RSD

Information Governance and ROI

How do you calculate the Return On Investment (ROI) as it pertains to information governance? On the one hand, this may not even be the right question. As our CTO Bassam Zarkout recently asked members of the Detroit ARMA Chapter, “Would you ask what the ROI is for your fire safety systems? How is risk mitigation associated with your records management program any different?”

Nevertheless, executives often require demonstrable ROI before they sign off on the organizational commitment information governance requires. Many of the key benefits of deploying an information governance platform are intangible:

• Operational efficiencies from secure, rapid information access, and from automating record lifecycle actions
• Assured compliance with applicable laws and regulations
• Improved e-discovery processes

The problem is that applying hard dollar values to these benefits requires that customers clearly understand costs underlying their current state of affairs. Do you have that kind of visibility into your records management processes and the costs associated with those? How much does an e-discovery request cost? What are the administrative costs incurred by manual tasks related to record disposition, migration, or enforcing security and privacy controls?

Some costs are relatively well understood. Let’s take a look at two of them today, and how they might comprise part of the information governance business case.

Storage

I am not a storage expert. If I were to pretend otherwise, this would become immediately evident to those of you who are. But I know enough to marvel at the amazing calisthenics IT Executives and Administrators must perform in order to meet demands imposed upon them by business and legal entities. First, IT must overcome the assumption that storage is cheap. This is partially true, insofar as storage devices are concerned: the cost of this hardware is indeed falling. The cost of administering those devices, however, is not. At the most basic level, consider the environmental costs… machines need space and consume power to operate without melting. On top of those costs, IT executives must hire people to perform periodic backups, transfer archives between storage media, and respond to requests to produce archived information as required by litigation and normal business activities. Business owners and legal teams (who, let’s face it, should know better) demand that IT retain information indefinitely… “Yes, I know we have a retention schedule, but ignore it for now, and keep these records, just in case!” The volume of information is increasing exponentially, and with it, the costs associated with all this stuff (technical term) that must be stored. These demands could be easily met if IT budgets were increasing in lockstep with these demands. This isn't 1997... they aren’t.

And so I marvel at the creativity of the IT Executives I meet. To keep systems healthy and functional, within the constraints imposed by budgets, Service Level Agreements, and regulatory obligations, IT leaders must reshuffle projects and priorities, as they and their teams are asked to do more with less. As economists are wont to say, this is not sustainable. At some point, those deferred projects must begin. That SAP upgrade, CRM Rollout, or mainframe migration isn’t going to wait forever. And at that point, companies who haven't will have to take a second look at storage.

Every IT Executive I have met knows exactly what their storage costs are, mainly because they are constantly having to make the case to increase their annual storage spend. They can easily match those costs with the potential savings incurred simply by adhering to the retention schedule that is already in place. “X Petabytes of information could be disposed today, multiplied by $ dollars per petabyte per year.” Add the rolling future savings of planned disposition activities (dashboards are a wonderful source of this kind of information), and you’ve got yourself a compelling ROI right off the bat. Policy-based storage tier transfers can bring additional savings, as content is migrated from fast, expensive Tier 1 storage to cheaper tiers.

To be sure, most of this is not new. What IS revolutionary, however, is the notion that the storage lifecycle of records (just like privacy and security lifecycles, in addition to the disposition period of the record) should be part of an overall information governance policy, and enforced as such. It won’t be long before IT Executives are going to be very, very interested in Information Governance, as the key means for reducing storage costs. In fact, many already are.

Policy Updates

How long has it been since your retention schedule was refreshed? How did that go?

A significant majority of the customers I talk to tell me that the process of updating the retention schedule is so painful, they put it off for as long as they can. Once every two years is common... I have heard up to 5 years between updates. When they explain to me what they do, I understand why they procrastinate. A typical process could include some or all of the following:

• Field surveys completed by business owners, legal, and records managers, providing feedback on policy and allowing them to formally register change requests
• A review of relevant statutes, industry guidelines, and internal standards for records management
• Redesigned business processes, to account for the manual enforcement activities required by the retention schedule
• Accounting for acquired entities, who perhaps brought their own retention schedule that must now be incorporated
• Approvals from legal, risk, compliance, privacy, security, records management, IT, and / or business executives (a group that we would call an Information Governance Steering committee... but hold that thought)

That’s a full time job by itself! Which is exactly the problem… all the people involved in this conversation have “Day Jobs”, as it were… they have higher priorities, and are often (usually? always?) reticent to set those aside and get involved in this process. For this reason, outside consultants are often hired to review and update the retention schedule, usually for significant sums of money.

