The value of information in business is rising, and business leaders are more and more viewing the ability to govern, manage, and harvest information as critical to

success. Raw data is now being increasingly viewed as an asset that can be

leveraged, just like financial or human capital.1 Some have called this new age of

“Big Data” the “industrial revolution of data.”

According to the research group Gartner, Inc., Big Data is defined as “high-

volume, high-velocity and high-variety information assets that demand cost-

effective, innovative forms of information processing for enhanced insight and

decision making.”2 A practical definition should also include the idea that the

amount of data—both structured (in databases) and unstructured (e.g., e-mail,

scanned documents) is so massive that it cannot be processed using today's

database tools and analytic software techniques.3

In today's information overload era of Big Data—characterized by massive growth

in business data volumes and velocity—the ability to distill key insights from

enormous amounts of data is a major business differentiator and source of

sustainable competitive advantage. In fact, a recent report by the World Economic

Forum stated that data is a new asset class and personal data is “the new oil.”4 And

we are generating more than we can manage effectively with current methods and

tools.

The Big Data numbers are overwhelming: Estimates and projections vary, but it

has been stated that 90 percent of the data existing worldwide today was created in

the last two years5 and that every two days more information is generated than was

from the dawn of civilization until 2003.6 This trend will continue: The global

market for Big Data technology and services is projected to grow at a compound

annual rate of 27 percent through 2017, about six times faster than the general

information and communications technology (ICT) market.7

Many more comparisons and statistics are available, and all demonstrate the

incredible and continued growth of data.

https://learning.oreilly.com/library/view/information-governance-concepts/9781118218303/09_chap01.html#chap01fn1

https://learning.oreilly.com/library/view/information-governance-concepts/9781118218303/09_chap01.html#chap01fn2

https://learning.oreilly.com/library/view/information-governance-concepts/9781118218303/09_chap01.html#chap01fn3

https://learning.oreilly.com/library/view/information-governance-concepts/9781118218303/09_chap01.html#chap01fn4

https://learning.oreilly.com/library/view/information-governance-concepts/9781118218303/09_chap01.html#chap01fn5

https://learning.oreilly.com/library/view/information-governance-concepts/9781118218303/09_chap01.html#chap01fn6

https://learning.oreilly.com/library/view/information-governance-concepts/9781118218303/09_chap01.html#chap01fn7

Certainly, there are new and emerging opportunities arising from the accumulation

and analysis of all that data we are busy generating and collecting. New enterprises

are springing up to capitalize on data mining and business intelligence

opportunities. The U.S. federal government joined in, announcing $200 million in

Big Data research programs in 2012.8

The onslaught of Big Data necessitates that information governance (IG) be

implemented to discard unneeded data in a legally defensible way.

But established organizations, especially larger ones, are being crushed by this

onslaught of Big Data: It is just too expensive to keep all the information that is

being generated, and unneeded information is a sort of irrelevant sludge for

decision makers to wade through. They have difficulty knowing which information

is an accurate and meaningful “wheat” and which is simply irrelevant “chaff.” This

means they do not have the precise information they need to base good business

decisions upon.

And all that Big Data piling up has real costs: The burden of massive stores of

information has increased storage management costs dramatically, caused

overloaded systems to fail, and increased legal discovery costs.9Further, the longer

that data is kept, the more likely that it will need to be migrated to newer

computing platforms, driving up conversion costs; and legally, there is the risk that

somewhere in that mountain of data an organization stores is a piece of information

that represents a significant legal liability.10

This is where the worlds of Big Data and business collide. For Big Data

proponents, more data is always better, and there is no perceived downside to

accumulation of massive amounts of data. In the business world, though, the

realities of legal e-discovery mean the opposite is true.11 To reduce risk, liability,

and costs, it is critical for unneeded information to be disposed of in a systematic,

methodical, and “legally defensible” (justifiable in legal proceedings) way, when it

no longer has legal, regulatory, or business value. And there also is the high-value

benefit of basing decisions on better, cleaner data, which can come about only

through rigid, enforced information governance (IG) policies that reduce

information glut.

Organizations are struggling to reduce and right-size their information footprint by

discarding superfluous and redundant data, e-documents, and information. But the

critical issue is devising policies, methods, and processes and then deploying

information technology (IT) to sort through which information is valuable and

which no longer has business value and can be discarded.

IT, IG, risk, compliance, and legal representatives in organizations have a clear

sense that most of the information stored is unneeded, raises costs, and poses risks.

According to a survey taken at a recent Compliance, Governance and Oversight

https://learning.oreilly.com/library/view/information-governance-concepts/9781118218303/09_chap01.html#chap01fn8

https://learning.oreilly.com/library/view/information-governance-concepts/9781118218303/09_chap01.html#chap01fn9

https://learning.oreilly.com/library/view/information-governance-concepts/9781118218303/09_chap01.html#chap01fn10

https://learning.oreilly.com/library/view/information-governance-concepts/9781118218303/09_chap01.html#chap01fn11

Counsel summit, respondents estimated that approximately 25 percent of

information stored in organizations has real business value, while 5 percent must

be kept as business records and about 1 percent is retained due to a litigation hold.

“This means that [about] 69 percent of information in most companies has no

business, legal, or regulatory value. Companies that are able to dispose of this data

debris return more profit to shareholders, can leverage more of their IT budgets for

strategic investments, and can avoid excess expense in legal and regulatory

response” (emphasis added).12

Big Data values massive accumulation of data, whereas in business, e-discovery

realities and potential legal liabilities dictate that data be culled to only that which

has clear business value.

Only about one quarter of information organizations are managing has real

business value.

With a smaller information footprint, it is easier for organizations to find the

information they need and derive business value from it.

With a smaller information footprint, organizations can more easily find what

they need and derive business value from it.13 They must eliminate the data debris

regularly and consistently, and to do this, processes and systems must be in place

to cull valuable information and discard the data debris. Daily. An IG program sets

the framework to accomplish this.

The business environment has also underscored the need for IG. According to Ted

Friedman at Gartner, “The recent global financial crisis has put information

governance in the spotlight…. [It] is a priority of IT and business leaders as a

result of various pressures, including regulatory compliance mandates and the

urgent need for improved decision-making.”14

And IG mastery is critical for executives: Gartner predicts that by 2016, one in five

chief information officers in regulated industries will be fired from their jobs for

failed IG initiatives.15

Defining Information Governance

IG is a sort of super discipline that has emerged as a result of new and tightened

legislation governing businesses, external threats such as hacking and data

breaches, and the recognition that multiple overlapping disciplines were needed to

address today's information management challenges in an increasingly regulated

and litigated business environment.16

IG is a subset of corporate governance, and includes key concepts from records

management, content management, IT and data governance, information security,

https://learning.oreilly.com/library/view/information-governance-concepts/9781118218303/09_chap01.html#chap01fn12

https://learning.oreilly.com/library/view/information-governance-concepts/9781118218303/09_chap01.html#chap01fn13

https://learning.oreilly.com/library/view/information-governance-concepts/9781118218303/09_chap01.html#chap01fn14

https://learning.oreilly.com/library/view/information-governance-concepts/9781118218303/09_chap01.html#chap01fn15

https://learning.oreilly.com/library/view/information-governance-concepts/9781118218303/09_chap01.html#chap01fn16

data privacy, risk management, litigation readiness, regulatory compliance, long-

term digital preservation, and even business intelligence. This also means that it

includes related technology and discipline subcategories, such as document

management, enterprise search, knowledge management, and business

continuity/disaster recovery.

IG is a subset of corporate governance.

IG is a sort of superdiscipline that encompasses a variety of key concepts from a

variety of related disciplines.

Practicing good IG is the essential foundation for building legally defensible

disposition practices to discard unneeded information and to secure confidential

information, which may include trade secrets, strategic plans, price lists, blueprints,

or personally identifiable information (PII) subject to privacy laws; it provides the

basis for consistent, reliable methods for managing data, e-documents, and records.

Having trusted and reliable records, reports, data, and databases enables managers

to make key decisions with confidence.17 And accessing that information and

business intelligence in a timely fashion can yield a long-term sustainable

competitive advantage, creating more agile enterprises.

To do this, organizations must standardize and systematize their handling of

information. They must analyze and optimize how information is accessed,

controlled, managed, shared, stored, preserved, and audited. They must have

complete, current, and relevant policies, processes, and technologies to manage

and control information, including who is able to access what information,

and when, to meet external legal and regulatory demands and internal governance

policy requirements. In short, IG is about information control and compliance.

IG is a subset of corporate governance, which has been around as long as

corporations have existed. IG is a rather new multidisciplinary field that is still

being defined, but has gained traction increasingly over the past decade. The focus

on IG comes not only from compliance, legal, and records management

functionaries but also from executives who understand they are accountable for the

governance of information and that theft or erosion of information assets has real

costs and consequences.

“Information governance” is an all-encompassing term for how an organization

manages the totality of its information.

According to the Association of Records Managers and

Administrators (ARMA), IG is “a strategic framework composed of standards,

processes, roles, and metrics that hold organizations and individuals accountable to

create, organize, secure, maintain, use, and dispose of information in ways that

align with and contribute to the organization's goals.”18

https://learning.oreilly.com/library/view/information-governance-concepts/9781118218303/09_chap01.html#chap01fn17

https://learning.oreilly.com/library/view/information-governance-concepts/9781118218303/09_chap01.html#chap01fn18

IG includes the set of policies, processes, and controls to manage information in

compliance with external regulatory requirements and internal governance

frameworks. Specific policies apply to specific data and document types, records

series, and other business information, such as e-mail and reports.

Stated differently, IG is “a quality-control discipline for managing, using,

improving, and protecting information.”19

Practicing good IG is the essential foundation for building legally defensible

disposition practices to discard unneeded information.

IG is “a strategic framework composed of standards, processes, roles, and metrics,

that hold organizations and individuals accountable to create, organize, secure,

maintain, use, and dispose of information in ways that align with and contribute to

the organization's goals.”20

IG is how an organization maintains security, complies with regulations, and meets

ethical standards when managing information.

Fleshing out the definition further: “Information governance is policy-based

management of information designed to lower costs, reduce risk, and ensure

compliance with legal, regulatory standards, and/or corporate governance.”21 IG

necessarily incorporates not just policies but information technologies to audit and

enforce those policies. The IG team must be cognizant of information lifecycle

issues and be able to apply the proper retention and disposition policies, including

digital preservation where records need to be maintained for long periods.

IG Is Not a Project, But an Ongoing Program

IG is an ongoing program, not a one-time project. IG provides an umbrella to

manage and control information output and communications. Since technologies

change so quickly, it is necessary to have overarching policies that can manage the

various IT platforms that an organization may use.

Compare it to a workplace safety program; every time a new location, team

member, piece of equipment, or toxic substance is acquired by the organization,

the workplace safety program should dictate how that is handled. If it does not, the

workplace safety policies/procedures/training that are part of the workplace safety

program need to be updated. Regular reviews are conducted to ensure the program

is being followed and adjustments are made based on the findings. The effort never

ends.22 The same is true for IG.

IG is not only a tactical program to meet regulatory, compliance, and litigation

demands. It can be strategic, in that it is the necessary underpinning for developing

https://learning.oreilly.com/library/view/information-governance-concepts/9781118218303/09_chap01.html#chap01fn19

https://learning.oreilly.com/library/view/information-governance-concepts/9781118218303/09_chap01.html#chap01fn20

https://learning.oreilly.com/library/view/information-governance-concepts/9781118218303/09_chap01.html#chap01fn21

https://learning.oreilly.com/library/view/information-governance-concepts/9781118218303/09_chap01.html#chap01fn22

a management strategy that maximizes knowledge worker productivity while

minimizing risk and costs.

Why IG Is Good Business

IG is a tough sell. It can be difficult to make the business case for IG, unless there

has been some major compliance sanction, fine, legal loss, or colossal data breach.

In fact, the largest impediment to IG adoption is simply identifying its benefits and

costs, according to the Economist Intelligence Unit. Sure, the enterprise needs

better control over its information, but how much better? At what cost? What is the

payback period and the return on investment?23

IG is a multidisciplinary program that requires an ongoing effort.

It is challenging to make the business case for IG, yet making that case is

fundamental to getting IG efforts off the ground.

Here are eight reasons why IG makes good business sense, from IG thought leader

Barclay Blair:

1. We can't keep everything forever. IG makes sense because it enables organizations to get rid of unnecessary information in a defensible manner. Organizations need a sensible way to dispose of information in order to reduce the cost and complexity of the IT environment. Having unnecessary information around only makes it more difficult and expensive to harness information that has value.

2. We can't throw everything away. IG makes sense because organizations can't keep everything forever, nor can they throw everything away. We need information—the right information, in the right place, at the right time. Only IG provides the framework to make good decisions about what information to keep.

3. E-discovery. IG makes sense because it reduces the cost and pain of discovery. Proactively managing information reduces the volume of information exposed to e-discovery and simplifies the task of finding and producing responsive information.

4. Your employees are screaming for it—just listen. IG makes sense because it helps knowledge workers separate “signal” from “noise” in their information flows. By helping organizations focus on the most valuable information, IG improves information delivery and improves productivity.

5. It ain't gonna get any easier. IG makes sense because it is a proven way for organizations to respond to new laws and technologies that

https://learning.oreilly.com/library/view/information-governance-concepts/9781118218303/09_chap01.html#chap01fn23

create new requirements and challenges. The problem of IG will not get easier over time, so organizations should get started now.

6. The courts will come looking for IG. IG makes sense because courts and regulators will closely examine your IG program. Falling short can lead to fines, sanctions, loss of cases, and other outcomes that have negative business and financial consequences.

7. Manage risk: IG is a big one. Organizations need to do a better job of identifying and managing risk. The risk of information management failures is a critical risk that IG helps to mitigate.

8. E-mail: Reason enough. IG makes sense because it helps organizations take control of e-mail. Solving e-mail should be a top priority for every organization.24

Failures in Information Governance

The failure to implement and enforce IG can lead to vulnerabilities that can have

dire consequences. The theft of confidential U.S. National Security Agency

documents by Edward Snowden in 2013 could have been prevented by properly

enforced IG. Also, Ford Motor Company is reported to have suffered a loss

estimated at $50 to $100 million as a result of the theft of confidential documents

by one of its own employees. A former product engineer who had access to

thousands of trade secret documents and designs sold them to a competing Chinese

car manufacturer. A strong IG program would have controlled and tracked access

and prevented the theft while protecting valuable intellectual property.25

Law enforcement agencies have also suffered from poor IG. In a rather frivolous

case in 2013 that highlighted the lack of policy enforcement for the mobile

environment, it was reported that U.S. agents from the Federal Bureau of

Investigation used government-issued mobile phones to send explicit text messages

and nude photographs to coworkers. The incidents did not have a serious impact

but did compromise the agency and its integrity, and “adversely affected the daily

activities of several squads.”26 Proper mobile communications policies were

obviously not developed and enforced.

IG is also about information security and privacy, and serious thought must be

given when creating policies to safeguard personal, classified or confidential

information. Schemes to compromise or steal information can be quite deceptive

and devious, masked by standard operating procedures—if proper IG controls and

monitoring are not in place. To wit: Granting remote access to confidential

information assets for key personnel is common. Granting medical leave is also

common. But a deceptive and dishonest employee could feign a medical leave

while downloading volumes of confidential information assets for a competitor—

https://learning.oreilly.com/library/view/information-governance-concepts/9781118218303/09_chap01.html#chap01fn24

https://learning.oreilly.com/library/view/information-governance-concepts/9781118218303/09_chap01.html#chap01fn25

https://learning.oreilly.com/library/view/information-governance-concepts/9781118218303/09_chap01.html#chap01fn26

and that is exactly what happened at Accenture, a global consulting firm. During a

fraudulent medical leave, an employee was allowed access to Accenture's

Knowledge Exchange (KX), a detailed knowledge base containing previous

proposals, expert reports, cost-estimating guidelines, and case studies. This activity

could have been prevented by monitoring and analytics that would have shown an

inordinate amount of downloads—especially for an “ailing” employee. The

employee then went to work for a direct competitor and continued to download the

confidential information from Accenture, estimated to be as many as 1,000 critical

documents. While the online access to KX was secure, the use of the electronic

documents could have been restricted even after the documents were down-loaded,

if IG measures were in place and newer technologies (such as information rights

management [IRM] software) were deployed to secure them directly and maintain

that security remotely. With IRM, software security protections can be employed

to seal the e-documents and control their use—even after they leave the

organization. More details on IRM technology and its capabilities is presented later

in this book.

Other recent high-profile data and document leakage cases revealing information

security weaknesses that could have been prevented by a robust IG program

include:

• Huawei Technologies, the largest networking and mobile communications company in China, was sued by U.S.-based Motorola for allegedly conspiring to steal trade secrets through former Motorola employees.

Ford's loss from stolen documents in a single case of intellectual property

(IP) theft was estimated at $50 to $100 million.

• MI6, the U.K. equivalent of the U.S. Central Intelligence Agency, learned that one of its agents in military intelligence attempted to sell confidential documents to the intelligence services of the Netherlands for £2 million GBP (S3 million USD).

And breaches of personal information revealing failures in privacy protection

abound; here are just a few:

• Health information of 1,600 cardiology patients at Texas Children's Hospital was compromised when a doctor's laptop was stolen. The information included personal and demographic information about

the patients, including their names, dates of birth, diagnoses, and treatment histories.27

• U.K. medics lost the personal records of nearly 12,000 National Health Service patients in just eight months. Also, a hospital worker was suspended after it was discovered he had sent a file containing pay-slip details for every member of staff to his home e-mail account.28

• Personal information about more than 600 patients of the Fraser Health Authority in British Columbia, Canada, was stored on a laptop stolen from Burnaby General Hospital.

• In December 2013, Target stores in the U.S. reported that as many as 110 million customer records had been breached in a massive attack that lasted weeks.

The list of breaches and IG failures could go on and on, more than filling the pages

of this book. It is clear that it is occurring and that it will continue. IG controls to

safeguard confidential information assets and protect privacy cannot rely solely on

the trustworthiness of employees and basic security measures. Up-to-date IG

policies and enforcement efforts and newer technology sets are needed, with

active, consistent monitoring and program adjustments to continue to improve.

Executives and senior managers can no longer avoid the issue, as it is abundantly

clear that the threat is real and the costs of taking such avoidable risks can be high.

A single security breach is an IG failure and can cost the entire business.

According to Debra Logan of Gartner, “When organizations suffer high-profile

data losses, especially involving violations of the privacy of citizens or consumers,

they suffer serious reputational damage and often incur fines or other sanctions. IT

leaders will have to take at least part of the blame for these incidents.”29

Form IG Policies, Then Apply Technology for Enforcement

Typically, some policies governing the use and control of information and records

may have been established for financial and compliance reports, and perhaps e-

mail, but they are often incomplete and out-of-date and have not been adjusted for

changes in the business environment, such as new technology platforms (e.g., Web

2.0, social media), changing laws (e.g., U.S. Federal Rules of Civil Procedure 2006

changes), and additional regulations.

IG controls to safeguard confidential information assets and protect privacy cannot

rely solely on the trustworthiness of employees and basic security measures.

https://learning.oreilly.com/library/view/information-governance-concepts/9781118218303/09_chap01.html#chap01fn27

https://learning.oreilly.com/library/view/information-governance-concepts/9781118218303/09_chap01.html#chap01fn28

https://learning.oreilly.com/library/view/information-governance-concepts/9781118218303/09_chap01.html#chap01fn29

Further adding to the challenge is the rapid proliferation of mobile devices like

tablets, phablets, and smartphones used in business—information can be more

easily lost or stolen—so IG efforts must be made to preserve and protect the

enterprise's information assets.

Proper IG requires that policies are flexible enough not to hinder the proper flow of

information in the heat of the business battle yet strict enough to control and audit

for misuse, policy violations, or security breaches. This is a continuous iterative

policy-making process that must be monitored and fine-tuned. Even with the

absolute best efforts, some policies will miss the mark and need to be reviewed and

adjusted.

Getting started with IG awareness is the crucial first step. It may have popped up

on an executive's radar at one point or another and an effort might have been made,

but many organizations leave these policies on the shelf and do not revise them on

a regular basis.

IG is the necessary underpinning for a legally defensible disposition program that

discards data debris and helps narrow the search for meaningful information on

which to base business decisions. IG is also necessary to protect and preserve

critical information assets. An IG strategy should aim to minimize exposure to risk,

at a reasonable cost level, while maximizing productivity and improving the

quality of information delivered to knowledge users.

But a reactive, tactical project approach is not the way to go about it—haphazardly

swatting at technological, legal, and regulatory flies. A proactive,

strategic program, with a clear, accountable sponsor, an ongoing plan, and regular

review process, is the only way to continuously adjust IG policies to keep them

current so that they best serve the organization's needs.

Some organizations have created formal governance bodies to establish strategies,

policies, and procedures surrounding the distribution of information inside and

outside the enterprise. These governance bodies, steering committees, or teams

should include members from many different functional areas, since proper IG

necessitates input from a variety of stakeholders. Representatives from IT, records

management, corporate or agency archiving, risk management, compliance,

operations, human resources, security, legal, finance, and perhaps knowledge

management are typically a part of IG teams. Often these efforts are jump-started

and organized by an executive sponsor who utilizes third-party consulting

resources that specialize in IG efforts, especially considering the newness of IG

and its emerging best practices.

So in this era of ever-growing Big Data, leveraging IG policies to focus on

retaining the information that has real business value, while discarding the majority

of information that has no value and carries associated increased costs and risks, is

critical to success for modern enterprises. This must be accomplished in a

systematic, consistent, and legally defensible manner by implementing a formal IG

program. Other crucial elements of an IG program are the steps taken to secure

confidential information by enforcing and monitoring policies using the

appropriate information technologies.

Getting started with IG awareness is the crucial first step.

CHAPTER SUMMARY: KEY POINTS

• The onslaught of Big Data necessitates that IG be implemented to discard

unneeded data in a legally defensible way.

• Big Data values massive accumulation of data, whereas in business, e-

discovery realities and potential legal liabilities dictate that data be culled to

only that which has clear business value.

• Only about one quarter of the information organizations are managing has

real business value.

• With a smaller information footprint, it is easier for organizations to find the

information they need and derive business value from it.

• IG is a subset of corporate governance and encompasses the policies and

leveraged technologies meant to manage what corporate information is

retained, where, and for how long, and also how it is retained.

• IG is a sort of super discipline that encompasses a variety of key concepts

from a variety of related and overlapping disciplines.

• Practicing good IG is the essential foundation for building legally defensible

disposition practices to discard unneeded information.

• According to ARMA, IG is “a strategic framework composed of standards,

processes, roles, and metrics that hold organizations and individuals

accountable to create, organize, secure, maintain, use, and dispose of

information in ways that align with and contribute to the organization's

goals.”30

• IG is how an organization maintains security, complies with regulations and

laws, and meets ethical standards when managing information.

• IG is a multidisciplinary program that requires an ongoing effort and active

participation of a broad cross-section of functional groups and stakeholders.

• IG controls to safeguard confidential information assets and protect privacy

cannot rely solely on the trustworthiness of employees and basic security

measures.

• Getting started with IG awareness is the crucial first step.

Notes

https://learning.oreilly.com/library/view/information-governance-concepts/9781118218303/09_chap01.html#chap01fn30

1. The Economist, “Data, Data Everywhere,” February 25, 2010, www.economist.com/node/15557443

2. Gartner, Inc., “IT Glossary: Big Data,” www.gartner.com/it-glossary/big- data/(accessed April 15, 2013).

3. Webopedia, “Big Data,” www.webopedia.com/TERM/B/big_data.html (accessed April 15, 2013).

4. World Economic Forum, “Personal Data: The Emergence of a New Asset Class”(January 2011), http://www3.weforum.org/docs/WEF_ITTC_PersonalDataNewAsse t_Report_2011.pdf

5. Deidra Paknad, “Defensible Disposal: You Can't Keep All Your Data Forever,” July 17, 2012, www.forbes.com/sites/ciocentral/2012/07/17/defensible-disposal- you-cant-keep-all-your-data-forever/

6. Susan Karlin, “Earth's Nervous System: Looking at Humanity Through Big Data,” www.fastcocreate.com/1681986/earth-s-nervous-system- looking-at-humanity-through-big-data#1(accessed March 5, 2013).

7. IDC Press Release, December 18, ,2013, http://www.idc.com/getdoc.jsp?containerId=prUS24542113New IDC Worldwide Big Data Technology and Services Forecast Shows Market Expected to Grow to $32.4 Billion in 2017

8. Steve Lohr, “How Big Data Became So Big,” New York Times, August 11, 2012, www.nytimes.com/2012/08/12/business/how-big-data-became-so- big-unboxed.html?_r=2&smid=tw-share&

9. Kahn Consulting, “Information Governance Brief,” sponsored by IBM, www.delve.us/downloads/Brief-Defensible-Disposal.pdf (accessed March 4, 2013).

10. Barclay T. Blair, “Girding for Battle,” Law Technology News, October 1, 2012, www.law.com/jsp/lawtech- nologynews/PubArticleLTN.jsp?id=1202572459732&thepage=1

11. Ibid.

12. Paknad, “Defensible Disposal.”

13. Randolph A. Kahn, https://twitter.com/InfoParkingLot/status/273791612172259329, November 28, 2012.

http://www.economist.com/node/15557443

http://www.gartner.com/it-glossary/big-data

http://www.webopedia.com/TERM/B/big_data.html

http://www3.weforum.org/docs/WEF_ITTC_PersonalDataNewAsset_Report_2011.pdf

http://www.forbes.com/sites/ciocentral/2012/07/17/defensible-disposal-you-cant-keep-all-your-data-forever/

http://www.fastcocreate.com/1681986/earth-s-nervous-system-looking-at-humanity-through-big-data#1

http://www.idc.com/getdoc.jsp?containerId=prUS24542113

http://www.nytimes.com/2012/08/12/business/how-big-data-became-so-big-unboxed.html?_r=2&smid=tw-share&

http://www.delve.us/downloads/Brief-Defensible-Disposal.pdf

http://www.law.com/jsp/lawtech-nologynews/PubArticleLTN.jsp?id=1202572459732&thepage=1

https://twitter.com/InfoParkingLot/status/273791612172259329

14. Gartner Press Release, “Gartner Says Master Data Management Is Critical to Achieving Effective Information Governance,” www.gartner.com/newsroom/id/1898914, January 19, 2012

15. Ibid.

16. Monica Crocker, e-mail to author, June 21, 2012.

17. Economist Intelligence Unit, “The Future of Information Governance,” www.emc.com/leadership/business-view/future- information-governance.htm (accessed November 14, 2013).

18. ARMA International, Glossary of Records and Information Management Terms, 4th ed., 2012, TR 22–2012.

19. Arvind Krishna, “Three Steps to Trusting Your Data in 2011,” IT Business Edge, posted March 9, 2011, www.itbusinessedge.com/guest- opinions/three-steps-trusting-your-data-2011. (accessed November 14, 2013).

20. ARMA International, Glossary of Records and Information Management Terms, 4th ed., 2012, TR 22–2012.

21. Laura DuBoisand Vivian Tero, “Practical Information Governance: Balancing Cost, Risk, and Productivity,” IDC White Paper (August 2010), www.emc.com/collateral/analyst-reports/idc-practical-information- governance-ar.pdf

22. Monica Crocker, e-mail to author, June 21, 2012.

23. Barclay T. Blair, Making the Case for Information Governance: Ten Reasons IG Makes Sense, ViaLumina Ltd, 2010. Online at http://barclaytblair.com/making-the-case-for-ig-ebook/ (accessed November 14, 2013).

24. Barclay T. Blair, “8 Reasons Why Information Governance (IG) Makes Sense,” June 29, 2009, www.digitallandfill.org/2009/06/8-reasons-why- information-governance-ig-makes-sense.html

25. Peter Abatan, “Corporate and Industrial Espionage to Rise in 2011,” Enterprise Digital Rights Management, http://enterprisedrm.tumblr.com/post/2742811887/corpora te-espionage-to-rise-in-2011. (accessed November 14, 2013).

26. BBC News, “FBI Staff7 Disciplined for Sex Texts and Nude Pictures,” February 22, 2013, www.bbc.co.uk/news/world-us-canada-21546135

27. Todd Ackerman, “Laptop Theft Puts Texas Children's Patient Info at Risk,” Houston Chronicle, July 30, 2009, www.chron.com/news/houston- texas/article/Laptop-theft-puts-Texas-Children-s-patient-info- 1589473.php. (accessed March 2, 2012).

http://www.gartner.com/newsroom/id/1898914

http://www.emc.com/leadership/business-view/future-information-governance.htm

http://www.itbusinessedge.com/guest-opinions/three-steps-trusting-your-data-2011

http://www.emc.com/collateral/analyst-reports/idc-practical-information-governance-ar.pdf

http://barclaytblair.com/making-the-case-for-ig-ebook/

http://www.digitallandfill.org/2009/06/8-reasons-why-information-governance-ig-makes-sense.html

http://enterprisedrm.tumblr.com/post/2742811887/corporate-espionage-to-rise-in-2011

http://www.bbc.co.uk/news/world-us-canada-21546135

http://www.chron.com/news/houston-texas/article/Laptop-theft-puts-Texas-Children-s-patient-info-1589473.php

28. Jonny Greatrex, “Bungling West Midlands Medics Lose 12,000 Private Patient Records,” Sunday Mercury, September 5, 2010, www.sundaymercury.net/news/sundaymercuryexclusives/2010/09/ 05/bun-gling-west-midlands-medics-lose-12-000-private-patient-records- 66331-27203177/ (accessed March 2, 2012).

29. Gartner Press Release, “Gartner Says Master Data Management Is Critical to Achieving Effective Information Governance.”

30. ARMA International, Glossary of Records and Information Management Terms.

HAPTER 2

Information Governance, IT

Governance, Data Governance:

What's the Difference?

There has been a great deal of confusion around the term information governance (IG) and how it is distinct from other similar industry terms, such

as information technology (IT) governance and data governance. They are all a

subset of corporate governance, and in the above sequence, become increasingly

more granular in their approach. Data governance is a part of broader IT

governance, which is also a part of even broader information governance. The few

texts that exist have compounded the confusion by offering a limited definition of

IG, or sometimes offering a definition of IG that is just plain incorrect, often

confusing it with simple data governance.

So in this chapter we spell out the differences and include examples in hopes of

clarifying what the meaning of each term is and how they are related.

Data Governance

Data governance involves processes and controls to ensure that information at

the data level—raw alphanumeric characters that the organization is gathering and

inputting—is true and accurate, and unique (not redundant). It involves data

cleansing (or data scrubbing) to strip out corrupted, inaccurate, or extraneous

data and de-duplication, to eliminate redundant occurrences of data.

http://www.sundaymercury.net/news/sundaymercuryexclusives/2010/09/05/bun-gling-west-midlands-medics-lose-12-000-private-patient-records-66331-27203177/

Data governance focuses on information quality from the ground up at the lowest

or root level, so that subsequent reports, analyses, and conclusions are based on

clean, reliable, trusted data (or records) in database tables. Data governance is the

most rudimentary level at which to implement information governance. Data

governance efforts seek to ensure that formal management controls—systems,

processes, and accountable employees who are stewards and custodians of the

data—are implemented to govern critical data assets to improve data quality and to

avoid negative downstream effects of poor data. The biggest negative consequence

of poor or inaccurate data is poorly and inaccurately based decisions.

Data governance uses techniques like data cleansing and de-duplication to improve

data quality and reduce redundancies.

Data governance is a newer, hybrid quality control discipline that includes

elements of data quality, data management, IG policy development, business

process improvement, and compliance and risk management.

DATA GOVERNANCE STRATEGY TIPS

Everyone in an organization wants good-quality data to work with. But it is not so

easy to implement a data governance program. First of all, data is at such a low

level that executives and board members are typically unaware of the details of the

“smoky back room” of data collection: cleansing, normalization, and input. So it is

difficult to gain an executive sponsor and funding to initiate the effort.1 And if a

data governance program does move forward, there are challenges in getting

business users to adhere to new policies. This is a crucial point, since much of the

data is being generated by business units. But there are some general guidelines

that can help improve a data governance program's chances for success:

• Identify a measureable impact. A data governance program must be able to demonstrate business value, or it will not get the executive sponsorship and funding it needs to move forward. A readiness assessment should capture the current state of data quality and whether an enterprise or business unit level effort is warranted. Other key issues include: Can the organization save hard costs by implementing data governance? Can it reach more customers or increase revenue generated from existing customers?2

• Assign accountability for data quality to business units, not IT. Typically, IT has had responsibility for data quality, yet it is mostly not under that department's control, since most of the data is being generated in the business units. A pointed effort must be made to

https://learning.oreilly.com/library/view/information-governance-concepts/9781118218303/10_chap02.html#chap02fn01

https://learning.oreilly.com/library/view/information-governance-concepts/9781118218303/10_chap02.html#chap02fn02

push responsibility and ownership for data to the business units that create and use the data.

• Recognize the uniqueness of data as an asset. Unlike other assets, such as people, factories, equipment, and even cash, data is largely unseen, out of sight, and intangible. It changes daily. It spreads throughout business units. It is copied and deleted. Data growth can spiral out of control, obscuring the data that has true business value. So data has to be treated differently, and its unique qualities must be considered.

• Forget the past; implement a going-forward strategy. It is a significantly greater task to try to improve data governance across the enterprise for existing data. Remember, you may be trying to fix decades of bad behavior, mismanagement, and lack of governance. Taking an incremental approach with an eye to the future provides for a clean starting point and can substantially reduce the pain required to implement. A proven best practice is to implement a from-this- point-on strategy where new data governance policies for handling data are implemented beginning on a certain date.

Good data governance ensures that downstream negative effects of poor data are

avoided and that subsequent reports, analyses, and conclusions are based on

reliable, trusted data.

• Manage the change. Educate, educate, educate. People must be trained to under-stand why the data governance program is being implemented and how it will benefit the business. The new policies represent a cultural change, and people need supportive program messages and training in order to make the shift.3

IT Governance

IT governance is the primary way that stakeholders can ensure that investments in

IT create business value and contribute toward meeting business objectives.4 This

strategic alignment of IT with the business is challenging yet essential. IT

governance programs go further and aim to “improve IT performance, deliver

optimum business value and ensure regulatory compliance.”5

Although the CIO typically has line responsibility for implementing IT

governance, the CEO and board of directors must receive reports and updates to

discharge their responsibilities for IT governance and to see that the program is

functioning well and providing business benefits.

https://learning.oreilly.com/library/view/information-governance-concepts/9781118218303/10_chap02.html#chap02fn03

https://learning.oreilly.com/library/view/information-governance-concepts/9781118218303/10_chap02.html#chap02fn04

https://learning.oreilly.com/library/view/information-governance-concepts/9781118218303/10_chap02.html#chap02fn05

Typically, in past decades, board members did not get involved in overseeing IT

governance. But today it is a critical and unavoidable responsibility. According to

the IT Governance Institute's Board Briefing on IT Governance, “IT governance is

the responsibility of the board of directors and executive management. It is an

integral part of enterprise governance and consists of the leadership and

organizational structures and processes that ensure that the organization's IT

sustains and extends the organization's strategies and objectives.”6

The focus is on the actual software development and maintenance activities of the

IT department or function, and IT governance efforts focus on making IT efficient

and effective. That means minimizing costs by following proven software

development methodologies and best practices, principles of data governance and

information quality, and project management best practices while aligning IT

efforts with the business objectives of the organization.

IT GOVERNANCE FRAMEWORKS

Several IT governance frameworks can be used as a guide to implementing an IT

governance program. (They are introduced in this chapter in a cursory way;

detailed discussions of them are best suited to books focused solely on IT

governance.)

IT governance seeks to align business objectives with IT strategy to deliver

business value.

Although frameworks and guidance like CobiT® and ITIL have been widely

adopted, there is no absolute standard IT governance framework; the combination

that works best for an organization depends on business factors, corporate culture,

IT maturity, and staffing capability. The level of implementation of these

frameworks will also vary by organization.

