RSD

2011 in Review – Pop Culture Meets Information Governance

Wow, it’s already the end of December. It’s been an exciting, busy, and fun year at RSD as we continue to work with our customers on addressing their information governance challenges. I know there are going to be dozens of articles on reviewing 2011 and predicting the next big trends, I thought it would be fun to combine 2011 pop culture with trends we will most likely see information governance in 2012. Also included at no charge are ten recommendations for 2012.

Album of the Year: 21 from Adele

“Here's a fire starting in my heart, reaching a fever pitch, it's bringing me out the dark”

Historically, records management was a corporate function buried in the basement or locked away in the dark somewhere in some offsite storage facility. Records mangers were focused on paper records, ensuring records were retained in a reliable and authentic manner and are ultimately disposed of in accordance with a retention schedule. Today, things are much different. Management of corporate information is becoming a topic of discussion at the executive level because of the consequences of information mismanagement  – brand damage, stock price, fines, and revenue. This is precisely why the records management function is beginning to report to general counsel and getting a seat at the table where strategic decisions are being made.

2012 Prediction: I don’t want to be the hundredth person to tell you to get executive buy-in for your records management program. This is going to be a slow process. I suggest starting to create awareness in your organization, starting with your peers (in other functions) and making this part of the department/corporate objectives.

Book of the Year: Unbroken from Laura Hillenbrand

“Though all three men faced the same hardship, their differing perceptions of it appeared to be shaping their fates”

Information management applies to everyone in the organization – regardless role, level, or jurisdiction. One of the top challenges facing companies is determining who owns this problem. Some say it’s legal, others claim IT, and a few maintain the business owns it. This is just one of the reasons why the current process is broken. Organizations must develop an overall governance strategy that includes a closed-loop records management program – from policy creation time through policy enforcement over the decades-long lifecycle of corporate records. These strategies must be also aligned with IT reality and cost constraints with a well-defined set of stakeholders, policies and procedures. The program’s objectives are to advance the corporate compliance agenda, mitigate risks and improve value of information. The tactics of the program consist of applying “legally defensible” governance controls over corporate information throughout its entire lifecycle.

2012 Prediction: IT is going be driving more and more projects to support the information governance program. According to a December Gartner report (G00227336), by 2016, 20% of CIOs in regulated industries will lose their jobs for failing to implement the discipline of information governance successfully.

Movie of the Year: Transformers 3

“You simply fail to understand, that the needs of the many outweigh the needs of the few...”

Information governance policies and objectives cannot and should not be developed in a vacuum. You must get consensus throughout company on policy, then add local stipulations. Policies should also incorporate attributes associated with the business, IT, legal, and compliance:

• Retention/disposition (i.e. when can we safely delete information)
• E-discovery (i.e. legal hold, data map)
• Data privacy (i.e. Personally Identifiable Information)
• Storage lifecycle (i.e. automatic tier migration)
• Metadata lifecycle management (i.e. keeping full text index for the life of the record)
• Laws and regulations (i.e. justification around the policy)

2012 Prediction: Expanding existing policies to include all of these elements will take time; certainly beyond 2012. However, in the near-term (that’s 2012), many more multinational organizations will consider jurisdiction-specific rules and include the business owners in the policy development process. According to a recent Forrester Report; 53% are not satisfied with their records management solution’s support for international requirements.

App of the Year: Words with Friends

“Word building, triple score seeking, chat bubble sending goodness with simple and familiar gameplay you know and love”

SharePoint 2010. Enough said, right? Well, sort of. Take it from me, SharePoint has certainly dominated the market this last couple of years. One of the reasons is because it’s simple to use and integrates well into the Office environment. The big question on the table is the impact SharePoint has on an information governance program. As usual, some companies have addressed this pretty well. If you haven’t, here’s a hint: start with your policies.

2012 Prediction: SharePoint 2010 came along way in terms of records management functionality and you will hear more and more case studies on how (and why) organizations are standardizing on SharePoint.

