI in One Year Using RSD Solution

As I have stated before, paper will never go away however there are numerous ways for an organization to reduce the amount of pages printed. Thoughtware Worldwide conducted a detailed analysis on how Gruppo BPER was able to reduce over 150 million printed pages annually by delivering data electronically. In addition to saving ~2000 trees, Gruppo BPER was able to streamline operations and dramatically improve decision making. As opposed to waiting for days to get information, users can now search, analyze, and customize the information.

Gruppo BPER improved customer interactions by reducing processing inefficiencies, better staff utilization, and putting knowledge at everyone’s finger tips for better decisions. The case study represents how data hidden in operational systems can be transformed into actionable intelligence and reduce print.

Read the case study, but please think twice before you print it.

Implementing an Information Governance Solution

Dear Customer,

 

Thank you very much for the recent purchase order for our information governance solution. You should be receiving the software CD in the next couple of days. Please insert the CD and after you run D:\setup, point to the applications that have the highest risk. It’s that simple. If you run into issues, access our online help system. Thank you again for your business and good luck.

 

Sincerely,

Your information governance vendor

 

I wish it was that simple and so do you. In reality, implementing an information governance solution requires more than software and running D:\setup.exe. Your company must document and validate (with executive management) the goals of an information governance program. Management needs to understand where in the company is the biggest risk. Is it in a particular line of business? Is it within a specific jurisdiction? Is it across a set of user groups (i.e. sales, finance, manufacturing)? Select a few areas and determine requirements, timelines, and budget constraints. Wait that’s right, you don’t have any budget constraints.

Step One – Create Information Governance Policy

One of challenges companies are grappling with is capturing all the requirements mandated by applicable laws and mapping them to corporate information and the various business applications and processes. Companies must hold cross functional meetings (stakeholders from legal, IT, business, compliance, and risk) to begin defining information governance policies. As I've stated before, information governance policies have some similarities to records management policies but also have lots of unique attributes. In addition to retention/disposition, information governance policies also include data privacy rules, eDiscovery requirements, metadata management, laws and regulations, as well as storage migration rules. This allows you to get “executive alignment” for managing the entire lifecycle of the record.

Once the policies are defined and validated, it’s time to publish the details to everyone in the organization. This should be published in PDF or HTML as well as an electronic format which can integrate with business applications across jurisdictions. By centralizing the definition of information governance policies, you reduce business risk while lowering your overall policy administration costs.

Stay tuned for step two.

 

Photo is courtesy of somegeekintn/Casey Fleser from Flickr

Sécurité des systèmes d'information

Le CLUSIF a publié la semaine dernière son rapport biennal quant aux entreprises et à la sécurisation de leur système d'information.
S'appuyant sur les réponses de 350 sociétés de plus de 200 salariés, et sur l'analyse des 11 thèmes de la norme ISO 27002 (relative à la sécurité des SI), ce rapport souligne les failles actuelles ainsi que les améliorations mises en œuvre par les entreprises.

Restons optimistes

Nous retiendrons que les entreprises, reconnaissant leur dépendance vis à vis de informatique, sont de plus en plus nombreuses (73%, soit +14% par rapport à 2008)à formaliser leur politique en la matière (67 % confirment l'existence d'une charte Sécurité SI, + 17 % par rapport à 2008.

Une évolution qui s'explique sans doute par l'implication de plus en plus forte de la direction générale dans la politique de sécurité IT de l'entreprise. "La politique de sécurité de l'information des entreprises est massivement soutenue par la direction générale, qui a contribué pour plus de la moitié à son élaboration", constate le CLUSIF.

Il est également intéressant de relever que chez 47% des répondants, la fonction RSSI (responsable de la sécurité du système d'information) existe même si ces responsables sont un peu isolés dans l'entreprise.

Cette fonction est plus souvent liée à la DSI (36%) ainsi qu'à la direction générale (34%). Un second rattachement qui s'inscrit néanmoins en recul comparé à 2008 (45%).
Pour le CLUSIF, "ceci peut s'expliquer par l'arrivée plus nombreuse de RSSI au sein d'entreprises de tailles moyennes ayant un niveau de maturité en sécurité IT encore faible".