CobiT®

CobiT (Control Objectives for Information and related Technology) is a process-

based IT governance framework that represents a consensus of experts worldwide.

Codeveloped by the IT Governance Institute and ISACA (previously known as

the Information Systems Audit and Control Association), CobiT addresses

business risks, control requirements, compliance, and technical issues.7

CobiT offers IT controls that:

• Cut IT risks while gaining business value from IT under an umbrella of a globally accepted framework.

• Assist in meeting regulatory compliance requirements.

https://learning.oreilly.com/library/view/information-governance-concepts/9781118218303/10_chap02.html#chap02fn06

https://learning.oreilly.com/library/view/information-governance-concepts/9781118218303/10_chap02.html#chap02fn07

• Utilize a structured approach for improved reporting and management decision making.

• Provide solutions to control assessments and project implementations to improve IT and information asset control.8

CobiT consists of detailed descriptions of processes required in IT and also tools to

measure progress toward maturity of the IT governance program. It is industry

agnostic and can be applied across all vertical industry sectors, and it continues to

be revised and refined.9

CobiT is broken out into three basic organizational levels and their responsibilities:

(1) board of directors and executive management; (2) IT and business

management; and (3) line-level governance, and security and control knowledge

workers.10

The CobiT model draws on the traditional “plan, build, run, monitor” paradigm of

traditional IT management, only with variations in semantics. The CobiT

framework is divided into four IT domains—(1) plan and organize, (2) acquire and

implement, (3) deliver and support, and (4) monitor and evaluate—which contain

34 IT processes and 210 control objectives. Specific goals and metrics are

assigned, and responsibilities and accountabilities are delineated.

The CobiT framework maps to the international information security standard, ISO

17799, and is also compatible with IT Infrastructure Library (ITIL) and other

“accepted practices” in IT development and operations.11

ValIT®

ValIT is a newer value-oriented framework that is compatible with and

complementary to CobiT. Its principles and best practices focus is on leveraging IT

investments to gain maximum value. Forty key ValIT essential management

practices (analogous to CobiT's control objectives) support three main processes:

value governance, portfolio management, and investment management. ValIT and

CobiT “provide a full framework and supporting tool set” to help managers

develop policies to manage business risks and deliver business value while

addressing technical issues and meeting control objectives in a structured,

methodic way.12

CobiT is process-oriented and has been widely adopted as an IT governance

framework. ValIT is value-oriented and compatible and complementary with

CobiT, yet focuses on value delivery.

ITIL

ITIL (Information Technology Infrastructure Library) is a set of process-oriented

best practices and guidance originally developed in the United Kingdom to

https://learning.oreilly.com/library/view/information-governance-concepts/9781118218303/10_chap02.html#chap02fn08

https://learning.oreilly.com/library/view/information-governance-concepts/9781118218303/10_chap02.html#chap02fn09

https://learning.oreilly.com/library/view/information-governance-concepts/9781118218303/10_chap02.html#chap02fn10

https://learning.oreilly.com/library/view/information-governance-concepts/9781118218303/10_chap02.html#chap02fn11

https://learning.oreilly.com/library/view/information-governance-concepts/9781118218303/10_chap02.html#chap02fn12

standardize delivery of IT service management. ITIL is applicable to both the

private and public sectors and is the “most widely accepted approach to IT service

management in the world.”13 As with other IT governance frameworks, ITIL

provides essential guidance for delivering business value through IT, and it

“provides guidance to organizations on how to use IT as a tool to facilitate

business change, transformation and growth.”14

ITIL best practices form the foundation for ISO/IEC 20000 (previously BS15000),

the International Service Management Standard for organizational certification and

compliance.15 ITIL 2011 is the latest revision (as of this printing), and it consists of

five core published volumes that map the IT service cycle in a systematic way:

1. ITIL Service Strategy 2. ITIL Service Design 3. ITIL Service Transition 4. ITIL Service Operation 5. ITIL Continual Service Improvement16

ISO 38500

ISO/IEC 38500:2008 is an international standard that provides high-level

principles and guidance for senior executives and directors, and those advising

them, for the effective and efficient use of IT.17 Based primarily on AS 8015, the

Australian IT governance standard, it “applies to the governance of management

processes” that are performed at the IT service level, but the guidance assists

executives in monitoring IT and ethically discharging their duties with respect to

legal and regulatory compliance of IT activities.

The ISO 38500 standard comprises three main sections:

1. Scope, Application and Objectives 2. Framework for Good Corporate Governance of IT 3. Guidance for Corporate Governance of IT

ITIL is the “most widely accepted approach to IT service management in the

world.”

ISO 38500 is an international standard that provides high-level principles and

guidance for senior executives and directors responsible for IT governance.

It is largely derived from AS 8015, the guiding principles of which were:

• Establish responsibilities • Plan to best support the organization • Acquire validly • Ensure performance when required • Ensure conformance with rules

https://learning.oreilly.com/library/view/information-governance-concepts/9781118218303/10_chap02.html#chap02fn13

https://learning.oreilly.com/library/view/information-governance-concepts/9781118218303/10_chap02.html#chap02fn14

https://learning.oreilly.com/library/view/information-governance-concepts/9781118218303/10_chap02.html#chap02fn15

https://learning.oreilly.com/library/view/information-governance-concepts/9781118218303/10_chap02.html#chap02fn16

https://learning.oreilly.com/library/view/information-governance-concepts/9781118218303/10_chap02.html#chap02fn17

• Ensure respect for human factors

The standard also has relationships with other major ISO standards, and embraces

the same methods and approaches.18

Information Governance

Corporate governance is the highest level of governance in an organization, and a

key aspect of it is IG. IG processes are higher level than the details of IT

governance and much higher than data governance, but both data and IT

governance can be (and should be) a part of an overall IG program. The IG

approach to governance focuses not on detailed IT or data capture and quality

processes but rather on controlling the information that is generated by IT and

office systems.

IG efforts seek to manage and control information assets to lower risk, ensure

compliance with regulations, and improve information quality and accessibility

while implementing information security measures to protect and preserve

information that has business value.19 (See Chapter 1 for more detailed definitions.)

Impact of a Successful IG Program

When making the business case for IG and articulating its benefits, it is useful to

focus on its central impact. Putting cost-benefit numbers to this may be difficult,

unless you also consider the worst-case scenario of loss or misuse of corporate or

agency records. What is losing the next big lawsuit worth? How much are

confidential merger and acquisition documents worth? How much are customer

records worth? Frequently, executives and managers do not understand the value

of IG until it is a crisis, an expensive legal battle is lost, heavy fines are imposed

for noncompliance, or executives go to jail.

IG is how an organization maintains security, complies with regulations and laws,

and meets ethical standards when managing information.

There are some key outputs from implementing an IG program. A successful IG

program should enable organizations to:

• Use common terms across the enterprise. This means that departments must agree on how they are going to classify document types, which requires a cross-functional effort. With common enterprise terms, searches for information are more productive and complete. This normalization process begins with developing a standardized corporate taxonomy, which defines the terms (and

https://learning.oreilly.com/library/view/information-governance-concepts/9781118218303/10_chap02.html#chap02fn18

https://learning.oreilly.com/library/view/information-governance-concepts/9781118218303/10_chap02.html#chap02fn19

https://learning.oreilly.com/library/view/information-governance-concepts/9781118218303/09_chap01.html#chap01

substitute terms in a custom corporate thesaurus), document types, and their relationships in a hierarchy.

• Map information creation and usage. This effort can be buttressed with the use of technology tools such as data loss prevention, which can be used to discover the flow of information within and outside of the enterprise. You must first determine who is accessing which information when and where it is going. Then you can monitor and analyze these information flows. The goal is to stop the erosion or misuse of information assets and to stem data breaches with monitoring and security technology.

• Obtain “information confidence”—that is, the assurance that information has integrity, validity, accuracy, and quality; this means being able to prove that the information is reliable and that its access, use, and storage meet compliance and legal demands.

• Harvest and leverage information. Using techniques and tools like data mining and business intelligence, new insights may be gained that provide an enterprise with a sustainable competitive advantage over the long term, since managers will have more and better information as a basis for business decisions.21

Summing Up the Differences

IG consists of the overarching polices and processes to optimize and leverage

information while keeping it secure and meeting legal and privacy obligations in

alignment with stated organizational business objectives.

IT governance consists of following established frameworks and best practices to

gain the most leverage and benefit out of IT investments and support

accomplishment of business objectives.

Data governance consists of the processes, methods, and techniques to ensure that

data is of high quality, reliable, and unique (not duplicated), so that downstream

uses in reports and databases are more trusted and accurate.

CHAPTER SUMMARY: KEY POINTS

• Data governance uses techniques like data cleansing and de-duplication to

improve data quality and reduce redundancies.

• Good data governance ensures that downstream negative effects of poor data

are avoided and that subsequent reports, analyses, and conclusions are based

on reliable, trusted data.

• IT governance seeks to align business objectives with IT strategy to deliver

business value.

https://learning.oreilly.com/library/view/information-governance-concepts/9781118218303/10_chap02.html#chap02fn21

• CobiT is processoriented and has been widely adopted as an IT governance

framework. ValIT is valueoriented and compatible and complementary with

CobiT yet focuses on value delivery.

• The CobiT framework maps to the international information security

standard ISO 17799 and is also compatible with ITIL (IT Infrastructure

Library).

• ITIL is the “most widely accepted approach to IT service management in the

world.”

• ISO 38500 is an international standard that provides high-level principles

and guidance for senior executives and directors responsible for IT

governance.

• Information governance is how an organization maintains security, complies

with regulations and laws, and meets ethical standards when managing

information.

Notes

1. “New Trends and Best Practices for Data Governance Success,” SeachDataManagement.com eBook, http://viewer.media.bitpipe. com/1216309501_94/1288990195_946/Talend_sDM_SO_32247_EB- ook_1104.pdf, accessed March 11, 2013.

2. Ibid.

3. Ibid.

4. M.N. Kooper, R. Maes, and E.E.O. RoosLindgreen, “On the Governance of Information: Introducing a New Concept of Governance to Support the Management of Information,” International Journal of Information Management 31 (2011): 195– a120, http://dl.acm.org/citation.cfm?id=2297895. (accessed November 14, 2013).

5. Nick Robinson, “The Many Faces of IT Governance: Crafting an IT Governance Architecture,” ISACA Journal 1 (2007), www.isaca.org/Journal/Past-Issues/2007/Volume-1/Pages/The- Many-Faces-of-IT-Governance-Crafting-an-IT-Governance- Architecture.aspx

6. Bryn Phillips, “IT Governance for CEOs and Members of the Board,” 2012, p.18.

7. Ibid., p.26.

8. IBM Global Business Services/Public Sector, “Control Objectives for Information and related Technology (CobiT®) Internationally Accepted

http://seachdatamanagement.com/

http://viewer.media.bitpipe.com/1216309501_94/1288990195_946/Talend_sDM_SO_32247_EB-ook_1104.pdf

http://dl.acm.org/citation.cfm?id=2297895

http://www.isaca.org/Journal/Past-Issues/2007/Volume-1/Pages/The-Many-Faces-of-IT-Governance-Crafting-an-IT-Governance-Architecture.aspx

Gold Standard for IT Controls & Governance,” http://www- 304.ibm.com/industries/publicsector/fileserve?contentid=187551 (accesse d March 11, 2013).

9. Phillips, “IT Governance for CEOs and Members of the Board.”

10. IBM Global Business Services/Public Sector, “Control Objectives for Information and related Technology (CobiT®) Internationally Accepted Gold Standard for IT Controls & Governance.”

11. Ibid.

12. Ibid.

13. www.itil-officialsite.com/ (accessed March 12, 2013).

14. ITIL, “What Is ITIL?” www.itil- officialsite.com/AboutITIL/WhatisITIL.aspx (accessed March 12, 2013).

15. Ibid.

16. Ibid.

17. “ISO/IEC 38500:2008 “Corporate Governance of Information Technology” www.iso.org/iso/catalogue_detail?csnumber=51639 (accessed November 14, 2013).

18. ISO 38500 www.38500.org/ (accessed March 12, 2013).

19. www.naa.gov.au/records-management/agency/digital/digital- continuity/principles/ (accessed November 14, 2013).

20. ARMA International, Glossary of Records and Information Management Terms, 4th ed. TR 22–2012 (from ARMA.org).

21. Arvind Krishna, “Three Steps to Trusting Your Data in 2011,” CTO Edge, March 9, 2011, www.ctoedge.com/content/three-steps-trusting-your-data- 2011

CHAPTER 3

Information Governance

Principles*

http://www-304.ibm.com/industries/publicsector/fileserve?contentid=187551

http://www.itil-officialsite.com/

http://www.itil-officialsite.com/AboutITIL/WhatisITIL.aspx

http://www.iso.org/iso/catalogue_detail?csnumber=51639

http://www.38500.org/

http://www.naa.gov.au/records-management/agency/digital/digital-continuity/principles/

http://www.ctoedge.com/content/three-steps-trusting-your-data-2011

https://learning.oreilly.com/library/view/information-governance-concepts/9781118218303/11_chap03.html#chap03fnast

Principles of information governance (IG) are evolving and expanding. Successful IG programs are characterized by ten key principles, which are the basis

for best practices and should be designed into the IG approach. They include:

1. Executive sponsorship. No IG effort will survive and be successful if it does not have an accountable, responsible executive sponsor. The sponsor must drive the effort, clear obstacles for the IG team or committee, communicate the goals and business objectives that the IG program addresses, and keep upper management informed on progress.

2. Information policy development and communication. Clear policies must be established for the access and use of information, and those policies must be communicated regularly and crisply to employees. Policies for the use of email, instant messaging, social media, cloud computing, mobile computing, and posting to blogs and internal sites must be developed in consultation with stakeholders and communicated clearly. This includes letting employees know what the consequences of violating IG policies are, as well as its value.

3. Information integrity. This area considers the consistency of methods used to create, retain, preserve, distribute, and track information. Adhering to good IG practices include data governance techniques and technologies to ensure quality data. Information integrity means there is the assurance that information is accurate, correct, and authentic. IG efforts to improve data quality and information integrity include de- duplicating (removing redundant data) and maintaining only unique data to reduce risk, storage costs, and information technology (IT) labor costs while providing accurate, trusted information for decision makers. Supporting technologies must enforce policies to meet legal standards of admissibility and preserve the integrity of information to guard against claims that it has been altered, tampered with, or deleted (called “spoliation”). Audit trails must be kept and monitored to ensure compliance with IG policies to assure information integrity.1

4. Information organization and classification. This means standardizing formats, categorizing all information, and semantically linking it to related information. It also means creating a retention and disposition schedule that spells out how long the information (e.g. e-mail, e- documents, spreadsheets, reports) and records should be retained and how they are to be disposed of or archived. Information, and particularly documents, should be classified according to a global or corporate taxonomy that considers the business function and owner of

https://learning.oreilly.com/library/view/information-governance-concepts/9781118218303/11_chap03.html#chap03fn01

the information, and semantically links related information. Information must be standardized in form and format. Tools such as document labeling can assist in identifying and classifying documents. Metadata associated with documents and records must be standardized and kept up-to-date. Good IG means good metadata management and utilizing metadata standards that are appropriate to the organization.

5. Information security. This means securing information in its three states: at rest, in motion, and in use. It means implementing measures to protect information from damage, theft, or alteration by malicious outsiders and insiders as well as nonmalicious (accidental) actions that may compromise information. For instance, an employee may lose a laptop with confidential information, but if proper IG policies are enforced using security-related information technologies, the information can be secured. This can be done by access control methods, data or document encryption, deploying information rights management software, using remote digital shredding capabilities, and implementing enhanced auditing procedures. Information privacy is closely related to information security and is critical when dealing with personally identifiable information (PII).

6. Information accessibility. Accessibility is vital not only in the short term but also over time using long-term digital preservation (LTDP) techniques when appropriate (generally if information is needed for over five years). Accessibility must be balanced with information security concerns. Information accessibility includes making the information as simple as possible to locate and access, which involves not only the user interface but also enterprise search principles, technologies, and tools. It also includes basic access controls, such as password management, identity and access management, and delivering information to a variety of hardware devices.

7. Information control. Document management and report management software must be deployed to control the access to, creation, updating, and printing of documents and reports. When documents or reports are declared records, they must be assigned to the proper retention and disposition schedule to be retained for as long as the records are needed to comply with legal retention periods and regulatory requirements. Also, information that may be needed or requested in legal proceedings is safeguarded through a legal hold process.

8. Information governance monitoring and auditing. To ensure that guidelines and policies are being followed and to measure employee

compliance levels, information access and use must be monitored. To guard against claims of spoliation, use of e-mail, social media, cloud computing, and report generation should be logged in real time and maintained as an audit record. Technology tools such as document analytics can track how many documents or reports users access and print and how long they spend doing so.

9. Stakeholder consultation. Those who work most closely to information are the ones who best know why it is needed and how to manage it, so business units must be consulted in IG policy development. The IT department understands its capabilities and technology plans and can best speak to those points. Legal issues must always be deferred to the in-house council or legal team. A cross-functional collaboration is needed for IG policies to hit the mark and be effective. The result is not only more secure information but also better information to base decisions on and closer adherence to regulatory and legal demands.2 Principles of successful IG programs are emerging. They include executive

sponsorship, information classification, integrity, security, accessibility,

control, monitoring, auditing, policy development, and continuous

improvement.

10. Continuous improvement. IG programs are not one-time projects but rather ongoing programs that must be reviewed periodically and adjusted to account for gaps or shortcomings as well as changes in the business environment, technology usage, or business strategy.

Accountability Is Key

According to Debra Logan at Gartner Group, none of the proffered definitions of

IG includes “any notion of coercion, but rather ties governance to

accountability [emphasis added] that is designed to encourage the right

behavior…. The word that matters most is accountability.” The root of many

problems with managing information is the “fact that there is no accountability for

information as such.”3

Establishing policies, procedures, processes, and controls to ensure the quality,

integrity, accuracy, and security of business records are the fundamental steps

needed to reduce the organization's risk and cost structure for managing these

records. Then it is essential that IG efforts are supported by IT. The auditing,

testing, maintenance, and improvement of IG is enhanced by using electronic

records management (ERM) software along with other complementary technology

https://learning.oreilly.com/library/view/information-governance-concepts/9781118218303/11_chap03.html#chap03fn02

https://learning.oreilly.com/library/view/information-governance-concepts/9781118218303/11_chap03.html#chap03fn03

sets, such as workflow and business process management suite (BPMS) software

and digital signatures.

Generally Accepted Recordkeeping Principles®

Contributed by Charmaine Brooks, CRM

A major part of an IG program is managing formal business records. Although

they account for only about 7 to 9 percent of the total information that an

organization holds, they are the most critically important subset to manage, as

there are serious compliance and legal ramifications to not doing so.

Accountability is a key aspect of IG.

Records and recordkeeping are inextricably linked with any organized business

activity. Through the information that an organization uses and records, creates, or

receives in the normal course of business, it knows what has been done and by

whom. This allows the organization to effectively demonstrate compliance with

applicable standards, laws, and regulations as well as plan what it will do in the

future to meet its mission and strategic objectives.

Standards and principles of recordkeeping have been developed by records and

information management(RIM) practitioners to establish benchmarks for how

organizations of all types and sizes can build and sustain compliant,

defensible records management (RM) programs.

THE PRINCIPLES

In 2009 ARMA International published a set of eight Generally Accepted

Recordkeeping Principles,® known as The Principles4 (or sometimes GAR

Principles), to foster awareness of good recordkeeping practices. These principles

and associated metrics provide an IG framework that can support continuous

improvement.

The eight Generally Accepted Recordkeeping Principles are:

1. Accountability. A senior executive (or person of comparable authority) oversees the recordkeeping program and delegates program responsibility to appropriate individuals. The organization adopts policies and procedures to guide personnel, and ensure the program can be audited.

2. Transparency. The processes and activities of an organization's recordkeeping program are documented in a manner that is open and verifiable and is available to all personnel and appropriate interested parties.

https://learning.oreilly.com/library/view/information-governance-concepts/9781118218303/11_chap03.html#chap03fn04

3. Integrity. A recordkeeping program shall be constructed so the records and information generated or managed by or for the organization have a reasonable and suitable guarantee of authenticity and reliability.

4. Protection. A recordkeeping program shall be constructed to ensure a reasonable level of protection to records and information that are private, confidential, privileged, secret, or essential to business continuity.

5. Compliance. The recordkeeping program shall be constructed to comply with applicable laws and other binding authorities, as well as the organization's policies.

6. Availability. An organization shall maintain records in a manner that ensures timely, efficient, and accurate retrieval of needed information.

7. Retention. An organization shall maintain its records and information for an appropriate time, taking into account legal, regulatory, fiscal, operational, and historical requirements.

8. Disposition. An organization shall provide secure and appropriate disposition for records that are no longer required to be maintained by applicable laws and the organization's policies.5

The Generally Accepted Recordkeeping Principles consist of eight principles that

provide an IG framework that can support continuous improvement.

Table 3.1 Generally Accepted Recordkeeping Principles Levels

Level 1

Substandard

Characterized by an environment where recordkeeping concerns are either not addressed at

all or are addressed in an ad hoc manner.

Level 2 In

Development

Characterized by an environment where there is a developing recognition that

recordkeeping has an impact on the organization, and the organization may benefit from a

more defined information governance program.

Level 3 Essential

Characterized by an environment where defined policies and procedures exist that address

the minimum or essential legal and regulatory requirements, but more specific actions need

to be taken to improve recordkeeping.

Level 4 Proactive

Characterized by an environment where information governance issues and considerations

are integrated into business decisions on a routine basis, and the organization consistently

meets its legal and regulatory obligations.

Level 5

Transformational

Characterized by an environment that has integrated information governance into its

corporate infrastructure and business processes to such an extent that compliance with

program requirements is routine.

https://learning.oreilly.com/library/view/information-governance-concepts/9781118218303/11_chap03.html#chap03fn05

Source: Used with permission from ARMA.

The Principles apply to all sizes of organizations, in all types of industries, in both

the private and public sectors, and can be used to establish consistent practices

across business units. The Principles are an IG maturity model, and it is used as a

preliminary evaluation of recordkeeping programs and practices.

Interest in and the application of The Principles for assessing an organization's

recordkeeping practices have steadily increased since their establishment in 2009.

The Principles form an accountability framework that includes the processes, roles,

standards, and metrics that ensure the effective and efficient use of records and

information in support of an organization's goals and business objectives.

As shown in Table 3.1, the Generally Accepted Recordkeeping Principles maturity

model associates characteristics that are typical in five levels of recordkeeping

capabilities ranging from 1 (substandard) to 5 (transformational). The levels are

both descriptive and color coded for ease of understanding. The eight principles

and levels (metrics) are applied to the current state of an organization's

recordkeeping capabilities and can be cross-referenced to the policies and

procedures. While it is not unusual for an organization to be at different levels of

maturity in the eight principles, the question “How good is good enough must be

raised and answered; a rating of less than “transformational” may be acceptable,

depending on the organization's tolerance for risk and an analysis of the costs and

benefits of moving up each level.

The maturity levels define the characteristics of evolving and maturing RM

programs. The assessment should reflect the current RM environment and

practices. The principles and maturity level definitions, along with improvement

recommendations (roadmap), outline the tasks required to proactively approach

addressing systematic RM practices and reach the next level of maturity for each

principle. While the Generally Accepted Recordkeeping Principles are broad in

focus, they illustrate the requirements of good RM practices. The Principles

Assessment can also be a powerful communication tool to promote cross-

functional dialogue and collaboration among business units and staff.

The Generally Accepted Recordkeeping Principles maturity model measures

recordkeeping maturity in five levels.

Accountability

The principle of accountability covers the assigned responsibility for RM at a

senior level to ensure effective governance with the appropriate level of authority.

A senior-level executive must be high enough in the organizational structure to

have sufficient authority to operate the RM program effectively. The primary role

of the senior executive is to develop and implement RM policies, procedures, and

https://learning.oreilly.com/library/view/information-governance-concepts/9781118218303/11_chap03.html#tab3.1

guidance and to provide advice on all recordkeeping issues. The direct

responsibility for managing or operating facilities or services may be delegated.

The senior executive must possess an understanding of the business and legislative

environment within which the organization operates, business functions and

activities, and the required relationships with key external stakeholders to

understand how RM contributes to achieving the corporate mission, aims, and

objectives.

It is important for top-level executives to take ownership of the RM issues of the

organization and to identify corrective actions required for mitigation or ensure

resolution of problems and recordkeeping challenges. An executive sponsor should

identify opportunities to raise awareness of the relevance and importance of RM

and effectively communicate the benefits of good RM to staff and management.

The regulatory and legal framework for RM must be clearly identified and

understood. The senior executive must have a sound knowledge of the

organization's information and technological architecture and actively participate

in strategic decisions for IT systems acquisition and implementation.

The senior executive is responsible for ensuring that the processes, procedures,

governance structures, and related documentation are developed. The policies

should identify the roles and responsibilities at all levels of the organization.

An audit process must be developed to cover all aspects of RM within the

organization, including substantiating that sufficient levels of accountability have

been assigned and accountability deficiencies are identified and remedied. Audit

processes should include compliance with the organization policies and procedures

for all records, regardless of format or media. Accountability audit requirements

for electronic records include employing appropriate technology to audit the

information architecture and systems. Accountability structures must be updated

and maintained as changes occur in the technology infrastructure.

The audit process must reinforce compliance and hold individuals accountable.

The results should be constructive, encourage continuous improvement, but not be

used as a means of punishment. The audit should contribute to records program

improvements in risk mitigation, control, and governance issues and have the

capacity to support sustainability.

An audit process must be developed to cover all aspects of RM in the organization.

To be effective, policies must be formalized and integrated into business processes.

Transparency

Policies are broad guidelines for the operation of the organization and provide a

basic guide to action that prescribes the boundaries within which business activities

are to take place. They state the course of action to be followed by the

organization, business unit, department, and employees.

Transparency of recordkeeping practices includes documenting processes and

promoting an understanding of the roles and responsibilities of all stakeholders. To

be effective, policies must be formalized and integrated into business processes.

Business rules and recordkeeping requirements need to be communicated and

installed at all levels of the organization.

Senior management must recognize that transparency is fundamental to IG and

compliance. Documentation must be consistent, current, and complete. A review

and approval process must be established to ensure that the introduction of new

programs or changes can be implemented and integrated into business processes.

Employees must have ready access to RM policies and procedures. They must

receive guidance and training to ensure they understand their roles and

requirements for RM. Recordkeeping systems and business processes must be

designed and developed to clearly define the records lifecycle.

In addition to policies and procedures, guidelines and operational instructions,

diagrams and flowcharts, system documentation, and user manuals must include

clear guidance on how records are to be created, retained, stored, and

dispositioned. The documentation must be readily available and incorporated in

communications and training provided to staff.

Integrity

Record generating systems and repositories must be assessed to determine record-

keeping capabilities. A formalized process must be in place for acquiring or

developing new systems, including requirements for capturing the metadata

required for lifecycle management of records in the systems. In addition, the record

must contain all the necessary elements of an official record, including structure,

content, and context. Records integrity, reliability, and trustworthiness are

confirmed by ensuring that a record was created by a competent authority

according to established processes.

Maintaining the integrity of records means that they are complete and protected

from being altered. The authenticity of a record is ascertained from internal and

external evidence, including the characteristics, structure, content, and context of

the records, to verify they are genuine and not corrupted or altered. In order to trust

that a record is authentic, organizations must ensure that recordkeeping systems

that create, capture, and manage electronic records are capable of protecting

records from accidental or unauthorized alteration or deletion while the record has

value.

Protection

Organizations must ensure the protection of records and ensure they are unaltered

through loss, tampering, or corruption. This includes technological change or the

failure of digital storage media and protecting records against damage or

deterioration.

This principle applies equally to physical and electronic records, each of which has

unique requirements and challenges.

Access and security controls need to be established, implemented, monitored, and

reviewed to ensure business continuity and minimize business risk. Restrictions on

access and disclosure include the methods for protecting personal privacy and

proprietary information. Access and security requirements must be integrated into

the business systems and processes for the creation, use, and storage of records.

LTDP is a series of managed activities required to ensure continued access to

digital materials for as long as necessary. Electronic records requiring long-term

retention may require conversion to a medium and format suitable to ensure long-

term access and readability.

Compliance

RM programs include the development and training of the fundamental

components, including compliance monitoring to ensure sustainability of the

program.

Monitoring for compliance involves reviewing and inspecting the various facets of

records management, including ensuring records are being properly created and

captured, implementation of user permissions and security procedures, workflow

processes through sampling to ensure adherence to policies and procedures,

ensuring records are being retained following disposal authorization, and

documentation of records destroyed or transferred to determine whether

destruction/transfer was authorized in accordance with disposal instructions.

Compliance monitoring can be carried out by an internal audit, external

organization, or RM and must be done on a regular basis.

Availability

Organizations should evaluate how effectively and efficiently records and

information are stored and retrieved using present equipment, networks, and

software. The evaluation should identify current and future requirements and

recommend new systems as appropriate. Certain factors should be considered

before upgrading or implementing new systems. These factors are practicality,

cost, and effectiveness of new configurations.

A major challenge for organizations is ensuring timely and reliable access to and

use of information and that records are accessible and usable for the entire length

of the retention period. Rapid changes and enhancements to both hardware and

software compound this challenge.

Retention

Retention is the function of preserving and maintaining records for continuing use.

The retention schedule identifies the actions needed to fulfill the requirements for

the retention and disposal of records and provides the authority for employees and

systems to retain, destroy, or transfer records. The records retention schedule

documents the record-keeping requirements and procedures, identifying how

records are to be organized and maintained, what needs to happen to records and

when, who is responsible for doing what, and whom to contact with questions or

guidance.

Organizations must identify the scope of their recordkeeping requirements for

documenting business activities based on regulated activities and jurisdictions that

impose control over records. This includes business activities regulated by the

government for every location or jurisdiction in which the company does business.

Other considerations for determining retention requirements include operational,

legal, fiscal, and historical ones.

Records appraisal is the process of assessing the value and risk of records to

determine their retention and disposition requirements. Legal research is outlined

in appraisal reports. This appraisal process may be accomplished as a part of the

process of developing the records retention schedules as well as conducting a

regular review to ensure that citations and requirements are current.

The records retention period is the length of time that records should be retained

and the actions taken for them to be destroyed or preserved. The retention periods

for different records should be based on legislative or regulatory requirements as

well as on administrative and operational requirements.

It is important to document the legal research conducted and used to determine

whether the law or regulation has been reasonably applied to the recordkeeping

practices and provide evidence to regulatory officials or courts that due diligence

has been conducted in good faith to comply with all applicable requirements.

Disposition

Disposition is the last stage in the life cycle of records. When the retention

requirements have been met and the records no longer serve a useful business

purpose, records may be destroyed. Records requiring long-term or permanent

retention should be transferred to an archive for preservation. The timing of the

transfer of physical or electronic records should be determined through the records

retention schedule process. Additional methods, including migration or conversion,

are often required to preserve electronic records.

Records must be destroyed in a controlled and secure manner and in accordance

with authorized disposal instructions. The destruction of records must be clearly

documented to provide evidence of destruction according to an agreed-on program.

Destruction of records must be undertaken by methods appropriate to the

confidentiality of the records and in accordance with disposal instructions in the

records retention schedule. An audit trail documenting the destruction of records

should be maintained, and certificates of destruction should be obtained for

destruction undertaken by third parties. In the event disposal schedules are not in

place, written authorization should be obtained prior to destruction. Procedures

should specify who must supervise the destruction of records. Approved methods

of destruction must be specified for each media type to ensure that information

cannot be reconstructed.

Disposition is the last stage in the life cycle of records. Disposition is not

synonymous with destruction, although destruction may be one disposal option.

Disposition is not synonymous with destruction, although destruction may be one

disposal option. Destruction of records must be carried out under controlled,

confidential conditions by shredding or permanent disposition. This includes the

destruction of confidential microfilm, microfiche, computer cassettes, and

computer tapes as well as paper.

Methods of Disposition

• Discard. The standard destruction method for nonconfidential records. If possible, all records should be shredded prior to recycling. Note that transitory records can also be shredded.

• Shred. Confidential and sensitive records should be processed under strict security. This may be accomplished internally or by secure on-site shredding by a third party vendor who provides certificates of secure destruction. The shredded material is then recycled.

• Archive. This designation is for records requiring long-term or permanent preservation. Records of enduring legal, fiscal, administrative, or historical value are retained.

• Imaging. Physical records converted to digital images, after which the original paper documents are destroyed.

• Purge. This special designation is for data, documents, or records sets that need to be purged by removing material based on specified criteria. This often applies to structure records in databases and applications.

Assessment and Improvement Roadmap

The Generally Accepted Recordkeeping Principles® maturity model can be

leveraged to develop a current state assessment of an organization's recordkeeping

practices and resources, identify gaps and assess risks, and develop priorities for

desired improvements.

The Principles were developed by ARMA International to identify characteristics

of an effective recordkeeping program. Each of the eight principles identifies

issues and practices that, when evaluated against the unique needs and

circumstances of an organization, can be applied to improvements for a

recordkeeping program that meets recordkeeping requirements. The Principles

identify requirements and can be used to guide incremental improvement in

creation, organization, security, maintenance, and other activities over a period of

one to five years. Fundamentally, RM and information governance are business

disciplines that must be tightly integrated with operational policies, procedures,

and infrastructure.

The Principles can be mapped to the four improvement areas in Table 3.2.

As an accepted industry guidance maturity model, the Principles provide a

convenient and complete framework for assessing the current state of an

organization's recordkeeping and developing a roadmap to identify improvements

that will bring the organization into compliance. An assessment/analysis of the

current RM practices, procedures, and capabilities together with current and future

state practices provides two ways of looking at the future requirements of a

complete RM (see Table 3.3).

Table 3.2 Improvement Areas for Generally Accepted Recordkeeping Principles

Who Should Determine IG Policies?

https://learning.oreilly.com/library/view/information-governance-concepts/9781118218303/11_chap03.html#tab3.2

https://learning.oreilly.com/library/view/information-governance-concepts/9781118218303/11_chap03.html#tab3.3

When forming an IG steering committee or board, it is essential to include

representatives from cross-functional groups and at different levels of the

organization. The committee must be driven by an executive sponsor and include

active members from key business units as well as other departments, including IT,

finance, risk, compliance, RM, and legal. Then corporate training/education and

communications must be involved to keep employees trained and current on IG

policies. This function may be performed by an outside consulting firm if there is

no corporate education staff.

Knowledge workers who work with records and sensitive information in any

capacity best understand the nature and value of the records they work with as they

perform their day-to-day functions. IG policies must be developed and

communicated clearly and consistently. Policies are worthless if people do not

know or understand them or how to comply with them. And training is a crucial

element that will be examined in any compliance hearing or litigation that may

arise. “Did senior management not only create the policies but provide adequate

training on them on a consistent basis?” This will be a key question raised. So a

training plan is a necessary piece of IG, and education should be heavily

emphasized.6

The need for IG is increasing due to increased and tightened regulations, increased

litigation, and the increased incidence of theft and misuse of internal documents

and records. Organizations that do not have active IG programs should reevaluate

IG policies and their internal processes following any major loss of records, the

inability to produce accurate records in a timely manner, or any document security

breach or theft. If review boards include a broad section of critical players on the

IG committee and leverage executive sponsorship, they will better prepare the

organization for legal and regulatory rigors.

When forming an IG steering committee or board, it is essential to include

representatives from cross-functional groups.

Knowledge workers who work with records in any capacity best understand the

nature and value of the records they work with.

Table 3.3 Assessment Report and Road Map.

https://learning.oreilly.com/library/view/information-governance-concepts/9781118218303/11_chap03.html#chap03fn06

CHAPTER SUMMARY: KEY POINTS

• Principles of successful IG programs are emerging. They include executive

sponsorship, information classification, integrity, security, accessibility,

control, monitoring, auditing, policy development, and continuous

improvement.

• Accountability is a key aspect of IG.