Final Words

Based on what I am reading and hearing from our customers, 2012 will be an exciting year for information management professionals. Top ten 2011 takeaways and suggestions for 2012:

1. Why not, boil the ocean at once.
2. Don’t forget about “Small Data”.
3. Understand the impact of records management on social media (this blog is a record, so there!)
4. I personally prefer “reactive” e-Discovery, don’t you?
5. Use the cloud for everything…and yes, I mean everything.
6. Job security: everything you do should not be repeatable or defensible.
7. eDiscovery, records management, information governance are not the same sides of the same coin. I am sorry, that’s just not possible.
8. Information governance means what you want it to mean.
9. Explain SharePoint 2010 governance to users. They will appreciate it.
10. Have fun and to quote the late Steve Jobs, “Think Different”.

Happy Holidays and New Year.

Governing Cloud-Based Content – Both Easier and Harder than it Seems

Once in awhile, as we did this past Wednesday, we’ll talk to a forward-thinking customer who realizes that the question is inevitable, whether they are creating cloud-based content or not: how to govern it?

First the Good News

On its face, the question is simple enough. With RSD GLASS, customers can govern records of any format, regardless of where they reside and how they are stored. And we allow in-place governance, which means that our customers don’t have to migrate content from the existing repository / archive / email server / storage system / physical inventory / etc. to our system. If we can do this, can we not also govern cloud-based content? The answer is the same as for any other repository: it depends.

First, it depends on what kind of governance you wish to employ. Are we talking just simple retention and disposition? E-discovery activities and litigation holds? Or are there additional lifecycles you’d like to automatically enforce, such as storage, metadata, and security lifecycles?

Second, once the governance controls are understood, we then need to determine if the repository supports those controls. If so, and if there is a means for accessing those controls via an API or similar technical interface, then the answer is yes, we can govern that content.

And that is true for cloud-based content as well. Re-read the previous paragraph, substituting “repository” for “cloud provider”, and our position is clear: if the cloud provider supports the governance control, and if they provide a means for leveraging it, then yes, we can govern that content. Intuitively, this makes sense: the nebulous (heh, you see what I did there?) nature of cloud-based content refers mainly to how it is accessed: usually via hyperlink, if not through an application that hides the access from the user. In the back-end, the a cloud-based record still resides somewhere… perhaps in a SharePoint repository, or perhaps on a proprietary repository specific to the cloud provider. All the provider has to do is expose the services offered by the repository, and we’ve got ourselves governance.

Mind you, not all service providers support these types of controls; many did not take governance into account when architecting their offerings. If you are in the market for a Repository-As-A-Service type offering, and if you want the option of governing cloud content in place, these are important questions to ask before you sign.

 

Location, Location, Location

 

But hold on there, Sparky, there is an important consideration that is usually forgotten. But ignoring it can put your company at serious risk of violating important data privacy statutes. We know, despite how the information is accessed, that at the end of the day, it’s sitting there somewhere. Where? No really, WHERE? One of the key benefits of adopting an information governance approach such as the one enabled by RSD GLASS is the ability to demonstrate that you are managing your company information in accordance with applicable laws and regulations. Cloud providers may move data around their infrastructure to maximize internal resource utilization, and minimize cost. They have the ability to move information from, say, a server in France to another in India. From the user’s perspective, this migration is transparent. The same http or https still returns the requested record. From a compliance perspective, however, this could represent a specific violation of European data privacy laws. And no governance technology would be aware of the violation, nor would it be able to prevent it.

 

The Trend: More of This

I won’t lie to you: this doesn’t come up much. Of the customers and prospects I visit, maybe 1 in 5 currently keeps records (mostly email) on a cloud-based infrastructure. But the trend is clear: this issue looms on the horizon. Asking the right questions now will enable you to govern this content with the same confidence as content on traditional repositories and storage systems.

CMIS 2.0 – Where Are You?