What if, instead of bringing in consultants to review and update the retention schedule, companies had a collaboration platform used by their Information Governance Steering Committee? (Still holding that thought? We’ve got a webinar coming up that walks through the role of a IG Steering Committee, and how to charter one if you haven’t already.) There are a number of significant and compelling benefits to this approach… but since we’re talking ROI today, let’s focus on the dollar savings. Instead of making wholesale changes to the entire policy every 2 or 3 years, a policy collaboration environment like RSD GLASS Mosaic allows members of the steering committee to continuously and incrementally refine policy as needed. Since Mosaic policies are both human- and machine-readable, socialization and automatic enforcement of the policy changes can begin immediately, regardless of where the information resides.

Policy change need not be the painful, expensive process most companies undertake today. The savings derived from migrating from a monolithic change management process to an incremental one should absolutely be included in an ROI calculation.

How to Form an Information Governance Committee

When embarking on an information governance initiative for the enterprise, conventional wisdom continually indicates that one of the first steps should be the formation of an information governance committee.  This is easier said than done.  How can you be sure that the right parties are at the table?  How do you gain buy-in from other departments in a siloed organization?  How do you align interests and objectives in a productive manner?  If you want to see your information governance program succeed, forming a committee is a key step... but where do you start?

RSD is hosting a complimentary webinar to address this very subject.  Join RSD's Director of Marketing Tamir Sigal on Thursday, February 2, 2012 at 11am EST as he walks through the steps required to form an effective information governance committee, the challenges you can expect to encounter, and why a committee is necessary for the success of any information governance program.

Register here!

RSD Industry Chats

RSD is pleased to announce Industry Chats!  This is an ongoing series of unscripted interviews with the team at RSD.  You’ll hear a variety of topics, including discussions regarding RSD and our solution GLASS, federated records management, information governance, and more.

In this first video in the series, RSD’s CTO Bassam Zarkout discusses information governance.

Keep checking back on our website for more Industry Chats!

2011 in Review – Pop Culture Meets Information Governance

Wow, it’s already the end of December. It’s been an exciting, busy, and fun year at RSD as we continue to work with our customers on addressing their information governance challenges. I know there are going to be dozens of articles on reviewing 2011 and predicting the next big trends, I thought it would be fun to combine 2011 pop culture with trends we will most likely see information governance in 2012. Also included at no charge are ten recommendations for 2012.

Album of the Year: 21 from Adele

“Here's a fire starting in my heart, reaching a fever pitch, it's bringing me out the dark”

Historically, records management was a corporate function buried in the basement or locked away in the dark somewhere in some offsite storage facility. Records mangers were focused on paper records, ensuring records were retained in a reliable and authentic manner and are ultimately disposed of in accordance with a retention schedule. Today, things are much different. Management of corporate information is becoming a topic of discussion at the executive level because of the consequences of information mismanagement  – brand damage, stock price, fines, and revenue. This is precisely why the records management function is beginning to report to general counsel and getting a seat at the table where strategic decisions are being made.

2012 Prediction: I don’t want to be the hundredth person to tell you to get executive buy-in for your records management program. This is going to be a slow process. I suggest starting to create awareness in your organization, starting with your peers (in other functions) and making this part of the department/corporate objectives.

Book of the Year: Unbroken from Laura Hillenbrand

“Though all three men faced the same hardship, their differing perceptions of it appeared to be shaping their fates”

Information management applies to everyone in the organization – regardless role, level, or jurisdiction. One of the top challenges facing companies is determining who owns this problem. Some say it’s legal, others claim IT, and a few maintain the business owns it. This is just one of the reasons why the current process is broken. Organizations must develop an overall governance strategy that includes a closed-loop records management program – from policy creation time through policy enforcement over the decades-long lifecycle of corporate records. These strategies must be also aligned with IT reality and cost constraints with a well-defined set of stakeholders, policies and procedures. The program’s objectives are to advance the corporate compliance agenda, mitigate risks and improve value of information. The tactics of the program consist of applying “legally defensible” governance controls over corporate information throughout its entire lifecycle.

2012 Prediction: IT is going be driving more and more projects to support the information governance program. According to a December Gartner report (G00227336), by 2016, 20% of CIOs in regulated industries will lose their jobs for failing to implement the discipline of information governance successfully.

Movie of the Year: Transformers 3

“You simply fail to understand, that the needs of the many outweigh the needs of the few...”

Information governance policies and objectives cannot and should not be developed in a vacuum. You must get consensus throughout company on policy, then add local stipulations. Policies should also incorporate attributes associated with the business, IT, legal, and compliance:

• Retention/disposition (i.e. when can we safely delete information)
• E-discovery (i.e. legal hold, data map)
• Data privacy (i.e. Personally Identifiable Information)
• Storage lifecycle (i.e. automatic tier migration)
• Metadata lifecycle management (i.e. keeping full text index for the life of the record)
• Laws and regulations (i.e. justification around the policy)

2012 Prediction: Expanding existing policies to include all of these elements will take time; certainly beyond 2012. However, in the near-term (that’s 2012), many more multinational organizations will consider jurisdiction-specific rules and include the business owners in the policy development process. According to a recent Forrester Report; 53% are not satisfied with their records management solution’s support for international requirements.