Des budgets épargnés

Les budgets restent très serrés, mais par rapport à 2008, la sécurité apparaît comme  une catégorie de dépenses plutôt épargnée.
Poutant le CLUSIF constate des disparités selon les secteurs d'activité. "61% des entreprises du secteur BTP et 43% des Transport et Télécoms ont augmenté leur budget en 2010 parfois de manière très importante : 15% des entreprises du BTP ont noté une augmentation de plus de 10% de leur budget"

Peut mieux faire

Le CLUSIF a ajouté dans son enquête le thème ISO 27002 numéro 9 (sécurité physique), et les résultats montrent pour 41% des entreprises, le responsable des « données papier » n’est pas clairement identifié.

33% (-7% vs 2008) des entreprises ne disposent toujours pas d’un plan de continuité d’activité pour traiter les crises majeures !…
Enfin, les aspects « conformité », pour lesquels des progrès restent à faire, au travers :

• des « obligations CNIL » : en légère progression (68% « conforment », 20% « conforment pour leurs traitements sensibles », respectivement +4% et +1% vs 2008),
• des audits de sécurité : 25% des entreprises n’en font toujours pas !…,
• du tableau de bord de la sécurité informatique : 34% seulement en dispose (malgré les +11%).

A noter également, le sentiment de danger concernant la protection de la vie privée qui augmente (73% « mise en danger de la vie privée - fortement ou un peu », vs 60% en 2008).

Téléchargez l'intégralité des présentations faites par le CLUSIF autour du rapport 2010 sur les Menaces Informatiques et Pratiques de Sécurité en France.

Push, Pull, quels services pour l'information ?

Mise en exergue à la fin des années 90, la distinction "Push/Pull" ne fait plus recette aujourd'hui dans les débats.

Avec le web 2.0 et l'apparition des réseaux sociaux, les responsables marketing tentent de marier les deux avec opportunisme, tandis que les consommateurs et utilisateurs que nous sommes se satisfont d'une approche orientée "pull" ressentie comme plus respectueuse et moins agressive.

Côté entreprise, il semble que l'orientation soit bien différente et que le "push" soit toujours synonyme d'efficacité.

La valorisation de l'information par une distribution sélective

Le travail quotidien dans l'entreprise est bien plus exigeant en terme de disponibilité des informations que la participation à des réseaux sociaux ou plus simplement la consultation de portail web.

Pour répondre aux besoins de rapidité des utilisateurs, les outils "push" font merveille dans la distribution des informations et des documents.

La distribution permet de valoriser une information au service de l'activité de l'utilisateur. Il peut s'agir d'une alerte liée à une métadonnée ou d'un document résumant une transaction ou encore un rapport financier statuant sur une situation à un instant t.
Cette information ou ce contenu est délivré dans le format adapté au besoin de l'utilisateur (courrier électronique, pièce jointe, feuille de calcul, flux CSV ou XML, etc.).
La distribution en push facilite l'interopérabilité des applications par la rapidité à laquelle les informations sont communiquées mais également par sa facilité d'intégration dans une architecture opérationnelle.

Les outils ou fonctionnalités push permettent à la fois un contrôle et une finesse dans la diffusion de l'information pour optimiser les solutions de gestion de contenus et de gouvernance de l'information.

La valorisation de l'information par une exposition pertinente

Ces qualités font que le mode "push" est souvent ressenti comme très efficace mais peu adapté à certains de types de contenus et/ou de public.

Le mode "pull" largement représenté par les sites tant professionnels (mise à disposition de factures, de relevés, etc.) que sociaux (exposition de photos, d'informations, d'avis, etc.) convient bien pour une approche marketing.
Il véhicule et valorise une image de transparence et d'ouverture de l'entreprise.

L'exposition permet à chacun de trouver et de sélectionner, à sa convenance, l'information dont il a besoin. Les fonctionnalités "pull" sont idéales pour valoriser un patrimoine informationnel au service d'une relation client.