• The Generally Accepted Recordkeeping Principles® (“The Principles”)

consist of eight principles that provide an IG framework that can support

continuous improvement.

• An audit process must be developed to cover all aspects of RM in the

organization.

• To be effective, policies must be formalized and integrated into business

processes.

• Disposition is the last stage in the life cycle of records. Disposition is not

synonymous with destruction, although destruction may be one disposal

option.

• Knowledge workers who work with records in any capacity best understand

the nature and value of the records they work with.

• When forming an information governance steering committee or board, it is

essential to include representatives from cross-functional groups.

• Organizations without active IG programs should reevaluate IG policies and

their internal processes following any major loss of records, the inability to

produce accurate records in a timely manner, or any document security

breach or theft.

Notes

1. Laura DuBois and Vivian Tero, “Practical Information Governance: Balancing Cost, Risk, and Productivity,” IDC White Paper, August 2010, www.emc.com/collateral/analyst-reports/idc-practical-information- governance-ar.pdf

2. Ibid.

3. Debra Logan, “What Is Information Governance? And Why Is It So Hard?” January 11, 2010, http://blogs.gartner.com/debra_logan/2010/01/11/what- is-information-governance-and-why-is-it-so-hard/.

4. ARMA International, “Generally Accepted Recordkeeping Principles,” www.arma.org/r2/generally-accepted-br-recordkeeping- principles/copyright (accessed November 14, 2013).

5. ARMA International, “Information Governance Maturity Model,” www.arma.org/r2/generally-accepted-br-recordkeeping- principles (accessed November 14, 2013).

6. “Governance Overview (SharePoint Server 2010),” http://technet.microsoft.com/en-us/library/cc263356.aspx (accessed April 19, 2011).

http://www.emc.com/collateral/analyst-reports/idc-practical-information-governance-ar.pdf

http://blogs.gartner.com/debra_logan/2010/01/11/what-is-information-governance-and-why-is-it-so-hard/

http://www.arma.org/r2/generally-accepted-br-recordkeeping-principles/copyright

http://www.arma.org/r2/generally-accepted-br-recordkeeping-principles

http://technet.microsoft.com/en-us/library/cc263356.aspx

* Portions of this chapter are adapted from Chapter 3 of Robert F. Smallwood, Managing Electronic Records: Methods, Best Practices, and Technologies, © John Wiley & Sons, Inc., 2013. Reproduced with permission of John Wiley & Sons, Inc.

CHAPTER 4

Information Risk Planning and

Management

Information risk planning involves a number of progressive steps: identifying potential risks to information, weighing those risks, creating strategic plans to

mitigate the risks, and developing those plans into specific policies. Then it moves

to developing metrics to measure compliance levels and identifying those who are

accountable for executing the new risk mitigating processes. These processes must

be audited and tested periodically not only to ensure compliance, but also to fine

tune and improve the processes.

Depending on the jurisdiction, information is required by specific laws and

regulations to be retained for specified periods, and to be produced in specified

situations. To determine which laws and regulations apply to your organization's

information, research into the legal and regulatory requirements for information in

the jurisdictions in which your organization operates must be conducted.

Step 1: Survey and Determine Legal and Regulatory

Applicability and Requirements

There are federal, provincial, state, and even municipal laws and regulations that

may apply to the retention of information (data, documents, and records).

Organizations operating in multiple jurisdictions must maintain compliance with

laws and regulations that may cross national, state, or provincial boundaries.

Legally required privacy requirements and retention periods must be researched for

each jurisdiction (e.g. county, state, country) in which the business operates, so that

it complies with all applicable laws.

IG, compliance, and records managers must conduct their own legislative research

to apprise themselves of mandatory information retention requirements, as well as

privacy considerations and requirements, especially in regard to personally

https://learning.oreilly.com/library/view/information-governance-concepts/9781118218303/11_chap03.html#chap03

identifiable information (PII). This information must be analyzed and structured

and presented to legal staff for discussion. Then further legal and regulatory

research must be conducted, and firm legal opinions must be rendered by legal

counsel regarding information retention, privacy, and security requirements in

accordance with laws and regulations. This is an absolute requirement. In order to

arrive at a consensus on records that have legal value to the organization and to

construct an appropriate retention schedule, your legal staff or outside legal

counsel should explain the legal hold process, provide opinions and interpretations

of law that apply to your organization, and explain the value of formal records.

In identifying information requirements and risks, legal requirements trump all

others.

Legal requirements trump all others. The retention period for a particular type of

document or PII data or records series must meet minimum retention, privacy, and

security requirements as mandated by law. Business needs and other considerations

are secondary. So, legal research is required before determining and implementing

retention periods, privacy policies, and security measures.

In order to locate the regulations and citations relating to retention of records, there

are two basic approaches. The first approach is to use a records retention citation

service, which publishes in electronic form all of the retention-related citations.

These services usually are purchased on a subscription basis, as the citations are

updated on an annual or more frequent basis as legislation and regulations change.

Figure 4.1 is an excerpt from a Canadian records retention database product called

FILELAW®.1 In this case, the act, citation, and retention periods are clearly

identified.

Another approach is to search the laws and regulations directly using online or

print resources. Records retention requirements for corporations operating in the

United States may be found in the Code of Federal Regulations (CFR).

https://learning.oreilly.com/library/view/information-governance-concepts/9781118218303/13_chap04.html#fig4.1

https://learning.oreilly.com/library/view/information-governance-concepts/9781118218303/13_chap04.html#chap04fn01

Figure 4.1 Excerpt from Canadian Records Retention Database

Source: Ontario, Electricity Act, FILELAW database, Thomson Publishers, May

2012.

In the United States the Code of Federal Regulations lists retention requirements

for businesses, divided into 50 subject matter areas.

The Code of Federal Regulations (CFR) annual edition is the codification of the

general and permanent rules published in the Federal Register by the departments

and agencies of the federal government. It is divided into 50 titles that represent

broad areas subject to federal regulation. The 50 subject matter titles contain one or

more individual volumes, which are updated once each calendar year, on a

staggered basis. The annual update cycle is as follows: titles 1 to 16 are revised as

of January 1; titles 17 to 27 are revised as of April 1; titles 28 to 41 are revised as

of July 1; and titles 42 to 50 are revised as of October 1. Each title is divided into

chapters, which usually bear the name of the issuing agency. Each chapter is

further subdivided into parts that cover specific regulatory areas. Large parts may

be subdivided into subparts. All parts are organized in sections, and most citations

to the CFR refer to material at the section level.2

There is an up-to-date version that is not yet a part of the official CFR but is

updated daily, the Electronic Code of Federal Regulations (e-CFR). “It is not an

official legal edition of the CFR. The e-CFR is an editorial compilation of CFR

material and Federal Register amendments produced by the National Archives and

Records Administration's Office of the Federal Register … and the Government

Printing Office.”3 According to the gpoaccess.gov Web site:

https://learning.oreilly.com/library/view/information-governance-concepts/9781118218303/13_chap04.html#chap04fn02

https://learning.oreilly.com/library/view/information-governance-concepts/9781118218303/13_chap04.html#chap04fn03

The Administrative Committee of the Federal Register (ACFR) has authorized the

National Archives and Records Administration's (NARA) Office of the Federal

maintain the e-CFR as an informational resource pending ACFR action to grant the

e-CFR official legal status. The OFR/GPO partnership is committed to presenting

accurate and reliable regulatory information in the e-CFR editorial compilation

with the objective of establishing it as an ACFR sanctioned publication in the

future. While every effort has been made to ensure that the e-CFR on GPO Access

is accurate, those relying on it for legal research should verify their results against

the official editions of the CFR, Federal Register and List of CFR Sections

Affected (LSA), all available online at www.gpoaccess.gov. Until the ACFR

grants it official status, the e-CFR editorial compilation does not provide legal

notice to the public or judicial notice to the courts.

The OFR updates the material in the e-CFR on a daily basis. Generally, the e-CFR

is current within two business days. The current update status is displayed at the

top of all e-CFR web pages.

For governmental agencies, a key consideration is complying with requests for

information as a result of freedom of information laws like the U.S. Freedom

of Information Act, Freedom of Information Act 2000 (in the United Kingdom),

and similar legislation in other countries. So the process of governing information

is critical to meeting these requests by the public for governmental records.

Step 2: Specify IG Requirements to Achieve Compliance

Once the legal research has been conducted and a process for keeping updated on

laws and regulations has been established, specific external compliance

requirements can be listed and those data, document, and record sets that apply to

those external compliance requirements can be mapped back to applicable holdings

of data sets, document collections, and records series. The crucial task is keeping

your legal and records management staff apprised of changes and updating the

policies and processes appropriately.

Internal IG retention policies may be different from the legally mandated

minimums. For instance, an organization that is not operating in a highly regulated

industry that wants to balance defensible disposition with a need to retain corporate

memory and develop knowledge management (KM) content or “knowledge

bases” may have the option to dispose of e-mail that is not declared a record or

cited for legal hold after 90 days, but may choose, based on corporate culture and

other business factors, to retain e-mail messages for a year. Similarly, the

organization may make legally defensible disposition decisions that reduce the

http://www.gpoaccess.gov/

total amount of information it must manage by using a “last accessed” rationale,

whereby information that has not been accessed for over one year (or whatever the

specified period is) may be destroyed and discarded, as a matter of policy.

Step 3: Create a Risk Profile

Creating a risk profile is a basic building block in enterprise risk

management (yet another ERM acronym), which assists executives in

understanding the risks associated with stated business objectives and allocating

resources, within a structured evaluation approach or framework. There are

multiple ways to create a risk profile, and how often it is done, the external sources

consulted, and stakeholders who have input will vary from organization to

organization.4 A key tenet to bear in mind is that simpler is better and that

sophisticated tools and techniques should not make the process overly complex.

According to the ISO, risk is defined as “the effect of uncertainty on objectives,”

and a risk profile is “a description of a set of risks.”5 Creating a risk profile

involves identifying, documenting, assessing, and prioritizing risks that an

organization may face in pursuing its business objectives. It can be a simple table

chart. Those associated risks can then be evaluated and delineated within a risk or

IG framework.

The corporate risk profile should be an informative tool for executive management,

the CEO, and the board of directors, so it should reflect that tone. In other words, it

should be clear, succinct, and simplified. A risk profile may also serve to inform

the head of a division or subsidiary, in which case it may contain more detail. The

process can also be applied to public and nonprofit entities.

The risk profile is a high-level, executive decision input tool.

A common risk profile method is to create a prioritized or ranked top-10 list of

greatest risks to information.

The time horizon for a risk profile varies, but looking out three to five years is a

good rule of thumb.6 The risk profile typically will be created annually, although

semiannually would serve the organization better and account for changes in the

business and legal environment. But if an organization is competing in a market

sector with rapid business cycles or volatility, the risk profile should be generated

more frequently, perhaps quarterly.

There are different types of risk profile methodologies; common methodologies are

a top-10 list, a risk map, and a heat map. The top-10 list is a simple identification

and ranking of the 10 greatest risks in relation to business objectives. The risk map

is a visual tool that is easy to grasp, with a grid depicting a likelihood axis and an

impact axis, usually rated on a scale of 1 to 5. In a risk assessment meeting,

https://learning.oreilly.com/library/view/information-governance-concepts/9781118218303/13_chap04.html#chap04fn04

https://learning.oreilly.com/library/view/information-governance-concepts/9781118218303/13_chap04.html#chap04fn05

https://learning.oreilly.com/library/view/information-governance-concepts/9781118218303/13_chap04.html#chap04fn06

stakeholders can weigh in on risks using voting technology to generate a

consensus. A heat map is a color-coded matrix generated by stakeholders voting on

risk level by color (e.g., red being highest).

Information gathering is a fundamental activity in building the risk profile. Surveys

are good for gathering basic information, but for more detail, a good method to

employ is direct, person-to-person interviews, beginning with executives and risk

professionals.7 Select a representative cross section of functional groups to gain a

broad view. Depending on the size of the organization, you may need to conduct

20 to 40 interviews, with one person asking the questions and probing while

another team member takes notes and asks occasionally for clarification or

elaboration. Conduct the interviews in a compressed timeframe—knock them out

within one to three weeks and do not drag the process out, as business conditions

and personnel can change over the course of months.

Here are three helpful considerations to conducting successful interviews.

1. Prepare some questions for interviewees in advance and provide them to interviewees so they may prepare and do some of their own research.

2. Schedule the interview close to their offices, and at their convenience. 3. Keep the time as short as possible but long enough to get the answers

you will need: approximately 20 to 45 minutes. Be sure to leave some open time between interviews to collect your thoughts and prepare for the next interview. And follow up with interviewees after analyzing and distilling your notes to confirm you have gained the correct insights.

The information you will be harvesting will vary depending on the interviewee's

level and function. You will need to look for any hard data or reports that show

performance and trends related to information risk. There may be benchmarking

data available as well. Delve into information access and security policies, policy

development, policy adherence, and the like. Ask questions about retention of e-

mail and legal hold processes. Ask about records retention and disposition policies.

Ask about long-term preservation of digital records. Ask about data deletion

policies. Ask for documentation regarding IG-related training and

communications. Dig into policies for access to confidential data and securing vital

records. Try to get a real sense of the way things are run, what is standard

operating procedure, and also how workers might get around overly restrictive

policies, or operate without clear policies. Learn enough so that you can grasp the

management style and corporate culture, and then distill that information into your

findings.

https://learning.oreilly.com/library/view/information-governance-concepts/9781118218303/13_chap04.html#chap04fn07

Once a list of risks is developed, grouping them into basic categories helps

stakeholders grasp them more easily and consider their likelihood and impact.

Key events and developments must also be included in the risk profile. For

instance, a major data breach, the loss or potential loss of a major lawsuit, pending

regulatory changes that could impact your IG policies, or a change in business

ownership or structure must all be accounted for and factored into the information

risk profile. Even changes in governmental leadership should be considered, if they

might impact IG policies. These types of developments should be tracked on a

regular basis and should continue to feed into the risk equation.8 Key events should

be monitored and incorporated in developing and subsequently updating the risk

profile.

At this point, it should be possible to generate a list of specific potential risks. It

may be useful to group or categorize the potential risks into clusters, such as

natural disaster, regulatory, safety, competitive, and so forth. Armed with this list

of risks, you should solicit input from stakeholders as to the likelihood and timing

of the threats or risks. As the organization matures in its risk identification and

handling capabilities, a good practice is to look at the risks and their ratings from

previous years to attempt to gain insights into change and trends—both external

and internal—that affected the risks.

Step 4: Perform Risk Analysis and Assessment

Once you have created a risk profile and identified key risks, you must conduct an

assessment of the likelihood that these risks hold and their resultant impact.

There are five basic steps in conducting a risk assessment:9

1. Identify the risks. This should be an output of creating a risk profile, but if conducting an information risk assessment, first identify the major information-related risks.

2. Determine potential impact. If a calculation of a range of economic impact is possible (e.g., lose $5 to $10 million in legal damages), then include it. If not, be as specific as possible as to how a negative event related to an identified risk can impact business objectives.

Table 4.1 Risk Assessment

https://learning.oreilly.com/library/view/information-governance-concepts/9781118218303/13_chap04.html#chap04fn08

https://learning.oreilly.com/library/view/information-governance-concepts/9781118218303/13_chap04.html#chap04fn09

3. Evaluate risk levels and probabilities and recommend action. This

may be in the form of recommending new procedures or processes, new investments in in-formation technology (IT), or other actions to mitigate identified risks.

4. Create a report with recommendations and implement. You may want to include a risk assessment table (see Table 4.1) as well as written recommendations, then implement.

5. Review periodically. Review annually or semiannually, as appropriate for your organization.

A helpful exercise and visual tool is to draw up a table of top risks, their potential

impacts, actions that have been taken to mitigate the risks, and suggested new risk

countermeasures, as in Table 4.1.

Step 5: Develop an Information Risk Mitigation Plan

After setting out the risks, their potential impacts, and suggested countermeasures

for mitigation, you must create the information risk mitigation plan, which

means developing options and tasks to reduce the specified risks and improve the

odds of achieving business objectives.10 Basically, you are putting in writing the

information you have collected and analyzed in creating the risk profile and risk

assessment, and assigning specifics. The information risk mitigation plan should

include a timetable and milestones for implementation of the recommended risk

mitigation measures, including IT acquisition and implementation and assigning

roles and responsibilities, such as executive sponsor, project manager (PM), and

project team.

The risk mitigation plan develops risk reduction options and tasks to reduce

specified risks and improve the odds for achieving business objectives.

https://learning.oreilly.com/library/view/information-governance-concepts/9781118218303/13_chap04.html#tab4.1

https://learning.oreilly.com/library/view/information-governance-concepts/9781118218303/13_chap04.html#chap04fn10

Step 6: Develop Metrics and Measure Results

How do you know how well you are doing? Have you made progress in reducing

your organization's exposure to information risk? To measure conformance and

performance of your IG program, you must have an objective way to measure how

you are doing, which means numbers and metrics. Assigning some quantitative

measures that are meaningful and do, in fact, measure progress may take some

serious effort and consultation with stakeholders. Determining relevant ways of

measuring progress will allow executives to see progress, as, realistically, reducing

risk is not something anyone can see or feel—the painful realizations are made

only when the risk comes home to roost. Also, valid metrics help to justify

investment in the IG program.

Although the proper metrics will vary from organization to organization, some

specific metrics include:

• Reduce the data lost on stolen or misplaced laptops by 50 percent over the previous fiscal year.

• Reduce the number of hacker intrusion events by 75 percent over the previous fiscal year.

• Reduce e-discovery costs by 25 percent over the previous fiscal year. • Reduce the number of adverse findings in the risk and compliance

audit by 50 percent over the previous fiscal year. • Provide information risk training to 100 percent of the knowledge-

level workforce this fiscal year. • Roll out the implementation of information rights management

software to protect confidential e-documents to 50 users this fiscal year.

• Provide confidential messaging services for the organization's 20 top executives this fiscal year.

Your organization's metrics should be tailored to address the primary goals of your

IG program and should tie directly to stated business objectives.

Step 7: Execute Your Risk Mitigation Plan

Now that you have the risk mitigation plan, it must be executed. To do so, you

must set up regular project/program team meetings, develop key reports on your

information risk mitigation metrics, and manage the process. This is done using

proven project and program management tools and techniques, which you may

want to supplement with collaboration software tools, knowledge management

software, or even internal social media.

But most important, execution of the risk mitigation plan involves communicating

clearly and regularly with the IG team on the progress and status of the IG effort to

reduce information risk.

Metrics are required to measure progress in the risk mitigation plan.

Step 8: Audit the Information Risk Mitigation Program

The metrics you have developed to measure risk mitigation effectiveness must also

be used for audit purposes. Put a process in place to separately and independently

audit compliance to risk mitigation measures, to see that they are being

implemented. The result of the audit should be a useful input in improving and

fine-tuning the program. It should not be viewed as an opportunity to cite shortfalls

and implement punitive actions. It should be a periodic and regular feedback loop

into the IG program.

CHAPTER SUMMARY: KEY POINTS

• In identifying information requirements and risks, legal requirements trump

all others.

• In the United States, the Code of Federal Regulations lists information

retention requirements for businesses, divided into 50 subject matter areas.

• The risk profile is a high-level, executive decision input tool.

• A common risk profile method is to create a prioritized or ranked top-10 list

of greatest risks to information.

• Once a list of risks is developed, grouping them into basic categories helps

stakeholders to grasp them more easily and consider their likelihood and

impact.

• The risk mitigation plan develops risk reduction options and tasks to reduce

specified risks and improve the odds for achieving business objectives.

• Metrics are required to measure progress in the risk mitigation plan.

• The risk mitigation plan must be reviewed and audited regularly and proper

adjustments made.

Notes

1. Ontario, Electricity Act, FILELAW database, Thomson Publishers, May 2012.

2. U.S. Government Printing Office (GPO), “Code of Federal Regulations,” www.gpo.gov/help/index.html#about_code_of_federal_reg ulations.htm (accessed April 22, 2012).

3. National Archives and Records Administration, “Electronic Code of Federal Regulations,” http://ecfr.gpoaccess.gov/cgi/t/text/text- idx?c=ecfr&tpl=%2Findex.tpl (accessed October 2, 2012).

4. John Fraser and Betty Simkins, eds., Enterprise Risk Management: Today's Leading Research and Best Practices for Tomorrow's Executives (Hoboken, NJ: John Wiley & Sons, 2010), p. 171.

5. “ISO 31000 2009 Plain English, Risk Management Dictionary,” www.praxiom.com/iso-31000-terms.htm (accessed March 25, 2013).

6. Fraser and Simkins, p. 172.

7. Ibid.

8. Ibid., p. 179.

9. Health and Safety Executive, “Five Steps to Risk Assessment,” www.hse.gov.uk/risk/fivesteps.htm(accessed March 25, 2013).

10. Project Management Institute, A Guide to the Project Management Body of Knowledge (PMBOK Guide), 4th ed. (Project Management Institute, 2008), ANSI/PMI 99-001-2008, pp. 273–312.

CHAPTER 5

Strategic Planning and Best

Practices for Information

Governance

Securing a sponsor at the executive management level is always crucial to projects and programs, and this is especially true of any strategic planning effort.

An executive must be on board and supporting the effort in order to garner the

resources needed to develop and execute the strategic plan, and that executive must

be held accountable for the development and execution of the plan. These axioms

apply to the development of an information governance (IG) strategic plan.

http://www.gpo.gov/help/index.html#about_code_of_federal_regulations.htm

http://ecfr.gpoaccess.gov/cgi/t/text/text-idx?c=ecfr&tpl=%2Findex.tpl

http://www.praxiom.com/iso-31000-terms.htm

http://www.hse.gov.uk/risk/fivesteps.htm

Also, resources are needed—time, human capital, and budget money. The first is a

critical element: It is not possible to require managers to take time out of their

other duties to participate in a project if there is no executive edict and consistent

follow up, support, and communication. Executive sponsorship is a best practice

and supports the key principle of accountability of the Generally Accepted

Recordkeeping Principles® (The Principles)1 (see Chapter 3 for more detail). And,

of course, without an allocated budget, no program can proceed.

The higher your executive sponsor is in the organization, the better.2 The

implementation of an IG program may be driven by the chief compliance officer,

chief information officer (CIO), or, ideally, the chief executive officer (CEO).

With CEO sponsorship come many of the key elements needed to complete a

successful project, including allocated management time, budget money, and

management focus.

It is important to bear in mind that this IG effort is truly a change

management effort, in that it aims to change the structure, guidelines, and rules

within which employees operate. The change must occur at the very core of the

organization's culture. It must be embedded permanently, and for it to be, the

message must be constantly and consistently reinforced. Achieving this kind of

change requires commitment from the very highest levels of the organization.

Executive sponsorship is critical to project success. There is no substitute. Without

it, a project is at risk of failure.

If the CEO is not the sponsor, then another high-level executive must lead the

effort and be accountable for meeting milestones as the program progresses.

Programs with no executive sponsor can lose momentum and focus, especially as

competing projects and programs are evaluated and implemented. Program failure

is a great risk without an executive sponsor. Such a program likely will fade or

fizzle out or be relegated to the back burner. Without strong high-level leadership,

when things go awry, finger pointing and political games may take over, impeding

progress and cooperation.

The executive sponsor must be actively involved, tracking program objectives and

milestones on a regular, scheduled basis and ensuring they are aligned with

business objectives. He or she must be aware of any obstacles or disputes that

arise, take an active role in resolving them, and push the program forward.

Crucial Executive Sponsor Role

The role of an executive sponsor is high level, requiring periodic and regular

attention to the status of the program, particularly with budget issues, staff

resources, and milestone progress. The role of a program or project manager (PM)

https://learning.oreilly.com/library/view/information-governance-concepts/9781118218303/14_chap05.html#chap05fn01

https://learning.oreilly.com/library/view/information-governance-concepts/9781118218303/11_chap03.html#chap03

https://learning.oreilly.com/library/view/information-governance-concepts/9781118218303/14_chap05.html#chap05fn02

is more detailed and day to day, tracking specific tasks that must be executed to

make progress toward milestones. Both roles are essential. The savvy PM brings in

the executive sponsor to push things along when more authority is needed but

reserves such project capital for those issues that absolutely cannot be resolved

without executive intervention. It is best for the PM to keep the executive sponsor

fully informed but to ask for assistance only when absolutely needed.

At the same time, the PM must manage the relationship with the executive sponsor,

perhaps with some gentle reminders, coaxing, or prodding, to ensure that the role

and tasks of executive sponsorship are being fulfilled. “[T]he successful Project

Manager knows that if those duties are not being fulfilled, it's time to call a timeout

and have a serious conversation with the Executive Sponsor about the viability of

the project.”3

The executive sponsor serves six key purposes on a project:

1. Budget. The executive sponsor ensures an adequate financial commitment is made to see the project through and lobbies for additional expenditures when change orders are made or cost overruns occur.

2. Planning and control. The executive sponsor sets direction and tracks accomplishment of specific, measureable business objectives.

3. Decision making. The executive sponsor makes or approves crucial decisions and resolves issues that are escalated for resolution.

4. Expectation Management. The executive sponsor must manage expectation, since success is quite often a stakeholder perception.

5. Anticipation. Every project that is competing for resources can run into unforeseen blockages and objections. Executive sponsors run interference and provide political might for the PM to lead the project to completion, through a series of milestones.

6. Approval. The executive sponsor signs off when all milestones and objectives have been met.

While the executive sponsor role is high level, the PM's role and tasks are more

detailed and involve day-to-day management.

An eager and effective executive sponsor makes all the difference to a project—if

the role is properly managed by the PM. It is a tricky relationship, since the PM is

always below the executive sponsor in the organization's hierarchy, yet the PM

must coax the superior into tackling certain high-level tasks. Sometimes a third-

party consultant who is an expert in the specific project can instigate and support

requests made of the sponsor and provide a solid business rationale.

Evolving Role of the Executive Sponsor

https://learning.oreilly.com/library/view/information-governance-concepts/9781118218303/14_chap05.html#chap05fn03

The role of the executive sponsor necessarily evolves and changes over the life of

the initial IG program launch, during the implementation phases, and on through

the continued IG program.

To get the program off the ground, the executive sponsor must make the business

case and get adequate budgetary funding. But an effort such as this takes more than

money; it takes time—not just time to develop new policies and implement new

technologies, but the time of the designated PM, program leaders, and needed

program team members.

In order to get this time set aside, the IG program must be made a top priority of

the organization. It must be recognized, formalized, and aligned with

organizational objectives. All this up-front work is the responsibility of the

executive sponsor.

Once the IG program team is formed, team members must clearly understand why

the new program is important and how it will help the organization meet its

business objectives. This message must be regularly reinforced by the executive

sponsor; he or she must not only paint the vision of the future state of the

organization but articulate the steps in the path to get there.

When the formal program effort commences, the executive sponsor must remain

visible and accessible. He or she cannot disappear into everyday duties and expect

the program team to carry the effort through. The executive sponsor must be there

to help the team confront and overcome business obstacles as they arise and must

praise the successes along the way. This requires active involvement and a

willingness to spend the time to keep the program on track and focused.

The executive sponsor must be the lighthouse that shows the way even through

cloudy skies and rough waters. This person is the captain who must steer the ship,

even if the first mate (PM) is seasick and the deckhands (program team) are

drenched and tired.

After the program is implemented, the executive sponsor is responsible for

maintaining its effectiveness and relevance. This is done through periodic

compliance audits, testing and sampling, and scheduled meetings with the ongoing

PM.

The role of the executive sponsor changes during the inception, planning, and

execution of the IG program.

Building Your IG Team

Who should make up the IG team? Although there are no set requirements or

formulas, the complex nature of IG and the fact that it touches upon a number of

specialized disciplines and functional areas dictates that a cross-functional

approach be taken. So you will need representatives from several departments.

There are some absolutes: you must have a representative from your legal staff or

outside counsel, your information technology (IT) department, a senior records

officer (SRO) or the equivalent, a risk management specialist or manager, an

executive sponsor, and the IG program manager. In addition, there may be a need

for input from managers of human resources, company communications, and

certain business units. Depending on the scope of the effort, other possible IG team

members might include an IT security expert, the corporate or agency archivist,

business analysts, chief knowledge officer or knowledge management (KM)

professional, litigation support head, financial analyst, business process specialist,

project management professional, and other professionals in functions related to

these areas.

Assigning IG Team Roles and Responsibilities

The executive sponsor will need to designate an IG PM. Depending on the focus of

the IG effort, that person could come from several areas, including legal,

compliance, risk management, records management, or IT.

In terms of breaking down the roles and responsibilities of the remainder of the IG

team, the easy decision is to have IG team representatives take responsibility for

the functional areas of their expertise. But there will be overlap, and it is best to

have some pairs or small work groups teamed up to gain the broadest amount of

input and optimum results. This will also facilitate cross training. For instance,

inside legal counsel may be responsible for rendering the final legal opinions, but

because they are not expert in records, document management, or risk

management, they could benefit from input of others in specialized functional

areas, which will inform them and help narrow and focus their legal research.

Basic research into which regulations and laws apply to the organization regarding

security, retention, and preservation of e-mail, e-records, and personally

identifiable information (PII) could be conducted by the SRO or records

management head, in consultation with the corporate archivist and CIO, with the

results of their findings and recommendations drafted and sent to the legal counsel.

The draft report may offer up several alternative approaches that need legal input

and decisions. Then the legal team lead can conduct its own, focused research and

make final recommendations regarding the organization's legal strategy, business

objectives, financial position, and applicable laws and regulations.

The risk mitigation plan develops risk reduction options and tasks to reduce

specified risks and improve the odds for achieving business objectives.

The IG team must include a cross-functional group of stakeholders from various

departments, including legal, records management, IT, and risk management.

The result of the research, consultation, and collaboration of the IG team should

result in a final draft of the IG strategic plan. It will still need more input and

development to align the plan with business objectives, an analysis of internal and

external drivers, applicable best practices, competitive analysis, applicable IT

trends, an analysis and inclusion of the organization's culture, and other factors.

Align Your IG Plan with Organizational Strategic Plans

The IG plan must support the achievement of the organization's business

objectives and therefore must be melded into the organization's overall strategic

plan. Integration with the strategic plan means that the business objectives in the

IG plan are consistent with, and in support of, the enterprise strategic plan.

So, for example, if the corporate strategy includes plans for acquiring smaller

competitors and folding them into the organization's structure as operating

divisions, then the IG plan must assist and contribute to this effort. Plans for

standardizing operating policies and procedures must include a consistent,

systematized approach to the components of IG, including stakeholder

consultation, user training and communications, and compliance audits. The IG

plan should bring a standard approach across the spectrum of information use and

management within the organization and it must be forged to accommodate the

new technology acquisitions. This means that e-mail policies, e-discovery policies,

mobile device policies, social media policies, cloud collaboration and storage use,

and even nitty-gritty details like report formats, data structures, document

taxonomies, and metadata must be consistent and aligned with the overall strategic

plan. In other words, the goal is to get all employees on the same page and working

to support the business objectives of the strategic plan in everyday small steps

within the IG plan.

The IG strategic plan must be aligned and synchronized with the organization's

overall strategic plans, goals, and business objectives.

The organization will also have an IT plan that must be aligned with the strategic

plan to support overall business objectives. The IT strategy may be to convert new

acquisitions to the internal financial and accounting systems of the organization

and to train new employees to use the existing software applications under the

umbrella of the IG plan. Again, the IG plan needs to be integrated with the IT

strategy and must consider the organization's approach to IT.

The result of the process of aligning the IG effort with the IT strategy and the

organization's overall strategic plan will mean, ideally, that employee efforts are

more efficient and productive since they are consistently moving toward the

achievement of the organization's overall strategic goals. The organization will be

healthier and will have less dissent and confusion with clear IG policies that

leverage the IT strategy and help employees pursue overall business objectives.

Further considerations must be folded into the IG plan. As every corporate culture

is different and has a real impact on decision-making and operational approaches,

corporate culture must be included in the plan. Corporate culture includes the

organization's appetite for risk, its use of IT (e.g., forward-thinking first adopter),

its capital investment strategies, and other management actions.

So, if the organization is conservative and risk averse, it may want to hold off on

implementing some emerging e-discovery technologies that can cut costs but also

induce greater risk. Or if it is an aggressive, progressive, risk-taking organization,

it may opt to test and adopt newer e-discovery technologies under the IT strategy

and umbrella of IG policies. An example may be the use of predictive

coding technology in early case assessment(ECA). Predictive coding uses text

auto-classification technology and neural technology with the assistance of human

input to “learn” which e-documents might be relevant in a particular legal matter

and which may not be. Through a series of steps of testing and checking subsets of

the documents, humans can provide input to improve the document sorting and

selection process. The software uses machine learning (artificial intelligence

whereby the software can change and improve on a particular task, as its decision

engine is shaped and “trained” by input) to improve its ability to cull through and

sort documents.

Predictive coding can reduce e-discovery costs, yet there are risks that the

approach can be challenged in court and could, in fact, affect the case adversely.

Thus, a decision on a technology like predictive coding can involve and include

elements of the IG plan, IT strategy, and overall organizational strategic plan.

And there are resource issues to consider: How much management time, or

bandwidth, is available to pursue the IG plan development and execution? Is there

a budget item to allow for software acquisitions and training and communications

to support the execution of the IG plan? Obviously, without the allocated

management time and budget money, the IG plan cannot be executed.

Survey and Evaluate External Factors

The IG plan is now harmonized and aligned with your organization's strategic plan

and IT strategy, but you are not finished yet, because the plan cannot survive in a

vacuum: Organizations must analyze and consider the external business, legal, and

technological environment and fold their analysis into their plans.

The IG strategic plan must be informed with an assessment of relevant technology

trends.

ANALYZE IT TRENDS

IG requires IT to support and monitor implementation of polices, so

it matters what is developing and trending in the IT space. What new technologies

are coming online? Why are they being developed and becoming popular? How do

these changes in the business environment that created opportunities for new

technologies to be developed affect your organization and its ability execute its IG

plan? How can new technologies assist? Which ones are immature and too risky?

These are some of the questions that must be addressed in regard to the changing

IT landscape.

Some changes in information and communications technology (ICT) are rather

obvious, such as the trends toward mobile computing, tablet and smartphone

devices, cloud storage, and social media use. Each one of these major trends that

may affect or assist in implementing IG needs to be considered within the

framework of the organization's strategic plan and IT strategy. If the corporate

culture is progressive and supportive of remote work and telecommuting, and if the

organizational strategy aims to lower fixed costs by reducing the amount of office

space for employees and moving to a more mobile workforce, then trends in tablet

and smartphone computing that are relevant to your organization must be analyzed

and considered. Is the organization going to provide mobile devices or support a

bring-your-own-device (BYOD) environment? Which equipment will you support?

Will you support iOS, Android, or both? What is your policy going to be on phone

jacking? What is the IG policy regarding confidential documents on mobile

devices? Will you use encryption? If so, which software? Is your enterprise

moving to the cloud computing model? Utilizing social media? What about Big

Data and analytics?Are you going to consider deploying auto-classification and

predictive coding technologies? What are the trends that might affect your

organization?

Many, many questions must be addressed, but the evaluation must be narrowed

down to those technology trends that specifically might impact the execution of

your IG plan and rollout of new technology.

On a more granular level, you must evaluate even supported file and document

formats. It gets that detailed, when you are crafting IG policy. For instance, PDF/A

is the standard format for archiving electronic documents. So your plans must

include long-term digital preservation (LTDP) standards and best practices.

SURVEY BUSINESS CONDITIONS AND THE ECONOMIC

ENVIRONMENT

If the economy is on a down cycle, and particularly if your business sector has

been negatively affected, resources may be scarcer than in better times. Hence, it

may be more difficult to get budget approval for necessary program expenses, such

as new technologies, staff, training materials, communications, and so forth. This

means your IG plan may need to be scaled back or its scope reduced.

Implementing the plan in a key division rather than attempting an enterprise rollout

may be the best tactic in tough economic times.

Trends and conditions in the internal and external business environment must be

included in the IG strategic plan.