App of the Year: Words with Friends

“Word building, triple score seeking, chat bubble sending goodness with simple and familiar gameplay you know and love”

SharePoint 2010. Enough said, right? Well, sort of. Take it from me, SharePoint has certainly dominated the market this last couple of years. One of the reasons is because it’s simple to use and integrates well into the Office environment. The big question on the table is the impact SharePoint has on an information governance program. As usual, some companies have addressed this pretty well. If you haven’t, here’s a hint: start with your policies.

2012 Prediction: SharePoint 2010 came along way in terms of records management functionality and you will hear more and more case studies on how (and why) organizations are standardizing on SharePoint.

Final Words

Based on what I am reading and hearing from our customers, 2012 will be an exciting year for information management professionals. Top ten 2011 takeaways and suggestions for 2012:

1. Why not, boil the ocean at once.
2. Don’t forget about “Small Data”.
3. Understand the impact of records management on social media (this blog is a record, so there!)
4. I personally prefer “reactive” e-Discovery, don’t you?
5. Use the cloud for everything…and yes, I mean everything.
6. Job security: everything you do should not be repeatable or defensible.
7. eDiscovery, records management, information governance are not the same sides of the same coin. I am sorry, that’s just not possible.
8. Information governance means what you want it to mean.
9. Explain SharePoint 2010 governance to users. They will appreciate it.
10. Have fun and to quote the late Steve Jobs, “Think Different”.

Happy Holidays and New Year.

Observations from the ACC Annual Meeting

Hello from Denver! We are wrapping up our presence at this year's annual meeting of the Association of Corporate Counsel (ACC). Early season snowflakes are flying, and conference attendees may end up spending a day or so more in Denver than originally planned. No time better than now to post some thoughts on the last three days.

We’ve not sponsored a booth, reception, or water cooler at ACC before. And while I’ve had numerous conversations with inside counsel (Chief Legal Officers, General Counsel, Assistant General Counsel, etc.) over the last year or so, I’ve never had the opportunity to talk to so many of these individuals at one time. I had dozens of interesting conversations with conference attendees, and learned quite a bit in the process.

Lesson 1: e-Discovery is not the issue I thought it was

One of the significant benefits of adopting an information governance solution like RSD GLASS is a significant, even measurable improvement in e-Discovery efficiency. And this makes sense. RSD GLASS provides a single source of search and access to governed records. These records are those most likely to be requested in the event of litigation, and / or those most likely to be scrutinized as a result of a compliance audit. By placing these records under governance ensures that records are managed in accordance with policy and relevant statutes, which likely results in a dramatic decrease inthe sheer volume of content to be searched and evaluated for potential relevancy. Counsel have a single solution for searching, accessing, and placing litigation holds on this content, across all governed repositories. The efficiency comes from not having to repeat the same search and hold process across countless file plans, repositories, and jurisdictions.

I thought this was going to be a compelling message for this audience. By and large, I was mistaken. Most of the attendees I spoke with already had an e-Discovery solution in place, in parallel with existing records management solutions and technologies. Some had spent significant sums of money purchasing and implementing these solutions, and most were still in the process of doing so. But the majority of conversations I had suggested that these folks were pleased with their e-Discovery solution, or, if not, had the expectation that they eventually would be happy with it.

The logical next step in this discussion is how information governance changes the way companies approach e-Discovery.

Lesson 2: "Information Governance" is a relatively empty label for this crowd

I am fond of describing RSD GLASS as an information governance platform. This allows me to expound on our unique approach to information governance, and also calls out the fact that RSD GLASS is more than a simple application or solution. As well it should be, given the complexities of the business and technical challenges it addresses.

Therefore, in answer to the question, “So what does RSD do?” I began by explaining how RSD GLASS solves information governance challenges, including multi-jurisdictional policy development, cross-repository enforcement, and secure information access. I was surprised at how poorly the topic of information governance resonated with inside counsel. In deepening the conversation, I learned that corporate counsel tends not to get inolved in solving information governance challenges. It's not so much that any of these individuals felt that these benefits were unimportant; no attorney is going to say that policy enforcement is unimportant (although many admit that, nevertheless, their company does not abide by its retention schedule). Rather, it is simply a matter of priorities. They told me their primary interest is in securing the tools, assets, resources and information they need to respond to litigation. This focus is singular and narrow, in sharp contrast to the global perspective addressed by information governance.

The good news is that, well, when it comes to helping handle litigation, we have good news for them as well. And this benefit opened a few eyes this week.

Lesson 3: Defensible Disposition is really, really difficult

RSD GLASS is a significant factor in establishing a legally defensible disposition program. Consider the position of corporate counsel who has implemented RSD GLASS. The conversation with the court can go something like this:

Court: “Give us all records related to this litigation.”