Si avec le "push" l'entreprise étendue et l'économie du savoir deviennent une réalité avec le "pull" c'est l'entreprise "citoyenne" (au sens acteur de la vie sociale et économique) du monde qui s'affiche.

"Push-Pull" ou "Push" versus "Pull" ?

Il est probable que les deux ont leur place. Il convient d'être pragmatique et d'utiliser la meilleure technique selon la cible, le contenu et surtout son objectif.

La gouvernance de l'information ne pousse pas à privilégier l'une ou l'autre de ces méthodes pour autant que les actifs informationnels soient utilisés au mieux des intérêts de son propriétaire.
C'est pour cette raison qu'il serait contre productif d'abandonner la distribution en faveur d'une exposition systématique.

Chacun comprend l'intérêt de déposer en "mains propres" de chaque récipiendaire concerné l'information sensible plutôt que de l'afficher dans un espace (même protégé).

8ème Conférence européenne sur l'archivage digital - Genève 28-30|04|2010

Le centre de conférence international de Genève abritait du 28 au 30 avril, la 8ème conférence européenne sur l'archivage digital.

Un nombre impressionnant de participants ont fait honneur aux speakers et il était bien difficile de faire son programme sans avoir l'impression de manquer une présentation ou un atelier important.

Avant de parler des thèmes, nous voudrions partager avec vous notre satisfaction quant à l'organisation de l'évènement et notre coup de coeur pour le travail de signalétique fait par des étudiants de la Haute école des arts de Berne (Hochschule der Künste - Bern) sous la houlette de Jimmy Schmid.  Bravo pour leur créativité et leur sens pratique !

Les thèmes

Les présentations étaient organisées autour de 4 thèmes :

• Profil professionnel : nouvelles compétences à l'ère numérique
• Constitution des fonds : comment documenter la société de l'information
• e-Archivage : réorganisation des processus et des modèles d'entreprise
• accès en ligne : solutions et implications.

e-Archivage

A défaut de pouvoir suivre toutes les présentations, nous avons privilégié l'e-Archivage et la réorganisation des processus et des modèles d'entreprises. La plupart des contributions étaient très intéressantes et nous avons retenu celle de Monsieur Alexander Samarin à propos de la synergie entre BPM (Business Process Model) et archivage électronique [www.improving-bpm-systems.com].
Nous avons également suivi avec intérêt les retours d'expérience du CNES, des Archives nationales de France (le rôle structurant des référentiels), de la Poste française ou encore de de l'AFSSAPS (Agence Française de Sécurité Sanitaire des Produits de Santé) et le projet d'archivage électronique des autorisations de mise sur le marché des médicaments.

L'importance des standards

Les normes et les standards sont au cœur des réflexions, des projets et des expériences. Nombreux sont les pays ou les organisations qui ont choisi le PDF/A comme standard d'archivage pour les documents et plus globalement le contenu non structuré.
Moreq2 et l'annonce de Moreq2010 couplé à un appel à contribution fait partie de ces normes et l'approche plus "verticalisée" de la présentation des exigences de Moreq2 ne peut qu'en faciliter la mise en oeuvre.

Aujourd'hui, la définition des référentiels se fait au regard du respect des standards tels PRONOM [formats de fichiers], IANA [types MIME], ICA, ISO 639, OAIS, Moreq2 et des l'exigence d'interopérabilité.

Enfin, nous retiendrons également le projet d'émulation DIOSCURI présenté par Nationaal Archief of the Netherlands en alternative à la migration par ainsi que SIARD, la solution  d'archivage de bases de données relationnelles développée et mise à disposition gratuitement par les ingénieurs des Archives fédérales suisses.

Il ne nous est malheureusement pas possible de rendre compte de toutes les présentations, aussi merci d'utiliser les commentaires pour partager vos impressions et réactions au contenu de cette note ou à celui des séances auxquelles vous avez pu participer.

Cordialement,

Claude SUPER