But if things are booming and the business is growing fast, budget money for

investments in the IG program may be easier to secure, and the goals may be

expanded.

IG should be an ongoing program, but it takes time to implement, and it takes

resources to execute, audit, and continue to refine. So an executive looking for a

quick and calculable payback on the investment may want to focus on narrower

areas. For instance, the initial focus may be entirely on the legal hold and e-

discovery process, with business objectives that include reducing pretrial costs and

attorney fees by a certain percentage or amount. It is much easier to see concrete

results when focusing on e-discovery, since legal costs are real, and always will be

there. The business case may be more difficult to make if the IG effort is broader

and improves the ability to organize and search for information faster and to

execute more complete searches to improve the basis for management decision

making. Improved management decision making will improve the organization's

competitiveness long-term, but it may be difficult to cite specific examples where

costs were saved or revenues were increased as a result of the “better decisions”

that should come about through better IG.

ANALYZE RELEVANT LEGAL, REGULATORY, AND

POLITICAL FACTORS

In consultation with your legal team or lead, the laws and regulations that affect

your industry should be identified. Narrowing the scope of your analysis, those that

specifically could impact your governance of information should be considered

and analyzed. What absolute requirements do they impose? Where there is room

for interpretation, where, legally, does your organization want to position itself?

How much legal risk is acceptable? These are the types of questions you will have

to look to your legal and risk management professionals to make. Again, legal

requirements trump all others.

Your decision process must include considerations for the future and anticipated

future changes. Changes in the legal and regulatory environment happen based on

the political leaders who are in place and any pending legislation. So you must go

further and analyze the current political environment and make some judgments

based on the best information you can gather, the organization's culture and

appetite for risk, management style, available resources, and other factors.

Generally, a more conservative environment means less regulation, and this

analysis must also be folded into your IG strategic plan.

Laws and regulations relevant to your organization's management and distribution

of information in all jurisdictions must be considered and included in the IG

strategic plan. Legal requirements trump all others.

Include a best practices review in your IG strategic plan. The most relevant best

practices in IG are those in your industry proven by peers and competitors.

SURVEY AND DETERMINE INDUSTRY BEST PRACTICES

IG is a developing hybrid discipline. In a sense, it is a superset of records

management and a subset of governance, risk management, and

compliance (GRC), that emerged to help manage the explosion in the amount of

records, documents, and data that must be managed in today's increasingly high-

volume and velocity business environment and highly regulated compliance and

litigation environment. As such, best practices are still being formed and added to.

This process of testing, proving, and sharing best practices will continue for some

time as the practices are expanded, revised, and refined.

The most relevant study of IG best practices is one that is conducted for your

organization and surveys your industry and what some of your more progressive

competitors are doing in regard to IG. Often the best way to accomplish such a

study is by engaging a third-party consultant, who can more easily contact, study,

and interview your competitors in regard to their practices. Business peer groups

and trade associations also can provide some consensus as to emerging best

practices.

Twenty-five IG best practices covering a number of areas in which IG has an

impact or should be a major consideration are listed next.

1. IG is a key underpinning for a successful RM program. Practicing good IG is the essential foundation for building a legally defensible RM program; it provides the basis for consistent, reliable methods for managing documents and records. Having trusted and reliable records, reports, and databases allows managers to make key

decisions with confidence.4 And accessing that information and business intelligence in a timely fashion can yield a long-term sustainable competitive advantage, creating more agile enterprises.

To implement a successful IG program, enterprises must standardize and

systematize their handling of information, in particular their formal business

records. They must analyze and optimize how information is accessed,

controlled, managed, shared, stored, preserved, and audited. They must have

complete, current, and relevant policies, processes, and technologies to

manage and control information, including who is able to

access what information, and when, to meet external legal and regulatory

demands and internal governance requirements. This, in short, is IG.

2. IG is not a project but rather an ongoing program that provides an umbrella of rules and policies, monitored and enforced with the support of IT to manage and control information output and communications. Since technologies change so quickly, it is necessary to have overarching technology-agnostic policies that can manage the various IT platforms that an organization may use.

Compare the IG program to a workplace safety program; every time a new

location, team member, piece of equipment, or toxic substance is acquired

by the organization, the workplace safety program should dictate how that

is handled. If it does not, the workplace safety policies/procedures/training

that are part of the workplace safety program need to be updated. Regular

reviews are conducted to ensure the program is being followed, and

adjustments are made based on the findings. The effort never ends.5

3. Using an IG framework or maturity model is helpful in assessing and guiding IG programs. Various models are offered, such as The Principles from ARMA International; the Information Governance Reference Model, which grew out of the Electronic Discovery Reference Model (found at EDRM.net);6 or MIKE2.0, which was developed by the consulting firm Bearing Point and released to the public domain. Another tool that is particularly used in the Australian market for records management projects is Designing and Implementing Recordkeeping Systems (DIRKS).

4. Defensible deletion of data debris and information that no longer has value is critical in the era of Big Data. You must have IG polices in place and be able to prove that you follow them consistently and systematically in order to justify, to the courts and regulators, deletion of information. With a smaller information footprint, organizations can more easily find what they need and derive business value from it.7 Data debris must be eliminated regularly and

https://learning.oreilly.com/library/view/information-governance-concepts/9781118218303/14_chap05.html#chap05fn04

https://learning.oreilly.com/library/view/information-governance-concepts/9781118218303/14_chap05.html#chap05fn05

https://learning.oreilly.com/library/view/information-governance-concepts/9781118218303/14_chap05.html#chap05fn06

https://learning.oreilly.com/library/view/information-governance-concepts/9781118218303/14_chap05.html#chap05fn07

consistently, and to do this, processes and systems must be in place to cull out valuable information and discard the data debris. An IG program sets the framework to accomplish this.

5. IG policies must be developed before enabling technologies are deployed to assist in enforcement. After the policy-making effort, seek out the proper technology tools to assist in monitoring, auditing, and enforcement.

6. To provide comprehensive e-document security throughout a document's life cycle, documents must be secured upon creation using highly sophisticated technologies, such as information rights management (IRM) technology. IRM acts as a sort of “security wrapper” that denies access without proper credentials. Document access and use by individuals having proper and current credentials is also tightly monitored IRM software controls the access, copying, editing, forwarding, and printing of documents using a policy engine that manages the rights to view and work on an e-document. Access rights are set by levels or “roles” that employees are responsible for within an organization.

7. A records retention schedule and legal hold notification (LHN) process are the two primary elements of a fundamental IG program. These are the basics. Implementation will require records inventorying, taxonomy development, metadata normalization and standardization, and a survey of LHN best practices.

8. A cross-functional team is required to implement IG. Since IG contains and requires elements of a number of established disciplines, representatives from the key areas must be included in the planning and implantation effort. At a minimum, you will need team leaders from legal, IT, records management, compliance and risk management, human resources, and executive management. Members from corporate communications, knowledge management, systems security, finance and accounting, and other functional areas also may be needed. Depending on the circumstances, you may need representatives from major business units within the organization.

9. The first step in information risk planning is to consider the applicable laws and regulations that apply to your organization in the jurisdictions in which it conducts business. Federal, provincial, state, and even municipal laws and regulations may apply to the retention of data, documents, and records. Organizations operating in multiple jurisdictions must be compliant with laws and regulations that may cross national, state, or provincial boundaries. Legally

required privacy requirements and retention periods must be researched for each jurisdiction (state, country) in which the business operates, so that all applicable laws are complied with.

10. Developing a risk profile is a basic building block in enterprise risk management, which assists executives in understanding the risks associated with stated business objectives and in allocating resources within a structured evaluation approach or framework. There are multiple ways to create a risk profile, and the frequency with which it is created, the external sources consulted, and stakeholders who have input will vary from organization to organization.8 A key tenet to bear in mind is that simpler is better and that sophisticated tools and techniques should not make the process overly complex.

11. An information risk mitigation plan is a critical part of the IG planning process. An information risk mitigation plan helps in developing risk mitigation options and tasks to reduce the specified risks and improve the odds of achieving business objectives.9

12. Proper metrics are required to measure the conformance and performance of your IG program. You must have an objective way to measure how you are doing, which means numbers and metrics. Assigning some quantitative measures that are meaningful before rolling out the IG program is essential.

13. IG programs must be audited for effectiveness. Periodic audits will tell you how your organization is doing and where to fine-tune your efforts. To keep an IG program healthy, relevant, and effective, changes and fine-tuning will always be required.

14. An enterprise wide retention schedule is preferable because it eliminates the possibility that different business units will have conflicting records retention periods. For example, if one business unit discards a group of records after 5 years, it would not make sense for another business unit to keep the same records for 10 years. Where enterprise-wide retention schedules are not possible, smaller business units, such as divisions or regions, should operate under a consistent retention schedule.

15. Senior management must set the tone and lead sponsorship for vital records program governance and compliance. Although e-records are easier to protect and backup, most vital records today are e- records. These are an organization's most essential records. Without them, an organization cannot continue operations.

https://learning.oreilly.com/library/view/information-governance-concepts/9781118218303/14_chap05.html#chap05fn08

https://learning.oreilly.com/library/view/information-governance-concepts/9781118218303/14_chap05.html#chap05fn09

16. Business processes must be redesigned to improve and optimize the management and security of information and especially the most critical of information, electronic records, before implementing enabling technologies. For instance, using electronic records management (ERM) software fundamentally changes the way people work, and greater efficiencies can be gained with business process redesign (versus simply using ERM systems as electronic filing cabinets to speed up poor processes).

17. E-mail messages, both inbound and outbound, should be archived automatically and (preferably) in real time. This ensures that spoliation (i.e., the loss of proven authenticity of an e-mail) does not occur. Archiving preserves legal validity and forensic compliance. By policy, most messages will be deleted in a short timeframe. Additionally, e-mail should be indexed to facilitate the searching process, and all messages should be secured in a single location (with backups). With these measures, the authenticity and reliability of e- mail records can be ensured.

18. Personal archiving of e-mail messages should be disallowed. Although users will want to save certain e-mail messages for their own reasons, control and management of e-mail archiving must be at the organization level or as high of a level as is practical, such as division or region.

19. Destructive retention of e-mail helps to reduce storage costs and legal risk while improving “findability” of critical records. It makes good business sense to have a policy to, say, destroy all e-mail messages after 90 or 120 days that are not flagged as potential records (which, e.g., help document a transaction or a situation that may come into dispute in the future) or those that have a legal hold.

20. Take a practical approach and limit cloud use to documents that do not have long retention periods and carry a low litigation risk. Doing this will reduce the risk of compromising or losing critical documents and e-records. Some duplicate copies of vital records may be stored securely in the cloud to help the organization recover in the event of a disaster.

21. Manage social media content by IG policies and monitor it with controls that ensure protection of critical information assets and preservation of business records. Your organization must state clearly what content and tone is acceptable in social media use, and it must retain records of that use, which should be captured in real time.

22. International and national standards provide effective guidance for implementing IG. Although there are no absolutes, researching and referencing International Organization for Standardization (ISO) and other standards must be a part of any IG effort.

23. Creating standardized metadata terms should be part of an IG effort that enables faster, more complete, and more accurate searches and retrieval of records. This is important not only in everyday business operations but also when delving through potentially millions of records during the discovery phase of litigation. Good metadata management also assists in the maintenance of corporate memory and in improving accountability in business operations.10 Using a standardized format and controlled vocabulary provides a “precise and comprehensible description of content, location, and value.”11 Using a controlled vocabulary means your organization has standardized a set of terms used for metadata elements that describe records. This ensures consistency across a collection and helps with optimizing search and retrieval functions and records research as well as with meeting e-discovery requests, compliance demands, and other legal and regulatory requirements.

24. Some digital information assets must be preserved permanently as part of an organization's documentary heritage.12 It is critical to identify records that must be kept long term as early in the process as possible; ideally, these records should be identified prior to or upon creation. LTDP applies to content that is born digital as well as content that is converted to digital form. Digital preservation is defined as long-term, error-free storage of digital information, with means for retrieval and interpretation, for the entire time span that the information is required to be retained. Dedicated repositories for historical and cultural memory, such as libraries, archives, and museums, need to move forward to put in place trustworthy digital repositories that can match the security, environmental controls, and wealth of descriptive metadata that these institutions have created for analog assets (such as books and paper records). Digital challenges associated with records management affect all sectors of society—academic, government, private, and not- for-profit enterprises—and ultimately citizens of all developed nations.

25. Executive sponsorship is crucial. Securing an executive sponsor at the senior management level is key to successful IG programs. It is

https://learning.oreilly.com/library/view/information-governance-concepts/9781118218303/14_chap05.html#chap05fn10

https://learning.oreilly.com/library/view/information-governance-concepts/9781118218303/14_chap05.html#chap05fn11

https://learning.oreilly.com/library/view/information-governance-concepts/9781118218303/14_chap05.html#chap05fn12

not possible to require managers to take time out of their other duties to participate in a project if there is no executive edict. It is a best practice across industry sectors and technology sets and supports the Accountability principle of The Principles.13

Formulating the IG Strategic Plan

Now comes the time to make sense of all the data and input your IG team has

gathered and hammer it into a workable IG strategic plan. Doing this will involve

some give-and-take among IG team members, each having their own perspective

and priorities. Everyone will be lobbying for the view of their functional groups. It

is the job of the executive sponsor to set the tone and to emphasize organizational

business objectives so that the effort does not drag out or turn into a competition

but is a well-informed consensus development process that results in a clear,

workable IG strategic plan.

SYNTHESIZE GATHERED INFORMATION AND FUSE IT

INTO IG STRATEGY

Your IG team will have gathered a great deal of information, which needs to be

analyzed and distilled into actionable strategies. This process will depend on the

expertise and input of the specialized knowledge your team brings to the table

within your organizational culture. Team members must be able to make decisions

and establish priorities that reflect organizational business objectives and consider

a number of influencing factors.

Do not prolong the strategy development process. The longer it lasts, the more key

factors influencing it can change. You want to develop a strategic plan that is

durable enough to withstand changes in technology, legislation, and other key

influencing factors, but it should be relevant to that snapshot of information that

was collected early on. When all the parts and pieces start changing and require

reconsideration, a dated IG plan does not serve the organization well.

Develop IG strategies for each of the critical areas, including the legal hold

process, e-discovery action plans, e-mail policy, mobile computing policy, IT

acquisition strategy, confidential document handling, vital records and disaster

planning, social media policy, and other areas that are important to your

organization. To maintain focus, do this first without regard to the prioritization of

these areas.

Fuse the findings of all your analyses of external and internal factors into your IG

strategic plan. Develop strategies and then prioritize them.

https://learning.oreilly.com/library/view/information-governance-concepts/9781118218303/14_chap05.html#chap05fn13

Then you must go through the hard process of prioritizing your strategies and

aligning them to your organizational goal and objectives. This may not be difficult

in the beginning—for instance, your IG strategies for legal holds and e-discovery

readiness are likely going to take higher priority than your social media policy, and

protecting vital records is paramount to any organization. As the process

progresses, it will become more challenging to make trade-offs and establish

priorities. Then you must tie these strategies to overall organizational goals and

business objectives.

A good technique to keep goals and objectives in mind may be to post them

prominently in the meeting room where these strategy sessions take place. This

will help to keep the IG team focused.

DEVELOP ACTIONABLE PLANS TO SUPPORT

ORGANIZATIONAL GOALS AND OBJECTIVES

Plans and policies to support your IG efforts must be developed that identify

specific tasks and steps and define roles and responsibilities for those who will be

held accountable for their implementation. This is where the rubber meets the road.

But you cannot simply create the plan and marching orders: You must build in

periodic checks and audits to test that new IG policies are being followed and that

they have hit their mark. Invariably, there will be adjustments made continually to

craft the policies for maximum effectiveness and continued relevance in the face of

changes in external factors, such as legislation and business competition, and

internal changes in management style and structure.

CREATE NEW IG DRIVING PROGRAMS TO SUPPORT

BUSINESS GOALS AND OBJECTIVES

You have to get things moving and get employees motivated, and launching new

sub-programs within the overall IG program is a good way to start. For instance, a

new “e-discovery readiness” initiative can show almost immediate results if

implemented properly, with the support of key legal and records management team

members, driven by the executive sponsor. You may want to revamp the legal hold

process to make it more complete and verifiable, assigning specific employees

accountability for specific tasks. Part of that effort may be evaluating and

implementing new technology-assisted review (TAR) processes and predictive

coding technology. So you will need to bring in the IG team members responsible

for IT and perhaps business analysis. Working cooperatively on smaller parts of

the overall IG program is a way to show real results within defined time frames.

Piecing together a series of program components is the best way to get started, and

it breaks the overall IG program down into digestible, doable chunks. A small win

early on is crucial to maintain momentum and executive sponsorship. And e-

discovery has real costs: yet progress can be measured objectively in terms of

reducing the cost of activities such as early case assessment (ECA). Benefits can

be measured in terms of reduced attorney review hours, reduced costs, and reduced

time to accomplish pretrial tasks.

Create supporting subprograms to jump-start your IG program effort. Smaller

programs should be able to measure real results based on metrics that are agreed on

in advance.

To be clear, you will need to negotiate and agree on the success metrics the

program will be measured on in advance.

There are other examples of supporting IG subprograms, such as e-mail

management and archiving, where storage costs, search times, and information

breaches can be measured in objective terms. Or you may choose to roll out new

policies for the use of mobile devices within your organization, where adherence to

policy can be measured by scanning mobile devices and monitoring their use.

DRAFT THE IG STRATEGIC PLAN AND GAIN INPUT

FROM A BROADER GROUP OF STAKEHOLDERS

Once you have the pieces of the plan drafted and the IG team is in agreement that it

has been harmonized and aligned with overall organizational goals and objectives,

you must test the waters to see if you have hit the mark. It is a good practice to

expose a broader group of stakeholders to the plan to gain their input. Perhaps your

IG team has become myopic or has passed over some points that are important to

the broader stakeholder audience. Solicit and discuss their input, and to the degree

that there is a consensus, refine the IG strategic plan one last time before finalizing

it. But remember, it is a living document, a work in progress, which will require

revisiting and updating to ensure it is in step with changing external and internal

factors. Periodic auditing and review of the plan will reveal areas that need to be

adjusted and revised to keep it relevant and effective.

GET BUY-IN AND SIGN-OFF AND EXECUTE THE PLAN

Take the finalized plan to executive management, preferably including the CEO,

and present the plan and its intended benefits to them. Field their questions and

address any concerns to gain their buy-in and the appropriate signatures. You may

have to make some minor adjustments if there are significant objections, but, if you

have executed the stakeholder consultation process properly, you should be very

close to the mark. Then begin the process of implementing your IG strategic plan,

including regular status meetings and updates, steady communication and

reassurance of your executive sponsor, and planned audits of activities.

CHAPTER SUMMARY: KEY POINTS

• Engaged and vested executive sponsors are necessary for IG program

success. It is not possible to require managers to take time out of their other

duties to participate in a project if there is no executive edict or allocated

budget.

• The executive sponsor must be: (1) directly tied to the success of the

program, (2) fully engaged in and aware of the program, and (3) actively

eliminating barriers and resolving issues.

• The role of the executive sponsor evolves over the life of the IG program

and IG program effort. Initially, the focus is on garnering the necessary

resources, but as the program commences, the emphasis is more on

supporting the IG program team and clearing obstacles. Once the program is

implemented, the responsibilities shift to maintaining the effectiveness of the

program through testing and audits.

• While the executive sponsor role is high level, the project manager's role and

tasks involve more detailed and day-to-day management.

• The risk mitigation plan develops risk reduction options and tasks to reduce

specified risks and improve the odds for achieving business objectives.

• The IG team must include a cross-functional group of stakeholders from

various departments, including legal, records management, IT, and risk

management.

• The IG strategic plan must be aligned and synchronized with the

organization's overall strategic plans, goals, and business objectives.

• The IG strategic plan must include an assessment of relevant technology

trends.

• Trends and conditions in the internal and external business environment

must be included in the IG strategic plan.

• Laws and regulations relevant to your organization's management and

distribution of information in all jurisdictions must be considered and

included in the IG strategic plan. Legal requirements trump all others.

• Include a best practices review in your IG strategic plan. The most relevant

best practices in IG are those in your industry proven by peers and

competitors. (Twenty-five IG best practices are listed in this chapter for the

first time in print.)

• Fuse the findings of all your analysis of external and internal factors into

your IG strategic plan. Develop strategies and then prioritize them.

• Creating supporting subprograms to jump-start your IG program effort.

Smaller programs should be able to measure real results based on metrics

that are agreed on in advance.

• Make sure to get executive sign-off on your IG strategic plan before moving

to execute it.

Notes

1. ARMA International, “How to Cite GARP,” www.arma.org/garp/copyright.cfm (accessed October 9, 2013).

2. Roger Kastner, “Why Projects Succeed—Executive Sponsorship,” February 15, 2011, http://blog.slalom.com/2011/02/15/why-projects- succeed-%E2%80%93-executive-sponsorship/

3. Ibid.

4. Economist Intelligence Unit, “The Future of Information Governance,” www.emc.com/leadership/business-view/future- information-governance.htm (accessed October 9, 2013).

5. Monica Crocker, e-mail to author, June 21, 2012.

6. EDRM, “Information Governance Reference Model (IGRM) Guide,” www.edrm.net/resources/guides/igrm (accessed November 30, 2012).

7. Randolph A. Kahn, https://twitter.com/InfoParkingLot/status/273791612172259329, Nov. 28, 2012.

8. John Fraser and Betty Simkins, eds., Enterprise Risk Management: Today's Leading Research and Best Practices for Tomorrow's Executives (Hoboken, NJ: John Wiley & Sons, 2010), p. 171.

9. Project Management Institute, A Guide to the Project Management Body of Knowledge (PMBOK Guide), 4th ed. (Newtown Square, PA Project Management Institute, 2008), ANSI/PMI 99–001–2008, pp. 273–312.

10. Kate Cumming, “Metadata Matters,” in Julie McLeod and Catherine Hare, eds., Managing Electronic Records, p. 34 (London: Facet, 2005).

11. Minnesota State Archives, Electronic Records Management Guidelines, “Metadata,” March 12, 2012, www.mnhs.org/preserve/records/electronicrecords/ermetadata.html .

12. Charles Dollar and Lori Ashley, e-mail to author, August 10, 2012.

13. ARMA International, “How to Cite GARP.”

CHAPTER 6

http://www.arma.org/garp/copyright.cfm

http://blog.slalom.com/2011/02/15/why-projects-succeed-%E2%80%93-executive-sponsorship/

http://www.emc.com/leadership/business-view/future-information-governance.htm

http://www.edrm.net/resources/guides/igrm

https://twitter.com/InfoParkingLot/status/273791612172259329

http://www.mnhs.org/preserve/records/electronicrecords/ermetadata.html

Information Governance Policy

Development

To develop an information governance (IG) policy, you must inform and frame the policy with internal and external frameworks, models, best practices, and

standards—those that apply to your organization and the scope of its planned IG

program. In this chapter, we first present and discuss major IG frameworks and

models and then identify key standards for consideration.

A Brief Review of Generally Accepted Recordkeeping

Principles®

In Chapter 3 we introduced and discussed ARMA International's eight Generally

Accepted Recordkeeping Principles®, known as The Principles1 (or sometimes

GAR Principles). These Principles and associated metrics provide an IG

framework that can support continuous improvement.

To review, the eight Principles are:

1. Accountability 2. Transparency 3. Integrity 4. Protection 5. Compliance 6. Availability 7. Retention 8. Disposition2

The Principles establish benchmarks for how organizations of all types and sizes

can build and sustain compliant, legally defensible records management (RM)

programs. Using the maturity model (also presented in Chapter 3), organizations

can assess where they are in terms of IG, identify gaps, and take steps to improve

across the eight areas The Principles cover.

IG Reference Model

In late 2012, with the support and collaboration of ARMA International and the

Compliance, Governance and Oversight Council (CGOC), the Electronic

Discovery Reference Model (EDRM) Project released version 3.0 of its

Information Governance Reference Model (IGRM), which added information

https://learning.oreilly.com/library/view/information-governance-concepts/9781118218303/11_chap03.html#chap03

https://learning.oreilly.com/library/view/information-governance-concepts/9781118218303/15_chap06.html#chap06fn1

https://learning.oreilly.com/library/view/information-governance-concepts/9781118218303/15_chap06.html#chap06fn2

https://learning.oreilly.com/library/view/information-governance-concepts/9781118218303/11_chap03.html#chap03

privacy and security “as primary functions and stakeholders in the effective

governance of information.”3 The model is depicted in Figure 6.1.

The IGRM is aimed at fostering IG adoption by facilitating communication and

collaboration between disparate (but overlapping) IG stakeholder functions,

including information technology (IT), legal, RM, risk management, and business

unit stakeholders.4 It also aims to provide a common, practical framework for IG

that will foster adoption of IG in the face of new Big Data challenges and increased

legal and regulatory demands. It is a clear snapshot of where IG touches and shows

critical interrelationships and unified governance.5 It can help organizations forge

policy in an orchestrated way and embed critical elements of IG policy across

functional groups. Ultimately, implementation of IG helps organizations leverage

information value, reduce risk, and address legal demands.

https://learning.oreilly.com/library/view/information-governance-concepts/9781118218303/15_chap06.html#chap06fn3

https://learning.oreilly.com/library/view/information-governance-concepts/9781118218303/15_chap06.html#fig6.1

https://learning.oreilly.com/library/view/information-governance-concepts/9781118218303/15_chap06.html#chap06fn4

https://learning.oreilly.com/library/view/information-governance-concepts/9781118218303/15_chap06.html#chap06fn5

Figure 6.1 Information Governance Reference Model

Source: EDRM.net

You must inform and frame IG policy with internal and external frameworks,

models, best practices, and standards.

The growing CGOC community (2,000+ members and rising) has widely adopted

the IGRM and developed a process maturity model that accompanies and leverages

IGRM v3.0.6

INTERPRETING THE IGRM DIAGRAM*

Outer Ring

Starting from the outside of the diagram, successful information management is

about conceiving a complex set of interoperable processes and implementing the

procedures and structural elements to put them into practice. It requires:

• An understanding of the business imperatives of the enterprise, • Knowledge of the appropriate tools and infrastructure for managing

information, and • Sensitivity to the legal and regulatory obligations with which the

enterprise must comply.

For any piece of information you hope to manage, the primary stakeholder is the

business user of that information [emphasis added]. We use the term “business”

broadly; the same ideas apply to end users of information in organizations whose

ultimate goal might not be to generate a profit.

Once the business value is established, you must also understand the legal duty

attached to a piece of information. The term “legal” should also be read broadly to

refer to a wide range of legal and regulatory constraints and obligations, from e-

discovery and government regulation to contractual obligations such as payment

card industry requirements.

Finally, IT organizations must manage the information accordingly, ensuring

privacy and security as well as appropriate retention as dictated by both business

and legal or regulatory requirements.

The business user is the primary stakeholder of managed information.

CENTER

In the center of the diagram is a work-flow or life-cycle diagram. We include this

component in the diagram to illustrate the fact that information management is

important at all stages of the information life cycle—from its creation through its

http://edrm.net/

https://learning.oreilly.com/library/view/information-governance-concepts/9781118218303/15_chap06.html#chap06fn6

https://learning.oreilly.com/library/view/information-governance-concepts/9781118218303/15_chap06.html#chap06fnast

ultimate disposition. This part of the diagram, once further developed, along with

other secondary-level diagrams, will outline concrete, actionable steps that

organizations can take in implementing information management programs.

Even the most primitive business creates information in the course of daily

operations, and IT departments spring up to manage the logistics; indeed, one of

the biggest challenges in modern organizations is trying to stop individuals from

excess storing and securing of information. Legal stakeholders can usually

mandate the preservation of what is most critical, though often at great cost.

However, it takes the coordinated effort of all three groups to defensibly dispose of

a piece of information that has outlived its usefulness and retain what isuseful in a

way that enables accessibility and usability for the business user.

HOW THE IGRM COMPLEMENTS THE GENERALLY

ACCEPTED RECORDKEEPING PRINCIPLES *

AU: We have inserted astric on h2 for footnote, please suggest.

The IGRM supports ARMA International's “Principles” by identifying the cross-

functional groups of key information governance stakeholders and by depicting

their intersecting objectives for the organization. This illustration of the

relationship among duty, value, and the information asset demonstrates

cooperation among stakeholder groups to achieve the desired level of maturity of

effective information governance.

Effective IG requires a continuous and comprehensive focus. The IGRM will be

used by proactive organizations as an introspective lens to facilitate visualization

and discussion about how best to apply The Principles. The IGRM puts into sharp

focus The Principles and provides essential context for the maturity model.

Information management is important at all stages of the life cycle.

Legal stakeholders can usually mandate the preservation of what is most critical,

though often at great cost.

The IGRM was developed by the EDRM Project to foster communication among

stakeholders and adoption of IG. It complements ARMA's Generally Accepted

Recordkeeping Principles.

Best Practices Considerations

IG best practices should also be considered in policy formulation. Best practices in

IG are evolving and expanding, and those that apply to organizational scenarios

may vary. A best practices review should be conducted, customized for each

particular organization.

https://learning.oreilly.com/library/view/information-governance-concepts/9781118218303/15_chap06.html#chap06fnast1

In Chapter 5, we provided a list of 25 IG best practices, with some detail. The IG

world is maturing, and more best practices will evolve. The 25 best practices,

summarized next, are fairly generic and widely applicable.

1. IG is a key underpinning for a successful ERM program. 2. IG is not a project but rather an ongoing program. 3. Using an IG framework or maturity model is helpful in assessing and

guiding IG programs. 4. Defensible deletion of data debris and information that no longer has

value is critical in the era of Big Data. 5. IG policies must be developed before enabling technologies are added

to assist in enforcement. 6. To provide comprehensive e-document security throughout a

document's life cycle, documents must be secured upon creation using highly sophisticated technologies, such as information rights management (IRM) technology.

7. A records retention schedule and legal hold notification process (LHN) are the two primary elements of a fundamental IG program.

8. A cross-functional team is required to implement IG. 9. The first step in information risk planning is to consider the

applicable laws and regulations that apply to your organization in the jurisdictions in which it conducts business.

10. A risk profile is a basic building block in enterprise risk management, assisting executives in understanding the risks associated with stated business objectives and in allocating resources within a structured evaluation approach or framework.

11. An information risk mitigation plan is a critical part of the IG planning process. An information risk mitigation plan involves developing risk mitigation options and tasks to reduce the specified risks and improve the odds of achieving business objectives.7

12. Proper metrics are required to measure the conformance and performance of your IG program.

13. IG programs must be audited for effectiveness. 14. An enterprise-wide retention schedule is preferable because it

eliminates the possibility that different business units will have different records retention periods.

15. Senior management must set the tone and lead sponsorship for vital records program governance and compliance.

16. Business processes must be redesigned to improve the management of electronic records or implement an electronic records management (ERM) system.

https://learning.oreilly.com/library/view/information-governance-concepts/9781118218303/14_chap05.html#chap05

https://learning.oreilly.com/library/view/information-governance-concepts/9781118218303/15_chap06.html#chap06fn7

17. E-mail messages, both inbound and outbound, should be archived automatically and (preferably) in real time.

18. Personal archiving of e-mail messages should be disallowed. 19. Destructive retention of e-mail helps to reduce storage costs and legal

risk while improving “findability” of critical records. 20. Take a practical approach and limit cloud use to documents that

do not have long retention periods and carry a low litigation risk. 21. Manage social media content by IG policies and monitor it with

controls that ensure protection of critical information assets and preservation of business records.

22. International and national standards provide effective guidance for implementing IG.

23. Creating standardized metadata terms should be part of an IG effort that enables faster, more complete, and more accurate searches and retrieval of records.8

24. Some digital information assets must be preserved permanently as part of an organization's documentary heritage.

25. Executive sponsorship is crucial.

Standards Considerations

Standards must also be considered in policy development. There are two general

types of standards: de jure and de facto. De jure (“the law”) standards are those

published by recognized standards-setting bodies, such as the International

Organization for Standardization (ISO), American National Standards Institute

(ANSI), National Institute of Standards and Technology (NIST—this is how most

people refer to it, as they do not know what the acronym stands for), British

Standards Institute (BSI), Standards Council of Canada, and Standards Australia.

Standards promulgated by authorities such as these have the formal status of

standards.

De facto (“the fact”) standards are not formal standards but are regarded by many

as if they were. They may arise though popular use (e.g., Windows at the business

desktop in the 2001–2010 decade) or may be published by other bodies, such as the

U.S. National Archives and Records Administration (NARA) or Department of

Defense (DoD) for the U.S. military sector. They may also be published by formal

standards-setting bodies without having the formal status of a “standard” (such as

some technical reports published by ISO).9

Benefits and Risks of Standards

https://learning.oreilly.com/library/view/information-governance-concepts/9781118218303/15_chap06.html#chap06fn8

https://learning.oreilly.com/library/view/information-governance-concepts/9781118218303/15_chap06.html#chap06fn9

Some benefits of developing and promoting standards are:

• Quality assurance support. If a product meets a standard, you can be confident of a certain level of quality.

• Interoperability support. Some standards are detailed and mature enough to allow for system interoperability between different vendor platforms.

• Implementation frameworks and certification checklists. These help to provide guides for projects and programs to ensure all necessary steps are taken.

• Cost reduction, due to supporting uniformity of systems. Users have lower maintenance requirements and training and support costs when systems are more uniform.

• International consensus. Standards can represent “best practice” recommendations based on global experiences.10

Some downside considerations are:

• Possible decreased flexibility in development or implementation. Standards can, at times, act as a constraint when they are tied to older technologies or methods, which can reduce innovation.

• “Standards confusion” from competing and overlapping standards. For instance, an ISO standard may be theory-based and use different terminology, whereas regional or national standards are more specific, applicable, and understandable than broad international ones.

• Real-world shortcomings due to theoretical basis. Standards often are guides based on theory rather than practice.

• Changing and updating requires cost and maintenance. There are costs to developing, maintaining, and publishing standards.11

Key Standards Relevant to IG Efforts

Below we introduce and discuss some established standards that should be

researched and considered as a foundation for developing IG policy.

RISK MANAGEMENT

ISO 31000:2009 is a broad, industry-agnostic (not specific to vertical markets) risk

management standard. It states “principles and generic guidelines” of risk

management that can be applied to not only IG but also to a wide range of

https://learning.oreilly.com/library/view/information-governance-concepts/9781118218303/15_chap06.html#chap06fn10

https://learning.oreilly.com/library/view/information-governance-concepts/9781118218303/15_chap06.html#chap06fn11

organizational activities and processes throughout the life of an organization.12 It

provides a structured framework within which to develop and implement risk

management strategies and programs.

ISO 31000 defines a risk management framework as a set of two basic

components that “support and sustain risk management throughout an

organization.”13 The stated components are: foundations, which are high level and

include risk management policy, objectives, and executive edicts; and

organizational arrangements, which are more specific and actionable, including

strategic plans, roles and responsibilities, allocated budget, and business processes

that are directed toward managing an organization's risk.

Additional risk management standards may be relevant to your organization's IG

policy development efforts, depending on your focus, scope, corporate culture, and

demands of your IG program executive sponsor.

ISO 31000 is a broad risk management standard that applies to all types of

businesses.

INFORMATION SECURITY AND GOVERNANCE

ISO/IEC 27001:2005 is an information security management system (ISMS)

standard that provides guidance in the development of security controls to

safeguard information assets. Like ISO 31000, the standard is applicable to all

types of organizations, irrespective of vertical industry.14 It “specifies the

requirements for establishing, implementing, operating, monitoring, reviewing,

maintaining and improving a documented information security management

system within the context of the organization's overall business risks.”

ISO/IEC 27001 is flexible enough to be applied to a variety of activities and

processes when evaluating and managing information security risks, requirements,

and objectives, and compliance with applicable legal and regulatory

requirements. This includes use of the standards guidance by internal and external

auditors as well as internal and external stakeholders (including customers and

potential customers).