A couple of weeks ago, I attended a Webinar titled “The Content Management Interoperability Services (CMIS) Standard: What is it and Where is it Going?” The Webinar gave great insight into the standard with great use cases on how organizations can and should leverage the standard. A few immediate things popped up during the event:

• CMIS is much more than federated search – The Webinar did a great job explaining the different use cases for CMIS. Certainly the most popular (and sought out) feature is federated search, however CMIS enables easy publication of content from one repository to another or the move from an active repository to an archived/records repository. CMIS also enables communication from a business application to a repository. Business applications can now be deployed in a content repository independent manner, allowing implementation teams to focus on the user experience without relying on an expert from each ECM vendor.
• Not all ECM vendors have adapted the standard – A standard is only good if everyone in the industry embraces it. Most vendors are behind it, and they are showing their support through specific actions and endorsements. Vendors include Alfresco, EMC, IBM, Nuxeo, and even Microsoft (with SharePoint 2010). Notable missing vendors include Autonomy and Hyland. 
• Records Management functionality is still missing – The key to effective information governance is to enforce the corporate retention schedule and policies across the disparate infrastructure. Define policy once and enforce across many. This is one of the top requests I hear from customers (and some of the other vendors as well). This was discussed during the Webinar and hope the vendor community will soon agree on a standard for ILM functionality. I understand some of the vendors may be hesitant to let an external application manage the content lifecycle in their repository. I know, it’s a trust thing. However, at some point ECM vendors need to start trusting third party applications for performing ILM functionality.

So…in summary, CMIS is a great standard enabling companies to leverage their existing ECM infrastructure. Many companies are still waiting for core records management functionality to be part of the CMIS standard. Here’s to CMIS v 2.0…or should we rename it to, RMIS.

Photo courtesy of Flickr By lumaxart (Scott Maxwell)

Preview of ARMA 2010

In the next couple of days, I will be heading out west to San Francisco for the ARMA International conference. I have been to ARMA before and certainly looking forward to catching up with old friends and meeting new ones. I will also be curious to see how many records management vendors will be “repositioning” their products as an information governance solution.

Information governance is becoming a top priority for many c-level officers since it helps companies better manage risk and increase the value/use of corporate information. IBM’s acquisition of PSS Systems and the recent press release from RSD has created a buzz in Twitterland.   
I received about 100 emails with several meetings just from this press release – confirming the urgency of a true end-to-end information governance solution.

Information governance can be broken down in the following four categories:

• Policy management – Information governance begins with a policy. Included in the policy is retention/disposition, rules and regulations, data privacy attributes, storage lifecycle management, and lifecycle of the metadata. The policy is then validated by all stakeholders.
• Lifecycle management – The idea here is to enable records managers and business managers to manage the lifecycle actions as defined in the policy. These actions must be controlled and audited (independent of the repository).
• Enforcement – The scheduled lifecycle actions must then be physically enforced in the repository infrastructure. This includes structured and unstructured repositories.
• Role-based access – Finally, the business needs to have high-speed secure access to information regardless the format or how it’s stored.     

An end-to-end information governance solution enables organizations to seamlessly go from central policy to control/administration to enforcement. I will be curious to see how IBM, Autonomy, EMC, HP, and others address the information governance challenge.

This year, RSD is proud to be a silver sponsor along with IBM and HP. Please see us at booth #918 as we are looking forward to talking about your information governance challenges and showing you why RSD GLASS is the most comprehensive information governance solution on the market. 

After all – seeing is believing.

Thoughts about IBM’s Acquisition of PSS Systems

I have been in the information management industry for 14 years and proud to say that I wouldn’t give it up for anything. I have seen this market evolve from output management to imaging/workflow, document management, web content management, records management, email archiving, ECM vendor consolidation, open source ECM, Microsoft dominating (again) with SharePoint, and now information governance. For the last 12 months, I have been focusing on information governance – talking to countless customers and watching how the traditional ECM vendors are responding to information governance. Yesterday (and to no surprise), IBM announced their acquisition of California-based PSS Systems.

I admire IBM’s move to acquire PSS as it closes a very much needed gap for providing companies with a policy engine for information governance and eDiscovery. Companies are struggling to create, validate, and manage the policies that define how corporate information should be managed across the organization. Companies must be cognizant of their ongoing legal and regulatory obligations since non-compliance leads to substantial fines, serious revenue loss, significant reputational damage, and possibly jail sentences for C-level executives.

