RSD

Step 2 – Implementing an Information Governance Solution

Dear {employee name}

 

Congratulations. You just spent the last two years defining, validating and publishing our global retention schedule. Your team did an excellent job coordinating the cross functional meetings and incorporating all the requirements from legal, business users, compliance, and IT into our information governance policies. Everyone in the company now has access to the retention schedule on our Intranet because of your team’s hard work. Job well done and please extend my congratulations to the rest of the team for completing our information governance project.  Enjoy the rest of the year off…

 

Sincerely,

Information Governance Officer

 

Completing a global retention schedule is certainly a significant and very important milestone, but you are not done. There is more – so much more. After you are done with step one, it’s now time to roll up your sleeves and begin implementing the retention schedule across the entire organization. Most companies have a very complex IT infrastructure – running hundreds of applications across a plethora of technology platforms. These technology platforms support business critical processes, back office operations, and a variety of business applications. To complicate matters, you have to manage these applications across different jurisdictions. Before you continue, you must first recognize you can’t do everything right away. This must be done in phases – typically subject to business cases, funding and resource availability.

Step Two – Map Information Governance Policy to Applications, Processes, and Jurisdictions

Start with the department or business unit in a jurisdiction with the biggest risk exposure. For example, some customers selected their accounting/finance department as the primary target for implementation while others selected product safety. Once this is selected, you need to map the information governance policies that apply to the business unit and “jurisdiction”. You cannot and should not do this alone. For the purpose of this article, let’s use the UK jurisdiction as an example. You need to sit down with the head of your UK operation, compliance manager for UK, the person responsible for all the records for the UK (can be the the same person) and someone from the IT organization who understands all the applications used within the UK operation. It’s also very helpful to have business representation in this exercise. You then need to select and map the information governance policies that apply to UK – internal email, financial records, human resources, customer records, etc, etc, etc.    

The goal is to create a UK “information governance file plan” that includes the entire information governance hierarchy for the UK, along with its security and templates. Corporate records in the UK are grouped according to their file plan, so file plans are implemented as “easy to navigate” folders. The file plan also carries with it a set of rules for evaluating new records that must be properly governed. As new information is being created by the UK operation, the information governance rules are applied which guarantees compliance at content creation time. 

Stay tuned for step three to learn how these policies are enforced.

 

Photo is courtesy of jeanlouis_zimmermann from Flickr.

Gruppo BPER Realizes a 253% ROI in One Year Using RSD Solution

As I have stated before, paper will never go away however there are numerous ways for an organization to reduce the amount of pages printed. Thoughtware Worldwide conducted a detailed analysis on how Gruppo BPER was able to reduce over 150 million printed pages annually by delivering data electronically. In addition to saving ~2000 trees, Gruppo BPER was able to streamline operations and dramatically improve decision making. As opposed to waiting for days to get information, users can now search, analyze, and customize the information.

Gruppo BPER improved customer interactions by reducing processing inefficiencies, better staff utilization, and putting knowledge at everyone’s finger tips for better decisions. The case study represents how data hidden in operational systems can be transformed into actionable intelligence and reduce print.

Read the case study, but please think twice before you print it.

Implementing an Information Governance Solution

Dear Customer,

 

Thank you very much for the recent purchase order for our information governance solution. You should be receiving the software CD in the next couple of days. Please insert the CD and after you run D:\setup, point to the applications that have the highest risk. It’s that simple. If you run into issues, access our online help system. Thank you again for your business and good luck.

 

Sincerely,

Your information governance vendor

 

I wish it was that simple and so do you. In reality, implementing an information governance solution requires more than software and running D:\setup.exe. Your company must document and validate (with executive management) the goals of an information governance program. Management needs to understand where in the company is the biggest risk. Is it in a particular line of business? Is it within a specific jurisdiction? Is it across a set of user groups (i.e. sales, finance, manufacturing)? Select a few areas and determine requirements, timelines, and budget constraints. Wait that’s right, you don’t have any budget constraints.