ISO/IEC 27002:2005, “Information Technology—Security Techniques—Code of

Practice for Information Security,”15

establishes guidelines and general principles for initiating, implementing,

maintaining, and improving information security management in an organization

and is identical to the previous published standard, ISO 17799. The objectives

outlined provide general guidance on the commonly accepted goals of information

security management. ISO/IEC 27002:2005 contains best practices of control

objectives and controls in the following areas of information security management:

https://learning.oreilly.com/library/view/information-governance-concepts/9781118218303/15_chap06.html#chap06fn12

https://learning.oreilly.com/library/view/information-governance-concepts/9781118218303/15_chap06.html#chap06fn13

https://learning.oreilly.com/library/view/information-governance-concepts/9781118218303/15_chap06.html#chap06fn14

https://learning.oreilly.com/library/view/information-governance-concepts/9781118218303/15_chap06.html#chap06fn15

• security policy;

• organization of information security;

• asset management;

• human resources security;

• physical and environmental security;

• communications and operations management;

• access control;

• information systems acquisition, development, and maintenance;

• information security incident management;

• business continuity management; and

• compliance.

The control objectives and controls in ISO/IEC 27002:2005 are intended to be

implemented to meet the requirements identified by a risk assessment. ISO/IEC

27002:2005 is intended as a common basis and practical guideline for developing

organizational security standards and effective security management practices, and

to help build confidence in inter-organizational activities.

ISO/IEC 27001 and ISO/IEC 27002 are information security management systems

standards that provide guidance in the development of security controls.

ISO/IEC 38500:2008 is an international standard that provides high-level

principles and guidance for senior executives and directors, and those advising

them, for the effective and efficient use of IT.16 Based primarily on AS 8015, the

Australian IT governance standard, it “applies to the governance of management

processes” that are performed at the IT service level, but the guidance assists

executives in monitoring IT and ethically discharging their duties with respect to

legal and regulatory compliance of IT activities.

The ISO 38500 standard comprises three main sections:

1. Scope, Application and Objectives 2. Framework for Good Corporate Governance of IT 3. Guidance for Corporate Governance of IT

It is largely derived from AS 8015, the guiding principles of which were:

• Establish responsibilities

• Plan to best support the organization

• Acquire validly

• Ensure performance when required

• Ensure conformance with rules

• Ensure respect for human factors

https://learning.oreilly.com/library/view/information-governance-concepts/9781118218303/15_chap06.html#chap06fn16

The standard also has relationships with other major ISO standards, and embraces

the same methods and approaches. It is certain to have a major impact upon the IT

governance landscape.17

RECORDS AND E-RECORDS MANAGEMENT

ISO 15489–1:2001 is the international standard for RM. It identifies the elements

of RM and provides a framework and high-level overview of RM core principles.

RM is defined as the “field of management responsible for the efficient and

systematic control of the creation, receipt, maintenance, use and disposition of

records, including the processes for capturing and maintaining evidence of and

information about business activities and transactions in the form of records.”18

ISO 38500 is an international standard that provides high-level principles and

guidance for senior executives and directors responsible for IT governance.

The second part of the standard, ISO 15489–2:2001, contains the technical

specifications and a methodology for implementing the standard, originally based

on early standards work in Australia (Design and Implementation of

Recordkeeping Systems—DIRKS). Note: Although still actively used in

Australian states, the National Archives of Australia has not recommended use of

DIRKS by Australian national agencies since 2007 and has removed DIRKS from

its Web site.)19

The ISO 15489 standard makes little mention of electronic records, as it is written

to address all kinds of records;nonetheless it was widely viewed as the definitive

framework of what RM means.

In 2008, the International Council on Archives (ICA) formed a multinational

team of experts to develop “Principles and Functional Requirements for Records in

Electronic Office Environments,” commonly referred to as ICA-Req.20 The project

was cosponsored by the Australasian Digital Recordkeeping Initiative (ADRI),

which was undertaken by the Council of Australasian Archives and Records

Authorities, which “comprises the heads of the government archives authorities of

the Commonwealth of Australia, New Zealand, and each of the Australian States

and Territories.”21 The National Archives of Australia presented a training and

guidance manual to assist in implementing the principles at the 2012 International

Congress on Archives Congress in Brisbane, Australia.

In Module 1 of ICA-Req, principles are presented in a high-level overview;

Module 2 contains specifications for electronic document and records management

systems (EDRMS) that are “globally harmonized”; and Module 3 contains a

requirements set and “implementation advice for managing records in business

systems.”22 Module 3 recognizes that digital recordkeeping does not have to be

limited to the EDRMS paradigm—the insight that has now been picked up by

https://learning.oreilly.com/library/view/information-governance-concepts/9781118218303/15_chap06.html#chap06fn17

https://learning.oreilly.com/library/view/information-governance-concepts/9781118218303/15_chap06.html#chap06fn18

https://learning.oreilly.com/library/view/information-governance-concepts/9781118218303/15_chap06.html#chap06fn19

https://learning.oreilly.com/library/view/information-governance-concepts/9781118218303/15_chap06.html#chap06fn20

https://learning.oreilly.com/library/view/information-governance-concepts/9781118218303/15_chap06.html#chap06fn21

https://learning.oreilly.com/library/view/information-governance-concepts/9781118218303/15_chap06.html#chap06fn22

“Modular Requirements for Records Systems” (MoReq2010, the European

standard released in 2011).23

Parts 1 to 3 of ISO 16175 were fully adopted in 2010–2011 based on the ICA-Req

standard. The standard may be purchased at www.ISO.org, and additional

information on the Australian initiative may be found at www.adri.gov.au.

ISO 16175 is guidance, not a standard that can be tested and certified against. This

is the criticism by advocates of testable, certifiable standards like U.S. DoD 5015.2

and the European standard, MoReq2010.

In November 2011, ISO issued new standards for ERM, the first two in the ISO

30300 series, which are based on a managerial point of view and targeted at a

management-level audience rather than at records managers or technical staff:

• ISO 30300:2011, “Information and Documentation—Management Systems for Records—Fundamentals and Vocabulary”

• ISO 30301:2011, “Information and Documentation—Management Systems for Records—Requirements”

ISO 15489 is the international RM standard.

The ICA-Req standard was adopted as ISO 16175. It does not contain a testing

regime for certification.

The standards apply to “management systems for records” (MSR), a term that, as

of this printing, is not typically used to refer to ERM or RM application [RMA]

software in the United States or Europe and is not commonly found in ERM

research or literature.

The ISO 30300 series is a systematic approach to the creation and management of

records that is “aligned with organizational objectives and strategies.” [italics

added]24

“ISO 30300 MSR ‘Fundamentals and Vocabulary’ explains the rationale behind

the creation of an MSR and the guiding principles for its successful

implementation. and it provides the terminology that ensures that it is compatible

with other management systems standards.

ISO 30301 MSR ‘Requirements’ specifies the requirements necessary to develop a

records policy. It also sets objectives and targets for an organization to implement

systemic improvements. This is achieved through designing records processes and

systems; estimating the appropriate allocation of resources; and establishing

benchmarks to monitor, measure, and evaluate outcomes. These steps help to

ensure that corrective action can be taken and continuous improvements are built

into the system in order to support an organization in achieving its mandate,

mission, strategy, and goals.”25

https://learning.oreilly.com/library/view/information-governance-concepts/9781118218303/15_chap06.html#chap06fn23

https://learning.oreilly.com/library/view/information-governance-concepts/9781118218303/08_p01.html#p01

https://learning.oreilly.com/library/view/information-governance-concepts/9781118218303/16_p03.html#p03

http://www.iso.org/

http://www.adri.gov.au/

https://learning.oreilly.com/library/view/information-governance-concepts/9781118218303/15_chap06.html#chap06fn24

https://learning.oreilly.com/library/view/information-governance-concepts/9781118218303/15_chap06.html#chap06fn25

Major National and Regional ERM Standards

For great detail on national and regional standards related to ERM, see the

book Managing Electronic Records: Methods, Best Practices, and

Technologies (Wiley 2013) by Robert F. Smallwood. Below is a short summary:

UNITED STATES E-RECORDS STANDARD

The U.S. Department of Defense 5015.2 Design Criteria Standard for Electronic

Records Management Software Applications, standard was established in 1997 and

is endorsed by the leading archival authority, the U.S. National Archives and

Records Administration (NARA). There is a testing regime that certifies software

vendors that is administered by JITC. JITC “builds test case procedures, writes

detailed and summary final reports on 5015.2-certified products, and performs on-

site inspection of software.”26 The DoD standard was built for the defense sector,

and logically “reflects its government and archives roots.”

Since its endorsement by NARA, the standard has been the key requirement for

ERM system vendors to meet, not only in U.S. public sector bids, but also in the

commercial sector.

The 5015.2 standard has since been updated and expanded, in 2002 and 2007, to

include requirements for metadata, e-signatures and Privacy and Freedom of

Information Act requirements, and, as previously stated, was scheduled for update

by 2013.

The U.S. DoD 5015.2-STD has been the most influential worldwide since it was

first introduced in 1997. It best suits military applications.

The 5015.2 standard has been updated to include specifications such as those for e-

signatures and FOI requirements.

CANADIAN STANDARDS AND LEGAL CONSIDERATIONS

FOR ELECTRONIC RECORDS MANAGEMENT*

The National Standards of Canada for electronic records management are:

(1) Electronic Records as Documentary Evidence CAN/CGSB-72.34–2005

(“72.34”), published in December 2005; and, (2) Microfilm and Electronic Images

as Documentary Evidence CAN/CGSB-72.11–93, first published in 1979 and

updated to 2000 (“72.11”).27 72.34 incorporates all that 72.11 deals with and is

therefore the more important of the two. Because of its age, 72.11 should not be

relied upon for its “legal” content. However, 72.11 has remained the industry

standard for “imaging” procedures—converting original paper records to electronic

storage. The Canada Revenue Agency has adopted these standards as applicable to

records concerning taxation.28

https://learning.oreilly.com/library/view/information-governance-concepts/9781118218303/15_chap06.html#chap06fn26

https://learning.oreilly.com/library/view/information-governance-concepts/9781118218303/15_chap06.html#chap06fnast2

https://learning.oreilly.com/library/view/information-governance-concepts/9781118218303/15_chap06.html#chap06fn27

https://learning.oreilly.com/library/view/information-governance-concepts/9781118218303/15_chap06.html#chap06fn28

72.34 deals with these topics: (1) management authorization and accountability; (2)

documentation of procedures used to manage records; (3) “reliability testing” of

electronic records according to existing legal rules; (4) the procedures manual and

the chief records officer; (5) readiness to produce (the “prime directive”); (6)

records recorded and stored in accordance with “the usual and ordinary course of

business” and “system integrity,” being key phrases from the Evidence Acts in

Canada; (7) retention and disposal of electronic records; (8) backup and records

system recovery; and, (9) security and protection. From these standards

practitioners have derived many specific tests for auditing, establishing, and

revising electronic records management systems.29

The “prime directive” of these standards states: “An organization shall always be

prepared to produce its records as evidence.”30 The duty to establish the “prime

directive” falls upon senior management:31

5.4.3 Senior management, the organization's own internal law-making authority,

proclaims throughout the organization the integrity of the organization's records

system (and, therefore, the integrity of its electronic records) by establishing and

declaring:

1. the system's role in the usual and ordinary course of business; 2. the circumstances under which its records are made; and 3. its prime directive for all RMS [records management system]

purposes, i.e., an organization shall always be prepared to produce its records as evidence. This dominant principle applies to all of the organization's business records, including electronic, optical, original paper source records, microfilm, and other records of equivalent form and content.

Being the “dominant principle” of an organization's electronic records management

system, the duty to maintain compliance with the “prime directive” should fall

upon its senior management.

Legal Considerations

Because an electronic record is completely dependent upon its ERM system for

everything, compliance with these National Standards and their “prime directive”

should be part of the determination of the “admissibility” (acceptability) of

evidence and of electronic discovery in court proceedings (litigation) and in

regulatory tribunal proceedings.32

There are 14 legal jurisdictions in Canada: 10 provinces, 3 territories, and the

federal jurisdiction of the Government of Canada. Each has an Evidence Act (the

Civil Code in the province of Quebec33), which applies to legal proceedings within

its legislative jurisdiction. For example, criminal law and patents and copyrights

https://learning.oreilly.com/library/view/information-governance-concepts/9781118218303/15_chap06.html#chap06fn29

https://learning.oreilly.com/library/view/information-governance-concepts/9781118218303/15_chap06.html#chap06fn30

https://learning.oreilly.com/library/view/information-governance-concepts/9781118218303/15_chap06.html#chap06fn31

https://learning.oreilly.com/library/view/information-governance-concepts/9781118218303/15_chap06.html#chap06fn32

https://learning.oreilly.com/library/view/information-governance-concepts/9781118218303/15_chap06.html#chap06fn33

are within federal legislative jurisdiction, and most civil litigation comes within

provincial legislative jurisdiction.34

The admissibility of records as evidence is determined under the “business

record” provisions of the Evidence Acts.35 They require proof that a record was

made “in the usual and ordinary course of business,” and of “the circumstances of

the making of the record.” In addition, to obtain admissibility for electronic

records, most of the Evidence Acts contain electronic record provisions, which

state that an electronic record is admissible as evidence on proof of the “integrity

of the electronic record system in which the data was recorded or stored.”36This is

the “system integrity” test for the admissibility of electronic records. The word

“integrity” has yet to be defined by the courts.37

However, by way of sections such as the following, the electronic record

provisions of the Evidence Acts make reference to the use of standards such as the

National Standards of Canada:

For the purpose of determining under any rule of law whether an electronic record

is admissible, evidence may be presented in respect of any standard, procedure,

usage or practice on how electronic records are to be recorded or stored, having

regard to the type of business or endeavor that used, recorded, or stored the

electronic record and the nature and purpose of the electronic record.38

U.K. AND EUROPEAN STANDARDS

In the United Kingdom, The National Archives (TNA) (formerly the Public Record

Office, or PRO) “has published two sets of functional requirements to promote the

development of the electronic records management software market (1999 and

2002).” It ran a program to evaluate products against the 2002

requirements.39Initially these requirements were established in collaboration with

the central government, and they later were utilized by the public sector in general,

and also in other nations. The National Archives 2002 requirements remain

somewhat relevant, although no additional development has been underway for

years. It is clear that the second version of Model Requirements for Management

of Electronic Records, MoReq2, largely supplanted the UK standard, and

subsequently the newer MoReq2010 may further supplant the UK standard.

MoReq2010 “unbundles” some of the core requirements in MoReq2, and sets out

functional requirements in modules. The approach seeks to permit the later

creation of e-records software standards in various vertical industries such as

defense, health care, financial services, and legal services.

MoReq2010 is available free—all 525 pages of it (by comparison, the U.S. DoD

5015.2 standard is less than 120 pages long). For more information on

https://learning.oreilly.com/library/view/information-governance-concepts/9781118218303/15_chap06.html#chap06fn34

https://learning.oreilly.com/library/view/information-governance-concepts/9781118218303/15_chap06.html#chap06fn35

https://learning.oreilly.com/library/view/information-governance-concepts/9781118218303/15_chap06.html#chap06fn36

https://learning.oreilly.com/library/view/information-governance-concepts/9781118218303/15_chap06.html#chap06fn37

https://learning.oreilly.com/library/view/information-governance-concepts/9781118218303/15_chap06.html#chap06fn38

https://learning.oreilly.com/library/view/information-governance-concepts/9781118218303/15_chap06.html#chap06fn39

MoReq2010, visit www.moreq2010.eu. The entire specification may be

downloaded at: http://moreq2010.eu/pdf/moreq2010_vol1_v1_1_en.pdf.

MoReq2010

In November 2010, the DLM Forum, a European Commission–supported body,

announced the availability of the final draft of the MoReq2010 specification for

electronic records management systems (ERMS), following extensive public

consultation. The final specification was published in mid-2011.40

The DLM Forum explains that “With the growing demand for [electronic] records

management, across a broad spectrum of commercial, not-for-profit, and

government organizations, MoReq2010 provides the first practical specification

against which all organizations can take control of their corporate information. IT

software and services vendors are also able to have their products tested and

certified that they meet the MoReq2010 specification.”41

MoReq2010 supersedes its predecessor MoReq2 and has the continued support

and backing of the European Commission.

AUSTRALIAN ERM AND RECORDS MANAGEMENT

STANDARDS

Australia has adopted all three parts of ISO 16175 as its e-records management

standard.42 (For more detail on this standard go to ISO.org.)

Australia has long led the introduction of highly automated electronic document

management systems and records management standards. Following the approval

and release of the AS 4390 standard in 1996, the international records management

community began work on the development of an International standard. This

work used AS 4390–1996 Records Management as its starting point.

Development of Australian Records Standards

In 2002 Standards Australia published a new Australian Standard on records

management, AS ISO 15489, based on the ISO 15489 international records

management standard. It differs only in its preface verbiage.43 AS ISO 15489

carries through all these main components of AS 4390, but internationalizes the

concepts and brings them up to date. The standards thereby codify Australian best

practice but are also progressive in their recommendations.

Additional Relevant Australian Standards

The Australian Government Recordkeeping Metadata Standard Version

2.0 provides guidance on metadata elements and subelements for records

management. It is a baseline tool that “describes information about records and the

context in which they are captured and used in Australian Government agencies.”

http://www.moreq2010.eu/

http://moreq2010.eu/pdf/moreq2010_vol1_v1_1_en.pdf

https://learning.oreilly.com/library/view/information-governance-concepts/9781118218303/15_chap06.html#chap06fn40

https://learning.oreilly.com/library/view/information-governance-concepts/9781118218303/15_chap06.html#chap06fn41

https://learning.oreilly.com/library/view/information-governance-concepts/9781118218303/15_chap06.html#chap06fn42

http://iso.org/

https://learning.oreilly.com/library/view/information-governance-concepts/9781118218303/15_chap06.html#chap06fn43

This standard is intended to help Australian agencies “meet business,

accountability and archival requirements in a systematic and consistent way by

maintaining reliable, meaningful and accessible records.” The standard is written

in two parts, the first describing its purpose and features and the second outlining

the specific metadata elements and subelements.44

The Australian Government Locator Service, AGLS, is published as AS 5044–

2010, the metadata standard to help find and exchange information online. It

updates the 2002 version, and includes changes made by the Dublin Core Metadata

Initiative (DCMI).

Another standard, AS 5090:2003, “Work Process Analysis for

Recordkeeping,” complements AS ISO 15489 and provides guidance on

understanding business processes and workflow so that recordkeeping

requirements may be determined.45

LONG-TERM DIGITAL PRESERVATION

Although many organizations shuffle dealing with digital preservation issues to the

back burner, long-term digital preservation (LTDP) is a key area in which IG

policy should be applied. LTDP methods, best practices, and standards should be

applied to preserve an organization's historical and vital records (those without

which it cannot operate or restart operations) and to maintain its corporate or

organizational memory. The key standards that apply to LTDP are listed next.

The official standard format for preserving electronic documents is PDF/A-1,

based on PDF 1.4 originally developed by Adobe. ISO 19005-1:2005, “Document

Management—Electronic Document File Format for Long-Term Preservation—

Part 1: Use of PDF 1.4 (PDF/A-1),” is the published specification for using PDF

1.4 for LTDP, which is applicable to e-documents that may contain not only text

characters but also graphics (either raster or vector).46

ISO 14721:2012, “Space Data and Information Transfer Systems—Open Archival

Information Systems—Reference Model (OAIS),” is applicable to LTDP.47 ISO

14271 “specifies a reference model for an open archival information system

(OAIS). The purpose of ISO 14721 is to establish a system for archiving

information, both digitalized and physical, with an organizational scheme

composed of people who accept the responsibility to preserve information and

make it available to a designated community.”48 The fragility of digital storage

media combined with ongoing and sometimes rapid changes in computer software

and hardware poses a fundamental challenge to ensuring access to trustworthy and

reliable digital content over time. Eventually, every digital repository committed to

long-term preservation of digital content must have a strategy to mitigate computer

technology obsolescence. Toward this end, the Consultative Committee for Space

https://learning.oreilly.com/library/view/information-governance-concepts/9781118218303/15_chap06.html#chap06fn44

https://learning.oreilly.com/library/view/information-governance-concepts/9781118218303/15_chap06.html#chap06fn45

https://learning.oreilly.com/library/view/information-governance-concepts/9781118218303/15_chap06.html#chap06fn46

https://learning.oreilly.com/library/view/information-governance-concepts/9781118218303/15_chap06.html#chap06fn47

https://learning.oreilly.com/library/view/information-governance-concepts/9781118218303/15_chap06.html#chap06fn48

Data Systems developed the OAIS reference model to support formal standards for

the long-term preservation of space science data and information assets. OAIS was

not designed as an implementation model.

The ISO 30300 series of e-records standards are written for a managerial audience

and encourage ERM that is aligned to organizational objectives.

LTDP is a key area to which IG policy should be applied.

OAIS is the lingua franca of digital preservation, as the international digital

preservation community has embraced it as the framework for viable and

technologically sustainable digital preservation repositories. An LTDP strategy that

is OAIS compliant offers the best means available today for preserving the digital

heritage of all organizations, private and public. (See Chapter 17.)

ISO TR 18492 (2005), “Long-Term Preservation of Electronic Document Based

Information,” provides practical methodological guidance for the long-term

preservation and retrieval of authentic electronic document-based information,

when the retention period exceeds the expected life of the technology (hardware

and software) used to create and maintain the information assets. ISO 18492 takes

note of the role of ISO 15489 but does not cover processes for the capture,

classification, and disposition of authentic electronic document-based information.

ISO 16363:2012, “Space Data and Information Transfer Systems—Audit and

Certification of Trustworthy Digital Repositories,” “defines a recommended

practice for assessing the trustworthiness of digital repositories. It is applicable to

the entire range of digital repositories.”49 It is an audit and certification standard

organized into three broad categories: Organization Infrastructure, Digital Object

Management, and Technical Infrastructure and Security Risk Management. ISO

16363 represents the gold standard of audit and certification for trustworthy

digital repositories. (See Chapter 17.)

BUSINESS CONTINUITY MANAGEMENT

ISO 22301:2012, “Societal Security—Business Continuity Management

Systems—Requirements,” spells out the requirements for creating and

implementing a standardized approach to business continuity management (BCM,

also known as disaster recovery [DR]), in the event an organization is hit with a

disaster or major business interruption.50 The guidelines can be applied to any

organization regardless of vertical industry or size. The specification includes the

“requirements to plan, establish, implement, operate, monitor, review, maintain

and continually improve a documented management system to protect against,

reduce the likelihood of occurrence, prepare for, respond to, and recover from

disruptive incidents when they arise.”

https://learning.oreilly.com/library/view/information-governance-concepts/9781118218303/29_chap17.html#chap17

https://learning.oreilly.com/library/view/information-governance-concepts/9781118218303/15_chap06.html#chap06fn49

https://learning.oreilly.com/library/view/information-governance-concepts/9781118218303/29_chap17.html#chap17

https://learning.oreilly.com/library/view/information-governance-concepts/9781118218303/15_chap06.html#chap06fn50

An LTDP strategy that is OAIS compliant (based on ISO 14721) offers the best

means available today for preserving the digital heritage of all organizations.

ISO 16363 represents the gold standard of audit and certification for trustworthy

digital repositories.

ISO 22301 spells out requirements for creating and implementing a standardized

approach to business continuity management.

The UK business continuity standard, BS25999-2, which heavily influenced the

newer ISO standard, was withdrawn when ISO 22301 was released.51 The business

rationale is that, with the increasing globalization of business, ISO 22301 will

allow and support more consistency worldwide not only in business continuity

planning and practices but also will promote common terms and help to embed

various ISO management systems standards within organizations. U.S.-based

ANSI, Standards Australia, Standards Singapore, and other standards bodies also

contributed to the development of ISO 22301.

Benefits of ISO 22301

• Threat identification and assessment. Discover, name, and evaluate potential serious threats to the viability of the business.

• Threat and recovery planning. so the impact and resultant downtime and recovery from real threats that do become incidents is minimized

• Mission-critical process protection. Identifying key processes and taking steps to ensure they continue to operate even during a business interruption.

• Stakeholder confidence. Shows prudent management planning and business resilience to internal and external stakeholders, including employees, business units, customers, and suppliers.52

Making Your Best Practices and Standards Selections to

Inform Your IG Framework

You must take into account your organization's corporate culture, management

style, and organizational goals when determining which best practices and

standards should receive priority in your IG framework. However, you must step

through your business rationale in discussions with your cross-functional IG team

and fully document the reasons for your approach. Then you must present this

approach and your draft IG framework to your key stakeholders and be able to

defend your determinations while allowing for input and adjustments. Perhaps you

https://learning.oreilly.com/library/view/information-governance-concepts/9781118218303/15_chap06.html#chap06fn51

https://learning.oreilly.com/library/view/information-governance-concepts/9781118218303/15_chap06.html#chap06fn52

have overlooked some key factors that your larger stakeholder group uncovers, and

their input should be folded into a final draft of your IG framework.

You must take into account your organization's corporate culture, management

style, and organizational goals when determining which best practice and standards

should be selected for your IG framework.

Next, you are ready to begin developing IG policies that apply to various aspects of

information use and management, in specific terms. You must detail the policies

you expect employees to follow when handling information on various information

delivery platforms (e.g., e-mail, blogs, social media, mobile computing, cloud

computing). It is helpful at this stage to collect and review all your current policies

that apply and to gather some examples of published IG policies, particularly from

peer organizations and competitors (where possible). Of note: You should not just

adopt another organization's polices and believe that you are done with policy

making. Rather, you must enter into a deliberative process, using your IG

framework for guiding principles and considering the views and needs of your

cross-functional IG team. Of paramount importance is to be sure to incorporate the

alignment of your organizational goals and business objectives when crafting

policy.

With each policy area, be sure that you have considered the input of your

stakeholders, so that they will be more willing to buy into and comply with the

new policies and so that the policies do not run counter to their business needs and

required business processes. Otherwise, stakeholders will skirt, avoid, or

halfheartedly follow the new IG policies, and the IG program risks failure.

Once you have finalized your policies, be sure to obtain necessary approvals from

your executive sponsor and key senior managers.

Roles and Responsibilities

Policies will do nothing without people to advocate, support, and enforce them.

So clear lines of authority and accountability must be drawn, and responsibilities

must be assigned.

Overall IG program responsibility resides at the executive sponsor level, but

beneath that, an IG program manager should drive team members toward

milestones and business objectives and should shoulder the responsibility for day-

to-day program activities, including implementing and monitoring key IG policy

tasks. These tasks should be approved by executive stakeholders and assigned as

appropriate to an employee's functional area of expertise. For instance, the IG team

member from legal may be assigned the responsibility for researching and

determining legal requirements for retention of business records, perhaps working

in conjunction with the IG team member from RM, who can provide additional

input based on interviews with representatives from business units and additional

RM research into best practices.

Lines of authority, accountability, and responsibility must be clearly drawn for the

IG program to succeed.

Program Communications and Training

Your IG program must contain a communications and training component, as a

standard function. Your stakeholder audience must be made aware of the new

policies and practices that are to be followed and how this new approach

contributes toward the organization's goals and business objectives.

The first step in your communications plan is to identify and segment your

stakeholder audiences and to customize or modify your message to the degree that

is necessary to be effective. Communications to your IT team can have a more

technical slant, and communications to your legal team can have some legal jargon

and emphasize legal issues. The more forethought you put into crafting your

communications strategy, the more effective it will be.

That is not to say that all messages must have several versions: Some core

concepts and goals should be emphasized in communications to all employees.

How should you communicate? The more ways you can get your IG message to

your core stakeholder audiences, the more effective and lasting the message will

be. So posters, newsletters, e-mail, text messages, internal blog or intranet posts,

and company meetings should all be a part of the communications mix.

Remember, the IG program requires not only training but retraining, and the aim

should be to create a compliance culture that is so prominent and expected that

employees adopt the new practices and policies and integrate them into their daily

activities. Ideally, employees will provide valuable input to help fine-tune and

improve the IG program.

Training should take multiple avenues as well. Some can be classroom instruction,

some online learning, and you may want to create a series of training videos. But

the training effort must be consistent and ongoing to maintain high levels of IG

effectiveness. Certainly, this means you will need to add to your new hire training

program for employees joining or transferring to your organization.

Program Controls, Monitoring, Auditing, and Enforcement

How do you know how well you are doing? You will need to develop metrics to

determine the level of employee compliance, its impact on key operational areas,

and progress made toward established business objectives.

Testing and auditing the program provides an opportunity to give feedback to

employees on how well they are doing and to recommend changes they may make.

But having objective feedback on key metrics also will allow for your executive

sponsor to see where progress has been made and where improvements need to

focus.

Communications regarding your IG program should be consistent and clear and

somewhat customized for various stakeholder groups.

Clear penalties for policy violations must be communicated to employees so they

know the seriousness of the IG program and how important it is in helping the

organization pursue its business goals and accomplish stated business objectives.

CHAPTER SUMMARY: KEY POINTS

• You must inform and frame IG policy with internal and external

frameworks, models, best practices, and standards

• The business user is the primary stakeholder of managed information.

• Information management is important at all stages of the life cycle.

• Legal stakeholders usually can mandate the preservation of what is most

critical, though often at great cost.

• The IGRM was developed by the EDRM Project to foster communication

among stakeholders and adoption of IG. It complements ARMA's The

Principles.

• ISO 31000 is a broad risk management standard that applies to all types of

businesses.

• ISO/IEC 27001 and ISO/IEC 27002 are ISMS standards that provide

guidance in the development of security controls.

• ISO 15489 is the international RM standard.

• The ICA-Req standard was adopted as ISO 16175. It does not contain a

testing regime for certification.

• The ISO 30300 series of e-records standards are written for a managerial

audience and encourage ERM that is aligned to organizational objectives.

• DoD 5015.2 is the U.S. ERM standard; the European ERM standard is

MoReq2010. Australia has adopted all three parts of ISO 16175 as its e-

records management standard.

• LTDP is a key area to which IG policy should be applied.

• An LTDP strategy that is OAIS compliant (based on ISO 14721) offers the

best means available today for preserving the digital heritage of all

organizations.

• ISO 16363 represents the gold standard of audit and certification for

trustworthy digital repositories.

• ISO 38500 is an international standard that provides high-level principles

and guidance for senior executives and directors responsible for IT

governance.

• ISO 22301 spells out requirements for creating and implementing a

standardized approach to business continuity management.

• You must take into account your organization's corporate culture,

management style, and organizational goals when determining which best

practices and standards should be selected for your IG framework.

• Lines of authority, accountability, and responsibility must be clearly drawn

for the IG program to succeed.

• Communications regarding your IG program should be consistent and clear

and somewhat customized for various stakeholder groups.

• IG program audits are an opportunity to improve training and compliance,

not to punish employees.

Notes

1. ARMA International, “Generally Accepted Recordkeeping Principles,” www.arma.org/r2/generally-accepted-br-recordkeeping- principles/copyright (accessed November 25, 2013).

2. ARMA International, “Information Governance Maturity Model,” www.arma.org/r2/generally-accepted-br-recordkeeping- principles/metrics (accessed November 25, 2013).

3. Electronic Discovery, “IGRM v3.0 Update: Privacy & Security Officers As Stakeholders – Electronic Discovery,” http://electronicdiscovery.info/igrm-v3-0-update-privacy- security-officers-as-stakeholders-electronic-discovery/ (accessed April 24, 2013).

4. EDRM, “Information Governance Reference Model (IGRM),” www.edrm.net/projects/igrm(accessed October 9, 2013).

5. Ibid.

6. Ibid.

7. Project Management Institute, A Guide to the Project Management Body of Knowledge (PMBOK Guide), 4th ed. (Newtown Square, PA, Project Management Institute, 2008), ANSI/PMI 99-001-2008, pp. 273–312.

8. Kate Cumming, “Metadata Matters,” in Julie McLeod and Catherine Hare, eds., Managing Electronic Records, p. 34 (London: Facet, 2005).

9. Marc Fresko, e-mail to author, May 13, 2012.

http://www.arma.org/r2/generally-accepted-br-recordkeeping-principles/copyright

http://www.arma.org/r2/generally-accepted-br-recordkeeping-principles/metrics

http://electronicdiscovery.info/igrm-v3-0-update-privacy-security-officers-as-stakeholders-electronic-discovery/

http://www.edrm.net/projects/igrm

10. Hofman, “The Use of Standards and Models,” in Julie McLeod and Catherine Hare, eds., Managing Electronic Records, p. 34 (London: Facet, 2005) pp. 20–21.

11. Ibid.

12. International Organization for Standardization, “ISO 31000:2009 Risk Management—Principles and Guidelines,” www.iso.org/iso/home/store/catalogue_tc/catalogue_detail.h tm?csnumber=43170(accessed April 22, 2013).

13. Ibid.

14. International Organization for Standardization, ISO/IEC 27001:2005, “Information Technology—Security Techniques—Information Security Management Systems— Requirements,” www.iso.org/iso/catalogue_detail?csnumber=42103 (acces sed April 22, 2013).

15. International Organization for Standardization, ISO/IEC 27002:2005, “Information Technology—Security Techniques—Code of Practice for Information Security Management,” www.iso.org/iso/cata- logue_detail?csnumber=50297 (accessed July 23, 2012).

16. International Organization for Standardization, ISO/IEC 38500:2008, www.iso.org/iso/catalogue_detail?csnumber=51639 (accesse d March 12, 2013).

17. ISO 38500 IT Governance Standard, www.38500.org/ (accessed March 12, 2013).

18. International Organization for Standardization, ISO 15489-1: 2001 Information and Documentation—Records Management. Part 1: General (Geneva: ISO, 2001), section 3.16.

19. National Archives of Australia, www.naa.gov.au/records- management/publications/DIRKS-manual.aspx (accessed October 15, 2012).

20. International Council on Archives, “ICA-Req: Principles and Functional Requirements for Records in Electronic Office Environments: Guidelines and Training Material,” November 29, 2011, www.ica.org/11696/activities- and-projects/icareq-principles-and-functional-requirements-for-records- in-electronic-office-environments-guidelines-and-training-material.html.

21. Council of Australasian Archives and Records Authorities, www.caara.org.au/ (accessed May 3, 2012).

22. Adrian Cunningham, blog post comment, May 11, 2011. http://thinkingrecords.co.uk/2011/05/06/how-moreq-2010-differs-

http://www.iso.org/iso/home/store/catalogue_tc/catalogue_detail.htm?csnumber=43170

http://www.iso.org/iso/catalogue_detail?csnumber=42103

http://www.iso.org/iso/cata-logue_detail?csnumber=50297

http://www.iso.org/iso/catalogue_detail?csnumber=51639

http://www.38500.org/

http://www.naa.gov.au/records-management/publications/DIRKS-manual.aspx

http://www.ica.org/11696/activities-and-projects/icareq-principles-and-functional-requirements-for-records-in-electronic-office-environments-guidelines-and-training-material.html

http://www.caara.org.au/

http://thinkingrecords.co.uk/2011/05/06/how-moreq-2010-differs-from-previous-electronic-records-management-erm-system-specifications/

from-previous-electronic-records-management-erm-system- specifications/.

23. Ibid.

24. “Relationship between the ISO 30300 Series of Standards and Other Products of ISO/TC 46/SC 11: Records Processes and Controls,” White Paper, ISO TC46/SC11-Archives/Records Management (March 2012), www.iso30300.es/wp- content/uploads/2012/03/ISOTC46SC11_White_paper_relationship_303 00_technical_standards12032012v6.pdf

25. Ibid.

26. Julie Gable, Information Management Journal, November 1, 2002, www.thefreelibrary.com/Everything+you+wanted+to+know+about+ DoD+5015.2:+the+standard+is+not+a...-a095630076.