Corporate Counsel of an RSD GLASS Customer: “We have some records related to the matter, but not all of them.”

Court: “Why don’t you have everything that has been requested?”

RSDGCC: “Because we have a corporate information governance policy in place. We have enforced this policy on our records, regardless of their potential relevance to this matter. In fact, here are the full audit trails that show what policy was in place at the time these records were declared, and how the policy was enforced not just on these records you requested, but all records. Disposition is not haphazard; we consistently enforce our policy.”

Court: “Well then. Let’s proceed with what we’ve got.”

100% of the corporate counsel I spoke with these first two days of ACC were unable to have this conversation, because their corporate records management policy is either sporadically enforced, or not enforced at all.

100% of the corporate counsel I spoke with these first days of ACC wished they could have this conversation with the court. These people will greatly benefit from an information governance solution like RSD GLASS.

Lesson 4: Corporate Counsel are resourceful people

As we did last week with ARMA, we sponsored a hybrid scavenger hunt / marketing campaign around RSD GLASS. Conference attendees had the opportunity to come by the booth and grab buttons. Each button had a letter on it: G, L, A, or S. The first group of five who could spell GLASS all won iPads. We had no winners on the first day. In fact, given the audience, this was somewhat problematic, as we were accused of rigging the game, and not distributing a required letter. “We are litigators… a class action suit may result here, if you don’t have any winners.”

Yesterday morning, around 11:00 AM, we finally had our winning group. It started with a single individual who had not previously heard of RSD or our iPad giveway promotion, but quickly understood that the point of the exercise was an interactive one. Find others, whether you know them or not, and get them invested in the promotion. She recruited a handful of others, who then traded business cards and contact information. Within an hour or so, this group of strangers spelled out GLASS. iPads for five! They celebrated with much enthusiasm. It was fascinating to watch this group network.

Congrats to our winners, and thanks everyone for stopping by the booth.

Thoughts from ARMA 2011 Conference – My Three Takeaways

I just returned from the ARMA 2011 conference, held at the Gaylord Resort at the National Harbor in Maryland. I have been to ARMA several times in the past (more times that I would like to admit) and happy to see ARMA is pushing the envelope with the program and content. This is certainly required to keep the records management function relevant in today’s organization.

Going up, 17^th floor please

The first time I attended ARMA, most of the attendees were either in the basement or locked away somewhere in some offsite storage facility. Records mangers were focused on paper records, ensuring records were retained in reliable and authentic manner and are ultimately disposed of in accordance with a retention schedule. Today, things are much different:

• Explosion in electronic content (formats, storage)
• Defined and stringent eDiscovery requirements
• Laws and regulations across multiple jurisdictions
• IT systems (often times with cryptic names)
• Privacy and security concerns

I am not going to bore you (again) on the consequences of information mismanagement – brand damage, stock price, fines, and revenue. This is precisely why the management of corporate information is becoming a topic of discussion at the executive level. Records management is beginning to report into legal and getting a seat at the table where strategic decisions are being made. I do warn you this trend is a little slow according to the latest Forrester survey, but it is changing. Galina Datskovsky, the president of ARMA suggested inserting yourself into these conversations about better ways of managing information.

Oh no, this blog is a record

It just occurred to me, “managing information” is just so broad and I hate when vendors use this term (oh wait, sorry). The term “information” means different things to different people. For some, this means paper records stored in some warehouse off the NJ Turnpike. For others in marketing, it may be the twitter feed on their products. Very different – for obvious reasons. I recall six years ago at ARMA, the big thing people were talking about was email. This year, ARMA decided to make the Tuesday morning general session around social media and records management. Wow, talking about pushing the envelope. This is from the same organization that not long ago was touting "electronic records were the future of records management."

The session (in the format of a vendor panel), talked about the many steps a company needs to integrate records management program with their social media strategy. The best takeaways from this session include:

• It all starts with policies – I have been saying this for years. Regardless of the source, format, location of the information, you need to define and validate the policies.
• Policies include more than retention – Everyone on the panel agreed policies should include data privacy, address metadata concerns, and address security concerns.
• All jurisdictions are not treated equal – This is a no brainer but should be mentioned. Each geographic region has its own set of laws, regulations, and requirements. This is especially around data privacy.

My favorite part of the session was when one of the panelists claimed their technology can determine if my tweets and blogs are sarcastic. Now, that’s awesome!

So, the second take away from ARMA is more practical advice on how to best govern all corporate records, which is currently outside the records management function. According to statistics, records management only deals with 10%-15% of the information within the organization – file shares, C drives, ERP systems, and social media content (blogs, tweets, etc). No surprise, SharePoint was a big discussion point. But that’s a different topic for another day.

Finally, information governance means something

Information governance is being used more and more –and not only by the vendors. At several customer meetings in our beautiful private suite, I asked the question. Does your company use the term information governance? The resounding answer was “yes”. We have customers leveraging the GARP maturity model to assess their information governance needs across departments and jurisdictions. Barclay Blair was walking around the expo floor asking people how they defined information governance. Can’t wait to see the results.

RSD defines information governance as the means of enforcing the desirable behavior in creating, using, managing, and deleting of all corporate information. Information governance is not search. Information governance is not a mechanism to justify increasing storage costs. Information governance does not mean you need to roll out hundreds of crawlers on your users desktops. Finally, information governance does not mean auto classification (which by the way does require some discussion).

At this year’s ARMA, RSD decided to declare itself as “the official sponsor of information governance”. This is for a reason. In addition to delivering a proven and patent-pending solution to market, RSD’s Bassam Zarkout was the only person at ARMA 2008 talking about information governance before information governance even was discussed by anyone. Now that’s cool.

Final words

Even though I think the show was a little slower this year, the event was excellent. I would like to personally thank ARMA for a great event and for all the attendees who took part in our contest. Who knew, the letter “A” was the most valuable button. RSD gave away five iPads - go Apple stock price. I would also like to thank Bob Williams from the Cohasset Group for organizing the MER Experience. The feedback from this track was extremely positive and I am proud RSD was part of this program.

Comments, questions, concerns?  I would love to hear from you. See you in Chicago.

Governing Cloud-Based Content – Both Easier and Harder than it Seems

Once in awhile, as we did this past Wednesday, we’ll talk to a forward-thinking customer who realizes that the question is inevitable, whether they are creating cloud-based content or not: how to govern it?

First the Good News

On its face, the question is simple enough. With RSD GLASS, customers can govern records of any format, regardless of where they reside and how they are stored. And we allow in-place governance, which means that our customers don’t have to migrate content from the existing repository / archive / email server / storage system / physical inventory / etc. to our system. If we can do this, can we not also govern cloud-based content? The answer is the same as for any other repository: it depends.

First, it depends on what kind of governance you wish to employ. Are we talking just simple retention and disposition? E-discovery activities and litigation holds? Or are there additional lifecycles you’d like to automatically enforce, such as storage, metadata, and security lifecycles?

Second, once the governance controls are understood, we then need to determine if the repository supports those controls. If so, and if there is a means for accessing those controls via an API or similar technical interface, then the answer is yes, we can govern that content.

And that is true for cloud-based content as well. Re-read the previous paragraph, substituting “repository” for “cloud provider”, and our position is clear: if the cloud provider supports the governance control, and if they provide a means for leveraging it, then yes, we can govern that content. Intuitively, this makes sense: the nebulous (heh, you see what I did there?) nature of cloud-based content refers mainly to how it is accessed: usually via hyperlink, if not through an application that hides the access from the user. In the back-end, the a cloud-based record still resides somewhere… perhaps in a SharePoint repository, or perhaps on a proprietary repository specific to the cloud provider. All the provider has to do is expose the services offered by the repository, and we’ve got ourselves governance.

Mind you, not all service providers support these types of controls; many did not take governance into account when architecting their offerings. If you are in the market for a Repository-As-A-Service type offering, and if you want the option of governing cloud content in place, these are important questions to ask before you sign.

 

Location, Location, Location

 

But hold on there, Sparky, there is an important consideration that is usually forgotten. But ignoring it can put your company at serious risk of violating important data privacy statutes. We know, despite how the information is accessed, that at the end of the day, it’s sitting there somewhere. Where? No really, WHERE? One of the key benefits of adopting an information governance approach such as the one enabled by RSD GLASS is the ability to demonstrate that you are managing your company information in accordance with applicable laws and regulations. Cloud providers may move data around their infrastructure to maximize internal resource utilization, and minimize cost. They have the ability to move information from, say, a server in France to another in India. From the user’s perspective, this migration is transparent. The same http or https still returns the requested record. From a compliance perspective, however, this could represent a specific violation of European data privacy laws. And no governance technology would be aware of the violation, nor would it be able to prevent it.

 

The Trend: More of This

I won’t lie to you: this doesn’t come up much. Of the customers and prospects I visit, maybe 1 in 5 currently keeps records (mostly email) on a cloud-based infrastructure. But the trend is clear: this issue looms on the horizon. Asking the right questions now will enable you to govern this content with the same confidence as content on traditional repositories and storage systems.

Governing Content on File Shares – Having Your Cake, and Eating It Too

Our customers come to us with a dizzying array and variety of Information Governance challenges. Many customers have unique needs… for example, one of our European customers has asked that we help them govern specific set of physical records: prototype parts created by their suppliers and R&D division, and stored away somewhere in crates in a large warehouse. (After all, not all physical records are documents.) We've also been asked to provide a governance solution for CAD Designs, Audio / Visual Records, and multi-component records comprised of many forms and supporting documents (discrete records in their own right).

Although there are often unique requirements such as these, there is also a consistent set of challenges voiced by nearly every customer and prospect we visit. These include:

• Multi-jurisdictional policy development
• Repository-agnostic policy enforcement
• Cross-repository search and records access

A significant percentage of our customers and prospects (95% or more) tell us that at least two of these issues are high-visibility challenges they must solve in the next year. RSD GLASS represents a unique approach companies are using today to address these problems. Customers, partners, and friends of RSD already know this, so I won’t go into much detail today* on how we solve these Information Governance challenges. 

* - That said, if you are new here, why not take a look at our webinars and other resources. Lots of good stuff there.

Rather, there is a common request I am hearing these days, and I would like to take a moment to explore it in depth. The question goes something like this: “Can you help us govern our content on our network and file shares?”

Peel That Onion, Try Not To Cry

On its face, the requirement seems harmless enough. The organization has some "stuff" on its network, network-addressable storage devices, and local C: drives. They want to apply their retention schedule to it. Unfortunately, when I start asking questions, and they look at the problem a little more closely, they often realize there are some unspoken requirements behind this request:

1. Little-to-no disruption. They usually want to govern the content in place. After all, legal and business users know where to find things on the network. (Don’t they?)
2. They want to automatically classify content. This means scrubbing metadata (which is file system metadata, not record metadata) and document content to infer whether it is a record or not. If a given document or file is a record, classify it according to the corporate taxonomy of records, and apply and enforce the appropriate retention. This is an especially important requirement for customers who have a poor sense as to what records are on their network.
3. Once a document is declared as a record, they want to block attempts to edit or delete the record outside of our governance platform. That is, they want to prohibit a user or system administrator from accidentally (or not) modifying or deleting the record from within the file system itself.

At this point in the conversation, the innocuous little request to govern content on file shares is now revealed to be a much more complex problem than first thought. On the one hand, the customer wants to employ all the necessary governance controls to meet regulatory and legal obligations. On the other hand, they want things to be exactly as they are today. What's so hard about that?

“One Word Can Really Bring You Round – Changes”

 The complexity behind the problem is the same problem ECM originally was supposed to help solve: the network / file share environment is inherently un-governable, from a Records Management perspective. Without specific and potentially very costly IT project work and ongoing administration, the required governance controls to identify, classify, and manage records is simply not possible at a technical level. More simply, a document or folder on a network can be changed or deleted. A record residing on a network or C: drive is not immutable. If it is not immutable, it is not a record.

And the Court will not admit it as such.

So Can This Be Done?

Thankfully, there are solutions. I’ve already suggested the most common solution: ask IT to solve it. IT defines and administers a set of permissions that describe who can read / write / access various drives and network directories where records may reside. They then trust their users (or their chosen auto-categorization technology) properly classify records. IT then applies the appropriate retention periods to these records, using a very small number of categories. To help, the network directory may mirror the taxonomy of corporate records. Enforcement is manual, entrusted to the IT / Network Administrator who periodically purges records with expired retention periods. The Audit Trail is the network log.

I’ve met a customers who have taken this approach; a few can make it work. Cost and complexity of administering such a program increase exponentially as they incorporate more than a few record types, business units, and / or jurisdictions. It can only work in relatively simple, localized, highly-cohesive environments, whose records are rarely, if ever subject to e-Discovery requests or litigation holds.

Most of the companies we talk to don’t fall in any of these categories. The records environment is complex. They lack unlimited IT and network administration budgets. IT and Records Management do not always work in lockstep. They are in highly regulated or litigious verticals. Their needs make it impractical or outrageously expensive to employ network technology as the RM enforcement mechanism. They know this; that’s why they bring us in.

From our perspective, we prefer to take a step back, and examine this question as a business / cultrual one, not a technology one. We examine why they want to maintain records on the network. We remind our customers that, in all likelihood, much of what resides on the network is probably not a record. Then we focus on the small subset of documents that truly are records, and develop an Information Governance program that:

• Prevents the unwanted or unintentional editing or deletion of records
• Allows authorized access
• Automatically (if desired) enforces appropriate lifecycle actions, including declaration, disposition, and a whole host of intermediate actions between these milestones as required by privacy statutes and other policies
• Provides corporate counsel with defensible disposition, showing when, how, and why records were disposed
• Allows litigation holds to be placed on records, thereby freezing the lifecycle of potentially relevant records
• Maintains an audit trail of all actions

The specifics of how these benefits are achieved differ from one implementation to the next. It may be necessary to move records (or a subset of records) to a traditional repository that supports these types of governance controls. RSD GLASS includes a component specifically designed for providing business and legal users the secure cross-repository search and access they expect.

In other environments, the benefit of this kind of migration does not justify the cost of moving records. Instead, these customers ask us to leave those records in place, but still calculate and transmit lifecycle action messages that are then manually enforced by the relevant administrator. To ensure appropriate governance, we can require to manually verify that they have performed the required actions, and record this verification in the Audit Trail.

Often, we take a blended approach: migrating some records to be governed in a repository, and enabling manual governance on the remainder of records left on the network. The openness of our platform and repository-agnostic approach gives us great flexibility to architect the right solution. In the end, we can meet the needs and govern records currently residing on the network.

It’s just a little more complicated than it first seems.

Review of the Gartner Risk and Security Summit 2011

I just returned from the Gartner Risk and Security Summit held @ the National Harbor in Maryland. While I have been to several Gartner summits before, this was my first time attending the Risk and Security summit and truthfully didn’t know what to expect. I wanted to learn what the burning issues were for risk, security, and compliance officers so I focused on the Risk Management & Compliance program. I was happy to see a session dedicated to Information Governance and several eDiscovery sessions at this event.

The Information Governance Imperative

Debra Logan gave a talk about the importance of Information Governance in the enterprise. Gartner defines Information Governance as the means to encourage desirable behavior in the valuation, creation, storage, use, archival and deletion of information.  

Over the last six months, I participated in over fifty meetings with customers, prospects, and partners regarding Information Governance. More and more of the meetings I attend include someone from risk and/or security. Certainly makes sense when it comes to better management of corporate information. In many cases, security and risk are not decision makers of such a solution, however in all cases they are an enabler and benefactor of such a program. I strongly reccomend you to read Debra's blog on What is Information Governance? And Why is it So Hard?

Four key takeaways from Debra’s session:

1. Information Governance is about improving the value of information. Some people within the organization may rely on the FUD message, however for most organizations information is a valuable asset.
2. Information Governance is about “role discipline” across the entire organization. This includes legal, IT, records management, line of business, and of course executive management. Debra warned to be careful of "death by committee".
3. Information Governance is about central management of information. Companies must be prepared to hire new roles and change existing responsibilities. It’s all about defining roles and making sure people acknowledge their roles.
4. Information governance is not always about technology. There is no single vendor for Information Governance however technology is the underpinning for Information Governance. It’s about behavior.

Regulations are Not Overrated

French Caldwell gave a great presentation on the different regulations with pragmatic advice on determining which regulations apply to an organization and integrating the regulations into a governance program. A few main takeaways from French’s presentation:

• Are you including multiple jurisdictions in your program? French explained the necessity of considering all the regulations across the different jurisdictions where a company conducts business. Remember, jurisdictions can be local governments, states, and countries.
• How effective are the GRC vendors at updating their regulatory content? It’s too early to measure the success of this and customers must determine the cost and risk of relying on their GRC vendor for this content as this may not be their core business.
• Is Legal involved in your GRC program?  If not, they should be.

GRC must support Record and Content Lifecycle

During the same session, I was happy to hear French bring up the importance of regulations and the impact they have on records management however in his other session, “The Future of GRC”, he made no mention of it. I thought this was a little odd since many customers are beginning to consider information management as part of their GRC strategy. Many companies are simply not there yet – which I really think is part of the future of GRC.

eDiscovery Meet Risk; Risk Meet eDiscovery

Finally, I was pleasantly surprised to see a few eDiscovery sessions at this event. Initially, I didn’t expect the IT risk/security audience to be remotely interested in eDiscovery. However the process of eDiscovery is moving in-house for obvious reasons (i.e. reduce costs). Debra gave a great overview of the EDRM model and explained IT’s involvement in the eDiscovery process. I was hoping she would focus on the data privacy and security issues around eDiscovery.

Thank you again to Gartner for putting on an excellent and quality event. See you next year.

Information Governance - What's The Point, Anyway?

Months in the making, we have finally reached the last entry in our epic, 3-part series mapping the retail best practices with a comprehensive Information Governance Program. (If you missed the first entries in the series, please take a look at the Introduction, then parts One and Two. Go ahead. We’ll wait.)

Having done the hard work of creating the centralized corporate policy, including applicable jurisdictional variances, and putting in place the infrastructure required to support it in the field, one might be persuaded that the rest of the program falls neatly into place as a matter of course. After all, that’s hard work, those first two phases. It involves a lot of people, including executives at the highest levels of the organization. Doesn’t the inertia generated by the sheer mass of the effort pull the project across the finish line?

Indeed, that was one of my takeaways from last month’s MER Conference… there was little to no discussion about what to do after you have defined and rolled out your RM / IG policy. Instead, session after session focused on how hard it is to get to that point in the first place. MER attendees left well-versed on the complexities of defining and enforcing retention schedules, and how difficult it is to overcome these using traditional RM approaches. There was no information on what to do next, or even why to go about this sort of thing in the first place. I would argue that the next step in this process is the most crucial, yet most neglected phase of the program: making content available to the people who require it.

Why Go To The Store?

As we’ve done in the previous entries in this series, let’s first consider the question from the retail point of view. The whole point in going through the heavy lifting of creating useful and easily navigable store layouts and then rendering those models into physical locations was to make it possible for customers to find what they want and purchase it. Consider the customer expectations… First and foremost, they expect to be able to find what they are looking for without needing help. This means the environment should be logically organized from THEIR perspective. They expect a safe, clean, and, better yet, visually appealing environment. They expect appropriate enforcements to be in place to ensure safety, collect taxes, and enforce age restrictions on the purchase of governed content such as firearms and prescription drugs. Finally, they expect the products they find to be of good quality, at a fair price.

There are some secondary audiences to be accommodated… company representatives will periodically visit the store to do inventories and ensure compliance with corporate standards. Government inspectors may also visit from time-to-time to ensure compliance with health and safety laws.

Each of these constituencies will have a satisfactory experience if the retailer has been sufficiently diligent in the earlier phases of the project. Successful retailers understand this. Those who fail to deliver on their customers’ expectations soon find themselves out of business.

The Expectations of the Information Governance Consumer

Who is the Information Governance Consumer? Say it with me, now: “EVERYONE!” (Don’t forget this; it will be important later.) The entire company is responsible for, and benefits from, good Information Governance practices. Having narrowed the target audience down thusly, let’s talk about what the Information Governance Consumer’s expectations should be.

In short, they should have the same expectations as a retail customer. They should be able to quickly and easily find the information they need (assuming they have the appropriate rights to it). They expect to have this access without having to go too far out of the way for it… that is, it should be available within the context of their day to day business activities. They expect the information to be relevant, high-quality, and specific to their needs. They should also expect that appropriate lifecycle actions are performed on the information as required by law, industry best practices, or internal standards and guidelines. If something is supposed to be moved or deleted, it should be.

Unfortunately, the Information Governance Consumer is usually frustrated. Too often, they:

• Cannot quickly and easily find the information they need, whether they have access to it or not.
• Use search engines hopelessly clogged with irrelevant or out-of-date entries.
• Have to go well out of their way to get the information they need.
• Must sift through rows and rows of records to find something relevant to the task at hand.

We have failed to meet the needs of the Information Governance Consumer. (And who, again, is the Information Governance Consumer? That’s right, everyone.)

Where Did We Drop The Ball?

The cause of these difficulties is simply identified, but difficult to address. Let’s review.

1. Define a central policy for managing corporate information, including jurisdictional variances as needed.
2. Create an infrastructure for managing that information in the field in accordance with the policy.
3. Deliver this governed content to the consumers who require it.

The failure occurs in step 3. The traditional Records Management approach abdicates this responsibility, and lays it at the feet of technology vendors to provide access to the content in their repositories. This means that business users, auditors, corporate counsel, and others who need access to the information must do so in a repository-specific manner. In practice, this means two things: first, they need to know where the information is; second, given the where, they need to know how to get it.

Would we do this to a retail customer? Would we organize an entire store according to brand?

“All the Nike stuff goes in this section… shoes, golf clubs, and apparel. All the Yamaha stuff goes over there, motorcycles, boat engines, and pianos.”

Or worse, by delivery mechanism (distributor)?

“Take everything off the next truck that arrives, and dump it in that corner. The customers will figure out what they want.”

If we set up a store with this mindset, customers would visit once and leave in frustration, never to return. We’d be out of business immediately. And yet, this is exactly what we expect out of our Information Governance Consumer.

The solution, of course, is to replicate the model proven by our friends in the retail industry. Remove the technology component from information access. Replace it with a repository agnostic search capability that can be easily embedded within the context of existing line-of-business applications, GUI’s, and / or portals. Business Consumers, such as customer service or field sales representatives, will never again have to consider which repository to search when looking for a given record. Legal counsel would not need a separate E-Discovery Tool, nor repository / platform specific means for searching through content and placing a litigation hold on potentially relevant records. Compliance and audit teams can use the same platform to ensure that information is being managed in accordance with standard laws and regulations. Lifecycle actions, such as disposition, removal of personally identifiable information, and transfers between repositories or storage tiers, can be tied to automated events generated by external systems, and automatically enforced. In this way, the beneficiaries of a comprehensive Information Governance program are actually ahead of their retail peers. They’d love to be able to automatically dispose of expired food and medication sitting on their shelves.  

To many of you, this state may seem implausible, an ideal state to be realized well in the future. ”How can I be sure my file plan is an accurate reflection of my policy? How can I account for the jurisdictional variances in relevant laws and regulations? How can I automatically enforce lifecycle actions across my repositories, while providing secure, fast, and simple access to information?”

This is exactly the value proposition behind RSD GLASS, our patent-pending Information Governance Platform. It’s a unique, revolutionary approach. Our customers are realizing these benefits today.

Want to learn more? We did a webinar last week on this very topic. Or, just give us a holler.