Step One – Create Information Governance Policy

One of challenges companies are grappling with is capturing all the requirements mandated by applicable laws and mapping them to corporate information and the various business applications and processes. Companies must hold cross functional meetings (stakeholders from legal, IT, business, compliance, and risk) to begin defining information governance policies. As I've stated before, information governance policies have some similarities to records management policies but also have lots of unique attributes. In addition to retention/disposition, information governance policies also include data privacy rules, eDiscovery requirements, metadata management, laws and regulations, as well as storage migration rules. This allows you to get “executive alignment” for managing the entire lifecycle of the record.

Once the policies are defined and validated, it’s time to publish the details to everyone in the organization. This should be published in PDF or HTML as well as an electronic format which can integrate with business applications across jurisdictions. By centralizing the definition of information governance policies, you reduce business risk while lowering your overall policy administration costs.

Stay tuned for step two.

 

Photo is courtesy of somegeekintn/Casey Fleser from Flickr

Don Rumsfield and Information Governance

I was at a barbecue over this past weekend having a general discussion on the latest news, global economy and hottest technology trends when somehow the topic of Don Rumsfield’s infamous speech about known unknowns came up. This speech goes back to February 12, 2002 when former United States Secretary of Defense Donald Rumsfeld made a statement relating to the unstable situation in post-invasion Afghanistan. As I was driving home, it occurred to me the "there are known knowns..." statement can easily map to the information governance challenges companies are facing today.

“There are known knowns. These are things we know that we know. There are known unknowns. That is to say, there are things that we now know we don’t know. But there are also unknown unknowns. These are things we do not know we don’t know. ”

—Former United States Secretary of Defense Donald Rumsfeld

 

There are known knowns – these are things we know that we know.

We all know corporations are dealing with huge volume of information – data about customers, employees, transactions, product development, and operations. According to a well-known survey by IDC, the amount of digital information created annually will grow by a factor of 44 from 2009 to 2020.  Even though more than 70% of the information is generated by individuals, organizations are responsible for managing and protecting 80% of it. We know this is an issue in terms of employee productivity, value creation, and risk mitigation.

• Employee productivity – Thanks to popular search engines and social media sites, we know we can find information we are looking for very quickly. Corporate employees are expecting the same capabilities when they come into the office Monday morning. Employees are more technical savvy these days. Employees know what they are looking for; they just spend too much time looking for it. Management knows this because they are in the same boat.
• Value creation – There is tremendous value in corporate information, so we know we can’t delete everything immediately. Companies must keep information to support their customers, drive product innovation, and make critical business decisions.
• Risk mitigation – We all know there is risk associated with information so I am not going to repeat what you already know. Bottom line, why keep information around if you don’t need it?

There are known unknowns. That is to say, there are things that we now know we don’t know.

We now know there will be ongoing eDiscovery requests and they are not going away anytime soon. According to a Gartner study, at any point in time many corporations are involved in an average of 86 lawsuits. Legal counsel doesn’t know when the next lawsuit will occur, who will be involved, and what information the courts will be looking for. Nevertheless, organizations need to be prepared and consider deploying a proactive eDiscovery project.

We now know there will be new rules and regulations around information management. With the various headlines in the last couple of months and the continuing global financial crisis, we do know there will be tougher regulations with new compliance laws. We just don’t know the details yet.

We also now know data privacy is becoming a hot topic around the world – from employee email privacy considerations to Facebook to Twitter. It seems like there is no end. Just last week, the Swiss parliament agreed to help IRS identify secret UBS accounts in tax probe. We don’t know when this will end and how this will evolve in the next couple of years.

Finally, we do know now solving the information governance challenge must be a top-down approach – otherwise it will be difficult to succeed. One of the key questions I get from customers is where to start, when to delete content, and how to go about managing this process. Someone within the organization (typically from legal) needs to stand up and bring the issue to the attention of the executives. Executives must first acknowledge there is an issue and then have a commitment to resolve it. This will only work when management brings in various stakeholders from the organization including legal, business, compliance, and IT.

But there are also unknown unknowns. These are things we do not know we don’t know.