27. These standards were developed by the CGSB (Canadian General Standards Board), which is a standards-writing agency within Public Works and Government Services Canada (a department of the federal government). It is accredited by the Standards Council of Canada as a standards development agency. The Council must certify that standards have been developed by the required procedures before it will designate them as being National Standards of Canada. 72.34 incorporates by reference as “normative references”: (1) many of the standards of the International Organization for Standardization (ISO) in Geneva, Switzerland. (“ISO,” derived from the Greek word isos (equal) so as to provide a common acronym for all languages); and (2) several of the standards of the Canadian Standards Association (CSA). The “Normative references” section of 72.34 (p. 2) states that these “referenced documents are indispensable for the application of this document.” 72.11 cites (p. 2, “Applicable Publications”) several standards of the American National Standards Institute/Association for Information and Image Management (ANSI/AIIM) as publications “applicable to this standard.” The process by which the National Standards of Canada are created and maintained is described within the standards themselves (reverse side of the front cover), and on the CGSB's Web site (see, “Standards Development”), from which Web site these standards may be obtained; http://www.ongc-cgsb.gc.ca.

28. The Canada Revenue Agency (CRA) informs the public of its policies and procedures by means, among others, of its Information Circulars (IC's), and GST/HST Memoranda. (GST: goods and services tax; HST: harmonized sales tax, i.e., the harmonization of federal and provincial sales taxes into one retail sales tax.) In particular, see: IC05-1, dated June

http://thinkingrecords.co.uk/2011/05/06/how-moreq-2010-differs-from-previous-electronic-records-management-erm-system-specifications/

http://www.iso30300.es/wp-content/uploads/2012/03/ISOTC46SC11_White_paper_relationship_30300_technical_standards12032012v6.pdf

http://www.thefreelibrary.com/Everything+you+wanted+to+know+about+DoD+5015.2:+the+standard+is+not+a...-a095630076

http://www.ongc-cgsb.gc.ca/

2010, entitled, Electronic Record Keeping, paragraphs 24, 26 and 28. Note that use of the National Standard cited in paragraph 26, Microfilm and Electronic Images as Documentary Evidence CAN/CGSB-72.11-93 is mandatory for, “Imaging and microfilm (including microfiche) reproductions of books of original entry and source documents …” Paragraph 24 recommends the use of the newer national standard, Electronic Records as Documentary Evidence CAN/CGSB-72.34- 2005, “To ensure the reliability, integrity and authenticity of electronic records.” However, if this newer standard is given the same treatment by CRA as the older standard, it will be made mandatory as well. And similar statements appear in the GST Memoranda, Computerized Records 500-1- 2, Books and Records 500-1. IC05-1. Electronic Record Keeping, concludes with the note, “Most Canada Revenue Agency publications are available on the CRA Web site www.cra.gc.ca under the heading ‘Forms and Publications.’”

29. There are more than 200 specific compliance tests that can be applied to determine if the principles of 72.34 are being complied with. The analysts—a combined team of records management and legal expertise— analyze: (1) the nature of the business involved; (2) the uses and value of its records for its various functions; (3) the likelihood and risk of the various types of its records being the subject of legal proceedings, or of their being challenged by some regulating authority; and (4) the consequences of the unavailability of acceptable records—for example, the consequences of its records not being accepted in legal proceedings. Similarly, in regard to the older National Standard of Canada, 72.11, there is a comparable series of more than 50 tests that can be applied to determine the state of compliance with its principles.

30. Electronic Records as Documentary Evidence CAN/CGSB-72.34-2005 (“72.34”), clause 5.4.3 c) at p. 17; and Microfilm and Electronic Images as Documentary Evidence CAN/CGSB-72.11-93 (“72.11”), paragraph 4.1.2 at p. 2, supra note 49.

31. 72.34, Clause 5.4.3, ibid.

32. “Admissibility” refers to the procedure by which a presiding judge determines if a record or other proffered evidence is acceptable as evidence according the rules of evidence. “Electronic discovery” is the compulsory exchange of relevant records by the parties to legal proceedings prior to trial.” As to the admissibility of records as evidence see: Ken Chasse, “The Admissibility of Electronic Business Records” (2010), 8 Canadian Journal of Law and Technology 105; and Ken Chasse, “Electronic Records for Evidence and Disclosure and Discovery” (2011) 57 The Criminal Law

http://www.cra.gc.ca/

Quarterly 284. For the electronic discovery of records see: Ken Chasse, “Electronic Discovery—Sedona Canada is Inadequate on Records Management—Here's Sedona Canada in Amended Form,” Canadian Journal of Law and Technology 9 (2011): 13 5; and Ken Chasse, “Electronic Discovery in the Criminal Court System,” Canadian Criminal Law Review 14 (2010): 111. See also note 18 infra, and accompanying text.

33. For the province of Quebec, comparable provisions are contained in Articles 2831-2842, 2859-2862, 2869-2874 of Book 7 “Evidence” of the Civil Code of Quebec, S.Q. 1991, c. C-64, to be read in conjunction with, An Act to Establish a Legal Framework for Information Technology, R.S.Q. 2001, c. C-1.1, ss. 2, 5-8, and 68.

34. For the legislative jurisdiction of the federal and provincial governments in Canada, see The Constitution Act, 1867 (U.K.) 30 – 31 Victoria, c. 3, s. 91 (federal), and s. 92 (provincial), www.canlii.org/en/ca/laws/stat/30—31-vict-c-3/latest/30— 31-vict-c-3.html.

35. The two provinces of Alberta and Newfoundland and Labrador do not have business record provisions in their Evidence Acts. Therefore “admissibility” would be determined in those jurisdictions by way of the court decisions that define the applicable common law rules; such decisions as, Ares v. Venner [1970] S.C.R. 608, 14 D.L.R. (3d) 4 (S.C.C.), and decisions that have applied it.

36. See for example, the Canada Evidence Act, R.S.C. 1985, c. C-5, ss. 31.1- 31.8; Alberta Evidence Act, R.S.A 2000, c. A-18, ss. 41.1-41.8; (Ontario) Evidence Act, R.S.O. 1990, c. E.23, s. 34.1; and the (Nova Scotia) Evidence Act, R.S.N.S. 1989, c. 154, ss. 23A-23G. The Evidence Acts of the two provinces of British Columbia and Newfoundland and Labrador do not contain electronic record provisions. However, because an electronic record is no better than the quality of the record system in which it is recorded or stored, its “integrity” (reliability, credibility) will have to be determined under the other provincial laws that determine the admissibility of records as evidence.

37. The electronic record provisions have been in the Evidence Acts in Canada since 2000. They have been applied to admit electronic records into evidence, but they have not yet received any detailed analysis by the courts.

38. This is the wording used in, for example, s. 41.6 of the Alberta Evidence Act, s. 34.1(8) of the (Ontario) Evidence Act; and s. 23F of the (Nova Scotia) Evidence Act, supra note 10. Section 31.5 of the Canada Evidence

http://www.canlii.org/en/ca/laws/stat/30%E2%80%9431-vict-c-3/latest/30%E2%80%9431-vict-c-3.html

Act, supra note 58, uses the same wording, the only significant difference being that the word “document” is used instead of “record.” For the province of Quebec, see sections 12 and 68 of, An Act to Establish a Legal Framework for Information Technology, R.S.Q., chapter C-1.1.

39. “Giving Value: Funding Priorities for UK Archives 2005–2010, a key new report launched by the National Council on Archives (NCA) in November 2005,” www.nationalarchives.gov.uk/documents/standards_guidance.pdf ( accessed October 15, 2012).

40. DLM Forum Foundation, MoReq2010®: Modular Requirements for Records Systems—Volume 1: Core Services & Plug-in Modules, 2011, http://moreq2010.eu/ (accessed May 7, 2012, published in paper form as ISBN 978-92-79-18519-9 by the Publications Office of the European Communities, Luxembourg.

41. DLM Forum, Information Governance across Europe, www.dlmforum.eu/ (accessed December 14, 2010).

42. National Archives of Australia, “Australian and International Standards,” 2012, www.naa.gov.au/records-management/strategic- information/standards/ASISOstandards.aspx(accessed July 16, 2012).

43. E-mail to author from Marc Fresko, May 13, 2012.

44. National Archives of Australia, “Australian Government Recordkeeping Metadata Standard,” 2012, www.naa.gov.au/records- management/publications/agrk-metadata-standard.aspx (accessed July 16, 2012).

45. National Archives of Australia, “Australian and International Standards,” 2012, www.naa.gov.au/records-management/strategic- information/standards/ASISOstandards.aspx(accessed July 16, 2012).

46. International Organization for Standardization, ISO 19005-1:2005, “Document Management—Electronic Document File Format for Long- Term Preservation—Part 1: Use of PDF 1.4 (PDF/A- 1),” www.iso.org/iso/catalogue_detail?csnumber=38920 (accessed July 23, 2012).

47. International Organization for Standardization, ISO 14721:2012, “Space Data and Information Transfer Systems Open Archival Information System—Reference Model,” www.iso.org/iso/iso_catalogue/catalogue_ics/catalogue_detail_ic s.htm?csnumber=57284 (accessed November 25, 2013).

48. Ibid.

http://www.nationalarchives.gov.uk/documents/standards_guidance.pdf

http://moreq2010.eu/

http://www.dlmforum.eu/

http://www.naa.gov.au/records-management/strategic-information/standards/ASISOstandards.aspx

http://www.naa.gov.au/records-management/publications/agrk-metadata-standard.aspx

http://www.naa.gov.au/records-management/strategic-information/standards/ASISOstandards.aspx

http://www.iso.org/iso/catalogue_detail?csnumber=38920

http://www.iso.org/iso/iso_catalogue/catalogue_ics/catalogue_detail_ics.htm?csnumber=57284

49. International Organization for Standardization, ISO 16363:2012, “Space Data and Information Transfer Systems—Audit and Certification of Trustworthy Digital Repositories,” www.iso.org/iso/iso_catalogue/catalogue_tc/catalogue_det ail.htm?csnumber=56510 (accessed July 23, 2012).

50. International Organization for Standardization, ISO 22301:2012 “Societal Security—Business Continuity Management Systems— Requirements,” www.iso.org/iso/catalogue_detail?csnumber=50038 (acce ssed April 21, 2013).

51. International Organization for Standardization, “ISO Business Continuity Standard 22301 to Replace BS 25999- 2,” www.continuityforum.org/content/news/165318/iso-business- continuity-standard-22301-replace-bs-25999-2 (accessed April 21, 2013).

52. BSI, “ISO 22301 Business Continuity Management,” www.bsigroup.com/en-GB/iso-22301-business- continuity (accessed April 21, 2013).

* This section is adapted with permission by EDRM.net, http://www.edrm.net/resources/guides/igrm(accessed January 24, 2014).

* This section was contributed by Ken Chasse J.D., LL.M., a records management attorney and consultant, and member of the Law Society of Upper Canada (Ontario) and of the Law Society of British Columbia, Canada.

CHAPTER 7

Business Considerations for a

Successful IG Program By Barclay T. Blair

The business case for information governance (IG) programs has historically been difficult to justify. It is hard to apply a strict, short-term return on investment

(ROI) calculation. A lot of time, effort, and expense is involved before true

http://www.iso.org/iso/iso_catalogue/catalogue_tc/catalogue_detail.htm?csnumber=56510

http://www.iso.org/iso/catalogue_detail?csnumber=50038

http://www.continuityforum.org/content/news/165318/iso-business-continuity-standard-22301-replace-bs-25999-2

http://www.bsigroup.com/en-GB/iso-22301-business-continuity

http://edrm.net/

http://www.edrm.net/resources/guides/igrm

http://edrm.net/

http://www.edrm.net/resources/guides/igrm

economic benefits can be realized. So a commitment to the long view and an

understanding of the many areas where an organization will improve as a result of

a successful IG program are needed. But the bottom line is that reducing exposure

to business risk, improving the quality and security of data and e-documents,

cutting out unneeded stored information, and streamlining information technology

(IT) development while focusing on business results add up to better organizational

health and viability and, ultimately, an improved bottom line.

Let us take a step back and examine the major issues affecting information costing

and calculating the real cost of holding information, consider Big Data and e-

discovery ramifications, and introduce some new concepts that may help frame

information costing issues differently for business managers. Getting a good

handle on the true cost of information is essential to governing it properly, shifting

resources to higher-value information, and discarding information that has no

discernible business value and carries inherent, avoidable risks.

Changing Information Environment

The information environment is changing. Data volumes are growing,

but unstructured information (such as e-mail, word processing documents, social

media posts) is growing faster than our ability to manage it. Some unstructured

information has more structure than others containing some identifiable metadata

(e.g., e-mail messages all have a header, subject line, time/date stamp, and message

body). This is often termed as semistructured information, but for purposes of this

book, we use the term “unstructured information” to include semistructured

information as well.

The volume of unstructured information is growing dramatically. Analysts

estimate that, over the next decade, the amount of data worldwide will grow by 44

times (from .8 zettabytes to 35 zettabytes: 1 zettabyte = 1 trillion

gigabytes).1 However, the volume of unstructured information will actually grow

50 percent faster than structured data. Analysts also estimate that fully 90 percent

of unstructured information will require formal governance and management by

2020. In other words, the problem of unstructured IG is growing faster than the

problem of data volume itself.

The problem of unstructured IG is growing faster than the problem of data volume

itself.

What makes unstructured information so challenging? There are several factors,

including

https://learning.oreilly.com/library/view/information-governance-concepts/9781118218303/17_chap07.html#chap07fn01

• Horizontal versus vertical. Unstructured information is typically not clearly attached to a department or a business function. Unlike the vertical focus of an enterprise resource planning (ERP) database, for example, an e-mail system serves multiple business functions—from employee communication to filing with regulators—for all parts of the business. Unstructured information is much more horizontal, making it difficult to develop and apply business rules.

• Formality. The tools and applications used to create unstructured information often engender informality and the sharing of opinions that can be problematic in litigation, investigations, and audits—as has been repeatedly demonstrated in front-page stories over the past decade. This problem is not likely to get any easier as social media technologies and mobile devices become more common in the enterprise.

• Management location. Unstructured information does not have a single, obvious home. Although e-mail systems rely on central messaging servers, e-mail is just as likely to be found on a file share, mobile device, or laptop hard drive. This makes the application of management rules more difficult than the application of the same rules in structured systems, where there is a close marriage between the application and the database.

• “Ownership” issues. Employees do not think that they “own” data in an accounts receivable system like they “own” their e-mail or documents stored on their hard drive. Although such information generally has a single owner (i.e., the organization itself), this non- ownership mind-set can make the imposition of management rules for unstructured information more challenging than for structured data.

• Classification. The business purpose of a database is generally determined prior to its design. Unlike structured information, the business purpose of unstructured information is difficult to infer from the application that created or stores the information. A word processing file stored in a collaboration environment could be a multimillion-dollar contract or a lunch menu. As such, classification of unstructured content is more complex and expensive than structured information.

Taken together, these factors reveal a simple truth: Managing unstructured

information is a separate and distinct discipline from managing databases. It

requires different methods and tools. Moreover, determining the costs and benefits

of owning and managing unstructured information is a unique—but critical—

challenge.

The governance of unstructured information creates enormous complexity and risk

for business managers to consider while making it difficult for organizations to

generate real value from all this information. Despite the looming crisis, most

organizations have limited ability to quantify the real cost of owning and managing

unstructured information. Determining the total cost of owning unstructured

information is an essential precursor to managing and monetizing that information

while cutting information costs—key steps in driving profit for the enterprise.

Storing things is cheap … I've tended to take the attitude, “Don't throw electronic

things away.”

—Data scientist quoted in Anne Eisenberg, “What 23 Years of E-Mail May Say

About You,” New York Times, April 7, 2012

The company spent $900,000 to produce an amount of data that would consume

less than one-quarter of the available capacity of an ordinary DVD.

—Nicholas M. Pace and Laura Zakaras, “Where the Money Goes: Understanding

Litigant Expenditures for Producing Electronic Discovery,” RAND Institute for

Civil Justice, 2012

Calculating Information Costs

We are not very good at figuring out what information costs—truly costs. Many

organizations act as if storage is an infinitely renewable resource and the only cost

of information. But, somehow, enterprise storage spending rises each year and IT

support costs rise, even as the root commodity (disk drives) grows ever cheaper

and denser. Obviously, they are not considering labor and overhead costs incurred

with managing information, and the additional knowledge worker time wasted

sifting through mountains of information to find what they need.

Some of this myopic focus on disk storage cost is simple ignorance. The executive

who concludes that a terabyte costs less than a nice meal at a restaurant after

browsing storage drives on the shelves of a favorite big-box retailer on the

weekend is of little help.

Rising information storage costs cannot be dismissed. Each year the billions that

organizations worldwide spend on storage grows, even though the cost of a hard

drive is less than 1 percent of what it was about a decade ago. We have treated

storage as a resource that has no cost to the organization outside of the initial

capital outlay and basic operational costs. This is shortsighted and outdated.

Some of the reason that managers and executives have difficulty comprehending

the true cost of information is old-fashioned miscommunication. IT departments do

not see (or pay for) the full cost of e-discovery and litigation. Even when IT

“partners” with litigators, what IT learn rarely drives strategic IT decisions.

Conversely, law departments (and outside firms) rarely own and pay for the IT

consequences of their litigation strategies. It is as if when the litigation fire needs

to be put out, nobody calculates the cost of gasoline and water for the fire trucks.

But calculating the cost of information—especially information that does not sit

neatly in the rows and columns of enterprise database “systems of record”—is

complex. It is more art than science. And it is more politics than art. There is no

Aristotelian Golden Mean for information.

The true cost of mismanaging information is much more profound than simply

calculating storage unit costs. It is the cost of opportunity lost—the lost benefit of

information that is disorganized, created and then forgotten, cast aside and left to

rot. It is the cost of information that cannot be brought to market. Organizations

that realize this, and invest in managing and leveraging their unstructured

information, will be the winners of the next decade.

Most organizations own vast pools of information that is effectively “dark”: They

do not know what it is, where it is, who is responsible for managing it, or whether

it is an asset or a liability. It is not classified, indexed, or managed according to the

organization's own policies. It sits in shared drives, mobile devices, abandoned

content systems, single-purpose cloud repositories, legacy systems, and outdated

archives.

And when the light is finally flicked on for the first time by an intensive hunt for

information during e-discovery, this dark information can turn out to be a liability.

An e-mail message about “paying off fat people who are a little afraid of some silly

lung problem” might seem innocent—until it is placed in front of a jury as

evidence that a drug company did not care that its diet drug was allegedly killing

people.2

The importance of understanding the total cost of owning unstructured information

is growing. We are at the beginning of a “seismic economic shift” in the

information landscape, one that promises to not only “reinvent society,” (according

to an MIT data scientist) but also to create “the new oil … a new asset class

touching all aspects of society.”3

Big Data Opportunities and Challenges

We are entering the epoch of Big Data—an era of Internet-scale enterprise

infrastructure, powerful analytical tools, and massive data sets from which we can

potentially wring profound new insights about business, society, and ourselves. It

is an epoch that, according to the consulting firm McKinsey, promises to save the

https://learning.oreilly.com/library/view/information-governance-concepts/9781118218303/17_chap07.html#chap07fn02

https://learning.oreilly.com/library/view/information-governance-concepts/9781118218303/17_chap07.html#chap07fn03

European Union public sector billions of euros, increase retailer margins by 60

percent, and reduce U.S. national health care spending by 8 percent, while creating

hundreds of thousands of jobs.4 Sounds great, right?

However, the early days of this epoch are unfolding in almost total ignorance of

the true cost of information. In the near nirvana contemplated by some Big

Data proponents, all data is good, and more data is better. Yet it would be an

exaggeration to say that there is no awareness of potential Big Data downsides. A

recent study by the Pew Research Center was positive overall but did note

concerns about privacy, social control, misinformation, civil rights abuses, and the

possibility of simply being overwhelmed by the deluge of information.5

Smart leaders across industries will see using big data for what it is: a management

revolution.

—Andrew McAfee and Erik Brynjolfsson, “Big Data: The Management

Revolution,” Harvard Business Review (October 2012)

But the real-world burdens of managing, protecting, searching, classifying,

retaining, producing, and migrating unstructured information are foreign to many

Big Data cheerleaders. This may be because the Big Data hype cycle6 is not yet in

the “trough of disillusionment” where the reality of corporate culture and complex

legal requirements sets in. But set in it will, and when it does, the demand for

intelligent analysis of costs and benefits will be high.

IG professionals must be ready for these new challenges and opportunities—ready

with new models for thinking about unstructured information. Models that

calculate the risks of keeping too much of the wrong information as well as

the benefits of clean, reliable, and accessible pools of the right information. Models

that drive desirable behavior in the enterprise, and position organizations to

succeed on the “next frontier for innovation, competition, and productivity.”7

Full Cost Accounting for Information

It is difficult for organizations to make educated decisions about unstructured

information without knowing its full cost. Models like total cost of ownership

(TCO) and ROI are designed for this purpose and have much in common with full

cost accounting (FCA) models. FCA seeks to create a complete picture of costs

that includes past, future, direct, and indirect costs rather than direct cash outlays

alone.

FCA has been used for many purposes, including the decidedly earthbound task of

determining what it costs to take out the garbage and the loftier task of calculating

how much the International Space Station really costs. A closely related concept,

often called triple bottom line, has gained traction in the world of environmental

https://learning.oreilly.com/library/view/information-governance-concepts/9781118218303/17_chap07.html#chap07fn04

https://learning.oreilly.com/library/view/information-governance-concepts/9781118218303/17_chap07.html#chap07fn05

https://learning.oreilly.com/library/view/information-governance-concepts/9781118218303/17_chap07.html#chap07fn06

https://learning.oreilly.com/library/view/information-governance-concepts/9781118218303/17_chap07.html#chap07fn07

accounting, positing that organizations must take into account societal and

environmental costs as well as monetary costs.

The U.S. Environmental Protection Agency promotes the use of FCA for

municipal waste management, and several states have adopted laws requiring its

use. It is fascinating—and no accident—that this accounting model has been

widely used to calculate the full cost of managing an unwanted by-product of

modern life. The analogy to outdated, duplicate, and unmanaged unstructured

information is clear.

Applying the principles of FCA to information can increase cost transparency and

drive better management decisions. In municipal garbage systems where citizens

do not see a separate bill for taking out the garbage, it is more difficult to get

new spending on waste management approved.8 Without visibility into the true

cost, how can citizens—or CEOs—make informed decisions?

IG professionals must be ready with new models that calculate the risks of storing

too much of the wrong information and also the benefits of clean, reliable,

accessible information.

Organizations can learn from accounting models used by cities to calculate the

total cost of managing municipal waste and apply them to the IG problem.

Responsible, innovative managers and executives should investigate FCA models

for calculating the total cost of owning unstructured information. Consider costs

such as:

• General and administrative costs, such as cost of IT operations and personnel, facilities, and technical support.

• Productivity gains or losses related to the information. • Legal and e-discovery costs associated with the information and

information systems. • Indirect costs, such as the accounting, billing, clerical support,

contract management, insurance, payroll, purchasing, and so on. • Up-front costs, such as the acquisition of the system, integration and

configuration, and training. This should include the depreciation of capital outlays.

• Future costs, such as maintenance, migration, and decommissioning of information systems. Future outlays should be amortized.

Calculating the Cost of Owning Unstructured Information

Any system designed to calculate the cost or benefit of a business strategy is

inherently political. That is, it is an argument designed to convince an audience.

https://learning.oreilly.com/library/view/information-governance-concepts/9781118218303/17_chap07.html#chap07fn08

Well-known models like TCO and ROI are primarily decision tools designed to

help organizations predict the economic consequences of a decision. While there

are certainly objective truths about the information environment, human decision

making is a complex and imperfect process. There are plenty of excellent guides

on how to create a standard TCO or ROI. That is not our purpose here. Rather, we

want to inspire creative thinking about how to calculate the cost of owning

unstructured information and help organizations minimize the risk—and maximize

the value—of unstructured information.

Any economic model for calculating the cost of unstructured information depends

on reliable facts. But facts can be hard to come by. A client recently went in search

of an accurate number for the annual cost per terabyte of Tier 1 storage in her

company. The company's storage environment was completely outsourced, leading

her to believe that the number would be transparent and easy to find. However,

after days spent poring over the massive contract, she was no closer to the truth.

Although there was a line item for storage costs, the true costs were buried in

“complexity fees” and other opaque terms.

Organizations need tools that help them establish facts about their unstructured

information environment. The business case for better management depends on

these facts. Look for tools that can help you:

• Find unstructured information wherever it resides across the enterprise, including e-mail systems, shared network drives, legacy content management systems, and archives.

Identifying and building consensus on the sources of cost for unstructured

information is critical to any TCO or ROI calculation. It is critical that all

stake-holders agree on these sources, or they will not incorporate the output

of the calculation in their strategy and planning.

• Enable fast and intuitive access to basic metrics, such as size, date of last access, and file type.

• Provide sophisticated analysis of the nature of the content itself to drive classification and information life cycle decisions.

• Deliver visibility into the environment through dashboards that are easy to for nonspecialists to configure and use.

SOURCES OF COST

Unstructured information is ubiquitous. It is typically not the product of a single-

purpose business application. It often has no clearly defined owner. It is endlessly

duplicated and transmitted across the organization. Determining where and how

unstructured information generates cost is difficult.

However, doing so is possible. Our research shows that at least 10 key factors that

drive the total cost of owning unstructured information. These 10 factors identify

where organizations typically spend money throughout the life cycle of managing

unstructured information. These factors are listed in Figure 7.1, along with

examples of elements that typically increase cost (“Cost Drivers,” on the left side)

and elements that typically reduce costs (“Cost Reducers,” on the right side).

1. E-discovery: finding, processing, and producing information to support law-suits, investigations, and audits. Unstructured information is typically the most common target in e-discovery, and a poorly managed information environment can add millions of dollars in cost to large lawsuits. Simply reviewing a gigabyte of information for litigation can cost $14,000 or more.9

2. Disposition: getting rid of information that no longer has value because it is duplicate, out of date, or has no value to the business. In poorly managed information environments, separating the wheat from the chaff can cost large organizations millions of dollars. For enterprises with frequent litigation, the risk of throwing away the wrong piece of information only increases risk and cost. Better management and smart IG tools drive costs down.

3. Classification and organization: keeping unstructured information organized so that employees can use it. It also is necessary so management rules supporting privacy, privilege, confidentiality, retention, and other requirements can be applied.

4. Digitization and automation. Many business processes continue to be a combination of digital, automated steps and paper-based, manual steps. Automating and digitizing these processes requires investment but also can drive significant returns. For example, studies have shown that automating accounts payable “can reduce invoice processing costs by 90 percent.”10

https://learning.oreilly.com/library/view/information-governance-concepts/9781118218303/17_chap07.html#fig7.1

https://learning.oreilly.com/library/view/information-governance-concepts/9781118218303/17_chap07.html#chap07fn09

https://learning.oreilly.com/library/view/information-governance-concepts/9781118218303/17_chap07.html#chap07fn10

Figure 7.1 Key Factors Driving Cost

Source: Barclay T. Blair

5. Storage and network infrastructure: the cost of the devices, networks, software, and labor required to store unstructured information. Although the cost of the baseline commodity (i.e., a gigabyte of storage space) continues to fall, for most organizations overall volume growth and complexity means that storage budgets go up each year. For example, between 2000 and 2010, organization more than doubled the amount they spent on storage-related software even though the cost of raw hard drive space dropped by almost 100 times.11

6. Information search, access, and collaboration: the cost of hardware, software, and services designed to ensure that information is available to those who need it, when they need it. This typically includes enterprise content management systems, enterprise search, case management, and the infrastructure necessary to support employee access and use of these systems.

7. Migration: the cost of moving unstructured information from outdated systems to current systems. In poorly managed information environments, the cost of migration can be very high—so high that some organizations maintain legacy systems long after they are no

https://learning.oreilly.com/library/view/information-governance-concepts/9781118218303/17_chap07.html#chap07fn11

longer supported by the vendor just to avoid (more likely, simply to defer) the migration cost and complexity.

8. Policy management and compliance: the cost of developing, implementing, enforcing, and maintaining IG policies on unstructured information. Good policies, consistently enforced, will drive down the total cost of owning unstructured information.

9. Discovering and structuring business processes: the cost of identifying, improving, and systematizing or “routinizing” business processes that are currently ad hoc and disorganized. Typical examples include contract management and accounts receivable as well as revenue-related activities, such as sales and customer support. Moving from informal e-mail and document-based processes to fixed work flows drives down cost.

10. Knowledge capture and transfer: the cost of capturing critical business knowledge held at the department and employee level and putting that information in a form that enables other employees and parts of the organization to benefit from it. Examples include intranets and their more contemporary cousins such as wikis, blogs, and enterprise social media platforms.

The Path to Information Value

At its peak during World War II, the Brooklyn Navy Yard had 70,000 people

coming to work every day. The site was once America's premier shipbuilding

facility, building the steam-powered Ohio in 1820 and the aircraft carrier

USS Independence in the 1950s. But the site fell apart after it was decommissioned

in the 1960s. Today, an “Admiral's Row” of Second Empire–style mansions once

occupied by naval officers are an extraordinary sight, with gnarled oak trees

pushing through the rotting mansard roofs.12

Seventy percent of managers and executives say data are “extremely important” for

creating competitive advantage. “The key, of course, is knowing which data

matter, who within a company needs them, and finding ways to get that data into

users' hands.”

—The Economist Intelligence Unit, “Levelling the Playing Field: How Companies

Use Data to Create Advantage” (January 2011)

However, after decades of decay, the Navy Yard is being reborn as the home of

hundreds of businesses—from major movie studios to artisanal whisky makers—

taking advantage of abundant space and a desirable location. There were three

phases in the yard's rebirth:

https://learning.oreilly.com/library/view/information-governance-concepts/9781118218303/17_chap07.html#chap07fn12

1. Clean. Survey the site to determine what had value and what did not. Dispose of toxic waste and rotting buildings, and modernize the infrastructure.

2. Build and maintain. Implement a plan to continuously improve, upgrade, and maintain the facility.

3. Monetize. Lease the space.

Most organizations face a similar problem. However, our Navy Yards are the vast

piles of unstructured information that were created with little thought to how and

when the pile might go away. They are records management programs built for a

different era—like an automobile with a metal dashboard, six ashtrays, and no seat

belts. Our Navy Yards are information environments no longer fit for purpose in

the Big Data era, overwhelmed by volume and complexity.

We are doing a bad job at managing information. McKinsey estimates that in

some circumstances, companies are using up to 80 percent of their infrastructure to

store duplicate data.13 Nearly half of respondents in a survey ViaLumina recently

conducted said that at least 50 percent of the information in their organization is

duplicate, outdated, or unnecessary.14 We can do better.

1. CLEAN

We should put the Navy Yard's blueprint to work, first by identifying our piles of

rotting unstructured information. Duplicate information. Information that has not

been accessed in years. Information that no longer supports a business process and

has little value. Information that we have no legal obligation to keep. The

economics of such “defensible deletion” projects can be compelling simply on the

basis of recovering the storage space and thus reallocating capital that would have

been spent on the annual storage purchase.

2. BUILD AND MAINTAIN

Cleaning up the Navy Yard is only the first step. We cannot repeat the past

mistakes. We avoid this by building and maintaining an IG program that

establishes our information constitution (why), laws (what), and regulations (how).

We need a corporate governance, compliance, and audit plan that gives the

program teeth, and a technology infrastructure that makes it real. It must be a

defensible program to ensure we comply with the law and manage regulatory risk.

3. MONETIZE

IG is a means to an end, and that end is value creation. IG also mitigates risk and

drives down cost. But extracting value is the key. Although monetization and value

https://learning.oreilly.com/library/view/information-governance-concepts/9781118218303/17_chap07.html#chap07fn13

https://learning.oreilly.com/library/view/information-governance-concepts/9781118218303/17_chap07.html#chap07fn14

creation often are associated with structured data, new tools and techniques create

exciting new opportunities for value creation from unstructured information.

For example, what if an organization could use sophisticated analytics on the email

account of their top salesperson (the more years of e-mail the better), look for

markers of success, then train and hire salespeople based on that template? What is

the pattern of a salesperson's communications with customers and prospects in her

territory? What is the substance of the communications? What is the tone? When

do successful salespeople communicate? How are the patterns different between

successful deals and failed deals? What knowledge and insight resides in the

thousands of messages and gigabytes of content? The tools and techniques of Big

Data applied to e-mail can bring powerful business insights. However, we have to

know what questions to ask. According to Computerworld, “the hardest part of

using big data is trying to get business people to sit down and define what they

want out of the huge amount of unstructured and semi-structured data that is

available to enterprises these days.”15

Key steps in driving information value are: (1) clean; (2) build and maintain; and

(3) monetize.

Table 7.1 Key Steps in the IG Process

Source: Barclay T. Blair

The analytics challenges of Big Data create opportunities. For example, McKinsey

predicts that demand for “deep analytical talent in the United States could be 50 to

60 percent greater than its projected supply by 2018.” A chief reason for this gap is

that “this type of talent is difficult to produce, taking years of training in the case of

someone with intrinsic mathematical abilities.” However, the more profound

opportunity is for the “1.5 million extra additional managers and analysts in the

United States who can ask the right questions and consume the results of the

analysis of big data effectively.”16

Some companies are using analytics to set prices. For example, the largest

distributor of heating oil in the United States sets prices on the fly, based on

commodity prices and customer retention risks.17 In a case that caught the attention

https://learning.oreilly.com/library/view/information-governance-concepts/9781118218303/17_chap07.html#chap07fn15

https://learning.oreilly.com/library/view/information-governance-concepts/9781118218303/17_chap07.html#chap07fn16

https://learning.oreilly.com/library/view/information-governance-concepts/9781118218303/17_chap07.html#chap07fn17

of morning news shows, with breathless headlines like “Are Mac Users Paying

More?” an online travel company revealed that “Mac users are 40 percent more

likely to book four or five-star hotels … compared to PC users.”18 Despite the

headlines, the company was not charging Mac users more. Rather, computer brand

was a variable used to determine which products were highlighted.

The path to information value is not necessarily linear. Different parts of your

business may achieve maturity at different rates, driven by the unique risks and

opportunities of the information they possess.

Challenging the Culture

The best models for calculating the total cost of owning unstructured are those that

information professionals can use to challenge and change organizational culture.

Much of the unstructured information that represents the greatest cost and risk to

organizations is created, communicated, and managed directly by employees—that

is, by human beings. As such, better IG relies in part on improving the way those

human beings use and manage information.

New Information Models

The “information calorie” and “information cap-and-trade,” explored next, are two

new models designed to help with the challenge of governing information.

INFORMATION CALORIE

The Western world is suffering from an embarrassment of riches when it comes to

calories. The calorie has been weaponized in the form of tasty, cheap, and fast food

loaded with sugar and fat. Even a cup of “coffee” can contain as much as 800

calories.19 We have gotten very, very good at maximizing available calories, at a

staggering cost: $190 billion per year in additional medical spending as a result of

obesity in the United States, greater than the cost of smoking.20

Governments are taking action. A new national health care law in the United States

requires restaurant chains to disclose calorie counts for the food they sell by 2013,

building on similar state laws.21 Calories are not inherently bad. We would literally

die without them. But too many calories make us sick.

The analogy to information is clear. Information is the “lifeblood” of our

organizations and is central to our survival. But too much unmanaged unstructured

information leaves us fat, slow, and coughing and wheezing at the back of the

pack.

In 2012, New York City initially passed a controversial law limiting the size of soft

drinks that can be sold at movie theaters and convenience stores (later challenged

https://learning.oreilly.com/library/view/information-governance-concepts/9781118218303/17_chap07.html#chap07fn18

https://learning.oreilly.com/library/view/information-governance-concepts/9781118218303/17_chap07.html#chap07fn19

https://learning.oreilly.com/library/view/information-governance-concepts/9781118218303/17_chap07.html#chap07fn20

https://learning.oreilly.com/library/view/information-governance-concepts/9781118218303/17_chap07.html#chap07fn21

in court). The “Bloomberg soda ban” was based on the premise that humans need

help making good choices. There is some basis for this approach, with studies

showing that, for example, the size of the candy scoop determines how much free

candy we eat.22 Under the new law, it was still possible in New York to buy two

smaller cups of soda, but it was hoped that inconvenience (and cost) will reduce

overconsumption.