While this acquisition is commendable, there is an open question which hardly gets mentioned during a merger/acquisition announcement. How exactly is IBM planning to integrate PSS ATLAS with their multiple repositories – FileNet, IBM Content Manager, IBM OnDemand, ImagePlus, etc, etc? Naturally, these systems have different flavors with multiple versions. The integration is not going to be straightforward. I am certain IBM global services team can make the integration work – question is at what cost to the customer.

You may ask why is this important?

We all recognize large companies have multiple repositories. The repositories are typically spread across jurisdictions, business units, and platform technologies. It is difficult to deploy corporate retention policies in a stove-piped manner and it’s also not feasible to migrate all content into a single content repository. Each repository needs to have dedicated policy administration and controls to ensure content is archived to corporate defined rules. Not only is this is an administrative headache, but it also creates a huge risk for the entire organization. As a result, policies must be centralized and the content should remain federated.

However, this only gets you 25% there – organizations must be able to demonstrate their policies are enforceable and auditable. Companies must take these policies and (what I call) put them to work in the field. The policies have to be properly published and drive the various lifecycle actions so they are performed correctly by the business units, jurisdictions, records management divisions, and ECM administrators. These actions must be (properly) managed and enforced. This should be done in an automated fashion without requiring extreme changes to the repository infrastructure or costly upgrades. By the way, these actions are not limited to just retention/disposition and eDiscovery. Actions also include metadata management, storage ILM, data privacy rules, and so much more. The integration of the PSS policy engine must be integrated with the records management applications and the various IBM repositories for a true information governance platform. At the end of the day, companies need a single records management dashboard which works across all IBM and non-IBM repositories that’s tightly integrated with the policy engine.

In the next 6-12 months, it will be interesting to see how PSS and IBM customers react. In the meantime, please hand me some popcorn as I wait to see how EMC responds.

Is the Archer acquisition enough?

Photo courtesy by Jake Wasdin on Flickr

Sécurité des systèmes d'information

Le CLUSIF a publié la semaine dernière son rapport biennal quant aux entreprises et à la sécurisation de leur système d'information.
S'appuyant sur les réponses de 350 sociétés de plus de 200 salariés, et sur l'analyse des 11 thèmes de la norme ISO 27002 (relative à la sécurité des SI), ce rapport souligne les failles actuelles ainsi que les améliorations mises en œuvre par les entreprises.

Restons optimistes

Nous retiendrons que les entreprises, reconnaissant leur dépendance vis à vis de informatique, sont de plus en plus nombreuses (73%, soit +14% par rapport à 2008)à formaliser leur politique en la matière (67 % confirment l'existence d'une charte Sécurité SI, + 17 % par rapport à 2008.

Une évolution qui s'explique sans doute par l'implication de plus en plus forte de la direction générale dans la politique de sécurité IT de l'entreprise. "La politique de sécurité de l'information des entreprises est massivement soutenue par la direction générale, qui a contribué pour plus de la moitié à son élaboration", constate le CLUSIF.

Il est également intéressant de relever que chez 47% des répondants, la fonction RSSI (responsable de la sécurité du système d'information) existe même si ces responsables sont un peu isolés dans l'entreprise.

Cette fonction est plus souvent liée à la DSI (36%) ainsi qu'à la direction générale (34%). Un second rattachement qui s'inscrit néanmoins en recul comparé à 2008 (45%).
Pour le CLUSIF, "ceci peut s'expliquer par l'arrivée plus nombreuse de RSSI au sein d'entreprises de tailles moyennes ayant un niveau de maturité en sécurité IT encore faible".

Des budgets épargnés

Les budgets restent très serrés, mais par rapport à 2008, la sécurité apparaît comme  une catégorie de dépenses plutôt épargnée.
Poutant le CLUSIF constate des disparités selon les secteurs d'activité. "61% des entreprises du secteur BTP et 43% des Transport et Télécoms ont augmenté leur budget en 2010 parfois de manière très importante : 15% des entreprises du BTP ont noté une augmentation de plus de 10% de leur budget"

Peut mieux faire

Le CLUSIF a ajouté dans son enquête le thème ISO 27002 numéro 9 (sécurité physique), et les résultats montrent pour 41% des entreprises, le responsable des « données papier » n’est pas clairement identifié.

33% (-7% vs 2008) des entreprises ne disposent toujours pas d’un plan de continuité d’activité pour traiter les crises majeures !…
Enfin, les aspects « conformité », pour lesquels des progrès restent à faire, au travers :

• des « obligations CNIL » : en légère progression (68% « conforment », 20% « conforment pour leurs traitements sensibles », respectivement +4% et +1% vs 2008),
• des audits de sécurité : 25% des entreprises n’en font toujours pas !…,
• du tableau de bord de la sécurité informatique : 34% seulement en dispose (malgré les +11%).

A noter également, le sentiment de danger concernant la protection de la vie privée qui augmente (73% « mise en danger de la vie privée - fortement ou un peu », vs 60% en 2008).

Téléchargez l'intégralité des présentations faites par le CLUSIF autour du rapport 2010 sur les Menaces Informatiques et Pratiques de Sécurité en France.

Thoughts from IBM Impact 2010

I just got back from the IBM Impact conference in Las Vegas. I really didn’t know what to expect as this was my first time attending Impact. IBM invited me to present on information governance and explain how companies can better manage their risk around corporate information. Before departing to Las Vegas, I reached out to my network to learn this conference was primarily a technical conference. Historically, this conference may have focused on technology however it seems that IBM has done a great job introducing business topics to this event. 

During the conference, I heard great customer case studies about cloud computing, service oriented architecture, and business process management. I learned that the mainframe is not going anywhere anytime soon and how cloud computing is for real. I have to say the theme on Wednesday was my favorite – technology changing as fast as the business changes. We are all aware business strategies are forced to change in this economic climate and how quickly IT reacts will make or break an organization.  

However, companies also need to respond to external conditions such as new regulations and laws as well as litigation and competitive threats. I was somewhat surprised there were limited conversations about the impact legal and compliance have on technology deployments and business processes. I certainly understand this may not be the primary audience for this type of discussion – but there is a very strong connection.

Enterprise systems exist to manage processes, line of business applications, and corporate information. There are hundreds, if not thousands, of different laws and regulations for managing corporate information. Exactly how does a company:

1) Capture these laws and regulations?

2) Understand the impact these regulations have on the business and IT organization?

3) Map the laws and regulations to their corporate information repositories?

4) Enforce the laws and regulations across the enterprise complex infrastructure?

This is where information governance comes in and why I attended Impact 2010. Information governance is an accountability program to enforce desirable behavior in the creation, use, archiving, and deletion of corporate information. Information governance enables companies to not only align IT with business – but also with the other corporate functions such as legal, finance, compliance, and records management.

An information retention schedule sets out the periods for which an organization’s corporate records should be retained to meet its operational and business needs and to comply with legal and other requirements. The retention schedule is just one component of information governance that protects the interests of the company and its stakeholders.

After my session and throughout the conference, I had fruitful discussions around the challenges of getting all the stakeholders (IT, business, compliance, and legal) on the same page to create the retention schedule. It’s quite difficult and there is no silver bullet. At the end of the day, each function needs to recognize the benefits of deploying an information governance framework and each function will need to give in order to receive.

The question I leave you with:

What if technology can change as fast as your information retention schedule?

See you next year in Las Vegas.

RSD Announces New YouTube Channel

A few years back, my friend sent me a rare video of Bruce Springsteen performing Rosalita in a small New Jersey club. He then challenged me to type anything into the search box to get immediate results. I was instantly hooked (and so were you) – spending countless hours looking for rare performances and watching some of the funniest videos from around the world. 

In the last 18 months, companies started using YouTube as a communication channel. RSD is pleased to announce a new channel on YouTube. The channel will be used to share industry trends, best practices, customer case studies, executive interviews, and exciting product news. We hope you enjoy the channel and welcome comments and feedback. 

Hurry up – get some popcorn and start watching!

 

 

RSD annonce l’ouverture d’une filiale à Madrid

"En cette période, nous souhaitons manifester notre volonté d’aller de l’avant sur le marché ibérique en nous engageant encore plus auprès de nos clients espagnols et en leur apportant notre qualité de services ainsi que des solutions qui vont les aider à répondre aux nombreux défis, notamment de gestion de l’information, qui se présentent à eux" annonce Pierre Van Beneden, Directeur Général de RSD

Lire le communiqué

Un entrepôt d’archives papier en feu à Lausanne.

Depuis le jeudi 24 septembre, un incendie ravage à Lausanne (Suisse) un bâtiment contenant des archives : 3000 m3 de classeurs rangés dans des armoires au deuxième sous-sol du bâtiment dans des locaux où sont stockées les archives de quelques 150 entreprises sont en danger et seront probablement entièrement détruites.

Cet incendie (toujours pas maitrisé à l’heure où nous écrivons ces lignes) est malheureux et il met en exergue la délicate question de l’archivage des documents émis ou reçus par les entreprises.

Tant que le papier a été l’un des principaux support des affaires et des contrats, l’archivage d’une copie papier de tous les documents était indispensable pour toutes les raisons que nous connaissons (obligations légales, protection de contrats, contrainte administrative, etc.).
Aujourd’hui, l’économie vit une transition accélérée par la dématérialisation et la mutation vers un monde numérique est en cours.
La plupart des échanges et des documents constitutifs des actes de commerce ou simplement des « affaires » est dématérialisée sous la forme de fichiers informatiques.
A l’heure du « Green IT », la matérialisation par l’impression de ces documents n’est ni souhaitable ni même nécessaire.
Par contre, qu’il s’agisse de contrats, de lettres, de bons de commande ou encore de courriers électroniques, il est plus que jamais indispensable pour les entreprises d’archiver tous ces documents.
Ceci est d’autant plus vrai que les volumes de données «explosent» : en 2006, ce sont 161 milliards de gigaoctets d’informations numériques qui auraient été créées et copiées, d’après une étude du cabinet IDC.D’après la même étude publiée en mars 2008, en 2007, ce chiffre a été évalué à 281 milliards de gigaoctets, soit 10 % de plus que ce qui avait été annoncé.
Les contraintes légales (gouvernance de l’information) viennent s’ajouter à cette réalité pour créer un nouveau défi pour les entreprises : comment archiver ces documents en toute sécurité, en toute conformité tout en pouvant les utiliser dans la conduite des affaires ?

L’archivage des contenus numériques dit également répondre aux problématiques de confiance.

Un système d'archivage électronique doit donc :

• Assurer la conservation des fichiers dans leur format d'origine (afp, pdf, pdf/a, TIFF, courriers électroniques, messages, images, vidéos, etc.)
• Supporter tous les environnements de production de documents (mainframes, systèmes ouverts)
• Garantir sa robustesse et sa capacité à ingérer des gros volumes
• Permettre une restitution rapide et fidèle des documents archivés (gestion des index et metadata, interface intuitive, filtres de sécurité, etc.)
• S'intégrer dans un espace sécurisé (gestion des accès et des droits, traçabilité, gestion des sauvegardes, etc.)
• Fournir un socle indépendant des applications et contribuer à la souplesse de l'entreprise
• Se connecter aux outils HSM ou supports d'archivage Hardware
• Participer aux standards (ISO -TC46/SC11, ISO 15489-1et15489) et aux normes (ex.: AFNOR - NF Z 43-400 et la NF Z 42-013) ou architectures d'interopérabilité
• Contribuer à la valeur probatoire (scellement, support de la signature électronique, etc.)
• Gérer avec granularité et automatiquement les cycles de vie des documents et des données
• Appliquer le référentiel de conservation et la politique d'entreprise afin d'en garantir la conformité

Le dommage subit par les entreprises dont les archives ont disparu en fumée ou sous les tonne d'eau des pompiers ne sont peut-être pas importants, et ce serait tant mieux!

Mais, il faut que tout à chacun au niveau du management  réfléchissent aux risques que peut représenter la destruction des "actifs documentaires" des entreprises.

Cette réflexion encadrée par les responsables juridiques doit, avec le concours des équipes informatiques, conduire à la mise en œuvre d'un système souple, simple, efficace, évolutif et garant de la conformité de l'entreprise au regard de ses besoins, de ses droits et de ses devoirs.

Merci et à bientôt.