Companies do not know what’s going to happen in the next 5-10 years. Surely, companies have strategies, growth tactics, mission statements, and contingency plans – but at the end of the day companies have very little control over external factors, mergers and acquisitions, new technology offerings, and the competition. This is precisely the reason why an information governance program is required. Information governance is an accountability program to enforce desirable behavior in the creation, use, archiving, and deletion of corporate information. I like to explain it as a vehicle to drive value from information and as an insurance policy on the unknown unknowns.

Thoughts from IBM Impact 2010

I just got back from the IBM Impact conference in Las Vegas. I really didn’t know what to expect as this was my first time attending Impact. IBM invited me to present on information governance and explain how companies can better manage their risk around corporate information. Before departing to Las Vegas, I reached out to my network to learn this conference was primarily a technical conference. Historically, this conference may have focused on technology however it seems that IBM has done a great job introducing business topics to this event. 

During the conference, I heard great customer case studies about cloud computing, service oriented architecture, and business process management. I learned that the mainframe is not going anywhere anytime soon and how cloud computing is for real. I have to say the theme on Wednesday was my favorite – technology changing as fast as the business changes. We are all aware business strategies are forced to change in this economic climate and how quickly IT reacts will make or break an organization.  

However, companies also need to respond to external conditions such as new regulations and laws as well as litigation and competitive threats. I was somewhat surprised there were limited conversations about the impact legal and compliance have on technology deployments and business processes. I certainly understand this may not be the primary audience for this type of discussion – but there is a very strong connection.

Enterprise systems exist to manage processes, line of business applications, and corporate information. There are hundreds, if not thousands, of different laws and regulations for managing corporate information. Exactly how does a company:

1) Capture these laws and regulations?

2) Understand the impact these regulations have on the business and IT organization?

3) Map the laws and regulations to their corporate information repositories?

4) Enforce the laws and regulations across the enterprise complex infrastructure?

This is where information governance comes in and why I attended Impact 2010. Information governance is an accountability program to enforce desirable behavior in the creation, use, archiving, and deletion of corporate information. Information governance enables companies to not only align IT with business – but also with the other corporate functions such as legal, finance, compliance, and records management.

An information retention schedule sets out the periods for which an organization’s corporate records should be retained to meet its operational and business needs and to comply with legal and other requirements. The retention schedule is just one component of information governance that protects the interests of the company and its stakeholders.

After my session and throughout the conference, I had fruitful discussions around the challenges of getting all the stakeholders (IT, business, compliance, and legal) on the same page to create the retention schedule. It’s quite difficult and there is no silver bullet. At the end of the day, each function needs to recognize the benefits of deploying an information governance framework and each function will need to give in order to receive.

The question I leave you with:

What if technology can change as fast as your information retention schedule?

See you next year in Las Vegas.

Review of AIIM 2010

I first attended AIIM back in 1997. Over the last few years, the AIIM conference managed to keep its momentum despite the consolidation of ECM vendors and tight travel budgets. This year’s AIIM conference seemed to be very busy as the expo hall was constantly crowded and some of the sessions were packed.  Here is my summary of AIIM 2010 – or should I say the unofficial SharePoint user conference.

SharePoint is Everywhere

Microsoft didn’t have a booth at AIIM in 1997. They only recently started to get involved with AIIM with the development and adoption of SharePoint 2007. In 2008, Microsoft claimed over a billion dollars in SharePoint sales. According to a recent Gartner survey, 50% of all organizations (large and small) have piloted or deployed SharePoint as a key element of their overall information infrastructures. During AIIM, I had the opportunity to see SharePoint 2010. Kudos to Microsoft. They enhanced the (much needed) search facilities, revamped the user interface, delivered basic records management capabilities, and with promised better scalability. I am now telling everyone “SharePoint 2010 was MY idea.” I counted over 20 different vendors offering a huge variety of services and products around SharePoint. There was even a dedicated SharePoint pavilion for partners, integrators and complementary technologies. I saw great demos from KnowledgeLake and NteliPath on imaging services for SharePoint. NextPage seems to have a unique information governance solution for SharePoint.

eDiscovery Pavilion

The concept of eDiscovery really didn’t exist at AIIM 1997. However, with the introduction of FRCP and the high costs associated with litigation, eDiscovery is becoming a hot topic within corporation. With AIIM being an “information management” association, it absolutely makes sense to discuss eDiscovery. However the current challenge for corporations with eDiscovery is getting alignment between IT, business, and legal. Furthermore, most of the discussions around eDiscovery have been limited to email archiving, reactive products (i.e. let’s search our 500 servers), and the consulting services to assist with eDiscovery. I didn’t hear many people at AIIM really talk about being proactive and what it takes to be litigation ready. There is a very well known case study by DuPont detailing the costs when companies do not have an information governance solution for eDiscovery readiness. The case study concluded over 39 million documents were reviewed during litigation that were past their retention period which cost in $12 million. Most of the ECM vendors at AIIM already have some type of message around eDiscovery (but did not really promote it) or will make one up before next year’s AIIM. For AIIM 2011, I predict there will be many more vendors in the eDiscovery pavilion.

Records, Records wherefore art thou Records?

At AIIM 1997, everyone (including me) was talking about efficient ways of keeping all the content in your business just in case someone may need it in the future. I agree with Barclay Blair that for most organizations keeping everything forever is not a viable option. I have said this before and know it’s not that simple to implement. When talking with customers, the biggest obstacle is to have agreement between all the stakeholders on exactly what needs to be kept and for how long. This conversation is not an hour long discussion and it’s no longer an IT or business decision. It involves legal, compliance, data security and finance. It also includes a proactive program which incorporates all the components of the lifecycle of the content – not just retention and disposal (data privacy, regulations, storage platforms, metadata). I discussed the difference between information governance and records management before and Greg Clark also wrote a good article on this topic.

Summary

AIIM 2010 was an excellent event for me. I was able to connect with customers, chat with partners, bump into old colleagues, and meet new people in this fascinating industry. At the end of the day, the main principal of AIIM hasn’t really changed since 1997. It’s all about companies using technology to efficiently better manage their number one asset – information. See you next year in Washington, DC.

Importance of PCI Compliance

Last week, I was finalizing my information governance presentation for the upcoming IBM Impact 2010 conference. I have this excellent slide that shows the relationship of the entire content lifecycle with the different stakeholders in the organization – Privacy Officer, Security Officer, legal counsel, and of course IT. When I usually present this slide I give specific examples related to HIPPA, Sarbanes Oxley, and DOD 5015.2. One example I sometimes leave out is the Payment Card Industry Data Security Standard (PCI DSS).

PCI applies to all organizations or merchants, regardless of size or number of transactions, that accepts, transmits or stores any cardholder data. A simpler way of saying this – if any customer of that organization ever pays the merchant directly using a credit card or even with a debit card, then the PCI DSS requirements apply.

PCI is designed to prevent hackers and criminals for targeting credit card theft and its subsequent fraudulent use of customer data. The intent of PCI is to make it much harder to obtain credit cardholder data due to the more robust and standardized approach to data security. Unfortunately, as I have seen, many companies are still struggling to demonstrate PCI compliance. The costs and effort associated with meeting PCI requirements can sometimes be daunting. However, so can the fines. Fines can amount from $5,000 to $100,000 per month for PCI compliance violations. How about brand reputation and stock price?

Some of the requirements for PCI include building and preserving a secure network while maintaining a vulnerability management program. Also included is to implement strong access control which includes protecting and encrypting cardholder data. This includes new data being generated as well as content stored for years and years.

The PCI Security Standard Council published a new version (1.2) of the PCI DSS in October 1st 2008, which includes 12 major requirements. The Lifecycle Process for changes to PCI DSS is currently in stage 3; stage 5 is expected to end by September 30th 2010 with the publication of a new version. 

When defining and planning a PCI program scope, one of the first action items is to know what is in and what is out of scope - including systems, content repositories, storage platforms, networks, people, and processes. As I have said many times before, measure your risk but don't ignore it.

Information Governance versus Records Management – What’s the Difference?

It’s a beautiful thing when a new industry term comes out and having an influence on the definition and usage of the term. In the last 9 months, the term information governance has been used more and more – by industry analysts, companies, and vendors. Even though the usage has expanded, there still is not 100% agreement on the definition. However, most people will define information governance as the means to help organizations manage corporate risk and improve operational efficiency as they work to achieve compliance with regulations and laws governing enterprise information. Sounds very much like records management, right?

Information governance goes beyond the existing “state-of-the-art” of records management applications. Here is how I separate the two. In the emerging information governance market, managing the lifecycle of the content not only covers the retention and disposition of the record but the complete management of the metadata of the record, tiering of content across storage platforms, security classification of the content during its lifecycle, data privacy attributes of the record during its lifecycle, and finally digital rights of the content when it goes outside the firewall (because that never happens).  Essentially, information governance programs are a superset of records management programs and feature similar methodologies and processes.

Information governance is also more of an accountability program to enforce desirable behavior in the creation, use, archiving, and deletion of corporate information. It includes the lifecycle management practices to address eDiscovery readiness, information risk management, business information lifecycle management, and federated archiving. Information governance clearly defines the roles and responsibilities with detailed metrics and auditing. It requires a cross functional committee involving legal, compliance, business, and IT.

Unlike current records management solutions, information governance enables central management of retention policy and metadata, while supporting the enforcement of information governance policies across business functions, locations, and information silos. Information silos include both structured (databases and data warehouses) and non-structured repositories (enterprise content management, document management, paper records etc).

Most of the traditional enterprise content management (ECM) vendors are now jumping on the information governance bandwagon and repositioning their records management products (which were most likely acquired) as an information governance solution. Fasten your seatbelts; it will be a fun ride.

Records and Data Privacy – Should You Be Worried?

During the last few months, we heard of several high profile stories about data theft and privacy issues. While most of the recent cases we hear about involve banks or financial services – this can occur in any industry. For example, the BBC just reported the medical records of 2,000 patients were lost at Haywood Hospital. The records are of 2,000 patients who had physiotherapy at Haywood Hospital in 2006 and have since been discharged and may have been destroyed in error, under what it calls "confidential conditions".

This is just one of the reasons why information governance is a top priority at most of organizations worldwide. An information governance program allows companies to implement the correct security controls, data privacy rules, proper encryption methodologies and audit facilities.

Security controls – Who needs access to what? What should the user be allowed to do once they have access to the information (i.e. download or print)? How is the security being enforced across all the information silos?

Data privacy rules – The legal protection of the right to privacy in general - and of data privacy in particular - varies greatly around the world. Who in your organization is monitoring these laws? How are these laws being implemented and enforced in your records management and electronic content management system? Does any information in the document (such as social security number) need to be redacted?

Encryption methodologies – There are dozens of different encryption methods and programs available. I am not an expert on encryption but do know some are good, some are not. What’s important is that when information gets archived, your organization utilizes the proper encryption tool so if data does leak out, it’s unreadable.      

Audit facilities – Most applications create an audit trail. Often times, these audit trails do not get analyzed or shared with the compliance team or auditors. Companies must keep track of who, what, when, where, and how.  Who accessed what?  When did they access it?  Where did they access it from? How did they access it (internal application versus CRM system)?

Bottom line, information within the organization must be treated as an asset but also as a liability. So the next time you open a bank account and provide a significant amount of personal data to a total stranger – just hope they have a well defined information governance program in place.

{picture courtesy of rpongsaj from Flickr}

RSD Announces New YouTube Channel

A few years back, my friend sent me a rare video of Bruce Springsteen performing Rosalita in a small New Jersey club. He then challenged me to type anything into the search box to get immediate results. I was instantly hooked (and so were you) – spending countless hours looking for rare performances and watching some of the funniest videos from around the world. 

In the last 18 months, companies started using YouTube as a communication channel. RSD is pleased to announce a new channel on YouTube. The channel will be used to share industry trends, best practices, customer case studies, executive interviews, and exciting product news. We hope you enjoy the channel and welcome comments and feedback. 

Hurry up – get some popcorn and start watching!