A new study … examined consumer behavior before and after calorie counts were

posted, and determined that when restaurants post calories on menu boards, there is

a reduction in calories per transaction.

—Bryan Bollinger, Phillip Leslie, Alan Sorensen, “Calorie Posting in Chain

Restaurants,” Stanford University, January 2010

Thinking about information as calories at your organization can improve

awareness of its costs and drive change. The goal is not to add friction to desirable

behaviors, like collaboration and mobile work, but rather to make it more difficult

to create and consume empty information calories.

Here are some tips to get started:

• Educate executives and employees about the cost of information mismanagement through anecdotes, case studies, and facts.

• Show employees their information footprint by regularly exposing them to the amount of data storage they are using in e-mail, shared drives, content management systems, and other environments they work with. With a little creative programming, you can post “information calories” on your menus.

• Design systems to minimize information calories. Examples include: preventing employees from exporting e-mail to .pst files; turning off the ability to store documents on desktop hard drives to encourage the use of managed collaboration environment; and requiring employees to send links to shared content rather than creating yet another e-mail attachment. Clever technology and social engineering, like the soda ban, can drive healthy information behavior.

INFORMATION CAP-AND-TRADE

Originally designed as a regulatory approach for fighting acid rain in the 1980s,

cap-and-trade has gained new attention as a method of curbing carbon emissions.

Cap-and-trade systems differ from command-and-control regulatory approaches

that mandate, rather than economically encourage, a course of action. In other

words, rather than forcing companies to install scrubbers on power plant exhausts

(command and control), cap-and-trade provides companies with an emissions

https://learning.oreilly.com/library/view/information-governance-concepts/9781118218303/17_chap07.html#chap07fn22

quota, which they can hit as they see fit, and even profit from. Companies with

unused room on their quota can sell those “credits” on specialized markets.

Consider a cap-and-trade system for information. Do not limit the creation and

storage of useful information—that defeats the purpose of investing in IT in the

first place. Rather, design a cap-and-trade system that controls the amount

of information pollution and rewards innovation and management discipline.

While there is no objective “right amount” of information for every organization or

department, we can certainly do better than “as much as you want, junk or not.”

After all, “nearly all sectors in the US economy had at least an average of 200

terabytes of stored data … and many sectors had more than 1 petabyte in mean

stored data per company.”23 Moreover, up to 50 percent of that information is easily

identifiable as data pollution.24 So, we have a reasonable starting point.

Here are some tips for creating an information cap-and-trade system:

• Baseline the desired amount of information per system, department, and/or type of user. How much information do you currently have? How much has value? How much should you have? These are not easy questions to answer, but even rough calculations can make a big difference.

• Create information volume targets or quotas, and allocate them by business unit, system, or user. This is the “cap” part of the system.

• Calculate the fully loaded cost of a unit of information, and adopt it as a baseline metric for the “trade” part of the system. Consider whether annual e-discovery costs can be allocated to this unit in a reasonable way.

• Create an internal accounting system for tracking and trading information units, or credits within the organization. Innovative departments will be rewarded, laggards will be motivated.

• Get creative in what the credits can purchase. New revenue- generating software? Headcount?

“There's not a person in a business anywhere who gets up in the morning and says,

‘Gee, I want to race into the office to follow some regulation.’ On the other hand,

if you say, ‘There's an upside potential here, you're going to make money,’ people

do get up early and do drive hard around the possibility of finding themselves

winners on this.”

—Dan Etsy, environmental policy professor at Yale University, quoted in Richard

Conniff, “The Political History of Cap and Trade,” Smithsonian

Magazine (August 2009)

https://learning.oreilly.com/library/view/information-governance-concepts/9781118218303/17_chap07.html#chap07fn23

https://learning.oreilly.com/library/view/information-governance-concepts/9781118218303/17_chap07.html#chap07fn24

Future State: What Will the IG-Enabled Organization Look

Like?

When an organization is IG enabled, or “IG mature”—meaning IG is infused into

operations throughout the enterprise and coordinated on an organization-wide

level—it will look significantly different from most organizations today. Not only

will the organization have a solid handle on the total cost of information; not only

will it have shifted resources to capitalize on the opportunities of Big Data; not

only will it be managing the deluge in a systematic, business-oriented way by

cutting out data debris and leveraging information value; it will also look

significantly different in key operational areas including legal, records and

information management (RIM), and IT.

In legal matters, the mature IG-enabled organization will be better suited to address

litigation in a more efficient way through a standardized legal hold notification

(LHN) process. Legal risk is reduced through improved IG, which will manage

information privacy in accordance with applicable laws and regulations. During

litigation, your legal team will be able to sort through information more rapidly

and efficiently, improving your legal posture, cutting e-discovery costs, and

allowing for attorney time to be focused on strategy and to zero in on key issues.

This means attorneys should have the technology tools to be more effective.

Adherence to retention schedules means that records and documents can be

discarded at the earliest possible time, which reduces the chances that some

information could pose a legal risk. Hard costs can be saved by eliminating that

approximately 69 percent of stored information that no longer has business value.

That cost savings may be the primary rationale for the initial IG program effort. By

leveraging advanced technologies such as predictive coding, the organization can

reduce the costs of e-discovery and better utilize attorney time.

Your RIM functions will operate with more efficiency and in compliance with

laws and regulations. Appropriate retention periods will be applied and enforced,

and authentic, original copies of business records will be easily identifiable, so that

managers are using current and accurate information on which to base their

decisions. Over the long term, valuable information from projects, product

development, marketing programs, and strategic initiatives will be retained in

corporate memory, reducing the impact of turnover and providing distilled

information and knowledge to contribute to a knowledge management (KM)

program. KM programs can facilitate innovation in organizations, as a knowledge

base is built, retained, expanded, and leveraged.

In your IT operations, a focus on how IT can contribute to business objectives will

bring about a new perspective. Using more of a business lens to view IT projects

will help IT to contribute toward the achievement of business objectives. IT will be

working more closely with legal, RIM, risk, and other business units, which should

help these groups to have their needs and issues better addressed by IT solutions.

Having a standardized data governance program in place means cleaning up

corrupted or duplicated data and providing users with clean, accurate data as a

basis for line-of-business software applications and for decision support analytics

in business intelligence (BI) applications. Better data is the basis for improved

insights, which can be gained by leveraging BI and will improve management

decision-making capabilities and help to provide better customer service, which

can impact customer retention. It costs a lot more to gain a new customer than to

retain an existing one, and with better data quality, the opportunities to cross-sell

and upsell customers are improved. This can provide a sustainable competitive

advantage. Standardizing the use of business terms will facilitate improved

communications between IT and other business units, which should lead to

improved software applications that address user needs. Adhering to information

life cycle management principles will help the organization to apply the proper

level of IT resources to its high-value information while decreasing costs by

managing information of declining value appropriately. IT effectiveness and

efficiency will be improved by using IT frameworks and standards, such as CobiT

5 and ISO/IEC 38500:2008, the international standard that provides high-level

principles and guidance for senior executives and directors, and those advising

them, for the effective and efficient governance of IT.25 Implementing a master data

management program will help larger organizations with complex IT operations to

ensure that they are working with consistent data from a single source. Improved

database security through data masking, database activity monitoring, database

auditing, and other tools will help guard the organization's critical databases

against the risk of rogue attacks by hackers. Deploying document life cycle

security tools such as data loss prevention and information rights management will

help secure your confidential information assets and keep them from prying eyes.

This helps to secure the organization's competitive position and protect its valuable

intellectual property.

By securing your electronic documents and data, not only within the organization

but also for mobile use, and by monitoring and complying with applicable privacy

laws, your confidential information assets will be safeguarded, your brand will be

better protected, and your employees will be able to be productive without

sacrificing the security of your information assets.

Moving Forward

We are not very good at figuring out what unstructured information costs. The Big

Data deluge is upon us. If we hope to manage—and, more important, to

https://learning.oreilly.com/library/view/information-governance-concepts/9781118218303/17_chap07.html#chap07fn25

monetize—this deluge, we must form cross-functional teams and challenge the

way our organizations think about unstructured information. The first and most

important step is developing the ability to convincingly calculate what unstructured

information really costs and then to discover ways we can recue those costs and

drive value. These are foundational skills for information professionals in the new

era of Big Data. In this era, information is currency—but a currency that has value

only when IG professionals drive innovation and management rigor in the

unstructured information environment.

CHAPTER SUMMARY: KEY POINTS

• The business case for IG programs has historically been difficult to justify.

• It takes a commitment to the long view to develop a successful IG program.

• The problem of unstructured IG is growing faster than the problem of data

volume itself.

• IG professionals must be ready with new models that calculate the risks of

storing too much of the wrong information and also the benefits of clean,

reliable, accessible information.

• Key steps in driving information value are: (1) clean; (2) build and maintain;

and (3) monetize.

• The information calorie approach and information cap-and-trade are two

new models for assisting in IG.

• Legal risk is reduced through improved IG, and legal costs are reduced.

• Leveraging newer technologies like predictive coding can improve the

efficiency of legal teams.

• Adherence to retention schedules means that records and documents can be

discarded at the earliest possible time, which reduces costs by eliminating

unneeded information that no longer has business value.

• RIM functions will operate with more efficiency and in compliance with

laws and regulations under a successful IG program.

• A compliant RIM program helps to build the organization's corporate

memory of essential “lessons learned,” which can foster a KM program.

• KM programs can facilitate innovation in organizations.

• Focusing on business impact and customizing your IG approach to meet

business objectives are key best practices for IG in the IT department.

• Effective data governance can yield bottom-line benefits derived from new

insights, especially with the use of business intelligence software.

• IT governance seeks to align business objectives with IT strategy to deliver

business value.

• Using IT frameworks like CobiT 5 can improve the ability of senior

management to monitor IT value and processes.

• Identifying sensitive information in your databases and implementing

database security best practices help reduce organizational risk and the cost

of compliance.

• By securing your electronic documents and data, your information assets

will be safeguarded and your organization can more easily comply with

privacy laws and regulations.

• We are not very good at figuring out what unstructured information costs.

To thrive in the era of Big Data requires challenging the way we think about

the cost of managing unstructured information.

Notes

1. International Data Corporation, “The 2011 Digital Universe Study,” June 2011. www.emc.com/leadership/programs/digital-universe.htm (accessed November 25, 2013).

2. Richard B. Schmidt, “The Cyber Suit: How Computers Aided Lawyers In Diet-Pill Case,” Wall Street Journal, October 8, 1999. http://webreprints.djreprints.com/0000000000000000001255900 1.html

3. Nick Bilton, “At Davos, Discussions of a Global Data Deluge,” New York Times, January 25, 2012, http://bits.blogs.nytimes.com/2012/01/25/at- davos-discussions-of-a-global-data-deluge/; Alex Pentland, quoted by Edge.org in “Reinventing Society in the Wake of Big Data,” August 8, 2012, www.edge.org/conversation/reinventing-society-in-the-wake-of-big- data; World Economic Forum, “Personal Data: The Emergence of a New Asset Class” (January 2011), http://www3.weforum.org/docs/WEF_ITTC_PersonalDataNewAsse t_Report_2011.pdf

4. James Manyika et al., “Big Data: The Next Frontier for Innovation, Competitions, and Productivity,” McKinsey Global Institute, May 2011, www.mckinsey.com/insights/business_technology/big_data_the_ne xt_frontier_for_innovation

5. Janna Quitney Anderson and Lee Ranie, “Future of the Internet: Big Data,” Pew Internet and American Life Project, July 20, 2012, http://pewinternet.org/~/media//Files/Reports/2012/PIP_Future_ of_Internet_2012_Big_Data.pdf

6. Louis Columbus, “Roundup of Big Data Forecasts and Market Estimates, 2012,” Forbes, August 16,

http://www.emc.com/leadership/programs/digital-universe.htm

http://webreprints.djreprints.com/00000000000000000012559001.html

http://bits.blogs.nytimes.com/2012/01/25/at-davos-discussions-of-a-global-data-deluge/

http://edge.org/

http://www.edge.org/conversation/reinventing-society-in-the-wake-of-big-data

http://www3.weforum.org/docs/WEF_ITTC_PersonalDataNewAsset_Report_2011.pdf

http://www.mckinsey.com/insights/business_technology/big_data_the_next_frontier_for_innovation

http://pewinternet.org/~/media/Files/Reports/2012/PIP_Future_of_Internet_2012_Big_Data.pdf

2012, www.forbes.com/sites/louiscolumbus/2012/08/16/roundup-of-big- data-forecasts-and-market-estimates-2012/

7. McKinsey Global Institute, “Big Data: The Next Frontier for Innovation, Competitions, and productivity,” May 2011.

8. U.S. EPA, “Making Solid Waste Decisions with Full Cost Accounting,” n.d., www.epa.gov/osw/conserve/tools/fca/docs/primer.pdf (accessed November 25, 2013).

9. Nicholas M. Pace and Laura Zakaras, “Where the Money Goes: Understanding Litigant Expenditures for Producing Electronic Discovery,” RAND Institute for Civil Justice, 2012. www.rand.org/content/dam/rand/pubs/monographs/2012/RAND_ MG1208.pdf (accessed November 25, 2013).

10. Accounts Payable Network, “A Detailed Guide to Imaging and Workflow ROI,” 2010.

11. Various sources. See, for example: Barclay T. Blair, “Today's PowerPoint Slide: The Origins of Information Governance by the Numbers,” October 28, 2010. http://barclaytblair.com/origins-of-information-governance- powerpoint/ (accessed November 25, 2013).

12. Brooklyn Navy Yard Development Corporation, “The History of Brooklyn Navy Yard,” www.brooklynnavyyard.org/history.html (accessed November 25, 2013).

13. James Manyika et al., “Big Data.”

14. Barclay Blair and Barry Murphy, “Defining Information Governance: Theory or Action? Results of the 2011 Information Governance Survey,” ViaLumina, eDiscovery Journal (September 2011).

15. Jaikumar Vijayan, “Finding the Business Value in Big Data Is a Big Problem,” Computerworld, September 12, 2012, www.computerworld.com/s/article/9231224/Finding_the_business _value_in_big_data_is_a_big_problem

16. James Manyika et al., “Big Data.”

17. Economist Intelligence Unit, “Leveling the Playing Field: How Companies Use Data to Create Advantage” (January 2011), http://blogs.sap.com/wp- content/blogs.dir/15/files/2012/02/EIU_Levelling_The_Playing_Field_1. pdf

18. Genevieve Shaw Brown, “Mac Users My See Pricier Options on Orbitz,” ABC Good Morning America, June 25,

http://www.forbes.com/sites/louiscolumbus/2012/08/16/roundup-of-big-data-forecasts-and-market-estimates-2012/

http://www.epa.gov/osw/conserve/tools/fca/docs/primer.pdf

http://www.rand.org/content/dam/rand/pubs/monographs/2012/RAND_MG1208.pdf

http://barclaytblair.com/origins-of-information-governance-powerpoint/

http://www.brooklynnavyyard.org/history.html

http://www.computerworld.com/s/article/9231224/Finding_the_business_value_in_big_data_is_a_big_problem

http://blogs.sap.com/wp-content/blogs.dir/15/files/2012/02/EIU_Levelling_The_Playing_Field_1.pdf

2012, http://abcnews.go.com/Travel/mac-users-higher-hotel-prices- orbitz/story?id=16650014#.UDlkVBqe7oV

19. “Health Care Bill Requires Calories on Menus at Chain Restaurants,” USA Today, March 23, 2010, http://usatoday30.usatoday.com/news/health/weightloss/2010-03- 23-calories-menus_N.htm

20. Sharon Beley, “As America's Waistline Expands, Cost Soar,” Reuters, April 30, 2012, www.reuters.com/article/2012/04/30/us-obesity- idUSBRE83T0C820120430

21. Stephanie Rosenbloom, “Calorie Data to Be Posted at Most Chains,” New York Times, March 23, 2010, www.nytimes.com/2010/03/24/business/24menu.html

22. James Surowiecki, “Downsizing Supersize,” New Yorker, August 13, 2012, www.newyorker.com/talk/financial/2012/08/13/120813ta_talk_sur owiecki

23. Manyika et al., “Big Data.”

24. Blair and Murphy, “Defining Information Governance.”

25. International Organization for Standardization, ISO/IEC 38500:2008, Corporate governance of information technology. www.iso.org/iso/catalogue_detail?csnumber=51639 (accessed November 25, 2013).

CHAPTER 8

Information Governance and Legal

Functions By Robert Smallwood with Randy Kahn, Esq., and Barry Murphy

Perhaps the key functional area that information governance (IG) impacts most is legal functions, since legal requirements are paramount. Failure to meet them

can literally put an organization out of business or land executives in prison.

Privacy, security, records management, information technology (IT), and business

management functions are important—very important—but the most significant

aspect of all of these functions relates to legality and regulatory compliance.

http://abcnews.go.com/Travel/mac-users-higher-hotel-prices-orbitz/story?id=16650014#.UDlkVBqe7oV

http://usatoday30.usatoday.com/news/health/weightloss/2010-03-23-calories-menus_N.htm

http://www.reuters.com/article/2012/04/30/us-obesity-idUSBRE83T0C820120430

http://www.nytimes.com/2010/03/24/business/24menu.html

http://www.newyorker.com/talk/financial/2012/08/13/120813ta_talk_surowiecki

http://www.iso.org/iso/catalogue_detail?csnumber=51639

Key legal processes include electronic discovery (e-discovery) readiness and

associated business processes, information and record retention policies, the legal

hold notification (LHN) process, and legally defensible disposition practices.

Some newer technologies have become viable to assist organizations in

implementing their IG efforts, namely, predictive coding and technology-assisted

review (TAR; also known as computer-assisted review). In this chapter we

explore the need for leveraging IT in IG efforts aimed at defensible disposition, the

intersection between IG processes and legal functions, policy implications, and

some key enabling technologies.

Introduction to e-Discovery: The Revised 2006 Federal Rules of

Civil Procedure Changed Everything

Since 1938, the Federal Rules of Civil Procedure (FRCP) “have governed the

discovery of evidence in lawsuits and other civil cases.”1 In law, discovery is an

early phase of civil litigation where plaintiffs and defendants investigate and

exchange evidence and testimony to better understand the facts of a case and to

make early determinations of the strength of arguments on either side. Each side

must produce evidence requested by the opposition or show the court why it is

unreasonable to produce the information.

The FRCP apply to U.S. district courts, which are the trial courts of the federal

court system. The district courts have jurisdiction (within limits set by Congress

and the Constitution) to hear nearly all categories of federal cases, including civil

and criminal matters.2

Legal functions are the most important area of IG impact.

The FRCP were amended in 2006, and some of the revisions apply specifically to

the preservation and discovery of electronic records in the litigation

process.3 These changes were a long time coming, reflecting the lag between the

state of technology and the courts' ability to catch up to the realities of

electronically generated and stored information.

After years of applying traditional paper-based discovery rules to e-discovery,

amendments to the FRCP were made to accommodate the modern practice of

discovery of electronically stored information (ESI). ESI is any information that

is created or stored in electronic format. The goal of the 2006 FRCP amendments

was to recognize the importance of ESI and to respond to the increasingly

prohibitive costs of document review and protection of privileged documents.

These amendments reinforced the importance of IG policies, processes, and

controls in the handling of ESI.4 Organizations must produce requested ESI

reasonably quickly, and failure to do so, or failure to do so within the prescribed

https://learning.oreilly.com/library/view/information-governance-concepts/9781118218303/18_chap08.html#chap08fn01

https://learning.oreilly.com/library/view/information-governance-concepts/9781118218303/18_chap08.html#chap08fn02

https://learning.oreilly.com/library/view/information-governance-concepts/9781118218303/18_chap08.html#chap08fn03

https://learning.oreilly.com/library/view/information-governance-concepts/9781118218303/18_chap08.html#chap08fn04

time frame, can result in sanctions. This requirement dictates that organizations put

in place IG policies and procedures to be able to produce ESI accurately and in a

timely fashion.5

All types of litigation are covered under the FRCP, and all types of e-documents—

most especially e-mail—are included, which can be created, accessed, or stored in

a wide variety of methods, and on a wide variety of devices beyond hard drives.

The FRCP apply to ESI held on all types of storage and communications devices:

thumb drives, CDs/DVDs, smartphones, tablets, personal digital assistants (PDAs),

personal computers, servers, zip drives, floppy disks, backup tapes, and other

storage media. ESI content can include information from e-mail, reports, blogs,

social media posts (e.g., Twitter posts), voicemails, wikis, websites (internal and

external), word processing documents, and spreadsheets, and includes

the metadata associated with the content itself, which provides descriptive

information.6

Under the FRCP amendments, corporations must proactively manage the e-

discovery process to avoid sanctions, unfavorable rulings, and a loss of public

trust. Corporations must be prepared for early discussions on e-discovery with all

departments. Topics should include the form of production of ESI and the methods

for preservation of information. Records management and IT departments must

have made available all relevant ESI for attorney review.7

This new era of ESI preservation and production demands the need for cross-

functional collaboration: records management, IT, and legal teams particularly

need to work closely together. Legal teams, with assistance and input of records

management staff, must identify relevant ESI, and IT teams must be mindful of

preserving and protecting the ESI to maintain its legal integrity and prove its

authenticity.

ESI is any information that is created or stored in electronic format.

The goal of the FRCP amendments is to recognize the importance of ESI and to

respond to the increasingly prohibitive costs of document review and protection of

privileged documents.

Big Data Impact

Now throw in the Big Data effect: The average employee creates roughly one

gigabyte of data annually (and growing), and data volumes are expected to increase

over the next decade not 10-fold, or even 20-fold, but as much as 40 to 50 times

what it is today!8 This underscores the fact that organizations must meet legal

requirements while paring down the mountain of data debris they are holding to

reduce costs and potential liabilities hidden in that monstrous amount of

https://learning.oreilly.com/library/view/information-governance-concepts/9781118218303/18_chap08.html#chap08fn05

https://learning.oreilly.com/library/view/information-governance-concepts/9781118218303/18_chap08.html#chap08fn06

https://learning.oreilly.com/library/view/information-governance-concepts/9781118218303/18_chap08.html#chap08fn07

https://learning.oreilly.com/library/view/information-governance-concepts/9781118218303/18_chap08.html#chap08fn08

information. There are also costs associated with dark data—unknown or useless

data, such as old log files, that takes up space and continues to grow and needs to

be cleaned up.

Some data is important and relevant, but distinctions must be made by IG policy to

classify, prioritize, and schedule data for disposition and to dispose of the majority

of it in a systematic, legally defensible way. If organizations do not accomplish

these critical IG tasks they will be overburdened with storage and data handling

costs and will be unable to meet legal obligations.

According to a recent survey, approximately 25 percent of information stored in

organizations has real business value, while 5 percent must be kept as business

records and about 1 percent is retained due to a litigation hold.9“This means that

[about] 69 percent of information in most companies has no business, legal, or

regulatory value. Companies that are able to [identify and] dispose of this debris

return more profit to shareholders, can use more of their IT budgets for strategic

investments, and can avoid excess expense in legal and regulatory response”

(emphasis added).

If organizations are not able to draw clear distinctions between that roughly 30

percent of “high-value” business data, records, and that which is on legal hold,

their IT department are tasked with the impossible job of managing all data as if it

is high value. This “overmanaging” of information is a significant waste of IT

resources.10

More Details on the Revised FRCP Rules

Here we present a synopsis of the key points in FRCP rules that apply to e-

discovery.

FRCP 1—Scope and Purpose. This rule is simple and clear; its aim is to “secure

the just, speedy, and inexpensive determination of every action.”11 Your discovery

effort and responses must be executed in a timely manner.

The amended FRCP reinforce the importance of IG. Only about 25 percent of

business information has real value, and 5 percent are business records.

FRCP 16—Pretrial Conferences; Scheduling; Management. This rule provides

guidelines for preparing for and managing the e-discovery process; the court

expects IT and network literacy on both sides, so that pretrial conferences

regarding discoverable evidence are productive.

FRCP 26—Duty to Disclose; General Provisions Governing Discovery. This rule

protects litigants from costly and burdensome discovery requests, given certain

guidelines.

https://learning.oreilly.com/library/view/information-governance-concepts/9781118218303/18_chap08.html#chap08fn09

https://learning.oreilly.com/library/view/information-governance-concepts/9781118218303/18_chap08.html#chap08fn10

https://learning.oreilly.com/library/view/information-governance-concepts/9781118218303/18_chap08.html#chap08fn11

FRCP 26(a)(1)(C): Requires that you make initial disclosures no later than 14 days

after the Rule 26(f) meet and confer, unless an objection or another time is set by

stipulation or court order. If you have an objection, now is the time to voice it.

Rule 26(b)(2)(B): Introduced the concept of not reasonably accessible ESI. The

concept of not reasonably accessible paper had not existed. This rule provides

procedures for shifting the cost of accessing not reasonably accessible ESI to the

requesting party.

FRCP 26(b)(5)(B): Gives courts a clear procedure for settling claims when you

hand over ESI to the requesting party that you shouldn't have.

Rule 26(f): This is the meet and confer rule. This rule requires all parties to meet

within 99 days of the lawsuit's filing and at least 21 days before a scheduled

conference.

Rule 26(g): Requires an attorney to sign every e-discovery request, response, or

objection.

FRCP 33—Interrogatories to Parties. This rule provides a definition of business e-

records that are discoverable and the right of opposing parties to request and access

them.

FRCP 34—Producing Documents, Electronically Stored Information, and

Tangible Things, or Entering onto Land, for Inspection and Other Purposes. In

disputes over document production, this rule outlines ways to resolve and move

forward. Specifically, FRCP 34(b) addresses the format for requests and requires

that e-records be accessible without undue difficulty (i.e., the records must be

organized and identified). The requesting party chooses the preferred format,

which are usually native files (which also should contain metadata). The key point

is that electronic files must be accessible, readable, and in a standard format.

FRCP 37—Sanctions. Rule 37(e) is known as the safe harbor rule. In principle, it

keeps the court from imposing sanctions when ESI is damaged or lost through

routine, “good faith” operations, although this has proven to be a high standard to

meet. This rule underscores the need for a legally defensible document

management program under the umbrella of clear IG policies.

The Big Data trend underscores the need for defensible deletion of data debris.

Landmark E-Discovery Case: Zubulake v. UBS Warburg

A landmark case in e-discovery arose from the opinions rendered in Zubulake v.

U.B.S. Warburg, an employment discrimination case where the plaintiff, Laura

Zubulake, sought access to e-mail messages involving or naming her. Although

UBS produced over 100 pages of evidence, it was shown that employees

intentionally deleted some relevant e-mail messages.12 The plaintiffs requested

https://learning.oreilly.com/library/view/information-governance-concepts/9781118218303/18_chap08.html#chap08fn12

copies of e-mail from backup tapes, and the defendants refused to provide them,

claiming it would be too expensive and burdensome to do so.

The judge ruled that U.B.S. had not taken proper care in preserving the e-mail

evidence, and the judge ordered an adverse inference (assumption that the

evidence was damaging) instruction against U.B.S. Ultimately, the jury awarded

Zubulake over $29 million in total compensatory and punitive damages. “The court

looked at the proportionality test of Rule 26(b)(2) of the Federal Rules of Civil

Procedure and applied it to the electronic communication at issue. Any electronic

data that is as accessible as other documentation should have traditional discovery

rules applied.”13 Although Zubulake's award was later overturned on appeal, it is

clear the stakes are huge in e-discovery and preservation of ESI.

E-Discovery Techniques

Current e-discovery techniques include online review, e-mail message archive

review, and cyberforensics. Any and all other methods of seeking or searching for

ESI may be employed in e-discovery. Expect capabilities for searching, retrieving,

and translating ESI to improve, expanding the types of ESI that are discoverable.

Consider this potential when evaluating and developing ESI management practices

and policies.14

E-Discovery Reference Model

The E-Discovery Reference Model is a visual planning tool created by EDRM.net

to assist in identifying and clarifying the stages of the e-discovery process. Figure

8.1 is the graphic depiction with accompanying detail on the process steps.

Information Management. Getting your electronic house in order to mitigate risk

and expenses should e-discovery become an issue, from initial creation of

electronically stored information through its final disposition

Identification. Locating potential sources of ESI and determining their scope,

breadth, and depth

In the landmark case Zubulake v. U.B.S. Warburg, the defendants were severely

punished by an adverse inference for deleting key e-mails and not producing

copies on backup tapes.

SEVEN STEPS OF THE E-DISCOVERY PROCESS

In the e-discovery process, you must perform certain functions for identifying and

preserving electronically stored (ESI), and meet requirements regarding conditions

such as relevancy and privilege. Typically, you follow this e-discovery process:

https://learning.oreilly.com/library/view/information-governance-concepts/9781118218303/18_chap08.html#chap08fn13

https://learning.oreilly.com/library/view/information-governance-concepts/9781118218303/18_chap08.html#chap08fn14

https://learning.oreilly.com/library/view/information-governance-concepts/9781118218303/18_chap08.html#fig8.1

1. Create and retain ESI according to an enforceable electronic records retention policy and electronic records management (ERM) program.

Enforce the policy, and monitor compliance with it and the ERM program.

2. I dentify the relevant ESI, preserve any so it cannot be altered or destroyed, and collect all ESI for further review.

3. Process and filter the ESI to remove the excess and duplicates. You reduce costs by reducing the volume of ESI that moves to the next stage in the e-

discovery process.

4. Review and analyze the filtered ESI for privilege because privileged ESI is not discoverable, unless some exception kicks in.

5. Produce the remaining ESI, after filtering out what's irrelevant, duplicated, or privileged. Producing ESI in native format is common.

6. Clawback the ESI that you disclosed to the opposing party that you should have filtered out, but did not. Clawback is not unusual, but you have to work

at getting clawback approved, and the court may deny it.

7. Present at trial if your case hasn't settled. Judges have little to no patience with lawyers who appear before them not understanding e-discovery and the

ESI of their clients or the opposing side.

Source: Linda Volonino and Ian Redpath, e-Discovery for Dummies (Hoboken,

NJ: John Wiley & Sons, 2010), http://www.dummies.com/how-

to/content/ediscovery-for-dummies-cheat-sheet.html (accessed May 22, 2013).

Used with permission.

Preservation. Ensuring that ESI is protected against inappropriate alteration or

destruction

Collection. Gathering ESI for further use in the e-discovery process (processing,

review, etc.)

Processing. Reducing the volume of ESI and converting it, if necessary, to forms

more suitable for review and analysis

Review. Evaluating ESI for relevance and privilege

Analysis. Evaluating ESI for content and context, including key patterns, topics,

people, and discussion

Production. Delivering ESI to others in appropriate forms, and using appropriate

delivery mechanisms

http://www.dummies.com/how-to/content/ediscovery-for-dummies-cheat-sheet.html

Figure 8.1 Electronic Discovery Reference Model

Source: EDRM (edrm.net)

Presentation. Displaying ESI before audiences (at depositions, hearings, trials,

etc.), especially in native and near-native forms, to elicit further information,

validate existing facts or positions, or persuade an audience15

The Electronic Discovery Reference Model can assist organizations in focusing

and segmenting their efforts when planning e-discovery initiatives.

Guidelines for E-Discovery Planning

1. Implement an IG program. The highest impact area to focus are your legal processes, particularly e-discovery. From risk assessment to processes, communications, training, controls, and auditing, fully implement IG to improve and measure compliance capabilities.

2. Inventory your ESI. File scanning and e-mail archiving software can assist you. You also will want to observe files and data flows by doing a walk-through beginning with centralized servers in the computer room and moving out into business areas. Then, using a prepared inventory form, you should interview users to find out more detail. Be sure to inventory ESI based on computer systems or applications, and diagram it out.

3. Create and implement a comprehensive records retention policy, and also include an e-mail retention policy and retention schedules for major ESI areas. This is required since all things are potentially discoverable. You must devise a comprehensive retention and disposition policy that is legally defensible. So, for instance, if your

https://learning.oreilly.com/library/view/information-governance-concepts/9781118218303/18_chap08.html#chap08fn15

policy is to destroy all e-mail messages that do not have a legal hold (or are expected to) after 90 days and you apply that policy uniformly, you will be able to defend the practice in court. Also, implementing the retention policy reduces your storage burden and costs while cutting the risk of liability that might be buried in obscure e-mail messages. The E-Discovery Reference Model is in a planning tool that presents key e-

discovery process steps.

4. As an extension of your retention policy, implement a legal hold policy that is enforceable, auditable, and legally defensible. Be sure to include all potentially discoverable ESI XE “litigation: e- discovery”. We discuss legal holds in more depth later in this chapter, but be sure to cast a wide net when developing retention policies so that you include all relevant electronic records, such as e-mail, e- documents and scanned documents, storage discs, and backup tapes.

5. Leverage technology. Bolster your e-discovery planning and execution efforts by deploying enabling technologies, such as e-mail archiving, advanced enterprise search, TAR, and predictive coding.

6. Develop and execute your e-discovery plan. You may want to begin from this point forward with new cases, and bear in mind that starting small and piloting is usually the best course of action.

The Intersection of IG and E-Discovery

By Barry Murphy

Effective IG programs can alleviate e-discovery headaches by reducing the amount

of information to process and review, allowing legal teams to get to the facts of a

case quickly and efficiently, and can even result in better case outcomes. Table

8.1 shows the impact of IG on e-discovery, by function.

LEGAL HOLD PROCESS

The legal hold process is a foundational element of IG.16 The way the legal hold

process is supposed to work is that a formal system of polices, processes, and

controls is put in place to notify key employees of a civil lawsuit (or impending

one) and the set of documents that must put on legal hold. These documents, e-

mail messages, and other relevant ESI must be preserved in place and no longer

edited or altered so that they may be reviewed by attorneys during the discovery

phase of the litigation. But, in practice, this is not always what takes place. In

fact, the opposite can take place—employees can quickly edit or even delete

https://learning.oreilly.com/library/view/information-governance-concepts/9781118218303/18_chap08.html#tab8.1

https://learning.oreilly.com/library/view/information-governance-concepts/9781118218303/18_chap08.html#chap08fn16

relevant e-documents that may raise questions or even implicate them. This is

possible only if proper IG controls are not in place, monitored, enforced, and

audited.

Implementing IG, inventorying ESI, and leveraging technology to implement

records retention and LHN policies are key steps in e-discovery planning.

Table 8.1 IG Impact on E-Discovery

Impact Function

Cost reduction Reduce downstream costs of processing and review by defensibly disposing of data according to corporate retention policies

Reduce cost of collection by centralizing collection interface to save time

Keep review costs down by prioritizing documents and assigning to the right level associates (better resource utilization)

Reduce cost of review by culling information with advanced analytics

Risk management Reduce risk of sanctions by managing the process of LHN and the collection and preservation of potentially responsive information

Better litigation win rates

Optimize decision making (e.g., settling cases that can't be won) quickly with advanced analytics that prioritize hot documents

Quickly find the necessary information to win cases with advanced searches and prioritized review

Strategic planning for matters based on merit

Determine the merits of a matter quickly and decide if it is a winnable case

Quickly route prioritized documents to the right reviewers via advanced analytics (e.g., clustering)

Strategic planning for matters based on cost

Quickly determine how much litigation will cost via early access to amount of potentially responsive information and prioritized review to make decisions based on the economics of the matter (e.g., settle for less than the cost of litigation)

Litigation budget optimization

Minimize litigation budget by only pursuing winnable cases

Minimize litigation budget by utilizing the lowest cost resources possible while putting high-cost resource on only the necessary documents

Source: Barry Murphy, eDiscovery Journal http://ediscoveryjournal.com/

Many organizations start with Legal Hold Notification (LHN) management as a

very discrete IG project. LHN management is arguably the absolute minimum an

organization should be doing in order to meet the guidelines provided by court

rules, common law, and case law precedent. It is worth noting, though, that the

expectation is that organizations should connect the notification process to the

actual collection and preservation of information in the long term.

LHN management is the absolute minimum an organization should implement to

meet the guidelines, rules, and precedents.

HOW TO KICK-START LEGAL HOLD NOTIFICATION

Implementing an LHN program attacks some of the lower-hanging fruit within an

organization's overall IG position. This part of the e-discovery life cycle must not

be outsourced. Retained counsel provides input, but the mechanics of LHN are

managed and owned by internal corporate resources.

In preparing for a LHN implementation project, it is important to first lose the

perception that LHN tools are expensive and difficult to deploy. It is true that some

of these tools cost considerably more than others and can be complex to deploy;

however, that is because the tools in question go far beyond simple LHN and reach

into enterprise systems and also handle data mapping, collection, and workflow

processes. Other options include Web-based hosted solutions, custom-developed

solutions, or processes using tools already in the toolbox (e.g., e-mail,

spreadsheets, word processing).

The most effective approach involves three basic steps:

1. Define requirements. 2. Define the ideal process. 3. Select the technology.

Defining both LHN requirements and processes should include input from key

stakeholders—at a minimum—in legal, records management, and IT. Be sure to

take into consideration the organization's litigation profile, corporate culture, and

available resources as part of the requirements and process defining exercise.

Managing steps 1 and 2 thoroughly makes tool selection easier because defining

requirements and processes creates the confidence of knowing exactly what the

tool must accomplish.

IG AND E-DISCOVERY READINESS

Having a solid IG underpinning means that your organization will be better

prepared to respond and execute key tasks when litigation and the e-discovery

http://ediscoveryjournal.com/

process proceed. Your policies will have supporting business processes, and clear

lines of responsibility and accountability are drawn. The policies must be reviewed

and fine-tuned periodically, and business processes must be streamlined and

continue to aim for improvement over time.

In order for legal hold or defensible deletion (discussed in detail in the next

section—disposing of unneeded data, e-documents, and reports based on set

policy) projects to deliver the promised benefit to e-discovery, it is important to

avoid the very real roadblocks that exist in most organization. To get the light to

turn green at the intersection of e-discovery and IG, it is critical to:

• Establish a culture that both values information and recognizes the risks inherent in it. Every organization must evolve its culture from one of keeping everything to one of information compliance. This kind of change requires high-level executive support. It also requires constant training of employees about how to create, classify, and store information. While this advice may seem trite, many managers in leading organizations say that without this kind of culture change, IG projects tend to be dead on arrival.

• Create a truly cross-functional IG team. Culture change is not easy, but it can be even harder if the organization does not bring all stakeholders together when setting requirements for IG. Stakeholders include: legal; security and ethics; IT; records management; internal audit; corporate governance; human resources; compliance; and business units and employees. That is a lot of stakeholders. In organizations that are successfully launching and executing IG projects, many have dedicated IG teams. Some of those IG teams are the next generation of records management departments, while others are newly formed. The stakeholders can be categorized into three areas: legal/risk, IT, and the business. The IG team can bring those areas together to ensure that any projects meet requirements of all stakeholders.

• Use e-discovery as an IG proof of concept. Targeted programs like e- discovery, compliance, and archiving have a history of return on investment (ROI) and an ability to get budget. These projects are also challenging, but more straightforward to implement and can address sub-sets of information in early phases (e.g., only those information assets that are reasonable to account for). The lessons learned from these targeted projects can then be applied to other IG initiatives.

• Measure ROI on more than just cost savings. Yes, one of the primary benefits of addressing e-discovery via IG is cost reduction, but it is

wise to begin measuring all e-discovery initiatives on how they impact the life cycle of legal matters. The efficiencies gained in collecting information, for example, have benefits that go way beyond reduced cost; the IT time not wasted on reactive collection is more time available for innovative projects that drive revenue for companies. And a better litigation win rate will make any legal team happier.

Building on Legal Hold Programs to Launch Defensible

Disposition

By Barry Murphy

Defensible deletion programs can build on legal hold programs, because legal hold

management is a necessary first step before defensibly deleting anything. The

standard is “reasonable effort” rather than “perfection.” Third-party consultants or

auditors can support the diligence and reasonableness of these efforts.

Next, prioritize what information to delete and what information the organization

is capably able to delete in a defensible manner. Very few organizations are

deleting information across all systems. It can be overly daunting to try to apply

deletion to all enterprise information. Choosing the most important information

sources—e-mail, for example—and attacking those first may make for a

reasonable and tenable approach. For most organizations, e-mail is the most

common information source to begin deleting. Why e-mail? It is fairly easy for

companies to put systematic rules on e-mail because the technology is already

available to manage e-mail in a sophisticated manner. Because e-mail is such a

critical data system, e-mail providers and e-mail archiving providers early on

provided for systematic deletion or application of retention rules. However,

in non–e-mail systems, the retention and deletion features are less sophisticated;

therefore, organizations do not systematically delete across all systems.

IG serves as the underpinning for efficient e-discovery processes.

For most organizations, e-mail is the most common information source to begin

deleting according to established retention policies.

Once e-mail is under control, the organization can begin to apply lessons learned to

other information sources and eventually have better IG policies and processes that

treat information consistently based on content rather than on the repository.

Destructive Retention of E-mail

A destructive retention program is an approach to e-mail archiving where e-mail

messages are retained for a limited time (say, 90 days), followed by the permanent

manual or automatic deletion of the messages from the organization network, so

long as there is no litigation hold or the e-mail has not been declared a record.

E-mail retention periods can vary from 90 days to as long as seven years:

• Osterman Research reports that “nearly one-quarter of companies delete email after 90 days.”17

• Heavily regulated industries, including energy, technology, communications, and real estate, favor archiving for one year or more, according to Fulbright and Jaworski research.

• The most common e-mail retention period traditionally has been seven years; however, some organizations are taking a hard-line approach and stating that e-mails will be kept for only 90 days or six months, unless it is declared as a record, classified, and identified with a classification/retention category and tagged or moved to a repository where the integrity of the record is protected (i.e., the record cannot be altered and an audit trail on the history of the record's usage is maintained).

Newer Technologies That Can Assist in E-Discovery

Few newer technologies are viable for speeding the document review process and

improving the ability to be responsive to court-mandated requests. Here we

introduce predictive coding and technology-assisted review (also known as

computer-assisted review), the most significant of new technology developments

that can assist in e-discovery.

Destructive retention of e-mail is a method whereby e-mail messages are retained

for a limited period and then destroyed.

PREDICTIVE CODING

During the early case assessment (ECA) phase of e-discovery, predictive

coding is a “court-endorsed process”18 utilized to perform document review. It uses

human expertise and IT to facilitate analysis and sorting of documents. Predictive

coding software leverages human analysis when experts review a subset of

documents to “teach” the software what to look for, so it can apply this logic to the

full set of documents,19 making the sorting and culling process faster and more

accurate than solely using human review or automated review.

Predictive coding uses a blend of several technologies that work in

concert:20 software that performs machine learning (a type of artificial

https://learning.oreilly.com/library/view/information-governance-concepts/9781118218303/18_chap08.html#chap08fn17

https://learning.oreilly.com/library/view/information-governance-concepts/9781118218303/18_chap08.html#chap08fn18

https://learning.oreilly.com/library/view/information-governance-concepts/9781118218303/18_chap08.html#chap08fn19

https://learning.oreilly.com/library/view/information-governance-concepts/9781118218303/18_chap08.html#chap08fn20

intelligence software that “learns” and improves its accuracy, fostered by guidance

from human input and progressive ingestion of data sets—in this case

documents);21 workflow software, which routes the documents through a series of

work steps to be processed; and text analytics software, used to perform functions

such as searching for keywords (e.g., “asbestos” in a case involving asbestos

exposure). Then using keyword search capabilities, or concepts using pattern

search or meaning-based search, and sifting through and sorting documents into

basic groups using filtering technologies, based on document content,

and samplinga portion of documents to find patterns and to review the accuracy of

filtering and keyword search functions.

The goal of using predictive coding technology is to reduce the total group of

documents a legal team needs to review manually (viewing and analyzing them

one by one) by finding that gross set of documents that is most likely to be relevant

or responsive (in legalese) to the case at hand. It does this by automating, speeding

up, and improving the accuracy of the document review process to locate and

“digitally categorize” documents that are responsive to a discovery

request.22 Predictive coding, when deployed properly, also reduces billable attorney

and paralegal time and therefore the costs of ECA. Faster and more accurate

completion of ECA can provide valuable time for legal teams to develop insights

and strategies, improving their odds for success. Skeptics claim that the technology

is not yet mature enough to render more accurate results than human review.

The first state court ruling allowing the use of predictive coding technology instead

of human review to cull through approximately 2 million documents to “execute a

first-pass review” was made in April 2012 by a Virginia state judge.23 This was the

first time a judge was asked to grant permission without the two opposing sides

first coming to an agreement. The case, Global Aerospace, Inc., et al. v. Landow

Aviation, LP, et al., stemmed from an accident at Dulles Jet Center.

In an exhaustive 156-page memorandum, which included dozens of pages of legal

analysis, the defendants made their case for the reliability, cost-effectiveness, and

legal merits of predictive coding. At the core of the memo was the argument that

predictive coding “is capable of locating upwards of seventy-five percent of the

potentially relevant documents and can be effectively implemented at a fraction of

the cost and in a fraction of the time of linear review and keyword searching.”24

Predictive coding software leverages human analysis when experts review a subset

of documents to “teach” the software what to look for, so it can apply this logic to

the full set of documents.

This was the first big legal win for predictive coding use in e-discovery.

Basic Components of Predictive Coding

https://learning.oreilly.com/library/view/information-governance-concepts/9781118218303/18_chap08.html#chap08fn21

https://learning.oreilly.com/library/view/information-governance-concepts/9781118218303/18_chap08.html#chap08fn22

https://learning.oreilly.com/library/view/information-governance-concepts/9781118218303/18_chap08.html#chap08fn23

https://learning.oreilly.com/library/view/information-governance-concepts/9781118218303/18_chap08.html#chap08fn24

Here is a summary of the main foundational components of predictive coding.

• Human review. Human review is used to determine which types of document content will be legally responsive based on a case expert's review of a sampling of documents. These sample documents are fed into the system to provide a seed set of examples.25

• Text analytics. This involves the ability to apply “keyword-agnostic” (through a thesaurus capability based on contextual meaning, not just keywords) to locate responsive documents and build create seed document sets.

• Workflow. Software to route e-documents through the processing steps automatically to improve statistical reliability and streamlined processing.

• Machine learning. The software “learns” what it is looking for and improves its capabilities along the way through multiple, iterative passes.

• Sampling. Sampling is best applied if it is integrated so that testing for accuracy is an ongoing process. This improves statistical reliability and therefore defensibility of the process in court.

Predictive Coding Is the Engine; Humans Are the Fuel

Predictive coding sounds wonderful, but it does not replace the expertise of an

attorney; it merely helps leverage that knowledge and speed the review process. It

“takes all the documents related to an issue, ranks and tags them so that a human

reviewer can look over the documents to confirm relevance.” So it cannot work

without human input to let the software know what documents to keep and which

ones to discard, but it is an emerging technology tool that will play an increasingly

important role in e-discovery.26

TECHNOLOGY-ASSISTED REVIEW

TAR, also known as computer-assisted review, is not predictive coding. TAR

includes aspects of the nonlinear review process, such as culling, clustering and de-

duplication, but it does not meet the requirements for comprehensive predictive

coding.

Many technologies can help in making incremental reductions in e-discovery

costs. Only fully integrated predictive coding, however, can completely transform

the economics of e-discovery.

Mechanisms of Technology-Assisted Review

https://learning.oreilly.com/library/view/information-governance-concepts/9781118218303/18_chap08.html#chap08fn25

https://learning.oreilly.com/library/view/information-governance-concepts/9781118218303/18_chap08.html#chap08fn26

There are three main mechanisms, or methods, for using technology to make legal

review faster, less costly, and generally smarter.27

1. Rules driven. “I know what I am looking for and how to profile it.” In this scenario, a case team creates a set of criteria, or rules, for document review and builds what is essentially a coding manual. The rules are fed into the tool for execution on the document set. For example, one rule might be to “redact for privilege any time XYZ term appears and add the term ‘redacted’ where the data was removed.” This rule-driven approach requires iteration to truly be effective. The case team will likely have rules changes and improvements as the case goes on and more is learned about strategy and merit. This approach assumes that the case team knows the document set well and can apply very specific rules to the corpus in a reasonable fashion.

2. Facet driven. “I let the system show me the profile groups first.” In this scenario, a tool analyzes documents for potential items of interest or groups potentially similar items together so that reviewers can begin applying decisions. Reviewers typically utilize visual analytics that guide them through the process and take them to prioritized documents. This mechanism can also be called present and direct.

3. Propagation based. “I start making decisions and the system looks for similar-related items.” This type of TAR is about passing along, or propagating, what is known based on a sample set of documents to the rest of the documents in a corpus. In the market, this is often referred to as predictive coding because the system predicts whether documents will be responsive or privileged based on how other documents were coded by the review team. Propagation-based TAR comes in different flavors, but all involve an element of machine learning. In some scenarios, a review team will have access to a seed set of documents that the team codes and then feeds into the system. The system then mimics the action of the review team as it codes the remainder of the corpus. In other scenarios, there is not a seed set; rather, the systems give reviewers random documents for coding and then create a model for relevance and nonrelevance. It is important to note that propagation-based TAR goes beyond simple mimicry; it is about creating a linguistic mathematical model for what relevance looks like.

These TAR mechanisms are not mutually exclusive. In fact, combining the

mechanisms can help overcome the limitations of individual approaches. For

example, if a document corpus is not rich (e.g., does not have a high enough

percentage of relevant documents), it can be hard to create a seed set that will be a

https://learning.oreilly.com/library/view/information-governance-concepts/9781118218303/18_chap08.html#chap08fn27

good training set for the propagation-based system. However, it is possible to use

facet-based TAR—for example, concept searching—to more quickly find the

documents that are relevant so as to create a model for relevance that the

propagation-based system can leverage.28

It is important to be aware that these approaches require more than just technology.

It is critical to have the right people in place to support the technology and the

workflow required to conduct TAR. Organizations looking to exercise these

mechanisms of TAR will need:

• Experts in the right tools and information retrieval. Software is an important part of TAR. The team executing TAR will need someone that can program the tool set with the rules necessary for the system to intelligently mark documents. Furthermore, information retrieval is a science unto itself, blending linguistics, statistics, and computer science. Anyone practicing TAR will need the right team of experts to ensure a defensible and measurable process.

• Legal review team. While much of the chatter around TAR centers on its ability to cut lawyers out of the review process, the reality is that the legal review team will become more important than ever. The quality and consistency of the decisions this team makes will determine the effectiveness that any tool can have in applying those decisions to a document set.

• Auditor. Much of the defensibility and acceptability of TAR mechanisms will rely on the statistics behind how certain the organization can be that the output of the TAR system matches the input specification. Accurate measures of performance are important not only at the end of the TAR process, but also throughout the process in order to understand where efforts need to be focused in the next cycle or iteration. Anyone involved in setting or performing measurements should be trained in statistics.

For an organization to use a propagated approach, in addition to people it may need

a “seed” set of known documents. Some systems use random samples to create

seed sets while others enable users to supply small sets from the early case

investigations. These documents are reviewed by the legal review team and

marked as relevant, privileged, and the like. Then, the solution can learn from the

seed set and apply what it learns to a larger collection of documents. Often this

seed set is not available, or the seed set does not have enough positive data to be

statistically useful.

https://learning.oreilly.com/library/view/information-governance-concepts/9781118218303/18_chap08.html#chap08fn28

Professionals using TAR state that the practice has value, but it requires a

sophisticated team of users (with expertise in information retrieval, statistics, and

law) who understand the potential limitations and danger of false confidence that

can arise from improper use. For example, using a propagation-based approach

with a seed set of documents can have issues when less than 10 percent of the seed

set documents are positive for relevance. In contrast, rules driven and other

systems can result in false negative decisions when based on narrow custodian

example sets.

However TAR approaches and tools are used, they will only be effective if usage is

anchored in a thought out, methodically sound process. This requires a definition

of what to look for, searching for items that meet that definition, measuring results,

and then refining those results on the basis of the measured results. Such an end-to-

end plan will help to decide what methods and tools should be used in a given

case.29

Defensible Disposal: The Only Real Way To Manage Terabytes

and Petabytes

By Randy Kahn, Esq.

Records and information management (RIM) is not working. At least, it is not

working well. Information growth and management complexity has meant that the

old records retention rules and the ways businesses apply them are no longer able

to address the lifecycle of information. So the mountains of information grow and

grow and grow, often unfettered.

Too much data has outlived its usefulness, and no one seems to know how or is

willing to get rid of it. While most organizations need to right-size their

information footprint by cleaning out the digital data debris, they are stymied by

the complexity and enormity of the challenge.

GROWTH OF INFORMATION

According to International Data Corporation (IDC), from now until 2020, the

digital universe is expected by expand to more than 14 times its current size.30 One

exabyte is the data equivalent of about 50,000 years of DVD movies running

continuously. With about 1,800 exabytes of new data created in 2011, 2840

exabytes in 2012, and a predicted 6,120 exabytes in 2014, the volumes are truly

staggering. While the data footprint grows significantly each year, that says

nothing of what has already been created and stored.

Contrary to what many say (especially hardware salespeople) storage is not cheap.

In fact, it is really becomes quite expensive when you add up not only the

https://learning.oreilly.com/library/view/information-governance-concepts/9781118218303/18_chap08.html#chap08fn29

https://learning.oreilly.com/library/view/information-governance-concepts/9781118218303/18_chap08.html#chap08fn30

hardware costs but also maintenance, air conditioning and space overhead, and the

highly skilled labor needed to keep it running. Many large companies spend tens if

not hundreds of millions of dollars per year just to store data. This is money that

could go straight to the bottom line if the unneeded data could be discarded. When

you consider that most organizations' information footprints are growing at

between 20 and 50 percent per year and the cost of storage is declining by a few

percentage points per year, in real terms they are spending way more this year than

last to simply house information.

VOLUMES NOW IMPACT EFFECTIVENESS

The law of diminishing returns applies to information growth. Assuming

information is an asset, at some point when there is so much data, its value starts to

decline. That is not because the intrinsic value goes down (although many would

argue there is a lot of idle chatter in the various communications technologies).

Rather the decline is related to the inability to expeditiously find or have access to

needed business information. According the Council of Information Auto-

Classification “Information Explosion” Survey, there is now so much information

that nearly 50 percent of companies need to re-create business records to run their

business and protect their legal interests because they cannot find the original

retained record.31 It is a poor business practice to spend resources to retain

information and then, when it cannot be found, to spend more to reconstitute it.

There is increasing regulatory pressure, enforcement, and public scrutiny on all of

an organization's data storage activities. Record sanctions and fines, new

regulations, and stunning court decisions have converged to mandate heightened

controls and accountability from government regulators, industry and standards

groups as well as the public. When combined with the volume of data, information

privacy, security, protection of trade secrets, and records compliance become

complex and critical, high-risk business issues that only executive management can

truly fix. However, executives typical view records and information management

(RIM) as a low-importance cost center activity, which means that the real problem

does not get solved.

In most companies, there is no clear path to classify electronic records, to formally

manage official records, or to ensure the ultimate destruction of these records. Vast

stores of legacy data are unclassified, and most data is never touched again shortly

after creation. Further, traditional records retention rules are too voluminous, too

complex, and too granular and do not work well with the technology needed to

manage records.

Finally, it is clear that employees can no longer be expected to pull the oars to cut

through the information ocean, let alone boil it down into meaningful chunks of

https://learning.oreilly.com/library/view/information-governance-concepts/9781118218303/18_chap08.html#chap08fn31

good information. Increasingly, technology has to play a more central role in

managing information. Better use of technology will create business value by

reducing risk, driving improvements in productivity, and facilitating the

exploitation and protection of ungoverned corporate knowledge.

HOW DID THIS HAPPEN?

Over the past several years, organizations have come to realize that the exposure

posed by uncontrolled data growth requires emergency, reactive action, as

seemingly no other viable approach exists. Faced with massive amounts of

unknown unstructured data, many organizations have chosen to adopt a risk-averse

save-everything policy. This approach has brought with it immediate

repercussions:

• Inability to quickly locate needed business content buried in ill- managed file systems.

• Sharply increased storage costs, with some companies refusing to allocate any more storage to the business. The users' reaction, out of necessity, is to store data wherever they can find a place for it. (Do not buy the argument that storage is cheap—everyone is spending more on storing unnecessary data, even if the per-gigabyte media cost has gone down).

• Soaring litigation and discovery costs, as organizations have lost track of what is where, who owns it, and how to collect, sort, and process it.

• Buried intellectual property, trade secrets, personally identifiable information, and regulated content, which are subject to leakage and unauthorized deletion, and are a clear target for opposing counsel—or anyone who can access them.

• Lack of centralized policies and systems for the storage of records, which results in hard-to-manage record sites spread throughout the organization.

• The lack of a clear strategy for managing records that have long-term, rather than short-term, business, legal, and research value.

Information Glut in Organizations

• 71 percent of organizations surveyed have no idea of the content in their stored data.

• 58 percent of organizations are keeping information indefinitely. • 79 percent of organizations say too much time and effort is spent

manually searching and disposing information.

• 58 percent of organizations still rely on employees to decide how to apply corporate policies.32

WHAT IS DEFENSIBLE DISPOSITION, AND HOW WILL IT

HELP?

A solution to the unmitigated data sprawl is to defensibly dispose of the business

content that no longer has business or legal value to the organization. In the old

days of records management, it was clear that courts and regulators alike

understood that records came into being and eventually were destroyed in the

ordinary course of business. It is good business practice to destroy unneeded

content, provided that the rules on which those decisions are made consider legal

requirements and business needs. Today, however, the good business practice of

cleaning house of old records has somehow become taboo for some businesses.

Now it needs to start again.

An understanding of how technology can help defensibly dispose and how

methodology and process help an organization achieve a thinner information

footprint is critical for all companies overrun with outdated records that do not

know where to start to address the issue. While no single approach is right for

every organization, records and legal teams need to take an informed approach,

looking at corporate culture, risk tolerance, and litigation profile.

A defensible disposition framework is an ecosystem of technology, policies,

procedures, and management controls designed to ensure that records are created,

managed, and disposed at the end of their life cycle.

NEW TECHNOLOGIES—NEW INFORMATION

CUSTODIANS

Responsibility for records management and IG have changed dramatically over

time. In the past, the responsibility rested primarily with the records manager.

However, the nature of electronic information is such that its governance today

requires the participation of IT, which frequently has custody, control, or access to

such data, along with guidance from the legal department. As a result, IT personnel

with no real connection or ownership of the data may be responsible for the

accuracy and completeness of the business-critical information being managed. See

the problem?

For many organizations, advances in technology mixed with an explosive growth

of data forced a reevaluation of core records management processes. Many

organizations have deployed archiving, litigation, and e-discovery point solutions

with the intent of providing record retention compliance and responsiveness to

litigation. Such systems may be tactically useful but fail to strategically address the

https://learning.oreilly.com/library/view/information-governance-concepts/9781118218303/18_chap08.html#chap08fn32

heart of the matter: too much information, poorly managed over years and years—

if not decades.

A better approach is for organizations to move away from a reactive keep-

everything strategy to a proactive strategy that allows the reasonable and reliable

identification and deletion of records when retention requirements are reached,

absent a preservation obligation. Companies develop retention schedules and

processes precisely for this reason; it is not misguided to apply them.

WHY USERS CANNOT, WILL NOT—AND SHOULD NOT—

MAKE THE HARD CHOICES

Employees usually are not sufficiently trained on records management principles

and methods and have little incentive (or downside) to properly manage or dispose

of records. Further, many companies today see that requiring users to properly

declare or manage records places an undue burden on them. The employees not

only do not provide a reasonable solution to the huge data pile (which for some

companies may be petabytes of data) but contribute to its growth by using more

unsanctioned technologies and parking company information in unsanctioned

locations. So the digital landfill continues to grow.

A defensible disposition framework is an ecosystem of technology, policies,

procedures, and management controls designed to ensure that records are created,

managed, and disposed at the end of their life cycle.

Most organizations have programs that address paper records, but these same

organizations commonly fail to develop similar programs for electronic records

and other digital content.

TECHNOLOGY IS ESSENTIAL TO MANAGE DIGITAL

RECORDS PROPERLY

Having it all—but not being able to find it—is like not having it at all.

While the content of a paper document is obvious, viewing the content of an

electronic document depends on software and hardware. Further, the content of

electronic storage media cannot be easily accessed without some clue as to its

structure and format. Consequently, the proper indexing of digital content is

fundamental to its utility. Without an index, retrieving electronic content is

expensive and time consuming, if it can be retrieved at all.

Search tools have become more robust, but they do not provide a panacea for

finding electronic records when needed because there is too much information

spread out across way too many information parking lots. Without taxonomies and

common business terminology, accessing the one needed business record may be

akin to finding the needle in a stadium-size haystack.

Technological advances can help solve the challenges corporations face and

address the issues and burdens for legal, compliance, and information governance.

When faced with hundreds of terabytes to petabytes of information, no amount of

user intervention will begin to make sense of the information tsunami.

AUTO-CLASSIFICATION AND ANALYTICS

TECHNOLOGIES

Increasingly companies are turning to new analytics and classification technologies

that can analyze information faster, better, and cheaper. These technologies should

be considered essential for helping with defensible disposition, but do not make the

mistake of underestimating their expense or complexity.

As discussed in the previous section by Barry Murphy, machine learning

technologies mean that software can “learn” and improve at the tasks of clustering

files and assigning information (e.g., records, documents) to different preselected

topical categories based on a statistical analysis of the data characteristics. In

essence, classification technology evaluates a set of data with known classification

mappings and attempts to map newly encountered data within the existing

classifications. This type of technology should be on the list of considerations

when approaching defensible disposition in large, uncontrolled data environments.

CAN TECHNOLOGY CLASSIFY INFORMATION?

What is clear is that IT is better and faster than people in classifying information.

Period.

A better approach is for organizations to move away from a reactive keep-

everything strategy to a proactive strategy of defensible deletion.

Increasingly studies and court decisions make clear that, when appropriate,

companies should not fear using enabling technologies to help manage

information.

For example, in the recent Da Silva Moore v. Publicis Groupe case, Judge Andrew

Peck stated:

Computer-assisted review appears to be better than the available alternatives, and

thus should be used in appropriate cases. While this Court recognizes that

computer-assisted review is not perfect, the Federal Rules of Civil Procedure do

not require perfection…. Counsel no longer have to worry about being the “first”

or “guinea pig” for judicial acceptance of computer assisted review.

This work presents evidence supporting the contrary position: that a technology-

assisted process, in which only a small fraction of the document collection is ever

examined by humans, can yield higher recall and/or precision than an exhaustive

manual review process, in which the entire document collection is examined and

coded by humans.33

MOVING AHEAD BY CLEANING UP THE PAST

Organizations can improve disposition and IG programs with a systemized,

repeatable, and defensible approach that enables them to retain and dispose of all

data types in compliance with the business and statutory rules governing the

business's operations.

Generally, an organization is under no legal obligation to retain every piece of

information it generates in the course of its business. Its records management

process is there to clean up the information junk in a consistent, reasonable way.

That said, what should companies do if they have not been following disposal

rules, so information has piled up and continues unabated? They need to clean up

old data. But how?

Manual intervention (by employees) will likely not work, due to the sheer volumes

of data involved. Executives will not and should not have employees abdicate their

regular jobs in favor of classifying and disposing of hundreds of millions of old

stored files. (Many companies have billions of old files.) This buildup necessitates

leveraging technology, specifically, technologies that can discern the meaning of

stored unstructured content, in a variety of formats, regardless of where it is

stored.

Here is a starting point: Most likely, file shares, legacy e-mail systems, and other

large repositories will prove the most target-rich environments, while better-

managed document management, records management, or archival systems will be

in less need of remediation. A good time to undertake a cleanup exercise is when

litigation will not prevent action or when migrating to a new IT platform. (Trying

to conduct a comprehensive, document-level inventory and disposition is neither

reasonable nor practical. In most cases, it will create limited results and even

further frustration.)

Technology choices should be able to withstand legal challenges in court.

Sophisticated technologies available today should also look beyond mere keyword

searches (as their defensibility may be called into question) and should look

to advanced techniques such as automatic text classification (auto-classification),

concept search, contextual analysis, and automated clustering. While technology is

imperfect, it is better than what employees can do and will never be able to

https://learning.oreilly.com/library/view/information-governance-concepts/9781118218303/18_chap08.html#chap08fn33

accomplish—to manage terabytes of stored information and clean up big piles of

dead data.

Organizations can improve disposition and IG programs with a systemized,

repeatable, and defensible approach.

DEFENSIBILITY IS THE DESIRED END STATE;

PERFECTION IS NOT

Defensible disposition is a way to take on huge piles of information without

personally cracking each one open and evaluating it. Perhaps it is, in essence,

operationalizing a retention schedule that is no longer viable in the electronic age.

Defensible disposition is a must because most big companies have hundreds of

millions or billions of files, which makes their individualized management all but

impossible.

As the list of eight steps to defensible disposition makes clear, different chunks of

data will require different diligence and analysis levels. If you have 100,000

backup tapes from 20 years ago, minimal or cursory review may be required before

the whole lot of tapes can be comfortably discarded. If, however, you have an

active shared drive with records and information that is needed for ongoing

litigation, there will need to be deeper analysis with analytics and/or classification

technologies that have become much more powerful and useful. In other words, the

facts surrounding the information will help inform if the information can be

properly disposed with minimal analysis or if it requires deep diligence.

Kahn's Eight Essential Steps to Defensible Disposition

1. Define a reasonable diligence process to assess the business needs and legal requirements for continued information retention and/or preservation, based on the information at issue.

2. Select a practical information assessment and/or classification approach, given information volumes, available resources, and risk profile.

3. Develop and document the essential aspects of the disposition program to ensure quality, efficacy, repeatability, auditability, and integrity.

4. Develop a mechanism to modify, alter, or terminate components of the disposition process when required for business or legal reasons.

5. Assess content for eligibility for disposition, based on business need, record retention requirements, and/or legal preservation obligations.

6. Test, validate, and refine as necessary the efficacy of content assessment and disposition capability methods with actual data until desired results have been attained.

7. Apply disposition methodology to content as necessary, understanding that some content can be disposed with sufficient diligence without classification.

8. On an ongoing basis, verify and document the efficacy and results of the disposition program and modify and/or augment the process as necessary. Source: “Chucking Daises: Ten Rules for Taking Control of Your Organization's Digital Debris,” Randy Kahn, Esq., and Galena Datskovsky Ph.D., CRM (ARMA International, 2013), Overland Park, KS.

BUSINESS CASE AROUND DEFENSIBLE DISPOSITION

What is clear is that defensible disposition can have significant ROI impact to a

company's financial picture. This author has clients for whom we have built the

defensible disposition business case, which saves them tens of millions of dollars

on a net basis but also makes them a more efficient business, reduces litigation cost

and risks, mitigates the information security and privacy risk profiles, and makes

their work force more productive, and so on.

However, remember auto-classification technology is neither simple nor

inexpensive, so be realistic and conservative when building the business case.

Often it is easiest to simply use only hardware storage cost savings to make the

case because it is a hard number and provides a conservative approach to justifying

the activities. Then you can add on the additional benefits, which are more difficult

to calculate, and also the intangible benefits of giving your employees a cleaner

information stack to search and base decisions on.

DEFENSIBLE DISPOSITION SUMMARY

Defensible disposition is a way to bring your records management program into

today's business reality—information growth makes management at the record

level all but impossible. Defensible disposition should be about taking simplified

retention rules and applying them to both structured and unstructured content with

the least amount of human involvement possible. While it can be a daunting

challenge, it is also an opportunity to establish and promote operational excellence

through better IG and to significantly enhance an organization's business

performance and competitive advantage.

Retention Policies and Schedules

By Robert Smallwood, edited by Paula Lederman, MLS

With limited resources, today's legal counsel, compliance managers, and records

manager are faced with an onslaught of increasingly pressing and complex

compliance and legal demands. At the core of these demands is the ability of the

organization to demonstrate that it has legally defensible records management

practices that can hold up in court.

Organizations can legally destroy records—but will have a greater legal

defensibility if:

• The authority to destroy the records is identified on a retention schedule.

• The retention requirements have been met. • The records are slated for destruction in the normal course of

business. • There are no existing legal or financial holds. • Al records of the same type are treated consistently and

systematically.

The foundation of legally defensible records management practices is a solid IG

underpinning, where policies and processes, supported and enforced by IT, help

the organization meet its externally mandated legal requirements and internally

mandated IG requirements for handling and controlling information.

A complete, current, and documented records retention program reduces storage

and handling costs and improves searchability for records by making records easier

and faster to find. This reduced search time and more complete search capability

improves knowledge worker productivity. It also reduces legal risk by improving

the ability to meet compliance demands while also reducing e-discovery costs and

improving the ability to more efficiently respond to discovery requests during

litigation.

Most large organizations maintain records retention schedules by business unit,

department, or functional area. Some organizations, particularly smaller ones, may

establish organization-wide IG programs that call for the developing, updating, and

improvement of an enterprise or master retention schedule. This is a tall order and

is almost never accomplished—but it is possible with a determined, sustained

effort. Developing enterprise-wide records retention schedules requires

consultation with stakeholder groups that have valuable input to contribute to the

overall development of the IG effort and to specific schedules for retaining record

collections and their planned disposition. Consultation by the records management

department, senior records officer, or records team must take place with

representatives from the business units that create and own the records as well as

with legal, compliance, risk management, IT, and other relevant stakeholder

groups.

MEETING LEGAL LIMITATION PERIODS

A key consideration in developing retention schedules is researching and

determining the minimum time required to keep records that may be demanded in

legal actions. “A limitation period is the length of time after which a legal action

cannot be brought before the courts. Limitation periods are important because they

determine the length of time records must be kept to support court action

[including subsequent appeal periods]. It is important to be familiar with the

purpose, principles, and special circumstances that affect limitation periods and

therefore records retention.”34

LEGAL REQUIREMENTS AND COMPLIANCE RESEARCH

As stated at the beginning of this chapter, legal requirements trump all others. The

retention period for a particular records series must meet minimum retention

requirements as mandated by law. Business needs and other considerations are

secondary. So, legal research is required before determining retention periods.

Legally required retention periods must be researched for each jurisdiction (state,

country) in which the business operates, so that it complies with all applicable

laws.

A limitation period is the length of time after which a legal action cannot be

brought before the courts. Such a period must be factored into retention policies.

In order to locate the regulations and citations relating to retention of records, there

are two basic approaches. The first approach is to use a records retention citation

service, which publishes in electronic form all of the retention-related citations.

These services usually are bought on a subscription basis, as citations are updated

on an annual or more frequent basis as legislation and regulations change.

Another approach is to search the laws and regulations directly using online or

print resources. Records retention requirements for corporations operating in the

United States may be found in the Code of Federal Regulations (CFR), the

annual edition of which:

is the codification of the general and permanent rules published in the Federal

into 50 titles that represent broad areas subject to federal regulation. The 50 subject

matter titles contain one or more individual volumes, which are updated once each

calendar year, on a staggered basis. The annual update cycle is as follows: titles 1

to 16 are revised as of January 1; titles 17 to 27 are revised as of April 1; titles 28

to 41 are revised as of July 1, and titles 42 to 50 are revised as of October 1. Each

https://learning.oreilly.com/library/view/information-governance-concepts/9781118218303/18_chap08.html#chap08fn34

title is divided into chapters, which usually bear the name of the issuing agency.

Each chapter is further subdivided into parts that cover specific regulatory areas.

Large parts may be subdivided into subparts. All parts are organized in sections,

and most citations to the CFR refer to material at the section level.35

There is an up-to-date version that is not yet a part of the official CFR but is

updated daily, the Electronic Code of Federal Regulations (e-CFR). “It is not an

official legal edition of the CFR. The e-CFR is an editorial compilation of CFR

material and Federal Register amendments produced by the National Archives and

Records Administration's Office of the Federal Register (OFR) and the

Government Printing Office.”36 According to the gpoaccess.gov Web site: