week4 IT - 7 pages
Week4/Course1-InfoTech in a Global Economy (ITS-832-06)/Assignment Question 5 Pages/Assignment Question.txt
This week, you have read about entrepreneurship in a global economy. For your written assignment this week, complete a case study of the organization you work for (use a hypothetical or “other” organization if more applicable) that will address the following prompts: • Describe the organization’s environment, and evaluate its preparedness to go global, if not already, and it's strategy for staying global if it is. • Research other company's strategy for going global and explain if this will or will not work for your company. Make a recommendation for a global strategy in the organization, including a justification for your recommendations. Submit your midterm research paper as a single document. Your paper should meet the following requirements: • Be approximately four to six pages in length (1200-1800 words), not including the required cover page and reference page. • Follow APA6 guidelines. Your paper should include an introduction, a body with fully developed content, and a conclusion. • Support your answers with the readings from the course and at least two scholarly journal articles to support your positions, claims, and observations, in addition to your textbook. The UC Library is a great place to find resources. • Be clearly and well-written, concise, and logical, using excellent grammar and style techniques. You are being graded in part on the quality of your writing.
Week4/Course1-InfoTech in a Global Economy (ITS-832-06)/Discussion Question 1 Page/Discussion Question.txt
Networks have changed drastically over the last 30 years. With the first introduction of the 56k modem, which was about 3 typewriter pages per second, to speeds well over 1Gbps these days, the ability to use networks globally, has changed the way we do business. Using research, determine where networks will go in the next 5-10 years and how that might impact the global economy. Please make your initial post and two response posts substantive. A substantive post will do at least TWO of the following: Ask an interesting, thoughtful question pertaining to the topic Answer a question (in detail) posted by another student or the instructor Provide extensive additional information on the topic Explain, define, or analyze the topic in detail Share an applicable personal experience Provide an outside source (for example, an article from the UC Library) that applies to the topic, along with additional information about the topic or the source (please cite properly in APA) Make an argument concerning the topic. At least one scholarly source should be used in the initial discussion thread. Be sure to use information from your readings and other sources from the UC Library. Use proper citations and references in your post.
Week4/Course1-InfoTech in a Global Economy (ITS-832-06)/Professor Readings/global information technology.pdf
Global Information Tectinology
Applications of Global Information Technology: Key Issues for Management
By: Blake Ives Cox School of Business Southern Methodist University Daiias, Texas 75275-0333
Sirkka L. Jarvenpaa Graduate School of Business University of Texas at Austin Austin, Texas 78712-1175
Abstract Carefully crafted investments in giobai informa- tion technology offer firms an opportunity to in- crease control and enhance coordination, whiie opening access to new global markets and businesses. But engineering such giobai systems presents numerous challenges to management. In this article, we relate these challenges as they were described to us by 25 senior managers from Fortune 500 firms responsible for implementing and managing global applicaitons of information technoiogy. Among the findings ofthe interviews are four common approaches for managing global information technology.
Keywords: IS management, worldwide MIS, strategic information systems, global information systems, key MIS issues, international business, multinational company
ACM Categories: H.4.0, K.3.2, K.6.0, K.6.4
Introduction Globalization reveals an imposing future for the managers of many firms. In numerous industries, globalization has already produced dramatic changes in key markets, major competitors, and products. Many of North American's biggest firms have become relatively sniall players in the new global markets (i.e., "the Global 1000"), with in- dustry leaders increasingly headquartered in Asia or Western Europe {Business Week, 1989). Firms operating in these new world markets will in- creasingly be at a serious strategic disadvantage if they are unable to firmly control their worldwide operations and manage them in a globally co- ordinated manner (Bartlett and Ghoshal, 1989).
Exciting opportunities Investments in information technology (IT) can give firms a basis for increased coordination and control or can provide direct competitive advan- tage in world markets. For example, a large computer vendor uses its worldwide network to ensure that products designed in the U.S. are appropriate for customers throughout the world. Lawyers for a large oil firm use the firm's worldwide office system to prepare international contracts in a fraction of the time previously required. In a large merchant bank, a global integrated trading system helps the dealers manager their currency risk and calculate profits, while it also permits the firm to operate in a virtual 24-hour currency market. Moreover, traders con- ducting business through the Australian or Japanese subsidiaries, which are located across the international date line from the U.S., enjoy a full extra business day before they must settle with North American and European trading partners.
As these examples demonstrate, information technology on a global scale compresses time and space and permits the duplication and sharing of scarce corporate expertise. Such capabilities provide firms with an opportunity to leverage advantages in both market size and geographical scope while they simultaneously provide the means to respond rapidly to the unique requirements of national markets.
MiS Quarteriy/March 1991 33
Global Information Technology
. . . but difficult challenges Misalignment of information technology with global business strategy can severely hamper a firm's efforts to seek global pre-eminence. For instance, a decentralized financial services firm catering to globetrotting customers found it very difficult to enlist the support of its foreign sub- sidiaries in a worldwide customer database. Sub- sidiary managers were reluctant to endorse an integrated corporate solution for fear that in the short-run it would adversely impact their earnings and in the long-run reduce their autonomy. Similarly, a manufacturing firm sought to ration- alize production across plants in different coun- tries, but found that systems incompatibilities severly restricted the range of products that could be moved from one factory to another.
Harnessing IT on a global scale presents management with problems that are far more challenging than those encountered in sharing systems across domestic divisions. In fact, it is likely that insights gained in studying IT on an internationai level will provide solutions ap- plicable to large, domestic-distributed IT opera- tions. Unfortunately, progress in the other direction—the exportation of domestic systems solutions—often proves to be less rewarding. Cash, et al. (1988) note problems related to language, currency, culture, national infra- structure, availability of IT staff, data export control, and trade unions. Hardware, software, and communications costs and availability also pose major challenges—challenges for w^ich domestic solutions are often inappropriate. For instance, a centralized hardware solution may provide the best economics in the U.S. where communications costs are low. Elsewhere in the world, however, the high costs of telecommunica- tions may favor a decentralized or distributed solution.
Information technology vendors are often poorly prepared to support global information require- ments across national boundaries. For instance, a multinational decentralized petroleum company chose to install a worldwide electronic mail system to better leverage its personnel in 45 countries. Management was disheartened to learn that they would require 14 different versions of the hardware vendors' office productivity system, each tailored to a particular language and each varying in functionality. Regional data centers were required to support multiple ver-
sions of the software, and for some Asian coun- tries, there was no appropriate language version available.
Key issues for management This article identifies the key issues that a manager charged with managing global IT ap- plications for U.S. multinational is likely to f a c t - issues that must be mastered if the firm is to use IT successfully in the new global markets. The primary objective of this article is to provide a rich description fo global IT applications and some tentative generalizations.
The foiiowing definition for an application of global information technology serves as the framework for our discussion of the key issues:
A global Information technology application
• contributes to achieving a firm's global business strategy
• by using Information technology platforms
• to store, transmit, and manipulate data
• across cultural environments.
Hence, in this article we identify key issues for the following four elements of global IT: (1) the linkage of global IT to global business strategy, (2) information technology platforms, (3) inter- national data sharing, and (4) cultural environ- ments. Previous work pertaining to applications to global IT and to each element of global IT is first reviewed.
Global Information Technology in the Literature The rapid globalization of business and the in- creased role of IT in shaping corporate strategy indicate that global IT is a topic of considerable importance to information systems practitioners. Our review of previous work suggests that the information systems research community has generally neglected this important area. Cash, et al. (1988) call international IT " a major, largely unreported, unstudied IT story" (p. 212). Feeny, et al. (1990) argue that the role of information
34 MIS Quarterly/March 1991
Giobai hformatiort Technoiogy
technology in supporting and enabiing the giobai- ization of business has been "understated and certainly under-explored" (p. 36). When inter- nationai topics have been addressed by the in- formation systems research community, it has often been as a replication of American research in a different country. This type of work has focused on countries or cuitures as the primary unit of anaiysis. By contrast, the focus of this article is applications of information technology that transcend national boundaries.
A few case studies consider global IT applica- tions. These include the development and im- plementation of a worldwide sales management information system at Du Pont's Polymer Products Department (Kneitei, 1980), the strategic use of iT at a paper company with 100 woridwide saies offices, agents, and distribution centers and headquartered in Finiand (Reponen and Copeiand, 1986), and two case studies (Selig, 1982) iiiustrating strategic planning ap- proaches for information resources in a multi- national organization. Keen, et al. (1982) discuss the implementation hurdles of an integrated bank transaction processing system in 40 worldwide locations.
The literature, however, offers little guidance for choosing between local versus common applica- tions. Keen, et al. (1982) argue that the more standardized the business process across home and foreign iocations, the larger the fraction of the system will consist of the "common core." The larger the core, and therefore, the smaller the need for local taiioring, the more sense a common global application makes. But, Keen, et al. (1982) warn that relatively minor differences in iocal markets can mean major requirements for local tailoring. Viewing the issue from a higher ievel. Reck (1989) concludes that a firm should structure its information systems function to operate in a "mixed mode." Reck recognizes that different suites of applications will support dif- ferent business strategies and wiii therefore require varying degrees of commonality across borders.
Global business strategy Some business strategies are more dependent than others on timely, accurate, and complete in- formation on overseas operations (Egelhoff,
1982). For instance, in the past, home offices typically conceded considerabie autonomy to their foreign businesses (Bartlett, 1986). Worldwide reporting and information require- ments were minimal under these "country- specific" strategies. As information technology advanced into foreign facilities, it was primariiy used to serve local information needs. It is not surprising then that in 1985, Freeman (1985) found that IT activities were relativeiy de- centralized to company units for most U.S. multinationals.
More recently, firms have begun to adopt globally integrative stratgies in response to increasingly competitive global markets. Among these pressures are the search for global economies of scale and scope, the development of global products, and the increasing requirement to satisfy the needs of woridwide customers. The consequent increased need for global coordina- tion and control has placed greater demands on information and communication between head- quarters and subsidiaries (Carlyle, 1988). In search of global efficiencies, many firms have started to move away from a geographic focus and toward a business operations orientation. Carlyle (1988) suggests that these changes in corporate strategy and structure may be precipitating more centralized global IT activities: one common telecommunications network, shared databases, and standardized reporting and planning systems. But, writing in 1987, Keen was unenthusiastic about the pace of the transi- tion to global information systems. He concluded that, "It is absurd that so many international firms have global business strategies but no corres- ponding strategy for managing information technology internationally" (p.1). Others fear that a poorly crafted IT strategy will limit organiza- tional options. Thompson and Taylor (1988), discussing the organizationai repositioning that will be required when Europe unifies in 1992, warn that, "inflexible minds presiding over in- stalled bases of unconnected applications soft- ware and incomparable data wiii retard the organization's ability to redraw its map of Europe" (p. 6).
IT can propagate new business strategies, but a more common goal is to effectively harness IT to an existing global business strategy. Such alignment requires a shared understanding of the firm's overall global strategy. Various authors
MIS Quarteriy/March 1991 35
Global Information Technology
have presented models of global business strategy (e.g., Levitt, 1983; Perlmutter, 1969; Rowe, et al., 1986), but usually with little or no attention to information processing requirements. For example. Porter (1986) positions a firm's global business strategy along a spectrum ranging from multidomestics, whose off-shore operations independently set strategy and handle production, marketing, and administrative func- tions, to global multinationals, who integrate their activities on a worldwide basis to capture the linkages between countries, while still maintain- ing some single-country perspective. Shanks (in Freeman, 1985), Carlyle (1990), and Runyan (1989) all agree that some amount of centralized IS is critical for global multinationals.
The global business strategy models of Bartlett and Ghoshal (1989) are among the most de- veloped because they tie business strategy to a set of organizational forces faced by the firm. Bartlett and Ghoshal indentify four broad strategies that a multinational firm may pursue. The firm following a multinational strategy operates Its foreign subsidiaries nearly autonomously or in a loose federation so as to quickly sense and respond to diverse local needs and national opportuntities. The requirement for local reponsiveness is the driving organizational force. The firm following a global strategy closely coordinates worldwide activities through central control from headquarters so as to capitalize on the economies associated with a standardized product design, global scale-manufacturing, and centralized control of worldwide operations. In this strategy, the firm is organized around a requirement for gloval efficiencies. The firm following an international strategy exploits parent company knowledge through worldwide diffusion and adaptation. Rapid deployment of innovation is the prime operating principle. The firm follow- ing a transnational strategy seeks to retain local flexibility while simultaneously achieving global integration and efficiencies as well as worldwide diffusion of innovations. According to Bartlett and Ghoshal (1989, p. 69), "Dynamic inter- dependence is the basis of a transnational company—one that can think globally and act locally."
The transnational model appears to be similar to the global multinational model of Porter (1986) and also resembles the global model of Ohmae (1989). According to Ohmae, the global model
prevails today because customer "needs have globalized and the fixed costs of meeting them have soared" (p. 161). Ohmae (1989) cautions that this does not mean that firms should necessarily pursue universal products. He argues that the businesses that are most likely to suc- ceed in global markets are those that can devise a short list of iead-country models—a product tailored to the dominant and distinct markets— and can adapt these lead-country models to local preferences at low cost. Ohmae's lead-country models have implications for IT. The common global systems need to be designed to efficient- ly accommodate local add-ons for local respon- siveness. The add-ons might reflect differences in underlying product or marketing and distribu- tion strategies (e.g., sold direct or through shared or exclusive channels), local resource or legal re- quirements, or the strategic importance of sub- sidiaries to headquarters.
Information technology platforms Keen (1987) contends that " . . . the telecom- munications architecture is generally the strategic driver for evolving a truly international capabili- ty" (p. 9). He suggests that management fund the backbone global communications network as " a corporate business asset, rather than allow- ing local case-by-case, cost-based decisions about communications facilties" (p. 2). But he warns that the builder of a global communication system must tread carefully when designing the infrastructure or seeking out international stan- dards for IT. For example, Japan, Germany, Brazil, and France have used information policy to protect their national computer and telecom- munciations concerns (Lerner, 1984). To operate in such countries, Wiggin (1987) suggests that senior management "finds friends in the PTTs"— the state-owned post office and telecommunica- tions operators that closely regulate the telecom- munications industry. Buss (1984) suggests that corporate contacts with the PTT "show a cor- porate concern for the issues and a willingness to comply with both the letter and the spirit of the law" (p. 118).
Worldwide variations in hardware and software features, i.e., availability and quality, force firms to use different vendor products in different parts of the world. This causes major obstacles in in- tegrating communication networks, hardware.
36 MIS Quarterly/March 1991
Global Information Technology
and disparate systems software for global ap- plications. Vendors' protectionist policies for their products are cited as the major barrier for agree- ments on standards such Open Systems Inter- connection (OSi) (Cash, et ai., 1988). Keen (1987) argues that "the fastest way that standards emerge is through the power of key market players" (p.5). Although vendors are usually con- sidered as key market piayers (Quinn, 1987), there have been other suggestions that ap- propriate iT standards wili only deveiop if the user organizations coordinate their demands and play an active roie in "internationai pressure groups" {Datamation, 1988). in the area of eiectronic data interchange (EDI), standards have been developed jointiy by the United Nations and ANSi. Harrington (1988) projects that 400,000 companies wiii have implemented internationai EDi standards (EDiFACT) by 1995.
strengthened to the point where it may hamper or even compietely staii a company's important operations" (p. 111). A study conducted in 1985 involving 370 service companies reported that 63 percent considered T D F regulations to be a serious potentiai problem, although only 31 per- cent reported problems at the time (Kane and Ricks, 1988).
Globai appiications present other data manage- ment challenges. Because users of global ap- plications often access the same worldwide database or because data from different foreign iocations are intended to be shared and con- solidated, global systems require well-defined and standard data definitions. In fact. Keen, et ai. (1982) argue persuasively that commonality in global systems should be established primarily through standardization of data rather than stan- dardization of programs.
International data sharing The international flow of data has received atten- tion both in the iiterature and from various legislative bodies. Much of this has been focused on the issues of data privacy and transborder data flows (TDF). TDFs have been defined as "movements of machine-readable data for pro- cessing, storage, or retrieval across nationai boundaries" (Chandran, et al., 1987, p. 75), and have been ciassified by Lerner (1984) into four types: (1) operationai data inciuding orders, accounting statements and records, or manage- ment directives, (2) personally identifiabie data that pertain to credit records, travel reservations, or employment records, (3) eiectronic transfers of money, and (4) technical and scientific data that inciude instructions for operating machinery in a plant. T D F iaws usually concern the second category, aithough many countries aiso restrict transfer of technical and scientific data (Smith and Heaiy, 1987).
T D F laws originated in the 1970s from concerns about the integrity and confidentiality of personai data. Since then, severai countries have ex- tended privacy laws to protect "legai persons" such as associations and corporations. As of 1988, 24 nations had privacy legislation on transborder data flows (McCrohan and Lowe, 1988). The impact of these laws was predicted to be devastating for U;S. multinationals. Buss (1984) argued that "legislation is now being
Cultural environment Finaiiy, giobal applications of information technology must be developed for and operate in a heterogeneous cuitural environment. Levitt (1983) proposes that consumers have become alike in aii parts of the world through the homogenization of needs and desires. This homogenization has resuited from the "pro- ietarianization of communication and travel" (p. 83). It suggests that cuiturai differences across internationai user communities may, to some extent at least, be converging.
Nonetheless, cross-cultural IT research has found major cultural disparities that warrant attention in developing global IT applications. Dagweil and Weber (1983) conclude that Australian and Swedish systems designers favor a Theory Y orientation in assessing user needs, whereas U.S. and U.K. designers iean instead toward a Theory X view of users. Kumar and Bj0rn-Andersen (1990) found similiar differences in values across Canadian and Danish systems designers. Couger and Motiwalla (1985) found major demographic differences between U.S. and Singaporean iS professionals; Singaporean IS professionais were younger, less experienced, and better educated than their U.S. counterparts. Research on group decision support systems has also detected that the assumptions underlying specific information technology features are culture sensitive (Ho, et al., 1989).
MIS Quarterly/March 1991 37
Global Information Technology
Global Information Technology in Practice Our exploratory study sought to identify the key problems and opportuntities facing managers responsbile for developing global applications of information technology. These were assessed in terms of (1) the linkage to business strategy, (2) Information technology platforms, (3) international data sharing, and (4) cultural environments. We interviewed 25 senior managers responsbile for the implementation of global applications of in- formation technology in Fortune 500 industrial and service firms. The managers were drawn from 19 organizations that represented a variety of industries including petroleum, computers and electronics, chemicals, motor vehicles, financial services, and management consulting services (see Table 1). The firms in the sample were not randomly chosen. Selections were based on our ability to gain access to a firm's senior manage- ment; many of the firms were associated either with the information systems programs at the University of Texas or Southern Methodist University.
The typical interviewee was either a project spon- sor from the user organization or the individual
responsible for project delivery. In seven cases, he or she was either the head of information systems or responsible for a particular suite of applications—e.g., director of worldwide manufacturing systems. Other typicai titles in- cluded: vice-president for systems deveiopment, senior partner (of a large consulting firm), manager of corporate office automation and in- formation services, coordinator of telecom- munications planning, and so on.
The applications discussed ranged from the worldwide spare parts network of a computer vendor, a global risk management system of a financial services firm, a reservation system of an airline, a worldwide manufacturing planning and control system implemented by a manufac- turer, to the corporate-wide general ledger systems of a petroleum firm and a computer com- pany. Most applications had been completed within the previous two years, though some were still being implemented. All involved at least two countries in addition to corporate headquarters— many spanned several continents including a petroleum application implemented in over 50 countries. Among the applications, some were running on a mainframe at headquarters, some were duplicated for use at multipie regional data
Company
1 2 3 4 5 6 7 8 9
10 11 12 13 14 15 16 17 18 19
Table
Industry
Computers/electronics Financial services Petroleum Petroleum Petroieum Manufacturing Computers/electronics Transportation Computers/electronics Financiai services Management consulting Chemicais Consumer goods Chemicals Manufacturing Banking Manufacturing Petroleum Freight forwarder
1. Companies
1988 Revenues in Billions
>$25 $11-25 >$25 >$25 >$25 >$25 $1-10 $1-10 $1-10 $1-10 — $1-10 $25-50 $1-10 $1-10 $1-10 $1-10 $11-25 <$1
n the Study
% Revenue from Overseas
> 5 0 % 11-25% > 5 0 % > 5 0 % 26-50% > 5 0 % 11-50% 11-50% > 5 0 % 25-50% — < 1 0 % < 1 0 % 25-50% 25-50% 11-25% > 5 0 % 11-25% —
Countries Operating in (plants or sales offices)
> 5 0 11.25 >50 >50 > 5 0
26-50 11-25 11-25 26-50 11-25
150 offices worldwide < 1 0
26-50 11-25 11-25 11-25 < 1 0 11-25 26-50
38 MIS Quarterly/March 1991
Global Information Technology
centers, and some standalone systems were housed on local PCs or mainframes. Others were housed on different-sized hardware, ranging from PCs to mainframes, depending on the business need within the foreign subisidiary. There were applications developed outside the U.S. and subsequently implemented in the U.S. Others had been exported from the U.S., then severely modified by foreign subsidiaries, in this ex- ploratory study, we sought variety in the applica- tion set, industry, and international settings to ensure that we were thoroughly exposed to the phenomenon of global information technoiogy.
Key Issues for Global IT Management In this section the interview resuits for the four elements of global IT applications are reported. The key issues detailed at the end of each subsection summarize the main management concerns expressed in the interviews.
Linking global applications to corporate strategy The search for systems economies was the intitial driving force for global IT applications in many firms. One interviewee recalled being told by the CEO, "We have invested so damn much money in these home office systems—iet's get some additional use out of them." Based on their hard won experience, however, the interviewees were nearly unanimous in endorsing the need for a compelling business reason to coordinate and standardize information technology. Many inter- viewees agreed that they had initially eri-ed by assuming application requirements were similar, when the underlying business processes were later revealed to be different in sometimes subtle but significant ways. For instance, an engineering firm wished to use a common engineering data- base to share project work between its U.S. and European offices. In addition to anticipated variations in engineering codes and the relative costs of materials, management soon discovered that the European project requirements de- manded far more detailed specifications for con- tractors than had traditionally been required of their U.S. counterparts.
Our interviewees offered a range of business drivers for their global applications. Some of these drivers were strongly linked to the needs of the marketplace—e.g., a global customer or a constrained resource—whereas others were driven by regulatory requirements. Many still mentioned the search for system economies as a driver for global applications. Table 2 sum- marizes the global business drivers for the ap- plications discussed.
Except for the economies of scale for systems, similar drivers were often mentioned by respondents in the same industry. Hence, it ap- peared that at least some of the business drivers for global IT are related to an industry in which the firm competes, although others vary by a firm, or even by a strategic business unit.
Aithough the interviewees were typically able to readily identify the business drivers, particuiarly the industry-based drivers, for the giobai applica- tion under discussion, few were able to state the firm's overall approach or strategy for managing global information technology. Consequently, from the discussions on applications of IT and from the interviewees' comments on their firm's global business strategy, we attempted to infer the emerging patterns of managing IT in the respondent fimis. Four generic patterns emerged that seemed to be aligned with the four business strategies proposed by Bartlett and Ghoshal (1989). These four strategies, discussed previously, were multinational, global, interna- tional, and transnational.
Approaches for managing global IT Independent Global IT Operations
For a few firms in our sampie, subsidiaries con- tinued to pursue independent system initiatives, often mirroring a relatively independent multi- national strategy. Common systems were few and iargely exceptions in these firms. Technology choices reflected the infiuence of iocal hardware and software vendors as weli as the prevaiiing national communication standards and offerings. For these firms, headquarter's systems per- sonnel rarely traveled abroad on business and had little knowledge or interest in their sub- sidiaries' system initiatives. Locai profit and loss responsibiiity, coupled with reiiance on local
MIS Quarterly/March 1991 39
Global Information Technology
Tabie 2. Business Drivers for Globai iT
1. Globai consumer/ customer
2. Giobai product
3. Rationaiized operations
4. Flexible operations
5. Joint resource
6. Duplicate facilities
7. Scarce resources
8. Risi( reduction
9. Legai requirements
10. Economies of scaie for systems
Firms that serve traveling customers—airlines, hotels, rental car, and credit card companies—find it necessary to have worldwide customer databases. A similar requirement is increasingly being imposed by corporate customers with global operations that more and more are demanding integrated worldwide services.
The product is either the same throughout the worid (e.g.. Coca Cola) or is assembied from subsidiaries throughout the worid (e.g., security, currency exchange, or real estate). Information systems can provide the abiiity to manage woridwide marketing programs.
Different subsidiaries buiid different parts of the same product based on availability of skills, raw materials, or favorable business climate. For exampie, a computer manufacturer might buiid software in the U.K., monitors in South Korea, and circuit boards on the West Coast of the U.S. IT is used to coordinate the operations.
Operations are moved from a piant in one country to a plant in another. For instance, a computer vendor moves production of personai computers between plants in response to labor strife or raw materiai shortages. Common systems exist across plants, which facilitates the move.
National subsidiaries may share certain facilities or people. For in- stance, the European subsidiaries for a petroleum company jointly own tankers or storage tanks. A material resource system is implemented to track the location of joint resource.
A chemicai company uses nearly identicai piants to produce gases in different countries. Software supporting that production facility can be readily shared.
A chemicai firm requires that high-cost gas compressors be available in case of breakdowns in its identical worldwide plants. High costs prohibit storing them at each faciiity. A parts logistics system coordinates the compressor's use and distribution.
Risks associated with currency conversions, multiple global markets, and multiple traders are alleviated. For instance, a petroleum com- pany develops a global system for bidding on crude oil contracts, or a multinational bank implements a global risk management system for currency trading.
information requirements mandated by laws in one or more countries are consolidated. For instance, financiai or environmental regulations imposed on a subsidiary may necessitate corporate-wide information requirements if the subsidiary intends to sell or use products manufac- tured elsewhere.
One corporate-wide system is used to reduce data center require- ments, duplicate deveiopment activities, and maintenance resources.
40 MIS Quarterly/March 1991
Global Information Technology
information systems departments and local technology, resulted in non-integrated technology platforms, databases, and applications. This lack of integration appeared at times to severely impede efforts to implement global business strategies. For instance, a computer vendor who had neither a global ordering or billing system had a difficuit time meeting the needs of a headquarters-based client who sought to design a worldwide system in New York for subsequent implementation in 50 country facilities, with payments to be made from regional offices iocated in London, Tokyo, Rio, and New York. The independent giobai iT operations best sup- ports the multinationai strategy of Bartlett and Ghoshal. The focus is ciearly on local respon- siveness, and the applications portfolio is strongly oriented toward iocai requirements.
Headquarters-Driven Global IT
A number of firms have imposed corporate-wide iT solutions on subsidiaries, at least for some applications. For many firms the headquarters- driven approach was not oniy desirable but required. These are Bartiett and Ghoshal's (1989) global firms that strive for woridwide efficiencies, usuaiiy in support of global products. Here the compelling business need and the opportunity to harvest worldwide economies of scaie force the firm toward a giobal systems solution. For in- stance, large semiconductor manufacturers with giobal customers and products, rationalized pro- duction, and stiff international competition have little choice but to seek globai efficiencies. Cen- tralized IT may provide some efficiencies of its own, but, more importantiy, it provides the coor- dination and controi necessary for efficient opera- tions throughout the firm.
Headquarters-driven global IT appeared to run into problems without a strong global business need. Efforts resulted in overt or covert resistance to the "ugly American" who suddenly appeared at the subsidiary's data center. This was often a frustrating period for a U.S. systems manager assigned overseas. One interviewee assigned to the U.K. confessed to us that "after a year I had finaiiy iearned enough to be useful and not to be bluffed—then I was recalled to the States." For some firms, appiications brought over from the U.S. were successfuiiy impiemented, but many died later from neglect or unmaintainability after the U.S. emissary departed. In other firms, this
approach had ended with a recognition that "their business really is different from ours," foiiowed by a hasty retreat to independent giobal IT opera- tions. For these firms, the only benefit was unplanned—organizationai learning emerging from face-to-face contacts between the sub- sidiaries' and headquarters' systems people and their major users.
Intellectual Cooperation in Global IT
For some of the firms in our sample, strong links existed between the home office and foreign sub- sidiaries, but the linkages were those of coop- eration and mutual assistance rather than management fiat, in these organizations, head- quarters personnel attempted to influence rather than control the information technoiogy choices of their foreign subsidiaries. Personnei were ex- changed regularly, and joint appiication develop- ment efforts were initiated. If headquarters had already developed an application that the sub- sidiary now required, the subsidiary might ask for a copy to modify. Alternatively, they might choose to send a group to the U.S. to study the applica- tion thoroughly before developing their own version. One interviewee described the objective that he and his European IT director shared as an attempt to develop "inteiiectual synergy" be- tween their two groups. This approach to manag- ing iT seems to fit well with Bartlett and Ghoshal's (1989) international siraXegy. The objective in this case is to rapidly disseminate corporate innova- tion while continuing to provide the flexibility re- quired to be responsive to local business entitites.
Integrated Global IT
Barttett and Ghoshal (1989) have proposed that a transnational strategy will supersede the muitinational, internationai, and global strategies currently pursued by different firms. According to Bartlett and Ghoshal, firms wiii seek this transnational status to permit them to simultaneously be globally efficient, provide iocal responsiveness, and quickly diffuse organiza- tionai innovation. The companies in the study had yet to reach the truiy transnational status. Feeny, et al. (1990) have proposed that firms pursuing a transnational strategy wiii require appiications of information technoiogy that reach across national borders to meet the firm's diverse ob- jectives. Here systems soiutions would be in- tegrated using international standards and a
MIS Quarterly/March 1991 41
Global Information Technology
planned common architecture that will meet the needs of various-sized organizational units operating in diverse environments. Muitinational development teams would ensure that organiza- tion-wide IT solutions also meet the needs of local business units with applications moduies divided into common and locally taiiored code. Global database design teams would ascertain the data entities that wouid be shared across the woridwide organization and deveiop universal data dictionaries and appropriate databases. In- novation in this case would be a two-way street, with headquarters benefiting from the knowledge of subsidiaries. Several of the firms we talked with, who had previousiy based their IT strategy on intellectual cooperation or headquarters- driven global IT, had recently recognized the necessity of moving toward the cooperative development of globally integrated appiications.
Table 3 lists the key issues resuiting from the interviews reiated to the iinkage between IT strategy and business strategy. If no deliberate global IT strategy is deemed necessary or viabie at present, management may wish to assess how important such a linkage might become in the future and how to best prepare for that eventuality.
Table 3. Liniclng IT and Business Strategy: Key Issues
• Understand each business unit's global business strategy.
• Determine the appropriate giobal IT management approach or IT strategy to align with the global business strategy.
• Identify the fundamentai objective or objectives driving the giobal IT strategy and global IT appiications.
• Classify and prioritize applications based on their contributions to giobai business strategy.
• Assign responsibiiity for deveioping and implementing the global IT strategy.
• Assist senior management to under- stand the potential impacts of global IT on corporate strategy.
Information technology platforms
Data center consolidation, location operations, vendor relations, and software availability were commonly mentioned concerns related to IT in- frastructure. The interviewees infrequentiy discussed data networks and telecommunica- tions as either barriers, if they had faiien behind their competitors, or competitive advantages, if they perceived themseives as leaders.
In many firms, additional data centers were located outside the U.S. These centers were used to meet nationai or regional needs and sometimes to baiance international workloads via sateilite communications. According to our inter- viewees, establishing locations for internationai data centers presents several challenges: overlapping working hours; local computing and iabor regulations; potentiai theft; sabotage and terrorism; unreliable power sources; avaiiability of completeiy redundant network backup capabiiity; and the iike.
Our interviewees complained that equipping a local data center can be problematic because of high prices for iocai hardware, the iack of local service for products, the absence of an author- ized distributor, and iong lead times in acquiring both equipment and spare parts. Interviewees complained that in Japan, for instance, iocai distributors hold monopoly positions and charge rates nearly double the price of comparable products purchased in the U.S. Economic and technical barriers set by national governments in- ciude higher prices for computing equipment and communication lines, restrictions on the impor- tation of equipment and services, and rigid hard- ware and software standards. Severe import limitations on assembled hardware in countries such as Brazii forced one firm to enter the com- puter assembly business to outfit their foreign subsidiaries. Even in countries with open trade poiicies, new hardware modeis or software ver- sions may take a year or two to be released to the market because the vendor may not have the resources available to quickly adapt the product, documentation, and support to local conditions. To support languages such as Japanese requires that a single character from the language be stored in two, rather than the customary one, bytes of computer storage, often necessitating
42 MIS Quarterly/March 1991
Global Information Technology
vendors to make costly and time-consuming modifications to software packages.
According to our interviewees, purchased soft- ware packages present unique problems in an international setting. Packages designed to run in Europe may be incompatible with their American or Asian counterparts, even when purchased from the hardware vendor. Packages from software houses are even less universally available than those from hardware vendors— no matter how well known in the U.S. Software houses often rely on licensing agreements with local personnel to handle the sales, distribution, and support of their product. In some countries, local disregard of copyright restrictions has caused vendors to completely ignore or retreat from a particular market. As a consequence, severai firms have restricted package choices to those provided and supported by their hardware vendor. Others buy PC packages in the U.S. and distribute them to their subsidiaries. Firms deal- ing in developing countries face even more challenging problems. A firm with operations in China first selected a hardware platform that they could legally import into the country and then searched for applications that potentially might be of some use to their Chinese business.
Table 4 lists the key issues related to technoiogical infrastructure.
Data In 1988, McCrohan and Lowe (1988) predicted increasing regulation of transborder data flows (TDF), claiming that "the control of transborder data flows will be the trade war of the 199O's" (p. 8). Our interviewees tell us that McCrohan and Lowe's war was never fought. One manager claimed that "transborder data flow is a myth." Another said that "TDF looked very exciting in the 70s, but proved to be a non-event in the 80s." One expert expiained that many transtx>rder data laws are vague and therefore difficuit to follow and to enforce. He explained his policy for deal- ing with the regulators: "The officials charged with enforcement are often as confused about these complex laws as we are and they are not anxious to spend much time interpreting them. We don't ask their permission. Instead, we tell them what we intend to do and ask them to let us know if there are any problems."
Table 4. Information Technology Platforms: Key Issues
• Determine the number and locations of regional data centers.
• Ensure 24-hour system avaiiability and support for global applications operating from global data centers.
• Select vendors who can provide support in dispersed iocations.
• Select hardware and software appro- priate for shared data or processing re- quirements.
• Expect delays and incompatibilities from vendors operating outside their own home markets.
• Anticipate a reduced set of hardware and software alternatives.
• identify reiiable local IT distributors and service providers.
Two application categories seemed most vulnerable to TDF or privacy iegislation. The first is payroll systems, which generaiiy do not lend themselves to global use. The second is personnei-record systems. Typcially, the firm must commit to providing the same level of security and access to personnei data stored abroad as is required by privacy iegisiation iocally. Although our IT experts acknowledged the difficulty of transporting personal data from some countries in Europe to the U.S. or from Canada to the U.S., some questioned whether "we even really need it [personai data] in the U.S." Few companies expressed need for a skiils inventory system that spans nationai boundaries. However, as corporations continue to institute truly transnationai corporate strategies, the need for worldwide personnei systems—at least for senior managers and professionals—is likely to surface.
Although transborder data laws and regulations were not perceived to be a major obstacie to globai iT, worldwide data management and data standardization within the firms were perceived to present significant barriers for internationai data sharing. Defining common data names presents unique problems when multiple languages are used. But, even within countries
MIS Quarterly/March 1991 43
Global Information Technology
sharing a language, the same word or phrase may take on quite different meanings. Differing nationai standards, rules of thumb, or differences in technology platforms also present problems when, for instance, common part codes are desirable. Data modeling presents further challenges as real world entities and relationships among data entities, as weli as day-to-day plant and field operations, vary from country to country. According to one executive, "People suddenly just forgot how to speak English" when con- fronted with standards that threatened cherished local operating procedures.
To find an organizational body within the firm that is willing to lead the standardization effort may be difficuit. A major manufacturer of farm equip- ment, for example, installed a worldwide manufacturing system in its piants. The corporate finance group was responsible for developing common standards for general ledger accounts, but nobody was willing to take action to stan- dardize part numbers. Finaiiy, the project manager from the corporate IT group developed a new standard coding scheme for parts. Locai personnei complained, but not enough to catch the ear of top management. The project manager commented: "The systems group became a cataiyst for changes that should have been done long before."
The key issues related to international data that were uncovered in the interviews are iisted in Table 5.
Cultural environment "Not Invented Here" and "Unsuitable for Our En- vironment" were commoniy identified barriers that severeiy hampered attempts to standardize on a global or regional application. Several in- terviewees acknowiedged that these concerns had been well founded in the past. We found some signs of them still. One respondent, for in- stance, was disappointed when system users in his Japanese subsidiary balked at data fieids con- taining dollar signs ($) as substitutes for the yen sign (¥). Nevertheless, the Japanese were recognized as being more accepting of "parachuted" solutions than the Europeans. Ac- cording to severai interviewees, the Japanese, once convinced that an application met their needs, were quick to embrace it. Severai firms interviewed had chosen to distribute deveiop-
Table 5. Internationai Data Sharing: Key Issues
• Weigh the desirability of transborder sharing and standardizing against the requirements for local fiexibiiity.
• Understand your responsibilities, limita- tions, and exposures vis-a-vis TDF and privacy laws.
• Assign responsibility for data standard- ization.
• Involve subsidiary users and IT groups in the standardization of common data names and data modeling activities.
• Design and deveiop a giobai data ar- chitecture around giobai business ob- jectives.
• Physically locate databases based on business requirements, legal considera- tions, relative costs, vendor support, organizational politics, etc.
ment between the U.S. and European sub- sidiaries to neutralize subsidiary resistance to an imposed outside solution. This appeared to pro- vide some short-run advantages, but in the long run reduce opportunities for full integration.
Variations in work vaiues were perceived across cultures, some no doubt stereotypic. One inter- viewee ciaimed that employees in one European subsidiary were half as productive as their American counterparts (they were also paid ap- proximateiy haif as much). In another country, where skilled jobs werre at a premium, workers were seen as highly protective of their personal knowledge. The interviewee had found that employees there were generally unwiiiing to share knowledge with others and considerably overstated their own proficiency. Another inter- viewee had been delighted to discover that aithough Japanese systems personnei were in short supply, women were more readily available than men. After the interviewee encouraged her Japanese systems manager to hire severai women, she was later chagrined to discover that he had "turned them into tea ladies." Religion is often another important factor. Prayer breaks and iong holidays must be accommodated. Ob- viously, the cultural stereotyping goes both ways;
44 MIS Quarterly/March 1991
Global Information Technology
managers from the European subsidiary of a U.S. firm described their American counterparts as "indined to do something fast, but likeiy to have to iater sow the seeds of the storm they pianted."
The firms' subsidiaries aiso varied in systems si<iii sets. Severai interviewees noted that the French were skiiied in data modeiing and in the more theoreticai aspects of systems deveiopment. Other interviewees reported the English to be weii trained in the use of structured deveiopment methodoiogies, whiie the Germans were seen as exceiient project managers. Singaporeans were described by one interviewee as extremeiy hard working, skiiied, and wiiiing to take on any task assigned. Another manager described them as the consultants of Asia. Austraiia, on the other hand, was seen as iacking in systems skiiis. Where such observations reflect reai rather than perceived cross-cuitural differences, there may be opportuntities for creatively aiiocating systems work or for fostering organizationai learning across subsidiaries.
The key issues reiated to cultural environment are summarized in Table 6.
Table 6. Cultural Environment: Key Issues
• Identify critical systems applications or skiiis competencies (or weaknesses) possessed by foreign subsidiaries.
• Provide opportuntities for giobal organizational learning reiated to these areas of unique competency.
• Recognize the sensitivity of foreign sub- sidiaries to imposed solutions and seek mutually acceptable alternatives.
• Seek new ways to sensitize managers sent abroad (or brought to the U.S.) to cultural, religious, and political differences.
Developing Global Applications of Information Technology Some of the cultural, infrastructure, and data issues that can impede the successfui employ-
ment of global information systems were de- scribed above. The importance of tightiy iinking information technology to the firm's giobai business strategy was also highiighted. Next, some additionai, but more specific, issues ex- pressed by the inten/iewees about the develop- ment and maintenance of individual global applications are described. A few generic ap- proaches used to overcome these specific deveiopment-related issues are aiso presented.
The most commoniy mentioned chailenges in the deveiopment of global applications were the determination of giobai versus iocal requirements and the maintenance of high levels of local user involvement and ownership. One interviewee estimated that it takes five to 10 times more time to reach an understanding and agreement on system requirements and deliverabies when the users and developers are in different countries. This is partialiy explained by travel requirements and language and cuiturai differences, but technical iimitations aiso contribute to the probiem. In many developing countries, outdated or unreliable communications systems can restrict or totally preclude regular phone calls, fax transmissions, or dial-up computer connections. One interviewee, who faced a 12-hour time dif- ference in reaching some subsidiaries, claimed that it typically took neariy an hour to establish a phone iink and that the iine wouid often go dead during the caii.
Ongoing maintenance of a functioning appiica- tion presented problems for many respondents. Our interviews suggested that giobal systems face simiiar, but usuaiiy more extreme, maintenance probiems than do distributed domestic systems. If the global system is run from one centraiized data center serving different markets, time-zone differences pose probiems for preventive and file maintenance. An interruption during a third shift in New York City wiii present midday service interruptions in Tokyo. One respondent recaiied a decision he had made earlier in his career that eventuaiiy came back to haunt him. "For various reasons we had designed the system so that it had to be down for one day each year. I had chosen the Fourth of July [U.S. Independence Day] because everyone would be on vacation that day."
If the global system is to be run on muitiple host computers, a decision must be made whether to
MIS Quarterly/March 1991 45
Global Information Technology
deveiop a single system reflecting aii the varia- tions required for its target countries or to develop multipie sets of code, each taiiored to a particular environment. The first option ensures a more consistent evolution of the system, but may cause performance degradation and siow response to iocal maintenance requests. Even within one single system, if run from multiple data centers, there tends to be an evolution to multiple locai systems. "Without strong central supervision in maintenance," one of our interviewees argued, "there is a naturai affinity for iocal solutions, no matter how similar the business."
The interviews surfaced three approaches for overcoming problems in developing and im- plementing global systems. The most common approach is to transform the home office or "best in firm" appiication into a global system. Some respondents reported better success in bringing a European system to the U.S. than the other way around, because the European systems were already designed to deal with multiple languages and currency conversions. Having indentified the system, it is then modified to meet worldwide requirements. A smaiier version of the system may be created for developing countries where both the required functionaiity and technological resources are modest. Almost without exception, the worldwide roll-out of the application has been gradual. Typically, the system is first modified to meet the requirements of the European sub- sidiaries. Later, the requirements of the Far Eastern operations might be added, followed by the requirements from South American sub- sidiaries, and so on.
A second development approach requires assembly of a multinationai design team. Systems and user personnel from headquarters and from local subsidiaries are posted to one design location, often for months at a time. Costs for this approach were reported as high. One respondent noted that the costs to maintain a U.S. systems manager in Japan are approx- imately 2.5 times greater than the U.S. fuiiy costed rated. Some countries restrict the number of foreign personnel assigned to a firm's local office, and the procedures to gain approvai for staff can be time-consuming. Deveiopment out- side the U.S. need not always be expensive, however. For instance, one firm reported that a U.S.-based software engineer costs three times as much as an indian with simiiar qualifications.
Whatever their costs, muitinational design teams ensure that appropriate decisions are made con- cerning allocations of system functionality to common versus local code, adherence to inter- national standards, and, over time, the develop- ment of common tools. The approach also develops personal networks across borders and exposes the home office personnei to the en- vironment of foreign operations (and vice versa).
Parailel development is the third approach. Here, the project is broken into components, with each component developed by a different home office or subsidiary development team. One firm in- ciuded in the study was using this approach with a system cun-ently in the requirements stage. The iocation of particular development sites was seiected based on the availability of appropriate expertise and resources. The home office was scheduled to develop one significant module of the global system, whiie a European systems group was scheduled to develop a second. Each was expected to assist the other with require- ments determination. The respondent hoped that common development methodologies, shared software engineering toois, eiectronic maii, and consistent definitions of data would ensure close coordination and consistency in the resuiting application.
Few of the firms had considered a common methodology for systems development projects to facilitate cooperation in giobai projects, and there was iittie activity in impiementing common automated development tools across sub- sidiaries. Interestingiy, severai of the manufac- turers we interviewed already used common, automated design tools within their product or process engineering groups in different countries, but shared software deveiopment toois appear to lag far behind their engineering equivaients.
In summary, management must realize that giobal applications are expensive and difficult to develop and operate. Even when a home office system is transformed into a global system, designers must fuliy understand the simiiarities and differences in the underlying business pro- cesses across countries. The applications must also often be designed with 24-hour, seven-day- a-week support and operational requirements in mind. Maintenance must be ciosely orchestrated for duplicated systems. To aiiow development in centers in different parts of the world, common
46 MIS Quarterly/March 1991
Global Information Technology
development approaches, tools, and method- ologies must be agreed upon. But perhaps of most critical importance is the need to align the global appiications and application approaches with giobal business objectives.
multiple diverse business units, it is likely that one would find a diversity of both global business strategies and corresponding IT management approaches.
Future Research Directions The purpose of this study was to outline some of the key management issues in global infor- mation technology and broadly examine the phenomenon of giobal IT through semi-structured interviews with a relatively smail number of senior managers. This broad brush approach is ap- propriate given both the complexity of the area and the lack of previous literature. Future re- searchers may find it advantageous to focus on some of the specific "key management issues" identified here.
We have several practicai recommendations for conducting giobai iT research. First, we en- courage researchers to be creative and oppor- tunistic in studying some of the naturaiiy occurring experiments such as Europe 1992 or the opening up of Eastern Europe. "Living" with a muitinationai deveiopment team for a few months provides another fascinating naturai laboratory for studying project management and team management issues in a giobal area. Moreover, voice maii, electronic mail, and fax messages so common in these international in- terchanges provide artifacts of considerabie potentiai value to the interested researcher. Finai- iy, researchers shouid invoive schoiars located throughout the world in their projects to reduce the costs of research whiie fostering giobal learning. Our own globai messaging systems give us the infrastructure for coordinating giobal efforts, whiie providing us with experience par- ticipating in and managing our own giobal enterprise.
There are also iimitations of this research that may suggest additionai opportunities for future investigators. Our sampie size was smaii (only U.S.-based), and selected partiaily on the basis of convenience. Our conversations with the inter- viewees, though far ranging, were reiatively short and were biased by the interviewees' current con- cerns and fauity memories. Our starting point was business appiications rather than either the cor- poration or a specific business unit within that corporation. For a iarge, multinationai firm with
Conclusion By the year 2000, firms with woridwide operations will use advances in communications and com- puter technoiogy to ieverage their distinctive com- petencies. This may mean providing multinationai customers with a singular woridwide identity or being abie to quickiy adapt products to the re- quirements of different cultures and nationaiities. It may mean being able to shift production schedules from one country to another or pro- ducing iead-country products with common com- ponents and toois. Impiementing any of these strategies will require a major upheaval for existing IT applications and architectures—most of which were initially designed to support singie geographic markets and homogeneous hardware environments. These new business needs wiii require software and documentation that can be quickly enabled for particuiar nationai ianguages so that products available in one part of the world are nearly simultaneously made available throughout the worid. Top management will demand instant access to meaningful data from around the world. Engineers of global products wiii require giobal information on legal re- quirements, professional codes, product per- formance, and customer needs. These new strategies wiii require us to leverage scarce inteiiectual resources on a woridwide basis using knowledge systems, databases, and various communication systems.
In the future, many giobal applications will be inter- organizational. Multinational firms will require immediate access to information systems residing in the computer systems of nationai customs departments, freight forwarders and consoiidators, brokers, carriers, bankers, and insurers as well as their customers, suppliers, and channel partners. Participation in such net- works will require firms to have carefully integrated their own internal processing systems using inter- nationally recognized standards. Firms who fail to build those global and interorganizationai in- formation bridges wiii be increasingiy at a com- petitive disadvantage.
MIS Quarterly/March 1991 47
Global Information Technology
Acknowledgements We want to thank Peat Marwick Main Founda- tion for financial assistance on this project. We are aiso gratefui to Siddik Badruddin for his able research assistance and Michael Vitale for com- ments on a previous draft.
References
Bartlett, C.A. "Buiiding and Managing the Transnationai: The New Organizational Challenge," in Competition in Global In- dustries. M.E. Porter (ed.). Harvard Business School Press, Boston, MA, 1986.
Bartlett, C.A. and Ghoshal, S. Managing Across Borders: The Transnational Solution, Harvard Business Schooi Press, Boston, MA, 1989.
Business Week. " T h e Global 1000—The Leaders," July 17, 1989, pp. 139-145.
Buss, M.D.J. "Legislative Threat to Transborder Data Fiow," Harvard Business Review (62:3), May-June 1984, pp. 111-118.
Cariyle, R.E. "Managing IS at Multinationals," Datamation, March 1, 1988, pp. 54-57.
Carlyle, R.E. "The Tomorrow Organization," Datamation, February 1, 1990, pp. 22-29.
Cash, J.I., McFarlan, F.W., and McKenney, J.L. Corporate Information Systems Management: The Issues Facing Senior Executives, Irwin, Homewood, IL, 1988.
Chandran, R., Phatak, A., and Sambharya, R. "Transporter Data Flows: Impiications for Muitinational Corporations," Business Horizons (30:6), November-December 1987, pp. 74-81.
Couger, J.D. and Motiwaiia, J. "Occidental Versus Oriental IS Professionais' Perceptions on Key Factors for Motivation," Proceedings of the Sixth International Conference on Infor- mation Systems, Indianapolis, IN, December 1985, pp. 105-112.
Dagwell, R. and Weber, R. "System Designers' User Modeis: A Comparative Study and Methodoiogical Critique, Communications of the ACM (26:11), November 1983, pp. 987-997.
Datamation, "internationai Users: What the Worid Needs Now," May 1, 1988, Interna- tional Section, 48:1-4.
Egelhoff, W.G. "Strategy and Structure in Multinational Corporations: An Information- Processing A p p r o a c h , " Administrative Science Quarterly (27), 1982, pp. 435-458.
Feeny, D., Earl, M.N., and Stevenson, H. "Infor- mation Technoiogy and Giobal Strategy: From Trade-offs to Simultaneities," working paper, Oxford Institute of Information Management, Tempieton College, Oxford, 0X1 5NY, England, 1990.
Freeman, D.H. "Managing Information Systems at the Multinational," Infosystems (32:1), January 1985, pp. 58-62.
Harrington, L "Global EDI Language May Have Finaiiy Arrived," Traffic Management (27), April 1988, pp. 17-18.
Ho, T.H., Raman, K.S., and Watson, R.T. "Group Decision Support Systems: The Cuiturai Factor," Proceedings of the Tenth Interna- tional Conference on Information Systems, Boston, MA, December 1989, pp. 119-129.
Kane, M.J. and Ricks, D.A. "Is Transnational Data Flow Regulation a Probiem," Journal of International Business Studies (19:3), Fall 1988, pp. 477-482.
Keen, P.G.W. "An International Perspective on Managing Information Technoiogies," An ICIT Briefing Paper, International Center for Infor- mation Technoiogies, Washington, D.C, 1987.
Keen, P.G.W., Bronsema, G.S., and Zuboff, S. "impiementing Common Systems: One Organization's Experience," Systems, Qbjec- tives, and Solutions (2), 1982, pp. 125-142.
Kneitel, A.M. "Evoiving and Implementing a Worldwide Management Information System (IMS/MIS)," MIS Quarterly (4:3), September 1980, pp. 31-40.
Kumar, K. and Bj^rn-Andersen, N. "A Cross- Cultural Comparison of IS Designer Values," Communications of the ACM (33:5), May 1990, pp. 528-538.
Lerner, E.J. "Internationai Data Wars are Brewing," IEEE Spectrum (21:7), Juiy 1984, pp. 45-49.
Levitt, T. "The Globalization of Markets," Harvard Business Review (61:3), May-June 1983, pp. 92-102.
McCrohan, K.F. and Lowe, L.S. "Non-Tariff Barriers to International Data Flow," Industrial Management and Data Systems, May/June 1988, pp. 8-11.
Ohmae, K. "Managing in a Borderiess Worid,"
48 MIS Quarterly/March 1991
Global Information Technology
Harvard Business Review (67:3), May-June 1989, pp. 152-161.
Perlmutter, H.V. "The Tortuous Evolution of the Muitinationai Corporation," Columbia Journal of World Business (4:1), January-February 1969, pp.9-18.
Porter, M.E. Competition In Global Industries. Harvard Business School Press, Boston, MA, 1986.
Ouinn, E. "Giobal Push for OSI Standards," Euromoney, Special Report, August 1987, pp. 31-33.
Reck, R.H. "The Shock of Going Giobal," Datamation. August 1, 1989, pp. 67-69.
Reponen, T. and Copeland, D. "Finnpap/Finn- board," Harvard Business School, Case No. 9-186-130, December 1986.
Rowe, A.J., Mason, R., and Dickel, K. Strategic Management: A Methodological Approach. Addison-Wesley, Reading, MA, 1986.
Runyan, L. "Global IS Strategies," Datamation. December 1, 1989, pp. 71-72, 78.
Seiig, G.J. "Approaches to Strategic Planning for Information Resource Management (iRM) in Muitinational Corporations," MIS Quarterly (6:2), June 1982, pp. 33-45.
Smith, K.A. and Healy, P.E. "Transborder Data Flows: The Transfer of Medical and Other Scientific Information by the United States," Information Society (5:2), 1987, pp. 67-75.
Thompson, J. and Tayior, S. "Europe in 1992: Winning Through Technoiogy," Indications. index Group, Five Cambridge Center, Cam- bridge, MA 02142, 1988.
Wiggin, G. "The Goiden Ruies of Giobai Net- working," Datamation (33:19), October 1, 1987, pp. 68-73.
About the Authors Blake Ives is the Constantin Distinguished Professor of Management Information Systems at the Cox Schooi of Business at Southern Methodist University. Professor Ives has been a distinguished feiiow at the Oxford Institute for In- formation Management at Templeton College, Oxford, and a Marvin Bower Faculty Feiiow at the Harvard Business Schooi. He is currently an honorary research associate at Victoria Univer- sity of Weilington, New Zealand, and an associate feiiow at Templeton College. He receiv- ed his Ph.D. in management information systems from the University of Minnesota. He is a frequent contribtor to MIS Quarterly and has pubiished In numerous management and information systems journals; he aiso serves oh several editoriai boards. Professor Ives' recent research focuses on customer service, the competitive use of information technoiogy, globai information systems, and the roie of the senior information systems executive.
Sirkka L. Jarvenpaa is associate professor of information systems at the University of Texas at Austin. She received her Ph.D. in management information systems from the University of Minnesota in 1986. Dr. Jarvenpaa has pubiished articles in such journals as MIS Quarterly. Com- munications of the ACM, Management Science, Information Systems Research, International Journal of Man-Machine Studies, and the IEEE Transactions on Systems, Man, and Cybernetics. Her research interests inciude behaviorai and organizational aspects of information technology. In her most recent research program, she examines giobai information systems.
MIS Quarterly/March 1991 49
Week4/Course1-InfoTech in a Global Economy (ITS-832-06)/Professor Readings/innovation global economy.pdf
Reproduced with permission of the copyright owner. Further reproduction prohibited without permission.
Is geographical proximity necessary in the innovation networks in the era of global economy? Rallet, Alain;Torre, Andre GeoJournal; 1999; 49, 4; ABI/INFORM Global pg. 373
Reproduced with permission of the copyright owner. Further reproduction prohibited without permission.
Reproduced with permission of the copyright owner. Further reproduction prohibited without permission.
Reproduced with permission of the copyright owner. Further reproduction prohibited without permission.
Reproduced with permission of the copyright owner. Further reproduction prohibited without permission.
Reproduced with permission of the copyright owner. Further reproduction prohibited without permission.
Reproduced with permission of the copyright owner. Further reproduction prohibited without permission.
Reproduced with permission of the copyright owner. Further reproduction prohibited without permission.
Week4/Course1-InfoTech in a Global Economy (ITS-832-06)/Professor Readings/KresselHenryLen_2012_5SpeedingVoiceAndData_EntrepreneurshipInThe.pdf
131
The network will truly be the computer.1
If you happen to make a wireless phone call to China, it may
be routed through a microprocessor chip produced by Raza
Microelectronics Inc. Although RMI (later merged with NetLogic
Microsystems) only began supplying integrated circuits in mid-
2005, its microprocessors now power some of the most advanced
communications network equipment in the world, and it counts
the leading Chinese equipment suppliers among its customers.
It has become the acknowledged technology leader in its chosen
market.
How a Silicon Valley startup developed the world’s most
sophisticated network microprocessor is a remarkable story. It is also
especially relevant to our theme of global entrepreneurship, because
RMI’s success hinged as much on its understanding of international
markets as on its technical expertise.
RMI’s management realized early on that overseas markets
were more open to network chip innovations from a startup than the
domestic US equipment manufacturers, who had well-established
chip suppliers with long-standing reputations. So the company
decided that its primary sales target should be China, the world’s
fastest-growing network equipment maker.
This may seem like an odd choice. China has become the
world’s factory. Its trade surplus with the US has risen from $202
billion in 2005 ($243 billion in exports vs. $41 billion in imports) to
5 Speeding voice and data traffic worldwide: Network microprocessors from RMI
1 http://googlesystemblogspot.com/2006/11/network-will-truly-be-compter.html, accessed November 4, 2011.
C o p y r i g h t 2 0 1 2 . C a m b r i d g e U n i v e r s i t y P r e s s .
A l l r i g h t s r e s e r v e d . M a y n o t b e r e p r o d u c e d i n a n y f o r m w i t h o u t p e r m i s s i o n f r o m t h e p u b l i s h e r , e x c e p t f a i r u s e s p e r m i t t e d u n d e r U . S . o r a p p l i c a b l e c o p y r i g h t l a w .
EBSCO Publishing : eBook Collection (EBSCOhost) - printed on 1/26/2020 4:19 PM via UNIVERSITY OF THE CUMBERLANDS AN: 465765 ; Kressel, Henry, Lento, Thomas V..; Entrepreneurship in the Global Economy : Engine for Economic Growth Account: s8501869.main.ehost
Speeding voice a nd data tr a ffic wor ldw ide132
$273 billion in 2010 ($365 billion vs. $92 billion).2 American busi-
nesspeople and government officials routinely complain that, while
China floods the US with manufactured goods, the Chinese market
is closed to American products. But RMI’s success in China proves
that its market is very open to innovative products no matter where
they originate.
RMI also embodies another common characteristic of the suc-
cessful technology startups surveyed in this book: it was built by
immigrants. Its founder and first CEO, Atiq Raza, was born in Pakistan,
while his successor, Behrooz Abdi, is a native of Iran. The drive to suc-
ceed, tolerance for risk, and comfort with international dealings that
marks the educated immigrant community must be counted as an
important element in the company’s growth and success.
However, while global perspective and immigrant origins cer-
tainly help, they aren’t the whole story. Ultimately every success-
ful startup enterprise is built on the same foundation: recognizing
and filling an unmet market need. In RMI’s case, it was an urgent
demand for ever-higher speeds in network communications. This is
the story of how the company met that need through technical break-
throughs, business savvy, and the flexibility to adapt to changes in
the business environment.
Information autobahn
The demand for more speed in communications networks has been
building for decades, and shows no sign of abating. It really started
to ramp up about thirty years ago, when the Internet was just getting
started. At that time only large corporations could afford digital net-
work connections, and they ran over dedicated lines that were closed
to everyone else.
Smaller organizations and individuals had to make do
with analog telephone lines, using devices called modems (for
2 www.census.gov/foreign-trade/balance/c5700.html#2010, accessed September 9, 2011.
EBSCOhost - printed on 1/26/2020 4:19 PM via UNIVERSITY OF THE CUMBERLANDS. All use subject to https://www.ebsco.com/terms-of-use
Infor m ation autoba hn 133
modulation/demodulation) to convert digital data to and from ana-
log transport modes. Early modems could handle a maximum of 300
bps (bits per second) of data. Eventually modems reached top speeds
of 56 kbps (thousands of bits per second). This was the equivalent of
about three typewritten pages per second.3
Today’s data networks are end-to-end digital. Comparing ana-
log modem speeds to what can be achieved in the digital realm is
like matching a slow stroll on a suburban sidewalk to a Grand Prix
race car on the autobahn. Broadband wired Internet connections
can deliver data at up to 100 Mbps (millions of bits per second) –
or 120 copies of the complete works of Shakespeare every minute.
Wireless is slower, but even the latest cell phones are capable of up
to 10 Mbps.
Digital data networks emerged on a global scale in the 1990s,
fueled by the rise of the Internet and its enormous data-handling and
security requirements. As people demanded ever more data-inten-
sive digital applications on their personal computers and wireless
handsets, the pressure to provide faster transmission speeds showed
no sign of lessening.
RMI was founded precisely to meet this demand for faster data
traffic. But providing higher data speeds isn’t as simple as stepping on
an accelerator. In order to appreciate the magnitude of the achieve-
ment, it is necessary to understand the basics of modern networks
and the hardware that runs them.
Routing bits and packets
The speed, flexibility, and reliability of digital communications,
from the simplest text email to video on the Web, are a direct out-
come of their “packetized” network structure.
Analog networks carry a continuous stream of information
that must be kept intact from origin to end-point. Digital networks
3 See www2.sims.berkeley.edu/research/projects/how-much-info/datapowers.html (accessed September 9, 2011) for a handy table by Roy Williams that matches various quantities of digital data with everyday forms of information.
EBSCOhost - printed on 1/26/2020 4:19 PM via UNIVERSITY OF THE CUMBERLANDS. All use subject to https://www.ebsco.com/terms-of-use
Speeding voice a nd data tr a ffic wor ldw ide134
are built on the radical concept that you can break up information
into smaller units, called packets, and send them as separate com-
ponents, to be reassembled into a single communication at their
destination.
This structure has two main benefits: the network can carry
many individual communications at the same time; and individual
portions of each message (the packets) can travel different routes to
their destination without destroying message integrity.
It may take millions of packets to contain the content of a
single data transmission. Each packet has two parts: the payload, or
data that has to delivered, and a header that identifies the packet’s
origin, contents, and destination.
The header is the crucial part of the message from the net-
work’s point of view – the payload is not so important. In fact, header
instructions can account for as much as half of a packet’s total bits.
Headers contain more than simple routing information – much
more. They identify the order in which packets are to be reassem-
bled, and ensure the packets are treated properly as they travel to
their destination. When the message includes voice and video, for
example, headers tell the network to treat the packets in such a way
that the contents play back smoothly at their destination.
When packets in a single transmission travel along different
routes to their destination, they may arrive out of sequence. This
is because the computers that direct the data traffic along the way,
appropriately called routers, are independent engines, giving the net-
work built-in redundancy. If one segment goes down, or a router is
busy, packets can be rerouted to their destination through alternate
paths.
At the end of the journey, a router must reassemble the mes-
sage in the proper sequence. Since data travels over an optical fiber
cable at the speed of light, the biggest limiting factor in network
speed is clearly the routers that analyze headers and move the pack-
ets to their destination. In order to speed up the network, faster rout-
ers must be created.
EBSCOhost - printed on 1/26/2020 4:19 PM via UNIVERSITY OF THE CUMBERLANDS. All use subject to https://www.ebsco.com/terms-of-use
Infor m ation autoba hn 135
Microprocessors: Breaking the router bottleneck
That’s where RMI’s focus on faster microprocessors comes into play.
A router is simply a special-purpose computer, and microprocessor
chips are the brains of computing systems. To make routers work
faster, the speed of their microprocessors must be increased.
Anyone familiar with electronic products tends to talk about
microprocessors as if they always existed. In fact, it was only in the
1970s that a single microprocessor began to replace the cluster of
integrated circuit chips on a circuit board that formed the central
processing units (CPUs) of previous computers.
The concept of a single chip designed to perform the core com-
puting operations originated at Intel. Its first commercial micro-
processor chip, dubbed the 4004, was introduced in 1971. The 4004
contained only 2100 transistors, but it had the same computing power
as the ENIAC computer of World War II vintage, which weighed 30
tons, occupied 3,000 cubic feet and used 18,000 vacuum tubes.4 (Of
course, this was before the invention of transistors.)
Gordon Moore, co-founder of Intel, saw the microprocessor as
an alternative to building custom chips for each computing system.
He described the device as “a broadly applicable, complex integrated
logic circuit that can be produced in huge volume, and hence [at] low
cost, and that utilizes the technology advantageously.”5
Moore’s idea was that all computing could be handled by soft-
ware running on a general-purpose microprocessor. Instead of hav-
ing custom hardware (chips) for each application, the microprocessor
would carry out all basic computational operations, with software
supplying application-specific functions. This would result in com-
puting systems that were both faster and cheaper, because these ver-
satile chips would be mass produced.
4 M. White, “25th anniversary for microprocessor,” Toronto Star, November 17, 1996.
5 G. E. Moore, “Microprocessors and integrated electronics technology,” Proceedings of the IEEE, vol.64 (1976), pp. 837–841.
EBSCOhost - printed on 1/26/2020 4:19 PM via UNIVERSITY OF THE CUMBERLANDS. All use subject to https://www.ebsco.com/terms-of-use
Speeding voice a nd data tr a ffic wor ldw ide136
Moore’s vision of huge production volumes has been fulfilled
beyond anything he could have predicted. Today microprocessors are
everywhere, at all levels of performance. There are hundreds at work
for each human being in the world. As the speed and performance
of microprocessors have improved, and their cost has dropped, they
have found their way into everything from toys to washing machines
to large computers and communications systems.
In his famous “Moore’s Law,” the Intel founder also predicted
that the processing power of chips would double every two years
with no increase in price. This was based on the rate at which tran-
sistors were being shrunk in size, permitting more logic gates (and
higher performance) on each chip. Making transistors smaller thus
meant getting more speed for less money. But gate dimensions could
shrink only so far before they began to bump up against physical
constraints on performance. In particular, the power dissipated by
very-high-performance chips became excessive, and cooling them
increased the size and cost of the systems.
Fortunately, another path forward had emerged: multiple proc-
essors on a single chip working in parallel to process data. In these
configurations each processor core has its own resources, but shares
access to centralized control functions, including instructions and
data storage. Since the individual processors have significant auton-
omy in the execution of instructions, this arrangement achieves
much higher processing speeds even if the speeds of the individual
cores do not increase.
Parallel processing is not a new idea. It was the architecture of
choice in powerful mainframe computers that combined many dis-
crete processor chips. Designing a microprocessor chip containing a
group of suitably interconnected processor cores, however, is new. To
make such a device work called for not only extraordinary engineer-
ing skills but also the invention of new technology.
Multicore processors were just beginning to appear in the mar-
ket in 2002, the year RMI was founded. It was the challenge of design-
ing such devices to greatly speed up data networks that attracted
EBSCOhost - printed on 1/26/2020 4:19 PM via UNIVERSITY OF THE CUMBERLANDS. All use subject to https://www.ebsco.com/terms-of-use
R ea dy for innovation 137
the company’s founding engineers. Their idea was to create a whole
new family of multicore microprocessors that would dramatically
increase the capacity of networks to meet the ever-growing demand
for higher-speed communications.
To do so, they had to design chips that processed the routing
information in packet headers in parallel rather than in the serial
manner of then-current single-core processors. This required the
invention of a novel chip architecture where multiple individual
processors were synchronized and shared timely access to infor-
mation needed to complete a computing task. This rapid access to
common information would enable a remarkable increase in packet
processing speed, eliminating the major bottleneck in data network
operation.
Designing the new chips was only the beginning. RMI’s cus-
tomers, the companies that built the routers, would have to learn
how to program the chips to meet their equipment objectives. For
this reason the microprocessors would have to be designed for versa-
tile programming. This opened the way for RMI’s customers to write
software that differentiated their network products by lower cost,
improved performance, and a superior ability to incorporate secur-
ity control. RMI’s founders were uniquely qualified to achieve these
goals.
Ready for innovation
Atiq Raza, the Pakistan-born founder of RMI, earned his degree in
physics and philosophy at the University of the Punjab, and then
moved to the US. He founded his first startup, NexGen, in 1988,
where he developed a general-purpose microprocessor designed to
compete with Intel’s top-of-the-line products. It was the first com-
pany to challenge Intel in the high-end microprocessor market.
Developing such a highly sophisticated product involved extra-
ordinary effort. NexGen had to avoid infringing Intel patents or copy-
rights, yet deliver products that were interoperable with Intel chips. It
took until 1995 for the company to develop a marketable product.
EBSCOhost - printed on 1/26/2020 4:19 PM via UNIVERSITY OF THE CUMBERLANDS. All use subject to https://www.ebsco.com/terms-of-use
Speeding voice a nd data tr a ffic wor ldw ide138
At the same time AMD, a big chip manufacturer with a
license to serve as a second source for Intel processors, was also
committed to breaking the Intel monopoly. It attempted to design
its own microprocessors, but failed to come up with a competitive
product.
For AMD the obvious next move was to acquire NexGen.
AMD paid $850 million in AMD stock for the company, laying the
foundation for AMD to launch a series of successful chips to com-
pete with Intel. Raza joined AMD where, as president and chief oper-
ating officer, he led the microprocessor product line as it established
itself against Intel.
But not for long: always looking for the next challenge, Raza
left AMD in 1999 to become a venture capital investor. His idea was
to incubate new technology companies, and manage their growth
to the point where they would become attractive acquisition candi-
dates. Raza launched a number of companies but, when financing
startups proved difficult after the public market crash of 2000–2001,
he decided to refocus his efforts on building a single company tar-
geting specially designed microprocessor chips to improve data
traffic on networks. With the explosive growth of Internet traffic,
the amount of data carried was believed to be doubling every three
months, so better equipment, powered by faster microprocessors,
was urgently needed.
Raza founded RMI in 2002 specifically to launch a new gen-
eration of microprocessors that were designed to deliver a dramatic
increase in data network performance. This was clearly a growing
market that would be targeted by others, so RMI was off to a race to
be first with the best. In a first for the industry, these new products
would incorporate eight powerful, closely linked processor cores on
the same chip.
In addition to novel ideas, his competitive edge in starting
the company was a team of exceptional managers who had worked
with him before. These included Waqar Shah (head of operations),
Dr. Nazar Zaidi (head of product development), Dave Hass (product
EBSCOhost - printed on 1/26/2020 4:19 PM via UNIVERSITY OF THE CUMBERLANDS. All use subject to https://www.ebsco.com/terms-of-use
R ea dy for innovation 139
architect), and Dr. Kai-Yeung (Sunny) Siu (head of sales and market-
ing for Asia).
Silicon Valley is the kind of place where talented engineers are
always willing to leave big companies to join a promising startup.
Raza’s reputation in Silicon Valley constituted a very high level of
promise. Everybody knew he had led the only successful challenge
to Intel’s monopoly in high-end microprocessors.
In a remarkably short period of time he assembled sixty of the
best microprocessor design engineers in the world. Their mission
was to produce the industry’s best single-chip data network micro-
processor. That’s the kind of challenge that gets the juices flowing
in that part of California. All that remained to be done was raising
enough venture capital to get to the finish line.
This is where Warburg Pincus came in. Our team was intro-
duced to Raza and his startup in 2002. Whether the proposed prod-
uct would find a ready market was not at issue. It was evident that
the rapidly increasing demand for data network traffic was spurring
a corresponding need for equipment to meet the demand.
What was startling was the ambition of the plan. There was no
precedent for the proposed product family in terms of performance
and value. Only a world-class talent had a hope of succeeding. What
convinced us to help fund the company (along with Benchmark
Capital) was Raza’s reputation and the quality of the team that he
had assembled. If any group could succeed, we concluded, it was
this one.
RMI had talent in the realms of both software and chip design.
It created and refined a set of specifications for the new product in
the process of consulting with potential customers. Production of
the actual chips was contracted to TSMC in Taiwan, the world’s
leading contract chip manufacturer.
This class of semiconductor products is not sold simply as a
chip but as part of a total solution, including the software needed
to integrate the processor into network equipment. Therefore, RMI
started a software development organization in India under the
EBSCOhost - printed on 1/26/2020 4:19 PM via UNIVERSITY OF THE CUMBERLANDS. All use subject to https://www.ebsco.com/terms-of-use
Speeding voice a nd data tr a ffic wor ldw ide140
leadership of an Indian engineering manager who had returned home
after a ten-year career in the US.
RMI was an international company from the start. In 2009, out
of about 300 employees, about 40 percent were in India and Asia.
The core chip development team stayed in the US, but a large num-
ber of the managers and engineers in the US were born outside the
country.
Furthermore, recognizing that China was likely to be an
important market, RMI had Dr. Sunny Siu build a customer engin-
eering support organization in China. Born in China, Dr. Siu had
earned a Ph.D. from Stanford University in electrical engineering
and had served as assistant professor at MIT – another example of
the phenomenon of Chinese-born technologists moving back to
China and serving as “bridges” between US companies and Chinese
customers.
So, before actually having products to ship in volume, RMI
had prepared the ground to deal with Asian customers to smooth the
sales process.
Product launch
The first of RMI’s new generation of multi-core microprocessors was
completed for customer sampling in 2004, and released for produc-
tion in 2005. It took three years from start to finish. Given the com-
plexity and novelty of the technology, this is record time for getting
a product to market.
Its reception was outstanding. “A new MIPS powerhouse
arrives,” was the headline of the lead article in Microprocessor
Design, the respected industry newsletter, on May 17, 2005. The
article detailed how RMI’s product had outclassed the competition
and was opening new markets. To start with, it delivered a ten-
fold increase in packet processing speed compared to other devices
doing the same job. The article quoted Raza as saying, “The XLR
processor design is my greatest accomplishment to date. It is the
first architecture in my experience that met every architectural
EBSCOhost - printed on 1/26/2020 4:19 PM via UNIVERSITY OF THE CUMBERLANDS. All use subject to https://www.ebsco.com/terms-of-use
Product launch 141
goal set for it. Today, this is the highest throughput machine on
the planet.”6
Once RMI’s new product was available, there were some inter-
esting market developments around it. You would have thought that
the first serious customers would be in the US. In fact, they were
in China and Israel. Why? After the failure of a number of US chip
startups in the period following the 2000 market crash, US network
equipment manufacturers became apprehensive of committing new
generations of their equipment to products from private companies
with uncertain economic futures.
At the time RMI was not yet profitable. As a result, although
Juniper in the US and a small network equipment company in Israel
designed the RMI microprocessor into their products, the company’s
success was built on its overseas customers. Sales outside of the US
grew rapidly because new equipment manufacturers in emerging
economies were willing to take a chance on buying from a startup.
The advanced performance of RMI’s new microprocessor gave them
a competitive edge against the dominant vendors in the market, such
as Alcatel and Cisco Systems.
China was home to the most important early customers. These
included Huawei and ZTE, the fast-growing national telecommu-
nications equipment vendors that dominated the Chinese market.
RMI benefited from the explosive growth not only of Internet traffic
but also of wireless traffic, as shown in Figure 5.1. In addition, both
Huawei and ZTE were developing overseas markets for their prod-
ucts. The number of wireless subscribers in China was booming and
local service providers needed equipment to keep up with service
demand. RMI’s microprocessor became the technological underpin-
ning of a new generation of equipment for the local Chinese carriers
such as China Mobile.
As a result of its early focus on Asian customers, RMI had the
right organization on the ground to take advantage of the opportunities
6 K. Krewell, “A new MIPS powerhouse arrives,” Microprocessor Design, May 17, 2005, pp. 1–7.
EBSCOhost - printed on 1/26/2020 4:19 PM via UNIVERSITY OF THE CUMBERLANDS. All use subject to https://www.ebsco.com/terms-of-use
Speeding voice a nd data tr a ffic wor ldw ide142
created by the booming Asian telecommunications market. In 2007
sales in the Asia-Pacific region were $52 million. Sales in the US were
$8 million, and in the rest of the world only $4.6 million.
Transition
In mid-2007 Atiq Raza resigned from the company he had created
and guided to success to return to venture capital management. He
was replaced as CEO by Behrooz Abdi.
Though born in Iran, Abdi received his B.S. degree from
Montana State University and an M.S. degree in electrical engin-
eering from the Georgia Institute of Technology. He joined RMI
from Qualcomm Inc., where he had been Senior Vice President and
General Manager of the chip division. Prior to Qualcomm he had
been at Motorola, where he headed the Radio Products Division.
Abdi joined RMI at just the right time to take it to the next
level as a market leader. His experience with wireless technology
at Qualcomm and Motorola was an enormous asset in this effort
because wireless networks were exactly the market where RMI had
the most to gain. In choosing Abdi, RMI had positioned itself to
adapt to new market realities.
Figure 5.1 Wireless data traffic volume growth by year (figures for 2012 and later are projected). Source: From IBS, private communications, 2011.
EBSCOhost - printed on 1/26/2020 4:19 PM via UNIVERSITY OF THE CUMBERLANDS. All use subject to https://www.ebsco.com/terms-of-use
Product launch 143
With over 100 patents either issued or pending, the com-
pany had an impressive portfolio of intellectual property to support
expansion into new markets. But it faced a challenge common to all
startup enterprises: the need for more revenue to solidify and extend
its early success. Although its first generation of products had been
launched to great acclaim, RMI had to gain widespread customer
acceptance and build revenues rapidly if it wanted to head off the
competitive pressures it would inevitably face from later entrants
into its market segment.
Abdi’s approach to this challenge was to turn the complex
nature of RMI’s network products into a competitive advantage by
helping its customers design their equipment. In effect, RMI set out
to deliver not only chips but also the software to integrate them into
its customers’ extremely complex communications equipment. This
was particularly important for new Asian equipment builders, who
lacked some of the established engineering skills that US companies
such as Cisco, Juniper, or Lucent had accumulated over the years.
As a result, RMI found itself increasingly in the position of a
system enabler. In addition to expanding its internal chip design and
support organizations, it had to develop a cadre of collaborative soft-
ware vendors if it was to win new customers. It needed these indus-
try partners to provide the enabling software for its customers.
Drawing on his extensive background in communications sys-
tems, Abdi built an ecosystem of over one hundred corporate part-
ners. These organizations developed and sold complementary chips
and software that allowed the company’s customers to build their
products in record time around RMI chips.
By 2008 RMI had over 200 customers and revenues of $79 mil-
lion, an increase of 25 percent from the prior year. It had proven that
it understood the network equipment market, had the technology to
meet its needs, and could work in a global environment. It was in a
good position for future growth – but it needed an infusion of new
capital to fund its expansion. Though successful, it was not yet prof-
itable due to its heavy investment in product development.
EBSCOhost - printed on 1/26/2020 4:19 PM via UNIVERSITY OF THE CUMBERLANDS. All use subject to https://www.ebsco.com/terms-of-use
Speeding voice a nd data tr a ffic wor ldw ide144
Under normal circumstances, the right place to raise this cap-
ital would be the public market. Accordingly Goldman Sachs was
selected to underwrite an IPO on NASDAQ in mid-2008 – just before
the US mortgage crisis triggered a stock market debacle and the deep-
est recession since 1929.
After the 2008 market crash an IPO was clearly impossible.
The company’s board of directors was faced with the task of plan-
ning a different future for RMI.
Weighing options
Deprived of the ability to raise capital in the public markets, RMI’s
directors had two strategic choices.
Keep the company independent; reduce product development costs to • maintain profitability.
Merge RMI with a public company with complementary products and a • similar customer base, in the expectation that the combined companies
would have enough resources to continue their growth.
Staying independent posed the bigger risk. If RMI chose that
course, it would have to cut back on new product development, pos-
sibly mortgaging its future. In a highly competitive industry like
microprocessors, inadequate investment in product development
could be fatal. There were already a number of bigger competitors
racing to overtake RMI’s lead.
If, on the other hand, the company chose the merger route, it
would obviously have to find the right partner. As it happened, in the
course of building RMI’s industry ecosystem, Behrooz Abdi had run
across a compatible company.
RMI merges with NetLogic
NetLogic Microsystems was the world leader in a specialized cat-
egory of semiconductor chips called knowledge-based processors
(KBP). These chips incorporate massive parallel signal processing
with content-addressable memories (CAM), which store the data
EBSCOhost - printed on 1/26/2020 4:19 PM via UNIVERSITY OF THE CUMBERLANDS. All use subject to https://www.ebsco.com/terms-of-use
R MI merges w ith NetLogic 145
needed to move data packets to their destinations. Such specialized
memories can greatly increase a router’s processing speed.
We have already seen that the headers on data packets carry
information to identify packet contents, origin, and ultimate destin-
ation. When the microprocessor in a router analyzes each packet’s
header to determine its destination, it must then look up informa-
tion in its own routing tables to decide how to send the packet on the
next leg of its journey through the network.
CAMs are specially designed to increase the efficiency of the
process of matching a packet’s address information with its destin-
ation path, while meeting network security requirements at the same
time. You can think of the operation as similar to the mail-sorting
procedure in an old-fashioned post office, where the routing informa-
tion for each letter is stored within easy reach of the sorting clerk.
After extensive meetings between the investors and the
managements of RMI and NetLogic, we mutually concluded that
by combining the two companies we would produce a technology
leader with a market position superior to what either company could
achieve on its own.
One avenue of potential growth opened up by this merger,
for example, was the combined company’s ability to develop prod-
ucts that more closely integrated packet processing with NetLogic’s
chips. This would allow customers to increase network performance
while reducing chip costs. In addition, the merger would realize sub-
stantial financial benefits by combining two sales, marketing, and
product development organizations into one, thus reducing admin-
istrative overhead.
We agreed that RMI would exchange its shares for new NetLogic
shares so that shareholders in both companies could benefit from
the new value created by the merger. The merger was completed in
October 2009. RMI’s shareholders ended up with about 20 percent of
the shares of the combined company.
Behrooz Abdi joined NetLogic as executive vice-president
and general manager. In 2010 NetLogic introduced a new family of
EBSCOhost - printed on 1/26/2020 4:19 PM via UNIVERSITY OF THE CUMBERLANDS. All use subject to https://www.ebsco.com/terms-of-use
Speeding voice a nd data tr a ffic wor ldw ide146
microprocessors that had been in development at RMI. These prod-
ucts extended the market leadership of RMI’s previous offerings,
delivering over four times the processing power at the same price as
its nearest competitors, including entries by Intel. Needless to say,
they were very well received.7
They also required a heavy investment in engineering expert-
ise. You get an idea of the engineering requirements for this kind of
company from its manpower: out of a total staff of 650 at the end of
2010, over 60 percent were engineers.
Despite this technology investment, NetLogic’s financial
performance after the merger did not disappoint its shareholders.
Revenues in 2010 reached $382 million (38 percent in China). Its
market capitalization was about $3 billion in March 2011. This
meant that the shareholders of RMI were credited with a value of
about $600 million for their part of the ownership.
Looking back
RMI successfully challenged the biggest companies in its business
with products that required a unique set of skills. In fact, when the
company was started in 2002, there were only two companies in the
world with the technical skills to design such products. One was
Intel, the industry pioneer and leader in microprocessors. The other
was AMD, whose ability to compete in the market was largely the
result of the initiatives of Atiq Raza, the founder of RMI. However,
neither of these big companies addressed the market that RMI
identified.
But there is a sobering message in this story. Despite having
performed an extraordinary feat of product engineering, its ultimate
destiny as a business was not as a standalone company. The reason is
that an enterprise committed to RMI’s class of highly sophisticated
products requires an enormous investment of resources for continued
7 T. R. Halfhill, “NetLogic broadens XLP family,” Microprocessor Design, July 2010, pp. 1–11.
EBSCOhost - printed on 1/26/2020 4:19 PM via UNIVERSITY OF THE CUMBERLANDS. All use subject to https://www.ebsco.com/terms-of-use
Look ing back 147
success in the international market. Most startups simply don’t have
the resources to sustain that level of investment unless they have
access to the kind of capital available from public markets.
Still, the story of pre-merger RMI is valuable for what it tells us
about the way entrepreneurs and investors have to think in a global
market. Here are some of the most important points to consider.
Management changes can be healthy. A large part of RMI’s
success must be credited to two outstanding entrepreneurs: Atiq
Raza and Behrooz Abdi. Raza was the visionary leader who got the
breakthrough product designed and launched. Abdi took the com-
pany to the next stage, launching the second-generation product
family while ensuring revenues from the first. His work in build-
ing an ecosystem of complementary software and hardware products
to win customer acceptance was critical to the company’s growth
strategy.
There is no substitute for access to international talent. RMI
attracted outstanding talent from around the world right from the
start. Engineers from India, Pakistan, and China were prominent
both in the Silicon Valley location and in the overseas location.
Their geographical dispersion and their understanding of different
markets, to say nothing of their talent, played a large role in the
penetration of the Asian market.
Startups are often viewed with suspicion by big customers in
the developed economies. The more strategic the component, the
more difficult it is to convince big customers to bet their new prod-
uct lines on an offering from a startup. This was the case with big
companies whose concern about the financial stability of RMI pre-
cluded their purchase of its microprocessors.
A global outlook can lead to willing buyers. RMI’s ability to
address the needs of Asian customers saved the company. Equipment
manufacturers in Asia were more focused on using the most advanced
chips than on the financial viability of their vendors. They wisely
concluded that companies with winning products get financed, and
that their support would make that happen. The company’s ultimate
EBSCOhost - printed on 1/26/2020 4:19 PM via UNIVERSITY OF THE CUMBERLANDS. All use subject to https://www.ebsco.com/terms-of-use
Speeding voice a nd data tr a ffic wor ldw ide148
success in selling in China and the Asia-Pacific region, however, was
no accident. Right from the start RMI had outstanding marketing and
customer support management located there, and it actively engaged
with potential customers while the products were being designed. It
takes years of effort and very talented people on the ground to gain
the respect of new customers. RMI was prepared.
Industry consolidation is a fact of life. The best products in
the world are no substitute for business scale. This is especially true
for technology companies, which require costly and ongoing invest-
ments in product development. Despite high gross profit margins of
60 percent, RMI was never profitable as an independent company. It
was constantly pouring money into new products, a necessity in an
industry where products are obsolete in less than three years. Under
these circumstances any company with the ambition to remain
independent needs access to large amounts of capital at attractive
valuations.
In the 1990s public markets were very open to financing com-
panies such as RMI. The crashes of 2000 and 2008, however, made
the timing of IPOs problematic. The investors’ decision to merge
RMI with NetLogic recognized that the combined companies would
create more value for their shareholders than if they were independ-
ent. This turned out to be the case – NetLogic remained profitable
after the RMI merger and was valued as a very high performance
growth company – over six times annual revenues. It also spends
nearly 40 percent of its revenues on product development. This is
what it takes to stay a winner in the microprocessor game. NetLogic
was in turn acquired by Broadcom in 2012.
In the next chapter we’ll look at a very different approach
to a similar situation: a company that leveraged IP and partner-
ships, instead of mergers, to reach a scale where it could remain
independent.
EBSCOhost - printed on 1/26/2020 4:19 PM via UNIVERSITY OF THE CUMBERLANDS. All use subject to https://www.ebsco.com/terms-of-use
Week4/Course1-InfoTech in a Global Economy (ITS-832-06)/Professor Readings/KresselHenryLen_2012_7ImplementingInformat_EntrepreneurshipInThe.pdf
172
Technology companies and global investors are beating a path to Israel and finding unique combinations of audacity, creativity and drive everywhere they look.1
If you mention a successful startup called Ness Technologies, there
is a good chance that a US listener will assume it is one of those
high-technology Silicon Valley companies. That listener would be
mistaken. Ness Technologies is a multinational information tech-
nology (IT) services corporation, created in Israel in 1999. It is also
the first company in this book that does not have its headquarters
in the US.
This chapter will examine how the Israeli entrepreneurs who
founded Ness dealt with the challenges of a global marketplace.
Within five years of its founding, this Israeli startup became a lead-
ing company in its field with operations in Asia, Europe, and the
Americas. Its rapid rise to prominence has fully justified its name,
which means “miracle” in Hebrew. It did so by melding subsidiaries
in countries with cultures as diverse as Bulgaria and Thailand into
a global corporate culture, with a common set of goals and expecta-
tions that was held across national boundaries.
Demand for IT services resh apes the world
Ness Technologies is a provider of IT services to other compan-
ies. As such it didn’t “invent” any basic technology. Like Ronald
Stanton’s Transammonia, its innovations took the form of a new
7 Implementing information technology across the globe
1 D. Senor and S. Singer, Start-up nation: The story of Israel’s economic miracle (New York: Twelve, Hachette Book Group, 2009), p. 11. This book contains a wealth of information about the Israeli environment for new business building.
C o p y r i g h t 2 0 1 2 . C a m b r i d g e U n i v e r s i t y P r e s s .
A l l r i g h t s r e s e r v e d . M a y n o t b e r e p r o d u c e d i n a n y f o r m w i t h o u t p e r m i s s i o n f r o m t h e p u b l i s h e r , e x c e p t f a i r u s e s p e r m i t t e d u n d e r U . S . o r a p p l i c a b l e c o p y r i g h t l a w .
EBSCO Publishing : eBook Collection (EBSCOhost) - printed on 1/26/2020 4:20 PM via UNIVERSITY OF THE CUMBERLANDS AN: 465765 ; Kressel, Henry, Lento, Thomas V..; Entrepreneurship in the Global Economy : Engine for Economic Growth Account: s8501869.main.ehost
Dem a nd for IT serv ices r esh apes the wor ld 173
business model and new approaches to international service. Unlike
Transammonia, however, Ness operated in an industry character-
ized by the most rapidly advancing technology in history. Even those
who lived through the rise of the computer can hardly believe how
quickly and profoundly digital data processing has changed the way
the world does business.
In just twenty years, between 1980 and 2000, corporations
replaced the river of paper that had carried business forward for cen-
turies with a stream of digital information flowing through wires.
Computers and associated software flooded into offices to handle
all aspects of business, including payrolls, supply management, cus-
tomer billing, and everything in between. This transformation, from
a paper-trail business model to a digitally wired one, required enor-
mous investments in successive generations of hardware. Processors
evolved from big, centrally located machines, accessed with “dumb”
terminals, to networked business computers. When low-cost PCs
became available most employees got their own.
As computers proliferated in every aspect of business, enter-
prises faced an urgent need to implement and manage their software
and communications infrastructure. To satisfy this need companies
began hiring IT specialists to configure and operate their systems.
They soon faced a classic supply-and-demand problem. Because of
the rapid growth in demand, skilled IT engineers were suddenly
in short supply. Predictably, a proliferation of enterprising startups
quickly emerged, offering contracted IT services to help companies
meet the needs of their computer users.
Corporate IT infrastructures continued to grow in complexity
as the technology advanced. Companies found they needed special-
ists to write software, install security systems to control access to
data, and install and configure data networks, to name just a few
areas of expertise. The arrival of the Internet in the mid-1990s greatly
increased the demand for highly skilled IT specialists.
IBM was certainly the giant in the IT services industry
throughout this period, but it was not alone. Many other companies,
EBSCOhost - printed on 1/26/2020 4:20 PM via UNIVERSITY OF THE CUMBERLANDS. All use subject to https://www.ebsco.com/terms-of-use
Implementing IT across the globe174
both large and small, provided expertise to enterprises that lacked
the internal skills to design, build, or maintain their IT infrastruc-
ture. Yet demand for IT specialists kept rising – as did the amount of
concern about their cost.
Companies went looking for other sources of supply. They
came to the realization that it was possible to have enterprise soft-
ware developed and configured at lower cost by skilled engineers in
countries with lower wages, such as India. Thus was born the off-
shore IT service model, with India at its center. Of course, the out-
sourcing of jobs from countries like the US and Britain to what used
to be thought of as “third-world” countries attracted a lot of negative
attention. But India’s ascendancy as a nexus of outsourced IT services
revealed a striking new truth about the developing world: countries
that were once considered economic and technological backwaters
were rapidly catching up to Europe and the US, especially where IT
was concerned. They too had IT infrastructure problems that needed
solutions – and they had skilled engineers who could provide those
solutions. In fact, in every part of the world where demand existed,
an army of startups was emerging to provide IT services. Most of
them were satisfied to remain small regional companies focused on
industry sectors important in their geographies.
Some Indian startups, however, built technical teams in India
and sales organizations in the US and Europe to solicit business. A
few startups there and elsewhere ultimately emerged as large multi-
national companies. Ness Technologies was one of these.
Israel: Technology company incubator
Ness, of course, was different. It was an Israeli company, which
prompts the question, why start such an ambitious venture in Israel?
Israel is a small country with a population to match: only 7.5 million
people in 2011. That is quite a contrast to India, which has a popula-
tion of 1.2 billion. And it is a relatively new player in technology. Not
so long ago oranges and flowers were key Israeli exports, not soft-
ware or medical products. Today the country can boast a remarkable
EBSCOhost - printed on 1/26/2020 4:20 PM via UNIVERSITY OF THE CUMBERLANDS. All use subject to https://www.ebsco.com/terms-of-use
Dem a nd for IT serv ices r esh apes the wor ld 175
record of technical innovation and entrepreneurship. It was ranked
fourteenth out of 125 countries in the 2011 Global Innovation Index,
published by INSEAD.2 Its economic clout extends far beyond what
its small size would predict. In 2009 Israel exported goods and ser-
vices valued at 35 percent of GDP, ranking it above Germany (34
percent), China (24 percent), and India (13 percent).
Israel developed as a technology powerhouse largely due to the
need to ensure its national survival. It took a sudden French boycott
of defense sales during the 1967 war, after years of close collabor-
ation with French industry, to wake the country up to its vulner-
ability. Because of the boycott, the government decided that it could
no longer rely on the importation of strategic defense products. It
launched a massive program to foster internal industrial develop-
ment and build a technology-based economy.
Trained engineers and scientists are the basis for any tech-
nology sector, and Israel was fortunate in having the resources to
develop engineering talent.
There are several outstanding universities, plus many private colleges.• The country has benefited from the immigration of many engineers and • scientists, particularly from the former Soviet Union.
Young engineers can gain practical experience in technical organizations • run by the Israel Defense Forces, which employ young people during
their mandatory military service.
It is worth expanding on this last point. Israel Defense Forces
draftees take rigorous tests for the opportunity to work on defense-
related product development. When those who are selected leave the
service they are well qualified for an industrial career. Many either
start companies of their own or join existing startups.
Israel’s focus on education and training has produced an
unusually talented and experienced pool of software and hard-
ware engineers. Their presence has attracted many major foreign
2 www.globalinnovationindex.org/gii/main/analysis/rankings.cfm, accessed September 16, 2011.
EBSCOhost - printed on 1/26/2020 4:20 PM via UNIVERSITY OF THE CUMBERLANDS. All use subject to https://www.ebsco.com/terms-of-use
Implementing IT across the globe176
corporations to open engineering centers and product development
facilities in Israel, among them, Intel, Motorola, and Siemens.
In addition to its support of technical education and training,
the government has taken an active role in encouraging the creation
of innovative new companies. The Office of the Chief Scientist of
Israel provides modest amounts of seed capital to technology start-
ups that are deemed to be promising. Companies that survive the
seed stage then seek funding from venture capital funds or large cor-
porations. There is a healthy venture capital industry in Israel. In
2009 Israel ranked first in venture capital investment as a percentage
of GDP at 0.43 percent. This compares, for example, to 0.08 percent
in China and 0.2 percent in the US.3
Most Israeli startups eventually get acquired, but some remain
independent and become publicly traded companies. Over 100
Israeli-originated firms are listed on US stock exchanges, the largest
number of any foreign country. Many others are listed on the Tel
Aviv exchange.
With a deep pool of engineering talent, an abundance of entre-
preneurial spirit, a solid legal system, and a history of intellectual
property protection, Israel is a good place to build innovative busi-
nesses or develop products for the global marketplace. So when
Warburg Pincus encountered an opportunity to invest in an Israeli
company, we paid attention.
How Ness Technologies began
Our opportunity to invest in Ness Technologies came through
Morris Wolfson, an experienced American investor in Israeli busi-
nesses, who had acquired a small Israeli IT services company in
1997. He realized that he needed an experienced, professional invest-
ing partner to build it into a major company. We were introduced to
Wolfson through a mutual friend, and began to discuss the idea of
3 Data from NVCA and EVCA, quoted in C. Dickson and O. Shenkar, The great deleveraging: Economic growth and investing strategies for the future (Saddle River, NJ: FT Press, 2011), p. 181.
EBSCOhost - printed on 1/26/2020 4:20 PM via UNIVERSITY OF THE CUMBERLANDS. All use subject to https://www.ebsco.com/terms-of-use
How Ness Technologies bega n 177
acquiring several IT services companies in Israel and merging them
to create the foundation for a global business. We had been investing
extensively in IT businesses in a number of countries. Given what
we had heard of the business climate in Israel, we thought this was
an idea worth exploring. So we went on a fact-finding trip there.
Our first step was to meet Raviv Zoller. A former officer in
the Israeli Navy, Zoller was a certified public accountant and the
founder of an investment bank focused on technology businesses. He
was familiar with the IT industry and was working with Wolfson.
He would be the driving entrepreneur of the new venture, morph-
ing from investment banker to CFO of Ness and finally to its CEO.
Zoller had identified five companies with outstanding technology
and established market positions, one of which had already been
acquired. He believed that these firms, consolidated under a unified
management, would provide the core of a leading IT services com-
pany in Israel. Once a solid local base was established, international
expansion would be a real possibility.
We visited each of the candidate companies, met their man-
agements, and reviewed their projects, capabilities, and finances.
Their combined revenues in 1999 were $94 million with a profit of
$7.5 million. They were selected because, taken together, they cov-
ered many of the most important and valuable IT services, includ-
ing enterprise networks, custom software development for defense
systems, and IT system integration for banks, telecommunications
carriers, hospitals, and utilities. Table 7.1 summarizes their size and
areas of practice.
We then talked to their major customers, who confirmed our
favorable impression of the quality of their work and the productiv-
ity of their engineering staffs. We were sufficiently impressed that
we decided to participate in funding Ness Technologies.
Assembling a senior management team was the first step. Over
a period of six months we recruited three senior-level executives to
launch the company. Aaron Fogel, former Director General of the
Israel Ministry of Finance, became the chairman of the board. Yaron
EBSCOhost - printed on 1/26/2020 4:20 PM via UNIVERSITY OF THE CUMBERLANDS. All use subject to https://www.ebsco.com/terms-of-use
Implementing IT across the globe178
Polak, a seasoned and highly respected executive who had built a
software company that had gone public on NASDAQ, became CEO.
Raviv Zoller became CFO and Chief Operating Officer.
Putting the pieces together
Merging companies is never easy, but merging five entrepreneurial
companies at one time is best qualified as “Mission: Impossible.”
The fact that it was done successfully is a tribute to the skills of the
management team we had recruited.
We felt it was essential to establish a common culture for the
new company. That would be difficult to do with employees scat-
tered among five facilities. Hence, the initial step in the integration
process was to move most of the 1,690 employees to a single loca-
tion. Fortunately, attractive office space became available in a new
Tel Aviv industrial park, and everybody moved to that facility prac-
tically overnight.
Moving to nice new quarters was the easy part of integration. It
was much harder to decide which managers to retain so we could cre-
ate a coherent business organization to unify the original companies.
As central functions such as finance, personnel, and marketing were
Table 7.1 Israeli acquisitions that started Ness Technologies
Year
acquired Company name Business type
No. of
employees
1999 Gilad Software development and system integration
340
1999 Conthal Information technology services
310
1999 Advanced Technology
Software develop- ment and system integration
650
1999 IPEX System integration 350 1999 IPEX ISI Software development 40
EBSCOhost - printed on 1/26/2020 4:20 PM via UNIVERSITY OF THE CUMBERLANDS. All use subject to https://www.ebsco.com/terms-of-use
How Ness Technologies bega n 179
staffed and business units were defined, some managers lost their
jobs, while others were promoted to greater levels of responsibility.
Making such wrenching personnel decisions is always difficult and
disheartening. Israeli culture made it more stressful than usual.
Israel is a close-knit society. As people’s jobs were either threat-
ened or eliminated, their friends and relatives anxiously sought to
talk to me about the situation. They waited for me in the hotel lobby
during my frequent visits to Israel. They told me that the people los-
ing their jobs were actually the best people there, and that Ness was
starting down a ruinous path. Would I not reverse management’s
decision and keep those talented folks in the company?
Of course I could do no such thing. The process of integra-
tion would work only if the company’s investors backed its manage-
ment’s decisions. The subsequent progress of the company suggests
that they picked the right people. It took just over a year to complete
the major consolidation process, after which Yaron Polak left Ness
to become a venture capitalist.
Raviv Zoller became CEO in mid-2001, just in time to tackle
the next phase of the project: leveraging the assembled resources to
grow the company’s market share in Israel, in preparation for inter-
national expansion. Zoller put new service initiatives in place, built
relationships with the biggest potential customers in Israel, and built
the Ness brand – all while making the company profitable.
Ness had a roster of established customers, but it needed to
acquire new ones. It faced fierce competition not just from small
companies, but from big multinationals such as IBM and Accenture.
It won business on the basis of both quality and price against these
formidable opponents, rapidly earning a reputation as a quality
vendor. Soon it had emerged as the leader in the domestic market.
Zoller also demonstrated considerable promotional talent. He
picked former US president Bill Clinton to be the featured speaker
at the Ness annual customer meeting, which he had instituted as a
brand-building opportunity. Clinton was very popular in Israel, and
this event won Ness a great deal of national press coverage.
EBSCOhost - printed on 1/26/2020 4:20 PM via UNIVERSITY OF THE CUMBERLANDS. All use subject to https://www.ebsco.com/terms-of-use
Implementing IT across the globe180
By 2002 Ness could count many leading Israeli banking,
industrial, and defense firms among its customers for IT software
and solutions. It had annual revenues of $167 million and a 13 per-
cent market share in Israel, slightly ahead of IBM. It was time to look
overseas for growth opportunities.
International expansion
Ness Technologies was conceived from the start as a global company.
Now it had to execute on that vision. Its strategy was to develop an
innovative business model for international expansion, particularly
into India, that maintained the integrity of regional operations, yet
integrated them into a worldwide resource for IT services.
There were several ways to penetrate foreign markets. One
approach was to establish sales offices in various countries, have
them solicit projects locally, and execute the work in Israel. This
strategy was rejected. It would take too long for an unknown new-
comer like Ness to gain credibility in a new country. Instead, we
decided that Ness’s expansion strategy had to be based on the acqui-
sition of well-established IT service companies in our geographies of
interest. As known quantities, these companies would make initial
market entry easier. We would then enhance their competitive pos-
ition with technology transferred from Israel.
All business is local
Given this approach, it was clear that retaining senior management
in each of these companies was the key to successful mergers. We
knew that acquisition by Ness could hurt a company’s relationships
with local industry, utilities, and government agencies. These cus-
tomers would be concerned about contracting mission-critical IT
services to a foreign provider.
Therefore, the operating paradigm for the acquired companies
was to continue to “look local” while offering, wherever appropri-
ate, Israeli technology as a competitive edge. Each company would
continue to have local management, and we would keep the folks
EBSCOhost - printed on 1/26/2020 4:20 PM via UNIVERSITY OF THE CUMBERLANDS. All use subject to https://www.ebsco.com/terms-of-use
Inter nationa l expa nsion 181
who had relationships with customers in place on sales and service
teams. Since these local companies would be Ness Technologies
business units, however, we would standardize operating practices
across all of them as much as possible. This included, among other
things, training and technology implementation. In addition, each
local Ness unit would be able to access resources at other locations
to meet customer needs.
In short, the success of Ness Technologies was to be built on a
network of companies that offered the consistent business practices
and technical resources of a multinational, yet maintained a local
presence with local management in the countries where they oper-
ated. These basic principles drove the company’s later spectacular
growth. Its biggest innovations, however, came about when putting
its principles into practice.
Ness goes global
When the word got out through investment bankers that Ness was
looking to expand beyond Israel, a large number of companies in
various countries around the world quickly identified themselves
as candidates for acquisition. The entrepreneurs who had started
these small companies realized that they were too small to com-
pete against larger rivals over the long term. At this point the only
issue was selecting appropriate acquisitions. Ness narrowed the field
by looking at GDP growth in the countries under consideration to
assess the economic opportunities there.
One of the regions that appeared attractive was Eastern Europe.
This region had developed a number of rapidly growing economies
after the fall of the Iron Curtain. Having analyzed local competition,
the nature of the potential customer base, and the availability of
native talent, Ness focused on APP Group, a company in the Czech
Republic. A startup with 180 employees, APP had received Warburg
Pincus funding when it started in 1990. In the interim it had estab-
lished itself as a quality provider of IT services to the local util-
ities, government agencies, and manufacturing enterprises. It was
EBSCOhost - printed on 1/26/2020 4:20 PM via UNIVERSITY OF THE CUMBERLANDS. All use subject to https://www.ebsco.com/terms-of-use
Implementing IT across the globe182
a perfect fit. Through its relationship with Warburg Pincus, Ness
kicked off its expansion program by acquiring the APP Group in
September 2002.
In line with the overall Ness strategy, APP’s senior man-
agement continued to run the business after the acquisition. APP
provided Ness an entry into the whole East European region. It
eventually grew to nearly 1,000 engineers providing IT services in
Slovakia and Romania as well as the Czech Republic.
Off-shore challenges
By 2003 the IT services industry was facing the acceleration of the
trend noted above: using engineers from countries with lower wages,
such as India, to reduce IT support costs. With the cost of local
engineers on the rise, thanks to a growing demand for IT talent in
the developed economies, this had obvious appeal.
At Ness Technologies, responding to increasing customer
demand for cost control became a subject of strategic discussion. Its
opportunity to develop an innovative solution to the problem came
about through another major acquisition, this time of Apar Holdings in
India, another Warburg Pincus investment. Apar was started by Indian
entrepreneurs in 1998. Its business model was quite different from that
of Ness. Instead of having intellectual property of its own, Apar sold IT
engineering services to enterprises on a daily or annual contract basis.
Indian engineers worked for its customers either in India or on location
in the US, Singapore, and the UK. The company had 1,200 engineers,
with a core group of 300 located in India. The others were deployed in
other countries and moved to meet customer demand.
A merger with Apar represented a change from the existing
Ness business model, but added management and engineering talent
in India, and promised access to new customers. We decided that
combining the companies was appropriate, and completed the mer-
ger of Ness and Apar in 2003.
At the time of the merger we recognized that Apar’s business
model had to change. It suffered from a basic problem: when Apar
EBSCOhost - printed on 1/26/2020 4:20 PM via UNIVERSITY OF THE CUMBERLANDS. All use subject to https://www.ebsco.com/terms-of-use
Inter nationa l expa nsion 183
engineers were involved in software development, customers had no
assurance of the continuity of staff assigned to their projects. And
since there were a lot of comings and goings of engineers on the
assigned projects, there was little assurance that intellectual prop-
erty would be protected either.
Shashank Samant, a software engineer trained in India but
with extensive international experience, joined Ness as a manager
during the Apar acquisition. He came up with an idea for a totally
different business model: the “managed laboratory.” His idea was to
offer corporate customers their own “managed laboratories” for soft-
ware development, consisting of a team of engineers contracted on a
long-term basis, all located in India. Working together in a dedicated
facility, they would function as part of the customer’s IT organiza-
tion, even though they were actually Ness employees. The customer
would define the software projects, and the head of the managed
lab would report to the customer’s IT department head. Ness was
responsible for training, recruiting, and all employee personal mat-
ters. Customers would get the continuity they needed, and with a
dedicated team reporting directly to the customer’s IT group there
would be more control over IP.
Ness embraced this idea. Samant became head of the managed
lab business, splitting his time among India, the US, and Israel. He
molded the organization and developed the management structure
that made the business successful. The managed lab model proved
attractive to medium-sized software companies in the US and Europe
who wanted the benefit of low-cost software engineering but could
not afford to build their own facilities in India. Ness provided them
with a dedicated staff that operated as part of their organization in
terms of project oversight. To make the service more attractive to
companies who might be interested in eventually operating their
own facilities, Ness also offered an option under which it would
transfer its managed lab staff to the customer.
This model offered clear benefits to Ness, too. First, the cus-
tomer paid staff costs plus a fee for the service, assuring profitability.
EBSCOhost - printed on 1/26/2020 4:20 PM via UNIVERSITY OF THE CUMBERLANDS. All use subject to https://www.ebsco.com/terms-of-use
Implementing IT across the globe184
Second, the contractual nature of the IT services made the busi-
ness more predictable. Instead of hiring engineers in anticipation of
potential future projects, the company could plan manpower utiliza-
tion consistent with its current billings.
As a clear “win-win” situation for buyer and seller, the man-
aged lab model was quickly embraced by customers across the US
and in Europe. Ness’s first managed lab customer contracted for 200
engineers in 2003. By 2006 Ness was operating fifty such facilities,
employing a total of 3,000 people and generating $120 million of
profitable revenues annually.
Although the first managed lab was in India, the concept
worked wherever wages for engineers were lower than those in the
developed countries. Ness also used engineers in Eastern Europe to
provide this service to clients in Western Europe.
Cultural considerations
Building the India operation was a lesson in cultural adaptation. As
our Israeli management team did not have an easy time managing
the rapidly growing Indian operation; management talent had to be
recruited locally. It became evident that the key to success was hav-
ing Indian senior management with prior experience in the US, an
appreciation of the local culture, and an understanding of modern IT
technology.
Staffing problems posed another serious challenge. Local com-
petition for talent was (and is) intense. At Ness and similar com-
panies, turnover of engineers in Bangalore, the technology capital of
India, was between 20 percent and 30 percent annually, compared
to less than 10 percent in Israel or Eastern Europe. Such turnover
rates put great stress on the efficiency of an engineering organization
and make training an ongoing headache. In fact, recruiting quali-
fied engineers, even in an increasingly competitive Indian market,
was the easy part. It was much harder to retain the talented ones
in a market where wages were rising at a rate of about 10 percent a
year (much faster than elsewhere) and employers were beginning to
EBSCOhost - printed on 1/26/2020 4:20 PM via UNIVERSITY OF THE CUMBERLANDS. All use subject to https://www.ebsco.com/terms-of-use
Going public a nd a fter 185
compete on the basis of fringe benefits, the offer of exciting projects,
and opportunities for personal development. Once good engineers
were on staff, their enthusiasm had to be kept high to retain them
by offering opportunities for professional growth.
The staff stayed young, and increasingly included women with
young children, so special provisions had to be made for them. Ness
became used to providing benefits such as meals, transportation, and
even visits by doctors to the Ness facilities to discuss family medical
needs and provide access to treatment as needed.
Going public and after
After APP and Apar, Ness made a number of smaller acquisitions
to increase its global footprint. International sales and marketing
for all these units was conducted by a staff of 200 professionals.
The strategy of leveraging technology skills globally was showing
results. For example, Ness developed and delivered a novel IT sys-
tem to a pharmaceutical company in Switzerland using engineering
teams from Europe and Israel. Similarly, a global delivery service for
an international law firm was implemented by teams from Israel,
the UK, and India. The service was made possible by a proprietary
information management system, developed by Ness engineers, that
allowed users around the world to share information and work col-
laboratively on projects.
At the end of 2003, Ness had a total staff of 4,300 employees
serving over 500 customers, including Lockheed Martin, Coca Cola,
Citibank, AT&T, Israel Aircraft Industries, the Israel Defense Forces,
Pfizer, American Express, and Czech Telecom. No single customer
represented more than 5 percent of revenues. There was a high level
of customer satisfaction, indicated by the fact that, at the end of the
year, 80 percent of the following year’s business was with the same
customer base as the prior year. Clearly the company’s management
was doing a lot of things right, and it was on a solid footing to con-
tinue its global success.
EBSCOhost - printed on 1/26/2020 4:20 PM via UNIVERSITY OF THE CUMBERLANDS. All use subject to https://www.ebsco.com/terms-of-use
Implementing IT across the globe186
By the end of 2003 the company had accomplished a great deal
of what we had hoped to see. Revenues had grown 23 percent annu-
ally since inception, to $226 million. The company was profitable
and doing business in fourteen countries. It was time to consider an
IPO. In September of the following year, the company had its IPO on
NASDAQ, selling $140 million of its shares.
At the end of 2006, Raviv Zoller decided to leave the company
to resume an investment banking career. He was replaced by Sachi
Gerlitz, an executive with extensive international business experi-
ence. By then the company had 8,900 employees and was on a clear
growth path. It was ranked among the top thirty IT service compan-
ies globally by the Brown-Wilson Group, a respected industry con-
sulting firm. Its revenues had increased from $474 million in 2006
to $563 million in 2007. Israeli revenues accounted for 48 percent of
the total.
A business of this type is affected by business cycles. As a
result of the global recession of 2008, revenues declined in 2009,
stabilized in 2010, and resumed growth in 2011 to $620 million. In
2011, the company was taken private by the private equity group of
Citigroup Inc.
Looking back
Building a successful multinational services company is perhaps the
most difficult management task entrepreneurs can face – especially
starting from a small country. Such a business succeeds only if it
learns how to share resources globally while maintaining a common
internal culture and uniform operating principles. It must also adapt
to the cultures of the places it does business without compromis-
ing common corporate goals. Internal regional politics also pose a
threat if management interests are not aligned. Without a common
operating methodology, each region can easily become a fiefdom that
optimizes its business results at the expense of the company as a
whole. An employee reward system must be put in place across the
EBSCOhost - printed on 1/26/2020 4:20 PM via UNIVERSITY OF THE CUMBERLANDS. All use subject to https://www.ebsco.com/terms-of-use
Look ing back 187
entire organization that encourages collaboration among disciplines
and geographies.
How the management at Ness was able to avoid the pitfalls
and build a successful organization will reward consideration by any
entrepreneur with global ambitions. Their approach can be summed
up as follows.
Careful selection of acquisitions to meet strategic objectives: adding • desired geographical coverage and skills to the company.
Retention of the most talented senior managers in acquired firms to • help build the local business. There was no attempt to import Israeli
management into overseas locations.
Immediate installation of financial management and control systems in • acquired companies, to integrate them into the corporation and allow
timely and accurate reporting of business activity.
Frequent, prolonged visits by senior Ness management in the various • regions to work with the local staff. In a remarkably short time this
interaction developed a common culture in which international
collaboration was accepted as the best means of generating business.
This effort was greatly helped by an annual meeting where the fifty
top company managers met to review the annual plan. The location
changed each year – Bangkok, London, New York, Bangalore, Prague – so
that local employees had the opportunity to meet company managers
from various countries. Such meetings are a valuable venue for building
personal relationships – over twenty nationalities were typically
represented among the managers.
Leveraging the company’s diverse skills to serve the needs of • international customers in different locations. To further this effort
the company developed proprietary information-sharing technology
that allowed resources throughout the company’s operating regions to
address customer needs.
Rigorous enforcement of a code of conduct – a necessity when operating • in some countries where bribery is a common method of acquiring
business.
Ness Technologies blazed a new path from its very beginning
because its founders designed the company from the ground up to be
EBSCOhost - printed on 1/26/2020 4:20 PM via UNIVERSITY OF THE CUMBERLANDS. All use subject to https://www.ebsco.com/terms-of-use
Implementing IT across the globe188
an international enterprise. They used acquisitions to give it a global
reach, and created an innovative business model to attract custom-
ers. The strategy for leveraging Indian talent is particularly note-
worthy in this regard. They also developed approaches to unifying
the company’s operations, creating a common corporate culture, and
leveraging its worldwide resources to serve major corporations.
In the next chapter we will look at how three Chinese telecom-
munications startups, operating only in China, dealt with entirely
different problems.
EBSCOhost - printed on 1/26/2020 4:20 PM via UNIVERSITY OF THE CUMBERLANDS. All use subject to https://www.ebsco.com/terms-of-use
Week4/Course1-InfoTech in a Global Economy (ITS-832-06)/Text Books/The Future Of The Global Economy.pdf
A s the 20th century draws to a close, power ful forces of change are converging that could set the stage for
a long, sustained economic boom in the next few decades – the transition to a knowledge- based society with its potentially h u g e productivity gains; the emergence of more deeply integrated, global markets for goods, services, capital and technology; and a fast- growing environmental awareness that could greatly accelerate the shift to new, less resource-intensive production and consumption patterns. The result could be several decades of above-average economic growth, substantial increases in income and wealth, and significant improvements in well-being across the world.
But what will it take to unleash these dynamic forces? Not only will it will call for a range of initiatives to establish the rules and frameworks for guiding the transition to a sustainable global knowledge economy. Above all, it will require exceptional efforts among decision makers in government, business and society at large to encourage continuous innovation, creativity and high levels of investment, and to promote bold new approaches to closer international co- operation and institution building. Inevitably some countries will benefit more than others, but a long boom with all its wealth creating capacity would offer a unique opportunity to reverse the trends of the last decades towards deepening inequality and exclusion.
This book reviews the forces driving economic and social change in today’s world. It asesses the likelihood of a long boom materialising in the first decades of the 21st centur y and explores the strategic policies essential for making it happen.
Further reading 21st Century Technologies: Promises and Perils of a Dynamic Future.
(03 1999 02 1 P) FF 140 ISBN 92-64-17029-4
9:HSTCQE=V\UŴW:
The FUTURE
of the Global Economy
Towards a Long Boom?
O E C D
Th e Fu
tu re
o f th
e G
lo b a l Eco
n o m
y : Tow
ards a Long Boom ?
B A N K G E S E L L S C H A F T
B E R L I N
West LB NORD/LB
N O R D D E U T S C H E L A N D E S BA N K G I RO Z E N T R A L E
O E
C D
99 O R
G A
N IS
A T
IO N
F O
R E
C O
N O
M IC
C O
-O P
E R
A T
IO N
A N
D D
E V
E L
O P
M E
N T
File: $1$DIA3:[PAGER.SAVE.PUB]COPYR–1623E.;7 NGUYEN Seq: 1 Page: Free: 4140D Next: 0D VJ: J1:1 9-AUG-99 10:55
OECD, 1999. Software: 1987-1996, Acrobat is a trademark of ADOBE. All rights reserved. OECD grants you the right to use one copy of this Program for your personal use only. Unauthorised reproduction, lending, hiring, transmission or distribution of any data or software is prohibited. You must treat the Program and associated materials and any elements thereof like any other copyrighted material.
All requests should be made to:
Head of Publications Service, OECD Publications Service, 2, rue André-Pascal, 75775 Paris Cedex 16, France.
THE FUTURE OF THE GLOBAL ECONOMY:
Towards a Long Boom?
ORGANISATION FOR ECONOMIC CO-OPERATION AND DEVELOPMENT
ORGANISATION FOR ECONOMIC CO-OPERATION AND DEVELOPMENT
Pursuant to Article 1 of the Convention signed in Paris on 14th December 1960, and which came into force on 30th September 1961, the Organisation for Economic Co-operation and Development (OECD) shall promote policies designed:
– to achieve the highest sustainable economic growth and employment and a rising standard of living in Member countries, while maintaining financial stability, and thus to contribute to the development of the world economy;
– to contribute to sound economic expansion in Member as well as non-member countries in the process of economic development; and
– to contribute to the expansion of world trade on a multilateral, non-discriminatory basis in accordance with international obligations.
The original Member countries of the OECD are Austria, Belgium, Canada, Denmark, France, Germany, Greece, Iceland, Ireland, Italy, Luxembourg, the Netherlands, Norway, Portugal, Spain, Sweden, Switzerland, Turkey, the United Kingdom and the United States. The following countries became Members subsequently through accession at the dates indi- cated hereafter: Japan (28th April 1964), Finland (28th January 1969), Australia (7th June 1971), New Zealand (29th May 1973), Mexico (18th May 1994), the Czech Republic (21st December 1995), Hungary (7th May 1996), Poland (22nd November 1996) and Korea (12th December 1996). The Commission of the European Communities takes part in the work of the OECD (Article 13 of the OECD Convention).
Publié en français sous le titre :
L’ÉCONOMIE MONDIALE DE DEMAIN : Vers un essor durable ?
© OECD 1999
Permission to reproduce a portion of this work for non-commercial purposes or classroom use should be obtained through the Centre français d’exploitation du droit de copie (CFC), 20, rue des Grands-Augustins, 75006 Paris, France, Tel. (33-1) 44 07 47 70, Fax (33-1) 46 34 67 19, for every country except the United States. In the United States permission should be obtained through the Copyright Clearance Center, Customer Service, (508)750-8400, 222 Rosewood Drive, Danvers, MA 01923 USA, or CCC Online: http://www.copyright.com/. All other applications for permission to reproduce or translate all or part of this book should be made to OECD Publications, 2, rue André-Pascal, 75775 Paris Cedex 16, France.
3
Foreword
As part of the preparations for EXPO 2000 – the World Exposition in Hanover, Germany – the OECD Forum for the Future is organising a series of four confer- ences to take place beforehand around the theme of “People, Nature and Technol- ogy: Sustainable Societies in the 21st Century”. The series will consider four key areas of human activity: technology, economy, society and government. The con- ferences will explore possible evolutions of key variables and analyse different development paths in order to expose some of the main policy implications and options. Each conference will provide analysis of underlying trends and policy directions. However, the overall aim of the series is to build a comprehensive foundation for assessing the critical choices likely to face citizens and decision makers in the next century.
The entire series benefits from special sponsorship by EXPO 2000 and four German banks – Bankgesellschaft Berlin, DG Bank Deutsche Genossenschaftsbank AG, Nord LB/Norddeutsche Landesbank, and Westdeutsche Landesbank Girozen- trale (WestLB). Additional financial support is provided by numerous Asian, Euro- pean and North American partners of the OECD Forum for the Future.
This was the second conference in the series. It was hosted by the DG Bank Deutsche Genossenschaftsbank AG in Frankfurt, Germany, on 2-3 December 1998. The theme was “21st Century Economic Dynamics: Anatomy of a Long Boom”.
After a day and a half of discussion, conference participants concluded that the world is on the threshold of a tantalising opportunity – the possibility of a sus- tained long boom over the first decades of the next millennium. A confluence of forces – particularly the transition to the knowledge society, the emergence of a global economy, and the pursuit of environmental stability – could come together to propel huge improvements in wealth-creating capacity and well-being world- wide. But for this to happen, major advances would have to be made on two policy fronts. First, exceptional efforts would be needed nationally and internationally to encourage continuous innovation and high levels of investment. And second, sub- stantial leaps would be needed in levels of international co-operation on such matters as the diffusion of technology and knowledge, market integration and
The Future of the Global Economy: Towards a Long Boom?
4
environmental transformation. The aim of this conference was to assess the pros- pects for a long boom in the next couple of decades and to explore the policy strategies that could help it become a reality.
The conference was organised into three sessions. The first looked at the generic factors likely to determine whether or not long-run economic dynamism will continue in the future. The second addressed specific driving forces likely to accompany economic dynamism in the next century and potentially spark the high growth rates of a long boom over the next twenty to thirty years. Finally, the third session considered the way policy choices are likely to influence the playing out of different scenarios for a 21st century long boom.
This publication brings together the papers presented at the meeting as well as an introductory contribution and summary of the main points of the discussions prepared by the Secretariat. The book is published on the responsibility of the Secretary-General of the OECD.
5
Table of Contents
Chapter 1: Anatomy of a Long Boom by Wolfgang Michalski, Riel Miller and Barrie Stevens.............................................. 7
Chapter 2: Sources of Continued Long-run Economic Dynamism in the 21st Century by Richard G. Lipsey................................................................................................ 33
Chapter 3: The Emerging Global Knowledge Economy by Peter Schwartz, Eamonn Kelly and Nicole Boyer ................................................. 77
Chapter 4: Towards Global Competition: Catalysts and Constraints by Horst Siebert and Henning Klodt ........................................................................ 115
Chapter 5: Working for World Ecological Sustainability: Towards a “New Great Transformation” by Alain Lipietz ........................................................................................................ 139
Chapter 6: Policy Drivers for a Long Boom by DeAnne Julius ..................................................................................................... 167
Annex: List of Participants................................................................................. 195
7
1
1Anatomy of a Long Boom 2by
3Wolfgang Michalski, Riel Miller and Barrie Stevens OECD Secretariat, Advisory Unit to the Secretary-General
1. Introduction
One of the most promising and commonly evoked vistas of the future centres on the dazzling potential of new technologies. From that perspective many of today’s profound problems, such as unemployment, malnutrition, disease and global warming could be solved through the clever application of breakthroughs in computer science, genetic engineering, nano-device construction and new materi- als creation. These hopes are not unlike those of a century ago, when the develop- ment and diffusion of technologies such as electricity, the radio and the internal combustion engine promised a new era of human well-being.
With the benefit of hindsight, however, it is clear that realising the potential of late 19th century new technologies required major economic and social transforma- tions. Extending breakthroughs beyond the inventor’s lab, imagining new applica- tions, realising broad diffusion of initially unfamiliar technology and achieving deep integration of cutting-edge techniques – all of these processes were both protracted and difficult. In the end, many landmarks had to be changed, from where and how people lived to what and how firms produced. This in turn entailed the overthrow of old patterns, of entrenched expectations and accepted “common sense” notions – not to mention established management theories and hardened political realities.
What is striking is that similarly dramatic transformations, economy- and society-wide, seem once again to be a realistic prospect. Although there have cer- tainly been other periods in recent history when the outlook for humankind was filled with promise, the current conjuncture constitutes one of those rare moments when a confluence of diverse and numerous developments generates new, poten- tially radical opportunities. These are not a forgone conclusion, for the necessary policies are highly ambitious and only just on the horizon for decision makers. But
The Future of the Global Economy: Towards a Long Boom?
8
the fact remains that humanity could reap huge rewards if it is ready to undertake equally significant changes.
Two factors largely account for that unconventionally strong conclusion – one is methodological, the other conjunctural. First, the analytical method adopted here for exploring long-term possibilities is neither partial nor linear, characteristics com- mon and justified for shorter-term forecasting. A systemic and interdisciplinary approach is what enables the identification of opportunities for more radical evolu- tionary and intentional transformations. Secondly, on the basis of this methodology, it becomes apparent that the current historical conjuncture – with its specific tech- nological, economic and social developments – holds the seeds that could blossom into a period of above-average growth. Some may attribute the sense of exceptional opportunity to end-of-century jitters and obligatory optimism by governments at the launch of a new millennium. Such scepticism is only natural. However, the assessment offered over the following pages tends to confirm the view that the his- torical door is now open to both a dramatic wave of socio-technical dynamism and the rapid pace of expansion that characterises a long boom.
Looking to the past, no single cause accounts for either long upsurges of eco- nomic dynamism or historically specific phases of faster and slower growth. A bundle of factors made important contributions both to the creation of a prolonged period of dynamic possibilities and the succession of cyclical booms and busts. Certainly a cru- cial role was played by technological innovations – from the steam engine to the microprocessor – that improved productivity, gave rise to previously unimagined products, and opened up vast new sectors for economic and social activity. In addition to supportive demographic factors, powerful contributions to economic dynamism came from expanded and more open national and international flows of goods, ser- vices, finance and ideas. These trends were further encouraged by steady declines in transaction costs – facilitated by more efficient market rules, transportation systems and communication technologies – which in turn fuelled gains from trade and interna- tional economic specialisation. Other major forces nourishing long-run economic dynamism arose from significant improvements in social, educational and health sta- tus as well as the evolution of political institutions, in many but not all jurisdictions, towards greater democratic accountability and administrative effectiveness.
Few dispute the importance of these ingredients in creating the conditions that nurture long-run productivity growth and wealth creation. Less evident is the recipe(s) to ensure that such dynamism not only continues over the next few decades but is also accompanied by a phase of above-average expansion – a long boom where world GDP growth could be in the 4% per annum range and might lift world per capita GDP growth rates above the 3% mark. Then there is the open ques- tion of the extent to which overall economic dynamism, and the long boom that may go with it, actually correspond to people’s aspirations.
Anatomy of a Long Boom
9
Entering a new millennium, concerns are being raised not only about the sus- tainability but also about the desirability of this path. For some it is too turbulent and uncertain, bringing too many changes too quickly. For others the problem is change itself: the disruption of existing patterns, values and social structures is viewed as either unnecessary or inimical to human well-being. Certainly, long-run economic dynamism has, throughout its various phases, produced tremendous wealth, but it has also inflicted high costs. The last two centuries have seen mas- sive disruptions to established patterns of work (from farm to factory) and every- day living (from rural to urban). The planet’s ecosystem has been put under tremendous strain. Inequality within and between nations has, from a number of perspectives, increased. Even deeply entrenched values and cultural norms have been called into question. No wonder some see the dynamic past as a precedent to be avoided in the future.
The chapters in this book grapple with these issues. This first chapter pro- vides an overview of prospects for both long-run economic dynamism and a long boom (Section 2) and a summary of the policies required to make them happen (Section 3). In Chapter 2, Richard Lipsey looks at the generic factors likely to determine whether or not long-run economic dynamism will continue into the future. The next three chapters turn to the specific driving forces likely to propel economic dynamism in the next century and potentially spark the high growth rates of a long boom over the next twenty to thirty years. Each chapter looks at a s p e c i f i c s e t o f c a t a l y s t s a n d c o n s t r a i n t s : C h a p t e r 3 , b y P e t e r S c h w a r t z , Eamonn Kelly and Nicole Boyer, deals with the transition to a knowledge economy and society; in Chapter 4, Horst Siebert and Henning Klodt look at the emergence of a global economy for goods, services, finance and technology; and Chapter 5, by Alain Lipietz, considers the challenge of environmental sustainability. Finally, in Chapter 6, DeAnne Julius assesses various policy options on the basis of three plausible scenarios for a 21st century long boom.
2. What is a long boom?
Long booms are exceptional events; there have been relatively few in the his- tory of human economic development. For example, the two rapid growth periods of the last 130 years – one in the latter decades of the 19th century and the other after the Second World War – made major contributions to pushing the long-run historical average to a higher level. An anatomy of these past booms reveals two basic features. First, a boom’s above-average pace of development is part of a longer, century-spanning flow. This powerful tide provided by long-run economic dynamism is a distinct phenomenon that should not be confused with the shorter cyclical expansions and contractions that fluctuate around the historical trend. Secondly, there is an interdependent constellation of diverse forces that work
The Future of the Global Economy: Towards a Long Boom?
10
together in a specific historical conjuncture to spark the unusually fast rates of socio-economic change and productivity growth that characterise a long boom. Both of these features appear to be present in the current context.
Long-run economic dynamism: foundations for a long boom
For four centuries prior to 1820, the twelve countries that form the core of Western Europe experienced average growth in per capita income of 0.2% per annum. From 1820 to 1870 the pace increased considerably, reaching 0.6% per annum on a worldwide basis and then ratcheting up to twice the previous rate at 1.3% between 1870 and 1913. The next burst of world per capita income growth, three times that during the preceding war-torn period, occurred from 1950 to 1973 at the pace of 2.9% p.a. Since then, the world average has been closer to 1.2%. Viewed over the entire span from 1820 to 1996, these average per capita growth rates, in the face of very large population increases, are testimony to the tremen- dous wealth-creating capacity unleashed by economic dynamism. This was eco- nomic and social transformation on a par with the most significant – and much more protracted – leaps in the development of human civilisation.
Systemic chemistry
Certainly strong growth in investment, in the capabilities of the labour force and in trade is crucial for very long periods of sustained economic development. But the dynamic element that drives change forward is the systemic chemistry that either catalyses the process or stifles it. Recent events cast the role of system functionality or dysfunctionality into stark relief. The dire consequences of sys- tems failure are evident, for instance, in the demise of Soviet command planning or the post-1970s plunge of many “debt crisis” countries into even deeper pov- erty. As for the immense benefits of system functionality, it can be seen in the postwar convergence of Europe and Japan to American income levels and the significant economic take-off of many Asian countries over the last two decades.
The historical record shows that long-run economic dynamism is orchestral. Like the single notes and chords of a melody that are then woven into a polyphony, a dynamic economy arises from a constellation of factors that together create a sym- phonic system. And, as with the multiple threads of polyphonic music, there can be harmony and dissonance as different melodies change, intertwine, catch-up and fall behind. Thus the current “Asian crisis”, with its dissonant chords, confirms rather than denies the contention that economic dynamism arises from the combination of many distinct and diverse technological, institutional and cultural elements into a functioning system. Indeed, the ongoing development of an innovation-driven economy and society depends on a process of falling behind and catching up, a
Anatomy of a Long Boom
11
kind of disequilibrium among and between scientific breakthroughs, social structures, organisational models and value systems.
This systems perspective also reveals the basic attributes that are essential for sustaining economic dynamism over almost two centuries, through many short- to medium-term crises and into the future. The characteristics that combat stagna- tion and renew the capacity and desire to change over time can be grouped into three areas: the aspirations and imperatives that emerge from the co-evolution of democracy and a competitive market-place; the capacities to innovate and adapt that are allowed to flower when there is pluralism, transparency and openness; and the range of cultural values, such as a respect for both civil liberties and societal obligations, that facilitate a perpetual search for ways of balancing co-operation with competition and security with risk-taking. Succinctly, long-run economic dynamism is sustained by combining adaptability and innovation with good infor- mation based on clear and efficient incentives and signals. All of these traits are in turn shaped by the myriad institutions, explicit laws and tacit rules that set parameters for everyday behaviour.
Of course, systems that are hierarchical, closed and riddled with intolerance are capable of short bursts of development, particularly if the technological, organisational and social structures are imposed from above during wartime and/ or a period of forced industrialisation. But, as the record of this century shows, these are not dynamic systems capable of sustaining long-run economic develop- ment. Furthermore, as is gradually becoming apparent, the uniform and hierarchi- cal formulas of the past are not only less desirable but also likely to be much less efficient in the future. Meeting a diversity of demand is breeding an ever greater diversity of supply, which in turn depends on the competitive encouragement of initiative, customisation and a relaxing of centralised controls. In fact, although the basic characteristics that sustain long-run economic dynamism remain fairly con- stant, the specific ways of realising these attributes change over time. For exam- ple, 19th century democracy and trading institutions offered tremendous scope in that era, as did the organisations of mass production, mass consumption and mass government that have dominated the 20th century. However, these institutional and organisational forms are unlikely to be adequate to the conditions and tasks of the 21st century. What, then, are the prospects for a continuation of long-run economic dynamism?
General determinants of long-run economic dynamism
Viewed from an aggregate perspective, the sources of economic dynamism in the 21st century are bound to share many characteristics with those of the century now drawing to a close. Continued expansion of the world’s population, along with the unabated pressures of human needs and desires, will certainly drive economic
The Future of the Global Economy: Towards a Long Boom?
12
activity. But beneath the surface of these basic demands, the general determinants of long-run economic dynamism can be divided into five categories. First, though not pre-eminent, are the tools or pervasive technologies that humans use to enhance their capacity to create value. Secondly, there are the institutional frame- works – economic (the firm), social (the household) and collective (government) – for managing risk, reducing uncertainty, enhancing flexibility and improving trans- parency. The third pillar of long-run economic dynamism is made up of the quantita- tive inputs (such as natural resources or fixed and human capital) that provide the ingredients for production. The fourth and fifth supports of a dynamic economy are the productivity-enhancing competitive forces and motivating aspirations that drive innovation, the reallocation of the full range of resources. Looking to the next few decades, the trends in each of these specific long-run factors will determine the course of economic dynamism.
• Technology
It emerged quite clearly in the previous book in this series, 21st Century Tech- nologies: Promises and Perils of a Dynamic Future (OECD, Paris, 1998), that there is a technological basis for a future wave of productivity-enhancing innovation in what, how and where economic value is produced. Humanity’s technical genius has, on the eve of the next Millennium, opened up new territory in the basic fields of information technology, genetic engineering and materials science – leading to potentially powerful knock-on effects for other areas such as energy generation, transportation, medicine and agriculture. The possibilities are nothing short of astounding across almost the complete spectrum of human activity. New horizons are appearing for communications, the sharing of knowledge, the co-ordination of production, the execution of transactions and the inspiration of ideas through a sharing of culture and insight. Exciting and risky advances are being made in biol- ogy as the mechanics of nature’s codes and building blocks begin to reveal the secrets of how to design and repair living organisms. Inanimate matter is also unlocking its mysteries as quantum theory and nano-level techniques begin to show the way towards new substances and methods for manipulating the atomic components of the universe.
Looking to the 21st century, the technological possibilities seem well within the same class of pervasive inventions as the steam engine, the railway, electricity, the telephone and the internal combustion engine. However, like the tools of the past, those of the future will be useful only to the extent that economic and social capacities keep pace. People choose to make use of tools to create and innovate. Thus, putting tomorrow’s technologies to use will hinge on the desire and capacity to embrace socio-technical dynamism. Here, institutional factors will play a deci- sive role. As many schools of growth theory have made clear, economic take-off
Anatomy of a Long Boom
13
depends on the introduction of institutional innovations, from judicial due pro- cess and Taylorist management to universal compulsory schooling and econ- omy-wide accounting standards. In the past, the institutional shells that structured the allocation of decision-making power have regularly been reconfigured, be it through the advent of universal suffrage or the shift in responsibility to profes- sional managers from owners of the firm. Such upheaval has not vanished from the world stage – indeed, there is evidence that a new wave of institutional change will mark the outset of the next century.
• Institutions
Institutions, along with the rules and attitudes they sustain, are in motion throughout the world. At global, regional, national and local levels, in devel- oped, developing and former centrally planned economies, public and private sector institutions are changing – in many cases radically. In the public sector governments are undertaking major reforms through privatisation, regulatory reform, programme redesign or devolution, and modernisation of state admin- istrative methods. In the private sector, established managerial practices such as hierarchical command and control structures are being delayered, with radi- cal implications for firms from New York to Vladivostok and from the lead- ing-edge knowledge creator to the traditional artisanal niche producer. At the international level, governments are negotiating frameworks with respect to electronic commerce and climate change. Multinational corporations are reconfiguring global supply networks, value chains and organisational struc- ture. Local firms are going global in an effort to find markets as the costs of dis- covering suppliers and buyers, sending goods or downloading information all fall. Significant efforts at regional integration are driving the search for flexibil- ity and the redistribution of activities and factor inputs by both business and government. At the national level, public sector policy mixes are, in most places, shifting away from direct and frequently uniform service provision towards more decentralised, regulatory and individually managed approaches. Locally, there is a resurgence of activism and networking as people at work and at home assume greater responsibilities.
Overall, the closing years of the 20th century are witnessing what some have called a “paradigm shift” – a sweeping challenge to the one-way hierarchical divi- sion of labour and its power relationships. Such institutional discontinuity, in so far as it opens up the possibility of deploying new technologies and liberating innovation, may be a powerful stimulus to the continuation of economic dyna- mism. Making the right policy choices will clearly play a decisive role. So too will the availability and distribution of key inputs like fixed and human capital. Here there is good reason to expect continuity with past trends.
The Future of the Global Economy: Towards a Long Boom?
14
• Inputs
The availability of quantitative inputs, from tangible resources like energy and raw materials to intangible inputs like financial and intellectual capital, is not likely to hinder the continuation of long-run economic dynamism. Relaxing of cer- tain important resource constraints of the past could be encouraged by trends, particularly in OECD countries, towards a growing share of intangibles in total out- put and the introduction of technologies, production methods and consumption patterns that are less resource-intensive. What is more difficult to anticipate in general terms is the extent to which cyclical forces and distributional problems could create bottlenecks and recessions, or open up new sources of supply and spark economic booms. In the past, mass migrations redistributed available labour, inadequate savings rates provoked credit crises, and postwar rebuilding generated sharp upturns. In the future there are likely to be many of these local and/or more widely diffused disequilibria, provoked by misguided or deliberate policy or even by chance events. Already on the horizon are a series of issues: large increases in the share of elderly in the total population in most OECD coun- tries and China, the unequal geographical distribution of the supply of capital (savings) and demand (high-return investment opportunities), and the divergence in income levels between high and low contributors to climate change.
• Competition
Although these imbalances generate hardship and adjustment that in a world of perfect market information might not exist, in the real world such signals and responses generate the trends and allocative flows that are regular sources of improvements in the use and efficiency of resources as well as in institutions and policies. At the micro level, where resource allocation decisions are actually taken, such disequilibria are frequently provoked by confrontation with the constraint of competitive forces. In the private sector, the fact that companies come up with ways of being more productive and undercutting competitors on the basis of price, quality or both is usually a decisive reason to change resource allocation. In the public sector, the failure to meet voters’ expectations often leads to either a change in policy or government – sometimes both.
The record of the past two centuries is fairly clear: competitive forces have been given ever greater scope to operate. Transparency and openness have improved as voters gain the right to know and consumers reap the benefits of freer intra- and international trade as well as antitrust and consumer protection laws. Once again, looking to the future, there are grounds for expecting that the competitive forces driving change will continue to operate and even gain greater hold on a wider range of activities. Supported by technological and institutional changes that facilitate information-sharing, the breadth and depth of comparative
Anatomy of a Long Boom
15
assessment appear set to grow. For example, developments such as the introduc- tion of the euro and the spread of electronic commerce will simplify comparison shopping, while international efforts to eliminate bribery should reduce the secrecy that corruption demands.
• Aspirations
Increases in the transparency upon which the competition of ideas or items for sale depends also promise to spur the motivating aspirations that have driven considerable change in the past. From the most basic hopes for a life free of hun- ger and oppression to the pursuit of greater self-awareness and fulfilment, human- ity’s desires continue to create pressure for change. Long-run economic dynamism seems unlikely to falter on the demand-side limits of market saturation and excess material abundance, for several reasons. First of all, among the wealthy there is evidence of a shift to the pursuit of non-material and qualitative interests and pleasures. Secondly, the majority of humanity still has a long way to go to meet even minimum standards of material well-being. And thirdly, it seems likely that in the future the relationship between people’s aspirations and the environ- ment will be changing in ways that require rethinking what, where, and how peo- ple produce and consume. For the foreseeable future these processes should serve as driving forces for change in general and towards more democratic forms of political expression in particular.
Taken as an ensemble, the prospects for the diffusion of new pervasive tech- nologies, efficiency-enhancing institutional change, continued availability of pro- duction inputs, the spread of competitive forces and the ongoing pressure of motivating aspirations lend credence to the view that a continuation of long-run economic dynamism is feasible. That does not necessarily imply that growth or change will be more rapid or profound than in the past. There is an open relation- ship between the general forces that set the stage for economic dynamism and the specific rates at which wealth-creating capacity increases. This ambiguity has not stopped some people, possessed of end-of-the-millennium sentiment and the recent euphoria over American economic growth, to declare the triumph of a single model of economic dynamism over all other approaches. Such a perspec- tive overlooks the rich diversity of specific economic models and mistakes the common attributes of long-run economic dynamism with the particular historical conditions and policies that make it happen. A related error is to assume that cre- ating the conditions conducive to long-run economic dynamism will necessarily give rise to the above-average growth rates of a long boom; the specific catalysts and constraints will determine actual outcomes.
Confident hopes that the economic dynamism of this century will continue into the first decades of the next are not as easily extended to the question of whether or
The Future of the Global Economy: Towards a Long Boom?
16
not a new long boom is plausible. The prospects for tomorrow’s long boom will be decided by the way humanity responds to three momentous opportunities, exam- ined below.
Specific forces driving the next long boom: global catalysts and constraints
A confluence of historically specific technological, economic and social factors need to fall into place so that the global average rate of per capita income growth can be pushed over the 3% mark for the next few decades. Looking to the first quarter of the next century, there would appear to be three primary movers – or sets of catalysts and constraints – capable of launching a long boom: the develop- ment of a global knowledge economy and society; the emergence of a global economy based on international trade, investment and technology flows; and the pursuit of global environmental sustainability.
Each of these currents could make a major contribution not only to sustaining a dynamic economy but also to sparking a period of above-average growth – a twenty-year long boom to mark the start of the next century. Equally, the collapse of efforts to share ideas, open up markets and attain sustainability could seriously undermine overall economic prospects and dash the hopes for a long boom. With little disagreement about the positive implications should the catalysts win the day, or the negative implications should the constraints prevail, the main analyti- cal and policy differences concern how to support the former rather than the latter. With this in mind, each of the subsections below touches, first on links between the prospects for a long boom and a particular set of catalysts and constraints, and then on the fairly marked differences of view regarding what to do.
The transition to a global knowledge economy and society
The full emergence of the knowledge economy and society, at first in a number of OECD countries, promises a shift from the abundance of uniformity in the mass-production, mass-consumption and mass-government era to the kaleidoscope of individual creativity in the “Internet era”. This transition to the predominance of knowledge as input, output and structuring feature of the economy and society has been building for some time, particularly since the ascent of the service sector started to put a greater premium on closer contact between customers and producers. At the core of this transformation is the growing capacity to add the intangible and highly valued conceptual input of a personal design, a unique pattern or a customised form. Nothing better symbolises this take-off than the explosion of the Internet as an economic and social force. As much as the automobile, a tangible industrial product, came to symbolise the synergies of the mass-production and mass-consumption era, the future is likely to give the Internet with its intangible digital services the status of icon
Anatomy of a Long Boom
17
of the knowledge economy. The Internet is the facilitator of a much vaster sys- tem that spans all digital information, from biotech to nanotech, and all sectors of the economy, from agriculture to art. Like the automobile before it, the spread of this “network of networks” could be a primary force behind a long boom. The potential is there for a leap on a par with the dramatic changes that distinguish the living and working conditions of the average person of the 19th versus 20th centuries.
Yet the prospect of such major changes does not assure that the shift to a knowledge economy and society will provoke the above-average growth rates of a long boom. Indeed, the open question is whether or not the catalysts pushing a transition will be sufficiently strong, not only to overcome the con- straints but also to drive change rapidly and broadly enough. Laboratory breakthroughs and product innovations offer no assurance of wide diffusion or of a profound reorganisation of the ways in which people work and live. Fur- thermore, as is well known, the spread of information technology has so far failed to produce a demonstrable productivity take-off. As with earlier transfor- mations, like the move from craft to factory production in the previous century, there are likely to be very rocky phases as the requisite institutions, habits and cultural expectations are built up through a process of trial and error. Pro- found transitions in how and where people live and work as well as what they produce and consume do not come easily. Many habits and customs are called into question without obvious replacements for easing human interaction and reassuring people with the familiar. Introducing the points of reference and common language that will allow virtual reality to seem as normal as parking the car or grooming the horse will demand considerable effort and experimen- tation. As the pioneers of electronic commerce and biotechnology are begin- ning to recognise, the everyday trust taken for granted when conducting a transaction at the corner store for old fashioned, non-genetically engineered produce does not come as automatically when the order passes through a new medium for a new product.
There is still a long way to go to create the infrastructure for translating the potential for low-cost knowledge-based transactions into an economy and society capable of unique production and consumption. These are still the early days of deciding on the basic conventions or rules of the road, akin to the time before the now so familiar traffic light attribution of stop to red and go to green. On the Inter- net, for example, there is still no universally available, easy and efficient means of ensuring privacy, contract enforcement, consumer redress, payment for copying intellectual property, a predictable tax regime or universal access to what is rap- idly becoming an essential service. Little has been done to address the social and economic implications of a major reshuffling of winners and losers – the ascendancy of the wired over the unwired.
The Future of the Global Economy: Towards a Long Boom?
18
With respect to access, the good news is that technological advances are reducing the cost of connecting and slowly chipping away at the elitist complexity of information technology. The bad news is that the majority of the world’s popula- tion is still largely excluded from even basic telephony. Other, less directly related infrastructure will also need to emerge if the knowledge economy is to reach its potential. The proliferation of independent knowledge producers and consumers implies significant adaptation: of labour codes to new forms of work organisation; of regulatory safeguards able to manage new materials, genetic combinations and a proliferation of unique products; of educational suppliers and certifiers to the lifelong acquisition of knowledge; of social insurance and support systems to different patterns of earning over a day, a year and a lifetime.
How these challenges are overcome will largely determine the extent to which the emergence of the knowledge economy – on balance – ends up serving as a catalyst or constraint to a long boom. If there is a rapid, wide and deep diffu- sion of the new digitally-enabled economy, then there is a good chance that its creative potential will be realised through huge investments in: more efficient, intuitively accessible information technology; a vast range of new genetic permu- tations; the first quantum gizmos; a renewed learning infrastructure that goes beyond the mass-production school system; a huge range of diagnostic, preventa- tive and non-invasive medical treatments and services; an across-the-board con- version of energy generation and conservation technologies; massive renewal of the housing stock as people change both the location and architecture of their homes; and more. A twenty-year boom arising from this surge in investment and productivity seems plausible. Alternatively, the transition to the knowledge econ- omy could end up advancing slowly and failing to diffuse widely. Along this path the gap between information haves and have-nots might grow even wider, exacer- bating the social costs of change. This would in all likelihood lead to investments that never pay off due to both lack of markets and the absence of multiplier effects that arise from synchronised, broad-based change.
In the end, the consequences for growth of a transition to the knowledge economy could end up being negative. An opportunity could be missed and the outset of the next century might instead be described as the long stagnation. The stark contrast between these two outcomes is partly what fuels the debate between those who advocate taking an activist approach to building the infrastruc- ture of a global knowledge economy and those who believe it will emerge without making much extra effort. The activist versus non-activist positions are also distin- guished by contrasting assessments of the scale of the changes implied by the shift to a world dominated by the production of knowledge. Finally, there is another schism that separates the two camps: their views regarding the interde- pendency of the transition to the knowledge economy with both the emergence of global markets and global environmental sustainability. Here again, as discussed
Anatomy of a Long Boom
19
in each of the following two subsections, there is a clear divide between those who do and those who do not advocate concerted action to make sure the catalysts rather than the constraints succeed in propelling tomorrow’s long boom.
The emergence of a global economy for goods, services, finance and technology
The pace at which the world economy moves towards or away from open and transparent global markets for goods, services, capital and technology will be one of the decisive factors determining whether or not there is a long boom. At its most positive, the ambitious goal of creating fully global markets should allow consumers, producers, savers and investors to achieve greater efficiency and to be more innovative. The dividends generated by considerable improvements in allocative efficiency could then be devoted not only to meeting the investment demands of structural change, but also to dealing with regional inequalities and compensating those whose human and/or financial capital are devalued or destroyed in the process.
Alternatively, negative factors such as the potential for new forms or out- breaks of collusion, protectionism and financial volatility could end up undermin- ing efficiency, imposing higher risk premiums and impeding change at the micro level. Here the downside risk is stagnation, as less transparency and reduced competition slow the development and diffusion of the knowledge economy, new institutional frameworks and the redeployment of a range of resources to more productive (and environmentally sustainable) uses. As a result, wealth-creating capacity, the foundation for the long boom, would be weakened. What then are the forces that are likely to encourage or discourage the emergence of fully functioning, efficient global markets for goods, services and capital?
One way of addressing this complex question is to consider the costs, bene- fits and often intricate negotiations that preceded the integration and opening up of markets within a nation or a region. The changes wrought in many OECD coun- tries in the 19th century offer in microcosm a precedent for what it might take to really advance towards true global markets. First, integrating distinct or formerly closed markets is a protracted process that requires skilled and tenacious leader- ship in order to overcome myriad organisational and political, hidden and exposed barriers to transparency and open exchange. Even after a common politi- cal constitution and harmonised regulatory conditions prevail, there are the subtle complications such as effective implementation of antitrust laws and overcoming those regional inequalities (e.g. sufficient scale to support competing retailers) that can impede local competition. Second, there is rarely agreement on reducing the barriers that are identified without the introduction of adjustment mecha- nisms and compensation for the losers. Lastly, when opening the market also opens the door to serious instability and crisis, it is important to have the capacity
The Future of the Global Economy: Towards a Long Boom?
20
to intervene in order to re-establish stability and avoid the even greater costs of complete collapse.
It is therefore important to be modest about what has been achieved so far in terms of creating operational global markets. Equally, it is very clear that to suc- ceed fully, future efforts to integrate markets on a worldwide scale will have to meet the same conditions as previous, less geographically ambitious projects. Such an initiative will certainly build on past achievements and the important increases in trade of goods and services, capital flows and technology diffusion. These accomplishments, however, need to be kept in perspective. After all, most of the trade is intra-regional and intra-firm. The flows of capital investment have mostly been in the form of direct ownership, highly concentrated in a limited num- ber of countries. Indirect portfolio investment has been less quantitatively signifi- cant until very recently, and remains very volatile. Technological leadership is highly concentrated in a few countries and regions within those countries. Diffu- sion is very uneven, for reasons ranging from insufficiently rich local markets to inadequate skill and transportation infrastructures. Simply put, there is still a long way to go before there is a fully global economy.
Yet, it could be argued that this underdevelopment is promising because it also implies that a large share of the gains from the emergence of a global econ- omy are yet to be realised. Less heartening is the implication that there are still many formidable hurdles to be jumped. One of the obstacles already hindering progress is that assessments differ radically as to the problems likely to be encountered and the appropriate solutions. On one side are those who take recent experience with tariff reductions as the most pertinent precedent. From this viewpoint the problem is largely to overcome the resistance of countries to the dismantlement of customs barriers, tariffs, countervailing duties, regulatory controls and various ways of protecting domestic or national firms from external competition. The solution, according to this school of thought, is mostly to be found by exerting pressure either in multilateral/bilateral negotiations or through international sanctions such as refusing entry into the WTO. Eventually, it is con- tended, recalcitrant countries will see that the gains outweigh the costs and join the fold of world markets.
Another standpoint focuses on the forces that create popular opposition to the formation of world markets. Here one of the main concerns is the current asymmetry between national and global treatment of the distributional implica- tions of market integration. From this perspective the economic and social frame- works devised to integrate markets should also be used to create a level playing field globally. As the proponents of this approach point out, it would be absurd in a national context to expect a failing region to be abandoned because its people and business are the losers from openness within the domestic economy. In these
Anatomy of a Long Boom
21
circumstances the winners usually compensate the losers, even if such pro- grammes are not always effective at rapidly putting the losing social group, area or sector back on track. Typically such partial compensation is seen as an acceptable price to pay for the net gains of integrated and transparent national markets. In a similar fashion, proponents of this approach argue that the large gains from forging an integrated world economy provide ample justification for developing frame- works that can take into account the ensuing costs and benefits of adjustment, locational competition, regional inequality, excesses in market volatility and dangers of regulatory races-to-the-bottom.
Realistically, as both schools of thought recognise, the contribution to the long boom made by major improvements in integrating the global economy will have to emerge from a world that is still mostly characterised by national-level mechanisms for guarding against noncompetitive practices, regulating financial and investment flows, and working out commercial, social and environmental dis- putes. Few would disagree that, scaled up to a global level, planet-wide markets will likely generate the same kinds of costs and spectacular benefits as the inte- gration of markets within national or regional space. But consensus about the gains vanishes into considerable disagreement about how to get there. As with the knowledge economy, there are those who advocate ambitious new initiatives as the most effective means of realising the gains of global markets and propelling the economic dynamism behind a long boom. On the other side are those who either consign the hope of forging more comprehensive global agreements and institutions to the realm of unrealistic ideas, or fail entirely to see the utility. Recently a new element has entered this debate, opening up new prospects for a more ambitious agenda. It is possible, as discussed next, that efforts to achieve global environmental sustainability could end up contributing considerably to the negotiation and introduction of both more globally integrated markets and the regulatory and institutional infrastructure to go with them.
Working towards global environmental sustainability
Recent years have seen the emergence of a ground swell of recognition that the world as a whole cannot follow the natural-resource and energy-intensive pat- terns of production and consumption taken by most OECD countries in the past. The current global energy system, predominantly based on fossil fuels, is inher- ently linked to the increase of atmospheric CO2 concentrations and hence to accel- erating disruption of the global climate system. As industrialisation and urbanisation take hold in developing countries, and as the lifestyles, modes of consumption and high-energy-use patterns of the industrialised economies dif- fuse worldwide, the risk looms ever larger that over the next fifty years there will be a fourfold increase in energy demand in the developing countries. Gradual,
The Future of the Global Economy: Towards a Long Boom?
22
marginal changes, though important, are increasingly perceived as likely to be insufficient to reach an environmentally sustainable trajectory within the next half-century. Changes will have to be much more fundamental, and they will have to be initiated in the very near future if sustainability is to be brought within reach. Energy infrastructures, urban settlements, the construction of dwellings, transport systems, the nature of the industrial capital stock, consumer technologies, values and attitudes – all these things that tend to lock societies into set patterns of energy-intensive production and consumption may take decades to change.
The potential to achieve such change and set the world economy on an envi- ronmentally more sustainable growth path is undeniable. A cluster of develop- ments point in this direction: the gradual shift in economic structures away from manufacturing towards services; the considerable technological potential for major improvements in energy efficiency, for example in transport and in build- ings; the emerging information society, with the prospect of telework, teletrade and the more energy-efficient reorganisation of work and production; and finally, the promise that rising global affluence will lead to higher demands (and willing- ness/ability to pay) for environmental quality. At a global institutional level, a suc- cession of international agreements from Rio to Kyoto have created relatively favourable framework conditions for a new start.
However, it is becoming equally clear that the outcome of efforts to reduce the carrying costs of human activity will depend fundamentally on how such a goal is achieved. Some policies might accelerate the changes that propel a long boom, while others may seriously undermine robust wealth creation. For example, the pricing policies that bring about deep, enduring transformations to the energy intensity of the infrastructures underlying the economy (transport, urban, etc.) could trigger hugely beneficial waves of innovation and creativity in ecologically benign approaches to production, consumption, and lifestyles in general, and those in turn could provide an important stimulus for efficiency, long-run produc- tivity growth and high, sustained economic performance. Alternatively, by impos- ing additional criteria on economic choices, environmental targets could hamper promising technological developments, generate extra costs for efficiency-enhancing changes, and stifle innovation. The question, then, is not if but how the world can take growing global environmental costs into account in order to shift to a more sustainable pattern of activity.
Starting where there is agreement, most solutions see the need for economic incentives to go to work changing the micro-level choices made by managers, investors, engineers and consumers, be they in the public or private sector. Confi- dence in market signals reflects the experience of most OECD countries that were able to change fairly dramatically the direction of growth rates in aggregate energy-to-output ratios after the oil price shocks. There is also fairly widespread
Anatomy of a Long Boom
23
optimism that the appropriate incentive structures will be met with sufficiently widespread innovation- and efficiency-enhancing resource reallocation to avoid undercutting productivity growth. Disagreement, however, sets in when it comes to what is meant by “appropriate incentive structures”.
Fundamental schisms can be identified in three areas. First there is the question of the degree of social engagement – the incentives and disincen- tives of peer pressure or cultural norms – deemed necessary to reach sustain- ability objectives. On one side there are those who argue that market signals alone can do the job. On the other there are those who believe that a broader approach involving a rearticulation of values and a willingness to embrace col- lectively determined environmental objectives will be essential. Bridging this divide will be difficult because it reflects fundamentally distinct political phi- losophies. This gulf leads to a second schism, over the extent to which basic universal rights to the planet’s ecological capacity should be made the corner- stone of the collective governance of the “appropriate incentive structures”. Finally, there are many disagreements about how to share out the benefits and the burdens that go along with the taxes, permits and quotas that will be used to internalise the externalities. Here the devil is in the details and the distribution of power to resolve them.
All of these schisms are pertinent to the realisation of the long boom in so far as they might jeopardise the achievement of the requisite innovation and produc- tivity growth. Furthermore, given the high stakes should efforts to redress growing global environmental hazards fail, there seems to be little justification for under- estimating either the kinds of resources or the power over them that will have to be reapportioned in order to attain the goal of sustainability. A plausible case can be made that dithering and failing to make decisions or provide clear leadership could, one way or the other, blow the chances of making the transition to a more sustainable form of economic dynamism. The reasons for this are rooted in the nature of economic dynamism, its complex interplay of technological, institutional, resource, competitive and aspirational conditions. Even though this tapestry has been rewoven on numerous occasions as the world economy has moved through different phases, it has so far never been done without very high costs. As tempt- ing as it might seem to believe that this time around it will be different, experi- ence argues for prudence and concerted action to achieve such a difficult goal. Policy choices will be the key.
3. Policies for provoking a long boom
The preceding anatomy of the long boom shows that its prospects depend, first on the underlying “motor” systems that sustain long-run economic dynamism in general, and second on the historically specific possibilities that serve as fuel.
The Future of the Global Economy: Towards a Long Boom?
24
On both counts, the prospects for a long boom during the first decades of the next century would improve significantly if inter-systems harmony and convergence were to reign. Not because harmony is always superior to dissonance when it comes to moving systems forward or that convergence is possible without prior divergence, but because of the singular importance right now of the global diffu- sion of knowledge, of new institutions and of common objectives to realising a long boom. Viewed from a policy perspective, provoking rates of economic develop- ment well above the historical average will depend on making choices that, first, lead to an exceptionally strong and enduring period of systems harmony and con- vergence, and second, succeed – at a global level – in leveraging simultaneously rapid technological progress, deep market integration and a productivity-enhancing reorientation of microeconomic choices towards environmental sustainability.
Certainly there are no foregone conclusions. Future stagnation in the underly- ing technological, institutional, material, competitive and aspirational forces that drive improvements in efficiency and wealth-creating capacity cannot be ruled out. Nor can the possibility of a stalled transition to the knowledge economy, frag- mentation of the world economy and a failure to shift the global environmental trajectory towards sustainability be excluded. Any or all of the five general deter- minants of overall long-run economic dynamism could fail either to develop or to be woven in with the others. Each of the three sets of catalysts and constraints of this historically specific long boom could be overwhelmed by the constraining rather than catalysing possibilities. Expansionary forces might be cancelled out by contractionary trends in another area; for example, successful globalisation could be undermined by the high costs of failed sustainability or strong knowledge dif- fusion through the Internet being undermined by the shredding of global markets due to sharp inter-regional conflicts. Finding policies that can navigate these var- ied and intricate problems will be a major challenge facing governments at the outset of the new millennium.
General policy criteria
One starting point for this task is to identify the types of policies that cor- respond best with the requirements for both economic dynamism and a long boom. At a general level progress along this path is likely to be most effec- tively encouraged by two categories of policy, one that fosters creativity and facilitates change, and the other that goes beyond simply reducing conflicts at a global level to creating a new, much higher degree of co-operative action.
Fostering creativity and change
The first group of policies involves initiatives that support people’s capacity to experiment, innovate and take risks, both locally and globally. Traditionally
Anatomy of a Long Boom
25
the terrain for policies that improve incentives, information and insurance for people and enterprises has been the nation state. Within the national territory governments introduced the infrastructure of laws, common currency, regula- tions, universal education, shared language and a range of social insurance schemes – from unemployment and pension programmes to subsidies for restructuring. Many of these policies, at one time or another, played a part in reducing uncertainty, cutting transaction costs, facilitating the acceptance of often painful resource reallocation, fostering innovation and encouraging risk taking.
For the future, three fields could prove to be fertile ground for new policy initiatives, both in the public and private sectors. First, there are many rules, regulations, programmes and products that are stuck in the mass era. There is still a long way to go in reforming entrenched attitudes to such things as one-size-fits-all products, passive chain-of-command organisational structures and lack of responsiveness to customers’ or citizens’ needs. Second, there are the various antiquated incentive systems, from rigid seniority-based compen- sation packages and career ladders to risk-discouraging social insurance, taxa- t i o n a n d r e g u l a t o r y s c h e m e s , t h a t a c t i v e l y d i s s u a d e i n n o v a t i o n a n d experimentation. Third and last are the more positive experimental initiatives that create new spaces where entrepreneurship and individual responsibility find a conducive framework for taking risks. In the future, as already discussed in 21st Century Technologies, the pay-off from the national-level policies that lib- erate creativity is likely to be very significant as people take advantage of the build-up in technological and intellectual capacity to develop the local foundations for a sustainable global knowledge economy.
Relative to domestic policies to foster change, international-level policies have one handicap and one advantage. The handicap is that so far the inten- sity of economic activity at the global level is much less developed than at a local level. As a consequence, the scope has been more limited for the kinds of experimentation, innovation, and forging of risk reduction schemes, com- mon codes and the socio-economic lubricants that are typical of everyday transactions. The advantage at the international level is the relative absence of yesterday’s institutional and regulatory infrastructure to act as a fetter on the future. In most areas of the global economy, apart from conventional trade in goods, the process of creating the institutional setting capable of delivering the trust, transparency and integration that characterises national space is still in its infancy. In the future, concerted efforts will be needed to provide global frameworks capable of establishing the fluidity and confidence that usually characterise national space in areas such as intellectual property rights, elec- tronic commerce, foreign direct investment, capital markets and technology diffusion.
The Future of the Global Economy: Towards a Long Boom?
26
Fostering global co-operation
The pursuit of these frameworks at the global level leads to the second group of policies likely to be essential for realising a long boom – initiatives that enhance the capacity to resolve conflicts at a global level. Such efforts will be important for two reasons. The first is that, as past experience shows, conflicts could well develop between policies meant to nurture innovation and smooth the acceptance of open competition at the national level, and those that reach towards the integration of the world economy. Resolving this kind of friction, where the protection and encouragement of local interests come into conflict with the introduction of common standards, shared codes and the non-discrimination requirements of a sustainable global knowledge economy, will be crucial for mak- ing progress at the worldwide level. So far these contradictions have only been worked out at a deeper level in regional or federal contexts such as the European Union, where integration depends in part on the capacity to co-ordinate and develop the institutional and regulatory infrastructure that moves towards eliminating the distinction between domestic and cross-border risk taking.
The second reason why policies to enhance conflict resolution capabilities will be important for creating the conditions underlying a long boom is the critical role of global-level action. Ushering in a worldwide knowledge economy, the inte- gration of international markets and environmental sustainability will demand a much higher degree of organisation and effective decision making. Perhaps the most positive precedent, decades of successful negotiation of trade liberalisation, actually demonstrates how hard it is to find both the institutional mechanisms and packages of trade-offs that can reconcile conflicting interests.
Indeed, as many current impasses at the international level demonstrate, existing institutional capacity is still inadequate to the task of introducing the risk-reducing frameworks and broader win-win trade-off schemes needed to forge an integrated global economy. Developing effective global mechanisms for mak- ing decisions that go beyond zero-sum games and actually organise integrated policy actions, such as the enforcement of antitrust or safe e-commerce, will be essential in creating the suppleness and inventiveness to power a long boom. The pursuit of environmental sustainability, for example, may pave the way for new institutional possibilities such as those entailed by the introduction of globally tradable CO2 quotas.
Scenario-derived policies
One method for teasing out the elements and testing the feasibility of ambi- tious policy agendas required to provoke a long boom is to examine a number of scenarios where – with slightly different policy mixes – all of the various pieces might fall into place. For example, clear policy distinctions emerge from three
Anatomy of a Long Boom
27
plausible trajectories (elaborated in detail in the final chapter): “growth leader”, where a booming United States drives the world forward; “growth shift”, where the worldwide diffusion of economic dynamism promises a swift convergence of much of the developing world with the developed; and “growth clusters”, where a densely connected network of innovative metropoles and regions spur far-reach- ing global change. Common to all the scenarios is the expectation that there will be little divergence from the prudent macroeconomic, fiscal and structural adjust- ment policies that are essential for creating a predictable and flexible investment context. Where the scenarios differ is in the driving forces and associated policies, both national and international, that set the long boom in motion.
Growth leader
In the first scenario, uncontested and invigorated American leadership pushes the technological frontier forward at a fast pace worldwide. Innovation is u n l e a s h e d a l o n g w i t h h y p e r - c o m p e t i t i v e p r e s s u r e s a n d t h e r a p i d c r e - ative-destruction of unconstrained economic flexibility. In policy terms, the pri- mary focus is on national initiatives for facilitating radical changes in economic and social organisation in the pursuit of innovation-based productivity and profits, although global frameworks for protecting intellectual property rights and foreign direct investment play an important role. New international institutional arrange- ments are not, however, essential for success, leaving the negotiation of initiatives aimed at improving environmental sustainability on a slower track. There would nonetheless have to be a continuation of existing trends towards fiscal and mone- tary policies aimed at macroeconomic stabilisation as well as increased liberalisa- tion of trade in goods, services and finance. The hard edges of economic imperatives and social inequality could become even sharper than they are today.
Growth shift
The second scenario sees the emerging economies of Asia, Latin America and perhaps Russia jumping on a rapid convergence track to the productivity and income levels of OECD countries. Here, the integration of world markets combines with the opportunity for developing countries to adopt global best practices. This in turn opens the door to a highly productive international division of labour. Most OECD economies prosper by focusing on intangibles and the adjustments to age- ing, while the rest of the world leapfrogs along the industrial path to catch up with the most advanced productivity levels. The policy key is at the international level, where the free flow of goods, services, finance, technology and skills enables the kind of investment and knowledge transfer necessary for take-off in the develop- ing world. At the same time, with the deep intertwining of interests, it could become much easier to get the co-operation needed to effectively pursue global
The Future of the Global Economy: Towards a Long Boom?
28
financial stability and environmental sustainability, and to improve the chances of the world’s poor and excluded.
Growth cluster
The third scenario envisions a long boom powered by the dynamism of net- worked growth clusters – world-spanning urban and regional hotspots of innova- tion and communication. Business and local governments work in tandem to develop the infrastructure and connections that catalyse a high-growth cluster. In this scenario, productivity growth explodes as the efficiency-enhancing impact of information technology finally pays off. Geographic advantages that arise from proximity, like in Silicon Valley, combine with the advantages of the virtual com- munities springing up on the Internet. Competition and innovation are fierce as knowledge-sharing and access to inexpensive technology lower start-up costs on the supply side and help inform consumers on the demand side. Facilitating elec- tronic commerce in ways that lower both entry and transaction costs will entail policy breakthroughs in the areas of global antitrust, privacy, intellectual property and payment regulation and enforcement. Sustainability objectives could be served by the acceleration towards less resource-intensive economic activity, but modest requirements for international co-operation under this scenario may limit progress on issues like climate change and global inequality.
Clearly, pushing growth to the above-average rates of these long boom sce- narios will call for more stringent requirements, and a degree of policy initiative that goes well beyond current thinking. Initially, the need for global systems har- mony and convergence puts a premium on the policy makers' difficult task of artic- ulating common goals and creating shared frameworks. The job will be made even more challenging because a long boom involves very high levels of experimenta- tion and diversity that will, of necessity, generate gaps between the successful and failed projects. Bridging these divides will in all likelihood demand approaches towards encouraging risk-taking and change that go well beyond the traditional economic and social policy frameworks of the mass-production, mass-consumption and mass-government era.
Continuity and change – policies for provoking a long boom
Innovative policies at the local, national and global levels will be essential in order to spur creativity in all domains, from the emerging markets of the knowledge economy to the virtual enterprises and communities of a fully networked world. But, unlike the protracted process of introducing the property and labour laws that underpinned industrialisation, launching a long boom will require a rapid burst of enabling legislation covering everything from fine-tuning the protection of increasingly diverse forms of intellectual property to the economic incentives for
Anatomy of a Long Boom
29
introducing environmentally less harmful energy systems. Policies at the top of the agenda for encouraging a long boom will need to draw on the most promising opportunities that arise as real-world changes intermingle elements of the growth leader, growth shift and growth clusters scenarios. One way of coming to grips with the scope of a long boom policy agenda, at both the national and international lev- els, is to distinguish those areas where continuity might be sufficient from those where innovative breakthroughs are probably necessary.
Continuity
Considering the national level first, there are a number of existing policy pri- orities that will continue to be important. Efforts to maintain macroeconomic sta- bility, based on government policies that aim for low inflation and solid public sector finances, will continue to help reduce uncertainty, while ongoing reforms meant to facilitate structural adjustment, including flexible labour markets, open and transparent capital markets, and competitive goods and services markets, promise continued improvements in the efficiency with which economic resources are allocated. Both of these traditional policy thrusts will help create the condi- tions conducive to the very high levels of investment and productivity.
Similarly, a continuation of the shift in government’s role from direct provider of often uniform products and services towards a regulator of more diversified, decentralised and market-driven provision will help trigger and sustain a long boom by enhancing general economic efficiency and flexibility. Continued empha- sis on reforms that help companies and governments to overcome the rigid, hier- archical methods of the past will also play an important part in spurring the introduction and invention of new products and services, new processes and tech- nologies, and new ways of organising work and daily life. In addition, efforts will be needed at an international level to help extend and deepen the multilateral pro- cesses aimed at liberalising trade, investment and technology flows; improving corporate governance and financial transparency; and controlling various dangers such as infectious diseases and toxic chemicals. Persistence and vigour will be needed in applying current policies.
Breakthroughs
Above and beyond the difficulties of activating the catalysts and overcoming the constraints, the prospects for a long boom also hinge on the impact of systems harmony and dissonance, convergence and divergence. The implications for a long boom are difficult to untangle because, on the one hand, there are times when the sharp conflicts of dissonant systems (e.g. the United States versus the Soviet Union) or harmony (e.g. integration of the EU) can help to propel experi- mentation and above-average expansion. On the other hand, there are times
The Future of the Global Economy: Towards a Long Boom?
30
when systems dissonance (e.g. civil war) or harmony (e.g. cartels) can cripple dyna- mism altogether. Similarly, alternate phases of convergence and divergence across and within systems can be an important mechanism for spurring dynamism by opening up learning, innovation and investment opportunities. Unfortunately divergence, as is evident from the unevenness of development and the growing inequality between rich and poor, is not always automatically self-correcting. Closing the gap requires active and effective responses. Here, as in other areas, the key to the realisation of the long boom will turn on making major policy breakthroughs.
For instance, fairly dramatic changes may be needed in areas such as social support systems, where the old ways of balancing risk-taking and security tend to stifle the much higher levels of adaptability, creativity and diversity that are essential to fuel the knowledge economy and society. In education, finally making the leap to lifelong learning will probably demand a breakthrough that pushes beyond the domination of existing educational institutions towards new ways of validating what people know regardless of how they have acquired that knowl- edge. In addition, developing new forms of risk-sharing and social solidarity will require major advances in the networks, work rules and incentives that facilitate co-operation, particularly at the local level. Perhaps the largest leaps for national- level policy will be those that occur in response to the challenge of reallocating responsibility. Such reallocation needs to occur not only between public and private organisations but also across local, regional and global levels.
At the international level the primary breakthrough may involve moving beyond reasoning from national considerations towards a logic that embraces the interests of the planet as a whole. A long boom will require accelerated and often more ambitious, planet-wide approaches to a number of key challenges. For instance, realising the full potential of information and communications technology, electronic commerce and the Internet will demand global solutions to such issues as consumer protection, safeguarding privacy, secure payment, verifying identities, attributing intellectual property rights and ensuring competitive market conditions.
Speeding up the intricate negotiations that pave the way to fuller market integra- tion will push to the forefront debates over the most effective and acceptable solu- tions to the economic and social trade-offs. Without consideration of both efficiency and distributive issues, political success is probably unattainable. On the environ- mental front everything from global warming and bio-diversity to management of the world’s fish stocks and oceans more generally will call for planet-wide perspectives and mechanisms capable of aiming at policy choices that are both efficient and politi- cally acceptable. Finally, nations are being asked to leap past old modes of thinking when it comes to the global application of the rule of law in order to achieve goals like reducing corruption and drug trafficking, prosecuting crimes against humanity or eval- uating the attainment of the environmental goals spelled out in international treaties.
Anatomy of a Long Boom
31
4. Conclusion
Overall, this is not a modest policy agenda. The realisation of a long boom will depend on the continuing spread of the basic systemic attributes that have underpinned two centuries of long-run economic dynamism in OECD countries. Indeed this is likely to be the easy part, since the three sets of generic system attributes that played such a crucial role in the past do seem set to spread. More parts of the world are expected to grapple with the potent mixture of economic drivers and political expression that comes from combining democracy and com- petitive markets. The pluralism, transparency and openness that underpin the capacity to innovate and adapt are also spreading wider roots, albeit with consid- erable difficulty. Lastly, with respect to culture, there are signs that in the future people will not only accept but actively pursue and desire ways of creating a more densely networked world capable of achieving a workable balance between co-operation and competition, identity and integration. Civil society around the globe is on the path, albeit slowly and often at high cost, to improved ways of seeking diversity and combining security with risk-taking.
Provoking a long boom will undoubtedly necessitate combining as many of the available catalytic forces as possible. The most promising paths are probably those that encourage the openness and creativity of entrepreneurial exuberance; high degrees of international co-operation to facilitate the rapid development and diffusion of the know-how and technologies that underpin economic convergence; and dense global networks which both intensify competition and foster the joint undertakings of business, government and individuals. Such a vibrant develop- ment trajectory could make the best of the possibilities open to humanity on the eve of the 21st century. But possibilities are not always realised. The last few decades have also witnessed much deepening of inequality and exclusion. Reversing these trends could be one of the greatest benefits of a long boom and one of the main reasons for making the exceptional economic and social policy efforts required.
In the end, it is how decision makers – managers, investors, engineers, and consumers – respond (or not) to everyday challenges that will determine future outcomes. They will make their choices from where they are, in their homes, work- places, boardrooms and parliaments. The final results may be surprising, may fail to correspond either to what policy makers intended or the values that people believe in. Such incongruity between intentions, desires and outcomes are endemic to human endeavour. For there are times when the low-power choices made by millions of individuals can have more impact than the solemn proclama- tions of high-powered governments. Nevertheless, it is human actions – whether they are just or right, by volition or inertia – that will make the difference between stagnation and dynamism, slump and boom over the next few decades. As a
The Future of the Global Economy: Towards a Long Boom?
32
consequence, policy makers must accept a dual challenge, to find ways to encour- age economic dynamism combined with a long boom and to do so in ways that are consistent with people’s expressed values and aspirations. Such an ambition, often taken for granted, will probably be even more complex in the diverse and interconnected world of tomorrow. But it offers the chance of ushering in an unprecedented period of improvement in the human condition.
33
2
2Sources of Continued Long-run Economic Dynamism in the 21st Century
4by
5Richard G. Lipsey Simon Fraser University, Canada
1. Introduction
Observers of past and current trends have suggested many possible scenarios for growth and dynamism in the OECD countries in the first half of the 21st century. These range from secular stagnation at one extreme to accelerating technical change leading to periods of social and political unrest at the other. Where might the West perform between these extremes of stagnation and excessive dynamism?
To begin to come to grips with the issues, and the conjectures that must be an important part of any answers – for we are well outside of the range of modestly confi- dent econometric projections – it is necessary to cover several topics. First is the nature of technological change and its relation to economic, social and political struc- tures. Secondly, there are the technologies that can already be perceived at, or rising just above, the visible horizon. The third relates to those macroeconomic forces that may discourage or encourage the exploitation of technological potential, and the fourth to public policies that may do the same. Finally, there are the political and social stresses that will be created by evolving technological paradigms.
2. Growth and technological change
Sources of growth
Following Mokyr (1990), economists distinguish three main sources of economic growth:
– Increases in the size of the market – Market size can increase for many reasons: new discoveries, as when Europe expanded in the 16th and 17th centuries;
The Future of the Global Economy: Towards a Long Boom?
34
increases in population, such as occurred in the 19th century; reductions in transportation costs, which have been going on for the last two centuries; and reductions in trade barriers, such as have been accomplished by trade liberalisation policies in the last half of this century. All these allow the exploitation of scale economies previously unexploited. Also, a growing economy encourages innovation by reducing risk because it is easier to finance new technologies and sell new things in expanding rather than in static or contracting markets.
– Capital investment – In standard economic analysis, pure investment in physical and human capital is distinct from technological change.
– Technical change – In the long term, changes in product and process technologies are potent sources of economic growth.
Although this threefold classification can be useful, it is also potentially mis- leading since these forces typically interact, making the separate contribution of each difficult or impossible to distinguish. Consider two important illustrations. First, market size and technological change are interrelated since the falling trans- port costs that raise the size of markets are usually driven by technological changes in the transport industry – such as the introduction of containers and the replacement of 10 000 ton tankers and freighters by super-tankers and large con- tainer ships in the 1960s. Second, investment and technological change are usu- ally interrelated because most new product and process technologies must be embodied in new capital goods before they can be used. Thus rapid technological change is typically associated with high rates of investment to embody it.
Technological change versus investment
Economists have sometimes debated which is the more important cause of long-term growth, pure investment or technological change. This debate is important here because it concerns the sources of long-term economic dynamism.
The author argues for the importance of technological change with a simple thought experiment. Imagine freezing technological knowledge at the levels exist- ing at some point in the past, say 1900, while continuing to accumulate more 1 9 0 0 - v i n t a g e m a c h i n e s a n d f a c t o r i e s a n d u s i n g t h e m t o p r o d u c e m o r e 1900-vintage goods and services, as well as training more people longer and more thoroughly in the technological knowledge that was available in 1900. Today’s liv- ing standards would then be vastly lower than those we now enjoy (and pollution would be a massive problem). The contrast is even more striking if the same thought experiment is performed comparing today with the knowledge, product and process technologies that existed at even earlier points in time.
This exercise illustrates what economic historians and students of technology are agreed on: technological change is the major determinant of long-term, global
Sources of Continued Long-run Economic Dynamism in the 21st Century
35
economic growth. So the problem of explaining growth over time and across coun- tries is mainly one of explaining the generation, adaptation within one country, and international diffusion of new product and process technologies. In the long term, these new technologies transform our standards of living, our economic, social and political ways of life, and even our value systems.
Are we to conclude then that saving, investment and capital accumulation do not matter? The answer is “no”, because virtually all new technology is embodied in new capital equipment whose accumulation is measured as gross investment. Technological change and investment are thus complementary, the latter being the vehicle by which the former enters the production process. Anything that slows the rate of embodiment through investment, such as unnecessarily high interest rates, will slow the rate of growth, just as any slowdown in the development of new technology will do so in the long term.
So, just because new investment can statistically “account for” most economic growth, that does not imply it is the main cause of growth. Both technological change and investment are needed. Nonetheless, faced with the choice, most of us would prefer to live in a society in which technology advanced but was only embodied through “replacement investment” since net investment (and hence measured capi- tal accumulation) was zero, rather than in a society in which nothing was known that was not known in 1900 and more and more investment had been made in 1900-style productive facilities to produce 1900-style goods and services.1
A structuralist-evolutionary (S-E) model of technological change2
To discuss technological change and economic dynamism, some framework is needed – a theoretical model. The standard neoclassical model, illustrated in Part A of Figure 1, shows inputs passing through a macro-production function to produce the nation’s output, as measured by its gross domestic product (GDP). Any structure or institutions are hidden in the “black box” of the aggregate pro- duction function where, presumably, they help to determine its form.
The author’s model is designed to highlight some of the elements of the neo- classical black box that research in technological change demonstrates to be important for economic dynamism. This model shows the economy’s structure and is in line with much microeconomic research on the evolution of technology (hence the term “structuralist-evolutionary” or “S-E” for short). Its six main elements are shown in Part B of Figure 1.
Technological knowledge is the idea set specifying all things that assist in creating economic value. This includes the specifications of all outputs of goods and ser- vices (product technologies), all the processes used to create them (process tech- nologies) and all forms in which production processes can be organised both on the “shop floor” and in management (organisational technologies).
The Future of the Global Economy: Towards a Long Boom?
36
The facilitating structure is the realisation set for technologies. It comprises 1) all physical capital, 2) all human capital (embodied in people), 3) the organ- isation of production facilities, including labour practices, 4) the managerial and financial organisation of firms, 5) the geographical location of industries, 6) industrial concentration, 7) all infrastructure, 8) all private-sector financial institutions, and financial instruments. To repeat, the facilitating structure is the embodiment of all technological, product, process and organisational knowledge.
Figure 1.
Part A
Part B
INPUTS PRODUCTION FUNCTION PERFORMANCE
TECHNOLOGICAL KNOWLEDGE
FACILITATING STRUCTUREINPUTS PERFORMANCE
POLICY STRUCTURE
POLICY
Part A shows the neoclassical approach. Inputs of labour, materials and the services of physical and human capital flow through the economy’s aggregate production function to produce economic performance, as measured by total national income. The form of the production function depends on the economy’s structure and its technology, but these things are hidden in a black box, the only manifestation of which is how much output emerges from a given amount of inputs.
Part B shows our structuralist-evolutionary approach. Technological knowledge is the idea set for all products, process, and organisations that create economic value. The facilitating structure is the realisation set and includes the capital goods that embody much of the technology, the internal organisation of firms, the geographical location and concentration of industy, the infrastructure, and the financial system. Inputs pass through the structure to produce economic performance. Policy is the idea set of public objectives and the specification of means. The policy structure is the realisation set that gives effect to policy, including all kinds of public institutions. Policy, working through the policy structure, influences the facilitating structure, technological knowledge and the quantity/quality of inputs.
Figure 1.
Part A
Part B
INPUTS PRODUCTION FUNCTION PERFORMANCE
TECHNOLOGICAL KNOWLEDGE
FACILITATING STRUCTUREINPUTS PERFORMANCE
POLICY STRUCTURE
POLICY
Part A shows the neoclassical approach. Inputs of labour, materials and the services of physical and human capital flow through the economy’s aggregate production function to produce economic performance, as measured by total national income. The form of the production function depends on the economy’s structure and its technology, but these things are hidden in a black box, the only manifestation of which is how much output emerges from a given amount of inputs.
Part B shows our structuralist-evolutionary approach. Technological knowledge is the idea set for all products, process, and organisations that create economic value. The facilitating structure is the realisation set and includes the capital goods that embody much of the technology, the internal organisation of firms, the geographical location and concentration of industy, the infrastructure, and the financial system. Inputs pass through the structure to produce economic performance. Policy is the idea set of public objectives and the specification of means. The policy structure is the realisation set that gives effect to policy, including all kinds of public institutions. Policy, working through the policy structure, influences the facilitating structure, technological knowledge and the quantity/quality of inputs.
Figure 1.
Part A
Part B
INPUTS PRODUCTION FUNCTION PERFORMANCE
TECHNOLOGICAL KNOWLEDGE
FACILITATING STRUCTUREINPUTS PERFORMANCE
POLICY STRUCTURE
POLICY
Part A shows the neoclassical approach. Inputs of labour, materials and the services of physical and human capital flow through the economy’s aggregate production function to produce economic performance, as measured by total national income. The form of the production function depends on the economy’s structure and its technology, but these things are hidden in a black box, the only manifestation of which is how much output emerges from a given amount of inputs.
Part B shows our structuralist-evolutionary approach. Technological knowledge is the idea set for all products, process, and organisations that create economic value. The facilitating structure is the realisation set and includes the capital goods that embody much of the technology, the internal organisation of firms, the geographical location and concentration of industy, the infrastructure, and the financial system. Inputs pass through the structure to produce economic performance. Policy is the idea set of public objectives and the specification of means. The policy structure is the realisation set that gives effect to policy, including all kinds of public institutions. Policy, working through the policy structure, influences the facilitating structure, technological knowledge and the quantity/quality of inputs.
Sources of Continued Long-run Economic Dynamism in the 21st Century
37
Public policy is the idea set covering the specifications of public policy objec- tives, which are expressed in such things as legislation and precedent.
The policy structure is the realisation set embodying the means of achieving public policy in the design of public sector institutions, rules and regulations and the human capital of those who administer these public institutions. (Note the parallel with technology and its embodiment in the facilitating structure.)
Inputs of labour and raw materials are fed through the facilitating structure to produce the system’s economic performance.
Economic performance covers aggregate GDP, its growth rate, and its breakdown among sectors and among such broadly defined groupings as goods production and service production; GNP and its distribution among size and functional classes; and total employment and unemployment and their distribution among such subgroups as sectors and skill classes.
Economic performance is determined by the interaction between inputs and the existing facilitating structure. That structure is in turn influenced by technology and public policy. It follows that changes in technology typically have no effect on performance until they are embodied in the facilitating structure. Furthermore, the full effects on performance will not be felt until all the elements of the structure have been adjusted to fit the newly embodied technology.
Characteristics of technological change
To study the causes and consequences of technological change, it is neces- sary to examine a few of the characteristics of the changes that have been going on over the last few centuries and that will go on during the next. This section states in general terms many of the things that are illustrated in later sections.
Endogenous change
Because R&D is an expensive activity which is often undertaken by firms in search of profit, technological change is to a great extent endogenous to the eco- nomic system, altering in response to changes in perceived profit opportunities. An abundance of empirical evidence suggests that competition in both product and process technologies drives much endogenous technological change. In man- ufacturing and many modern service industries, failure to keep up with one’s opponents in new technologies is far more serious than the choice of a wrong price or an inappropriate capacity.
Uncertainty
Because innovation means doing something not done before, there is an element of uncertainty (in Frank Knight’s sense of the term) in all innovation.3 As
The Future of the Global Economy: Towards a Long Boom?
38
a result, massive sums are sometimes spent with no positive results, while trivial expenditures sometimes produce results of great value. Furthermore, the search for one objective often produces results of great value but for very different objectives.
Uncertainty is involved in more than just making some initial technological breakthrough. There is enormous uncertainty with respect to the range of appli- cations that some new technology may have. The steam engine, electricity, the telephone, radio, the laser, the computer, the VCR, and fibre optics are exam- ples of technologies that were initially thought to have very limited potential, and that did have very limited actual applications during the first decades of their life.
Types of change
The overall technology systems of all growing economies evolve along paths that include both small incremental improvements and occasional jumps. To dis- tinguish these, investigators often define two categories. An innovation is incremen- tal if it is an improvement to an existing technology. An innovation is radical if it could not have evolved through incremental improvements in the technology that it displaces – e.g. artificial fabrics could not have evolved out of the natural fabrics that they displaced in many uses.
An extreme form of radical innovation is called a general purpose technology (GPT). GPTs share some important common characteristics: they begin as fairly crude technologies with a limited number of uses; they evolve into much more complex technologies with dramatic expansions in the range of their use across the economy and in the range of economic outputs that they help to produce. As they diffuse through the economy, their efficiency improves. As mature technolo- gies, they have many complementarities in the sense of co-operating with many other technologies.4 A mature GPT is defined formally as a technology that is widely used, has many uses, and has many complementarities with other existing technologies. The steam engine, the dynamo and the internal combustion engine are examples of major GPTs in the field of energy generation.
Induced changes in the facilitating structure
The full potential of developing new technologies can only be achieved when they operate within a facilitating structure that fits them. To see what is involved in the link from technology to facilitating structure, a number of points need to be established.
First, when elements of technology change, various elements of the facilitat- ing structure change adaptively. For example, a new method of making steel will have to be embodied in new equipment and possibly new plants. This may affect
Sources of Continued Long-run Economic Dynamism in the 21st Century
39
the optimal plant size and hence the degree of concentration in the steel industry, as well as the location of steel plants. Various elements of the public infrastructure may need to be changed. So, too, will human capital change whenever the new methods require amounts and types of skills that differ from those required by the old methods. These changes are made mostly by self-interested agents who are responding to the price and profit incentives created by the change in technology.
Second, at any moment in time, the facilitating structure may be better or worse adapted to any given state of technology. For example, labour practices with respect to job demarcation, which adapted well to the Fordist production methods, are only slowly adjusting to the new Toyotaist production methods that have already been installed.
Third, there are substantial inertias in most of the elements of the structure. Much capital is highly durable and, as long as its variable costs of operation can be covered, it will not be replaced by new capital embodying some superior tech- nology. The new pattern of industrial location and firm concentration will not be finalised until all the firms and plants are adjusted to the new technology – it took nearly forty years for electric motors to fully replace steam engines in factories after they had demonstrated their clear superiority. The optimal design of plant and management practices may not be obvious after the introduction of a new technology (as was the case with the computer). The understanding of what is needed by way of new infrastructure may take time, as will its design and con- struction (witness long discussion about the new information highway). New requirements for human capital must be established and the appropriate training devised – both on the job and in school.
Fourth, the period of adjustment is often “conflict ridden” [Freeman and Perez’s (1988) term] because old methods and organisations which worked well – often for decades – begin to function poorly in the new situation and often become dysfunctional. Furthermore, the uncertainty accompanying any radical new innovation implies that there will be many different, but defensible, judgements about what adaptations are actually needed.
Fifth, changes in technology and the resulting changes in the facilitating struc- ture can require adaptations in policy and the policy structure. For example, tech- nological changes often turn natural monopolies into highly competitive industries. Thus the post office once had a natural monopoly in the delivery of hard-copy messages, but today’s competition comes from fax, e-mail, satellite links, and a host of other technologies that have made this activity highly competi- tive. A new technology can also do the reverse by introducing scale economies large enough for natural monopolies to emerge in what was previously an industry in which a few firms rigorously competed with each other.
The Future of the Global Economy: Towards a Long Boom?
40
Policy and the policy structure
Reactive changes – How the policy structure reacts to technological change is an important determinant of a society’s technological dynamism. However, adjust- ments typically occur with long lags. Uncertainty can make it unclear what reac- tions are needed. Inertias in political decision taking, plus the resistance of vested interests who will be hurt, either by the new technologies or by the accom- modating changes in policy, can slow the process of adaptation. For example, US legislators spent decades arguing over the revision of the Glass-Steagall Act, long after the information and communications technologies (ICT) revolution made prohibitions on interstate banking obsolete.
Proactive changes – Not only does policy react to changes in technology and in the facilitating structure, it may also be changed proactively in an attempt to alter technology or the structure. For example, a policy that encourages the establish- ment of R&D labs and richer links between the private sectors and universities is altering the facilitating structure in the expectation that these changes will influence the rate and nature of technological change.
3. Roots of past growth
If we go back through the millennia to the beginning of modern people, some forty thousand years ago, we find a story of continuous technological change at least in the West (defined as the Fertile Crescent through to Western Europe).5 During that time, there have been a dozen or so major GPTs that have transformed the whole economic, social and political structures of the societies that developed or adopted them. These have been discussed else- where (see for example Lipsey and Bekar, 1995 and Lipsey, Bekar and Carlaw, 1998); it will suffice here just to name them to give some perspective: the domestication of crops, the domestication of animals, writing, bronze, iron, the water-wheel and windmill, the three-masted sailing ship, the moveable-type printing press, automated textile machinery, the steam engine, electricity, the internal combustion engine, and the computer. Each of these transformed their societies at least as fundamentally as the current computer-based revolution is doing.
The important conclusion is that massive social, economic and political transformations driven by new technologies are not new phenomena. Qualita- tively, we are experiencing nothing new about the transforming potential of major GPTs. Whether the current transformations are quantitatively larger than those of previous centuries is debatable – although there is no clear evidence that they are.
Sources of Continued Long-run Economic Dynamism in the 21st Century
41
The mechanical age
The period from, say, 1000 to 1870 can be thought of as the mechanical age. In it, Europe mechanised the production of a steadily increasing range of commodities. The process began in the Middle Ages when the water-wheel was used to mechan- ise a wide range of production activities, from fulling cloth to smelting iron and brewing beer. The scientific revolution in the 15th and 16th centuries solidified a mechanistic view of the universe and contributed to many new mechanical inven- tions. The steam engine was the culminating power source of the mechanical age.
The electronic age
The period from 1870 to today can be thought of as the electronic age. Of course electricity spread slowly, as does any major GPT, and mechanical means are still important today. But because what happens at the cutting edge of techno- logical development has come more and more to depend on electronics, we now live in a truly electronic age. Our mechanical contraptions would seem under- standable marvels to people transported here from 1800, but our electronic tech- nologies would have seemed like magic – something totally beyond their ken.
Electricity is the last major GPT that has worked its way fully through the econ- omy – to the point even of enabling other GPTs such as the computer and the laser. So it is worth studying for the lessons it has to offer about current adjustments.
As is typical of a GPT, electricity’s first uses were limited – street lighting and street railways. Slowly, as technical problems were solved, the number of uses expanded, the techniques and locations of production were transformed, and a range of new products and industries arose. For example, an assortment of electri- cally driven household machines including washing machines, dishwashers, vac- uum cleaners, irons, refrigerators, deep freezers, and electric stoves transformed household work; the numerous servants that ran middle class households in 1900 and tended to much of household drudgery were no longer needed.
Electricity has powered an ongoing communications revolution, starting with the telegraph which for the first time in history provided a publicly accessible sys- tem that allowed information to travel faster than human messengers. The new com- munications technologies made possible by electricity evolved through the telephone, the radio, the TV, satellites and the Internet. Electricity also powered the computer and is, therefore, complementary with the new computer-based GPT.
Structural adjustments – As with any major GPT, the full development of electric- ity’s potential required substantial structural adjustments. One of the most impor- tant was a drastic alteration in the layout of factories. Water and steam used a central drive shaft whose power was distributed to individual machines via belts. Because of heavy friction loss in belt transmission, machines that used the most
The Future of the Global Economy: Towards a Long Boom?
42
power were placed closest to the drive shaft, and factories were built with two sto- ries to get more machines close to the shaft which was situated near the ceiling of the lower floor.
At first, electric motors merely replaced steam or water as the power source for the central drive; they were installed in a design adapted to the old power sources. Later, a separate motor was attached to each machine (the unit drive) and it was slowly realised that the factory could be most efficiently built on one level with machines arranged in the order of the flow of production. Only when this restructuring was completed was the full potential of electric power in factories realised (Schurr, 1990 and David, 1991).
Electricity required a massive new infrastructure for power generation and distribution. In assembly plants, it increased scale economies; in parts manu- facture, small-scale production became efficient because an electric motor could be attached to each machine tool. The result was a system of small decentralised parts producers supplying large centralised assembly plants – a method of production that is still used today. The 1890s were also a time of intense merger activity, which was sometimes the cause, and sometimes the effect, of electrification.
Performance effects – Although few new steam-driven factories were built in the United States after 1900, it was not until the end of the 1930s that the electrifica- tion of US industry was substantially completed. The long lags were due to many forces, not least of which was the long life of a steam-driven plant. By the early 1940s, the facilitating and policy structures of the US economy had been altered drastically to fit the needs of electricity and the automobile – the result of another concurrent GPT, the internal combustion engine.
There followed a long secular boom from 1945 to the early 1970s in which technological change took place more incrementally, and within a stable structure reasonably well adapted to the underlying technologies. Employment was high, recessions were shallow, productivity and real wages grew rapidly and the human capital requirements for various trades, professions and other occupations were relatively stable and well known.
4. The roots of future growth
When we ask about future dynamism, we must look first and foremost at the GPTs that will create major technological opportunities in the next century.
The first point to make is that we can never identify all of these. Technologi- cal development is replete with uncertainties. For almost a century, the steam engine’s main use was pumping water out of mines or into reservoirs. Not until the 19th century did the high pressure steam engine allow the many uses that
Sources of Continued Long-run Economic Dynamism in the 21st Century
43
ushered in the Victorian age of steam. When the computer was first commercial- ised after the Second World War, the world demand was estimated to be fewer than 10. Thus, if the past is any guide, we can be pretty sure that there is some small, ineffective-looking technology that is undergoing its early stages of devel- opment but which will surprise us all by becoming one of the 21st century’s influential GPTs.
The second point is that we can see some technologies that are well on their way to becoming GPTs. Modern ICTs are well established as full GPTs, although their use is still spreading; the materials revolution is also well under way; bio- technology is in its early stages; new fuel technologies can be foreseen, but their impacts are still uncertain; nanotechnologies are still little more than a glow on the horizon, but their potential is enormous. We consider each of these in the five subsections that follow.
The revolution in information and communications technologies6
The electronic computer, combined with various forms of message transmis- sion such as satellites and digital telephones, is in the midst of working one of the most profound economic, social and political transformations in this millennium.
Evolution – As with all revolutionary GPTs, electronic computers came into the world in crude form and were slowly improved as a result of a number of innova- tions, some incremental and some fundamental, such as von Neumann’s substitu- tion of software for hard wiring. Slowly, as their efficiency improved, their range of applications grew. Over the last several decades, computer power has increased and its costs of handling a unit of data have diminished exponentially. The increas- ing processing power of the computer has led to the shift from analogue to digital methods of recording, analysing, and reproducing all forms of communication, and thereby to immense changes in performance.
Production – It was apparent early on that by managing information flows, com- puters would have a major impact on the organisation of firms and on financial transactions. What few foresaw was the impact of digitalisation on production and design in both the goods and the service industries. Today, many consumer goods incorporate intelligent reactions initiated by chips. Intelligent buildings will soon be unrecognisable advances over their old “unthinking” predecessors. On the fac- tory floor, computers run robots. In the chemical industry, materials advances are being made that would have been impossible without advanced computing power. In lumber mills, X-rays and computers now decide much more effectively than could an experienced sawyer where to put the first cut in a large tree. Record- ing, film and TV are all computerised and the virtual band is a reality – one or more musicians who play all the instruments plus technicians who meld the results into a band of as many pieces as desired. Financial industries make
The Future of the Global Economy: Towards a Long Boom?
44
extensive use of computers in gathering, storing, analysing, and retrieving information – with mixed results.
Design – In the past, complex products such as a new commercial aircraft were designed in parts which were then joined with the hope that not too many con- flicts would emerge at the borders. Whole textbooks were written on which parts of the design should be solidified first and which kept fluid, also on who should talk to whom (as there was so much going on that everyone could not communi- cate with everyone else). Nathan Rosenberg (1982, Chapter 6) has documented in detail how, until the very latest aircraft, it was necessary to learn by using. One did what one could on the design board, but then there was no substitute for building the aircraft and observing its flight characteristics directly.
In contrast, the evolving design of the Boeing 777 was held in one giant com- puter, and every night all new design components were fed into the exiting virtual structure. The originators of this procedure thought that individual designers would go to the partially completed virtual plane and figure out how best to fit their own part into it. Instead, designers placed their part into the best spot for it and loaded their specification onto the computer. The computer then discovered any conflicts and told the designers who to talk to. As this example illustrates, no one can fully foretell, even at this micro level, how some new technology will work in practice. Typically, it brings surprises and unexpected gains.
Information generation – Computers generate masses of information as they do their jobs. For example, scanners at checkout counters update inventories and tabulate characteristics of sales, such as time, frequency, and shelf location. This presents management with unprecedented amounts of information and the means of analysing it. As a result, many procedures that used to be handled by intuition are now being rationalised.
Employers know much more about their employees than they used to and can discriminate between the performances of individuals, rather than having to deal with the broad classes that were necessary when information was difficult to obtain. Financial institutions can tell the cost and revenues associated with each customer. For example, banks find that they lose money on the majority of their customers and only a few (not necessarily the wealthiest) yield a profit – a profit which cross-subsidises the majority of customers. How long will banks accept a social obligation to persist in this non-maximising behaviour?
Education – The traditional textbook is under threat. Interactive computerised instruction modes are replacing the older lectures delivered from on high. Distant learning is becoming more and more powerful and is beginning to allow more staff-student and student-student interaction than many traditional face-to-face teaching technologies (to the great surprise of many teachers).
Sources of Continued Long-run Economic Dynamism in the 21st Century
45
Media – On most days of the week, well-respected and experienced press, TV and radio journalists can be heard lamenting the changes caused by the Internet. In contrast, a few seers laud the Internet’s democratisation of information and foresee a new era in which ordinary people have direct access to information unfil- tered by the media elite. This debate is characteristic of the conflict-ridden pro- cess through which new technologies radically alter facilitating structures.
Military – Computers in tanks, naval vessels, smart bombs, aircraft and satel- lites have revolutionised warfare. The changes are so fast that strategy, tactics, logistics and countless other military matters are hard pressed to keep up.
The materials revolution
Less well-known but highly important in its impact is the materials revolution. New materials began to become important after the development of the chemical industry at the end of the last century. As with electricity and computers, the first new materials were merely fitted into the structure of the then-dominant technol- ogies. A new material was invented in isolation and usually used to substitute for some existing material in an unchanged structure.
Today, however, the ability to tailor-make new materials constitutes a GPT at the leading edge of a new set of technologies. New products and new processes are designed around new materials expressly created to make the products and processes functional. This is equally true of recent aircraft designs and new under- sea methods of extracting mineral and fossil wealth. Indeed, new materials are seen as important to the continued expansion of many important growth sectors including microelectronics, transportation, architecture, construction, energy sys- tems, aerospace engineering, engineering and production practices in the auto- mobile industry – to say nothing of fusion reactors, ersatz human organs and solar conversion cells. Once again we see spillovers creating a cluster of related innovations in often widely differentiated industries.
Changes in materials innovation and application within the last half cen- tury […] have occurred in a time span which was revolutionary rather than evolutionary. The materials revolution of our times is qualitative as well as quantitative. It breeds the attitude of purposeful creativity rather than modification of natural materials, and also a new approach – an innovative organisation of science and technology (Kranzberg and Smith, 1988, p. 88).
Biotechnology
Biotechnology is an emerging technology developed just enough to be projected as one of the most important GPTs in the first part of the 21st century.
The Future of the Global Economy: Towards a Long Boom?
46
Early history
Although biological engineering through selective breeding is as old as the neolithic agricultural revolution, modern biotechnology begins with the 1953 discovery of the structure of DNA as the carrier of the genetic code. The next breakthrough was the discovery of a family of enzymes called restriction endonu- cleases, that can recognise a particular sequence in DNA and cut it at the required point, allowing a given set of DNA fragments to be reproduced at will. Another technique allowed the various fragments of DNA to be separated into homoge- neous groups. A big step followed with recombinant DNA. Fragments of DNA can be joined by use of a “sealing enzyme”, called ligase. Cancer cells, which have the property of unstoppable growth, can then be used to reproduce the recombinant DNA at will. This technique is used to produce masses of monoclonal (single par- ent) antibodies by fusing white blood cells, which produce germ-fighting antibodies, with cancer cells, which multiply indefinitely.
Like all GPTs, it was not clear just what applications would emerge before each technique was perfected and applied – although it was obvious to most observers in a general way that the possibilities were enormous. As is always the case, the discovery of new knowledge is well ahead of its practical applications, although these are beginning to multiply in the explosive way that is typical of really important GPTs. Below are a few examples.
Applications
Medical
The original use of monoclonal antibodies was to fight disease. But surprising applications have been developed that use their ability to locate and mark any target. This allows them to be employed in a range of techniques for diagnosis, treatment, monitoring, autopsies, drug purification and screening.
New biomaterials are now routinely manufactured from animals’ own tissues. The eventual aim is to use the patient’s own genetic material to manufacture any- thing from skin to organ tissue which can then be returned to substitute for defec- tive material with no fear of rejection by the patient’s immune system.
Literally thousands of disorders are now known to be caused by defective genes – cystic fibrosis is but one example. Gene therapy offers promise in the cure of many of these.
Vaccines are the second-largest category of over 200 drugs now being produced by American pharmaceutical companies using biotechnology. Other products include hormones, interferons, blood clotting factors, antisense molecules, and enzymes. Most of these drugs are still undergoing
Sources of Continued Long-run Economic Dynamism in the 21st Century
47
clinical testing, and are designed to combat cancer, AIDS, asthma, diabe- tes, heart disease, Lyme disease, multiple sclerosis, rheumatoid arthritis, and viral infections (Grace, 1997, p. 81).
Only slightly further away is the ability to build up therapeutic molecules from scratch using computer models to discover the best fits for the surface of a protein that is to be treated.
Although successes and failures cannot be predicted, it is clear that a massive range of successful medical applications of biotechnology is on its way, with the early arrivals already in common use. No one can foresee how much will be accomplished in the next thirty years, but it is likely that medical practice will be transformed in myriad ways.
As is usual, predictions about the effects of biotechnology range from disaster to Utopia. What is clear is that those of us alive today are probably the last people on earth whose life expectancy will be determined by the interaction of a given genetic structure with our environment. The latest in a continuing series of dra- matic pronouncements is the discovery of how to alter our biology so as to remove the built-in senescence that causes our muscles to atrophy with age. Whatever the final outcome, there is little doubt that people will vote with their pocket-books to read the prophets of doom while embracing technologies that promise a longer life of better quality.
Agricultural
The use of biotechnology in food production is full of uncertainties about harmful side-effects, and so far the results have been less than some of the opti- mists predicted when genetically engineered plant life was first produced in the 1970s. If nothing else, public resistance to genetically engineered foodstuffs will slow the development, even if a mass of benign applications is ultimately discovered.
The genetically engineered bovine growth hormone mimics the natural prod- uct made by cows and stimulates milk production. Genetically engineered resis- tance to diseases is a superficially attractive way of reducing the use of herbicides, although many fear that the resistance may spread to weeds. Genetic engineering of grains can be used “to modify different stages of crop production, from speed- ing up early growth of food plants, to increasing yields, to slowing down ripening or wilting. Since much of the form and function of a plant depends on its genes, the ultimate hope is to engineer optimal plants for every growing condition and market niche” (Grace, 1997, p. 110-2). Plants can now be made resistant to fungal diseases by exposing them to a genetically engineered weak version of the dis- ease to activate their immune system – a procedure analogous to inoculation in humans. No doubt other diseases will be treated in this way in the future. Also in
The Future of the Global Economy: Towards a Long Boom?
48
the works are more exotic ways of controlling pests, such as genetically engineer- ing plants to secrete substances that harm the bacteria that live within, and are essential to, many plant pests.
Mixed strategies are being developed to combat the development of resis- tance among the target pests. Immunity of enemies to any treatment usually comes from activating a recessive gene. By planting some non-engineered plants amidst engineered ones, the hope is that the non-engineered ones will harbour more pests and, when these interbreed with pests that have developed immuni- ties by feeding on engineered plants, the immunity will be suppressed. This is an illustration of the continued war between engineers and their enemies. As soon as a new technique is developed, defences evolve and the engineers seek ways of meeting these defences. Critics worry that this never-ending arms race will induce too many unpredictable and potentially harmful side-effects.
Genetic engineering is being used to improve the freezing tolerance of grains and grapes; this could have major effects on extending the area of cultivation of some key crops. In a practice called “genetic farming”, genetic engineers are also using plants and animals as factories to manufacture wanted drugs, industrial chemicals, fuels, plastics, medical products and other materials. Here we see a typical GPT development as the procedure branches out to affect more and more industries that initially were unrelated to biology.
Genetic engineering also has promise for environmental control. In an odd reversal, an oil-digesting bacteria was developed only to have its use proscribed by the US Congress. In response to what they had learned, engineers were able to produce a similar bug by selective breeding without genetic engineering, a ver- sion now used in selected clean-ups. This technique may also be useful for clean- ing up all sorts of accumulated chemical wastes – a possibility that has enormous potential.
One of the biggest roadblocks to development is that so little is known about bacterial communities in nature. Although microbes are the most abundant and widespread organisms on earth, their ecology is largely a mystery. The immediate need is to discover how microbial communities function in the wild, and how they respond naturally to stresses, such as exposure to materials that are toxic to most organisms (Grace, 1997, p. 139).
Here we see another phenomenon typical of a GPT: it can lead to new major research programmes. In virtually all cases, one can be quite sure that masses of useful information will be generated while also being quite uncertain about where they will be applicable.
Sources of Continued Long-run Economic Dynamism in the 21st Century
49
Mining
Genetically engineered bacteria, fungi, algae and plants have many potential uses in the mining industry. Examples include recovering metals left in tailings, cleaning up contaminated sites after mines are abandoned, and extracting metal from crushed ores when they are first mined, or even in situ. Techniques that leach the minerals from the ores without removing the ore-bearing rock itself would be one of the most fundamental revolutions in metal extraction since people first began mining and smelting.
Forests and oceans
Bioprospecting is steadily locating new medicines and other useful materials in forests and seas. Animals that live with others that are poisonous often produce antitoxins of great potency – materials that, once understood, can be manufac- tured in laboratories. Other possibilities just on the horizon include salt-resistant, protein-digesting enzymes that may be useful in cleaning industrial machinery; compounds made by algae and sponges that help plants to germinate and grow; and marine enzymes that combine readily with other chemicals and are then use- ful in processing medicines, food production and cosmetics (Grace, 1997, p. 170). Marine farming is becoming widespread and bioengineering can be used to speed up maturation, growth and egg production, and raise survival rates of offspring.
Bioengineering is also being extending into the forest industry. Of the many new techniques, one of the most promising is micropropagation which clones trees. Its advantages include cheap, fast, mechanised production of trees for refor- estation; and the ability to genetically engineer and clone stocks of transgenic trees. Currently, industrial plantation of forests is criticised for major environmen- tal impacts. Genetic engineering of farmed trees looks for new species to improve soil fertility and reduce the need for fertilisers and herbicides.
Conclusion
Biotechnology is evolving just as we would expect a major GPT to do. It is a GPT sufficiently developed to clearly offer many potential uses, but not suffi- ciently developed for us to even guess at some of the revolutionary new uses further down the road.
Commercial risks are great because the industry is operating under condi- tions of genuine uncertainty. Payoffs are sometimes a decade or more into the future and many dead ends are encountered. Under these circumstances public assistance can be important in influencing the pace and direction of new develop- ments. Indeed, much of the early pre-commercial research is done in universities and government labs. By now, research is heavily financed by companies, but ear-
The Future of the Global Economy: Towards a Long Boom?
50
lier on the technologies would have been much slower to develop had they not been seeded by government money.
The United States is well in the lead in this entire field, which would seem a success of the US innovation system with its mixed private-public base. One important aspect of this is the massive investment in university research – much of which has practical orientation, and much of which is carried on in close contact with the private sector.
One of the unfortunate uncertainties around biotechologies is the large degree of social risk. Risks of unfortunate, even disastrous side-effects are a major concern, especially since uncertainty is everywhere – there is no way we can rule out the possibility of producing a product that does massive harm before we learn how to control it.
New fuels
The end of the age of fossil fuels will be an important landmark, probably to be passed gradually through a good part of the 21st century. Highly efficient bat- teries may be one of the first steps. Solar energy, already harnessed for some uses, will become increasingly efficient, as may wind and tidal energy. More prob- lematic is the harnessing of the earth’s thermal energy. Finally, nuclear fission may sometime in the next century be harnessed to make an inexhaustible, cheap, non-polluting source of energy, first for large power users and later for small sites.
The major uncertainty is in predicting how long the price of petroleum will remain low enough to discourage major research into these alternative sources. Had the price remained at its 1980 level, the massive research that was then under way would already have produced dramatic results. As it is, the continued low price of oil probably well into the 21st century will slow but not stop research into the sources that will eventually supplant all fossil fuels.
No more needs to be said about these developments, not because their effects will be undramatic but because we know from the past experience of steam, petroleum and electricity how dramatic their effects will be. Fundamen- tal changes will be induced in all elements of the facilitating structure, and a host of new derivative inventions will be made possible. Like all GPTs, the new energy sources will establish a research programme that will last for decades, providing new products and new processes, and hence a vast array of new investment possibilities.
Nanotechnology
Compared with the other GPTs considered here, nanotechnology – the tech- nology of producing goods out of individual atoms and molecules – is but a faint glow on the distant horizon. Conceptually, however, this technology promises the
Sources of Continued Long-run Economic Dynamism in the 21st Century
51
greatest revolution in production since the first stone tool was produced by flaking chips off flints.
Basics
Current “bulk technology” takes materials and pares away the unwanted parts to be left from what is wanted. Nano- or molecular technology handles individual atoms and molecules, building them precisely into desired aggregates, which may be no more than two or three molecules, or may be an object observable to the naked eye.
All goods, manufactured or natural, are composed of atoms. When the atoms are rearranged, the resulting goods are changed. For example, the difference between a diamond and a piece of coal is solely in the arrangement of their atoms. The power to rearrange atoms at will, not long ago thought forever out of our reach, will have staggering implications for the production of economic output.
Nanotechnology is already interacting with other GPTs – including biotechnol- ogy, the materials revolution and the computer – without which it would have been impossible. The technology does not yet have all the characteristics of a GPT. It has yet to enter the economy in an important way, and many of its applications are either still only on the drawing board or in designers’ imaginations. Yet if nanotech- nology fulfils even a significant fraction of its potential, it will become one of the most important GPTs of the coming century. If it meets most of its already perceived potential, it could become the most important GPT in all of history.
An early example
One early application of the technology was the production of a planetary gear. It was little more than a toy but it demonstrated that such constructs were indeed feasible:
There had been a lot of trial an error involved, and some of the earlier designs hadn't worked so well. When they were put through tests on molecular modelling software, things came unglued. Gears slipped out of their housings. Molecular rings exploded like firecrackers. Atomic wreck- age flew hither and yon. But then there was a design that worked per- fectly, a gear system that was made out of 3 557 individual atoms – precisely that many, not one more and not one less (Regis, 1995, p. 13).
Key characteristics
Nanotechnology has a number of key characteristics. The first is the ability to produce almost any shape or structure, so long as it obeys the basic laws of phys- ics. The second is the ability to produce goods for a cost only slightly more than
The Future of the Global Economy: Towards a Long Boom?
52
the cost of the raw materials. The third, and most important, is the ability to get every atom into its precise place. Manipulating matter at the molecular level allows it to be treated as a computer treats data, transforming it and reproducing it with perfect precision. This one element of nanotechnology will have huge implica- tions. Just as the increase in the quality of materials allowed fundamental changes in the design of aeroplanes, the increase in precision allowed by nanotechnology (affecting hardness and durability, and creating specifically tailored characteristics) will fundamentally change everything from electronics to construction.
Range of applications
Nanotechnology has already started to revolutionise medicine where it under- pins many of the advances in biotechnology. It is being used to produce medical machines the size of a few hundred atoms to practice nanomedicine, which includes non-intrusive surgery. The production of new materials will include new polymers with strength and bonding characteristics that have never been seen before. Nano- technology will be used to reduce the size and cost of computers, and truly molecu- lar computers may not even use electronic effects. One result will be the production of massively parallel computers, which could evolve into intelligent machines. Other nanoproducts will simplify housekeeping. Dirt-digesting machines will make every- thing from dishes to carpets self-cleaning, while keeping household air permanently fresh. Nanotechnology will also produce fresh food by mimicking cell growth in plants and animals. Nanoreceptors on TV sets will provide high definition only dreamed of today. Tools will be harder, more durable, and separately created for each specific purpose. Batteries will be minute and long-lived. Fuel efficiency of automobiles (should they still be around) will be enhanced when the spark plugs are replaced by nanoplugs. Aeroplanes will fly faster, higher, longer, and safer when made with nanoengineered materials. Medical implants will be more effective and more durable, and so on, and so on.
Not quite in the realm of science fiction are rooms filled with airborne nano- machines no larger that a molecule of air but with substantial computing power. The slightest command would produce any desired action from those machines, from levitating a bottle of beer out of the refrigerator and into your hand, to repel- ling an intruder.7
[N]anotechnology could have more effect on our material existence than those last two great inventions in that domain – the replacement of sticks and stones by metals and cements and the harnessing of elec- tricity. Similarly, we can compare the possible effects of artificial intelli- gence on how we think – and on how we might come to think about ourselves – with only two earlier inventions: those of language and of writing (Minsky, 1986).
Sources of Continued Long-run Economic Dynamism in the 21st Century
53
5. Structural adjustments
Every new GPT causes structural adjustments. However, the extent and mag- nitude of these adjustments varies greatly from one GPT to another. Some GPTs, such as the laser, fit reasonably well into the existing structure. Others, such as electricity, require large and extensive structural adjustments before their full potential can be realised. To see what is involved the discussion now focuses on the currently ongoing set of structural adjustments caused by the ICT revolution discussed above, adjustments that will continue into the 21st century. Briefer attention is then given to the other technologies discussed above.
The ICT Revolution
When computers were initially introduced they entered structures designed for the paper world, merely substituting for human hands and minds. Before they could really pay off, administration and production facilities had to be redesigned both physically and in their command structures. Slowly, again as it was with electricity, the whole process of producing, designing, delivering and marketing goods and ser- vices was, and is still being, reorganised along lines dominated by computing tech- nologies. As more and more of the needed changes in the facilitating structure are identified and accomplished, we can expect that, as with electricity, the latent power of the new technology to raise productivity will be seen in measured produc- tivity growth – as it is in many sectors already. This section deals with the facilitating structure; policy and the policy structure are considered later, in Section 7.
The organisation of firms
Administratively, the old hierarchical firm, organised on the military command model in which hoards of middle managers passed information and commands up and down, has given way to the new, more flexible management form of semi-independent groups linked laterally rather than vertically. Many middle managers have lost their jobs in the process.
That much has already happened. The uncertainties attached to the structural impact of major innovations are clearly seen, however, in conjectures about what kinds of organisational adjustments will occur in the future as a result of the continuing ICT revolution. Below are two important examples.
Peter Drucker, who has an enviable record as a seer in this area, foresees a new revolution when firms turn outwards from their current ICT-reinforced concen- tration on internal costs and organisation. He predicts that the next round of ICT-induced organisational changes will be the use of computers to generate and analyse “outside data”, which look at external results rather than internal costs. One early advance is that small and middle-sized enterprises are already engaging
The Future of the Global Economy: Towards a Long Boom?
54
in “economic chain accounting”. This technique, which traces value right through the value added chain, revolutionised the behaviour of such large enterprises as GM in the 1920s, Sears, Roebuck in the 1930s, and Marks and Spencer, Toyota, and Wal-Mart in the postwar world.
The more inside information top management gets, the more he will need to balance it with outside information – and that does not exist as yet. Within the next 10 to 15 years, developing this data is going to be the next informa- tion frontier. This job is already being tackled […] primarily by top manage- ment people in middle-sized and highly specialised businesses in the role as their companies’ main marketing executives (Drucker, 1998, p. 54).
Drucker sees this results-centred approach extending to many other fields, such as education and healthcare. He sees the continuing education of profes- sionals during their entire adult lives, with profound induced structural shifts. Education will to a great extent move “off campus and into a lot of new places: the home, the car, or the commuter train; the workplace, the church basement, or the school auditorium where small groups can meet after hours” (p. 54). In healthcare he sees the focus moving from fighting disease to maintaining physi- cal and mental well-being – a results-centred shift aided by computers tracking people’s state of health. Again, the structural adjustments will be profound. “Neither of the traditional health care providers, the hospital and the general practice physician, may survive this change, and certainly not in their present form and function” (p. 54).
Malone and Laubacher (1998) foresee an even more fundamental transforma- tion caused by the growth of what they call the “e-lance economy” – an economy dominated by the electronically linked freelancers.
The coordinating technologies of the industrial era – the train, and the telegraph, the automobile and the telephone, the mainframe computer – made internal transactions not only possible but also advantageous […] But with the introduction of powerful personal computers and broad elec- tronic networks – the coordinating technologies of the twenty-first century – the economic equation changes. [p. 147] […] Because informa- tion can be shared instantaneously and inexpensively among many peo- ple in many locations, the value of centralised decision making and expensive bureaucracies decreases […] the new coordination techniques allow us to return to the pre-industrial organisational model of tiny autono- mous businesses […] conducting transactions with one another in a market […] [with] one crucial difference: electronic networks enable these micro- businesses to tap into the global reservoirs of information, expertise, and financing that used to be available only to large companies. [p. 148] […] The fundamental unit of such an economy is not the corporation but the
Sources of Continued Long-run Economic Dynamism in the 21st Century
55
individual. These electronically connected freelancers – e-lancers – join together into fluid and temporary networks to produce and sell goods and services. When the job is done […] the network dissolves, and its mem- bers become independent agents again, circulating through the economy, seeking the next assignment [p. 146].
Should anything like this come to pass, the structural adjustment would be enormous. There would be:
fundamental changes in virtually every business function […] Supply chains would become ad hoc structures, assembled to fit the needs of a particular project and disassembled when the project ended. Manufac- turing capacity would be bought and sold in an open market, and inde- pendent, specialised manufacturing concerns would undertake small batch order of a variety of brokers, design shops, and even consumers. Marketing would be performed in some cases by brokers, in other cases by small companies that would own brands and certify the quality of the merchandise sold under them. In still other cases, the ability of consumer to share product information on the Internet would render marketing obsolete; consumers would simply “swarm” around the best offerings. Financing would come less from retained earnings and big equity markets and more from venture capitalists and interested indi- viduals [p. 150].
Many e-lance enterprises already exist. The vision of a major e-lance sector, even if it only covers, say, 20% of the whole economy, is unlike anything seen since the first Industrial Revolution destroyed the Putting-Out System.
This discussion illustrates that the major structural changes in the organisa- tion of productive units are not yet over; that they will continue at a rapid rate; and that there are major surprises yet to come.
Economies of scope and scale
As GPTs have done in the past, the ICT revolution is altering scale economies in complex ways. Whereas economies of scale in manufacturing were a driving force in the postwar expansion of many industries, increasingly they are becoming either non-important or redefined. The introduction of computers and other information technologies, plus the use of advanced materials, have drastically lowered the mini- mum efficient scale of production for many individual product lines. One firm’s fixed costs of computers and other facilities are covered by producing many product lines so that economies of scope become more important than economies of scale.
The organisation of service production has also changed rapidly. On the one hand, firms operating on a global scale in law, accounting and other traditional ser-
The Future of the Global Economy: Towards a Long Boom?
56
vices are replacing many of the older individual operators. On the other hand, com- puters – plus a host of related electronic devices such as faxes, photocopiers, and modems – allow many independent providers of services to work out of home rather than where their services are consumed. The Internet allows these individu- als access to masses of information and the ability to interact with others that was formerly only available to employees of very large corporations. If the first Industrial Revolution took work out of the home, the Computer Revolution is, at least partially, putting it back, with profound social and economic consequences.
Deindustrialisation and servicisation
The new technologies have accentuated a trend observable throughout most of this century. Manufacturing employment typically reached a peak of somewhere between 25-35% of the labour force in most industrialised societies earlier in this century. Since then, the proportion has been steadily declining and shows no signs of stabilising yet. At the same time, the proportion of the labour force employed in services has been growing steadily, to the point where it is now the largest single sector by employment in all industrialised economies. Note, however, that as with agriculture, total output of manufactured goods has continued to rise but productivity has risen even faster, so that manufacturing employment has fallen.
The “servicisation” of the economy has a number of sources. First, some of the apparent shift is definitional. Second, on the demand side the shift to services is partly driven by consumers’ tastes. As real incomes rise, people spend a lower proportion of their incomes on durable consumer goods and a rising proportion on such services as medical care, travel, and restaurants. Third, on the supply side the decline in employment in manufacturing is partly a measure of its success in producing more with less inputs, especially labour. A range of service activities that used to be conducted in-house by manufacturing firms, and so recorded as manufacturing activities, is now contracted out to firms specialised in a wide range of activities such as product design, marketing, accounting, cleaning and mainte- nance, and so recorded as service activities. Fourth, also on the supply side, the ICT revolution has encouraged many service activities by making them more effi- cient. Travel agents now have real-time access to travel and vacation possibilities; financial advisors monitor the performance of worldwide investment opportunities by the minute; courier services deliver packages worldwide, tracking them at every stage of their journey.
Locational effects: globalisation8
Globalisation, the rapid acceleration of which has been going on for over a century, is due in large part to the ICT revolution. The effects on manufacturing fol- low from three distinct developments. First, the new ICTs have allowed production
Sources of Continued Long-run Economic Dynamism in the 21st Century
57
to be disintegrated into a series of independent operations. Second, ICTs allow independent units to be co-ordinated in ways that were impossible in the past. Seventy-five years ago, even where production was split between many component suppliers, these had to be within relatively short distances of each other so that components could be delivered to assemblers when and where they were required. Third, improvements in transportation technologies, particularly containerisation and the development of very large ships, have greatly reduced the costs of ship- ping goods around the world. Today, with the ability to co-ordinate worldwide and to ship products at very low cost, component parts can be produced anywhere in the world in the right quantities and shipped to arrive when and where they are needed with little error.
The same is true of many services. Accounting of all sorts is increasingly being decentralised to areas where labour is still cheap. Ireland, the Caribbean and India are all locations in which large transnational corporations, such as credit card and travel companies, do much of their record keeping and accounting. Software firms are also moving much of their coding work to places outside of North America. While India is still a relatively small producer of software in absolute terms, it is now one of the fastest-growing sources of computer coding in the world. When an Indian technician uses the Internet to repair some electronic equipment in Boston, where does the production take place? Where is the value created? Where should it be taxed?
The importance of human capital in many of the new growth sectors has given rise to a need for factor creation, which creates national comparative advantages based on human capital and technological infrastructure. This has had important effects on the old matrix of international comparative advantage.
By the end of the 1980s, in most advanced industrial economies, not only were natural factor endowments assuming a less important locational role, but also the actions of governments, through their willingness and ability to affect the quantity and quality of these endowments and their organisation, were assuming a new significance (Dunning, 1993, p. 601).
Labour
Flexible, knowledge-intensive production techniques and a global market in low-skilled labour have led to a need to redefine the role of the union. No longer are strict, rigid job descriptions a supportable labour practice. Skill requirements for previously low-skilled jobs have risen as design, production and marketing increasingly involve creating and processing information.
Effecting the required changes quickly has been a conflict-ridden process. To many labour leaders, the need to change procedures that were worked out pain- fully over decades early in this century and that worked well for further decades
The Future of the Global Economy: Towards a Long Boom?
58
seems like some plot by employers to exploit employees instead of an inevitable adjustment to new technologies.
European and Canadian labour markets have shown high unemployment since the mid-1970s. Although there is controversy about causes, market rigidities are thought by many to bear some part of the blame. Technological displacement has also accounted for some of the unemployment, as the restructuring of finance and industry has caused a shedding of jobs and left people at least temporarily unemployed, sometimes for quite long periods.
Both firms and workers are going through an evolution where structural rela- tionships are adapting to changes in the technology. This sorting out process should bring productivity gains in the long term, but there are likely to be casual- ties in terms of job demarcations and other structural dislocations and relocations as the process evolves. Currently it is the well-paid and well-educated who are benefiting most from the introduction of the computer in the workplace; thus, computerisation is reinforcing the polarisation of incomes and jobs.
Dealing with long-term unemployment and finding ways to diminish the pro- portion of the labour force that is unskilled and therefore in competition with unskilled labour worldwide are urgent matters for public policy in the developed nations.
Social organisations
Ways of life are changing with the changing patterns of work. With electronic communication, groups of like-minded individuals are finding it easier to get together. Technologies have effectively redefined our notions of time and distance (and in some ways have created the much-heralded global village).
By linking people and groups, e-mail encourages work across space, time and group boundaries. Indeed, the absence of constraining non-verbal cues and social controls in e-mail may make it easier to communicate with unknown or peripheral people than through face-to-face means. Such wide-ranging ties are especially useful for linking socially diverse people, obtaining innovative information and integrating organisations (Wellman and Buxton, 1994, p. 12).
Conclusion
The scale of R&D in the new applications of ICT, the extraordinary growth of the software industry and related business services, the scale of investment in comput- erised equipment and in the telecommunications infrastructure, the rapid growth of industries supplying the ICT products and services, and the use of computers within every function in every industry have led some observers to characterise the ICT
Sources of Continued Long-run Economic Dynamism in the 21st Century
59
Revolution as a structural change in the economy comparable to the first Industrial Revolution. Peter Drucker argues, with not much exaggeration, that:
We are clearly in the middle of this transformation […] already it has changed the political, economic, social, and moral landscape of the world. No one born in 1990 could possibly imagine the world in which one’s grandparents […] had grown up, or the world in which one’s own parents had been born (Drucker, 1993, p. 3).
The future is hard to predict but the ICT Revolution is still in full swing. Many applications of new products, new processes and new ways of organising activities have yet to be invented. Their effects will continue to reverberate through most economies during the first half of the 21st century.
Other technologies
The other GPTs discussed above will also have major effects on structure and economic performance. The full discussion of ICTs above is intended to provide a foretaste of the changes that the other technologies may have in store over the next decades; thus there will be only brief mention of the adjustments that will be induced by the other technologies.
New materials
In certain industries the materials revolution will have significant effects on the organisation, geographic location and degree of concentration of firms. Most of these changes can, however, be accommodated within the existing structure and so will not themselves cause the kinds of deep-seated structural adjustments caused by the ICT revolution.
Biotechnology
In contrast, biotechnology will cause deep and widespread changes in the facil- itating structure. Many of biotechnological processes have large-scale economies and so the size of firms will increase in many lines. Also, intellectual property rights are currently being redefined in quite fundamental ways. There is ongoing conflict between innovating countries that want tough new property rights and the adopting countries that want weaker control for inventors and innovators. Some researchers feel that it has already become much too easy to patent a bio-engineered product or process (see for example Eisenberg, 1996).
Biotechnology will transform many basic industries such as agriculture, for- estry and mining, changing them almost beyond recognition. Although the details are still hard to predict, we can be sure that massive adjustments will occur
The Future of the Global Economy: Towards a Long Boom?
60
throughout the facilitating structure as biotechniques begin to transform these and other industries.
More importantly, the impact of the medical applications of biotechnology will be profound. Increasing average life spans from 70 to, say, 110 years over the course of half a century will require enormous adjustments in all aspects of the facilitating and policy structures. Imagination rapidly proves inadequate when predicting the pervasive adjustments that will have to be made in response to just this one medical advance – to say nothing of the many other advances, includ- ing big alterations in the prevalence of many human ailments (and the possible introduction of new ones).
Non-fossil fuels
The end of fossil fuels will also bring about major adjustments in the facilitat- ing and policy structures that are hard to imagine in detail. At one extreme, major shifts in global power balances will occur when oil and coal cease to be important commodities. At the other extreme, local pollution and city layouts will alter greatly. The decommissioning of the vast infrastructure of production and distribu- tion of petroleum products will cause profound upsets that will coexist with the rise of a new infrastructure adapted to the new fuels, and take forms that cannot be predicted today.
Nanotechnology
Guessing at the adjustments in the facilitating structure that would be brought about by a major shift to nanotechnology is still in the realm of science fic- tion. Just as our electronic world would look like magic to people transported from 1800 to 2000, the world of nano, bio and materials technology will look like nothing on earth to us if we could be transported to 2100 or even 2050.
Opportunities for great technological dynamism are surely offered by this radical new technology. Adjustment problems that may tax the ability of societies to manage them will probably also arise.
6. The anatomy of long booms
What does all that has been said so far suggest about the future? Will there be boom or stagnation, or some of both? The possibility of a continuing boom depends a great deal on what one means by the term. The concept that seems to underlie the topic of this book is a very long boom of a century or more. The con- cept that emerges from our S-E theory is a boom lasting several decades followed by a period of rapid structural adjustment and pervasive uncertainty.
Sources of Continued Long-run Economic Dynamism in the 21st Century
61
Century-long booms
In a very long-term perspective, there is one long boom covering the period stretching to the present time and starting with the second Industrial Revolution in the latter part of the 19th century. This revolution was characterised by the rise of science-based industries often depending on organised R&D, and the spread of electricity through the entire economy. If that is to be our perspective we must be willing to see the 1930s and the 1980s and 90s as lesser cycles within that long boom. Given this perspective, it seems pretty clear that a boom of this sort will continue well into the 21st century. Everything that we know about the GPTs that are either in full bloom or in obvious bud suggests that investment and employ- ment related to the new technologies will persist at high levels, at least into the first half of the 21st century.
Decade-long booms
In another perspective, the period 1945-75 was a secular boom which was pre- ceded by a period of major upheaval which culminated in the Great Depression (whose depth was very probably magnified by poor macroeconomic policies) and was followed by the structural upheavals of the 1980s and 1990s. This is the kind of boom that we have associated with the mature stage of an entire technological system (or paradigm) after the facilitating and policy structures have become fairly well adjusted to it.
To deal with this type of boom Freeman and Perez (1988) develop the con- cept of a “techno-economic paradigm” It describes a socio-economic technology system which includes all of the items covered here under technology, facilitating and policy structures. They see these as coming together into a systemic whole. Occasionally the whole paradigm changes, as when electricity replaced steam, or electronic ICTs replaced the paper world.
Here, the S-E model with its explicit disaggregation is preferred; nonetheless, it is acknowledged that these ideas grew out of theirs. Both treatments expect a major new system of interrelated technologies grouped around some really important evolving GPT, to be accompanied by massive readjustments to every element of the facilitating structure and many elements of policy and the policy structure, some of them in a conflict-ridden process.9 Then, after the whole new set of technologies is developed and the facilitating and policy structures have adapted, a period of secular boom can ensue as the full potential of the new tech- nologies is worked out. This can be a period of rapid technological advance, but mainly in incremental and lesser radical inventions. These develop the potential of existing GPTs, which take place within stable and well-adjusted facilitating and policy structures.
The Future of the Global Economy: Towards a Long Boom?
62
Booms of this sort tend to have several characteristics. The facilitating struc- ture is fairly well-adapted and further inventions and innovation fit fairly well into it. For this reason, the areas of uncertainty are substantially diminished compared with the preceding period of rapid structural adjustment. The requirements of the labour force become fairly well known so that young people understand the kinds of education that are needed to fit into the new economy. Business is profitable as new incremental improvements, applications and derivative inventions are made and marketed. These are likely to be associated with a higher rate of productivity growth than were earlier innovations which had to be fitted into facilitating and policy structures that were not well adapted to them.
Such was the period between 1945 and 1975 in the United States. The new electric age had been well established, factories had been remodelled to suit machines driven by unit drive electric motors, the system of mass assemblers and decentralised parts manufacturers was in place, the infrastructures for electricity generation and petroleum refining and their respective distribution systems had been installed, and the adjustments to the internal combustion engine and auto- mobiles were well under way. Within this stable structure, the full potential of the new technologies was developed in what is seen with hindsight to have been a period of strong and rapid growth. (Because of the disruption of the Second World War and because mass production was later in being accepted in Europe, the tim- ing was a little later in Europe than in North America – the time frame to which this discussion applies.)
There was a similar period of about fifty years that started around 1840, when the full potential of the steam engine, driving railway engines, ships, automated machines in factories, etc. was being worked out in a structure that had been pain- fully adapted during the transition from the early stages of the first industrial age, in which the water-wheel was the main motive force for stationary engines and the horse for movement.
It seems reasonable to see the ICT revolution as being at about the same stage as was the electric and motor car revolutions in the late 1930s. Much has been worked out, and the full potential of the computer is foreseen but not yet realised. Many of the structural adjustments in the organisation of offices and plants, design, and information control, as well as the infrastructure of the informa- tion highway, are already in place, at least in embryo form. The near future should see vast improvements in the efficiency of the new technologies increasingly tak- ing place, as well as a widening of their range of applications, within a structure designed for electronic rather than paper ICTs.
If the past is any guide, and to the extent that other forces such as wars or poor public policies do not upset expectations, we might expect a secular boom starting about 2000 and extending into the 2020s or 2030s. This will not necessarily
Sources of Continued Long-run Economic Dynamism in the 21st Century
63
preclude large sections of the population from remaining unemployed or cyclical fluctuations from occurring but, like the 1950s and 1960s, the fluctuations should be mild and grafted onto a rising trend of output and productivity.
Of course, during such a boom the economy is only stable relative to the period of transition that preceded it. Change and uncertainty are always present. Also, each technology carries its own characteristic costs and benefits. If the ICT technology has speeded up the pace of innovations, which seems pretty clear, more rapid product cycles may lead to lower profits, lower rates of return on capi- tal that rapidly becomes obsolete, and higher uncertainty than accompanied pre- vious booms. Change will always destroy some jobs and if labour markets are rigid, substantial structural unemployment may persist.
Alternative possibilities
Of course, these theories, combined with the evidence of the past, can only suggest possibilities, or at most broad probabilities. Thus, many things could upset the prediction of a coming secular boom, aside from the always-present possibility that the whole theory could be wrong. The current Asian crisis, or some new one that is mismanaged by monetary authorities, might develop into a deep, worldwide depression. A shift to inward-looking, protectionist and anti-growth poli- cies might drastically slow (although it would be unlikely to fully stop) the pace of technological advance. The pace at which one fundamental GPT follows another might accelerate so much that facilitating and policy structures never become well enough adjusted to create the stable conditions needed for the full development of any one GPT, and the secular boom that often accompanies its later stages.
On the first item, there is nothing to add about the possibility that some crisis unrelated to the technological dynamism of Europe and North America might cre- ate a severe worldwide recession. On the second, government policies are consid- ered in the last part of this chapter. This leaves the possibility of problems caused by too much technological change, rather than too little, to be discussed now.
Past periods of sustained development of the new GPTs’ full potential have taken place after the facilitating and policy structures became fairly well adjusted to a new set of prevailing GPTs. For this to happen, those major new GPTs that require extensive adjustments to the facilitating structure must be introduced far enough apart for the structure to have sufficient time to become well-adapted to the prevailing set of GPTs. Although not easy to measure, it seems that the pace of technological change is speeding up. Among other things, the late 19th century institutionalisation of invention and innovation, which in all previous times was mainly in the hands of non-scientists, has led to a cascading advancement of knowledge and a shortening of the time between the discovery of fundamental scientific knowledge and its commercial application.
The Future of the Global Economy: Towards a Long Boom?
64
Currently, no fundamental new GPT is sufficiently well-developed to destabi- lise the facilitating and policy structures that are becoming increasingly well-adapted to the current ICT and materials revolutions. Of the new GPTs dis- cussed earlier, biotechnology, nanotechnology and a pervasive new energy source probably have the characteristics capable of causing upheavals in the facilitating and policy structures comparable to those caused by the factory, steam and elec- tricity. It must also be remembered that it is often impossible to identify a tech- nology in the early stages of its development as one that will develop into a fully fledged GPT. Given the three fundamental GPTs already coming into place and the possibility of further ones not yet identified, we cannot rule out the possibility of the reverse of secular stagnation. In this case there would be a succession of upheavals due to a series of new GPTs, each one of which would outdate many of the facilitating and policy structures that are relevant to the established GPTs.
7. Policies to exploit potential
It is one thing for there to be a potential for dynamism; it is another for that potential to be realised. The latter depends on many things, including public policy.
New policy views
Events over the last couple of decades have forced many governments to revise their views on appropriate economic policies. Among other things, it is now understood that there are massive and often unpredictable technical changes that are difficult to predict and to manage; the facilitating structure is constantly chang- ing; and global competition is restricting any government’s ability to act unilater- ally. According to the new policy paradigm, sustaining dynamism into the 21st century requires that governments cease to do many of the things they rou- tinely did in the mid-20th century, and that they newly take on, or increase their existing emphasis on, other activities.
Some accepted key government functions are:
– Macro policies must provide a stable background in terms of low inflation, reasonable investment incentives, a stable fiscal regime with either balanced budgets or sustainable deficits and micro policies without excessive disin- centives, such as high marginal rates of taxation, high indirect labour costs, and excessive regulatory burdens. Among other things, this requires the scaling back of entitlements that seemed supportable in the postwar era.
– Appropriate market supporting institutions must be provided, such as the justice system, property rights, freedom of contracts, ensuring a sound money and a well-functioning financial system, and providing quality control product standardisation and consumer protection.
Sources of Continued Long-run Economic Dynamism in the 21st Century
65
– An efficient infrastructure is also required. The realisation that technological dynamism is needed in these areas, as well as the growing belief that pro- duction should be left to the private sector except where there are compel- ling reasons for public control, has led to the privatisation of many government-owned infrastructure activities, particularly in the United States and the United Kingdom.
– Human capital must be created for the new knowledge society, a need which extends from providing the substantial minimum level below which people become unemployable, to higher education, to providing adequate staffing for private- and public-sector R&D.
– Strong support for R&D, including assistance in the creation of emerging technologies in the pre-commercial stage. For example, much of the early basic US research on biotechnology and nanotechnology was done, and some still is being done, in publicly funded universities and research labs.
Policies for technological dynamism
Economists debate what kinds of S&T policies are needed to support techno- logical dynamism. Neoclassical economics is structureless. Its equations apply to all markets everywhere, and it produces a single set of policy prescriptions appli- cable to everyone: remove market imperfections. In the case of invention and innovation, a positive externality is recognised and, therefore, a generalised non-distorting subsidy to R&D is recommended. As Ken Carlaw and the author have pointed out in detail in a series of publications, (See, e.g., Lipsey and Carlaw 1996, 1998a and 1998b), this advice does not take into account what is known through both empirical studies and S-E theory concerning endogenous technolog- ical change. S-E theory, like Romer’s macro endogenous growth theory, recognises that unique optimal policies cannot be derived in the case of knowledge creation. Romer emphasises the non-rivalrous nature of knowledge, which invalidates the standard conditions for an optimal allocation of resources – perfect property rights and competitive markets. S-E theories emphasise the uncertainty of technological advance which creates a context-specific, path-dependent world in which there are better and worse polices but no unique optimal set for all times and all places. Both of these approaches prescribe policy approaches that practical policy makers and advi- sors have come to accept as a result of observing the changing knowledge-intensive world and the failures of some past policies. Here are a few examples.
Assisting pre-competitive research
Many economists, particularly in the United States, argue that governments have little potential to influence the process of technological change in a useful way. The reality is that many important technologies have been encouraged in
The Future of the Global Economy: Towards a Long Boom?
66
their early, largely pre-competitive stages by public sector assistance in the United States, as well as in other countries. Here are a few US examples of this important point.
Publicly funded US land grant colleges have done important agricultural research from their inception in the 19th century. The 20th century “green revolu- tion” was to a great extent researched by public funds. In its early stages, the US commercial aircraft industry received substantial assistance from the National Advisory Committee on Aeronautics (NACA) which, among other things, pioneered the development of large wind tunnels and demonstrated the superiority of the retractable landing gear. The airframe for the Boeing 707 and the engines for the 747 were both developed in publicly funded military versions before being transferred to successful civilian aircraft. Electronic computers and atomic energy were largely created in response to military needs and with military funding. For many years, support for the US semiconductor industry came mainly from military procurement, whose rigid standards and quality controls helped to standardise practices and to diffuse technical knowledge. The US Government’s activities in the software industry produced two major spin-offs to the commercial sector: an infrastructure of academic experts built largely with government funding, and high industry standards.
Knowing when and how to use public funds to encourage really important new technologies in their early stages is one of the most important conditions for remaining technologically dynamic.
Created assets
Many of the new technologies are knowledge-based in the sense that human capital is the most important resource required. Governments have always played an important part in creating human capital, for example by establishing elemen- tary schools, trade schools and institutions of higher education. Uncertainty sur- rounds the design of education most suitable for today’s rapidly changing world. Today’s monolithic state education systems encourage less diverse experimenta- tion than would occur if education were provided by the private sector (and uni- versal access provided by vouchers or some other similar system). As with commercial innovation, the best response to uncertainty is to maximise experimentation, as a free market in education would do.
Policies concerning FDI
To be technologically dynamic, a country needs to be a part of the global economy, which normally requires two things. First, a substantial presence of TNCs within its borders is required. Second, where firms need to be international
Sources of Continued Long-run Economic Dynamism in the 21st Century
67
in scope, outward-bound FDI is an important step in turning successful domestic industries into truly global competitors, rather than an undesirable export of jobs.
A key part of government policy is the treatment of foreign-owned relative to home-owned firms. The technology-support initiatives of many countries are often open only to home-owned firms, as was the US SEMATECH. As a result, foreign firms that are major creators of domestic jobs are denied support, while domestic firms that do most of their production in foreign countries are included. There is a strong case that countries that wish to remain technologically dynamic should treat all firms based in their jurisdictions equally (as, for example, the three NAFTA countries must do to firms owned in any NAFTA country).
Fixed costs of acquiring knowledge
Acquiring codifiable knowledge about new technologies, as well as tacit knowledge of how to operate given technologies, often requires heavy fixed costs. Thus small firms often operate in “rational ignorance” of existing relevant technol- ogies. Government bodies can disseminate technological knowledge by operating on a scale that makes the sunk costs bearable, even trivial, where they would be prohibitively high for small firms. The institutional design of such programmes is critical if they are to succeed in this difficult area. The very successful Canadian Industrial Research Assistance Program (IRAP) is a case in point. (This programme is described and evaluated in Lipsey and Carlaw, 1998b, Chapter 4.)
Catch-up and leading-edge economies
The recognition that technical change is endogenous makes S&T policies become context-specific in many ways. For one example, the problems of catch-up are very different from the problems of trying to stay on the cutting edge of technological advance. Catch-up economies, especially in their earlier stages, have the advantage of dealing with already established technologies. Although there are still uncertainties associated with tacit knowledge and local adaptations of generic technologies, many of the main uncertainties of cutting-edge advances are removed. Many market-oriented Asian countries in the catch-up stage have championed consultative processes whereby the government agency and the main private sector agents pool their knowledge and come to a consensus on where the next technology push should be and then jointly finance it. This policy worked well in the catch-up phase and it still works well when all private agents are pushing for a fairly well defined small-to-intermediate advance in technology. Consensus and co-operation can then eliminate wasteful duplication of pre-competitive research. But when more major breakthroughs at the cutting edge are being sought, the inevitable uncertainties call for a multiplicity of investiga- tions, each pursued with the minimum required funds. Here concentrating effort,
The Future of the Global Economy: Towards a Long Boom?
68
even after a national consensus has been reached, is likely to be worse than the apparent “wastefulness” of unco-ordinated experimentation that occurs in the free market. Possible illustrations are Japan’s costly failures in high definition TV, which was overtaken by the digital revolution, and in the 5th generation chip, which proved too big a technological jump to succeed against the more conservative US approach.
Changes in structure
Policies may also indirectly target technological change by altering elements of the facilitating structure. Examples of such policies include attempts to inte- grate some university, government and private sector research activities, attempts to create technology information networks, and attempts to change private sector attitudes toward adopting new or different technologies. Furthermore, a govern- ment can give funds to firms to develop technologies that they would have devel- oped anyway but then attach structural conditions. This has been done by more than one government to encourage the development of long-range research facili- ties. All of these initiatives would fail narrow tests that measure only direct changes in specified technologies, but would pass wider tests that consider alter- ations in the structure which would not have happened without the government pressure. Two prime examples are the aforementioned US military procurement policy that virtually created the US software industry, and Canada’s Defence Industry Productivity Program (DIPP) which helped firms to create R&D facilities in the early stages of what is now Canada’s very successful aerospace industry.
Institutional competence
Policies are given effect by the policy structure, and their success depends to a great extent on the institutional competencies of those administering them. The ability of government to carry out some types of policies aimed at technological dynamism will vary across governments partly because of constitutional differences (e.g. first-past-the-post or proportional representation and cabinet or decentralised powers); partly on the power relations between various special interest groups (e.g. are government required to broker regional differences? and how strong are the Greens?); partly on the nature of their civil services (e.g. professional or amateur, well or poorly paid); and partly on the accumulated learning-by-doing in operating their country’s typical set of policy instruments over the past. Policies need to be tailored to suit a nation’s institutional competence.
Conclusion
This discussion only scratches the surface of specific policies to promote technological dynamism. The author and his colleagues have studied the reasons for success or failure in 30 such individual policies (Lipsey and Carlaw, 1996). A
Sources of Continued Long-run Economic Dynamism in the 21st Century
69
second publication drew lessons about the conditions that lead to success and those that lead to the all-too-many failures (Lipsey and Carlaw, 1998b). In the former publication, our general position was summarised as follows.
An innovation policy will work well or poorly depending on how well adapted it is to such elements of the facilitating structure as the pattern of industrial concentration, the structure and behaviour of financial insti- tutions, the mobility of labour, the way in which the political system bro- kers regional interests, and the ability of special interest groups to capture particular policies and public bodies. It is useful to ask how well adapted a country’s policies are to its structure. It is useful to ask if other countries have elements of their innovation policy that work well and could be easily transferred to one’s own structure. It is not useful to think of copying completely another country’s set of innovation policies, espe- cially when their structures are as radically different as are, say, those of Japan and Canada or the US (Lipsey and Carlaw, 1996, page 299).
8. The need for social consensus
The shift of policies from those of the middle-20th century to those appropriate to the new conditions is unlikely to be accomplished or sustained in the absence of a social consensus that change is needed. French Colbertist policies had that social consensus uniting the elite who were technologically oriented and the populace who approved of reducing foreign domination. There seems to be no such French consensus for adopting new policies consistent with the new technologies, and a diminished place for government in production of goods and services. The German Government is having trouble persuading the populace that levels of entitlements that seemed feasible in the postwar boom are no longer affordable. The Canadians achieved such a consensus and then jeopardised it when the opposition party got elected on a platform of undoing all of the reforms and then reneged on all of their important promises. This left the Conservative government that imposed the changes one of the most hated governments in Canadian history, while the current Liberal government is under pressure from the electorate and many of its own rank and file to reactivate some of its Luddite promises.
There is space to mention only in passing a few of the forces that may make reaching and/or sustaining the new policy consensus difficult. First, continued high unemployment makes it difficult to impose reforms that impose further short-term pain, although structural rigidities in the labour market need to be alleviated as part of the new policy package.
Second, increasing disparities in the distribution of income create a “have” and “have-not” dichotomy that is inimical to social consensus. In the United States, this has been exacerbated by the tendency to cut entitlements for the
The Future of the Global Economy: Towards a Long Boom?
70
poorer groups while leaving some key middle class entitlements in place, contrib- uting to social stress. It is worth noting here that there are forces in current techno- logical change that contribute to rising inequality. New technological paradigms always create inequalities between those lucky enough to have human capital suited to the new techniques and those who do not. The current ICT technologies add some new forces. They make it easier to gain information about the contribu- tions of individuals and so to reward each separately rather than in the broad groups needed with cruder information systems. Also, globalisation, by uniting formerly separate markets, leads to greater stratification and hence greater income inequalities.10 Offsetting to some extent these demand-side tendencies, there should be some supply-side adjustment as the education system begins to train a larger fraction of the labour force in the skills needed for the new economy.
Third, there is a strong desire to maintain old entitlements, particularly on the part of older people who counted on them. This is an argument for grandfathering some vested interests that are threatened by reforms. But this gives rise to intergenerational jealousies.
Finally, the rapid pace of technological change and structural adjustment has led to a fear of big business, globalisation, and technological change. This could lead to a reversion to more inward-looking policies, particularly in the United States and possibly in Canada as well. A turning away from the postwar outward-looking stance, as seen for example in the reluctance of the United States to embrace the extension of NAFTA, could have serious repercussions for world dynamism.
9. The policy structure
The current structure of government is still the old hierarchical departmental structure that was found in most firms in the middle of the 20th century. Many mat- ters that civil servants now have to deal with cut across these traditional structures and hierarchical information channels. But unlike firms, many of whom have changed in response, there has been little alteration of the structure of government departments. Lacking bottom-line constraints, governments find it difficult to alter the structure of their operating institutions. Societies that manage to reform govern- ments along lines made efficient by the ITC revolution, may be those that make the most of the dynamic opportunities in the area of private-public sector co-operation in the 21st century.
Government power
Aside from creating the need to change the operating institutions, the ICT revolution is altering some of the very basics of government power. All govern- ments are being impacted by globalisation and the other structural adjustments associated with the ICT revolution.
Sources of Continued Long-run Economic Dynamism in the 21st Century
71
Diminished power
Sophisticated communications and vast amounts of short-term capital in the hands of TNCs make it impossible for governments to control international capital movements in the ways that they routinely did in previous times.
Many of today’s most important assets are both created and internationally mobile. A country whose government policies reduce the value of these assets significantly more than do the policies of other governments loses many of these assets. The resulting limitations on policy independence are profound.
The increasing difficulty that governments face in dictating what their citizens will see and hear has greatly curtailed the efficacy of information-restriction poli- cies exercised in the interest of many purposes, from supporting a repressive dictatorship at one extreme to encouraging local cultural industries at the other.
Increased power
In other areas, governments have gained power. Computers allow the collec- tion and cross-referencing of masses of data about individual citizens and firms. The technology exists today to locate any inconsistent statements given to two different government authorities and, unless it is controlled by political means, this possibility may soon be realised. Developments in genetics have provided breakthroughs in crime prevention and detection. As a final example, traffic con- trol will see major changes in the next decade as it becomes possible to track cars through urban streets and to monitor speed with advanced technologies.
The more distant future
No one can be sure how the full development of ICT technology, by say 2030, will affect the powers of the state. Some, such as Davidson and Rees Mogg (1997), see a great deterioration of state power as assets disappear into the untraceable cyberspace in which business is increasingly transacted. We can be sure that the government’s power to track and tax wealth and income transactions will diminish, but we do not know by how much. One disturbing observation is in order. In the final analysis, taxes are voluntary and if enough transactions do escape, the sense of injustice among those who still pay may reach a point where widespread tax evasion disrupts the whole system. If the social consensus that taxes should (more or less) be paid breaks down in the face of cyberspace evasion, a real crisis of the state could ensue. How this affects growth and technological dynamism will depend on all sorts of imponderables, including how the nation state responds to its loss of power and how the private sector copes with the resulting dramatic restriction of state activity.
The Future of the Global Economy: Towards a Long Boom?
72
Reallocations of power
Reallocations are tending to transfer some of the powers of national govern- ments upward to supranational bodies and others downward to more local levels of government.
Pulling in one direction, globalisation is requiring supervision at the interna- tional level of many issues involving trade and investment. The importance to most countries of a relatively free flow of international trade has led them to trans- fer power over trade restrictions to supranational bodies such as the World Trade Organisation (WTO), the EU, the NAFTA, and MERCOSUR. The interrelation of trade and investment brought about by the ICT revolution has caused modern trade liberalising agreements to be expanded to include measures to ensure the free flow and “national treatment” of foreign investment.
Due to globalisation of trade and investment, policies with respect to such matters as labour practices, industrial competition, R&D support, subsidies and intellectual property protection, which were formerly of purely domestic inter- est, now affect international flows of trade, FDI and factors of production. Trade liberalising arrangements are now working towards “deep integration” in which the sources of these “systems frictions” are brought under international control, which implies major transfers of power from national to supranational levels of government (Ostry, 1990).
In contrast, consciousness of regional identities and the decline of broad identification with the nation-state, which are also related to the globalisation caused by the ICT revolution, are causing pressures for the devolution of some powers to lower levels of authority. Provided that acceptable allocations are achieved, there is no need to find these two pressures contradictory. If common markets (or at least modern free trade areas) are maintained among the local authorities, there is little reason to oppose the devolution of considerable power with respect to cultural and community matters to local authorities, although mak- ing the transition is often a conflict-ridden process.
Determining an appropriate allocation of functions between local, national and international levels of government, and willingness to pass some power upwards to supranational authorities and some downwards to state and local authorities, are two of the most important tasks facing modern national govern- ments. How well this is managed will be one important determinant of a nation’s technological dynamism in the 21st century.
Sources of Continued Long-run Economic Dynamism in the 21st Century
73
Notes
1. The author argues that the split between pure investment, as measured by increases in physical and human capital, and technological change, as measured by total factor pro- ductivity, is only possible under a strong set of assumptions never found in reality. In practice, new investment embodies some existing and some new technologies and it is impossible to separate how much of any increase in GDP is due to “pure” investment and how much to technological change. (See Lipsey, Bekar and Carlaw, forthcoming.)
2. The author has developed this model in a series of publications starting in the early 1990s. The fully elaborated version is in Lipsey, Bekar and Carlaw (forthcoming) and one published brief account is in Lipsey and Carlaw (1998a).
3. Risk occurs when outcomes have both well-defined expected values and probability distributions. In uncertain situations, it is often impossible even to enumerate all the possible outcomes, let alone assign an expected value to each.
4. For a detailed consideration of these characteristics and a development of the definition that follows in the text, see Lipsey, Bekar and Carlaw, Ch. 2 in Helpman, 1998.
5. Technological dynamism was found in China from the beginning of civilisation until a time that is debated but was probably between the 16th and the 17th centuries. It was also found in the Islamic countries for a shorter period running from about the 11th to the 14th centuries.
6. These issues are discussed in more detail in Lipsey and Bekar, 1995.
7. For a description of such airborne machines see Crandall, 1996.
8. The author has discussed the implications of the new ICTs on globalisation at length in Lipsey, 1997.
9. Whether a new GPT fits into the existing facilitating structure or requires a whole new structure depends on the technological characteristics of each individual GPT.
10. To illustrate this important point, consider a set of markets. Each market has 100 clients with incomes spread out evenly between $1 000 and $100 000 and each is served by two professionals with different abilities whose fees are proportional to their client’s abilities. The professional with the greatest ability gets the clients with the highest incomes. When the markets are isolated, each will be served by the two local profes- sionals, the better of which will have clients with an average income of $75 000 while the other’s clients will average $25 000. Now let the two markets be united. Now the four professionals will each serve a quarter of the combined market and the average
The Future of the Global Economy: Towards a Long Boom?
74
incomes of their clients will be $87 500, $62 500, $37 500 and $12 500, respectively. The more markets unite, the more the stratification according to ability and the more the inequalities in the professionals’ incomes.
Sources of Continued Long-run Economic Dynamism in the 21st Century
75
Bibliography
CRANDALL, B.C., ed. (1996), Nanotechnology Molecular Speculations on Global Abundance. Cambridge, Mass: MIT Press.
DAVID, P. (1991), “Computer and Dynamo: The Modern Productivity Paradox in a Not Too Distant Mirror” in Technology and Productivity: The Challenge for Economic Policy. Paris: OECD.
DAVIDSON, J.D. and William REES-MOGG (1997), The Sovereign Individual. London: Macmillan.
DRUCKER, Peter F. (1993), Post Capitalist Society. New York: HarperCollins.
DRUCKER, Peter F. (1998), “The Next Information Revolution”, Forbes ASAP, 24 August, pp. 47-58.
DUNNING, J.H. (1993), Multinational Enterprises and the Global Economy. Reading: Addison-Wesley.
DUNNING, J.H., ed. (1997), Governments, Globalisation, and International Business. Oxford: Oxford University Press.
EISENBERG, Rebecca (1996), “Patents: Help or Hindrance to Technology Transfer?” in Rudolph and McIntire (1996), pp. 161-174.
FREEMAN, C. and C. PEREZ (1988), “Structural Crisis of Adjustment” in Dosi et al. (eds), Technological Change and Economic Theory. London: Pinter.
GRACE, C.S. (1997), Biotechnology Unzipped: Promises and Realities. Toronto: Trifolium Books Inc.
HELPMAN, Elhanan, ed. (1998), General Purpose Technologies and Economic Growth. Cambridge: MIT Press.
KRANZBERG, M. and C. S. SMITH (1988), “Materials in History and Society” in T. Forester (ed.), The Materials Revolution. Cambridge, Mass.: MIT Press.
LIPSEY, R.G. (1997), “Globalisation and National Government Policies: An Economic View”, Chapter 2 in Dunning (1997).
The Future of the Global Economy: Towards a Long Boom?
76
LIPSEY, R.G. and C. BEKAR (1995), "A Structuralist View of Technical Change and Economic Growth", Bell Canada Papers on Economic and Public Policy, Vol. 3, Proceedings of the Bell Canada Conference at Queen's University. Kingston: John Deutsch Institute.
LIPSEY, R.G., C. BEKAR and K. CARLAW (1998), “What Requires Explanation” and “The Consequences of Changes in GPT's”, Chapters 2 and 8 in Helpman (1998).
LIPSEY, R.G., C. BEKAR and K. CARLAW (forthcoming), Time, Technology and Markets: Explorations in Economic Growth and Restructuring.
LIPSEY, R.G. and K. CARLAW (1996), "A Structuralist View of Innovation Policy" in Peter Howitt. (ed.), The Implications of Knowledge Based Growth. Calgary: University of Calgary Press, pp. 255-333.
LIPSEY, R.G. and K. CARLAW (1998a), “Technology Policies in Neo-classical and Structuralist-Evolutionary Models”, STI Review, No. 22. Paris: OECD.
LIPSEY, R.G. and K. CARLAW (1998b), Assessing Innovation Policies: Taking Schumpeter Seriously on Technology Policy, Industry Canada Working Paper No. 25. Ottawa: Industry Canada.
MALONE, Thomas W. and Robert J. LAUBACHER (1998), “The Dawn of the E-Lance Economy”, Harvard Business Review, September-October, pp. 145-152.
MINSKY, Marvin (1986), Foreword to Eric K. Drexler’s Engines of Creation. Garden City, New York: Anchor Press/ Doubleday. Also available on the Internet: http://www.foresight.org.EOC/ EOC_Foreword.html
MOKYR, J. (1990), The Lever of Riches: Technology Creativity and Economic Progress. Oxford: Oxford University Press.
OSTRY, Sylvia (1990), Governments and Corporations in a Shrinking World: Trade and Innovation Policies in the United States and Japan. New York: Council on Foreign Relations Press.
REGIS, E. (1995), Nano. New York: Little, Brown.
ROSENBERG, N. (1982), Inside the Black Box: Technology and Economics. Cambridge: Cambridge University Press.
RUDOLPH, F.B. and L.V. McINTIRE, eds. (1996), Biotechnology: Science, Engineering, and Ethical Challenges for the Twenty-First Century. Washington DC: Joseph Henry Press.
SCHURR, S. et al. (1990), Electricity in the American Economy. New York: Greenwood Press.
WELLMAN, B. and B. BUXTON (1994), “Work and Community Along the Information Highway”, Policy Options 7, pp. 11-15.
77
3
3The Emerging Global Knowledge Economy 6by
7Peter Schwartz, Eamonn Kelly and Nicole Boyer Global Business Network
1. Introduction: A tale of two countries
There is an old South American legend that when God created the continent he tripped over the Patagonian Andes and accidentally emptied the bulk of His riches in the land of Argentina. One can see how this myth got started. Argentina is indeed blessed with a surfeit of natural resources: vast, fertile “Pampas” flatlands which yield a bounty of grains and support countless livestock; a solid range of for- ests for lumber; a long triangular coastline with a rich fishery; an ample supply of water for hydroelectric power; and lastly, a beautiful high mountainous terrain that both attracts travellers and provides minerals to fuel industry.
Throughout its history, these natural endowments have served Argentina well. As far back as 1535, they lured the Spanish to colonise it as a territory. By the early 1880s-1900s, the former colony had become a formidable economic and political power, boasting the seventh largest economy in the world. With an edu- cated and sophisticated population, high culture and the arts flourished. Buenos Aires’ natural beauty and architecture earned it the distinction of being the “Paris of Latin America”. Argentina was clearly a country on the rise, set to be an important presence on the world stage for the coming century.
Now imagine the island of Singapore around the same time. As one of Britain’s “Straits Settlements”, the city was a sleepy trading outpost in 1900 com- pared to the bustling streets of Buenos Aires. An island just 647.5 square kilome- tres in size, it had little in terms of natural resources. While it did have a protected harbour and was strategically located in the South China Sea, the lucrative tea and spice trade had made its sister cities – Penang and Malacca – long-standing rivals and equal competitors in capturing the business of traders. So at the turn of century, Singapore must have looked like a poor bet for future success.
The Future of the Global Economy: Towards a Long Boom?
78
Enlisting the entrepreneurial energies of characters like Sir Stanford Raffles, Singapore eventually did earn its place in the Empire’s sun. It quickly became a key naval base and commercial centre in British Malaya, acting as a hub for export- ing agricultural commodities to the rest of the world. Then in 1965, Singapore’s future was again in doubt. Shortly after it won independence, it joined the Malay- sian Federation but was quickly forced to leave. (In essence, the Malays were sus- picious of their Chinese partners in Singapore.) So with strained relations among its neighbours, and few natural resources to stand upon, Singapore faced grim prospects. How could this small city-state survive in the modern world? Many observers were highly sceptical.
In 1999, the stories of these two countries have taken very different turns. Argentina, its improved performance in the past decade notwithstanding, has experienced drastic decline, dashing the buoyant expectations and future prom- ise. With a population of 35.4 million, Argentina’s GDP per capita is $8 030 in 1995 figures. In contrast, with a population one-tenth the size of Argentina’s (3.1 million), Singapore had a GDP per capita of $26 730 in 1995, exceeding many parts of Europe, including the United Kingdom. Ranked consistently by the World Economic Forum as the most competitive nation in the world, Singapore is now the envy of both developed and developing countries. From a policy point of view, the island country has managed the unimaginable, transforming itself in just thirty years from a have-not state to a leading global economic entrepôt.
The recent histories of these countries have been informed by a range of deep and complex factors – political, social, economic – that are beyond the scope of this chapter. But they are perfect illustrations of the emerging global knowledge economy because they highlight the evolution from an economic order in which the clever and organised use of natural resources was sufficient for success – illustrated by Argentina at the end of the last century – to an eco- nomic order based on knowledge, in which the exploitation of natural resources is not only insufficient but, as Singapore demonstrates, not even necessary. Those i n d i v i d u a l s , o r g a n i s a t i o n s a n d c o u n t r i e s t h a t r e c o g n i s e d t h i s e a r l y a r e well-placed for the next century; those still struggling to understand the seismic shift we are undergoing may suffer friction burns and relative decline for some time to come.
Section 2 of this chapter puts the knowledge economy in context, explaining what makes it different from an industrial-based economy, and highlighting the key driving forces that enable this transformation.
Section 3 then surveys the numerous dilemmas facing society. When we take stock of today’s challenges – whether finding a new set of metrics for knowl- edge-based activities, reinventing how we educate our citizens or employees, rec- onciling antitrust laws in an economy based on increasing returns, or enabling
The Emerging Global Knowledge Economy
79
developing countries to participate in an increasingly high-tech world – we get a profound sense that our institutional, legal, organisational and social arrange- ments are lagging behind events, and that we lack the analytical and conceptual tools to deal with these dilemmas. Our thesis is that these dilemmas are symp- tomatic of a clash between two economic paradigms and values – the uneven col- lision between the industrial age and burgeoning knowledge age. But as Albert Einstein noted, we cannot solve our current problems with the same level of thinking that created them. In the same way, to resolve these dilemmas we need to step back and clearly understand the different assumptions driving the two different economic models and reperceive the various problems through the lens of knowledge. This perceptual shift is critical for the realisation of what we call “The Long Boom”, a sustained period of global economic growth, prosperity, openness, and integration.
Section 4 takes some of the key dilemmas or critical uncertainties and weaves them into two broad-brush scenarios for the future of the knowledge economy. For example, in a world where innovation is highly rewarded, where the slow must compete against the fast, who will be the winners and losers? How widespread will the economic impact of the knowledge economy be? How rapidly will it occur? One can envision two very different scenarios. If the effects of growth are substan- tial and rapid, and access to education and technology is very wide and deep, then a high-growth, socially convergent future is plausible. If, on the other hand, the effects of growth are slow to materialise and access is more limited and nar- row, then a slower growth and socially divergent future is more likely. In terms of the implications for the OECD countries, the central policy question for govern- ments is how to achieve the first outcome and avoid the second. The answer lies in providing cheap and easy access to a high-quality knowledge infrastructure, especially in education.
2. Understanding the global knowledge economy
At times of momentous change in culture and society, our use of old words to describe new things can hide the emerging future from our eyes.
Charles Handy (Drucker et al., 1997)
The naming of an economic system is usually long in the making. Indeed, over the past couple of decades there has been a profusion of terms emerging in popu- lar discourse. We have heard about the post-industrial economy, service econ- omy, post-capitalist society, digital economy, network economy, the new economy – and more recently, the knowledge economy. So amid this diversity of terms, it is worth asking, why now the “knowledge” economy? This section will answer that question, and in the process will detail the three fundamental forces driving the
The Future of the Global Economy: Towards a Long Boom?
80
transformation. Inextricably related, each representing one aspect of a complex feedback loop, they include:
– The qualitatively different assumptions governing knowledge inputs.
– The proliferation of IT networks.
– The globalisation of the economy.
Toward the tipping point
In the same way that an algae blight goes unnoticed until just before the tipping point – the day before it takes over the entire pond – we often fail to see the nature of deep trends and structural changes until they are upon us (Kelly, 1997). Today we are at one of these thresholds, where the proliferation of knowledge-intensive activities is irrevocably transforming the shape of our economic systems.
We have been approaching this tipping point for some time. As historian Fernand Braudel details (1992), the changing nature of capitalism has favoured different inputs over the past three centuries. “Favoured” here means, that which was scarce became the source of wealth creation. For instance, the focus shifted from land in an agrarian society to capital in an industrial society. Now we are see- ing the balance move from capital to knowledge. In the language of economists, knowledge is now the source of wealth creation and the most important factor of production. This means that while traditional factors – land and natural resources, labour, and capital – are still important for economic activity, they are becoming secondary (Drucker, 1993). Capital, once the pre-eminent factor, is no longer scarce. This can be seen in high-technology centres like the Silicon Valley. If one has knowl- edge, as is the case with promising new start-ups, capital and labour quickly follow. Furthermore, in the last few decades, we have seen how the input of knowledge has been remaking the economic landscape, lending knowledge-intensity to other inputs. The revolution in manufacturing is one example, where entire supply chains are now wired from beginning to end with just-in-time delivery systems.
Knowledge, however, is more than just the next critical factor of production. From an economic perspective, it has two roles: it is a source of renewal and is also the glue that binds and co-ordinates other factors of production. In fact, the evolution of our collective knowledge may also be the key to our evolution and progress over time. Taking the long view, each major economic and social transfor- mation throughout the ages has been triggered by new breakthroughs in knowl- edge. During the Agricultural Revolution tens of thousands of years ago, a new society emerged (in different parts of the world at different times) as a result of the new knowledge about how to grow, cultivate, and harvest food from seeds (Chichilnisky, 1998). In the 18th century, the invention of the steam engine,
The Emerging Global Knowledge Economy
81
together with the knowledge of how to harness the power of this new machine, initiated the Industrial Revolution.
As we move into the 21st century, we are learning to exploit information tech- nology (IT) to create wealth from knowledge (Chichilnisky, 1998). In a post-modern way, we are now learning to use the tools of IT to mine our “knowledge about knowledge”. IT has shown us that information is not knowledge, and that while digitisation, IT networks and technological innovation are all key aspects of the new economy, the common DNA driving these changes is knowledge.
Lastly, from a human perspective, the quest for knowledge is an integral part of what it means to be Homo sapiens. So in this context, the word “knowledge” commands a certain emotional appeal that “capital” and other inputs fail to invoke. Thus, while the prefix “knowledge” may be place-holder for the next epi- thet to emerge in popular discourse, the notion of the knowledge economy may have more enduring conceptual power because it tells us how to do things and how we may do them better (Davenport and Prusak, 1998).
The birth of knowledge economics
In the end, the location of the new economy is not in the technology, be it the microchip or the global telecommunications network. It is in the human mind.
Alan M. Weber (1993)
Manifestations of the knowledge economy are now appearing in many aspects of our economic lives. As we approach the tipping point, we see evidence of this transition everywhere. In the stock markets, corporations are increasingly being evaluated for their knowledge and ideas, e.g. new technology, patents, copyright, brand names and human talent. For instance, Microsoft, a company that has only 3% of the physical assets of General Motors, now has the highest capitali- sation in the market. In terms of job creation, the fastest-growing sectors are all knowledge-intensive industries, including software, biotechnology, consulting, healthcare and education (Wilson, in Conceição et al., 1998); meanwhile, we will continue to see a jump in the number of displaced workers from manufacturing and resource extraction sectors. Overall, however, the number of new jobs being created is greater than the jobs lost (Kelly, 1998.) For instance, 1998 saw the United States experiencing its lowest unemployment rate (4.3%) in twenty-eight years (The New York Times, 5 February 1999).
A special issue of Technological Forecasting and Social Change on “The Emerging Importance of Knowledge for Development: Implications for Technology Policy and Innovation”, found ample evidence to sustain the idea of a knowledge-based
The Future of the Global Economy: Towards a Long Boom?
82
economy (Conceição et al., 1998). While the subject of the knowledge economy remains controversial in their view, the “safe” evidence includes:
– Workforce movements from manufacturing to service jobs. Service jobs were interpreted by the journal as more knowledge-intensive because they have intangible inputs and outputs. This shift has been strongest in developed world.
– Growth in investment in intangible assets.
– The growth of new employment in knowledge-intensive fields such as consulting, education, high technology and healthcare.
– Evidence that “knowledge work” requires higher education levels and that knowledge workers are increasingly better paid.
Another important indicator is a change in popular discourse. As we approach the tipping point, the discussion of “knowledge about knowledge” has increased exponentially. Already there is a growing body of empirical and theoretical litera- ture explaining the development of the knowledge economy. Entire new disci- plines and areas of study have been born, and with them a flurry of new journals, websites and magazines devoted to understanding various aspects of knowledge creation, application and dissemination. The University of California at Berkeley recently appointed its first professor of “knowledge”. In the private sector, we have seen the birth of the “knowledge movement” and the rise of “chief knowl- edge officers”. Recognising where their future work will be, all of the “Big Six” con- sulting firms are now reinventing their core business around the platform of knowledge management.
Not everyone, however, is comfortable with this shift. In particular, the process of re-perception has yet to penetrate the halls of many economic departments. In fact, when it comes to talking about the “new economy”, the sheer religiosity of views on the subject is astounding. Varian and Shapiro (1999) write in the beginning of their book Information Rules, “Technology changes. Economic laws do not.” Indeed, when it comes to key economic laws such as supply and demand, this is surely the case. But there are some notice- able and widening cracks in conventional economic theory that cannot be addressed within current economic thinking. Take the concept of scarcity, for instance. According to traditional economic thinking, the main factor of pro- duction was also scarce. Does this mean, now, that knowledge is scarce? With the exponential growth of the world’s knowledge stock, how can knowledge be scarce? Whether economists like it or not, knowledge is different. The rest of this section addresses that difference, one that conventional thinking struggles to reconcile.
The Emerging Global Knowledge Economy
83
Knowledge is messy
There is good reason why economic thinkers have avoided the use of knowl- edge as a primary unit for analysis: quite simply, knowledge is hard to measure and quantify. Clearly, as Verna Allee (1997) notes, “There is no convenient way to isolate knowledge as a discrete phenomenon.” In systems thinking terms, knowl- edge exists in, as she puts it, “a system of interacting problems”. Because of this, the study of economic growth has been focused on more tangible manifestations, such as technological innovation. But even then, economists have had a hard time incorporating technology into their economic models. Knowledge and technology growth, therefore, have typically remained outside or “exogenous” to economic models and measures.
The Nobel Prize winning work of Robert Solow (1957), however, started to highlight the shortcomings of this approach. Solow found that after accounting for the impact of increases in labour and capital, the “residual” – i.e. technology – was the key driver of growth. With so much of technology accounting for economic growth, a full 85% according to Solow’s calculations, it did not seem to make sense to treat it as if it occurred in a black box. This work led to a measure called Total Factor Productivity (TFP), which gives an indication of the overall improvements in all factors of production. But even this yardstick has been inadequate in furthering our understanding of how knowledge drives economic activity.
In recent years, a band of pioneering economists called “new growth” or “endogenous” theorists have tried to incorporate knowledge and technology into the production function. Paul Romer (1993, 1995), one of the leading pro- ponents of new growth theory, has gone as far as to reframe how we see the production function. The traditional factors of production fall into fairly distinct categories: land, raw materials, capital equipment, and labour. Romer argues that the term “factors of production” is very industrial age, invoking the meta- phor of “factory”. As we move away from factories and industrialisation, a more appropriate way to see economic activity is through a computer metaphor: hardware, software, and “wetware” (see Figure 1). Hardware includes all physi- cal inputs, such as land, buildings, and capital investments in technology. Software is codified knowledge that is stored outside the human brain: in a book, CD-ROM, computer hard drive, blueprint, or schematic. Wetware includes the tacit knowledge stored in the human brain, including skills, talents, and beliefs (Conceição et al., 1998).
There are further distinctions within each broad category. Software – knowledge that is codified – includes information or knowledge about facts ( k n o w - w h a t ) a s w e l l a s k n o w l e d g e a b o u t h o w t h i n g s w o r k i n t h e w o r l d (know-why). Wetware, embodied in the minds of knowledge workers, includes a person’s abilities and skills to carry out their function (know-how). Another
The Future of the Global Economy: Towards a Long Boom?
84
aspect includes knowledge about knowledge relationships, e.g. knowledge about other people’s wetware (know-who) and who the experts are in the o r g a n i s a t i o n – t h e “ w h o k n o w s w h a t a n d w h o k n o w s h o w t o d o w h a t ” (Conceição et al., 1998).
This new taxonomy deals with the individual as the primary unit for analy- sis, but one can also see how the concepts of hardware, software and wetware can be extrapolated to a firm, a country, or a region. For instance, although Singapore is lacking in hardware, its economic strength comes from key invest- ments in its software and the wetware of its citizens. Even as the city-state experiences the full brunt of the Asian financial crisis, it is cognisant of this reality more than ever. Its strategy for the future is firmly grounded in the virtu- ous circle of investment in the knowledge stock of its people. Argentina, by contrast, has an economy focused on hardware, including its natural resources and more industrial-age activities. While the population is highly educated, with 25 national universities and a 95% literacy rate, the typology of Figure 1 raises some interesting strategic questions about how well they are marshal- ling their national wetware and software. As this example shows, seeing things t hroug h th e lens of know ledg e, w ith h uman r esources in it s cent re, can fundamentally recast people’s thinking and priorities.
Figure 1. Taxonomy of knowledge
Sources: Foray and Lundvall, in Conceição, et al. (1998).
KNOW-HOW: Skills or capacity to
execute a task
KNOW-WHO: Knowing “who knows what”
(e.g., experts)
KNOW-WHAT: Information or knowledge
about facts
KNOW-WHY: Knowledge about
scientific principles and explanatory
theories
WETWARE: Tacit knowledge stored in human brains (beliefs, talents, skills)
SOFTWARE: Codifiable knowledge (books, CD-ROMs,
blueprints)
HARDWARE: Non-human material things (equipment,
buildings, land)
Figure 1. Taxonomy of knowledge
Sources: Foray and Lundvall, in Conceição, et al. (1998).
KNOW-HOW: Skills or capacity to
execute a task
KNOW-WHO: Knowing “who knows what”
(e.g., experts)
KNOW-WHAT: Information or knowledge
about facts
KNOW-WHY: Knowledge about
scientific principles and explanatory
theories
WETWARE: Tacit knowledge stored in human brains (beliefs, talents, skills)
SOFTWARE: Codifiable knowledge (books, CD-ROMs,
blueprints)
HARDWARE: Non-human material things (equipment,
buildings, land)
Figure 1. Taxonomy of knowledge
Sources: Foray and Lundvall, in Conceição, et al. (1998).
KNOW-HOW: Skills or capacity to
execute a task
KNOW-WHO: Knowing “who knows what”
(e.g., experts)
KNOW-WHAT: Information or knowledge
about facts
KNOW-WHY: Knowledge about
scientific principles and explanatory
theories
WETWARE: Tacit knowledge stored in human brains (beliefs, talents, skills)
SOFTWARE: Codifiable knowledge (books, CD-ROMs,
blueprints)
HARDWARE: Non-human material things (equipment,
buildings, land)
The Emerging Global Knowledge Economy
85
Knowledge is abundant, not scarce
Contrary to traditional economic thinking, knowledge follows the law of abun- dance rather than scarcity. As Romer discusses (1993), the economics of “ideas” follow very different assumptions from the economics of “objects”. Objects, or physical inputs to production, are finite resources subject to the laws of physics. Their meaning is derived from their physical performance (e.g. the strength of steel). Ideas, on the other hand, are intangible and abstract. Their meaning is not derived from the physical realities of ink on the page; rather, meaning is created in the interaction of a reader with the words on the page.
The shift away from a resource-intensive economy to a knowledge-inten- sive economy means that economic growth is constrained only by our ability to create new knowledge. As Romer explains, economic growth occurs whenever people develop new “recipes” or ideas that rearrange physical things and resources in ways that add more value. New discoveries in material science, for instance, are ideas that will create cheaper, stronger, and possibly more sustainable products for automobiles. In this way, knowledge amplifies the value and capacity of other factors while creating new processes and products (Stevens, 1996).
Although knowledge is not scarce, what may be scarce is human attention. To quote the Nobel Prize winning economist Herbert Simon, “what information con- sumes is rather obvious: it consumes the attention of the recipient. Hence a wealth of information creates a poverty of attention.”
Knowledge creates increasing returns
Another key difference in a knowledge-based economy is the existence of an “increasing returns” dynamic that contrasts with the traditional concept of “ d i m i n i s h i n g r e t u r n s ” . T h e l a t t e r i s b a s e d o n t h e n o t i o n o f s c a r c i t y o f resources. A mining company, for instance, will inevitably face certain limita- tions as it depletes the natural resource it mines. In theory, this prevents one company from dominating the market and ensures an equilibrium of prices. As we have already established, knowledge and the economics of ideas is not based on scarcity – thus the dynamic of “increasing returns”. Industries based on increasing returns lend themselves to “natural monopolies”, where markets are unstable and perfect price competition does not occur. This is because increasing returns are based on “mechanisms of positive feedback that oper- ate – within markets, businesses, and industries – to reinforce that which gains success or aggravate that which suffers loss” (Arthur, 1996). Kevin Kelly (1998) calls these “network superwinners” because they essentially dominate the industry ecosystem. Microsoft, Cisco and Oracle are classic examples of this in
The Future of the Global Economy: Towards a Long Boom?
86
the high technology sector. In brief, three things drive this winner-take-most logic:
– Large up-front R&D investments but with falling costs per unit as sales increase. It may cost $50 million to create a piece of software, but only $3 per unit to produce. Companies that seize early market share stand to gain further advantages.
– The need for products and services to be compatible with a network of users. The company that gains market advantage also influences the rules and standards of the network.
– The customer lock-in that occurs when a product requires a certain level of knowledge to use it, e.g. Microsoft Windows (Arthur, 1996).
As Brian Arthur notes, we are seeing the coexistence of both increasing returns and diminishing returns in different industries, and often within the same company. The dynamic of diminishing returns is found mostly in traditional, indus- trial age industries, whereas increasing returns is a hallmark of high-technology, knowledge-intensive industries and companies. Importantly, each dynamic elicits and requires different economic and organisational behaviours. As Arthur puts it:
[…] diminishing returns is characterized by planning, control, and hierar- chy. It is a world of materials, of processing, of optimization. Observation, positioning, flattened organizations, missions, teams, and cunning char- acterize the increasing return world. It is the world of psychology, of cognition, of adaptation.
As Arthur and Kelly both argue, the bifurcation of the economy into these two worlds is becoming less distinct. Increasing returns is migrating to other parts of the economy as industrial age sectors adopt more knowledge-intensive products and processes with “smart” technologies. This deeper shift toward the knowledge economy is pulling with it the old economy as well.
Increasing returns can also happen within a region. As AnnaLee Saxenian (1994), author of Regional Advantage, makes clear, Silicon Valley’s sustained success has been driven by the powerful forces of increasing returns. Many regions have subsequently tried to emulate the same initial conditions of Silicon Valley by nur- turing positive feedback loops to drive growth: the recruiting of a talent pool, the presence of world-class institutions and R&D facilities, a risk-taking venture capi- tal sector, and fast broadband networks and technology. Singapore, for instance, has been moving down this checklist very consciously. In an attempt to stimulate increasing returns, Singapore has been systematically luring top talent and corpo- rations to participate in its state-of-the-art multimedia network called “Singapore One”. Its goal is to be the “giga-hub” for Southeast Asia. Other examples are proliferating around the world: South Africa’s “Cyber-townships”; Malaysia’s
The Emerging Global Knowledge Economy
87
“Multimedia Corridor”; “Smart Toronto” in Canada; the “Redline” project in the Netherlands; and the “Stockholm Project” in Sweden (Boyer, 1996).
Knowledge feeds on itself
The second form of increasing returns in the new economy is embedded in the very cycle of knowledge creation and innovation. Scientific discoveries and technological breakthroughs do not happen in a vacuum, with a solitary researcher finding the silver bullet to a key problem. One scientific discovery in a given disci- pline builds on the cumulative knowledge stock of that particular field. According to Romer (1997),“the more we discover things, the better we get at the process of discovery itself. Knowledge builds on itself.” The more we learn about how inno- vation happens, the more we realise it is driven by a series of feedback loops between a network of scientists, universities, labs, think tanks, investors, corporations, and even consumers; it is a dynamic, organic, and iterative process.
Growth in the knowledge stock of science, therefore, has nonlinear, biological characteristics. This creates certain problems when it comes to public perception and even analysis. The human mind is notoriously bad at intuitively comprehending expo- nential growth. For instance, when someone is told that they will get paid 1 cent at the beginning of the month, with it doubling in value every day, it is hard for them to grasp that by the thirtieth day they will have earned in excess of $5 million dollars. In a simi- lar way, with each scientific discovery building on others, we systematically underesti- mate the potential for scientific discovery in the future. For instance, who knows what kind of jump human knowledge will make after the completion of the Human Genome Project? The answer is most likely far beyond our predictions or imagination.
Knowledge resets the limits for economic growth
In the bigger picture, we can see how the biological growth of new ideas and knowledge has stimulated technological innovations throughout human develop- ment. In categorising technological breakthroughs over time, Perez has argued that different waves of technology profoundly reinvent the “techno-economic par- adigm” of the day (1985). Such a shift occurs when a certain technological develop- ment becomes pervasive and fundamentally affects other technologies, industries and services. An increasing returns dynamic takes hold as knowledge about how to use and apply these technologies spreads widely throughout society. Electricity was one such technology at the turn of the last century. Information technology is at the centre of another paradigm shift today.
Returning to Romer’s metaphor, these waves of technology are not only “new rec- ipes” that unleash economic wealth; they are also entirely new ways of cooking that creatively push the outer boundaries of what was once thought possible in terms of economy growth. In Wheels of Commerce, Braudel (1992, Volume 2) makes a compelling
The Future of the Global Economy: Towards a Long Boom?
88
case for how this has happened with each techno-economic shift. In the 15th century, Holland, a small trading country, dominated the world economy because of its mas- tery of sailing technology and knowledge of navigation and the seas. At that time, the global rate of growth was about 0.5%. During the Industrial Revolution, capitalism began to spread throughout the world and brought with it steam power and new modes of manufacturing. The United Kingdom rose as the key economic player, par- tially because of its early adoption of and pioneering efforts using machines driven by steam. The worldwide rate of growth jumped to 1.5%. Then, based on early exploita- tion of new technologies and resources – e.g. electric power, the telephone, the inter- nal combustion engine and petroleum – the United States assumed economic leadership in the latter part of the 19th century. Another factor fuelling this hegemony was that US industrialists, mainly in the East and the upper Midwest, had mastered mass manufacturing, surpassing the techniques first developed by the British. By then, the global economy was growing at approximately 3% annually.
New waves of technology – computers, communication, bioengineering, fuel cells, and the like – are just beginning to impact the world economy. Once again, the drivers of growth may be relocating (this time toward the Western United States and the Pacific Basin) and accelerating growth to levels perhaps as high as 4-5% annually. Conventional economic wisdom holds that as economies mature
1580
25 20
15
10
5
25 20
15
10
5
1700 1820 1890 1989
Figure 2. Changes in economic leadership
United States
Locus of Productivity Leadership, 1580-1989 (GDP per man-hour in 1985 US$). Source: Maddison, 1991.
United Kingdom
Netherlands
1580
25 20
15
10
5
25 20
15
10
5
1700 1820 1890 1989
Figure 2. Changes in economic leadership
United States
Locus of Productivity Leadership, 1580-1989 (GDP per man-hour in 1985 US$). Source: Maddison, 1991.
United Kingdom
Netherlands
1580
25 20
15
10
5
25 20
15
10
5
1700 1820 1890 1989
Figure 2. Changes in economic leadership
United States
Locus of Productivity Leadership, 1580-1989 (GDP per man-hour in 1985 US$). Source: Maddison, 1991.
United Kingdom
Netherlands
The Emerging Global Knowledge Economy
89
they will converge toward lower growth (e.g. 1-2% annually). But clearly, this view is being challenged as we learn more about the impact of these techno-economic paradigms. In particular, we are seeing that new technologies can de-mature an economy if it successfully adopts the new capabilities. Singapore, for example, has de-matured itself several times.
The impact of these new technologies, especially the powerful web channel, will increase the amount of turbulence in the world economy, a turbulence driven largely by uncertainty. Developing an e-commerce strategy for most companies is still one grand experiment because there are no clear “recipes”. At present, we see a wide vari- ety of business models sprouting up around e-commerce going in different directions, each hoping that their model will stick or set the standard for others. But once these recipes evolve and take hold, a much larger number of people and companies will start to imitate them – and that in turn will drive another spurt of economic growth.
Knowledge is both a public and private good
When one asks the question “What is knowledge in an economic sense?”, there are usually two answers. Knowledge can be either a private or public good, depend- ing on what aspect is considered. Using Romer’s typology, “wetware” is a private good until that knowledge is codified into “software”. The problem with software is that once produced it is hard to make it “excludable”, given the marginal cost and ease of reproduction. This is a problem because most knowledge-intensive prod- ucts, such as pharmaceuticals or a new CD-ROM, are costly to produce. In many cases, the innovators do not capture the full economic benefit of their work. Put another way, “traditional market mechanisms do not provide the rules for efficient resource allocation in the production of software” (Conceição et al., 1998). Public goods, which have private goods qualities, are very hard for the market to price. This is a dilemma that will be discussed further in the next section.
Knowledge involves human beings
If the new economy is rooted in the human mind, this is likely to produce new values and behaviours in our institutions, corporations, and society. One example is that the traditional power relationships are likely to change significantly, making the economy more decentralised in nature. In a knowledge economy, for instance, “knowledge workers” own the mode of production. In this sense, knowledge, unlike capital, equipment, or land, can walk out the door on any given day. This will considerably shift the dynamic between employer and employee. Similarly, while a country or state may invest money in educating its citizens, the global competition for highly skilled workers is making it easier to move to another coun- try where there are more lucrative and rewarding jobs. The current “brain drain” of highly skilled scientists from Russia is a good example.
The Future of the Global Economy: Towards a Long Boom?
90
Also, if corporations are seeking to increase the productivity of knowledge workers, they can use very different types of incentives. The quality of the work environment, for instance, is becoming a priority. What motivate a knowledge worker are things such as learning, equity sharing, interesting and important work, and fun. Knowledge generation also follows nonlinear, organic cycles that contrast strongly with industrial age production cycles. As Allee (1997) writes, “knowledge wants to happen, just as life wants to happen, and both want to happen as com- munity”. Prime examples are the on-line knowledge communities currently blos- soming on the Internet. Physics researchers were among the first to exploit the community of knowledge made possible by the Net. Within these communities, no one is in charge of the knowledge-creation process. Knowledge also seeks community when issues are complex and uncertainty abounds. We see this hap- pening at the policy-making level and among scientific groups, but also within industry. The whole idea of “co-opetition” is based on the idea of co-operating and sharing knowledge to solve a particular issue (e.g. standard-setting) while still competing in the wider market-place.
Values of trust might also become a business imperative in the knowledge economy. With the free flow of information across a multitude of networks, concerns about privacy are going to increase. IT enables corporations to know more about their consumers. While this can help customers, it also gives corporations the ability to make market-based choices (or to discriminate) based on a consumer’s socio-economic profile. This is raising a number of social and political concerns. As Kevin Kelly (1998) writes: “The network economy is founded on technology, but can only be built on relationships. It starts with chips and ends with trust.”
IT networks and connectivity
Knowledge is the content, information is the medium. The content is driving change, facilitated by the medium.
Graciela Chichilnisky (1998)
As we have argued, the very nature of knowledge is driving change. The most important catalyst, however, has been the tremendous growth of IT and digital networks. Without question, this aspect of the emerging knowledge economy is something new. Transcending both spatial and temporal boundaries, IT networks are creating an entirely different competitive space and social experience. As a result, the “network economy” has been an important focus in recent literature.
In brief, the widespread application of networks and information technology has enabled and accelerated the knowledge-based economy by:
– Increasing the codification, dissemination, and creation of knowledge.
– Enabling the commoditisation of knowledge.
The Emerging Global Knowledge Economy
91
– Creating a global information infrastructure for communication, discovery and commerce.
– Facilitating a functional convergence between the spheres of commercial activity.
– Accelerating the pace of change towards a state of disequilibrium.
The power of connectivity
Although scientists and experts have been communicating via IT networks for decades, the rapid rise of the World Wide Web was a largely unanticipated develop- ment. The desire to communicate, interact, and engage in commercial transactions seems to be an insatiable human need. Already 100 million people can access the web. By the year 2002, this figure will have jumped to 320 million. Another indicator of increasing connectivity is the growth of data traffic on telecommunications net- works. According to Bell South Chairman Duane Ackerman, voice traffic will drop to 10% by 2008. But as he explains, “It’s not that voice is declining, on the contrary, it continues to grow, doubling every twelve years, but data traffic over the internet – e-mail, orders from retail businesses and the like – continues to double every 100 to 120 days.” That is indeed astounding, exponential growth.
In response to this emerging economic and social platform, governments around the world, together with the private sector, have been creating information infrastructures so that more people can participate in the economic and social benefits. The opportunities for developing countries to leap-frog into knowl- edge-intensive activities are therefore greater than ever. The new generation of low-earth-orbit communication satellites (LEOs) will extend the range of commu- nication options to nearly everyone on the planet in just six years. This is a historic discontinuity: today, 70% of the world has never made a telephone call but soon, most will have full broadband access to the Net. As increasingly large sections of global society become connected to networks, the result is bound to be profound. Even so, the globalisation of the knowledge economy does create numerous dilemmas for society’s policy makers, a point taken up in the next section.
The acceleration of knowledge creation
Developments in IT and networks have been driving tectonic changes in almost every scientific and technology field by magnifying the acceleration and sharing of knowledge. Revolutionary innovations are occurring across the board. Alternative, “clean” energy technologies and fuel cells are on the horizon. Indus- trial ecology and intelligent materials will change the way we build. Genetic engi- neering will enable us to cure major diseases and improve agricultural productivity. New computational and simulation methods are improving the
The Future of the Global Economy: Towards a Long Boom?
92
productivity of scientific, engineering and design talent. Meanwhile, the creation of information networks and enhanced connectivity among scientists is enabling the free flow of ideas and knowledge from diverse cultures and fields at a global level. The economic rewards for technological innovation have never been higher. The metabolism of discovery and innovation is continuing to accelerate. To put this into perspective, of all the scientists who ever lived, more than 90% are alive today. It’s estimated that the stock of scientific knowledge is currently doubling every five to six years; by the year 2020, it will double every 73 days.
The speed and development of new knowledge is exemplified by the US Gov- ernment’s human genome project. Initially, the government estimated that mapping the human genome would take twenty-five years to complete. The private sector, however, could not wait that long. In 1997, a biotechnology company named Human Genomic Sciences jumped into the race and concluded that it could perform the work not in half the time, but in three years. This in turn forced the government to rethink – and speed up – its research to match the private efforts. Now, the entire human genome will be mapped by the year 2002 instead of 2015.
Technological convergence
IT, itself the convergence of communications and computing, is accelerating the creation of new knowledge and new technologies. Most technologies today are products of many other supporting technologies. The development of the modern VCR, for instance, required, over time, the convergence of approximately 16–18 technologies and innovations.
Another important functional convergence is also happening between the modes of commerce. On an abstract level, commerce can be reduced to three cir- cles of activity or goals (Alliance for Converging Technologies, 1997):
– Value creation – which occurs mainly through physical labour and tangible goods.
– Communication – either externally (with customers) or internally (with employees), using various forms of media such as the human voice, print, telephones, TV, and radio.
– Distribution of goods and services – which has utilised a variety of technolo- gies of transport (e.g. by hand, ship, railway).
For the first time in the history of commerce, all three activities are converg- ing around a common digital platform (Alliance for Converging Technologies, 1997). This is why some observers dub our current world a “digital economy” (Tapscott, 1995.) However, the real story is centred around enhanced access to the knowledge housed in the other modes of commercial activity. For instance, what we mean by value creation is starting to change. The way we communicate with
The Emerging Global Knowledge Economy
93
our employees and customers is being transformed, with consumers becoming “prosumers”: customers who co-create the value being produced with their suppli- ers. For example, the success of Scott Adams’ “Dilbert” cartoon strip, which lam- poons the social and economic perversions of modern corporate life, did not take off until he distributed his e-mail address on the web. The result: people from around the world sent him a flood of e-mails detailing their real-life experiences as corporate employees. The quality and power of his strip were strengthened because he reflected the very issues and concerns of his audience. In this sense, the content was being created by both Adams and his readership.
This functional convergence via IT has sped up nearly every process in the world of business. This has led to much wider and deeper integration among eco- nomic actors and has blurred the boundaries between them. The fusion and cross-fertilisation of three pillars of commerce – value creation, communication, and distribution – is creating, in the words of Stan Davis and Christopher Meyer (1998), a “blur of desires, blur of fulfillment, blur of resources”.
Toward creative disequilibrium
Contrary to what many people thought, ecosystems and other complex adap- tive systems in the natural world exist in constant flux at the cusp of disequilib- rium and breakdown. In recent years, the rise of “chaos theory” and “systems thinking” has taught us that our organisational and economic institutions operate very much like a complex, adaptive living system. This has certain implications for creating the right conditions in which new ideas and insights flourish. For instance, Kevin Kelly (1998) advises: “To achieve sustainable innovation you need to seek persistent disequilibrium. To seek persistent disequilibrium means that one must chase after disruption without succumbing to it, or retreating from it.” Dee Hock, founder of Visa International, calls this the “chaordic” organisation. Building these companies, however, is very hard to do in practice. Clearly, the realisation that creative disequilibrium reigns supreme in organisations and economic systems is a discomforting thought for managers and policy makers, creating numerous dilemmas that defy an intuitive response.
Forces of globalisation and integration
The third driver making this economic transition truly novel is the manifold thrust towards globalisation and economic integration. The rise of transnational networks, the market power of connectivity, and the global demand for real-time information and knowledge have been pushing the trend. Critics are quick to point out that this is not a historical precedent, which is true enough. In empirical terms the world is probably no more integrated economically than it was in 1913 (Dicken, 1998), but the type of global economic integration we are seeing is faster,
The Future of the Global Economy: Towards a Long Boom?
94
deeper, and more profound than ever before. The following indicators offer good examples:
– World exports were 14 times greater in 1994 than they were in 1950 (Dicken, 1998).
– Since 1985, foreign direct investment (FDI) has been growing at an average annual rate of 28%. Although the 1993 recession dampened investment, FDI outflows quickly rebounded in 1995 by 40% (Dicken, 1998).
– Daily foreign exchange turnover has increased from $15 billion in 1973 to $1.2 trillion in 1995 (The Economist, 1997).
Perhaps the best examples of globalisation are the growth and transformation of the South East and East Asian economies. While a large part of manufacturing remains in developed countries, the Asian tigers and other newly industrialised economies (NIEs) have become the new centres of production for global trade and manufacturing (Dicken, 1998). This has, in turn, increased the level of interconnect- edness between national economies and transnational corporations. Value-added processes are now diffused around the world. A new cellular phone, for instance, may be designed by a team in London, manufactured in northeast China with parts from Canada, the United States and Sweden, and then brought to various national markets by the global marketing and sales headquarters in Helsinki.
The depressed state of the Asian economies, post-financial crisis, will not change this pattern, unless developed countries put in place more protectionist barriers to prevent the dumping of cheap commodities on their markets. Singapore, our bellwether for the knowledge economy, has been at the forefront, developing into a value-added production centre for the rest of the world. The city-state has clearly positioned itself well in the cross-hairs of two important trends: the rise of the knowledge-intensive economy and the thrust toward globalisation.
3. Reperceiving the knowledge economy
As we move further into the knowledge economy, profound dilemmas seem to proliferate in almost every aspect of our lives. This section tries to articulate a few, focusing on issues likely to be of interest to policy makers. At the highest level, what do these dilemmas tell us? They are indicative of a clash between two economic paradigms and values, the collision between the industrial age and the burgeoning knowledge age. These dilemmas also suggest that we need to reper- ceive the future through the lens of knowledge. As Drucker notes, changing our assumptions – within economic policy, educational models, or management – is critically important because, unlike scientific theories or paradigms, these assumptions affect behaviour and human institutions.
The Emerging Global Knowledge Economy
95
Governance dilemmas
Over the past 200 years, the modern organisation – in both private and public sectors – has evolved into a model based on “command and control” hierarchies and the view that the world was relatively certain and predictable. Most organisa- tions today are still structured around and functioning on this familiar logic, mainly because it has worked so well in the past. We metaphorically call these “citadel” organisations. This model was ideal for industrial-based activities where cost effi- ciencies, increased productivity, and economies of scale were of paramount importance. As knowledge becomes a critical resource, however, we will see more organisations based on the “web” metaphor. This model springs from the contrary belief that the world is increasingly complex, full of rapid discontinuous change, and unpredictable. As Figure 3 highlights, the difference in assumptions and behaviours governing the two models are pronounced.
The dilemma here, however, is that the web model will not necessarily replace the citadel organisation. Both models will continue to coexist in different parts of government (e.g. the Department of Defense), in different industries, and – interestingly – often within the same organisation. So, while over the long term the balance may be shifting towards a more web-based structure, the challenge today is in managing the interface between these two very different worlds. Already numerous tensions are emerging.
Dilemmas for governments
Finding the right institutional arrangements to govern an emerging global knowledge economy is creating many problems for governments. Governmental departments are notorious for operating in a citadel-like way. As the knowledge economy penetrates our society more deeply, dilemmas about the very nature of governing will persist. For instance, in an industrial economy, the government was concerned about the allocation of scarce resources, whereas in a knowledge econ- omy the goal will be to foster knowledge-creation and the discovery of new things. In this model, governments are more focused on creating “framework” policies that set the context or “road-map” from which knowledge activities happen (Stevens, 1996). This model is more about nurturing and stimulating such drivers of growth as technological innovation, and being open to new ideas and outside influences. Like corporations, bureaucracies will have to become nimble learning organisations. The character and style of policy making may come to resemble “action-oriented” research, which tests several directions or pilot projects at the same time and then makes modifications and directional decisions through a series of learning loops. This is a more grass-roots, responsive, and experimental way to govern. As Kevin Kelly describes it (1997, 1998), a knowledge economy is about “letting go at the top” and trusting in the power of decentralised and autonomous networks to
The Future of the Global Economy: Towards a Long Boom?
96
generate wealth. The problem with this, however, is that it runs counter to modern notions of the nation-state and sovereignty.
This web-based model is problematic for countries that want to maintain a more closed system with a particular ideology and way of life. Singapore today is a classic example. Until recently, a key part of the country’s success came from its top-down approach to governance. Ensuring stability in a politically charged region has been the first goal of the government. Over the past thirty years, any semblance of serious dissent or opposition has been squashed. Political stability in exchange for political liberty was a tolerable trade-off for most of the local pop- ulation, many of whom were immigrants who had fled “revolutionary regimes”. The government also worked hard to create an environment of economic freedom. By behaving like a corporation actively seeking new markets, Singapore quickly
Figure 3.
Uncertainty/Complexity Web
Relative certainty/Predictability
Command and control hierarchy
Empowered networks Interface
Challenge
Citadel
– Counter-intuitive and scary – Strategic conversation and self-organisation – Knowledge creation, dilemmas, openness – Synthesis of knowledge/decision/action-iterative – Organic, fluid systems (and metaphors) – Comfort with ambiguity/porosity of boundaries – Enquiry; intention/communication; influence; connect – Nimbleness/customisation; creativity/speed – Value webs – Internet – Knowledge Age
– Familiar and intuitive – Planning – Experts, right answers, closure – Separation of knowledge/decision/action-linear – Mechanical systems (and metaphors) – Clarity of structures/roles/etc. – Advocacy; directives; power; control – Massification/standardisation; efficiency – Value chains – Mainframe – Industrial Age
Source: Eamonn Kelly, 1994.
Figure 3.
Uncertainty/Complexity Web
Relative certainty/Predictability
Command and control hierarchy
Empowered networks Interface
Challenge
Citadel
– Counter-intuitive and scary – Strategic conversation and self-organisation – Knowledge creation, dilemmas, openness – Synthesis of knowledge/decision/action-iterative – Organic, fluid systems (and metaphors) – Comfort with ambiguity/porosity of boundaries – Enquiry; intention/communication; influence; connect – Nimbleness/customisation; creativity/speed – Value webs – Internet – Knowledge Age
– Familiar and intuitive – Planning – Experts, right answers, closure – Separation of knowledge/decision/action-linear – Mechanical systems (and metaphors) – Clarity of structures/roles/etc. – Advocacy; directives; power; control – Massification/standardisation; efficiency – Value chains – Mainframe – Industrial Age
Source: Eamonn Kelly, 1994.
Figure 3.
Uncertainty/Complexity Web
Relative certainty/Predictability
Command and control hierarchy
Empowered networks Interface
Challenge
Citadel
– Counter-intuitive and scary – Strategic conversation and self-organisation – Knowledge creation, dilemmas, openness – Synthesis of knowledge/decision/action-iterative – Organic, fluid systems (and metaphors) – Comfort with ambiguity/porosity of boundaries – Enquiry; intention/communication; influence; connect – Nimbleness/customisation; creativity/speed – Value webs – Internet – Knowledge Age
– Familiar and intuitive – Planning – Experts, right answers, closure – Separation of knowledge/decision/action-linear – Mechanical systems (and metaphors) – Clarity of structures/roles/etc. – Advocacy; directives; power; control – Massification/standardisation; efficiency – Value chains – Mainframe – Industrial Age
Source: Eamonn Kelly, 1994.
The Emerging Global Knowledge Economy
97
earned the reputation of being “Singapore Inc.” By placing its best and brightest at the wheels of the government (and earning private sector wage equivalents), Singapore has successfully sustained its competitive advantage over the years.
The problem Singapore is facing today concerns fostering an environment where local innovation and knowledge-creation happen. Singapore’s strategy thus far has relied on the spin-off effects of technology and knowledge from foreign multinationals based on the island (there are about 2 000.) This has not happened to the extent that economic policy makers had initially hoped. Singapore has few global high-technology companies to speak of. The direction, therefore, is clear to the Singaporean leadership: it needs to move up the knowledge value-chain. There are big questions, however, about how to do this in practice without com- promising the current political system. If innovation is key to continued success, how can an orderly society be sustained while allowing for the creative disequilib- rium within which innovation thrives? As Prime Minister Goh describes, “[…] this is the kind of dilemma we are in: How paternalist should we be, and how much room can we give to the people?” (Dolven, 1998). In the past couple of years, Singapore has been experimenting with new approaches to break its culture of conservatism and stimulate freer thinking. A first step has been to revamp its entire educational system, with a great emphasis on “teaching” creativity. But teaching creativity, in characteristic top-down style, may be exactly the problem. Deeply ingrained cultural traits are bound to collide with the imperatives of the knowledge economy, causing both social and economic tensions within that society.
There are other country examples. Recently in China, an Internet entrepre- neur was thrown in jail for sending 30 000 e-mail addresses to another company apparently affiliated with a pro-Chinese democracy organisation. The man claimed he was simply selling addresses for profit, a common practice on the web, but the PRC, ever fearful of outside influences, dismissed this explanation. In the final analysis, however, the networked global knowledge economy is forcing these more closed countries open. Compared to ten years ago, very few economies remain “closed” today, and the trend towards openness is likely to continue.
There are many other dilemmas for governance. For example, immigration and taxation policies will be challenged by this new economy. Global knowledge workers, although not a new phenomenon, will become even more prevalent. The archetype of the future is to be found in high-technology centres such as Silicon Valley that are host to a diverse mix of highly skilled workers from all over the world. A country’s competitive advantage is therefore partially driven by its ability to recruit and attract the best knowledge workers. This thinking is already part of Singapore’s strategy. Also, in Malaysia’s Multimedia Super Corridor project, a key feature is the creation of “Cyber Jaya”, designed with the ideal aesthetics and modern conveniences for the high-tech knowledge worker. This trend has many
The Future of the Global Economy: Towards a Long Boom?
98
implications for the future of nation-states as we know them. A worldwide value-added tax could very well be in the offing.
Dilemmas for organisations
As they are closer to the market, organisations in the private sector have been on the forefront of trying to manage this “web” vs. “citadel” interface. Already we have seen many organisations restructure themselves through a system of empowered networks and decentralised decision-making (Kelly, 1996). This has been a difficult transition for some. Barings Bank, for instance, thrived for the past hundred years using the citadel model. But Barings Securities, a newer, more web-based organisation, quickly found itself out of business because of the mis- guided actions of one of its workers. This example raises a host of dilemmas about knowledge workers. As the story of Barings Securities illustrates, a company’s knowledge workers are often far more powerful than their managers. As owners of their knowledge, they can create great wealth as well as create tremendous sys- tem-wide disruptions, either by leaving or by precipitating a series of disastrous mistakes. How do we make knowledge workers accountable? How do managers “manage” knowledge workers when the latter’s’ motivations are no longer purely based on monetary factors? To recruit and retain top talent, leading companies in Silicon Valley, for instance, go to great pains and cost to build campuses that more resemble hotel resorts than traditional offices. In the quest to create the right envi- ronment for knowledge workers, these offices are complete with health clubs, com- fortable furniture, works of art, and even concierges to help with errands and life’s time-consuming minutiae. For industries steeped in industrial age modus operandi, however, this jump to more holistic thinking about the work environment is a far one indeed. In this context, Drucker argues for a reconceptualisation of what we mean by “management.” Instead of being responsible for the performance of people, the focus should be on “the application and performance of knowledge” (Neef, 1998).
Dilemmas for economic policy
Economic policy makers are faced with a complex of dilemmas. As noted ear- lier, we are in the midst of a transition governed partially by industrial era rules of the game and partially by knowledge era rules. Policy tools that were useful for an industrial era, such as the impact of interest rates on the cost of physical goods, have little relevance to the value of knowledge. Most of the dilemmas arise because we do not have an adequate empirical or theoretical understanding of a knowledge-based economy. In 1998, for example, the US Federal Reserve Board struggled with monetary policy, not knowing if the old rules of thumb linking capacity, employment and prices still applied when dealing with the new eco- nomic realities. Neither research nor extensive debate among the Fed governors
The Emerging Global Knowledge Economy
99
could satisfactorily resolve these questions. Our tools for crafting economic policy are glaringly blunt. As Kevin Kelly describes, “The dials on our economic dash- board have started spinning wildly, blinking and twittering as we head into new territory. It’s possible that the gauges are all broken, but it’s much more likely the world is turning upside down” (Kelly, 1998).
I n t h e f i e l d o f e c o n o m i c s , w h a t i s n o w r e q u i r e d i s t h e a n a l o g u e o f Thomas Kuhn’s notion of scientific paradigm shift, where there is a wholesale change of world view (1962). Based on the new insights from Romer and his fellow growth theorists, it is possible that we are in “phase two” where the weaknesses in conventional thinking become increasingly apparent, anomalies become the rule, and where new theories and methods start surfacing as their replacements.
Measuring economic growth
The quest for economic measures has always been fraught with difficulty. The debate over developing the measure for GDP, for instance, was a long and hard process, earning economists Nobel Prizes. But compared to some of the issues faced today, measuring the value of an economic investment in the industrial economy was fairly straightforward and easy to understand. If an improved, steel-making blast furnace allowed workers to make more steel in less time and use less energy, then the productivity gain was obvious. If the word processing software we are using to produce this article enables the authors to spend more time on creative thought and less time on the mechanics of production, then the improvement is clear but harder to measure. In developing software, creativity may be the most important success factor. How to measure and value that creativ- ity in any meaningful economic sense is conceptually and practically difficult. Iron- ically, since software is considered an intermediate good, all the productivity improvements at Microsoft that produced enormous shareholder value in the past decade do not show up in the GDP. The dilemma here is that we cannot throw the baby out with the bath-water; we need to work within the existing system of mea- sures while devising more appropriate measures for the knowledge economy. This is already an urgent research priority, and some progress has been made. Work commissioned by the United Nations Commission on Science and Technology for Development (UNCSTD) has produced an indicators approach called INEXSK – Infrastructure, Experience, Skills, and Knowledge – to map the strengths and weaknesses for technology and knowledge accumulation in developing nations (Mansell and Wehn, 1998).
The productivity paradox
For most of the OECD nations, the seventies, eighties, and nineties have seen low productivity growth – around 1% – compared to the fifties and sixties when
The Future of the Global Economy: Towards a Long Boom?
100
productivity grew at more than twice that rate. Prosperity is a direct result of increases in productivity. Thus, any expectations about future prosperity are linked to expectations of productivity growth. Many economists argue that the expanding investments in IT have not yielded increases in productivity, and growth is therefore likely to remain low. Even if there appear to be some signals of increasing productivity growth, the debate in the economics profession remains lively.
The challenge we face today is understanding how to harness knowledge as a productive resource. Only recently have we started to shift our attention to knowl- edge, and especially how it interacts and amplifies the other inputs of capital, labour and land. As we have discussed, knowledge is messy and confusing because it is a process, a thing, and now a commodity. Increasing the productivity of knowledge and service-based workers is nonetheless critical to the future of the new economy. Given the nature of knowledge, the precise meaning of “produc- tive” might have to change dramatically for this to happen. For Bill Joy of Sun Microsystems, productivity is not related to efficiency but creativity. The creative process rarely follows notions of efficiency; its goes in fits and starts, and happens through iterations. A software engineer might spend a whole year working on a project, with small marginal improvements in the value they are creating for the company. Then all of a sudden, in just a night’s work, they pay for their annual sal- ary (and then some) by creating a new product idea that has the potential to gen- erate tremendous value. Importantly, this idea was an indirect result of working on the year-long project. Innovations build on other innovations.
Provocatively, Kelly (1998) asserts that productivity “is exactly the wrong thing to care about in the new economy.” As he explains: “The task for each worker in the industrial age was to discover how to do his job better: that’s productivity […] But in the network economy, where machines do most of the inhumane work of manufac- turing, the question for each worker is not ‘How do I do this job right?’ But ‘What is the right job to do?’” This latter question, now decided by managers, is about explo- ration, curiosity, and discovery. Companies and institutions will continue to struggle with these two very different ways of perceiving productivity for some time.
Natural monopolies
As we saw earlier, in a knowledge-based economy, “natural monopolies” arise due to the logic of increasing returns. Today we see Microsoft dominating the operating systems market, and Cisco Systems dominating the network equipment market. This is perceived as a problem because innovation is the engine of growth in a knowledge economy and monopolies tend to inhibit innovation. Kelly (1998) calls this problem “monovation”. Microsoft, the first great monopoly of the knowl- edge economy, is now under extensive legal attack for the success it achieved in capturing the dominant position in the software market. While they may have
The Emerging Global Knowledge Economy
101
engaged in some predatory practices, abusing their market power, they got that power by winning in the market-place. The knowledge economy may continue to generate such natural monopolies. The key role for regulators will be to find a way to encourage “polyvation” in a world of monopolists (Kelly, 1998).
Digging deeper, another dilemma is trusting in Joseph Schumpeter’s idea of “creative destruction” when public perception and our legal system still rest on industrial-age notions of competition. In a knowledge economy, competi- tion within industries will come from new and substituting technologies rather than price. The introduction of these new technologies often destroys the nat- ural monopolies created by increasing returns and opens up the competitive field for new players. For instance, the makers of transistors did not win in the integrated circuit market. Microsoft is quite conscious of these precedents of creative destruction. Its key competitors are not necessarily companies within its own industry, but the inventors of the next “killer app,” whether they be the R&D scientists of Xerox PARC, a professor at MIT, or some talented hackers in a suburban garage.
Balancing innovation and diffusion
The debates over the evolving notion of “intellectual property” are another indicator of how our mental maps are no longer adequate in under- standing the emerging terrain. Innovation is central to the production of knowl- edge. Rewarding innovation by providing economic incentives is essential for inventors to continue to create new ideas, products and services. One of the reasons Silicon Valley has done so well, despite the increasing costs of labour and other inputs, is that lucrative rewards are offered for innovation. The dilemma is how to reward innovators without restricting the dissemination and distribution of knowledge. This boils down to the theoretical economic prob- lem of pricing knowledge. Once created, knowledge can be shared at a mar- ginal cost. We see this in software development: the up-front costs are huge, but once the software is created, additional costs per unit are marginal and decrease over time. In this respect, knowledge has aspects of a public good: it can be shared by all with positive social and economic benefits. Society has tried to solve the reward problem through intellectual property laws. With the easy replicability of knowledge goods such as software, and the use of the web as a distribution channel, the merits of the existing system are being ques- tioned. Academics and policy makers are coming up with hybrid regimes. Chichilnisky (1998), for instance, argues for “compulsory negotiable licences” that enable the unrestricted use of knowledge with the creator getting paid per use of that knowledge. In this model, compensation would directly reflect market demand.
The Future of the Global Economy: Towards a Long Boom?
102
The dilemma of “jobs” versus “work”
Of all the challenges faced by people in developed economies over the past twenty years, perhaps one of the most urgent, divisive, and agonising has related to the erosion of the traditional job. Reflect, for example, upon media coverage of the collapse of any large company, or popular demands for government interven- tions to save failing giants. People do not ask, “What will we do without Acme’s products and services?” They ask, “What will we do without these jobs?”
The job – a relatively static, secure, and lifelong form of work, clearly defin- able and boundaried, requiring a specific and known set of skills – became, very quickly, one of the defining features (and benefits) of the industrial economy. Within only two or three generations, it came to inform and drive our expectations. Governments worldwide still implement policies based on this model, despite the fact that the mass, highly structured, and protected “job” was a brief curiosity in the history of work (see Figure 4).
One hundred and fifty years ago, the vast majority of people (even in the more developed economies) were engaged in agricultural work or domestic ser- vice – both of which were flexible, ever-changing and often “portfolio” in nature, certainly not like jobs as we came to know them. Even those involved in physical
Figure 4. Work, wealth, jobs... coming full circle
2000: “Virtual workers”
Source: Eamonn Kelly.
1850: “Craft Workers”
1950: “Factory”
Figure 4. Work, wealth, jobs... coming full circle
2000: “Virtual workers”
Source: Eamonn Kelly.
1850: “Craft Workers”
1950: “Factory”
Figure 4. Work, wealth, jobs... coming full circle
2000: “Virtual workers”
Source: Eamonn Kelly.
1850: “Craft Workers”
1950: “Factory”
The Emerging Global Knowledge Economy
103
production, especially craft workers, were working individually or in small groups in flexible and fluid ways, usually from home. Indeed, the webs of craft workers and their various market-places, generally co-ordinated by a “factor”, bore some resemblance to the virtual organisations of today. The industrial age encouraged the factor to centralise production in a factory and routinise work into jobs. Today the centrifugal forces of the knowledge economy and information networks are driving many organisations back in the opposite direction.
Today, therefore, people tend to change their employers more frequently, or work for several employers simultaneously, or work as independent contractors, or work flexibly from home. We often have to learn new skills, change career tracks sev- eral times, and pursue new opportunities in growth areas of the economy that we had never even imagined. In short, people are having to adapt to the “post-job” economy, and concentrate instead on ever-evolving and rather fluid work opportunities and challenges, not unlike their forebears four or five generations ago.
For policy makers everywhere, this transition point generates a significant dilemma as to whether and when to revise long-standing policies based on the public’s expectations of work in the form of “the job”. For example:
– Today many governments – national, regional, and local – are under some pressure to support or initiate job creation or programmes, often predi- cated on historic notions of work.
– Often, attempts to attract foreign direct (or even out-of-state) investment are driven by policies related to the volume of jobs attracted, rather than broader measures of work, value, and economic activity.
– In many countries, pension planning and other benefit arrangements assume long-term, steady jobs as the normal form of economic engagement for individuals.
– Just as the physiocrats once argued that all true wealth creation was sourced only in agriculture, economic policies appear to value manufacturing activ- ity ahead of services – as if wealth could only be created by the making of things. This may in part be driven by, as well as reinforce, a rather nostalgic focus on the traditional job as the desired form of work.
Over time, even our approaches to spatial planning will be seriously impacted by the new geography of the knowledge-intensive, work-rather-than-job society unfolding today.
The jobs-versus-work dilemma is deep, and it will take time for public policy making and public opinion to come into alignment with new economic and social realities. However, in the knowledge society there is real potential for new, rewarding, and ever-changing types of work. Those who linger too long with an outmoded set of expectations – related to the relatively short-lived era of the
The Future of the Global Economy: Towards a Long Boom?
104
static and permanent job – will suffer more than those who move fast to embrace new work opportunities. Public policy makers may find it their duty not only to revise their own policies as quickly as possible, but also to help shift public atti- tudes and expectations.
Dilemmas for education
If our economy is in fact shifting towards knowledge-intensive activities, edu- cation will have to move to society’s centre stage. Already, our educational institu- tions are feeling pressures to reform and adapt. The dilemma, however, is how to actually achieve this without penalising the students and people who do not have the education or socio-economic means to participate. The central issue in the competitive race ahead is how to create the right education for the new economy while improving access for more (all) people. Singapore amply demonstrates the value of investing in the quality of the labour force. In addition to the basic issues of cost and access, questions regarding the purpose of education will also arise. How do we balance the goals of economic gain and human development? Is human development also a goal? If creativity and innovation are essential success factors, can you educate for these abilities?
These dilemmas are highlighted in debates on educational reform. For exam- ple, in the United States there is a push toward making educational standards more rigorous. On the one hand, we need some benchmarks to improve the qual- ity of education, while on the other we know that what gets measured and rewarded in schools is the only thing that receives attention from students. How- ever, these measures often fail to capture what is truly important for the knowl- edge economy – intangible skills, the ability to think independently, and creative instincts which in themselves often defy measurement. Meanwhile, in North America (and elsewhere) the private sector continues to be disenchanted with the types of skills and abilities the secondary and post-secondary education systems seem to foster. This is why corporations are increasingly entering the training and education business so as to ensure they get a skilled workforce trained to meet to their needs. Of course, this in turn raises a host of other dilemmas about the ability of corporations to deliver a well-balanced and unbiased education.
Dilemmas for world development
Many of the key problems confronting world development are rooted in a lack of knowledge. Diarrhoea, for instance, is a simple ailment, yet it kills millions of children in developing countries because their parents do not know how to treat them. Many of the diseases in these countries are brought about by people drink- ing contaminated water supplies, yet they continue to drink and wash from them because they do not know any better. Population growth also continues to be a
The Emerging Global Knowledge Economy
105
problem even though we learned in the past twenty years that it can be significantly curbed if women are educated. So in this sense, the world has always been divided between the “knowledge-rich” developed world and the “knowledge-poor” devel- oping world. However, with the dynamic of increasing returns driving much of the knowledge economy, this gap is likely to get wider. Thus the dilemmas for global institutions relate back to creating the right incentives for continued innovation while distributing knowledge to the “knowledge-poor” areas of the globe.
Environmental dilemmas
A sign of the clash between economic paradigms is that we have yet to find a satisfactory solution to the “tragedy of commons” dilemma. Meanwhile, the extraordinary success of worldwide industrialisation is now turning on itself and hurting the earth. With the continued erosion of our planet’s biodiversity and signs of rapid climate change, we are quickly approaching a critical thresh- old where long-standing and irreversible damage is being done. And despite the progress of new regimes and agreements such as those made at Rio and Kyoto, our attempts to create the right incentives for sustainable development have been only partially successful. Pricing public goods, as we have seen with the pricing of knowledge, is quite problematic within current intellectual property regimes.
These shortcomings have been driven by the structural underpinning of the industrial-age paradigm. Economic growth in the industrial economy was driven by the exploitation of resources and the consumption of fossil fuels. To use Romer’s (1997) analogy, growth was achieved by cranking up the volume of cook- ing, and doing more with more. In our debates aimed at finding solutions to environmental problems, the underlying dilemma concerns balancing long-term sustainability with the continued need to exploit resources for industrial activ- ity. But as we move away from industrial-based activities toward a knowledge economy, there is an opportunity to reperceive this dilemma. For instance, in theory, the economics of ideas is inherently less resource-intensive. If the right incentives and measures were created – such as a new regime of intellectual property rights and pricing schemes – that would initiate a fundamental shift in the way people view “environmental assets”. Under such a scheme, an Amazon rain forest would have far more economic value in terms of future discoveries, biotechnology product ideas, patents, and even insight into how complex adap- tive systems operate than it would as lumber. Until such a recalculation can occur, many of our pressing environmental problems will remain burdened with that principal dilemma. What Romer calls for is another creation of a “meta-idea” that could radically transform the way an economic system operates and yet increase the flow of ideas and knowledge. The British invention of the patent system is one example. It is time to find others.
The Future of the Global Economy: Towards a Long Boom?
106
Ethical dilemmas
Ethical dilemmas are not new; they have provoked philosophers and gov- ernments throughout history. But we are in an historical moment during which they are becoming particularly acute. As social, technological and commercial boundaries blur, new ethical challenges present themselves that have direct or indirect implications for economic policy. In Europe, for instance, with the his- torical memory of Nazi eugenics experiments during the Second World War, the idea of patenting human recombinant DNA met with considerable resistance. This in turn had serious consequences for the future success of European bio- technology companies. Another example concerns the regulation of unsavoury content on the Internet, such as pornography and the predatory practices of paedophiles. How should we regulate this? Or should we? Many people argue that the free and unfettered nature of the web drives its vitality and is the source for creative expression.
These ethical dilemmas will proliferate in the near future. Already, develop- ments in bioscience are reaching a point where we will be able to “design” our children and create the first “immortals” by extending life by a factor of 2 or 3. As we create tools that have the potential to fundamentally enrich and transform our existence, we simultaneously open a Pandora’s Box of ethical issues which could serve to seriously damage social cohesion and drive deep divisions within soci- ety. In a negative scenario, for instance, one can easily imagine the Religious Right in the United States or the Green lobby in Europe taking up some of these emerg- ing ethical issues, and driving public opinion away from acceptance and applica- tion of these important technologies and discoveries in bioscience.
Indeed, one of the most important roles for public policy makers in the first years of the next millennium will be to prevent such a scenario. This might involve two things: first, anticipating where technology and commerce may generate ethi- cal challenges; and second, creating the conditions for open and inclusive civic dialogue from which a more complex value system might evolve.
4. Scenarios for the future of the global knowledge economy
The way we use and distribute knowledge casts very long shadows on human societies.
Graciela Chichlnisky (1997)
Assuming that we are perceiving the new economic realities accurately and that a knowledge economy is emerging, that economy’s future could unfold in two distinct ways. The fundamental uncertainty at the heart of the discussion is the degree to which the transformation will be socially inclusive. Will an ever-growing number of people in the near future share in this economic
The Emerging Global Knowledge Economy
107
development and increasing prosperity? Or will the benefits flow mainly to a fairly small elite, while the great majority of people lose ground by almost every measure?
Most of the darker visions of the knowledge economy share common fears…
High friction world
This is a winner-takes-all economy where a small knowledge elite captures most of the economic value. The economic structure rewards a few and leaves the great majority behind. The resulting social friction of a two-tier society consisting of “knows” and “know-nots” consumes much of the economy’s potential in a vicious circle.
The fruits of innovation drive economic growth in some parts of the world, cre- ating local islands of prosperity. Highly educated knowledge workers do very well, but a modest education produces little economic benefit. Low wages characterise most service and manufacturing work. Overall, organisations evolve very slowly and remain mainly traditional in form. The “fast” gradually pull away from the “slow”. Highly divergent outcomes result as a few countries do well behind high-security shields and others fall further behind. Intellectual protectionism is rife and the free flow of ideas is highly constrained by both those who want to pro- tect the value of their intellectual property and those who want to prevent the informational “pollution” of their populations.
But there is another possibility…
The knowledge take-off
After a fairly brief transition, the emerging economic structure allows value to be added and captured by people with a wide range of skill levels and intel- lectual capabilities. Eventually most people benefit economically from the evolving knowledge economy. The computer-enhanced deliveryman of today is an early example.
Two major forces drive the successful knowledge take-off: the continued development of human capability and massive expansion of the technological infrastructure. More and more public and private resources are devoted to the two priorities of education and information infrastructure. Public education and busi- ness training become universally available. Public policies encourage investments in R&D. In addition, government and private sector expenditures create new capacity which leads to abundant, cheap bandwidth, inexpensive and easy-to-use devices, and an information-rich web.
This is a world characterised by open flows of information and rapid, nearly universal innovation. It is a high-speed economy of change. A side benefit is
The Future of the Global Economy: Towards a Long Boom?
108
reduced environmental impacts of growth as value is added by knowledge-intensive rather than resource-intensive activities. Innovators are disproportionately rewarded. Network organisations become common and facilitate diverse new forms of eco- nomic participation.
5. Conclusion and implications for the OECD
The movement toward an economy and society where knowledge is highly valued is more or less inevitable. There are, however, important uncertainties about the pace, distribution and consequences of this transformation. No benefits come without a cost. An assessment of the policy implications will require an understanding of both the benefits (and how to increase their likelihood and per- vasiveness) and the downsides (and how to minimise their likelihood and impact).
The experience of Singapore over the last thirty years is a very clear demon- stration of the ability to harness effectively the power of knowledge and create enormous economic potential. Knowledge economies have the potential to grow ever richer, and they are largely unconstrained by the limits of physical resources and environmental carrying capacity. Indeed, as the knowledge component of economic output grows, the environmental impact per unit of economic activity is likely to fall. The result is, at least in theory, greater wealth on the road to a more ecologically sustainable economy.
But often such transitions are accompanied by the loss of huge numbers of jobs. With retraining, many of these displaced workers may find new employ- ment opportunities and in some cases even better jobs. However, many will struggle with unemployment, falling job levels and reduced incomes. Others may find the insecurity of the new dynamic job market very stressful: while opportunities may be abundant, the competition may be equally plentiful. It is also possible that it will be a very long time before the technology of the knowledge economy will advance sufficiently to give a relatively unskilled worker the ability to earn a middle class income in the way that industrial tech- nology did. Some people may be left permanently behind, with very limited prospects.
The spread of useful knowledge is the key to the widening circle of grow- ing economic potential. This implies that nations need to be fairly transparent to information flows. However, a consequence of transparency is the near impossibility of control. Thus, with the useful knowledge comes unwanted information, ranging from foreign entertainment to pornography. Open flows of information in the form of telecommunication networks, freedom of the press and the free flow of people are essential to encourage the continuing innova- tion that is key to competition in the knowledge economy. The increasing integration
The Emerging Global Knowledge Economy
109
of the world, both physical and through information, also leads to another widespread concern: the potential for cultural homogenisation. For example, the ubiquity of English as the language of the knowledge economy is a power- ful force. The impact of American television and movies is felt all over the planet.
Many nations will find such openness a threat to the current order. But the frictions created by this transition to a knowledge economy might be even more fundamental. China, for example, has millions of people out on the leading edge of the knowledge economy and hundreds of millions living in subsistence agricul- ture. The economic and social tensions of such vast difference in ways of life will be very difficult to manage. China will also confront frictions created by its differ- ent approaches from the west to some aspects of the knowledge economy, such as intellectual property laws.
Thus a core policy dilemma is the tension between the need for openness and the need for control. Singapore finds this a difficult dilemma. Also, many think that the USSR failed to handle this in part because they tried to control too much and so cut themselves off from external inputs. Maintaining a balance between the two extremes can produce a very dynamic society like the United States, but one whose high mobility creates great social tensions as winners accelerate away from the losers. Getting this balance right will be one of the keys to policies that sustain growth.
Policy makers in both the public and private sectors are also struggling with another aspect of the transition. What are the appropriate metrics of a knowl- edge economy? How, for example, do we measure the productivity of a knowl- edge worker? Automobiles made per hour made sense in the industrial age, while the notion of ideas per hour in the knowledge economy is obviously silly. A major and fairly urgent intellectual challenge is to develop new models and measures.
These issues translate into critical policy questions. For example: How will governments deal with taxation in an economy driven by electronic commerce? What is the right level of regulation, especially with regard to such key systems as banking and finance? Does government need to subsidise access to new informa- tion networks as every citizen’s basic right? How do you help those who are get- ting left behind? Some of the traditional activities of government, such as the development of infrastructure and the provision of education, will become increasingly important in a knowledge economy.
The private sector obviously has critical roles to play in innovation, invest- ment in new capabilities, provision of employment and education for its work- force. As the great engine of growth, the private sector can contribute to
The Future of the Global Economy: Towards a Long Boom?
110
reweaving the fabric of social equity by making technology easier to use for a wider range of skill sets.
The policy issues and dilemmas created by this transition are mainly about increasing the likelihood and distribution of the economic benefits and mitigating the potentially damaging social consequences. The transition to a knowledge soci- ety and an economy driven by knowledge creates great challenges and tensions. In the end, a key question remains: how to increase and liberate the potential of the winners and how best to assist the losers.
The Emerging Global Knowledge Economy
111
Bibliography
ALLEE, Verna. (1997), The Knowledge Evolution: Expanding Organizational Intelligence. Boston: Butterworth-Heinemann.
ALLIANCE FOR CONVERGING TECHNOLOGIES (1997), Strength in Numbers: How Cyber-commerce Communities Create Value in the Digital Economy. Toronto: Alliance for Converging Technologies.
ARTHUR, W. Brian (1996), “Increasing Returns and the New World of Business”, Harvard Business Review, July-August, pp. 100-109.
BRAUDEL, Fernand (1992), Civilization and Capitalism, 15th-18th Century, translated by Siân Reynolds. Berkeley: University of California Press.
BOYER, Nicole-Anne (1996), “Working Paper on the Growth of Smart Cities.” Singapore: International Development and Research Council.
CHICHILNISKY, Graciela (1998), “The Knowledge Revolution”, The Journal of International Trade & Economic Development. 7, No. 1:39-54.
CHICHILNISKY, Graciela (1997), “The Knowledge Revolution: Its Impact on Consumption Patterns and Resource Use”. Human Development Report 1998: UNDP Development Program. Draft for discussion only.
CONCEIÇÃO, P. et al. (1998), “The Emerging Importance of Knowledge for Development: Implications for Technology and Policy and Innovation”, Technological Forecasting and Social Change, 58:181-202.
DAVENPORT, Thomas and Laurence PRUSAK (1998), Working Knowledge: How Organizations Manage What They Know. Boston, Mass.: Harvard Business School Press.
DAVIS, Stan and Christopher MEYER (1998), Blur: The Speed of Change in a Connected Economy, Ernst and Young Center for Business Innovation.
De GEUS, Arie (1997), The Living Company. Boston: Harvard Business School Press.
The Future of the Global Economy: Towards a Long Boom?
112
DICKEN, Peter (1998), Global Shift: Transforming the World Economy. 3d ed. New York and London: The Guildford Press.
DOLVEN, Ben (1998), “Let’s All Be Creative”, Far Eastern Economic Review, 24 December.
DRUCKER, Peter (1998), “Management’s New Paradigms”, Forbes, 5 October, pp. 152-176.
DRUCKER, Peter, P. and E. DYSON, C. HANDY, P. SAFFO and P. SENGE (1997) “Looking Ahead: Implications of the Present”, Harvard Business Review. September-October, 18-32.
DRUCKER, Peter (1993), The Post-Capitalist Society. New York: HarperBusiness.
The Economist (1997), “One World?” 18 October, pp. 79-80.
The Economist (1997), “The Survey of the World Economy”, 20 September.
HALAL, William et al. (1998), “The George Washington University Forecast of Emerging Technologies: A Continuous Assessment of the Technology Revolution”, Technological Forecasting and Social Change, 59:89-110.
HEILBRONER, Robert (1994), 21st Century Capitalism. Toronto: CBC Massy Lectures Series.
JARBOE, K.P. and Robert D. ATKINSON (1998), The Case for Technology in the Knowledge Economy: R&D, Economic Growth, and the Role of Government. Washington DC: Progressive Policy Institute.
KELLY, Eamonn (1996), Presentation on “The Knowledge Economy”. Emeryville, California: Global Business Network.
KELLY, Kevin (1998), New Rules for the New Economy: 10 Radical Strategies for A Connected World. New York: Viking.
KELLY, Kevin (1997), “New Rules for the New Economy”, Wired 5, No. 9.
KUHN, Thomas [1962 and 1996 (3rd Edition)], The Structure of Scientific Revolutions. Chicago: University of Chicago Press.
KURTZMAN, Joel (1997), “An Interview with Paul Romer”, Strategy & Business, First quarter. Booz-Allen & Hamilton. Reprinted from Paul Romer’s home page (www.stanford.edu/~promer).
MADDISON, Angus (1991), Dynamic Forces in Capitalist Development: A Long-Run Comparative View. Oxford: Oxford University Press.
MANSELL, Robin and Uta WEHN (1998), Knowledge Societies: Information Technology for Sustainable Development. Oxford and New York: Oxford University Press.
NEEF, Dale, ed. (1998), The Knowledge Economy. Boston: Butterworth-Heinemann.
The Emerging Global Knowledge Economy
113
NONAKA, Ikujiro and Hirotaka TAKEUCHI (1995), The Knowledge-Creating Company: How Japanese Companies Create the Dynamics of Innovation. Oxford and New York: Oxford University Press.
PEREZ, C. (1985) “Microelectronics, Long Waves and World Structural Change”, World Development. 13:441-463.
ROMER, Paul M. (1997), personal communication.
ROMER, Paul M. (1995) “Beyond the Knowledge Worker”, Worldlink, 56-60.
ROMER, Paul M. (1994), “Beyond Classical and Keynesian Macroeconomic Policy”, Policy Options, July-August.
ROMER, Paul M. (1993), “Economic Growth” in David R. Henderson (ed.), The Fortune Encyclopedia of Economics. New York: Time Warner Books.
ROMER, Paul M. (1990), “Endogenous Technological Change”, Journal of Political Economy, 98, No. 5:S71-S107.
ROSELL, Steven et al. (1995), Changing Maps: Governing in a World of Rapid Change. Ottawa: Carleton University Press.
SAXENIAN, AnnaLee (1994) Regional Advantage: Culture and Competition in Silicon Valley and Route 128. Cambridge, Mass.: Harvard University Press.
SHUMPETER, J.A. (1952), Capitalism, Socialism, and Democracy. 4th ed. London: George Allen & Unwin.
SOLOW, Robert (1957), “Technical Change and the Aggregate Production Function”, Review of Economics and Statistics, 39:312-320.
STEVENS, Candice (1996), “The Knowledge-Driven Economy”, The OECD Observer, No. 200:6-10.
TAPSCOTT, Don (1995), The Digital Economy: Promise and Peril in the Age of Networked Intelligence. New York and Toronto: McGraw-Hill.
VARIAN, Hal and Carl SHAPIRO (1999), Information Rules: A Strategic Guide to the Network Economy. Boston, Mass.: Harvard Business School Press.
WEBBER, Steve (1999), Informal Conversation. Global Business Network.
WEBER, Alan M. (1993), "What's So New About the New Economy?", Harvard Business Review, January/February, 27.
115
4
4Towards Global Competition: Catalysts and Constraints 8by
9Horst Siebert and Henning Klodt Kiel Institute of World Economics, Germany
1. Introduction
When the turn of a century approaches, perceptions of the future tend to become gloomy. As we enter the 21st, one of the gloomy catchwords is “globalisa- tion”, which is associated with concerns and sorrows about the economic pros- pects of highly developed countries. It is feared that they will not be able to withstand the storms of a global competition that will eventually destroy the wage gap against poor countries and will raze social standards to the ground all around the globe. One World, Ready or Not is the title of a bestselling book (Greider, 1997), and many observers are concerned that people are indeed not yet ready.
The basic message of this chapter is that the public debate strongly overrates the risks of globalisation and almost completely ignores its opportunities. Most of the concerns raised today against globalisation could similarly have been raised against the expansion of international trade in the 1960s. Import competition in those days was also threatening domestic jobs, and put labour-intensive and stan- dardised industries in advanced economies under strain. In retrospect, however, the sixties seem like a “Golden Age”, when an increased international division of labour opened up rich export opportunities, created numerous new jobs, and fos- tered economic growth and welfare in all open, internationally oriented econo- mies. There is good reason to believe that the current wave of globalisation will also be regarded as a tide of rich opportunities which will eventually lift all boats.
The structure of the chapter is as follows. Section 2 analyses the concept of globalisation within the context of international economics theory; Section 3 examines the driving forces for a more integrated world economy; Section 4 dis- cusses the constraints involved; and Section 5 concludes with a look at the future of globalisation and the potential gains.
The Future of the Global Economy: Towards a Long Boom?
116
2. Visions of an integrated world economy
No doubt, globalisation is an increasingly fashionable term. A person researching the number of publications that contain the word in the title at the library of the Kiel Institute of World Economics will find not more than 36 entries for the year 1990. For the year 1997, the number of entries increases to 212, equivalent to a growth rate of 30% per year.
There is still no unequivocal definition of what globalisation means and what it does not mean. For some observers, it describes the tremendous increase of trade and capital flows in the recent past; for others it is a catchword for the ubiq- uitous availability of all kinds of information, for the emergence of worldwide pro- duction networks, or for the assimilation of lifestyles in the global village. All these perceptions share the notion that globalisation raises the level of integration in the world economy.
As the suffix “isation” indicates, globalisation describes a process, not a state of affairs. From an economist’s point of view, the word can be defined as the pro- cess of converting separate national economies into an integrated world economy. This conversion is basically achieved through three channels:
– International trade, which is still the basic and most important link between national economies.
– International factor movements, which are mainly confined to capital flows; the international mobility of workers is still rather low.
– The international diffusion of technology, which is only partly a by-product of international flows of goods and capital; increasingly, it is based on intangible cross-border flows of information.
Figure 1 illustrates the main features of a world economy where national bor- ders have lost their significance and global competition is prevalent. It is a simple model with two countries, two production factors (capital and labour), and an independent government in each country. Production factors are employed by firms which compete with each other in the domestic market and with foreign firms in world markets.
The immediate result of globalisation is an increase in competitive pressures in virtually all areas of the economy. Product competition can be expected to elimi- nate substantial differences in product prices between countries. Standard mod- els of trade theory tell us that this equalisation of product prices will also equalise real wages and interest rates. However, this factor price equalisation theorem rests upon a number of restrictive assumptions that are not very realistic. For instance, it assumes the complete absence of any transport costs or other types of trade barriers. And, more importantly, it postulates identical technologies all over the world.1 In the real world, where shipping goods across long distances is costly,
Towards Global Competition: Catalysts and Constraints
117
where some countries are technologically ahead of others, and where labour rep- resents different levels of human capital, it can be expected that international trade – while it might tend to level factor prices – will not succeed in completely eliminating any international factor price differentials.
Those that remain are the stimulus for international factor flows which give rise to factor price competition. If capital is free to move across national borders, inter- est rates will differ between locations only with respect to different risk premiums, not with respect to the capital endowment of countries. Real wages in rich coun- tries will no longer benefit from a higher amounts of physical capital, because cap- ital will flow to those places where the rate of return is highest. If capital mobility is supplemented by unrestrained international flows of technology, factor price equalisation will also apply to real wage levels – even if international mobility of labour is low. In these conditions, international wage differentials will only be sus- tainable if they reflect corresponding differences in the qualification of the labour force or in the general economic conditions of the respective countries.
In centuries past, when governments were small and nature was a dominant production factor, general economic conditions depended mainly on geographical features, i.e. on climate, the quality of soil, or the availability of ports and naviga- ble rivers. Nowadays, the economic capacity of locations depends much more on institutional settings, which are largely under the influence of governments.
Government
Figure 1. Basic elements of global competition
FIRMS
Government
FIRMS
Labour Capital Labour Capital
Institutional competition
Product competition
Factor price competition
H O M E
F O R E I G N
Government
Figure 1. Basic elements of global competition
FIRMS
Government
FIRMS
Labour Capital Labour Capital
Institutional competition
Product competition
Factor price competition
H O M E
F O R E I G N
Government
Figure 1. Basic elements of global competition
FIRMS
Government
FIRMS
Labour Capital Labour Capital
Institutional competition
Product competition
Factor price competition
H O M E
F O R E I G N
The Future of the Global Economy: Towards a Long Boom?
118
Among these settings are the quality of communication infrastructure, the level and structure of taxes, the soundness of legal protection, the intensity of social conflicts, and the stability and convertibility of the national currency. If countries want to attract internationally mobile production factors, their governments have to engage in institutional competition with foreign governments. In a perfectly integrated world economy, where distance costs have completely vanished, the relative wage level of regions depends to a large extent upon the relative performance of governments in institutional competition.
The major result of globalisation is the extension of competition from the level of firms to the level of governments. The position of the latter in global com- petition can be compared to that of hotel landlords who want to attract potential guests. If the service offered is poor or too expensive, the travellers will just move on and the landlord will have to improve the service or lower the price. Similarly, internationally mobile investors will chose locations with either low costs and poor infrastructure or with high costs and excellent infrastructure – but they will surely avoid locations with high costs and poor infrastructure. This type of competition, labelled as “institutional competition” in Figure 1, can also be referred to as “loca- tional competition” (a translation, far from perfect but the best available, of the German term Standortwettbewerb), because it is concerned with the relative attractiveness of business locations for internationally mobile factors.
Generally speaking, it can be expected that all types of global competi- tion will increase aggregate welfare: product competition will enrich consump- t i o n o p p o r t u n i t i e s a n d e r a s e p r o d u c t i o n i n e f f i c i e n c i e s ; f a c t o r p r i c e competition will improve capacity utilisation and help avoid allocative distor- tions; and institutional competition will eliminate excessive and inefficient government activities. A truly integrated world economy holds the promise of substantial “gains from globalisation”, which basically result from the deepen- ing of the international division of labour. Hence, the pessimistic perceptions of globalisation held by the public are not shared by the internationally oriented economists.
3. Catalysts of globalisation
Globalisation is an ongoing process which continues to gain momentum. A whole string of tendencies can be observed in the world economy, which together have the effect of reducing market segmentations and increasing inter- dependence of world markets. Some of these factors have been in play for decades, others are fairly new, but almost all of them will continue to exert an influence in the future. This section examines those factors which appear to be the most important.
Towards Global Competition: Catalysts and Constraints
119
Reduced transport and communication costs
Transport and communication costs are falling significantly – a phenomenon as true for the traditional costs of covering distances by sea and air (reduced to approximately one-fifth since the twenties and thirties, respectively) as for the costs of telecommunication. For instance, a three-minute telephone call from New York to London in 1930 cost $250 (in constant prices from 1990), in 1950 $50, and in 1990 $3.32; the price for processing information fell from $1 per instruction per second in 1975 to one cent in 1994 (World Bank, 1995, p. 45). The costs of using satellites have also fallen dramatically. In the future, transport costs may continue to fall when technological progress is sufficiently strong to overcome environmen- tal costs incurred by transport activities.
This decline in costs is illustrated in Figure 2. The “death of distance” (Cairncross, 1997) facilitates the establishment and monitoring of international production networks, enlarges trading areas, and enables firms to exploit interna- tional cost differentials through the fragmentation and relocation of production and global sourcing.
Information technology is a veritable revolution. In 1998, 180 million Internet stations made up a worldwide information network; the number will be half a
1920 1930 1940 1950 1960 1970 1980 1990
100
80
60
40
20
0
100
80
60
40
20
0
Source: World Bank, 1995, p. 51.
Figure 2. Costs of transport and communication
Average charge for ship freight and harbour fees
Cost index Cost index
Costs of a 3-minute telephone call from New York to London
Charges for using satellites
Average air transport revenues per mile and passenger
1920 1930 1940 1950 1960 1970 1980 1990
100
80
60
40
20
0
100
80
60
40
20
0
Source: World Bank, 1995, p. 51.
Figure 2. Costs of transport and communication
Average charge for ship freight and harbour fees
Cost index Cost index
Costs of a 3-minute telephone call from New York to London
Charges for using satellites
Average air transport revenues per mile and passenger
1920 1930 1940 1950 1960 1970 1980 1990
100
80
60
40
20
0
100
80
60
40
20
0
Source: World Bank, 1995, p. 51.
Figure 2. Costs of transport and communication
Average charge for ship freight and harbour fees
Cost index Cost index
Costs of a 3-minute telephone call from New York to London
Charges for using satellites
Average air transport revenues per mile and passenger
The Future of the Global Economy: Towards a Long Boom?
120
billion in 2002. Information costs are likely to fall even further in the future, because the microelectronics revolution is far from over. Physical transport costs can also be expected to decline, although limited fuel supply and/or "green taxes" to protect the environment may counteract the technology-driven trend.
At present, integration into the global network of information is much easier for rich countries than for poor ones. The availability of information and communi- cation equipment is significantly greater in countries such as the United States or Singapore than in countries such as China or India (Table 1). As the relative prices of these appliances are declining, however, it can be expected that the connection of poor countries to the world pool of information will improve considerably in the near future. Hence, an important aspect of globalisation in the near future will be the eventual inclusion of virtually every region of the world into the global village.
Dismantled trade barriers
National economic policies have changed, and adopted an approach of greater openness. The radical change in the former centrally planned economies of Central and Eastern Europe and the opening of China have brought important regions of the world within the scope of the international division of labour. If India is also taken into account, it is clear that an historical process is taking place, one in which more than 40% of the world’s population is becoming integrated into the world economy. This implies that the limitation of the size of markets, formerly a potential barrier to extending the international division of labour, will be a less important factor in the future.
Regional efforts towards integration, for example in Europe, and the strength- ening of multilateral trade agreements have also eliminated impediments to trade. Most developing and newly industrialising countries have changed their strategies for development and foreign trade, and are now much more open.
Table 1. Information and communication equipment per 100 inhabitants in countries grouped by income, 1995
GNP per capita PCs Telephones Television sets
Low: < $726 0.3 2.0 12.9 Middle: $726-$2895 1.1 9.1 20.5 Upper: $2896-$8955 3.3 14.5 26.3 High: > $8955 20.5 53.2 61.2
Source: Cairncross (1997, p. 22).
Towards Global Competition: Catalysts and Constraints
121
Forty-four countries have joined GATT/WTO between 1986 and 1998. As of 1998, 31 countries want to become members of the WTO, a clear sign of a forceful pro- cess of liberalisation in the world economy. Finally, the reduction of political ten- sions (e.g. cold war, apartheid in South Africa) has provided a better political environment for openness.
National and regional liberalisation policies are supported and comple- mented by international negotiations on trade and investment barriers in the GATT/WTO framework. The significance of declining trade barriers is illustrated in Figure 3, which describes the development of average tariff rates for the United States since the 1940s. By and large, the tariff rates of other industrial countries are at a similar level, whereas those of developing countries are in general higher. Over time, however, the latter have also substantially declined.
Of course, the international trading system is still far from free trade in several areas, notably agriculture, textiles and clothing. And severe problems will have to be solved before international trade in services will really become free. Nevertheless, there should be no doubt that trade liberalisation has significantly contributed to the integration of the world economy over the past decades. At present, several far-reaching agreements from the Uruguay Round, for instance on trade-related intel- lectual property rights (TRIPS), trade-related investment measures (TRIMS), trade in
0 10 20 30 40 50 60 70 80 90 100
Source: Bhagwati (1989); own calculations.
Pre-Geneva
Geneva (1947)
Annecy (1949)
Torquay (1951)
Geneva (1956)
Dillon (1960-61)
Kennedy (1964-67)
Tokyo (1973-79)
Uruguay (1986-94)
Figure 3. Weighted average US tariff rate after GATT Rounds Pre-Geneva = 100
0 10 20 30 40 50 60 70 80 90 100
Source: Bhagwati (1989); own calculations.
Pre-Geneva
Geneva (1947)
Annecy (1949)
Torquay (1951)
Geneva (1956)
Dillon (1960-61)
Kennedy (1964-67)
Tokyo (1973-79)
Uruguay (1986-94)
Figure 3. Weighted average US tariff rate after GATT Rounds Pre-Geneva = 100
0 10 20 30 40 50 60 70 80 90 100
Source: Bhagwati (1989); own calculations.
Pre-Geneva
Geneva (1947)
Annecy (1949)
Torquay (1951)
Geneva (1956)
Dillon (1960-61)
Kennedy (1964-67)
Tokyo (1973-79)
Uruguay (1986-94)
Figure 3. Weighted average US tariff rate after GATT Rounds Pre-Geneva = 100
The Future of the Global Economy: Towards a Long Boom?
122
services (GATS) and improved dispute settlement procedures, are being imple- mented and brought into effect. Furthermore, initial negotiations are commenced for establishing a new GATT/WTO round (the Clinton Round?). Hence, global economic integration will continue to benefit from multilateral liberalisation approaches in the future. Apart from measures which explicitly restrict trade, national regulations are increasingly being reviewed. They are continuously adjusted in the process of institu- tional competition, which also results in less impediments.
Expansion of trade and foreign direct investment
Globalisation is not a new phenomenon, but there are signs that indicate the process is accelerating. A rather simple although highly instructive indicator of glo- balisation is provided by the growth rates of world output and world trade. Gener- ally, the volume of international trade is growing twice as fast as the volume of world output. This development suggests that the international division of labour is deepening and the world economy is becoming increasingly integrated (Figure 4). The gap between export growth and GDP growth has further widened in the recent past – yet another indication of this acceleration.
Contrary to popular belief, world economic integration is not accompanied by a replacement of manufactures by services in international trade. The share of
800
1973
600
400
200
0
800
600
400
200
0
74 75 76 77 78 79 80 81 82 83 84 85 86 87 88 89 90 91 92 93 94
Foreign direct investment
Source: Siebert (1997b, p. 15).
Figure 4. World output, exports, and foreign direct investment 1973 = 100
Exports
Output
800
1973
600
400
200
0
800
600
400
200
0
74 75 76 77 78 79 80 81 82 83 84 85 86 87 88 89 90 91 92 93 94
Foreign direct investment
Source: Siebert (1997b, p. 15).
Figure 4. World output, exports, and foreign direct investment 1973 = 100
Exports
Output
800
1973
600
400
200
0
800
600
400
200
0
74 75 76 77 78 79 80 81 82 83 84 85 86 87 88 89 90 91 92 93 94
Foreign direct investment
Source: Siebert (1997b, p. 15).
Figure 4. World output, exports, and foreign direct investment 1973 = 100
Exports
Output
Towards Global Competition: Catalysts and Constraints
123
services in world trade stagnates around a level of 20% (Table 2), although the share of services in domestic output and employment is significantly rising in vir- tually every country. Moreover, modern information and communication technolo- gies have facilitated the international tradability of services – at least those that are provided in a "disembodied" manner (Klodt, 1988). The seeming contradiction between rising trade potentials and constant shares of services in world trade can be explained by the fact that the transition to the service society is mainly achieved by a rising share of services in intermediate inputs, whereas the ratio of services to industrial goods in final demand is fairly stable (Klodt, 1997). Hence, the true importance of international trade in services is not reflected by statistics, because a significant portion is incorporated into trade in goods. Nevertheless, further steps towards liberalising trade in services (for instance in the context of GATS) appears to be an essential ingredient of further world economic integration, because a significant fraction of the international division of labour is achieved by foreign direct investment in service industries.
Foreign direct investment (FDI) can be regarded both as an international relocation of capital and as a basic means of establishing international production networks. Up to the early 1980s, the development of world FDI more or less kept pace with the development of world exports, but in the recent past there have been two distinct waves of globalisation via FDI, which peaked around 1990 and 1995. Hence, international capital flows can indeed be regarded as an increas- ingly important channel of globalisation.2
Among the larger OECD countries, FDI dominated in Germany, France, Japan and the United States, whereas in Italy and the United Kingdom globalisation was
Table 2. Share of services in total trade Percentage
1975 1980 1985 1990 1996
World 19.6 18.2 18.2 20.1 20.1 Industrial countries 20.5 20.6 19.6 21.3 21.1 United States 17.9 16.9 22.3 27.5 27.7 Japan / / 11.4 12.8 14.5 Germany 17.1 16.9 15.7 13.9 14.0 France 22.4 29.2 27.3 26.8 24.5 United Kingdom 28.4 25.1 23.4 23.6 23.4
Source: IMF (current issues); own calculations.
The Future of the Global Economy: Towards a Long Boom?
124
mainly driven by exports (Figure 5). On the other hand, it should be kept in mind that the international integration of production networks can be achieved not only by outward FDI (presented in the figure), but also by inward FDI, which is espe- cially important for the United Kingdom. With respect to the elimination of inter- national factor price differentials, outflows and inflows of foreign investment are working in the same direction.
The role of capital flows
Figures 4 and 5 look at investment capital and ignore international flows of financial capital, which have reached impressive levels in recent years. According to the Bank for International Settlements, international currency transactions (which are only a fraction of international financial transactions) account for $1.49 trillion per day in 1998, an increase of 26% against 1995 and an increase of 150% against 1989 (Neue Zuercher Zeitung, 19 October 1998, p. 10). Nevertheless, there are still reasonable doubts whether the world capital markets can really be regarded as perfectly integrated.
These doubts were originally raised by Feldstein and Horioka (1980), who argued that a perfectly integrated world capital market could be regarded as a finan- cial pool where savers put their money in and investors take their money out – irrespective of the national origin of savings and investment. Under such condi- tions, there should be no systematic relationship between the savings ratio and the investment ratio of a country, because only by accident would a high propensity to save go hand in hand with rich and promising investment opportunities.
However, Feldstein and Horioka found a rather stable relationship between the savings and investment ratio across countries. This observation, which became known as the Feldstein-Horioka Puzzle, was confirmed in several other studies. Moreover, Taylor (1996) found that international capital mobility among the G7 countries was even higher in the late 19th century than in the 1970s and 1980s, and only slightly lower than in the 1990s.
There are several objections to these findings that cannot be discussed at length in this chapter. For instance, Taylor’s argument ignores the fact that interna- tional capital mobility today covers many more countries than it has in the past century. And more importantly, it covers countries with much larger differences in wage rates and technological levels, which allows more room for exploiting inter- national cost and productivity differentials by relocations of capital. With respect to the Feldstein-Horioka argument, the basic objection is that countries may be affected by external shocks that influence savings and investment behaviour in the same way. Therefore, a parallel development of national savings and invest- ment ratios does not necessarily reflect a segmentation of national capital mar- kets. Nevertheless, most observers agree that the Feldstein-Horioka coefficients
Towards Global Competition: Catalysts and Constraints
125
500 300
200 400
400 600
400
300
200
100
0
200
100
0
150
100
50
0
300
200
100
0
300
200
100
0
500
400
300
200
100
0
Figure 5. Increase in gross domestic product, exports, and foreign direct investment of selected countries, 1981-1996
At constant prices; 1981 = 100
Source: OECD, International Direct Investment Statistics Yearbook, 1998; OECD statistics; OECD, National Accounts, Main Aggregates, Vol. I, 1999.
Germany Italy
United Kingdom France
Japan United States
GDP Exports FDI GDP Exports FDI
GDP Exports FDI GDP Exports FDI
GDP Exports FDI GDP Exports FDI
500 300
200 400
400 600
400
300
200
100
0
200
100
0
150
100
50
0
300
200
100
0
300
200
100
0
500
400
300
200
100
0
Figure 5. Increase in gross domestic product, exports, and foreign direct investment of selected countries, 1981-1996
At constant prices; 1981 = 100
Source: OECD, International Direct Investment Statistics Yearbook, 1998; OECD statistics; OECD, National Accounts, Main Aggregates, Vol. I, 1999.
Germany Italy
United Kingdom France
Japan United States
GDP Exports FDI GDP Exports FDI
GDP Exports FDI GDP Exports FDI
GDP Exports FDI GDP Exports FDI
500 300
200 400
400 600
400
300
200
100
0
200
100
0
150
100
50
0
300
200
100
0
300
200
100
0
500
400
300
200
100
0
Figure 5. Increase in gross domestic product, exports, and foreign direct investment of selected countries, 1981-1996
At constant prices; 1981 = 100
Source: OECD, International Direct Investment Statistics Yearbook, 1998; OECD statistics; OECD, National Accounts, Main Aggregates, Vol. I, 1999.
Germany Italy
United Kingdom France
Japan United States
GDP Exports FDI GDP Exports FDI
GDP Exports FDI GDP Exports FDI
GDP Exports FDI GDP Exports FDI
The Future of the Global Economy: Towards a Long Boom?
126
at least contain some relevant information about the integration of world capital markets.
More recent studies have revealed that the correlation between savings and investment ratios is still significant, but declining over time (Table 3).3 Hence, it can be argued that world capital markets are still far from being perfectly integrated. But integration obviously continues, which implies that globalisation via trans-border flows of capital is an ongoing process which will probably carry on into the future.
In essence, the decline of the Feldstein-Horioka coefficients reflects the enhanced opportunities for internationally mobile investors to enter foreign mar- kets. An important prerequisite for this development is a well-functioning interna- tional banking system that relies on transparency of financial markets, liberal regulations of cross-border capital flows, and political stability. In the European Union, complete capital market liberalisation was achieved in 1990 (as one of the four freedoms in the single market). East and South East Asia opened up to foreign capital as early as the 1960s and 1970s, whereas several Latin American countries lacked the necessary political stability until the 1980s. If there exist reasonable risks of sovereignty, foreign countries become mousetraps: they are easily entered but difficult to leave. The reduction of sovereignty risks helps to reduce capital flights and allows access to the international supply of capital. Further steps towards an integrated world capital market will remain an important topic on the agenda of the International Monetary Fund, the World Bank and – with respect to international trade in banking services – the World Trade Organisation.
4. Constraints of globalisation
The driving forces of globalisation – technological reduction of distance costs and removal of artificial economic barriers between countries – have surely not
Table 3. Feldstein-Horioka coefficients for OECD countries
Regression: (I/Y)i = α + β (S/Y)i
Period β t-value
1960-69 0.86 14.3 1970-79 0.77 7.0 1980-89 0.63 6.3 1990-93 0.61 6.8
Source: Bayoumi (1999).
Towards Global Competition: Catalysts and Constraints
127
reached an end. It can be expected that the trend towards the integrated world economy will forge ahead in the years to come. It should be kept in mind, how- ever, that history has never been, and will never be, a one-way street. The success of globalisation will breed its own constraints, which may slow down if not reverse world economic integration. These endogenous constraints and a few others are discussed in this section.
Demand for more redistribution and an expansion of the Welfare State
Resistance to further globalisation can be expected especially from those groups that fear they will be among the losers. In highly developed countries the main losers are low-qualified workers, because they are increasingly exposed to direct and indirect factor price competition from low-wage countries. There is still an ongoing debate among economists about the relative importance of globalisa- tion for the income and employment opportunities of skilled and less-skilled workers (Siebert, 1999b), but there is no doubt that the integration of China, Eastern Europe and other labour-rich regions into the world economy will put the wage levels in Western industrial countries under strain. In a globalised world, high wages can only be earned if they correspond to high labour productivity which stems from a high qualification level of workers.
In the United States, the United Kingdom and, to some extent, Japan, the national labour markets have reacted to the increased adjustment pressure from global competition in the form of increased wage differentials (Table 4). In conti- nental Europe, by contrast, wage dispersion remained constant or even declined. Consequently, low-qualified workers had to face a severe deterioration of their employment opportunities in those countries. Inadequate and inflexible adjustment
Table 4. Wage dispersion between different income decilesa across countries
D5/D1 D9/D5
1979 1995 1979 1995
United States 1.84 2.13 1.73 2.04 Japan 1.71 1.63 1.76 1.85 Western Germanyb 1.65 1.44 1.63 1.61 Francec 1.67 1.65 1.94 1.99 United Kingdom 1.69 1.81 1.65 1.87 Italyd 1.96 1.75 1.50 1.60
a) D1: lowest income decil; D9: second-highest income decil. b) 1983 to 1993. c) 1994 instead of 1995. d) 1993 instead of 1995. Source: OECD (1996).
The Future of the Global Economy: Towards a Long Boom?
128
to global competition can be regarded as a major determinant of rising structural unemployment in continental Europe (Siebert, 1997a).4 Presumably, globalisa- tion’s potential losers will try to minimise their adjustment costs by calling for redistribution from gainers in order to participate in the aggregate welfare gains from globalisation. In principle, this strategy meets with open arms in the Euro- pean approach to economic policy – for instance in the concept of the “Social Mar- ket Economy”, where social insurance helps accommodate structural change. It is therefore not surprising that, as Rodrik observed (1997, p. 53), open economies tend to spend more on social security and redistributive policies than less open economies. In his view, “the social welfare state is the flip side of the open economy”.
The potential for compensating globalisation’s losers through an extended social policy are limited, however, because institutional competition restricts the power of governments to raise taxes for financing such policies. Rodrik may be right in concluding that the demand for redistributive policies will rise, but he ignores that the supply of redistributed income will decline. Politicians will increasingly face the dilemma that rising claims for redistribution will be accompa- nied by shrinking tax revenues. The social security systems in Europe are under pressure in any case because they create severe distortions in the labour market (tax wedge), and because with an ageing population these systems are running the risk of not being sustainable. The scope for redistribution is limited; an increase in the Welfare State is unlikely; instead, the industrial countries in Europe are faced with choosing which income risks (in case of unemployment) are so relatively small that each individual can carry them on the basis of their own economic capacity, and which risks are so large for the individual that society needs to carry them (Siebert, 1998a).
Like national security systems, the transfer system of the European Union (structural funds, the common agricultural policy) can be interpreted as an attempt to make structural adjustment more acceptable. With monetary union, the political demand for transfers can be expected to rise. As the EU budget is limited to 1.27% of the EUGDP, however, there is a severe hurdle for an exten- sion of transfers that would eat away the efficiency gains expected from the single market.
Trade unions and political systems under strain
It seems unlikely that the increased pressure on the labour market could result in stronger trade unions. In the United States and the United Kingdom, trade unions have seen an erosion of their power, and in most continental Euro- pean countries membership is down. New production processes involving teams in which the individual worker has more responsibility, the rising level of human
Towards Global Competition: Catalysts and Constraints
129
capital requirements, the decline of industrial-type jobs and the rise of new jobs in information technology and the service sector in general – all these tendencies make it more difficult for trade unions to organise members. The most important aspect, however, is that the rising international mobility of investors and capital increases the elasticity of labour demand, and thus reduces the monopoly power of unions (Lorz, 1997). The attempt to Europeanise wage policy will not be a way out for them, because the European Union itself is increasingly integrating into a globalising world economy.
In a sense, the limited ability of unions to adjust to globalisation’s require- m e n t s i s p a r t o f t h e m o r e g e n e r a l q u e s t i o n o f w h e t h e r t h e p o l i t i c a l decision-making system is able to cope with larger shocks or the reversal of eco- nomic trends that prevailed in the past. Japan, accustomed to high growth rates until the early nineties, seems to be a case in point: its political system may appear to have lost its capacity to solve economic problems. Is that also true for the three major continental countries in Europe – Italy, France and Germany? Like Japan, these countries are based on consensus, and not unlike Japan, they seem to be less and less able to solve major issues such as high unemployment and the necessary reforms of the social insurance system.5
Pressure for protectionism
When advanced countries lack the flexibility that is required for coping with the challenges of globalisation, it must be expected that politicians will increas- ingly be tempted to rely upon another strategy: the establishment of protectionist barriers against global competition. Such barriers can take various forms: tariffs, non-tariff trade barriers, capital controls, Tobin taxes, social and green standards, etc. It would appear necessary, therefore, to keep a watchful eye on the development of protectionist policies in the future.
In the area of trade-related instruments, the imposition of anti-dumping actions is one of the most prevalent protectionist measures. In the 1990s, the incidence of these measures has strongly increased (Table 5). It would perhaps be misguided to interpret the data of the table as the beginning of protection- istic struggles against global competition, but the large increase in the number of actions per year should at least be taken as a first warning signal.
A second warning signal results from the calculations of Table 6, where the share of intra-bloc trade is provided for different blocs. Except for the EU, intra-bloc trade has gained importance both in exports and imports.6 The numbers are not dramatic, but they may well indicate that governments are beginning to look for ways of escaping from global competition and the associated adjustment pains of the integrated world economy.
The Future of the Global Economy: Towards a Long Boom?
130
Social standards and international policy co-ordination
In public debate, harmonising social norms is proposed as another strategy in the era of globalisation. The starting point of this position is that social protection should not stop at national borders, but should also apply to countries that are the source of imports to advanced countries. The logic behind this approach is that employers in developing countries would be forced to improve their working conditions; otherwise they could not obtain access to the markets of developed countries. As a variant, min- imum social norms are required. This leaves open what minimum means, i.e. whether it is related to bare necessities or whether it is simply a step towards a more compre- hensive form of harmonisation. Harmonising social norms could prove to be as formidable a constraint to the international division of labour as protectionism.
Table 5. Anti-dumping actions by region
Countries initiating actions Average actions per yeara
1985-90 1990-96
North America 56.8 62.7 Western Europe 28.2 30.7 Australia/New Zeeland 33.6 47.5 Latin America 5.6 38.5 Asia 1.4 7.8 Other 0.0 12.6
Total 125.6 199.8
a) Years run from 1/7 to 30/6. Source: Calculated from Spinanger (1997, Table 2).
Table 6. Share of intra-regional trade in total flowsa
Percentage
Trading bloc No. of participating
countries
Exports Imports
1990 1996 1990 1996
APEC 18 69.1 73.0 67.0 70.9 EU* 15 62.5b 62.2 62.1b 64.0 NAFTA 3 42.7 47.5 34.4 39.2 ASEAN 7 19.5 24.7 15.9 19.3 MERCOSUR 4 8.9 22.6 14.5 20.0
a) Without associated members. b) 1993. Source: WTO (1998, Vol. II, p. 7).
Towards Global Competition: Catalysts and Constraints
131
In many cases, the demand for social standards in international trade is not motivated by solidarity with exploited workers in poor countries, but basically aims at sheltering high-wage jobs in advanced countries from low-wage competi- tion. The price of such “social protection” would have to be paid by developing countries, which would face reduced opportunities of integrating into the world economy, and by consumers in developed countries, who would have to face higher import prices.
In any case, the logic behind harmonising social norms is fallacious for differ- ent reasons. Firstly, from an employer’s point of view, social standards are just another form of non-wage labour costs. They can only be increased at the expense of the wage level. As the demand for social protection is income-elastic, rich coun- tries should refrain from imposing their conceptions about social security upon poorer countries, which probably prefer higher wages instead of higher social standards. Secondly, social standards in international trade may cause substitu- tion effects between the international sector and the domestic sector in develop- ing countries. For instance, if advanced countries banned the import of goods that are produced from child labour, children would probably be driven into local industries where working conditions may be even worse. Hence, it may be difficult to achieve well-intended social goals by imposing respective barriers to trade.
The social standards approach can be viewed as the tip of an iceberg: the more general approach of “co-ordinating” international arrangements – including taxation. Although this is unlikely to proceed on a worldwide level, attempts can clearly be seen such as harmonising taxes, including taxes for business in the European Union. This can be interpreted as the response of national governments that see their manoeuvring space reduced in locational competition and that are trying to redefine some common institutional setup that would limit the exit opportunities of internationally oriented investors.
At present, the debate about international policy co-ordination is concentrat- ing on exchange rates and international financial markets. The financial crisis in South East Asia, the fragility of the banking sector in Japan, the crisis in Russia, the potential instability of Latin American countries such as Brazil, and the increased risk aversion in the US financial sector have made clear that volatility in the finan- cial sector has an impact on the real sphere of the economy. Globalisation also means more globalised financial markets.
Many solutions to these issues have been discussed, but the bottom line of all approaches is that each country must anticipate the negative impact that a financial crisis will have for its own development. Thus, countries cannot rely on international efforts to help them. They have to take stability at home more seri- ously by applying stricter banking regulations, by including investment banks and hedge funds in a regulatory framework, by preventing a bubble from developing,
The Future of the Global Economy: Towards a Long Boom?
132
and by implementing more stability-oriented policy. “Stability begins at home” will be an important slogan for the new world economy. This implies, however, that stabil- ity constraints have to be taken into consideration early on. That will restrain exces- sive growth; it will also be helpful in steering economies to a long-run growth path.
Environmental sustainability
In a long-term perspective, considerable constraints on globalisation and world economic growth could result from the limited capacity of the environment as a sink, i.e. as a receptacle of wastes. The major issue is no longer national envi- ronmental quality as a restraint on national development; the issue of the next century is global environmental goods.
If the appraisal of the overwhelming majority of natural scientists is taken seri- ously, global warming is a severe risk for the world; the risk has to be taken into account by a precautionary environmental policy. There are competing uses for the global environment: its role as a public good for consumption versus its role as a sink for greenhouse gases (Siebert, 1998b). Reconciling these facets requires determin- ing the optimal level of the global environment (the atmosphere), i.e. the quantity of greenhouse gases to be tolerated. That means comparing the costs of reducing emissions and the benefits of improved environmental quality, including a dimin- ished risk of global warming. It also entails signalling the global scarcity to individual countries. The problem is that in determining the tolerable global quantity of emis- sions, countries can behave as free riders. Thus it is necessary to allocate the total quantity of emissions to individual countries. This allocation of property rights poses severe incentive problems: accepting a global treaty, ensuring that an inter- national contract among sovereign states is not revoked in the future. This presup- poses that the allocation of emission rights is “incentive-compatible” and that the increased demand for emission rights of countries in the process of economic devel- opment is taken into account (Sachverständigenrat zur Begutachtung der gesa- mtwirtschaftlichen Entwicklung, 1998). According to the Kyoto Protocol, emission reduction obligations will be defined for the 1990 level, and will be tradable.
The extent to which the atmosphere’s limited capacity to absorb greenhouse gases will be a restraint for economic growth is an open question. The institutional arrangement envisioned by the Kyoto Protocol and the results of the 1998 Buenos Aires Conference so far do not represent a specified restraint. National environ- mental policy has had structural effects in the last twenty years, in that it has reduced the competitiveness of emission-intensive sectors in industrialised coun- tries. Until now, environmental policy has not been a severe restraint for national economic growth. The situation could change, however, if environmental scarcities become more noticeable.
Towards Global Competition: Catalysts and Constraints
133
5. The future of globalisation
As the preceding section has demonstrated, a simple linear extrapolation of current globalisation trends would be premature; several drawbacks have been identified that could considerably slow down the speed of future world economic integration. Most of these drawbacks originate from advanced countries, where low-qualified labour has to bear significant adjustment costs. These potential glo- balisation losers may try to revert to a disintegrated world economy and reshape the international economic order in favour of protectionism and “fair” instead of free trade relations. All in all, however, it can be expected that the positive engines of globalisation and integration will eventually predominate, for two major reasons.
First, the industrialised countries as a whole will gain, which enables them to at least partly compensate the losers. A case in point is the development of the terms of trade, i.e. the relative change of export prices as compared to import prices. If this ratio rises, the respective countries are better off because they have to give in less export goods for the same amount of import goods, or in other words, can afford higher imports at a given level of exports.
As a matter of fact, the terms of trade of industrial countries have substan- tially improved during the past two decades (Table 7). The basic reason is the integration of large, labour-rich countries into the international division of labour. China alone accounts for about one-fifth of the worldwide labour force, and India is not much smaller. The contribution of these and other newly integrating countries to world output is much less, because they are provided with little physical and human capital and a rather low technological level of production. Hence, it can be expected that labour-intensive goods (which are mainly importedby advanced countries) will become relatively cheap on world markets, whereas technologically sophisticated and capital-intensive goods (which constitute the major portion of
Table 7. Terms of trade in international trade
Export prices Terms of trade
of industrial countriesa Industrial countries Developing countries
1980 100 100 1.00 1985 99 92 1.08 1990 148 115 1.29 1995 181 130 1.39 1996 178 129 1.38
a) Ratios of export prices of industrial countries to export prices of developing countries. Source: Gundlach, Nunnenkamp (1997).
The Future of the Global Economy: Towards a Long Boom?
134
export goods of advanced countries) will face increasing demand and rising prices on world markets. These gains from globalisation would be at stake if the world economy fell back into protectionist practices.
The second reason is the historical experience of several countries, which strongly supports the case for further liberalisation. According to a pioneering study from the World Bank (Michaely et al., 1991), economic growth after trade lib- eralisation was higher than it was before in 23 out of 31 cases. The most prominent examples are presented in Table 8, which concentrates on the success stories of trade liberalisation, but also presents the average growth performance for all countries. That average clearly supports the view that an intensified international division of labour is a major source of economic growth and wealth.
The country-specific results of Table 8 are in line with the region-specific calcula- tions of Stoeckel et al. (1990) which are based upon a general equilibrium model of the Centre for International Economics at the University of Canberra. The status-quo situa- tion on world markets was compared to a scenario with completely liberalised trade on the one hand and a scenario with strong protectionism in the United States and the EU on the other. In the case of completely free trade, world output would increase by about 5%, whereas a relapse into protectionism would reduce world output by 3%. Moreover, unilateral steps towards free trade either by the United States or the EU would be beneficial to each region, although the welfare gains would be smaller than the gains from complete liberalisation. Of course, the results of these simulations depend upon the specific features of the underlying. model, but the calculations of Stoeckel et al. at least demonstrate that trade liberalisation is not a zero-sum game.
Table 8. Annual real GDP growth before and after trade liberalisation Percentage
Start of trade liberalisation
Beforea Afterb
Brazil 1965 2.90 3.43 Chile 1974 2.30 3.74 Greece 1962 4.90 6.20 Indonesia 1996 6.13 8.95 Israel 1962 0.80 6.38 Korea 1965 5.77 10.40 Portugal 1970 5.32 6.48 Singapore 1968 1.60 4.20 Turkey 1970 2.80 6.81 Uruguay 1974 2.90 4.00 Average of 31 countries 4.45 5.57
a) Average of three years up to liberalisation. b) Average of three years after liberalisation. Source: Maurer (1998).
Towards Global Competition: Catalysts and Constraints
135
The advanced economies would be well advised, therefore, to resist protec- tionist pressures from special interest groups and to proceed on the road towards the integrated world economy. Flexible adjustment to changing world economic conditions will probably require some painful offerings in the short run, but will eventually turn out to be beneficial to all participants. History has repeatedly demonstrated that those who try to escape from structural adjustment will not only not be able to preserve their Elysium, but will have to face an even harder landing when their protectionist shelter is washed away by the relentessly rising tide of global competition.
The Future of the Global Economy: Towards a Long Boom?
136
Notes
1. Gottfried Haberler (1955) even argued that the factor price equalisation theorem actu- ally proves the opposite of what it claims to prove, because its assumptions are much too restrictive to ever be fulfilled.
2. For a detailed analysis of the structure and determinants of foreign direct investment, see Klodt (1998).
3. In a perfectly integrated world capital market, the coefficient β in Table 3 should be zero, whereas it should be unity in case of completely segmented national capital markets.
4. For the European Union as a whole, unemployment reached a level of 12.6% for low-qualified workers, 8.6% for the medium-qualified, and 5.9% for highly qualified workers in 1996 (EUROSTAT, 1997).
5. According to Olson (1982), the diminishing ability of consensus-oriented countries to cope with structural adjustment basically reflects the rising power of special interest groups that obstruct aggregate efficiency.
6. For the EU, no reliable data could be calculated for the year 1990, because the comple- tion of the internal market in 1992 brought about substantial changes in trade statistics. Since 1993, the statistical coverage of intra-EU trade is much lower. Therefore, a comparison of intra-bloc shares of 1990 and 1996 would make no sense.
Towards Global Competition: Catalysts and Constraints
137
Bibliography
BAYOUMI, Tamin (forthcoming), “Is There a World Capital Market?” in Horst Siebert (ed.), Globalization and Labor, Kiel Week Conference 1998. Tübingen.
BHAGWATI, Jagdish (1989), Protectionism. Cambridge, MA.
CAIRNCROSS, Frances (1997), The Death of Distance. Boston.
EUROSTAT (1997), Erhebung über Arbeitskräfte. Ergebnisse 1996. Luxemburg.
FELDSTEIN, Martin and Charles HORIOKA (1980), “Domestic Saving and International Capital Flows”, The Economic Journal, Vol. 90, pp. 314-329.
GREIDER, William (1997), One World, Ready or Not: The Manic Logic of Global Capitalism. New York.
GUNDLACH, Erich and Peter NUNNENKAMP (1997), “Labor Markets in the Global Economy: How to Prevent Rising Wage Gaps and Unemployment”. Kiel Discussion Papers, 305.
HABERLER, Gottfried (1955), A Survey of International Trade Theory. Princeton.
INTERNATIONAL MONETAY FUND (current issues), Balance of Payments Statistics, Yearbook, Part II, Washington DC.
KLODT, Henning (1998), “Globalisierung – Phänomen und empirische Relevanz” in K.E. Schenk, D. Schmidtchen and M.E. Streit (eds.), Globalisierung, Systemwettbewerb und nationalstaatliche Politik. Jahrbuch für Neue Politische Ökonomie, 17. Band.
KLODT, Henning (1997), “The Transition to the Service Society”, Kiel Working Papers, 839.
KLODT, Henning (1988), “International Trade, Direct Investment, and Regulations in Services”, World Competition, Vol. 12 (2): 4967.
LORZ, Oliver (1997), “A Bertrand Model of Wage Competition With Capital Mobility”, Economic Letters 56: 339343.
The Future of the Global Economy: Towards a Long Boom?
138
MAURER, Rainer (1998) Economic Growth and International Trade with Capital Goods: Theories and Empirical Evidence. Tübingen: Kieler Studien, 289.
MICHAELY, M., D. PAPAGEORGIOU and A.M. CHOSKI (1991), Liberalizing Foreign Trade: Lessons of Experience in the Developing World. Cambridge, MA.
OECD (1996), Employment Outlook. Paris.
OLSON, Mancur (1982), The Rise and Decline of Nations. New Haven.
RODRIK, Dani (1997), Has Globalization Gone Too Far? Washington DC.
SACHVERSTÄNDIGENRAT ZUR BEGUTACHTUNG DER GESAMTWIRTSCHAFTLICHEN ENTWICKLUNG (1998), “Vor weitreichenden Entscheidungen”, Jahresgutachten 1998/99.
SIEBERT, Horst (1999a), The World Economy. London.
SIEBERT, Horst, ed. (1999b), Globalization and Labor. Tübingen.
SIEBERT, Horst (1998a), Arbeitslos ohne Ende? Strategien für mehr Beschäftigung. Wiesbaden.
SIEBERT, Horst (1998b), Economics of the Environment: Theory and Policy. Fifth revised edition. Heidelberg.
SIEBERT, Horst (1997a), “Labor Market Rigidities: At the Root of Unemployment in Europe”, Journal of Economic Perspectives, Vol. 11(3): 37-54.
SIEBERT, Horst (1997b), Weltwirtschaft, Stuttgart.
SPINANGER, Dean (1997), “The WTO After the Singapore Ministerial: Much to Do About What?” Kiel Discussion Papers, 304.
STOECKEL, Andrew, David PEARCE and Gary BANKS (1990), Western Trade Blocs: Game, Set or Match for Asia-Pacific and the World Economy. Canberra: Centre for International Economics.
TAYLOR, Alan M. (1996), “International Capital Mobility in History: Purchasing Power Parity in the Long Run”, NBER Working Papers, No. 5742, Cambridge, MA.
WORLD BANK (1995), World Development Report. Washington DC.
WTO-WORLD TRADE ORGANISATION (1997, 1998), Annual Report. Geneva.
139
5
5Working for World Ecological Sustainability: Towards a “New Great Transformation”
3by
4Alain Lipietz Centre d'Études Prospectives d’Économie Mathématique Appliquées
à la Planification France
1. Introduction
The relationship of humankind to its environment, that is, the way one affects the other and the way the environment enables humankind to live, is the subject of human ecology, still called “political ecology” (humans being political animals). Demographics, followed by economics, are the main shaping forces in this rela- tionship. Since the dawn of history, economic progress and the artificialisation of humankind's surroundings appeared to be the instruments which would irrevers- ibly emancipate human beings from the constraints imposed by their environ- ment's “load capacity”. In the second half of the 20th century, after the long boom which followed the Second World War, the march towards emancipation reached its limits. Economic progress itself would seem to be a crisis factor in regard to sustainability. Does that mean that, where the long-term future is concerned, “environment” and “development” must be considered as opposites? This chap- ter is intended to supply a qualified answer to that question, which poses a formidable challenge to the OECD, whose “D” stands for “Development”.
In fact, the creation of the OECD when the Second World War ended went in step with the institution of a new “model of development”, one which was to bring North America, Western Europe, Japan, Australia and New Zealand thirty glorious years of economic growth.
The model marked the apogee of a “technological paradigm”, namely the search for maximum work efficiency gains, thanks to the Scientific Organisation of Labour. Above all, it expressed a new way of viewing labour itself. Its cost (wages) was now seen primarily as the basic income of the mass consumer and hence as
The Future of the Global Economy: Towards a Long Boom?
140
the key element in determining outlets for industrial production.1 The regulation of these wages, and thereby of effective demand, changed the conditions govern- ing how capitalism operated – a turning-point which the anthropologist Karl Polanyi (1957) called “the Great Transformation”.
The “Great Transformation” of the 1930s and 1940s, according to Polanyi, expressed “the revolt of Society against the dogma of the market's self-regulating power”, a power which during the Depression had shown its ability to destroy “the machine, the earth and labour”. The solution could lie only in placing the laws of the market within a wider system of social constraints: habits, regulations, laws and conventions. Capitalism so reorganised would operate as much by “civic spirit” as by “self-interest”.
Nobody these days disputes the reality of the “Golden Age”, the boom that fol- lowed the Great Transformation, but nobody would dare presume to go back to it. Globalisation of the world economy has crippled the effectiveness of national regu- lations; and above all, the technological paradigm which attached top priority to raising labour productivity seems well and truly responsible for the particularly nature-fouling character of this model of development. It is as though, to quote Adam Smith's trinity formula, there had been a systematic attempt to economise labour by amassing capital and exhausting the Earth, and as though the Great Change of the mid-20th century, in failing to transcend a civic spirit anchored in the Nation-State, had (at least during the “thirty glorious years” 1945-1975) been able to save only the Machine and Labour – by intensifying the plunder of the Earth.
The argument defended in this chapter runs as follows:
– Any fresh “long boom” will be constrained principally by its “viability” or ecological “sustainability”.
– It will therefore have to be grounded in a technological paradigm that hus- bands the “Earth” factor, i.e. the environment and more especially energy.
– This being so, it will be fuelled by research into and investment in energy-saving and, more broadly, environment-friendly techniques.
– It will hence be guided by new forms of regulation that add environmental to social protection.
Section 2 provides a very short review of the age-old history of the environ- ment-development relation, up until the crisis of the economic model that saw the founding of the OECD. Economic globalisation, as is well known, played a decisive (though not exclusive) role in this crisis, and any way out of the crisis must deal with this problem. Section 3 distinguishes two concepts, “local ecological crisis” and “global economic crisis”, along with the latter's diplomatic repercussions. Section 4 treats the contribution of economic thinking to the management of local ecological crises. The fifth section concerns the first lessons to be drawn from global
Working for World Ecological Sustainability: Towards a “New Great Transformation”
141
crises. Section 6 explores the global crisis presenting the most danger for the 21st century, and currently the subject of internal divisions among OECD countries, namely the greenhouse effect. Section 7 forms the chapter’s conclusion.
At the end of this journey we shall have gained some inkling of the new tech- nological paradigm, the new civic sensibility, and the new modes of regulation that should enable the world to experience a new phase of prolonged growth com- patible with environmental constraints: a “New Great Transformation” that will open the way towards “sustainable development”.
2. A short history of human ecology
If we are to guess what the long-term future holds, our only guide is study of the long march of history.
Long ago, the “viability” of human groups depended almost entirely on the natural environment. Human ecology differed very little from that of other living species: a predator-prey system converging towards eco-demographic equilib- rium, no doubt cyclical (Lokta-Voltera equations). The population grew as far as the load capacity of its hunting-grounds permitted, then ran into a scarcity crisis. The human difference lay almost certainly in an ability to see ahead and, by popula- tion displacements, to adjust to changes in the environment, whether they resulted from very slow climate fluctuations (like the glaciation cycle), or from human pressure itself.
With the Neolithic Revolution, begun 10 000 years ago and ending in our time, man learned how to “domesticate” nature by selecting seeds and raising animals. The subsequent artificial leap in the load capacity of the environment allowed, and indeed demanded, social specialisation distinguishing the leaders of what must already be called an “economy” from those who followed their orders.2 The specialisation was itself expressed by the appearance of towns, writing and his- tory. From then on, ecological crises of scarcity (the collision of demographics with environmental load capacity) were compounded by crises stemming from faulty proportions in the social distribution of the wealth produced.
The most spectacular (and instructive for us) example of this kind of crisis was the “great bi-secular fluctuation” at the end of the European Middle Ages (14th-16th centuries). The excessive pressure of the nobles and their wars on the peasantry produced an over-exploitation of communal property by the peasants, general penury, and vulnerability to the Great Plague, which exterminated over half of the European population. Europe recovered thanks to the agricultural revo- lution of mixing farming and husbandry – a revolution within the Neolithic Revolution – which entailed sweeping changes in technical productivity and in the legal system of land use. This agricultural revolution of the modern age in turn allowed the Industrial Revolution to gather strength.
The Future of the Global Economy: Towards a Long Boom?
142
From the start of the modern age (16th-17th centuries), ecological crises seemed completely subordinate to economics, and to the latter's dual aspect. As rational organisation of production, it embodied the promise of final deliverance from scarcity. But, as a politico-social system founded on private interest regu- lated by the market (spreading around the world with a raging force that makes today's “globalisation” look tame), it showed itself to be a scourge even more piti- less than climate. The major calamities that followed one another since the 16th century (the “destruction of the West Indies” by colonisation, the ravaging of Africa by the slave trade, the Irish famine, etc.) could no longer be blamed on the human overloading of ecosystems; the fault lay in the overloading of the mass of mankind by certain social groups.
The Great Slump of the 1930s marked the paroxysm of this “autonomisation” of the forces capable of devastating the market economy. The “Great Transforma- tion” studied by K. Polanyi signalled the rebellion of world society against this power of destruction. The Second World War would lead to a “domestication” of economics, expressed in the creation of the OECD among other things, and the birth of the concept of “economic development”.
Many economists dubbed this postwar development model “Fordism”. It rested on three pillars:
– Scientific organisation of labour (Taylorism), designed by engineers, relying on automation and mass production, and characterised by impressive gains in apparent labour productivity.
– Distribution of productivity gains to the workers, granting them access to mass consumption and, via the sustaining of effective demand, guaranteeing full employment.
– A thicket of labour agreements and social legislation, combined with a strong welfare-state system, ensured that mass production and mass con- sumption would run in tandem. This mode of regulation, buttressed by the state, was given legitimacy by a new civic consciousness that paid attention to “social issues”.
For thirty years, between 1945 and 1975, this model seemed to have banished not only economic crises but also the ecological crises arising from either insufficient land or labour productivity or from unsatisfactory product distribution. In the 1970s it ran into trouble, following a new spate of globalisation (which shook the third pil- lar) and the exhaustion of the Taylorist model of labour organisation (which eroded the first pillar). The OECD countries, faced with this twin crisis, have diverged for twenty years. Some prefer to look for a solution in the free play of market forces; others seek a degree of continuity with the “organised capitalism” of the postwar period and count on the “mobilisation of human resources” to renew labour and
Working for World Ecological Sustainability: Towards a “New Great Transformation”
143
capital productivity (Lipietz, 1995). The divergence is reflected in stronger or weaker commitment where the new ecological problems are concerned.
Alongside the economic crisis, a quite novel form of ecological crisis – the cri- sis of abundance – was making itself felt. It was the tainted legacy of the postwar eco- nomic miracles. In the OECD area, technical progress had at last made it possible to feed mankind, but at the price of a dangerous impoverishment of biodiversity and landscape variety. Town-dwellers, crowded into megacities, discovered traffic jams and pollution as the cost of their mobility. Epidemiology was increasingly relating morbidity and mortality not to under-consumption, but to excessive con- sumption of certain items. More generally, the industrial model was threatened by a new scarcity of natural resources – not so much, as the Club of Rome had feared, in terms of raw materials as in terms of the planetary ecosystem's capacity to recy- cle wastes. The artificialisation of the living world was bringing dramatic “industrial illnesses” (blood contamination, mad cow disease) in its wake. The cutting-edge of artificialisation, the cyber world, developed its own pathologies (computer viruses, the “millennium bug”). In the Third World, which had never experienced Fordism but was familiar with uncontrolled industrialisation, all the historical forms of ecological crisis (scarcity, distribution, abundance) were superimposed.
At the approach of the 21st century, ecological crisis is thus detectable at the very core of the economic system. It is a hydra-headed crisis, similar in seriousness to the Great Plague but vastly more ramified. It is no wonder that it feeds irrational fantasies. Regaining control over the economy and mastering the parameters of a new “long boom”, at a level which embraces not only market forces but also techno-science, are the crucial issues at stake in a “New Great Transformation”.
3. Local crises and global crises
Ecological crises – in addition to their variety, as has just been seen – are characterised by human ability to deal with them. An initial distinction needs to be made between “local” and “global” crises.
E v e r y m o d e r n e c o l o g i c a l c r i s i s i s r o o t e d i n a m a l f u n c t i o n i n g o f t h e socio-economic system or, more precisely, in an inability to keep the system in good running order given the inherited environment. (“Socio-economic system” here refers to the economic system adopted by a given society.) The governance of this society usually depends on compromises that have been institutionalised in a national framework, “diffracted” into local bodies. “World society” exists only as a myth, ethically useful but for the moment largely inoperative.
In concrete terms, there are ecological crises whose victims nearly all belong to the institutionally organised society whose operation is itself the source of the crises. These may be termed “local” crises. Then there are crises whose effects are felt round the world, even though they originate in malfunctioning that is located
The Future of the Global Economy: Towards a Long Boom?
144
in particular societies whose members are rarely their main victims. These may be termed “global” crises.
In the case of a local crisis, the society concerned theoretically possesses the means for controlling, for “regulating” it. These means are a matter of morality, civic spirit, the law or market organisation. “Victim” groups have ways of exerting pressure on the “perpetrator” groups: demonstrations, press campaigns, the bal- lot-box. Examples are local pollution of a city's water supply or atmosphere by a particular factory, industrial epidemics induced by insufficient nation-wide polic- ing and regulation (use of asbestos), and traffic snarls and pollution caused by an inadequate public transport network.
At the other extreme, the depletion of the ozone layer above territories in the Southern hemisphere, the drift of the greenhouse effect and its dramatic conse- quences for the Indian Ocean rim countries, for example, depend to a very large extent on the industrial economic model adopted decades ago by the OECD countries. There is no democratic mechanism by which potential victim societies can shield themselves. Only action followed by diplomatic agreements can oblige the perpetrator societies to alter their practices, if they are willing to do so.
The distinction is too crude, however. Some local crises are “trans-border” by nature. Closeness to the border means that the effects are felt in the neighbouring country, or the place of pollution is actually the border (pollution of the Rhine). Diplomatically negotiated methods of regulation had urgently to be devised. The Convention on Long-Range Transboundary Air Pollution (against acid rain) was a recent example – destined for ever-broader enlargement, as the Chernobyl “trans-boundary” accident makes clear.
Some kinds of local crises are so common that, by addition, they end up creat- ing a global problem. Deforestation, for example, which is locally dangerous (it depletes soils and induces irreversible erosion) contributes globally to the green- house effect. The industrialisation of local agriculture leads to a breakdown of global biodiversity. In this case, international diplomacy can take advantage of local mobil- isation to make the general interest prevail – providing that modes of economic regulation do not generate pernicious effects of the “everyone loses” kind.
It is in this field that the OECD countries bear a special responsibility. Further on, we shall examine their prime role in solving the most serious global problem threat- ening the 21st century, namely the greenhouse effect. Even now, however, their influ- ence in international trade negotiations endows them with particular responsibilities concerning the ability of local societies to deal with their own crises. Ecological crises spread not only through air and water but also through traded goods.
There is, luckily, one border which economic liberalism has never dared to cross: the plant-health frontier. All sovereign states have stubbornly clung to their right to protect themselves against dangerous or spoiled goods. This legitimate
Working for World Ecological Sustainability: Towards a “New Great Transformation”
145
protectionism is not contrary to the GATT or WTO principle of “national treat- ment”. If it is forbidden to import an article, it is because the domestic production or consumption of that article would also be forbidden. The compartmentalisation of the world meat market in response to foot-and-mouth disease is one example.
Foot-and-mouth disease is a case of a naturally originating crisis affecting livestock farming. But modern ecological crises are born of technology. When a crisis occurs, “sacred” national self-interest becomes legitimate once more, as was seen in the European Union with the mad cow crisis. In order to prevent such crises, the “precautionary principle” was recently imposed, i.e. the obliga- tion laid upon a state to prohibit or defer the introduction of a process whose harmlessness is dubious. Doubt not being certainty, the precautionary principle can give rise to situations of “questionable legitimacy” where production is authorised but may in the end be boycotted by the consumer population, on account of the risks it represents.3 It is futile to retort that these risks are exag- gerated. A society has a perfect right to accept death in war and at the same time refuse the slightest risk posed by the genetic or hormonal treatment of what it eats. Only the democratic process can decide, however enlightened it may be by independent investigations.
This means that no society should be able to force on another society articles produced by manufacturing processes that this society would not itself allow. It is the “Do not do unto others as they would not be done by” principle.
The OECD, were it to militate within international trade regulation forums for an enlargement of the “national treatment of products” principle into a “national treatment of products and production processes” principle, would be sending a strong message for preventing ecological crises at the most strictly local level and stopping their spread.
The “Do not do unto others as they would not be done by” principle should naturally be coupled with a “Do not do unto others as you would not be done by” rule. The author here refers to problems of “international environmental justice”. In the most developed countries, a century and a half of citizen mobilisation has imposed social and environmental standards. There is a strong temptation for transnational firms to ignore these standards when they are operating (producing or selling) in emerging economies. True, the laxity of these countries' legislation often supplies the “comparative advantage” that enables them to industrialise. It would nonetheless be difficult to prove (and terribly damning for the OECD eco- nomic model if it were proved) that this “take-off” absolutely requires deviation from currently employed standards. Once techniques are the same and guarantee comparable productivity, standards should also be comparable.4
The OECD recently spurred an international citizen's movement against a draft Multilateral Agreement on Investment, which seemed to violate the first
The Future of the Global Economy: Towards a Long Boom?
146
principle. Indeed, a multinational firm would have had the right to sue, before the International Court of Trade, and obtain compensation from a democracy that decided to introduce more effective regulations for protecting the envi- ronment. Such a compensation principle would systematically rule out any future environmental taxation. There was much less publicity surrounding the OECD’s code of professional ethics for multinational enterprises, which is a good illustration of the second principle. It recommends that these firms, when they delocate, should at least observe the standards of their country of origin. The OECD, as an institution and as a group of countries, would greatly enhance its world legitimacy by promoting the code and having it incorporated in the WTO corpus.
4. On the regulation of local ecological crises
The most frequently cited “tools” for solving latent or declared ecological cri- ses are divided into two families, the “regulatory” (laws, standards) and the “eco- nomic” (taxes, permit markets). There is a third type, consisting of self-restriction agreements, good conduct codes, etc.
This third type is, in fact, the first type in all forms of human conduct. Women and men (including economic agents), before observing laws, comply with implicit social norms (what is called “civic sense” or “civility”) and together work out practi- cal arrangements, including the place where they settle, in face-to-face negotia- tions. Combining the insights of Fernand Braudel and Pierre Bourdieu, it could be said that “society” exists on the one hand in its “habitat” – the material environ- ment which it has already given itself – and on the other in a mentally integrated and sometimes institutionalised system of norms and habits. The “New Great Transformation”, which will enable mankind to adopt an ecologically sustainable development model, first requires a cultural revolution in which certain former practices are “delegitimised”, stigmatised by consumers, neighbours, the press, competitors and lastly by governments. Concurrently, better practices, codes of good behaviour, self-limitation agreements and negotiated standards will come into being in civil society well before the law makes them mandatory or price-signals make them attractive.5
Furthermore, the environment, the physical space in which economic activ- ity takes place and which is constantly remodelled by it, has been the primary concern of policy since Neolithic times and Sumeria. Governance is above all the production of a collective good, the “habitat”, and the regulation of access to it (beginning with the irrigation system). The spontaneous activity of civil society – merely choosing where to live – automatically creates a physical environment: urban aggregations, groupings of industries. The art of placing together indus- tries, the wastes of some of which are the raw materials of the others (energy
Working for World Ecological Sustainability: Towards a “New Great Transformation”
147
co-generation, use of water, etc.), is beginning to be called “industrial ecology”. This could be said to form a new type of “Marshall-style industrial district” where the factors pleading for juxtaposition are not only the social division of labour but also the “social” division of by-products and related products. Local authorities will certainly be required to channel what are still groping attempts, by a new kind of town planning whose goal will no longer be to enlarge cities but to restructure them through the installation of diverse networks (public trans- port, telematics loops, etc.), and better-thought-out zoning schemes.
Alas, in real-life ecology, most private activities contribute to damaging the environment. This makes it necessary to introduce explicit forms of regulation, a responsibility that also falls to the political sphere. What are the justifying reasons?
In economic language, the local environment may be termed a “collective asset”, at once freely accessible and “non-rival” in the sense that its use by certain agents does not hamper the ability of other agents to make use of it… at least up to a certain point, which is what ecologists correctly call its “load capacity”. Public regulation of the environment always aims at obliging or persuading agents not to abuse this load capacity, and if possible to increase it. This indeed is the crucial element in the “New Great Transformation”. Whereas the aim of the one described by Polanyi was better distribution of wildly increasing output, the “New Great Transformation” will be also have as its guiding thrust the redirection of technolog- ical progress so as to increase the sustainable load capacity of our environment. It will thereby have the effect of stimulating a “long boom” in the equipment of households and industry and in the generation of ecologically sustainable collec- tive infrastructure.6 This, according to the World Commission on Environment and Development (1995) (Brundtland), is the true definition of sustainable develop- ment: “development that meets the needs of the present and, as an over-riding priority, those of the world's poor, without compromising the ability of future gen- erations to meet their own needs”.
Why should the quest for private satisfaction run counter to such collective goals, in contradiction with the faith of the fathers of liberalism? It is largely a con- sequence of the properties of collective assets (“the tragedy of commons”). Each actor involved has a personal stake in accentuating pressure on the environment. But once, as a result of joint use, exploitation of the environment approaches the load capacity threshold, collective satisfaction – for the community of potential users – wanes. For each individual agent, on the other hand, the pressure they exercise on the unrestricted and cost-free environment represents a virtual rent, that is, a surplus of satisfaction and profit in comparison with what they would be prepared to pay if the environment stopped being unrestricted. This is the contradiction that it would be well to regulate.7
The Future of the Global Economy: Towards a Long Boom?
148
To this end, the public authorities have an arsenal of possible policies at their disposal. A first distinction may be made between:
– Regulatory instruments: bans (to prohibit uses that do too much damage to the environment) and norms (to ration legitimate uses within a sustainable “envelope”).
– Economic instruments, which work by their “price-signal”: environmental taxes (or rather, pollution taxes) and tradable quotas.
Another distinction may be added to the list, that between “goals policies” and “instrument policies”. A goals policy regulates the impact of practices on the environment. After determining the lawful (sustainable) envelope for users, it:
– Either fixes an “intensity” limit for each potential user (norms policy). This technique is a powerful industrial policy tool when it generates economies of scale. However, through an agglomeration effect, a host of users can exceed the sustainable threshold, even though they all respect the permitted norms.
– Or it “allocates” the total volume allowed in the shape of quotas or permits granted to private users, which are then freely tradable, as after an agrarian reform. This method, the one chosen in Kyoto for dealing with the green- house effect, gives maximum power to the government authorities, who plan both overall use and (at least to begin with) each party's share.
Instrument policies, on the other hand, do no more than prohibit or set a direction. Prohibiting does not mean eliminating; everything depends on the severity of the penalty. A fine, after all, is only the extreme form of a pollution tax. While the effect of a pollution tax is to induce agents to adopt increasingly effi- cient practices, there is no saying in advance whether the tax is high enough.
From the user's standpoint, buying a quota and paying a pollution tax amount to the same thing. The user pays once in one case and continuously in the other. It is like the difference between buying land and renting it. The two instruments, which allow the user to choose their techniques and extent of use, are particularly appro- priate where large numbers of different sorts of users threaten the environment.
But just what do they pay for? The OECD countries have adopted the Pol- luter-Pays Principle without dwelling too much on its signification. Is it a question of paying for:
– The cost of repairing the environment? This should be called a fee.
– Damage caused to third parties? This should be called compensation.
– The price which, by confiscating polluters’ virtual rent, deters them from damaging the environment? This should properly be called a pollution tax.
In the realm of the standard general equilibrium theory, the three definitions would be interchangeable. In the real world, this is not at all so. Why? Precisely
Working for World Ecological Sustainability: Towards a “New Great Transformation”
149
because the environment is a collective asset, sometimes international and always inter-generational (all the agents concerned are not simultaneously present on the market); it is, moreover, subjective (what is the price of noise, the pain of illnesses, the loss of beauty?). The guiding principle should therefore be the third definition (a deterrent tax) configured by an assessment derived from the second one (damage caused). Naturally, government revenues accruing from pollution taxes or the initial auctioning of quotas can be used for “repairing” the environment, but this is not always possible. Whatever the case, these revenues, apart from the “primary dividend” provided by the instruments (protecting the environment), offer the body collecting them a “secondary dividend” in the shape of funds for other policies, e.g. lowering the cost of labour as part of a jobs policy.
This leads to the social aspect of the “New Great Transformation”. In the 21st century, a dense forest of ecological regulations will most probably develop. What will be its redistributive effect? It will surely not be neutral; and it will be fairly complex.
The least well off are hardly in a position to create pollution, and their satisfac- tion will come mainly from a healthy environment. They will be the chief beneficia- ries of a general shift towards sustainable development. The wealthiest will have their virtual rent somewhat amputated but at a high income level where its marginal utility is smallest. The short-term losers could be the “middle poor”, those for whom restrictions on an open and cost-free use of the environment will push the dream of the “Fordist” consumer model for all even further away – even though they may well be unaware of its unsustainable and health-endangering character.
This “U-curve” will require New Deal-style social reforms to be combined with the new ecological policies. If they are not, these policies will not seem justified. The same remark, as we shall see, applies to global crises and international relations.
5. Global crises: first lessons
The first international agreements – the Washington convention forbidding international trade in endangered species, and especially the Montreal protocol for protecting the ozone layer – are by now textbook examples. The scenario is always the same.
– Specialists, with a world view, ring the alarm bells on a subject that is at first disputed.
– Public opinion in a few developed countries becomes convinced and takes fright.
– Consensus, and sometimes an international agreement, is achieved among the OECD countries.
The Future of the Global Economy: Towards a Long Boom?
150
– At this stage, emerging economy governments realise that they will be pre- vented from doing what the countries preceding them in the dominant eco- nomic development model had been doing for over a century. They protest, and demand waivers and compensations, even if their own people would have been the first to benefit from the agreement.
To break this deadlock (because the emerging countries have the power of obstruction, suicidal though it be), there are three indispensable requirements:
– The agreement put forward by the OECD countries must clearly and effec- tively respond to the global threat, with the OECD countries assuming more than their fair share of the burden.
– The results of the agreement, in terms of protecting the planet, must be not only positive but popularised among the people in the least developed countries and the emerging economies; NGOs in the South have a vital role to play in this.
– The agreement must have a redistributive function that will hasten the transition towards sustainable development in both groups of countries.
Let us take the example of one of these agreements, that on biodiversity, which the United States rejected at the Rio Conference in 1992 but subsequently accepted.
Unknown genetic biodiversity is for the most part that of wild plants and tra- ditional peasant varieties. It acts something like a planetary immune system res- ervoir, as distinct from the super-selected varieties of modern agriculture. It provides raw material for the pharmaceutical industry and biological engineering. By definition, this raw material is located essentially in the developing countries. The user industries, on the other hand, are located in the OECD area. It is the classic set-up for North-South disputes.
The OECD's snap reaction is to say that biodiversity is naturally free but that selection of useful genes must be covered by patents – a position which the South countries find unacceptable. The agreement negotiated in Rio provides therefore that the North must pay royalties to the biodiversity source countries and offer the results of its research to the South countries at favourable prices.
The agreement was crippled by the WTO framework on intellectual property rights which has stalled its implementation. Since then, private control over useful genes has grown. What is worse, the agro-food industry is marketing on a large scale genetically modified organisms whose effect on the human system, and on ecosys- tems, has not been tested over the time scale of even one generation, whereas nat- ural biodiversity no longer presents any danger to mankind from the food angle. For hundreds of generations, human beings selected danger-free peasant varieties and did not feed on wild biodiversity.8 Industry practice contravenes the precautionary
Working for World Ecological Sustainability: Towards a “New Great Transformation”
151
principle which Europe, chastened by the completely unpredictable phenomenon of mad cow disease, holds particularly dear where food is concerned. Today's rules of international trade, by not allowing for any compartmentalising of risks variously accepted by different publics, breach the “Do not do unto others as they would not be done by” principle.
The present dynamics of unregulated technological progress therefore engen- der a serious crisis, among OECD countries and between Member countries and the peasant communities of the South. For the moment, luckily, the risks are still virtual, and to date there has not been a bad accident arising from a genetically modified variety imposed on the whole world by the agro-food industry.9 It is to be hoped that OECD countries will be wise enough to propose and impose upon themselves sound rules before any such accident happens.
Their responsibility is on the line also in a global crisis whose imminence is now recognised: the greenhouse effect.
6. The case of the greenhouse effect
O f a l l t h e g l o b a l e c o n o m i c c r i s e s l o o m i n g o v e r t h e f i r s t h a l f o f t h e 21st century, the climatic disorder caused by the growth in the greenhouse effect is the one that poses the greatest challenge to the model of economic develop- ment. The beating heart of human activity is involved – agro-industry through the methane cycle, and energy through the carbon dioxide cycle.
a) The situation
Since Arrhenius at the end of the 19th century, scientists have known that cer- tain molecules imprison in the atmosphere the infra-red radiation emitted by the Earth (radiative forcing). Only in the late 20th century, however, was the concentra- tion of these gases in the atmosphere, as a result of human activity, put in relation with an observed warming of the planet, first as a strong presumption [at the 1990 Conference of the International Panel on Climate Change (IPCC)], and then as a near-certainty (IPCC 1995).
The greenhouse gases (GHGs) are water vapour (whose radiative forcing does not vary significantly), CFCLs (already covered by the Montreal Protocol) and, especially, carbon dioxide (CO2) and methane (CH4).
Methane is associated particularly with paddy fields and grazing animals. Forty times more dangerous than carbon dioxide, it has only a short life-span in the atmosphere, which means that the methane problem can be settled at any time by energetic measures. The carbon dioxide emitted into the atmosphere, on the other hand, is up there for a century, which is to say practically forever. For this reason the different greenhouse gases are measured in “CO2 equivalent”.
10
The Future of the Global Economy: Towards a Long Boom?
152
Carbon dioxide is for the most part produced by the burning of fossil fuel reserves (coal, oil and gas in descending order of CO2 emitted by amount of energy produced) and, to a lesser extent, by the burning of wood for energy. The latter can be offset by a matching growth of the standing bio-mass, which acts as a “carbon sink”. There are other reasons for deforestation, however – uncontrolled logging, clearing for farming purposes (suspended within the OECD area but widely practised in the Third World for lack of agrarian reform). Fossil energy may be replaced by nuclear energy, which entails ecological hazards of similar magni- tude – to the point where major OECD countries have stopped developing it, in practice (the United States, Italy) or in law (Germany, Sweden, etc.).
It is for these reasons that the French General Commissariat for Planning (CGP, 1998) rightly concludes, “Economic growth is circumscribed by a triangle: climate risk, nuclear risk and land use conflicts”.
To beat this challenge, mankind has two trump cards to play. First, the global ecosystem automatically fixes about half of the human carbon released into the atmosphere. This “sustainable envelope”, matched against a human population that stabilises at 9 billion in the 21st century, would allow a flow of some 600 kg of carbon per person per annum. Attaining this “frontier of sustainability” (in flow) would mean halving the present production of greenhouse gases. Yet this would result only in stabilising CO2 concentrations in the atmosphere (its stock) at the level they would then have reached. Temperatures would be markedly higher than they are today, and the reduction in flow would not produce a return to pre-industrial concentra- tions. Ideally, in order to reduce carbon dioxide concentrations to a level that would stabilise temperatures, a target of reduction in GHG production by a factor of three, and not by a factor of two, would have to be assigned rapidly. In any case, the flow must be reduced as quickly as possible, to prevent concentrations reaching too high a level before subsiding… in the 22nd century.
The second trump card is the reversal of the historic trend towards lower energy efficiency. The first agricultural and industrial revolutions had, by “length- ening the production detour”, caused an ever faster decline in human labour per product unit, at the cost of a rise in the quantity of energy per unit. Then, in the 1960s, the ratio between GDP and consumed energy became stable. The oil price “shocks” triggered an unexpected turnabout – an “uncoupling” of the rise in the economic output of the industrialised countries and the rise in their energy consumption (which became much less steep or stopped altogether). With progress in technology, energy intensity (quantity of energy in national product) described an “inverted V” curve, first rising and then falling (at a present rate of 1 or 2% in Europe, according to the CGP's 1998 Report).
Man's technological hopes all rest on the gamble that this result can be gen- eralised. If mankind can manage, at the level of production and especially of the
Working for World Ecological Sustainability: Towards a “New Great Transformation”
153
structures of consumption, to achieve a boost in energy efficiency as spectacular as the rise in labour productivity, it has a hope of providing all future generations with an acceptable degree of material comfort without irremediably upsetting the world's climate.11 But the risks are very great.
b) Consequences
Current IPCC mean estimates forecast, on the basis of the present rate of anthropogenically-generated GHG releases, a doubling in the 21st century of CO2 concentrations, leading to an average temperature rise of 2° Celsius and a rise in sea-level (by surface dilatation) of 20-30 centimetres.
Experience with financial instability suggests that it is often a bad idea to make provision only for forecast averages. The IPCC does not predict the worst-case sce- narios – melting of continental ice-sheets, escape of methane from the Siberian permafrost – for the next century. This does not mean that they are excluded. The consequences of even the mid-range (+2°) scenario are dramatic enough. Climate zones would be displaced by several hundreds of kilometres; the great overpopu- lated deltas and the low-lying islands would be submerged. The geophysical changes would affect ecosystems even more seriously, and have a crucial impact on human ecology. The climatic shifts would probably be too rapid to allow an organ- ised transmigration of flora and the associated fauna. Above all, hostility to interna- tional mass migration would thwart the natural form of adjustment practised by early humans when faced with the slow climatic cycles of prehistoric times.
If no preventive remedy is found, this form of adjustment will be inevitable, and it will be the main cause of wars and crises in the 21st century. Preventive strategies themselves have geo-strategic and economic dimensions which lie and will continue to lie at the heart of negotiations on climate change.
c) The geo-strategic nexus
Not all countries are in the same boat, as regards either the costs of a prevention strategy or its benefits.
On the benefits side: countries are not all equally threatened by the green- house effect. Europe protects its deltas (Rhine-Meuse, Po); the Mississippi delta is sparsely populated. All the great unprotected and heavily populated deltas are located in the least developed countries (a typical example is Bangladesh) or the emerging economies. All the Small Island States (grouped in the AOSIS) are in this situation. These countries also have the largest proportions of rural inhabitants and the largest share of agriculture in their GNP.
The South countries are the first to be threatened by the drift of the green- house effect, and it is their populations which stand most to gain from a “precau- tionary policy”. The OECD countries, on the other hand, have less to fear, at least
The Future of the Global Economy: Towards a Long Boom?
154
according to the scenarios of 1990. Since then, the aggravation of temperate zone storms has awakened the attention of scientists… and insurers. The OECD area could be a major victim of “world tropicalisation”. If a link were established between the intensification of the El Niño-La Niña phenomena and the observed warming of the surface waters of the Pacific (something which is not yet proven), the “cost” to the OECD area of the greenhouse effect could be very substantial indeed and the “benefit” would be to avoid it.
As to the costs of prevention policy, the dissymmetries are even more strik- ing. Humanity cannot do without rice-fields or livestock, or even without some kind of land-clearing. “Basic needs” entail an incompressible production of anthropogenic GHGs, which in any case fits inside the “sustainable envelope” of 600 kg of carbon per head per annum (currently 60 kg in Bangladesh). The least developed countries have practically no leeway for reduction, except through agrarian reform and improvement in plant-energy efficiency. Conversely, industrial pollution is very largely concentrated in the OECD countries, which consequently all greatly exceed the sustainable envelope amounts – two metric tons per head in the United States, and two metric tons on average in the European Union and Japan (World Resources Institute, 1990).
It would be wrong, however, to think that greenhouse geopolitics are pitting a South interested in having a prevention policy at barely any cost to itself against a North deriving dubious benefits from preventing the greenhouse effect and hav- ing huge costs to pay out. Such a caricature applies only to a contest between the United States and, say, Bangladesh or the Fiji Islands.
For one thing, in the South, the emerging economies are coming close to the threshold of sustainability and consider it normal to cross it for as long as the indus- trialised countries which preceded them have done. For another, within the OECD group of countries, serious differences surfaced in 1990 between the Europeans – the most determined advocates of precautionary policies – and the United States – which was not so convinced – with the other countries wavering between the two extremes. The same divergence was apparent during the preparation of the fourth Conference of Parties (COP-4) in Buenos Aires, between the European Union and the other OECD countries (the JUSCANZ in COP-4 parlance: Japan, USA, Canada, Australia, New Zealand). There is a double explanation for this friction.
As regards benefits: Europe feels vulnerable, if not to its own greenhouse cri- sis, at least to that of its African and West and Central Asian neighbours. The JUSCANZ countries view themselves on the contrary as “large island States” having little to fear from a rise in sea-levels or migration pressures and (except for Japan) possessing plentiful amounts of space and natural resources.
As regards costs: Europe already has technical systems that are two to three times as energy- and GHG-efficient as those of the United States. Any restraints
Working for World Ecological Sustainability: Towards a “New Great Transformation”
155
imposed on the whole OECD area would work in its favour. Furthermore, its model of social regulation accords considerable importance to compromise goals dictated by the general interest. America's faith in free enterprise has, on the contrary, resulted in an energy-voracious model, in terms of both production and consumption.
d) Negotiation: the state of play
Command over climate risk will involve decades of bickering and compromise. A “certain idea of the ultimate goal” already governs the first stepping-stones in all negotiations, however.
In 1990, the United States expressed scepticism as to the reality of the green- house effect; it took an optimistic view of any disadvantages it might have to endure, and was adamant about any effort it might have to make. The best the World Resources Institute would do was to suggest a “percentage” dividing of the burden – in other words, conservation of historically acquired shares of rights to pollute the atmosphere.
The Third World found this position unacceptable. A protest movement, launched in 1990 by Amil Agarwal and Sunita Narain of the Centre for Science and Environment (CSE) in New Delhi, soon joined by the Group of 77 and UNCTAD, retorted by postulating a principle of equality – each country would ultimately have a right to pollute which would be sustainable and proportionate to its popu- lation. At the same time, the theorists who were the artisans of this position, A. Agarwal and M. Grubb, proposed a flexibility mechanism: countries that did not use all of their quota could sell the remainder to those which exceeded it. A gen- eral pollution tax would be levied on all countries exceeding the sum of their quotas, allocated or purchased.
The New York Framework Convention, solemnly signed at the Rio UNCED in 1992, endorsed a compromise suggested by Europe: only the “Annex I Group” (in effect, the OECD countries and the industrialised ex-Socialist countries) would initially constrain themselves to make efforts at limitation, the others being invited to temper the increase in their GHGs. According to interpretation, it was possible to understand or refuse to understand a planned return by the year 2000 to the levels of 1990. As to instruments, Europe considered proposing a general environmental tax, but was incapable of imposing it on itself. A decade was wasted with little to show for it.12
Then the new certainties acquired by the IPCC and the intervening climatic accidents altered the “climate” of the negotiations. At the COP-3 (Kyoto, 1997), the American delegation let itself be persuaded by Europe to accept quantified reduction targets – unevenly distributed among Annex I Group countries accord- ing to considerations that were more diplomatic than scientific – for the time-frame 2010.13 It set two conditions: commitment by the newly industrialising
The Future of the Global Economy: Towards a Long Boom?
156
Third World countries to make abatement efforts, and economic flexibility mechanisms, all based on the idea of purchasing abatements where their marginal cost was lowest: a QELRO (quantified emission limitation and reduction objec- tives) quotas market and “joint implementation” among Annex I parties, a “clean development mechanism” in the Third World.
At the time of writing, the Kyoto Protocol has been ratified by only the most typical of the AOSIS countries, the Fiji Islands. The COP-4 in Buenos Aires had no other ambition than to clarify this compromise. It could hardly be said to have succeeded in doing so.
Significant advances were nevertheless made in Buenos Aires. In the first place, it was decided not to specify the flexibility mechanisms until the compli- ance with commitments verification mechanisms had been elaborated. This was a wise decision which put the horse before the cart again. Second, thanks to an alli- ance between Europe and the Third World, the idea was introduced – an essential p o i n t , a s w i l l b e s e e n – o f m a k i n g g e n e r a l c o n v e r g e n c e t h e g o a l w h e r e atmospheric rights are concerned.
e) Hopes for a world compromise
As things now stand, negotiations are stalemated. Europe refuses to accept flexibility for quantitative objectives that are already too low; the United States will not accept binding objectives unless the Third World agrees to commitments; the Third World will not agree to commitments if it is denied the same right to development as that enjoyed by the North.
The only thread on which to pull to unravel this tangle is a solemn recognition, prior to any negotiation, of the equal right that all human beings of all countries and all generations have over the atmosphere. A declaration of this kind would be in conformity with the values that oversaw the foundation of the OECD, after the end of the Second World War. In practical terms, it would mean that, in the final analysis, all the people in the world would have a roughly equal right to “the common envelope of sustainable use of the atmosphere”, i.e. about 600 kg per person if the aim is to stabilise CO2 concentrations, less if the aim is to reduce them.
Were this to happen, a compromise – founded on a principle of reduction objectives converging towards this final target allocation – between the Third World (including the emerging economies) and the OECD area (including the JUS- CANZ countries) should be attainable. The compromise would have to take into account the energy intensity “inverted V” curve. While the industrialised coun- tries, whose improvement in energy efficiency outstrips their growth, would imme- diately have to embark on a downward per capita pollution path towards the target, the emerging economies would be entitled to let their pollution mount slightly higher than the sustainability threshold (but well beyond their present
Working for World Ecological Sustainability: Towards a “New Great Transformation”
157
emissions – an imaginable figure would be 1 000 kg per head of population per year); beyond that, quantified reduction objectives would become mandatory.
The first major compromise would therefore be to couple recognition of an egalitarian target level with mandatory entry into Annex I for all countries exceeding the target level by more than a certain amount.
At the same time, it would be understood that this threshold beyond which abatement is compulsory would act as a mid-course convergence target for Annex I countries, with 2030 as time-frame, for example. After this date and this threshold, all countries would be required to abate their per capita emission lev- els in parallel, at a rate to be set at about that time in accordance with the state of knowledge at that time.
A compromise along these lines reflects the spirit of the “historic” compromises that have marked the close of the century. The idea is to make commitments now for problems which will become apparent only in the long run, at a time when the bene- fits of action will appear more clearly than they do today.
What instruments should be associated with this goals policy? From the moment that these goals clearly set mankind on a path for overall quantified reductions in GHG emissions leading to an egalitarian right over the atmosphere, every economic “mechanism” inducing respect for this path becomes licit.
User responsibilisation, propagation of “best practices”, self-restriction agree- ments by manufacturers, energy consumption norms for machines and appliances, will, as in the case of local crises, be the surest way of translating awareness into wise behaviour, shaped by a budding “planet-wide civic consciousness”. The problem is that norms, agreements and even the sense of responsibility are inad- equate. They determine intermediate goals without offering an incentive to go fur- ther. They thus create an impression of disappointment when a new, sterner norm has to be imposed. They do not, moreover, enable effort to be concentrated where it is the most effective.
Economic instruments, on the other hand, motivate a permanent quest for increased efficiency. It is true that they are ineffectual when they are not associ- ated with trading practices, as in the case of slash-and-burn cultivation. But the great mass of atmospheric pollution comes from trade-related economic practices aiming for profit maximisation and virtual rents. Any rise in the costs weighing on a factor's use therefore encourages the search for techniques to husband it.
In the current negotiations, two traditions confront one another: environmen- tal taxes (which should more properly be called pollution taxes) and tradable per- mits. The latter, after being introduced into the geo-strategic greenhouse effect debate in 1990 by A. Agarwal of the CSE, are today preferred by the United States, which sees them as genuine market mechanisms that can possibly remove the
The Future of the Global Economy: Towards a Long Boom?
158
need for government-style agencies. The Europeans for their part regard trade in QELRO quotas as a ploy for dodging domestic efforts. What is worse, trades might concern fake reductions – either the “seller” might not implement the agreed abatement of emissions, or the abatement might owe more to an economic reces- sion, which it is hoped will be short-lived, than to a sincere effort to increase energy efficiency. At the Kyoto Conference, for example, Russia was allotted a 0% reduction in its GHGs in 2010 compared with 1990. Its fearsome economic crisis has already caused a drop of 30% in its GHG emissions. Its QELRO quotas could therefore be offered on the market to the highest bidder. Yet they are not matched by any change in its productive system. Worse yet, indebted Third World countries might be tempted to sacrifice their chances of future development. This could create a sort of “atmospheric serfdom”, over and above the servicing of high-interest debts. For this reason, the European Union is tempted to set quanti- tative caps on the use of “economic flexibilities”, thereby giving priority to domestic efforts spurred on by a pollution tax on energy.14
Even granting the legitimacy of the European reservations (supported by international NGOs), their carrying power needs to be qualified. As has been said, once all countries agree to an overall scheme for reduction, there is nothing shock- ing about seeking reduction where it is least expensive, especially if it is associ- ated with an increase in labour productivity. Funding efficient stoves in the Sahel, for example (whether by buying Sahel quotas, by “joint implementation” opera- tions, or through “clean development” mechanisms15), would not only be friendly to the atmosphere, it would also ease the toil of the women whose forced wood-gathering chore is ruining the savannah.
Moreover, where the buyer is concerned, tradable permits are tantamount to a capitalised pollution tax. This is quite obvious if it is supposed that only one-year pollution permits may be sold; they would take exactly the same form as an annual tax matched to the amount of emissions produced. Of course, it is important to be sure that the quota is actually be paid for. This remark raises the question of the rules of competition on the quote market. Since a quota is merely a capitalised pollution tax, a state which handed out free quotas to its business firms would in effect be subsidising them. Such a practice would in all likelihood be contestable before the World Trade Organisation.
In fact, a quota market requires not less government than a pollution tax, but more. With a pollution tax, each state goes no farther than setting a direction and supplying a more or less powerful incentive to reduce emissions. But with quotas, an international states treaty must first determine each state's initial allocation – the reduction obligations “map”. Then a supra-national agency must oversee the sincerity of transactions, i.e. the effective reduction. Lastly, this agency would probably have to regulate quota prices so as to prevent a buyer with unlimited
Working for World Ecological Sustainability: Towards a “New Great Transformation”
159
credit from cornering the market and dispensing with domestic reduction, or an indebted seller from pawning away its future development potential. The quota price, like any market mechanism, serves only two purposes:
– To send a price signal to both buyer and seller, conferring “worth” for both parties on the economising effort associated with the object of their transac- tion – here, the interest they have in air pollution abatement, regardless of the degree of development already achieved.
– To transfer from buyer to seller the financial means for re-producing the object of the transaction – here, a more industrialised and polluting country would be financing the “clean development” of a less developed one.
In short, the international permit market supervisory agency should set a floor-price for transactions, in line with broadly established practice in the world's three dominant economic entities (United States, EU, Japan) once agri- culture is involved. The reader will surely want to reflect upon the deeper reasons for this parallel.
If this were to happen, the difference between European demands and Amer- ican preferences would dissipate. A floor-price is, after all, the mirror counterpart of a ceiling quantity. The agency could, for the four-year exercise 2008-2012, fix a floor-price so calculated that 80% of reduction efforts in the domestic space of countries already parties to Annex I would cost them less than the floor-price.16
The most “prodigal” countries, those where the marginal cost per carbon tonne avoided is the lowest (United States), would centre their efforts on improving domestic technologies. The most expensive 20% of reduction efforts, involving more particularly countries that have reached the technological frontiers of clean development, could be sought in countries not having these technologies – and would be a way for those countries to acquire them.
7. Conclusion
At the Kyoto Conference, the world's people chose to give their preference to objectives quantified by country or group of countries (the EU). This primary strategy cannot now be altered. It can, however, be perfected:
– By setting it in a very long-term prospect of convergence in the allocation of pollution permits, respecting the equal rights of all human beings from generation to generation.
– By reserving the choice of instruments (regulations, pollution taxes or permit markets) for national or continental subsidiarity.
– By laying down rules for fair international competition in addition to the different national instruments.
– By stabilising price ratios in domestic and international flexibility mechanisms.
The Future of the Global Economy: Towards a Long Boom?
160
Over and above this example, the main lines of the “New Great Transforma- tion” are coming into focus:
– A new “global civic consciousness” that recognises the egalitarian right of all humans of all generations to a healthy environment.
– International diplomatic arrangements that establish common rules (against global ecological crises) and limit, by rules on free trade, the pernicious effects of competition, so as to enable national (or continental) societies to handle their local crises.
These new methods of regulation (rules, pollution taxes, quotas) will raise the cost of using the environment in a way that will favour the technologies that economise this use.
– Applied research, spurred by corporate economic interest, stimulated by aid measures and encouraged by the pooling of best practices, will turn towards pollution abatement and energy consumption savings. A new investment boom will bring productive systems and infrastructure into line with the most environment-friendly technologies.
– Income from pollution taxes and quota auctions will enable the taxation weighing upon labour costs to be lightened, allowing use of this factor to be “de-intensified” (reduction in work-time, development of low-labour, pro- ductivity-gaining cultural or neighbourhood services), and setting in motion a return to full employment.
These economic instruments, framed by norms that are consonant with an ethic of human rights and responsibility towards future generations, can influence the trajectory of technological progress in accordance with a new paradigm – the search for maximum energy and environmental efficiency. From then on, the pos- sibility will emerge of a new period of prolonged development, ecologically viable for the whole world: sustainable development.
Working for World Ecological Sustainability: Towards a “New Great Transformation”
161
Notes
1. Whence the name “Fordism”, in honour of Henry Ford I's famous observation that the working-class was America's most populous class, and that it should become a well-off class if American industry wished to market its huge output. On Fordism and its crisis, see Lipietz (1995) and, for a more quantitative treatment, Glynn et al., 1990.
2. Economics, ecology and domestication hark back to two linguistic roots (one Greek and the other Latin) that mean the same thing: the domain around the dwelling-place.
3. The concept of “questionable legitimacy” was proposed by Olivier Godard (1996).
4. The notion of comparability needs to be fairly flexible. It is not a question of fixing a worldwide pay standard for the same hour's work while overlooking differences in pro- ductivity. Such uniformity is not applied in either the social or environmental fields within the European Union, or even among regions of the same country. It is easy, how- ever, to compare social legislation in the presently less productive countries with the social legislation obtaining in the past in the countries that are now the most highly productive. It has to be admitted that in the mid-20th century, many OECD countries tolerated schoolchild labour when there was heavy work to be done in the fields. It would be inadmissible in international trade, however, for countries that launch satel- lites and have computer industries to condone social standards that were already out of date in Europe before the invention of the electric motor! What is all-important is the existence of a neutral supra-national referee (which could be the International Labour Office and the Commission on Sustainable Development working under the UN Secretary-General). The decisions handed down would then be applicable by the WTO.
5. Case studies do not invalidate the idea that the “first-mover”, the economic agent who acts in advance of future norms, can thereby obtain a competitive advantage even though the corresponding equipment is very expensive at the beginning. An environ- ment-friendly initiative of this kind usually goes hand in hand with a technical renewal that increases productivity. Secondly, the “civic-consciousness” of their production meth- ods gives their product the advantage of respectability. Their location becomes more appealing to the population, in particular its skilled elements. Lastly, when the implied norm propagates and becomes law or an official standard, the accumulated experience acts as an entrance barrier. This consideration tempers the need for explicit binding rules – in any case, where social pressure is sufficiently strong (see OECD, 1997).
The Future of the Global Economy: Towards a Long Boom?
162
6. A distinction needs to be made here between the transition towards this new order and the new order itself. The transition, providing its financing is correctly organised, will induce a temporary boom similar to that of post-1945 reconstruction. The real problem lies in the sustainability of the new order ten or so years after the transition begins. P. Quirion (1999) goes through all the forecasting and calculable general equilibrium models that test the assumption of a pollution tax on energy recycled as a reduction in employers' social insur- ance contributions. The results predict variable but low impact on GDP growth (compared with a continuation of the present order), and a clearly favourable impact on employment (up to +1-2%). They confirm the instinctive idea of a Labour/Earth substitution, with the fac- tor Capital changing more in form than in quantity. The findings are all the more remarkable in that Labour/Energy elasticity is greater in the model, and the model's degree of disinte- gration enables restructuring of consumption and production to be better apprehended (DIW, 1994; Barker, 1997). It should be noted that this research deals with local and not internationally co-ordinated policies. They confirm, incidentally, that a country does not run much competitive risk by being the first to take action. To be honest it must be emphasised that, according to these models, environmental regulations do little to accelerate traded GDP growth; by reducing pollution, they do, however, make it more sustainable – the “primary dividend” increases net domestic product. Such regulations are a necessary, but not sufficient, condition for a long boom. At best, they could be expected to produce quickened growth in employment. Suffi- cient conditions would involve regulation of supply and demand, and new work organi- sation paradigms. As to the extra-environmental conditions for the “New Great Transformation”, see Lipietz, 1997.
7. For a more detailed analysis of “local” modes of environmental regulation, see Lipietz, 1998.
8. Land-clearing does, however, put the human race in contact with reservoirs of unknown germs, and this can be a cause of new epidemics such as Ebola-virus disease.
9. Let us again remember the precedent of bovine spongiform encephalopathy (mad cow disease), apparently due to the mutation of a prion, which was innocuous to humans for centuries as long as it remained in sheep, but which jumped the species barrier as the result of new livestock industry practices.
10. In France, CO2 emissions are also measured by the mass of carbon atoms in the gas. In other countries, they are measured by the molecular mass (3.66 times greater) of CO2. This chapter uses the French system.
11. At the height of Fordism, between 1950 and 1970, the quantity of direct labour per product unit was divided by three in France. Such a rate, kept up over forty years and applied to energy efficiency, would be more than enough to fall within the sustainable CO2 envelope, without reliance on nuclear energy. See Goldemberg et al., 1987.
12. From 1990 to 1996, world emissions grew by 17%, those of the United States by 9%, Japan's by 11%. The EU countries almost stabilised theirs (France +1.6%, Italy +3%, United Kingdom –0.4%, Germany –8%). The emerging economies posted spectacular increases (China +33%, India +44%, Korea +75%). Yet China and India, which together contain nearly half of the human race, still do not much influence the world total, which is growing at half their speed.
Working for World Ecological Sustainability: Towards a “New Great Transformation”
163
13. With 1990 as base year, the idea was to reduce emissions of six GHGs by 2010, on a four-yearly sliding average, by a CO2 equivalent of –8% for the EU, –7% for the United States, –6% for Japan and –5.2% for the Annex I Group.
14. The European Commission proposes a pollution tax, joining together GHG deterrence and promotion of energy-saving, regardless of source.
15. As before, these are mechanisms by which one country finances the reduction of pollution in another country and “credits itself” with the reduction obtained.
16. The Commission of the European Union is considering a pollution tax of $10 per barrel of oil equivalent, which it feels is enough to return to a sustainable level in Europe. This being a ceiling price for QELRO quotas, the floor-price could be something like $8 per boe.
The Future of the Global Economy: Towards a Long Boom?
164
Bibliography
AGARWAL, A. and S. NARAIN (1991), Global Warming in an Unequal World: A Case of Environmental Colonialism. New Delhi: Centre for Science and Environment.
BARKER, T. (1997), “Taxing Pollution Instead of Taxing Jobs: Towards More Employment Without More Inflation Through Fiscal Reform in the UK” in T. O'Riordan (ed.), Ecotaxation. London: Earthscan.
COMMISSARIAT GÉNÉRAL DU PLAN (1998), Energie 2010-2020. Paris: CGP.
DIW-DEUTSCHES INSTITUT FÜR WIRTSCHAFTFORSCHUNG (1994), “The Economic Effect of Ecological Tax Reform”, DIW Economic Bulletin No. 7, Bonn.
GLYNN et al. (1990), “The Rise and Fall of the Golden Age: An Historical Analysis of Post-War Capitalism in the Developed Market Economies” in Marglin and Schor (eds.), The Golden Age of Capitalism: Reinterpreting the Post-War Experience. Oxford and New York: Clarendon Press.
GODARD, O. (1996), “Stratégies industrielles et conventions d'environnement : de l'univers stabilisé aux univers controversés”, Environnement-Economie, Proceedings of the Paris Colloquium, 15-16 February 1993, INSEE-Méthodes Nos. 39-40, pp. 145-174.
GOLDEMBERG, J. et al. (1987), Energy for a Sustainable World. Washington DC: World Resources Institute.
LIPIETZ, A. (1995), “Capital-Labour Relations at the Dawn of the 21st Century” in Schor and You (eds.), Capital, The State and Labour: A Global Perspective. London: Edward Elgar.
LIPIETZ, A. (1997), “The Next Transformation” in Cangiani (ed.), The Milano Papers: Essays in Societal Alternatives. Montreal: Black Rose Book.
LIPIETZ, A. (1998), “Economie politique et écotaxes”, Report to the Prime Minister's Council for Economic Analysis, 16 April, Conseil d'Analyse Economique No. 8. Paris: La Documentation Française.
OECD (1997), Environmental Policy and Employment. Paris: OECD.
POLANYI, K. (1957), The Great Transformation. Boston: Beacon Press.
Working for World Ecological Sustainability: Towards a “New Great Transformation”
165
QUIRION, P. (1999), “Les conséquences sur l'emploi de la protection de l'environnement”, Doctoral thesis, Écoles des Mines de Paris.
WORLD COMMISSION ON ENVIRONMENT AND DEVELOPMENT (1995), Our Common Future. United Nations.
WORLD RESOURCES INSTITUTE (1990), World Resources 1990-1991: Guide to the Global Environment. Washington DC: World Resources Institute.
167
6
6Policy Drivers for a Long Boom 5by
6DeAnne Julius Monetary Policy Committee, Bank of England
The probability that the world economy will experience a sustained period of significantly higher growth – referred to throughout this volume as a long boom1 – during the first quarter of the 21st century is low. The statistical odds, judging from past history, are against it. Over the past two centuries, with the exception of post- war spurts of rebuilding, world growth appears to have stayed within a narrow track of around 3% during most periods.2 This is probably because economic growth is the by-product of such a complex web of technological, social, demo- graphic and political developments that even if trends in one or two of them take a sudden surge, the overall result is held in check by the others. Recent history does not even suggest that growth is rising. Despite rapid technological change and the absence of major wars, the 1990s and 1980s have seen slower world growth than the 1970s and 1960s.
Against this backdrop it may seem fanciful to consider the policy requirements for a long boom. Yet to say that such a boom is improbable is not to say that it is impossible. Supportive policy – however defined – is likely to be a necessary though by no means sufficient condition for it to develop. Given the transformation that a sustained period of high growth could bring to the lives of a large share of the world’s population, policies that could increase its probability deserve careful con- sideration. These may not be the same policies that deliver “growth as usual”, because a long boom is clearly unusual. Just as a runner setting out to break records in the marathon may need a different training regime from one whose goal is to improve a bit over last season’s average, so the policy drivers for a long boom may be more radical and arduous than the conventional prescriptions.
The type of policies needed will depend on the underlying dynamics of the boom itself. The first section below reviews the basic economic framework for decomposing growth into its constituent parts and suggests how each of these
The Future of the Global Economy: Towards a Long Boom?
168
might drive a long boom over the next quarter-century, given the initial conditions of the late 1990s. The sections following develop three geographic scenarios for long booms with different dynamics that depend in part on the technological, social and demographic characteristics. None of these scenarios is a “base case”, in the sense of a most likely forecast of world growth, since all are defined as out- side the bounds of historical probability. But as a thought exercise it is useful to have a stretch target – say, 3.5 to 4% average annual world growth for 25 years – to sharpen the focus on growth-enhancing policies. By specifying the fundamental drivers of each scenario it is possible to identify which policies would be most important, and which policies should be avoided, if such a boom is to be created and sustained. The scenarios are not mutually exclusive, but they are driven by quite different dynamics in order to clarify the logic involved in different pathways and to trace the political and social strands that accompany different economic outcomes. They represent three different ways that a long boom could be created if the facilitating policies were put into place. The final section compares these policies, identifies overlaps and contrasts the degree of policy infrastructure required to drive the three boom scenarios.
1. An economic decomposition of growth
At the most general level, the growth of world output (or GDP) depends on the growth of world inputs of labour and capital and the growth in efficiency of the process of turning inputs into outputs. The last term, variously called the Solow residual, disembodied technical change or total factor productivity (TFP), is esti- mated as the residual of an aggregate production function, with labour and capital as its independent variables. It is generally interpreted to include technological change, in the broadest sense. As well as new technology, TFP sweeps up manage- rial innovations, improvements in the quality of labour, regulatory changes, etc. While many restrictive assumptions are necessary to apply this framework in a strictly numerical sense,3 it is nonetheless useful in classifying the possible sources of a long boom into labour-led, capital-led and productivity-led. Combi- nations of these are used in the scenarios developed below, but at this stage it would be helpful to consider them separately.
a) Labour-led
A step-change in the labour input into the global production function over the next 25 years will not come from the OECD Member countries, which currently account for around 60% of world GDP. The labour force in most Member countries will peak during that period and the hours per worker are static or declining (OECD, 1998a). Japan is at the forefront of this trend. Its labour force may have already peaked (at 68.6 million in 1997) and the numbers are likely to fall rather
Policy Drivers for a Long Boom
169
rapidly as the population ages (Statistical Bureau, Government of Japan, 1998). In other OECD countries the trend towards earlier retirement, even if it merely stabi- lises at current levels, will bring labour force growth to an earlier end than has been predicted.
If there is to be a labour-led long boom, it will have to be strong enough in the developing countries to more than offset the fall in labour-based growth in OECD countries. This is certainly possible. There are three trends which could intertwine to create a huge increase in the economically productive labour force of developing countries. First, the demographic bulge from high reproductive rates over the past four decades will continue to increase the size of the working-age population for decades to come, despite declining population growth rates now in all regions. Second, the continuing shift of labour out of subsistence agriculture and into the market economy increases the effective size of the labour force for a given population profile. This process could be accelerated by advances in bio- technology and food production during the coming decades. Third, the long-term investment in primary and secondary education in developing countries is now delivering a rapidly rising share of skilled labour in the total workforce. The pro- portion of highly skilled is also rising, and in several Asian countries where educa- tion is highly valued, the share of the labour force with university-level qualifications has already overtaken that in several European countries. All three of these trends are well established and likely, over the next quarter-century, to bring about a step-change in the growth of the quality-adjusted, economically available labour force for the world economy. The scenario called “Growth Shift” is based partly on this labour-led dynamic.
b) Capital-led
Despite at least three decades of globalising capital markets, it is still the case that national investment rates are closely correlated with national savings rates.4 Although the world’s pool of savings is large and growing in absolute value, only a very small share crosses borders in search of the most productive invest- ment. Since it is highly unlikely that risk-adjusted rates of return on investment are already equal across countries, this implies that there must be scope for a step-change in capital-led growth through better allocation of global capital.
In the 1970s and 80s the focus was on raising savings rates in the developing countries and expanding the cross-border flow of investment funds from the slower-growing capital-rich countries to the faster-growing capital-scarce ones. Both of these roads to raising economic growth through capital-deepening were succeeding, spectacularly so in Asia. However, the financial crises beginning in 1997 in Thailand and spreading to Korea, Indonesia and then beyond Asia during 1998 have led to a sobering reassessment of capital-led growth.
The Future of the Global Economy: Towards a Long Boom?
170
With hindsight it is clear that investment can be too high as well as too low, especially when domestic financial institutions and corporate boards are weak or lack external checks and transparent accounts. In some countries the situation was further aggravated by devoting monetary policy to an exchange rate target that was under upward pressure from large inflows of foreign investment. Asset prices rose precipitously, wasteful investment was undertaken because of the artificially low cost of capital and the perception of foreign exchange risk, and the countries’ vulnerability to financial market turbulence – whether externally or domestically provoked – grew alarmingly. When the price bubbles burst and the exchange links broke, the shock and cross-country contagion was much greater than implied by pre-crisis risk premiums.5
Many of the policy lessons being drawn from the Asian crisis are not supportive of a long boom scenario. Tighter bank regulation, controls on short-term capital inflows, gradual debt workouts and larger stand-by arrangements by the interna- tional financial institutions may all be worthy, and in some cases even necessary, reactions to what has already occurred in the most affected countries. They may also help prevent similar crises in other countries in the future. But they are essentially damage-limitation devices rather than growth-enhancing ones. Two of the scenarios below, the aforementioned Growth Shift and another called “Growth Clusters”, develop alternative policies to facilitate a capital-led stimulus for a long boom.
c) Productivity-led
A step-change in (total factor) productivity growth is most futurologists’ favou- rite candidate for driving a long boom. This is logical, both because TFP growth has been the largest single contributor to overall economic growth in most coun- tries in most periods in the past, and because the evidence is all around us of rapid innovation in fundamental fields such as those relating to information and communications technology (ICTs), biotechnology, new materials, nanotechnology, etc.6 It is already clear that many of these have widespread applications across industrial sectors, and that some (particularly ICTs) are already changing the way businesses operate internally and the way they interact with their suppliers, employees and customers. As with the steam engine and the rise of the railroads, or the internal combustion engine and the spread of the automobile and road transport, such fundamental technologies can roll out over decades to transform organisational structures, industrial location, employment patterns and the social and environmental fabric of communities and cities.
The dynamics of such technology-led growth are so complex that broad-brush (but internally consistent) scenarios are one of the only tools available for their economic analysis.7 Each of the following scenarios is based on technology-led growth. The first depends on leading edge developments in new technologies and
Policy Drivers for a Long Boom
171
new applications of existing technologies. One important driver in the “Growth Leader” scenario is that firms in those countries that are the key players in ICT, bio- t e c h n o l o g y , a d v a n c e d a u t o m o t i v e d e v e l o p m e n t a n d o t h e r l a r g e - s c a l e research-intensive areas generate powerful growth spin-offs for the rest of their economies and reap the intellectual property rents from the rest of the world. Remaining at the leading edge of these technologies requires massive investment, which tends to mean that large firms in established markets reap the largest gains.
A second type of technology-led growth is through the application of catch-up technologies and transfer of best practice. In the Growth Shift scenario the main stimulus to growth comes from the transfer of new and existing technologies and their related organisational structures to production facilities outside the OECD Member countries. Coupled with the dynamic of rapidly expanding, well-educated but still relatively low-cost labour in the developing countries, and the shrinking workforce in the OECD countries, catch-up technology transfer creates a quick and powerful route to sustained higher growth in many developing countries.8
Third, the biggest technological impetus to growth in the first quarter of the 21st century may NOT come from any new breakthroughs that are made in the research labs of large companies and governments, but from an innovative explo- sion of small-scale applications of ICTs that transform supply and value chains in both the manufacturing and service sectors. The biggest beneficiaries of this would be small firms and highly skilled individuals who suddenly gain access to the same real-time information and global customer base that only large multinational firms had in the past. The optimal boundary between firm and market – between those activities that can most efficiently be carried out inside the firm and organised through hierarchies and those that are cheaper to outsource and organise through contracts (Williamson, 1975) – may already be shifting strongly towards markets. If technological and policy developments accelerate this shift, it could result in the scenario called Growth Clusters, in which communities of specialised firms and individuals congregate where their aggregate productivity is greater than the sum of their parts. The location of these clusters is partly serendipitous, partly influ- enced by history, geography and policy. But through their success in providing what the global consumer wants, they shape growth in their industries and link into each other for supplies and support, regardless of location.9
In addition to the organisational choice between firms and markets, the decentralising tendency of ICT will affect the relative efficiency of the public and private sectors. Much of the early rationale for public sector provision was based on economies of scale (telephones, transport, post offices, utilities) or informa- tional externalities (healthcare, higher education). Innovations in communication such as mobile telephones and e-mail, along with the near-zero cost of making information available to household decision makers (potential patients, students
The Future of the Global Economy: Towards a Long Boom?
172
and parents), will erode some of the advantages of state provision. Thus in Growth Clusters we finally see the long-heralded decline of the nation state.
2. Three geographic scenarios for a long boom
The focus of this book is on the possibility of a global long boom, for which there is no historical precedent. It is nonetheless the right focus, because the most striking initial condition of the 21st century is also without precedent: the degree of global interconnectedness. Not only (or even mostly) on the economic front, but also in scientific research, in popular fashion and music, in environmen- tal concerns and in news and current events, the world scale is more relevant than the nation scale. There are no island economies left.
Yet there are island governments. And it is the geographic dimension of any long boom that will determine policy, because policies are made and enforced by geographic entities: states; regional and international organisations; international treaties signed by states; communities and sub-regions with delegated authori- ties; etc. Thus we need to map the forces that could create a long boom into geographic scenarios that can provide the basis for policy.
Each of the three scenarios below is self-contained and built upon its own internal logic. Each is thus a stylised version of how the world might develop. No probabilities are assigned to them; each represents a logically possible but statis- tically improbable future. If they are well-built scenarios, then the real future is likely to contain elements of each. In that sense they are not mutually exclusive, and within each there may be some countries, or some industries, that follow other routes. As with economic models, scenarios inevitably simplify the world they attempt to portray in order to illuminate the key causal relationships and keep their size down to a manageable level. But, as the quantification in the last section shows, there is no scope for diluting the policy requirements in any of these scenarios without jeopardising their growth prospects. None provides an easy or automatic route to a long boom.
a) Growth Leader
In this scenario the United States consolidates its position as the economic and political hegemon for at least the first quarter of the 21st century. Its economic leadership derives from a complex of technological, macroeconomic and institu- tional features that provide a favourable environment for leading-edge, technol- ogy-led growth. Information/communications technology and, later, biotechnology evolve into the “general purpose technologies” (Lipsey, in this volume) that drive the long boom. In ICT, many of the leading-edge advantages that come from set- ting industry standards have been appropriated by US companies such as Microsoft, Oracle, Netscape and PeopleSoft. One reason is that breakthroughs in
Policy Drivers for a Long Boom
173
digital technology often come from individual entrepreneurs and small, start-up companies, both of which flourish in the low-tax, flexible-labour-market, equity-driven environment of the United States. Another is that when large-scale resources are required for the marketing and development of new ICTs, the com- petitive US market in corporate control facilitates the partnership or, more often, the purchase of start-ups by established players with easy access to the deep domestic capital markets.
The application of ICT to wave after wave of industrial sectors (continual re-engineering) continues to happen first and fastest in the United States, driven by domestic competition and shareholder-value pressures. This strong demand response to falling ICT costs creates a positive externality for the rest of the econ- omy. The cost-saving benefits of new ICT developments are broadly spread, enhancing the international competitiveness of US companies across a range of product and service sectors.
The social turbulence created by such Schumpeterian restructuring is aggra- vated by the wide and sudden differences in wealth created by equity-driven rewards. This degree of social disruption and income divergence is less politically tolerable in other OECD countries, yet it may be a necessary condition for gener- ating a long boom through rapid, technology-induced change.
Biotechnologies are also likely to advance fastest in the United States due to scale economies and the importance of pre-commercial research in universities and government labs. The protection of intellectual property rights (IPR), upon which the diffusion of biotechnology depends, is also well-established in the US market.
The macroeconomic fundamentals of the US economy as it enters the 21st century are supportive of this Growth Leader scenario. A decade of political wrangling over the budget – including such memorable extremes as a shutdown of federal government spending and Congressional threats of default on the national debt – has finally resulted in a sustainable budgetary balance which turns into an ever-growing surplus (at current tax rates) under even modest assumptions of eco- nomic growth (US Congressional Budget Office, 1998). In the US political context, there can be little doubt that such emerging surpluses would result in tax cuts rather than spending increases. This tight fiscal position allows the monetary stance to be accommodating, which both economic theory and comparative history suggest is the optimal policy mix for sustainable (investment-led) high growth with low inflation. Despite low interest rates, the dollar is likely to rise against the euro in this scenario, reflecting the relative productivity improvement in the United States and acting as a brake on the international competitiveness of US firms.
US political leadership, derived initially from the collapse of the Soviet superpower in the late 1980s, was reinforced by the difficulty the European states had in agreeing common foreign and defence policies during the 1990s and by the
The Future of the Global Economy: Towards a Long Boom?
174
long-running Japanese recession which weakened Japan’s political influence both in Asia and beyond. With each crisis that arose – Iraq, Bosnia, Korea, Indonesia, Russia – it became increasingly clear that US leadership was required for interna- tional action to take place. Thus, in Growth Leader, policy initiatives in the early 21st century have to match the US agenda.
Europe and Japan also benefit from technology-led growth in some sectors and through their market integration with the United States. European companies continue to lead in chemicals and pharmaceuticals, and many of those in service sectors gain from the scale advantages and competitive spur provided by the introduction of the euro across most of the single market just after the millennium. Japanese companies retain their lead in consumer electronics, computer peripher- als and advanced automotive engineering (including hybrid electric/gasoline models and car navigation systems). The commitment to research and the close integration of design and production in large Japanese companies help them to regain their competitive prowess in this scenario, where scale and efficiency are keys to remaining at the technological frontier.
Although their economic growth is strong, on the social and political front this is an uncomfortable world for Europe and Japan. The hyper-competitive pressures emanating from the United States, coupled with its undisputed political clout on the international stage, mean that there are continual commercial and policy pres- sures to converge toward the US socio-economic and legal models. In Europe the burden of high social overhead costs must be reduced, pension financing reform becomes an urgent budgetary priority, agricultural support payments are increas- ingly disciplined through the WTO, and European governments more generally are forced to scale back their activities for budgetary reasons. All of these changes are growth-enhancing in the long run, but they require wrenching political trade-offs.
In Japan the current economic crisis has already provoked a number of TV com- mentators and editorial writers to campaign for a complete redesign of the Japanese economic system based on “Anglo-American style capitalism” (Fukushima, 1998). The Japan Association of Business Executives, Keizai Doyukai, recently published a booklet entitled “Declaration of Market Ideology” which argues for corporate gover- nance along American lines. A decade of further restructuring ensues – first in bank- ing, then in the corporate sector – as Japan transforms itself yet again. By 2010 Japanese companies and banks are again leading many world rankings and the domestic service sector has been dramatically modernised by new investment.
For the developing countries too, there is economic gain coupled with some political pain in Growth Leader. Latin America gains from its proximity to the US market, but it chafes under the renewed influence of US banks and multina- tionals on its domestic politics, both directly and indirectly through the central role of the United States in shaping IMF and World Bank policies. East Asian
Policy Drivers for a Long Boom
175
countries, especially China, are also vulnerable to political strains with the United States but their ties with its West Coast, where much of the ICT development takes place, bring high economic rewards.
For this scenario to deliver the long boom on which it has been predicated, international policy initiatives have to reflect US priorities, and the domestic pol- icy refrain outside the United States becomes (with apologies to Frank Sinatra), “We did it your way!” Most of the policy reform would be domestic, driven by the pervasive pressures of policy competition in this economically integrated world. In most European countries the focus would be on labour market reform to increase flexibility, fiscal consolidation to allow tax rates to fall, privatisation of state-owned industries, and the gradual scaling back of welfare support, probably through tighter eligibility criteria. This is an agenda scarcely likely to appeal to the eleven of fifteen EU countries currently led by socialist, or at least left-of-centre, governments. The pressures for change would come from the corporate sector, faced with the competitive need to restructure their businesses based on falling ICT costs, and from institutional shareholders managing internationally diversified investment portfolios. Profit performance by the “best in class” in each industry would rapidly become the yardstick by which other firms in that industry are judged. Individual share prices often exhibit winner-take-all behaviour in their overshoots and crashes as international investors reassess their company rank- ings. This would put strong pressure on corporate management to follow industry leaders (often headquartered in the United States) in downsizing or outsourcing.
At the international policy level, few initiatives would be required – or could be delivered – in this scenario. The basic thrust of postwar trade and investment liber- alisation would be maintained. However, US attempts to focus new WTO rounds on IPR and sectoral negotiations in services (taking further the financial services and telecommunications agreements and adding new service sectors), rather than on the “old” areas of agriculture and textiles, would be resisted as unwelcome action to undermine the “grand bargain” tradition of past rounds. Those international institu- tions with a structure that allows a heavy US influence would grow in importance – e.g. the IMF, the World Bank, the OECD, NATO – while those that do not would decline, at least in relative importance – e.g. the UN, the WTO, the ILO. The United States would often take the route of bilateral negotiations in areas of particular interest such as intellectual property (as it has done with Korea, Chinese Taipei, Japan and others), which would tend to spread US standards directly and thereby reinforce the competitive position of its companies. The response to international crises, whether of political or financial origin, would become more ad hoc and based on personal diplomacy rather than formal institutional structures.
As long as the United States Government remains committed to international engagement and to building a new world order, albeit in their own image, then
The Future of the Global Economy: Towards a Long Boom?
176
Growth Leader can deliver a long boom, led by those countries that can converge most rapidly and successfully on the US economic model.10 Laissez-faire capitalism provides a highly nourishing culture for growth by the strongest and most enter- prising firms. And inside existing firms and government organisations there is still a huge potential for x-efficiency gains in productivity if downsizing and re-engineering were to be ruthlessly pursued. But this scenario has a fragile political base, partic- ularly in Europe and in the larger developing countries where US influence is likely to be most resented. It is also vulnerable to swings of political opinion in the United States and it is difficult to see how global environmental problems could be tackled. It is not an attractive scenario for most of the world, and its polit- ical feasibility is its weakest link.
b) Growth Shift
In this scenario the economic centre of gravity of the world economy shifts decisively from the OECD countries to the emerging market economies11 (EMEs) in Asia and Latin America. This shift is driven by an economic dynamic in the EMEs and by a coincident but independent social dynamic in North America, Europe and Japan.
In the richer countries of the OECD, the shift in consumer preferences towards services and away from goods, which began in the1980s but slowed in the 1990s, gathers pace in the early decades of the 21st century. This is partly because many services, especially customised ones, are “luxury goods” for which demand grows more rapidly than income as income itself rises. Gourmet meals in fine restaurants are an example. As household income increases, expenditure on such meals rises from a once-a-year anniversary treat to a once-a-month outing with friends. Holi- days abroad are another example; the statistical relationship between demand and income traces a classic S-curve shape. When an economy’s average income level passes into the steep part of the curve, total demand tends to grow very rap- idly for a decade or two. This provides a strong growth stimulus to those industries supplying such luxury goods. As the two examples above demonstrate, such industries may be domestic (because essentially non-tradable) or foreign. But when customising is involved, the domestic element tends to increase.
The ongoing shift in the OECD consumption basket towards (mostly non-traded) services (e.g. entertainment, leisure activities, gardening, education, health) and away from goods (e.g. food, clothing, appliances, automobiles) has a profound effect on employment creation, relative wage rates, and manufacturing industry’s choice of location for expansion. Services tend to be more labour inten- sive than goods, and less susceptible to automation. Thus the demand for labour in the service industries rises by more than it falls in the OECD countries’ manu- facturing industries. At the same time, because of demographic change, the overall
Policy Drivers for a Long Boom
177
supply of labour is stagnant or shrinking in most of the Member countries. Average real wages are bid up despite low productivity growth in the service sectors. In some countries this leads to higher immigration, but in most it simply widens the gap between inflation in goods and services.12
Although at the millennium most manufacturers’ largest markets are still in the OECD countries, demand growth there is stagnating while EME demand is acceler- ating. Coupled with the rise in wage costs in the OECD, and the increasingly well-educated workforce in the EMEs, it makes overwhelming sense to locate new production in the EMEs. As policy reforms lower the commercial and financial risks associated with investment in those countries, some existing capacity in Member country markets is also closed in favour of new capacity in the EMEs. By 2025 the share of manufacturing employment in the OECD countries is below 10%.13
Demographics and the prospect of medical advances from biotechnology pro- vide additional drivers for Growth Shift. The rise in population share of retired people in OECD countries over the next decades will be dramatic. For the OECD area as a whole the dependency ratio14 will rise from below 55% in 1990 to nearly 65% by 2030, with most of this increase in the retired end of the age range. In the most extreme case, Japan, the ratio will go from below 45% in 1990 to nearly 70% by 2030. The social welfare implications of this shift will put increasing strains on the tax and spending requirements of those countries – mostly in Continental Europe – whose pension systems are primarily state-financed. But while change may be difficult and protracted, these are wealthy countries whose retirees are increasingly among the most financially sophisticated and politically influential groups in society. Their long-term interests are unlikely to be neglected.
The young and well-educated have considerable bargaining power in the workplace. Their skills are in demand and many of them work in sectors that are sheltered from international competition. The scope for collusive behaviour is high, by the younger generation in the workplace and by the older generation with time to devote to special interest groups. OECD countries in Growth Shift are clas- sic examples of Mancur Olson’s “stable societies with unchanged boundaries” which “tend to accumulate more collusions and organisations for collective action over time… Special interest organisations and collusions reduce efficiency and aggregate income” (Olson, 1982). Yet many of these special interest groups also contribute to society through their work in the voluntary sector, improving the local environment and providing social services to those in need. Such charitable work is not counted in the GDP but it clearly contributes to the quality of life, both of those providing the services and of those who benefit from them.
Medical advances, both in drugs (Viagra) and in interactive treatment/preven- tion therapies (physiotherapy, massage, health clubs, spas) are of particular inter- est to the affluent retirees with time to spare. As knowledge expands and brings
The Future of the Global Economy: Towards a Long Boom?
178
new drugs and treatments to the market-place, a growing share of expenditure (either private or public, depending on the healthcare delivery system) will be devoted to health and medical services. As with leisure services, a large share of these is non-tradable.
There are two key differences between the retirees of the 1970s and 1980s and those of 2000-25: the latter are healthier and wealthier. Medical technology and pharmaceuticals that are now under trial (e.g. for cancer detection, osteoporo- sis) will greatly improve the quality of life and extend the productive potential of the retirees. And they will have money, as well as time and energy, to spend. In the United States 80% of financial assets belong to people over 55. In Europe, because of the wars and hyperinflation of the 1914-44 period, the generation retir- ing over the next decade is the first to inherit significant housing wealth from their parents. In Japan, because of high savings rates, the average household already has net financial assets equivalent to 2.3 times its annual income. This is why “there is no sense of urgency from the ordinary Japanese citizen for demanding a higher growth rate” (Fukushima, 1998).
Savings and pension investment funds, whether publicly or privately funded, will become significant players in international asset allocation. The numbers involved are already enormous. In the United States the total assets of the mutual fund industry (many of which are held in 401k retirement accounts) are as large as those of the banking industry at around $5 trillion (Hale, 1998). The number of funds offering international equity investments expanded from 29 in 1984 to 543 in 1996, with assets of over $215 billion. American pension funds began diversify- ing earlier and had over $480 billion in foreign markets by the end of 1996. Most of these foreign assets are elsewhere in the OECD countries, but over the early decades of the next century, as OECD area growth rates slow, fund managers increasingly look to stock markets in EMEs to boost their portfolio returns.
The net result is that the OECD countries in Growth Shift become capital-rich rent- ier societies working fewer hours, spending more time on leisure and family-related pursuits, retiring earlier and specialising in end-user services such as art, fashion, sports, tourism, gardening and home improvements, health and education. Their rate of economic growth slows (to around 1% p.a.), while their labour force is shrink- ing. Thus the low average growth rate accommodates a faster growth in labour income for those in the workforce and a higher marginal propensity to consume (because of accumulated savings) of many of those no longer in the workforce.
Meanwhile in the developing countries, achieving high rates of economic growth and the rise in living standards it brings remains the top priority, pursued with renewed vigour and determination after the unexpected setback of the late 1990s “Asian crisis”. The silver lining in that crisis was the cathartic effect it had in sweeping away the old corporate structures and bureaucratic powers in the
Policy Drivers for a Long Boom
179
most affected countries that had contributed to inefficient investment and poor risk management. With the vested interests gone or fatally weakened, exchange rates reset at hyper-competitive levels, domestic industries more open than ever to foreign direct investment (FDI) and macroeconomic stability regained, the area known as “developing Asia” enters the 21st century poised to be a huge engine for economic growth.
The critical policy requirements for a long boom in this scenario are mostly at the international level. They are the policies needed to support a major increase in cross-border trade and capital flows from OECD countries to the EMEs. On the trade front there must be a continuation of WTO-bound trade liberalisation, lower- ing tariffs further in those sectors where protection is still high and finally bringing textiles and agricultural products under the full WTO disciplines. China and Russia should be brought into the WTO by 2000. The resources available to the WTO Sec- retariat should be doubled to enable it to provide the intellectual leadership and negotiating support necessary to make rapid progress in these difficult areas.
FDI represents the quickest route to raising total factor productivity in the EMEs and to penetration of the OECD market-place by goods produced in devel- oping countries. Both greenfield investment and mergers/acquisitions are means to these ends. Several Asian countries have already eliminated or raised their ceilings on the share of foreign ownership that is allowed, and there are signs of some companies in Member countries reviving their investment plans. With the collapse of the Multilateral Agreement on Investment (MAI) negotiations at the OECD in 1998, it is important that FDI be brought fully onto the WTO agenda (not just trade-related investment). The author has suggested elsewhere that the WTO dispute settlement procedures should be made available for disputes over FDI, and that the private companies involved in any such international disputes should be given full access as affected parties (Julius, 1994).
Restarting cross-border bank lending and stimulating portfolio investment by OECD country pension funds into the stock markets of the EMEs will require pol- icy changes on both sides. The “Asian crisis” has dealt a severe blow to the appe- tite for cross-border financial flows by both lenders and recipients. Yet large increases in such flows are essential if demand and output in the EMEs are to recover promptly and lay the groundwork for the production shift that drives this long boom. The EMEs will need to increase transparency in their banking systems, inject new discipline into corporate sector governance and apply international accounting standards to corporate accounts. Such reforms will make it easier for Member country fund and bank managers to assess risk and compare returns with those available from similar companies in home markets. In Growth Shift it would rapidly become obvious that the highest returns were in the EMEs. International agreements are not necessary to achieve such reforms, but they could be
The Future of the Global Economy: Towards a Long Boom?
180
encouraged by IMF and Bank for International Settlements (BIS) discussions with EME governments and central banks.
To allow the share of pension fund investment going into EMEs to increase, it will also be necessary to liberalise pension investment rules in some of the OECD countries. Member country pension reform more generally is needed in this sce- nario. With the exceptions of the United States, the United Kingdom, Switzerland and possibly Australia,15 state-provided benefits will have to be reduced, tax incentives increased for private pension contributions, and restrictions on where pension funds can invest relaxed to allow asset diversification.
Cross-border investment of all kinds would be hugely facilitated if stable exchange rates could be established between the investing and recipient coun- tries. There is no easy or low-risk way of achieving this in a world of deeply inte- grated and open capital markets. But the major historical period of large-scale long-term investment by Europeans in Latin American railway and other bonds took place during the gold standard era. The closest modern equivalent is the currency board.
In Growth Shift a system of regional currency boards gradually develops. Not all developing countries choose this route (or manage to stick to it once chosen), but many of the Latin American countries adopt the US dollar; the euro is favoured by eastern European countries, parts of Africa and the non-oil-exporters of the Middle East; and hybrid varieties including the dollar, euro and yen are adopted by many Asian countries and the oil-exporters. This requires some accommodation by the three anchor central banks in terms of money creation, which is co-ordinated through the IMF just after the millennium. Although exchange rate targets are not agreed, the heads of the three central banks pledge themselves to the same target range for inflation in order to stabilise expectations about exchange rate movements among the big three currencies.
Because this is a world where the economic interests of the OECD and EME countries are so clearly intertwined, it is easier to reach international agreement on global environmental protocols.16 Industrial energy use shifts to the EMEs along with manufacturing capacity. A system of tradable permits for carbon emis- sions, with initial country allocations based partly on population and partly on cur- rent energy use, is agreed, with global patterns to be reviewed every five years. Trading (i.e. buying and selling) is freely permitted as long as trades are transpar- ently registered with a central record-keeping authority. However, this system does not really start to bring about significant reductions in global carbon emis- sions until it is joined by a tax and regulatory drive, led by OECD countries, to raise the share of renewable energy in their own total energy consumption. The resulting increase in demand for solar panels, underpinned by rising government targets looking ten years ahead, brings the unit cost of solar energy down sharply
Policy Drivers for a Long Boom
181
through capturing economies of scale, which also makes it the economic choice for new generating capacity in many developing countries.
c) Growth Clusters
In both Growth Leader and Growth Shift, the policies that permit rapid growth are national policies, sometimes internationally agreed. By contrast, in Growth Clusters the critical geographic unit of growth is not the nation but the city or small geographic region.17 Thus in different global industries the leading-edge compa- nies are found in such places as Singapore, Silicon Valley, Shenzhen, the City of London and Canary Wharf, Route 128 around Boston, Bangalore, the Hsinchu Science Park outside Taipei, Paris and Milan.
In this scenario, the communications revolution built on the Internet during the 1990s creates a step-change in productivity growth in the 21st century like that of the Industrial Revolution in the 19th century. As with the development of mass production, the disappearance of communication costs transforms the economic supply chain that links suppliers to producers to customers. The difference is that cyberspace transfer of knowledge, co-ordination of production, and advertising/ sale of product are almost instantaneous. The cities and regions that are home to the dynamic companies that develop new ways to produce, distribute and sell quickly rise above their neighbours and connect to each other like nodes on a global economic overlay.
The driving forces in this scenario are network competition and agglomeration economies. While competition between companies is fierce – made fiercer for being global – it has shifted onto a more complex plain that is also more difficult to regulate. Network competition is often about competing standards – e.g. operating systems or Internet browsers in computers, GSM versus CDMA in cel- lular telephony. The company or group of co-operating companies whose standard becomes the generally accepted one gains a huge advantage. But the consumer also gains from a generally accepted standard; indeed, without it, the gains from rapid diffusion of technology will not bring about the long wave of growth on which this scenario is predicated.
Agglomeration economies are the gains to one firm derived from locating itself close to other firms or to its key customers. Early work in economic geography used the idea to explain the location and growth of cities, where the gains were primarily in terms of savings in transport costs either of inputs from other firms or outputs to final consumers (e.g. cities with ports or at railway nodes). More recently the growth of industrial clusters has been studied by Rosabeth Moss Kanter (1995) and Michael Porter (1998) as a basis to advise cities and regions on enhancing their attractiveness for inward investment and job creation.
The Future of the Global Economy: Towards a Long Boom?
182
Clustering is particularly evident in rapidly changing industries that are inten- sive in highly skilled or highly specialised people, such as software development, financial services, leading-edge medical care and cinematography. New firms are formed in the cluster, new people are hired or poached from other firms already there, independent contractors or consultants set up locally to provide specialist skills particularly to new firms, and the entire cluster grows in its attractiveness to both customers and competitors. The initial location of such private sector growth is often serendipitous, but when it is supported by public sector investment in infrastructure (e.g., modern airport development), speedy processes for planning permission and reasonable tax policies, then a powerful dynamic for regional growth is created.
While local politics is probably the biggest obstacle to the creation of a growth cluster, there are also intrinsic geographic elements that come into play. Being “too close” to an already successful cluster can be a severe limitation. The hopeful new- comer faces almost insurmountable competition from the established rival, both for resources and in terms of the choice and depth of what can be offered to the cus- tomer. For example, in the airline industry a carrier whose hub is at a large estab- lished airport with frequent flights (some by rivals) to the most popular locations and short transfer times for connecting passengers can command higher prices than a new competitor operating from a smaller city nearby or a less established airport. The customer clearly benefits from (and therefore is willing to pay for) the concen- tration of flights at a single source that permits greater frequency and ease of rescheduling. Another example is the difficulty of establishing local theatre compa- nies in suburban towns close to a major theatre centre such as London. The best actors and directors can always earn more in London where the theatres and audi- ences are larger, while the suburban theatre-goers are reluctant to pay London prices for a local performance, however professional.
For global financial centres the time zone is a critical geographic limita- tion. As dealers in a firm with offices around the world pass the trading book from one centre to another in 24-hour markets such as foreign exchange, it makes economic sense to concentrate trading activity in just three or four cit- ies where 8-hour/day markets can touch. With New York and London long established in two of those zones, it would be difficult for Boston or Frankfurt to take over their lead roles in foreign exchange dealing. In East Asia, by con- trast, exchange markets are newer and there is less difference in the volume of business done in Tokyo, Hong Kong and Singapore; regional dominance is not yet established.
In a world of relatively free trade, capital and information flows, the hard-to-shift advantages conferred by history and geography may be the key determinants of high-growth industrial location. The long-term effects of this
Policy Drivers for a Long Boom
183
on social patterns and income distribution are difficult to predict. Agglomera- tion economies have their own self-correcting mechanism built in. A cluster becomes more and more attractive for a certain industry and its relations for a time, but at some point the cost of fixed assets such as land and well-located buildings starts to rise and congestion externalities begin to erode productiv- ity growth. This puts limits on the attraction of capital and highly skilled peo- p l e i n t o e x i s t i n g c l u s t e r s . N e w o n e s w i l l f o r m a r o u n d e n t r e p r e n e u r s o r investors who choose unspoilt, low-cost locations for those reasons. There are also some new service industries, such as call centres, where ICT has allowed the jobs to move to the available workers rather than vice versa. Call centres have been a major source of new employment in the north of England, Ireland, p a r t s o f I n d i a a n d J a m a i c a . T h e r e a r e a l s o t w o u b i q u i t o u s i n d u s t r i e s – agriculture and tourism – which are unlikely to be subject to job clustering.
For all these reasons, clusters are likely to prove more significant for out- put (GDP) than for employment, and if overall economic growth is high then new cluster creation is rapid. The social risk in Growth Clusters is that regional disparities in per capita income within countries may increase. However, there are also at least two offsetting socio-economic benefits created by Growth Clusters. First, ICT, including the Internet, enables many otherwise isolated entrepreneurs and small firms with specialised skills or new products to access the global marketplace. This helps them overcome whatever national, ethnic or locational disadvantages that might otherwise hold them back. ICT also brings cross-border educational opportunities through distance learning courses to people who could never afford to travel to attend such courses in person. And second, beyond the economic benefits, ICT enables people to stay in touch with their relatives and friends more easily, cheaply and directly than ever before. It is hard to place a value on these largely free gains in social inclusion, but the rise in cyber cafés for youth around the world and the grow- ing use of Internet e-mail by the elderly attest to the ability of ICT to benefit socially vulnerable groups.
The “winners and losers” table of countries is also more difficult to predict in this scenario than in the others. ICT has levelled the playing field for firms and communities regardless of their country affiliation. Countries with a tradi- tion of small-scale enterprises (India, Taiwan, Italy) might be expected to thrive. Those with highly educated, English-speaking business classes would h a v e a n a d v a n t a g e ( I n d i a a g a i n , K o r e a , t h e P h i l i p p i n e s , S o u t h A f r i c a ) . City-states such as Singapore and Hong Kong, China and successful small countries such as the Netherlands have always thought in terms of clusters, hubs and networking in their policy design. Japan might have particular diffi- culty adapting in this scenario because of its distinctive language, hierarchical culture and high local costs relative to the rest of Asia.18
The Future of the Global Economy: Towards a Long Boom?
184
Many of the policy requirements for economic success in Growth Clusters relate to the cluster itself. To promote and sustain a cluster it will be necessary to have high-quality inputs in the form of educated people and efficient infrastruc- ture. But the real gains in productivity, at least according to Michael Porter (1998), come from complementary investments and policies by the public and private sectors:
Leaders of businesses, government, and institutions all have a stake – and a role to play – in the new economics of competition. Clusters reveal the mutual dependence and collective responsibility of all these entities for creating the conditions for productive competition. […] The lines between public and private investment blur. Companies, no less than governments and universities, have a stake in education. Universi- ties have a stake in the competitiveness of local businesses. By revealing the process by which wealth is actually created in an economy, clusters open new public-private avenues for constructive action.
Such partnerships between firms and local governments would also be an effective way to tackle pollution, congestion and other local environmental prob- lems. It is possible that this model could be scaled up to the international level, where there is already substantial advisory participation by business leaders (e.g. at the Rio and Kyoto conferences). But it is difficult to see how the private sector could take the initiative on an issue such as global warming where the trade-offs between countries are central to its solution.
Growth Clusters are more likely to develop if global standards and global net- works are allowed to evolve in response to competitive pressures and customer choice. Thus beyond productivity-enhancing local policies and partnerships, a global long boom will require international advances in competition policy, intel- lectual property protection, and the relatively untracked field of policies relating to electronic commerce.
Competition policy may be the most difficult. To allow market-driven devel- opment of global standards, governments will have to redefine some of their tra- ditional tests for monopoly power, contestability and anti-competitive behaviour. The current US Government case against Microsoft illustrates how complex the issues are. The triple-jeopardy faced by American Airlines and British Airways in their battle with regulators in Washington, London and Brussels for approval of their airline alliance demonstrates another flaw in the current approach. When the relevant market is worldwide, the need for consultation and then mutual recogni- tion of regulatory approval is urgent. International jurisdiction is probably an impossible dream.
The Internet makes intellectual property protection and the policing of IPR violations more difficult. Yet without it the gains in information exchange and
Policy Drivers for a Long Boom
185
market penetration by small companies are unlikely to be sustainable. Because information is global, the appropriate policy forum for most IPR discussions is the WTO. Its mandate should be extended beyond trade-related intellectual property and its dispute settlement procedures made more open and transparent to the companies concerned.
Finally, electronic commerce, upon which the high growth of this scenario depends, will need to be nurtured by supportive regulation. A substantive start towards defining regulatory principles was made at the October 1998 OECD Ministe- rial Conference.19 The basic thrust is that tax treatment should be neutral between electronic and conventional commerce; that business and governments should work together to protect and enforce IPR in cyberspace without imposing burdens on intermediaries; that government policies should facilitate market-driven standards that are interoperable; and that mutual recognition of regulatory schemes for pri- vacy or consumer protection is crucial. Much thinking remains to be done, however, in jurisdiction, choice of law agreement, and enforcement issues.
This scenario also has implications for the evolution of government policies. As e-commerce comes to represent a large share of total consumption, its taxation will become more complex, especially for countries with VAT systems. The current trend of moving from direct (income and profits) taxation to indirect (sales and value-added) taxation is likely to be reversed. The domicile of people and firms is easier to track than their transactions.
Common standards of all types facilitate e-commerce as long as they are mar- ket-driven, voluntary and (thus) open to competitive challenge. English would become even more widely used as the language of business. Generally Accepted Accounting Principles (GAAP) would be voluntarily adopted by companies across the clusters to attract equity investors. Two or possibly three currencies – the dol- lar, the Euro and the yuan – would come to dominate world commerce with most prices quoted in them. The choice of currency would generally be determined by what the customer uses, not the producer. Banks would offer special international charge cards to facilitate e-commerce purchases with minimal transaction costs and liability coverage for fraud. Such shifts in the burden of consumer protection from regulators to private firms would be a central feature of Growth Clusters.
3. Policy overview for a long boom
This chapter has presented three scenarios, each of which could deliver a quarter-century of above-average world economic growth. Growth Leader does this through productivity gains by big firms and governments based on large-scale, leading-edge technology in information/communications and biotech- nology, driven by economic and policy competition emanating mostly from the United States. In Growth Shift global productivity gains come from the transfer of
The Future of the Global Economy: Towards a Long Boom?
186
production and technology to emerging market countries where the skilled labour force is rapidly expanding. OECD countries become low-growth, but high-income, rentier societies where employment and spending are increasingly focused on ser- vices. Growth Clusters is truly a new world order where the role of national govern- ments withers and private/public partnerships at the local level are the deciding factor for competitiveness. Productivity growth is driven by the reshaping of global distribution (supply and value chains) by the rise of electronic commerce and the new opportunities it brings to individuals and small firms, regardless of location.
GDP growth rates consistent with these scenarios are shown in Table 1. The OECD countries would continue at roughly their present growth rates in Growth Clusters, with higher productivity growth offsetting the fall in labour force growth. In Growth Leader the whole OECD area would achieve the high growth perfor- mance of the United States during its 1990s upswing. This would require total fac- tor productivity growth approaching 2.5% per year for 25 years, which is outside the historical bounds derived from a growth accounting framework. It would require serious corporate and public sector restructuring to capture x-efficiency gains as well as technology-led growth. The OECD countries’ slowdown in Growth Shift reflects the structural shift of their economies towards services, with their lower productivity growth, as well as the preference shift from labour to leisure, especially by older people.
For the developing world, all of the scenarios show higher growth than that experienced over the past two decades.20 This is consistent with the optimistic intent of long boom scenarios that are not constrained by including a maximum likelihood case. Indeed, it is not possible to create a global long boom unless developing countries do better than they have recently. Their performance in Growth Leader is only slightly better than the recent average, since little of the leading-edge technology development takes place outside OECD countries, and the international policy climate is only marginally better for the developing world in this scenario than at present. In Growth Clusters there is a rapid trans- formation of growth potential around key cities and enterprise zones in the developing world, which pulls them into the global (electronic) market-place
Table 1. GDP growth 2000-2025 Average annual percentage
Growth Leader Growth Shift Growth Clusters
OECD countries 3.0 1.0 2.5 Non-OECD 4.5 6.0 5.0 World 3.7 3.7 3.7
Source: Author.
Policy Drivers for a Long Boom
187
much faster than was possible in the past. And in Growth Shift emerging market economies show very strong growth as catch-up technology and skilled workers enable them to leapfrog in some sectors to the levels of productivity seen in industrial countries today. The prices of manufactured goods fall, their produc- tion shifts to the developing world, and trade volumes grow at double-digit rates for more than a decade.
These divergent growth rates in the OECD and developing countries create strikingly different distributions of world GDP by 2025 in the three cases, as shown in Table 2. In Global Leader world output is evenly split between developed and developing countries, compared to the roughly 60/40 split at present. However, in Growth Shift today’s balance has been decidedly reversed in favour of the developing world.21
From the discussion above it is possible to identify three common interna- tional policy requirements for a long boom and the key additional policy areas for developed and developing countries in each scenario. Before listing these, how- ever, there are three more general comparisons that can be made about the policy intensity and focus of the different scenarios.
First, all three scenarios require major policy reform or new initiatives in some parts of the world in order to deliver a long boom. Even with optimistic assumptions about technology drivers, sustained high growth depends on policy change.
Second, the focus for policy action is at different levels in the three scenarios. In Growth Leader it is predominantly national governments that need to reform their labour and welfare policies (in the OECD countries) and restructure corporate con- trol and foreign ownership laws (in the developing countries). In Growth Shift the major policy action is at the international level through the WTO and IMF; this enables the acceleration of trade and capital flows that drive world growth. Growth Shift is also the scenario that has the best chance of tackling global environmental problems. In Growth Clusters the private sector takes the lead, both at local/regional
Table 2. World GDP shares
2000 Growth Leader
2025 Growth Shift
2025 Growth Clusters
2025
OECD 60 51 31 45 Non-OECD 40 49 69 55 World 100 100 100 100
Source: Author.
The Future of the Global Economy: Towards a Long Boom?
188
and at international levels, often working in partnership with the public sector to develop growth-enhancing infrastructure and to define the principles for self- regulation and broadly compatible standards in electronic commerce.
Third, while all scenarios require policy action to deliver high growth, the degree of policy change – what one might call the “policy intensity” – differs among the three. Growth Shift has the highest policy intensity, but it also has a higher upside to growth than the other two22 and is the only scenario likely to address global warming concerns. Growth Clusters needs less actual policy change, but it rests upon private/public mechanisms that are still in their infancy and deals with the virgin area of electronic commerce with few policy signposts to guide it. Growth Leader has the lowest policy intensity; it requires few changes in the United States or at the international level, and its internal competitive pres- sures would produce strong domestic forces for political change in Europe, Japan and beyond the OECD area. However, many of these changes would be politically difficult to achieve, and the scenario is vulnerable to opinion shifts in the United States as well as to global environmental threats.
At the international level there are three policy priorities that are common to all scenarios:
– Trade liberalisation – As a minimum (in Growth Leader and Growth Clusters) the current international undertakings through the WTO must be main- tained, anti-dumping complaints resisted and rulings by the WTO’s dispute settlement panels complied with. There are worrying indications, from steel to bananas, that the current economic slowdown, the price effects of recent devaluations in East Asia and the looming US election season may combine to increase trade frictions. Backsliding on openness to trade would swiftly kill any hopes of a long boom in the new millennium. In Growth Shift the WTO process for liberalisation and expansion needs to be accelerated. Textiles and agriculture need finally to be brought under full WTO disciplines. China and Russia need to be brought quickly into membership. To do this, as well as handling the broader agenda of issues below, the resources available to the WTO Secretariat would need to be substantially increased.
– Intellectual property protection – All three scenarios rely on the rapid transfer of new information/communications and other technologies between OECD countries and the emerging market economies (in Growth Leader and Growth Shift) or high-growth clusters (in Growth Clusters) in other parts of the world. Unless intellectual property rights are protected and enforced, this transfer will not take place. With growth increasingly dependent on these technologies, concerns about IPR could lead to new technological access barriers against those countries where lack of enforcement is suspected.
Policy Drivers for a Long Boom
189
The start made in the Uruguay Round on trade-related intellectual property needs to be broadened to all IPR, and a special focus should be given to the problems of copyright and related protection needed for electronic commerce.
– Foreign direct investment – Both greenfield investment and substantial equity investments (up to and including 100% ownership) will need to be acceler- ated to generate the higher growth rates in developing countries that all three scenarios postulate. One of the painful lessons of the 1997/98 Asian crisis is that short-term portfolio flows and cross-border bank lending do not provide a sound basis for long-term development. They can be helpful at the margin, but they also carry high risks for small economies with thin financial markets and vulnerable exchange rates. Since the collapse of the MAI negotiations at the OECD, it is even more important that FDI (not just trade-related investment) be brought fully onto the WTO agenda. Its dispute settlement procedures should be opened to companies and governments where they are the directly affected parties.
In addition to these common international policy priorities, it may be helpful to highlight the single most important enabling policy focus for OECD and developing countries in each scenario. These are shown in Table 3.
Even with fair geopolitical and technological tailwinds, the extent of policy change required to reach a higher global growth path is sobering. None of these sce- narios is easy to achieve, and only one may be capable of early action on global environmental concerns. Yet taken together, they suggest a set of policy priorities
Table 3. Key enabling policies
Growth Leader Growth Shift Growth Clusters
OECD countries Domestic economic restructuring to improve flexibility in the EU and openness in Japan/Asia
Pension reform, both in financing and to remove investment restrictions
Competition policy reform to better accommodate ICT and other network industry growth
Non-OECD countries US-style corporate governance and accounting transparency
Open trade and FDI-friendly policies, especially in manufacturing
Physical and policy infrastructure for linking into e-commerce
Source: Author.
The Future of the Global Economy: Towards a Long Boom?
190
that can significantly raise the chances of a global long boom. It is worth remem- bering that such scenarios are not mutually exclusive. In this case, the policies conducive to the success of one are not detrimental to the others. Predicting the future developments that differentiate the three scenarios – both in technology and in politics – is a hazardous game. Proceeding on all three policy fronts is the best bet for the new millennium.
Policy Drivers for a Long Boom
191
Notes
1. In this chapter the term refers specifically to a period in which both productive poten- tial and aggregate world demand are growing at higher than historical rates, so that the real GDP growth rate increases while world inflation remains stable.
2. See the Introduction to this volume.
3. In particular, neoclassical growth accounting assumes constant returns to scale. OECD estimates of ten Member countries’ growth during the 1970s and 1980s showed that the 2.9% average annual GDP increase was composed of 0.6% growth in the labour force, 1.1% growth in capital and 1.2% TFP growth (Sakurai et al., 1997).
4. This was first brought to widespread attention by Feldstein and Horioka (1980), and has since been corroborated by many others.
5. Among the many analyses of the causes of the Asian crisis, one of the best is Miller and Luangaram (1998).
6. See Lipsey’s chapter in this volume.
7. Wack (1985), McRae (1994).
8. Evidence on the strength of this catch-up route is found in Proudman et al. (1998).
9. An even more extreme version of this technology-driven organisational change is Malone and Laubacher’s depiction of the “e-lance economy” run by electronically linked freelancers, as described elsewhere in this volume by Lipsey.
10. In a speech earlier this year, Alan Greenspan, Chairman of the Federal Reserve Board, seemed to suggest this is the way the world is heading when he said: “My sense is that one consequence of this Asian crisis is an increasing awareness in the region that market capitalism, as practised in the west, especially in the US, is the superior model; that it provides greater promise of rising standards of living and continuous growth.” The affected countries in Asia are “endeavouring to move their economies much more rapidly toward the type of economic system that we have in the US” (FED home page, 1998).
11. The author uses this term loosely to refer to all low- and middle-income countries with relatively stable political conditions. In practice, for this scenario, most of Africa and the Russian Federation would probably be excluded. The term “developing countries” is here synonymous with non-OECD.
12. This assumes that countries have an explicit or implicit overall inflation target. If it were, say, 2% and wages and service prices were growing by 3%, then assuming a
The Future of the Global Economy: Towards a Long Boom?
192
50-50 split of consumption between goods and services, goods prices could only be growing by 1%. This simple arithmetic is complicated by the traded/non-traded charac- ter of goods/services and by the important share of consumption out of wealth rather than wage income in this scenario.
13. See Brown and Julius (1993) for another route to this figure based on an analogy with the shrinking share of agricultural employment in five OECD countries during the earlier part of this century.
14. Defined as the population below 14 years of age and over 65, divided by the total population.
15. The first three countries already have low state-provided pensions and large pension trust funds in either public or private sectors. Australia has recently implemented pension reforms.
16. See Lipietz’s chapter in this volume for a description of the difficulties encountered at Rio and Kyoto.
17. Michael Porter has recently published an article in the Harvard Business Review (Nov./Dec. 1998) in which he also uses the term cluster to describe a “geographic concentration of interconnected companies and institutions in a particular field” that affects competition by “increasing the productivity of companies based in the area… driving the direction and pace of innovation… and stimulating the formation of new businesses, which expands and strengthens the cluster itself.” Although some of his links to productivity growth go beyond what could be expected and he does not focus on the importance of interconnected clus- ters, the ideas are sufficiently similar that the author has retained the same term.
18. Japan is currently 21st in the number of Internet domain names registered per capita, partly because it requires those wanting a jp identification in their Internet address to use a Japanese service provider whose prices are among the highest in the world (Fortune, 1999).
19. See the OECD.org site for the background papers and documents resulting from “A Borderless World: Realising the Potential of Global Electronic Commerce”.
20. For the period since 1974, the average annual real GDP growth of developing countries excluding the former Soviet Union and Eastern Europe was 3.5% (World Bank, 1997).
21. The calculations behind Table 2 do not take into account possible shifts in exchange rates between OECD and non-OECD countries. Over such a long period, and with much higher economic growth in the non-Member countries, their currencies could be expected to appreciate against those of the OECD, a possibility explored in Brown and Julius (1993). Such exchange rate trends would increase the share of the developing countries in world GDP, but it would be an exaggeration to assume that they would reach full purchasing power parity by 2025 or that they could do so without a significant effect on export growth. Thus the figures in Table 2 are closer to a lower bound estimate for the non-OECD share based on the other assumptions of each scenario.
22. It is possible to imagine the OECD countries growing somewhat faster in this scenario. The social preferences story that drives their accelerated shift to services and the tilt in their labour/leisure choice is an internally consistent but not logically necessary counterpart to the high growth in the developing countries.
Policy Drivers for a Long Boom
193
Bibliography
BROWN, Richard and DeAnne JULIUS (1993), “Is Manufacturing Still Special in the New World Order?” in Richard O’Brien (ed.), Finance and the International Economy: 7, The Amex Bank Review Prize Essays. Oxford University Press.
FELDSTEIN, M. and C. HORIOKA (1980), “Domestic Savings and International Capital Flows”, Economic Journal 358, June.
Fortune magazine (1999), “Wrapping the Web in Red Tape”, 1 February, p. 24.
FUKUSHIMA, Kiyohiko (1998), “Asia Shift, High Tech Shift, and Reform Shift: Silver Lining Behind Japan’s Stagnant Economy”. Paper presented to the 12th Asia Pacific Roundtable, June.
HALE, David (1998), “Has America’s Equity Market Boom Just Begun or How the Rise of Pension Funds Will Change the Global Economy in the 21st Century”. Unpublished paper.
JULIUS, DeAnne (1994), “International Direct Investment: Strengthening the Policy Regime” in Peter Kenen (ed.), Managing the World Economy: Fifty Years after Bretton Woods. Washington DC: Institute for International Economics.
McRAE, Hamish (1994), The World in 2020. London: HarperCollins Publishers.
MILLER, Marcus and Pongsak LUANGARAM (1998), “Financial Crisis in East Asia: Bank Runs, Asset Bubbles and Antidotes”. CSGR Working Paper No. 11/099, University of Warwick, July.
MOSS KANTER, Rosabeth (1995), World Class: Thriving Locally in the Global Economy. Boston: Harvard Business School Press.
OECD (1998a), Maintaining Prosperity in an Ageing Society. Paris: OECD.
OECD (1998b), “ A G l o b a l A c t i o n P l a n f o r E l e c t r o n i c C o m m e r c e P r e p a r e d b y B u s i n e s s w i t h Recommendations from Governments”, SG/EC(98)11/REV2, October.
OLSON, Mancur (1982), The Rise and Decline of Nations. London: Yale University Press.
The Future of the Global Economy: Towards a Long Boom?
194
PORTER, Michael E. (1998), “Clusters and the New Economics of Competition”, Harvard Business Review, November/ December.
PROUDMAN, James, Stephen REDDING and Marco BIANCHI, eds. (1998), Openness and Growth. London: Bank of England.
SAKURAI, N., G. PAPACONSTANTINOW and E. IOANNIDIS (1997), “Impact of R&D and Technology Diffusion on Productivity Growth: Empirical Evidence for Ten OECD Countries”, Economic Systems Research, Vol. 9, No. 1, pp. 81-109.
STATISTICAL BUREAU, GOVERNMENT OF JAPAN (1998), Monthly Report on the Labour Force Survey, August.
US CONGRESSIONAL BUDGET OFFICE (1998), “The Economic and Budget Outlook: An Update”, August.
WACK, Pierre (1985), “Scenarios: Uncharted Waters Ahead”, Harvard Business Review, September/October.
WILLIAMSON, O.E. (1975), Markets and Hierarchies: Analysis and Antitrust Implications. New York: Free Press.
WORLD BANK (1997), Global Economic Prospects and the Developing Countries. Washington DC.
195
Annex
List of Participants
CHAIRMAN
Donald JOHNSTON Secretary-General
OECD
PARTICIPANTS
Fernando ALVAREZ Director of Economic Studies CEMEX Mexico
Walter BRINKMANN Senior Vice-President Coca-Cola Greater Europe Belgium
Paul A. DAVID Professor of Economics Stanford University United States
Frederik von DEWALL General Manager and Chief Economist ING Group The Netherlands
Emilio FONTELA Professor of Economics University of Madrid Spain
Robert GOEBBELS Ministre de l’Économie, des Travaux Publics et des Transports Luxemburg
Orhan GÜVENEN Under-Secretary State Planning Organisation Prime Minister’s Office Turkey
David HALE Global Chief Economist Zürich Insurance Group United States
Martin HUEFNER Executive Vice-President Hypo Vereinsbank Germany
David HUMPHREYS Chief Economist RIO TINTO plc United Kingdom
The Future of the Global Economy: Towards a Long Boom?
196
DeAnne JULIUS Member of the Monetary Policy Committee Bank of England United Kingdom
Alain LIPIETZ Professeur Centre d’Études Prospectives d’Économie Mathématique Appliquées à la Planification (C.E.P.R.E.M.A.P.) France
Richard LIPSEY Professor of Economics Simon Fraser University Canada
Maria LIVANOS CATTAUI Secretary-General International Chamber of Commerce
Wolfgang MICHALSKI Director, Advisory Unit to the Secretary-General OECD
Herbert OBERHÄNSLI Vice-President, Economic Studies and International Relations Nestlé Switzerland
William PFAFF Writer on Contemporary History and Politics The International Herald Tribune The Los Angeles Times Syndicate France
Christopher PLEISTER Member of the Board DG BANK Deutsche Genossenschaftsbank AG Germany
Peter SCHWARTZ President Global Business Network United States
Robert J. SHAPIRO Under-Secretary for Economic Affairs Department of Commerce United States
Horst SIEBERT President Kiel Institute of World Economics Germany
Friedrich-Leopold von STECHOW Member of the Board DG BANK Deutsche Genossenschaftsbank AG Germany
Kari TAPIOLA Deputy Director-General International Labour Organisation
Jitsuro TERASHIMA General Manager Mitsui & Co., Ltd. Japan
Bernd THIEMANN Chairman of the Managing Board DG BANK Deutsche Genossenschaftsbank AG Germany
Heiko THIEME Chairman American Heritage Management Corp. United States
Ignazio VISCO Head of the Economics Department OECD
Martin WOLF Associate Editor Financial Times United Kingdom
Annex: List of Participants
197
OECD SECRETARIAT
Barrie STEVENS Deputy Head, Advisory Unit to the Secretary-General
Riel MILLER Principal Administrator, Advisory Unit to the Secretary-General
Pierre-Alain SCHIEB Principal Administrator, Advisory Unit to the Secretary-General
Also Available
21st Century Technologies: Promises and Perils of a Dynamic Future (03 98 03 1 P), ISBN 92-64-16052-3 140 FF US$23
Energy: The Next Fifty Years (03 99 01 1 P), ISBN 92-64-17016-2 160 FF US$29
China in the 21st Century: Long-term Global Implications (03 96 05 1 P), ISBN 92-64-14924-4 120 FF US$33
The Economic and Social Impact of Electronic Commerce (93 99 01 1 P), ISBN 92-64-16972-5 135 FF US$22
Open Markets Matter: The Benefits of Trade and Investment Liberalisation (22 98 01 1 P), ISBN 92-64-16100-7 120 FF US$20
Trade, Investment and Development: Reaping the Full Benefits of Open Markets (22 99 01 1 P), ISBN 92-64-17111-8 120 FF US$21
Trade, Investment and Development: Policy Coherence Matters (22 99 02 1 P), ISBN 92-64-17112-6 120 FF US$21
For a complete listing of OECD publications, see the OECD Online Bookshop at: www.oecd.org/bookshop.
How to contact us:
OECD Paris Centre 2, rue André-Pascal – 75775 Paris Cedex 16 – France
Tel.: (33.1) 45.24.81.67 (sales enquiries) Fax: (33.1) 45.24.19.50 (sales enquiries)
E-mail: [email protected]
Online orders: www.oecd.org/bookshop (secure payment with credit card) Orders by fax: (33.1) 49.10.42.76
OECD PUBLICATIONS, 2, rue André-Pascal, 75775 PARIS CEDEX
PRINTED IN FRANCE
(03 1999 02 1 P) ISBN 92-64-17029-4 – No. 50791 1999
- Foreword
- Table of Contents
- Chapter 1. Anatomy of a Long Boom
- 1. Introduction
- 2. What is a long boom?
- 3. Policies for provoking a long boom
- 4. Conclusion
- Chapter 2. Sources of Continued Long-run Economic Dynamism in the 21st Century
- 1. Introduction
- 2. Growth and technological change
- Figure 1.
- 3. Roots of past growth
- 4. The roots of future growth
- 5. Structural adjustments
- 6. The anatomy of long booms
- 7. Policies to exploit potential
- 8. The need for social consensus
- 9. The policy structure
- Notes
- Bibliography
- Chapter 3. The Emerging Global Knowledge Economy
- 1. Introduction: A tale of two countries
- Figure 1. Taxonomy of knowledge
- Figure 2. Changes in economic leadership
- 2. Understanding the global knowledge economy
- 3. Reperceiving the knowledge economy
- Figure 3
- Figure 4. Work, wealth, jobs... coming full circle
- 4. Scenarios for the future of the global knowledge economy
- 5. Conclusion and implications for the OECD
- Bibliography
- Chapter 4. Towards Global Competition: Catalysts and Constraints
- 1. Introduction
- 2. Visions of an integrated world economy
- Figure 1. Basic elements of global competition
- 3. Catalysts of globalisation
- Figure 2. Costs of transport and communication
- Table 1. Information and communication equipment per 100inhabitants in countries grouped by income, 1995
- Figure 3. Weighted average US tarif rate after GATT Rounds
- Figure 4. World output, exports, and foreign direct investment
- Table 2. Share of services in total trade
- Figure 5. Increase in gross domestic product, exports, and foreign direct investment of selected countries, 1981-1996
- Table 3. Feldstein-Horioka coefficients for OECD countries
- 4. Constraints of globalisation
- Table 4. Wage dispersion between different income decilesa across countries
- Table 5. Anti-dumping actions by region
- Table 6. Share of intra-regional trade in total flows
- 5. The future of globalisation
- Table 7. Terms of trade in international trade
- Table 8. Annual real GDP growth before and after trade liberalisation
- Notes
- Bibliography
- Chapter 5. Working for World Ecological Sustainability: Towards a “New Great Transformation”
- 1. Introduction
- 2. A short history of human ecology
- 3. Local crises and global crises
- 4. On the regulation of local ecological crises
- 5. Global crises: first lessons
- 6. The case of the greenhouse effect
- 7. Conclusion
- Notes
- Bibliography
- Chapter 6. Policy Drivers for a Long Boom
- 1. An economic decomposition of growth
- 2. Three geographic scenarios for a long boom
- 3. Policy overview for a long boom
- Table 1. GDP growth 2000-2025
- Table 2. World GDP shares
- Table 3. Key enabling policies
- Notes
- Bibliography
- Annex. List of Participants
- List of Figures
- Figure1.
- Figure 1. Taxonomy of knowledge
- Figure 2. Changes in economic leadership
- Figure 3.
- Figure 4. Work, wealth, jobs...coming full circle
- Figure 1. Basic elements of global competition
- Figure 2. Costs of transport and communication
- Figure 3. Weighted average US tariff rate after GATT Rounds
- Figure 4. World output, exports, and foreign direct investment
- Figure 5. Increase in gross domestic product, exports, and foreign direct investment of selected countries, 1961-1996
- List of Tables
- Table 1. Information and communication equipment per 100inhabitants in countries grouped by income, 1995
- Table 2. Share of services in total trade
- Table 3. Feldstein-Horioka coefficients for OECD countries
- Table 4. Wage dispersion between different income deciles a across countries
- Table 5. Anti-dumping actions by region
- Table 6. Share of intra-regional trade in total flows
- Table 7. Terms of trade in international trade
- Table 8. Annual real GDP growth before and after trade liberalisation
- Table 1. GDP growth 2000-2025
- Table 2. World GDP shares
- Table 3. Key enabling policies
Week4/Course1-InfoTech in a Global Economy (ITS-832-06)/Week4 Readings.txt
Chapter 5 & 7: Kressel, H., & Lento, T. V. (2012). Entrepreneurship in the Global Economy : Engine for Economic Growth. Cambridge, UK: Cambridge University Press. (see attached PDFs) Rallet, A., & Torre, A. (2000). Is geographical proximity necessary in the innovation networks in the era of global economy? GeoJournal, 49(4), 373. Retrieved from http://search.ebscohost.com/login.aspx?direct=true&AuthType=shib&db=edsjsr&AN=edsjsr.41147437&site=eds-live Ives, B., & Jarvenpaa, S.L. (1991). Applications of Global Information Technology: Key Issues for Management. MIS Quarterly, 15(1), 33. https://doi.org/10.2307/249433
Week4/Course2 -Information Governance (ITS-833-20)/Discussion Question/Discussion Question - 1 Page.txt
In chapter seven (7), we have learned from "The Path to Information Value" that 70% (seventy percent) of managers and executives say data are “extremely important” for creating competitive advantage. In addition, it is implied by the authors that, “The key, of course, is knowing which data matter, who within a company needs them, and finding ways to get that data into users’ hands.” Based on the company you have identified for your Final Paper, discuss 1) the data that matters to the executives in that industry, 2) who, within that industry, needs that data, and 3) some methods for ensuring that the critical data gets into the users' hands. Remember to respond to two other learners' post, letting them know if they missed any data or details in their industry. Please make your initial post and two response posts substantive. A substantive post will do at least TWO of the following: Ask an interesting, thoughtful question pertaining to the topic Answer a question (in detail) posted by another student or the instructor Provide extensive additional information on the topic Explain, define, or analyze the topic in detail Share an applicable personal experience Provide an outside source (for example, an article from the UC Library) that applies to the topic, along with additional information about the topic or the source (please cite properly in APA) Make an argument concerning the topic. At least one scholarly source should be used in the initial discussion thread. Be sure to use information from your readings and other sources from the UC Library. Use proper citations and references in your post. Initial post due Thursday Peer responses due Sunday
Week4/Course2 -Information Governance (ITS-833-20)/Profesor Readings.txt
Information Governance in IT Textbook: Chapter 7 – IG for Business Units and Chapter 10 – Information Governance and Information Technology Functions
Week4/Course2 -Information Governance (ITS-833-20)/Text Books/Information Governance Text book.pdf
ffi rs i February 28, 2014 6:11 PM
INFORMATION GOVERNANCE
ffi rs ii February 28, 2014 6:11 PM
Founded in 1807, John Wiley & Sons is the oldest independent publishing company in the United States. With offi ces in North America, Europe, Asia, and Australia, Wiley is globally committed to developing and marketing print and electronic products and services for our customers’ professional and personal knowledge and understanding.
The Wiley CIO series provides information, tools, and insights to IT executives and managers. The products in this series cover a wide range of topics that supply strategic and implementation guidance on the latest technology trends, leadership, and emerging best practices.
Titles in the Wiley CIO series include:
The Agile Architecture Revolution: How Cloud Computing, REST-Based SOA, and Mobile Computing Are Changing Enterprise IT by Jason BloombergT
Big Data, Big Analytics: Emerging Business Intelligence and Analytic Trends for Today’s Businesses by Michael Minelli, Michele Chambers, and Ambiga Dhiraj
The Chief Information Offi cer’s Body of Knowledge: People, Process, and Technology by Dean Lane
CIO Best Practices: Enabling Strategic Value with Information Technology (Second Edition) by Joe Stenzel, Randy Betancourt, Gary Cokins, Alyssa Farrell, Bill Flemming, Michael H. Hugos, Jonathan Hujsak, and Karl Schubert
The CIO Playbook: Strategies and Best Practices for IT Leaders to Deliver Value by Nicholas R. Colisto
Enterprise Performance Management Done Right: An Operating System for Your Organization by Ron Dimon
Executive’s Guide to Virtual Worlds: How Avatars Are Transforming Your Business and Your Brand by Lonnie Bensond
IT Leadership Manual: Roadmap to Becoming a Trusted Business Partner by Alan R. r Guibord
Managing Electronic Records: Methods, Best Practices, and Technologies by Robert F. s Smallwood
On Top of the Cloud: How CIOs Leverage New Technologies to Drive Change and Build Value Across the Enterprise by Hunter Muller
Straight to the Top: CIO Leadership in a Mobile, Social, and Cloud-based World (Second Edition) by Gregory S. Smith
Strategic IT: Best Practices for Managers and Executives by Arthur M. Langer ands Lyle Yorks
Transforming IT Culture: How to Use Social Intelligence, Human Factors, and Collaboration to Create an IT Department That Outperforms by Frank Wanders
Unleashing the Power of IT: Bringing People, Business, and Technology Together by Dan Roberts
The U.S. Technology Skills Gap: What Every Technology Executive Must Know to Save America’s Future by Gary J. Beach
Information Governance: Concepts, Strategies and Best Practices by Robert F. Smallwoods
ffi rs iii February 28, 2014 6:11 PM
Robert F. Smallwood
INFORMATION GOVERNANCE
CONCEPTS, STRATEGIES AND
BEST PRACTICES
ffi rs iv February 28, 2014 6:11 PMv
Cover image: © iStockphoto / IgorZh Cover design: Wiley
Copyright © 2014 by Robert F. Smallwood. All rights reserved.
Chapter 7 © 2014 by Barclay Blair
Portions of Chapter 8 © 2014 by Randolph Kahn
Published by John Wiley & Sons, Inc., Hoboken, New Jersey. Published simultaneously in Canada.
No part of this publication may be reproduced, stored in a retrieval system, or transmitted in any form or by any means, electronic, mechanical, photocopying, recording, scanning, or otherwise, except as permitted under Section 107 or 108 of the 1976 United States Copyright Act, without either the prior written permission of the Publisher, or authorization through payment of the appropriate per-copy fee to the Copyright Clearance Center, Inc., 222 Rosewood Drive, Danvers, MA 01923, (978) 750-8400, fax (978) 646-8600, or on the Web at www.copyright.com. Requests to the Publisher for permission should be addressed to the Permissions Department, John Wiley & Sons, Inc., 111 River Street, Hoboken, NJ 07030, (201) 748-6011, fax (201) 748-6008, or online at http://www.wiley.com/go/permissions.
Limit of Liability/Disclaimer of Warranty: While the publisher and author have used their best efforts in preparing this book, they make no representations or warranties with respect to the accuracy or completeness of the contents of this book and specifi cally disclaim any implied warranties of merchantability or fi tness for a particular purpose. No warranty may be created or extended by sales representatives or written sales materials. The advice and strategies contained herein may not be suitable for your situation. You should consult with a professional where appropriate. Neither the publisher nor author shall be liable for any loss of profi t or any other commercial damages, including but not limited to special, incidental, consequential, or other damages.
For general information on our other products and services or for technical support, please contact our Customer Care Department within the United States at (800) 762-2974, outside the United States at (317) 572-3993 or fax (317) 572-4002.
Wiley publishes in a variety of print and electronic formats and by print-on-demand. Some material included with standard print versions of this book may not be included in e-books or in print-on-demand. If this book refers to media such as a CD or DVD that is not included in the version you purchased, you may download this material at http://booksupport.wiley.com. For more information about Wiley products, visit www.wiley.com.
Library of Congress Cataloging-in-Publication Data:
Smallwood, Robert F., 1959- Information governance : concepts, strategies, and best practices / Robert F. Smallwood. pages cm. — (Wiley CIO series)
ISBN 978-1-118-21830-3 (cloth); ISBN 978-1-118-41949-6 (ebk); ISBN 978-1-118-42101-7 (ebk) 1. Information technology—Management. 2. Management information systems. 3. Electronic
records—Management. I. Title. HD30.2.S617 2014 658.4’038—dc23
2013045072
Printed in the United States of America
10 9 8 7 6 5 4 3 2 1
ffi rs v February 28, 2014 6:11 PMv
For my sons
and the next generation of tech-savvy managers
vii
ftoc vii March 8, 2014 6:34 PM
CONTENTS
PREFACE xv
ACKNOWLEDGMENTS xvii
PA RT O N E — Information Governance Concepts, Defi nitions, and Principles 1p
C H A P T E R 1 The Onslaught of Big Data and the Information Governance Imperative 3
Defi ning Information Governance 5
IG Is Not a Project, But an Ongoing Program 7
Why IG Is Good Business 7
Failures in Information Governance 8
Form IG Policies, Then Apply Technology for Enforcement 10
Notes 12
C H A P T E R 2 Information Governance, IT Governance, Data Governance: What’s the Difference? 15
Data Governance 15
IT Governance 17
Information Governance 20
Impact of a Successful IG Program 20
Summing Up the Differences 21
Notes 22
C H A P T E R 3 Information Governance Principles 25
Accountability Is Key 27
Generally Accepted Recordkeeping Principles® 27 Contributed by Charmaine Brooks, CRM
Assessment and Improvement Roadmap 34
Who Should Determine IG Policies? 35
Notes 38
PA RT T W O — Information Governance Risk Assessment and Strategic Planning 41g g
C H A P T E R 4 Information Risk Planning and Management 43
Step 1: Survey and Determine Legal and Regulatory Applicability and Requirements 43
viii CONTENTS
ftoc viii March 8, 2014 6:34 PM
Step 2: Specify IG Requirements to Achieve Compliance 46
Step 3: Create a Risk Profi le 46
Step 4: Perform Risk Analysis and Assessment 48
Step 5: Develop an Information Risk Mitigation Plan 49
Step 6: Develop Metrics and Measure Results 50
Step 7: Execute Your Risk Mitigation Plan 50
Step 8: Audit the Information Risk Mitigation Program 51
Notes 51
C H A P T E R 5 Strategic Planning and Best Practices for Information Governance 53
Crucial Executive Sponsor Role 54
Evolving Role of the Executive Sponsor 55
Building Your IG Team 56
Assigning IG Team Roles and Responsibilities 56
Align Your IG Plan with Organizational Strategic Plans 57
Survey and Evaluate External Factors 58
Formulating the IG Strategic Plan 65
Notes 69
C H A P T E R 6 Information Governance Policy Development 71
A Brief Review of Generally Accepted Recordkeeping Principles® 71
IG Reference Model 72
Best Practices Considerations 75
Standards Considerations 76
Benefi ts and Risks of Standards 76
Key Standards Relevant to IG Efforts 77
Major National and Regional ERM Standards 81
Making Your Best Practices and Standards Selections to Inform Your IG Framework 87
Roles and Responsibilities 88
Program Communications and Training 89
Program Controls, Monitoring, Auditing and Enforcement 89
Notes 91
PA RT T H R E E — Information Governance Key Impact Areas Based on the IG Reference Model 95p
C H A P T E R 7 Business Considerations for a Successful IG Program 97
By Barclay T. Blair
Changing Information Environment 97
CONTENTS ix
ftoc ix March 8, 2014 6:34 PMx
Calculating Information Costs 99
Big Data Opportunities and Challenges 100
Full Cost Accounting for Information 101
Calculating the Cost of Owning Unstructured Information 102
The Path to Information Value 105
Challenging the Culture 107
New Information Models 107
Future State: What Will the IG-Enabled Organization Look Like? 110
Moving Forward 111
Notes 113
C H A P T E R 8 Information Governance and Legal Functions 115
By Robert Smallwood with Randy Kahn, Esq., and Barry Murphy
Introduction to e-Discovery: The Revised 2006 Federal Rules of Civil Procedure Changed Everything 115
Big Data Impact 117
More Details on the Revised FRCP Rules 117
Landmark E-Discovery Case: Zubulake v. UBS Warburg 119
E-Discovery Techniques 119
E-Discovery Reference Model 119
The Intersection of IG and E-Discovery 122 By Barry Murphy
Building on Legal Hold Programs to Launch Defensible Disposition 125 By Barry Murphy
Destructive Retention of E-Mail 126
Newer Technologies That Can Assist in E-Discovery 126
Defensible Disposal: The Only Real Way To Manage Terabytes and Petabytes 130 By Randy Kahn, Esq.
Retention Policies and Schedules 137 By Robert Smallwood, edited by Paula Lederman, MLS
Notes 144
C H A P T E R 9 Information Governance and Records and Information Management Functions 147
Records Management Business Rationale 149
Why Is Records Management So Challenging? 150
Benefi ts of Electronic Records Management 152
Additional Intangible Benefi ts 153
Inventorying E-Records 154
Generally Accepted Recordkeeping Principles® 155
E-Records Inventory Challenges 155
x CONTENTS
ftoc x March 8, 2014 6:34 PMx
Records Inventory Purposes 156
Records Inventorying Steps 157
Ensuring Adoption and Compliance of RM Policy 168
General Principles of a Retention Scheduling 169
Developing a Records Retention Schedule 170
Why Are Retention Schedules Needed? 171
What Records Do You Have to Schedule? Inventory and Classifi cation 173
Rationale for Records Groupings 174
Records Series Identifi cation and Classifi cation 174
Retention of E-Mail Records 175
How Long Should You Keep Old E-Mails? 176
Destructive Retention of E-Mail 177
Legal Requirements and Compliance Research 178
Event-Based Retention Scheduling for Disposition of E-Records 179
Prerequisites for Event-Based Disposition 180
Final Disposition and Closure Criteria 181
Retaining Transitory Records 182
Implementation of the Retention Schedule and Disposal of Records 182
Ongoing Maintenance of the Retention Schedule 183
Audit to Manage Compliance with the Retention Schedule 183
Notes 186
C H A P T E R 10 Information Governance and Information Technology Functions 189
Data Governance 191
Steps to Governing Data Effectively 192
Data Governance Framework 193
Information Management 194
IT Governance 196
IG Best Practices for Database Security and Compliance 202
Tying It All Together 204
Notes 205
C H A P T E R 11 Information Governance and Privacy and Security Functions 207
Cyberattacks Proliferate 207
Insider Threat: Malicious or Not 208
Privacy Laws 210
Defense in Depth 212
Controlling Access Using Identity Access Management 212
Enforcing IG: Protect Files with Rules and Permissions 213
CONTENTS xi
ftoc xi March 8, 2014 6:34 PM
Challenge of Securing Confi dential E-Documents 213
Apply Better Technology for Better Enforcement in the Extended Enterprise 215
E-Mail Encryption 217
Secure Communications Using Record-Free E-Mail 217
Digital Signatures 218
Document Encryption 219
Data Loss Prevention (DLP) Technology 220
Missing Piece: Information Rights Management (IRM) 222
Embedded Protection 226
Hybrid Approach: Combining DLP and IRM Technologies 227
Securing Trade Secrets after Layoffs and Terminations 228
Persistently Protecting Blueprints and CAD Documents 228
Securing Internal Price Lists 229
Approaches for Securing Data Once It Leaves the Organization 230
Document Labeling 231
Document Analytics 232
Confi dential Stream Messaging 233
Notes 236
PA RT F O U R — Information Governance for Delivery Platforms 239y
C H A P T E R 12 Information Governance for E-Mail and Instant Messaging 241
Employees Regularly Expose Organizations to E-Mail Risk 242
E-Mail Polices Should Be Realistic and Technology Agnostic 243
E-Record Retention: Fundamentally a Legal Issue 243
Preserve E-Mail Integrity and Admissibility with Automatic Archiving 244
Instant Messaging 247
Best Practices for Business IM Use 247
Technology to Monitor IM 249
Tips for Safer IM 249
Notes 251
C H A P T E R 13 Information Governance for Social Media 253
By Patricia Franks, Ph.D, CRM, and Robert Smallwood
Types of Social Media in Web 2.0 253
Additional Social Media Categories 255
Social Media in the Enterprise 256
Key Ways Social Media Is Different from E-Mail and Instant Messaging 257
Biggest Risks of Social Media 257
Legal Risks of Social Media Posts 259
xii CONTENTS
ftoc xii March 8, 2014 6:34 PM
Tools to Archive Social Media 261
IG Considerations for Social Media 262
Key Social Media Policy Guidelines 263
Records Management and Litigation Considerations for Social Media 264
Emerging Best Practices for Managing Social Media Records 267
Notes 269
C H A P T E R 14 Information Governance for Mobile Devices 271
Current Trends in Mobile Computing 273
Security Risks of Mobile Computing 274
Securing Mobile Data 274
Mobile Device Management 275
IG for Mobile Computing 276
Building Security into Mobile Applications 277
Best Practices to Secure Mobile Applications 280
Developing Mobile Device Policies 281
Notes 283
C H A P T E R 15 Information Governance for Cloud Computing 285
By Monica Crocker CRM, PMP, CIP, and Robert Smallwood
Defi ning Cloud Computing 286
Key Characteristics of Cloud Computing 287
What Cloud Computing Really Means 288
Cloud Deployment Models 289
Security Threats with Cloud Computing 290
Benefi ts of the Cloud 298
Managing Documents and Records in the Cloud 299
IG Guidelines for Cloud Computing Solutions 300
Notes 301
C H A P T E R 16 SharePoint Information Governance 303
By Monica Crocker, CRM, PMP, CIP, edited by Robert Smallwood
Process Change, People Change 304
Where to Begin the Planning Process 306
Policy Considerations 310
Roles and Responsibilities 311
Establish Processes 312
Training Plan 313
Communication Plan 313
Note 314
CONTENTS xiii
ftoc xiii March 8, 2014 6:34 PM
PA RT F I V E — Long-Term Program Issues 315g g
C H A P T E R 17 Long-Term Digital Preservation 317
By Charles M. Dollar and Lori J. Ashley
Defi ning Long-Term Digital Preservation 317
Key Factors in Long-Term Digital Preservation 318
Threats to Preserving Records 320
Digital Preservation Standards 321
PREMIS Preservation Metadata Standard 328
Recommended Open Standard Technology-Neutral Formats 329
Digital Preservation Requirements 333
Long-Term Digital Preservation Capability Maturity Model® 334
Scope of the Capability Maturity Model 336
Digital Preservation Capability Performance Metrics 341
Digital Preservation Strategies and Techniques 341
Evolving Marketplace 344
Looking Forward 344
Notes 346
C H A P T E R 18 Maintaining an Information Governance Program and Culture of Compliance 349
Monitoring and Accountability 349
Staffi ng Continuity Plan 350
Continuous Process Improvement 351
Why Continuous Improvement Is Needed 351
Notes 353
A P P E N D I X A Information Organization and Classifi cation: Taxonomies and Metadata 355
By Barb Blackburn, CRM, with Robert Smallwood; edited by Seth Earley
Importance of Navigation and Classifi cation 357
When Is a New Taxonomy Needed? 358
Taxonomies Improve Search Results 358
Metadata and Taxonomy 359
Metadata Governance, Standards, and Strategies 360
Types of Metadata 362
Core Metadata Issues 363
International Metadata Standards and Guidance 364
Records Grouping Rationale 368
Business Classifi cation Scheme, File Plans, and Taxonomy 368
Classifi cation and Taxonomy 369
xiv CONTENTS
ftoc xiv March 8, 2014 6:34 PMv
Prebuilt versus Custom Taxonomies 370
Thesaurus Use in Taxonomies 371
Taxonomy Types 371
Business Process Analysis 377
Taxonomy Testing: A Necessary Step 379
Taxonomy Maintenance 380
Social Tagging and Folksonomies 381
Notes 383
A P P E N D I X B Laws and Major Regulations Related to Records Management 385
United States 385
Canada 387 By Ken Chasse, J.D., LL.M.
United Kingdom 389
Australia 391
Notes 394
A P P E N D I X C Laws and Major Regulations Related to Privacy 397
United States 397
Major Privacy Laws Worldwide, by Country 398
Notes 400
GLOSSARY 401
ABOUT THE AUTHOR 417
ABOUT THE MAJOR CONTRIBUTORS 419
INDEX 421
xv
fpref xv February 28, 2014 11:37 AMv
PREFACE
I nformation governance (IG) has emerged as a key concern for business executives and managers in today’s environment of Big Data, increasing information risks, co- lossal leaks, and greater compliance and legal demands. But few seem to have a clear
understanding of what IG is; that is, how you defi ne what it is and is not, and how to implement it. This book clarifi es and codifi es these defi nitions and provides key in- sights as to how to implement and gain value from IG programs. Based on exhaustive research, and with the contributions of a number of industry pioneers and experts, this book lays out IG as a complete discipline in and of itself for the fi rst time.
IG is a super-discipline that includes components of several key fi elds: law, records management, information technology (IT), risk management, privacy and security, and business operations. This unique blend calls for a new breed of information pro- fessional who is competent across these established and quite complex fi elds. Training and education are key to IG success, and this book provides the essential underpinning for organizations to train a new generation of IG professionals.
Those who are practicing professionals in the component fi elds of IG will fi nd the book useful in expanding their knowledge from traditional fi elds to the emerging tenets of IG. Attorneys, records and compliance managers, risk managers, IT manag- ers, and security and privacy professionals will fi nd this book a particularly valuable resource.
The book strives to offer clear IG concepts, actionable strategies, and proven best practices in an understandable and digestible way; a concerted effort was made to simplify language and to offer examples. There are summaries of key points through- out and at the end of each chapter to help the reader retain major points. The text is organized into fi ve parts: (1) Information Governance Concepts, Defi nitions, and Principles; (2) IG Risk Assessment and Strategic Planning; (3) IG Key Impact Areas; (4) IG for Delivery Platforms; and (5) Long-Term Program Issues. Also included are appendices with detailed information on taxonomy and metadata design and on re- cords management and privacy legislation.
One thing that is sure is that the complex fi eld of IG is evolving. It will continue to change and solidify. But help is here: No other book offers the kind of compre- hensive coverage of IG contained within these pages. Leveraging the critical advice provided here will smooth your path to understanding and implementing successful IG programs.
Robert F. Smallwood
xvii
fl ast xvii February 28, 2014 11:37 AM
ACKNOWLEDGMENTS
I would like to sincerely thank my colleagues for their support and generous contribu- tion of their expertise and time, which made this pioneering text possible.
Many thanks to Lori Ashley, Barb Blackburn, Barclay Blair, Charmaine Brooks, Ken Chasse, Monica Crocker, Charles M. Dollar, Seth Earley, Dr. Patricia Franks, Randy Kahn, Paula Lederman, and Barry Murphy.
I am truly honored to include their work and owe them a great debt of gratitude.
c01 1 February 28, 2014 11:39 AM
PA RT O N E Information Governance Concepts, Defi nitions, and Principles
3
c01 3 February 28, 2014 11:39 AM
The Onslaught of Big Data and the Information Governance Imperative
C H A P T E R 1
T he value of information in business is rising, and business leaders are more and more viewing the ability to govern, manage, and harvest information as critical to success. Raw data is now being increasingly viewed as an asset that can be
leveraged, just like fi nancial or human capital.1 Some have called this new age of “Big Data” the “industrial revolution of data.”
According to the research group Gartner, Inc., Big Data is defi ned as “high-volume, high-velocity and high-variety information assets that demand cost-effective, inno- vative forms of information processing for enhanced insight and decision making.” 2 A practical defi nition should also include the idea that the amount of data—both struc- tured (in databases) and unstructured (e.g., e-mail, scanned documents) is so mas- sive that it cannot be processed using today’s database tools and analytic software techniques. 3
In today’s information overload era of Big Data—characterized by massive growth in business data volumes and velocity—the ability to distill key insights from enor- mous amounts of data is a major business differentiator and source of sustainable com- petitive advantage. In fact, a recent report by the World Economic Forum stated that data is a new asset class and personal data is “the new oil.” 4 And we are generating more than we can manage effectively with current methods and tools.
The Big Data numbers are overwhelming: Estimates and projections vary, but it has been stated that 90 percent of the data existing worldwide today was created in the last two years 5 and that every two days more information is generated than was from the dawn of civilization until 2003. 6 This trend will continue: The global market for Big Data technology and services is projected to grow at a compound annual rate of 27 percent through 2017, about six times faster than the general information and com- munications technology (ICT) market. 7
Many more comparisons and statistics are available, and all demonstrate the incredible and continued growth of data.
Certainly, there are new and emerging opportunities arising from the accu- mulation and analysis of all that data we are busy generating and collecting. New enterprises are springing up to capitalize on data mining and business intelligence opportunities. The U.S. federal government joined in, announcing $200 million in Big Data research programs in 2012.8
Information Governance: Concepts, Strategies and Best Practices By Robert F. Smallwood Copyright © 2014 by Robert F. Smallwood
4 INFORMATION GOVERNANCE
c01 4 February 28, 2014 11:39 AM
Big Data values massive accumulation of data, whereas in business, e-discovery realities and potential legal liabilities dictate that data be culled to only that which has clear business value.
But established organizations, especially larger ones, are being crushed by this onslaught of Big Data: It is just too expensive to keep all the information that is being generated, and unneeded information is a sort of irrelevant sludge for decision makers to wade through. They have diffi culty knowing which information is an accurate and meaningful “wheat” and which is simply irrelevant “chaff.” This means they do not have the precise information they need to base good business decisions upon.
And all that Big Data piling up has real costs: The burden of massive stores of information has increased storage management costs dramatically, caused overloaded systems to fail, and increased legal discovery costs. 9 Further, the longer that data is kept, the more likely that it will need to be migrated to newer computing platforms, driving up conversion costs; and legally, there is the risk that somewhere in that mountain of data an organization stores is a piece of information that represents a signifi cant legal liability.10
This is where the worlds of Big Data and business collide . For Big Data proponents, more data is always better, and there is no perceived downside to accumulation of mas- sive amounts of data. In the business world, though, the realities of legal e-discovery mean the opposite is true. 11 To reduce risk, liability, and costs, it is critical for unneeded information to be disposed of in a systematic, methodical, and “legally defensible” (jus- tifi able in legal proceedings) way, when it no longer has legal, regulatory, or business value. And there also is the high-value benefi t of basing decisions on better, cleaner data, which can come about only through rigid, enforced information governance (IG) policies that reduce information glut.
Organizations are struggling to reduce and right-size their information footprint by discarding superfl uous and redundant data, e-documents, and information. But the critical issue is devising policies, methods, and processes and then deploying information technol- ogy (IT) to sort through which information is valuable and which no longer has business value and can be discarded.
IT, IG, risk, compliance, and legal representatives in organizations have a clear sense that most of the information stored is unneeded, raises costs, and poses risks. According to a survey taken at a recent Compliance, Governance and Oversight Counsel summit, respondents estimated that approximately 25 percent of information stored in organizations has real business value, while 5 percent must be kept as busi- ness records and about 1 percent is retained due to a litigation hold. “This means that
The onslaught of Big Data necessitates that information governance (IG) be implemented to discard unneeded data in a legally defensible way.
THE ONSLAUGHT OF BIG DATA AND THE INFORMATION GOVERNANCE IMPERATIVE 5
c01 5 February 28, 2014 11:39 AM
[about] 69 percent of information in most companies has no business, legal, or regulatory value. Companies that are able to dispose of this data debris return more profi t to sharehold- ers, can leverage more of their IT budgets for strategic investments, and can avoid excess expense in legal and regulatory response” (emphasis added). 12
With a smaller information footprint , organizations can more easily fi nd what they tt need and derive business value from it.13 They must eliminate the data debris regularly and consistently, and to do this, processes and systems must be in place to cull valuable information and discard the data debris daily. An IG program sets the framework to accomplish this.
The business environment has also underscored the need for IG. According to Ted Friedman at Gartner, “The recent global fi nancial crisis has put information gov- ernance in the spotlight. . . . [It] is a priority of IT and business leaders as a result of various pressures, including regulatory compliance mandates and the urgent need for improved decision-making.” 14
And IG mastery is critical for executives: Gartner predicts that by 2016, one in fi ve chief information offi cers in regulated industries will be fi red from their jobs for failed IG initiatives. s 15
Defi ning Information Governance
IG is a sort of super discipline that has emerged as a result of new and tightened legislation governing businesses, external threats such as hacking and data breaches, and the recog- nition that multiple overlapping disciplines were needed to address today’s information management challenges in an increasingly regulated and litigated business environment.16
IG is a subset of corporate governance, and includes key concepts from re- cords management, content management, IT and data governance, information se- curity, data privacy, risk management, litigation readiness, regulatory compliance, long-term digital preservation , and even business intelligence. This also means that it includes related technology and discipline subcategories, such as document management, enterprise search, knowledge management, and business continuity/ disaster recovery.
Only about one quarter of information organizations are managing has real business value.
With a smaller information footprint, it is easier for organizations to fi nd the information they need and derive business value from it.
IG is a subset of corporate governance.
6 INFORMATION GOVERNANCE
c01 6 February 28, 2014 11:39 AM
IG is a sort of superdiscipline that encompasses a variety of key concepts from a variety of related disciplines.
Practicing good IG is the essential foundation for building legally defensible disposition practices to discard unneeded information and to secure confi dential in- formation, which may include trade secrets, strategic plans, price lists, blueprints, or personally identifi able information (PII) subject to privacy laws; it provides the basis for consistent, reliable methods for managing data, e-documents, and records.
Having trusted and reliable records, reports, data, and databases enables managers to make key decisions with confi dence.17 And accessing that information and business intelligence in a timely fashion can yield a long-term sustainable competitive advan- tage, creating more agile enterprises.
To do this, organizations must standardize and systematize their handling of in- formation. They must analyze and optimize how information is accessed, controlled, managed, shared, stored, preserved, and audited. They must have complete, current, and relevant policies, processes, and technologies to manage and control information, including who is able to access what information , and when, to meet external legal and regulatory demands and internal governance policy requirements. In short, IG is about information control and compliance.
IG is a subset of corporate governance, which has been around as long as corpora- tions have existed. IG is a rather new multidisciplinary fi eld that is still being defi ned, but has gained traction increasingly over the past decade. The focus on IG comes not only from compliance, legal, and records management functionaries but also from ex- ecutives who understand they are accountable for the governance of information and that theft or erosion of information assets has real costs and consequences.
“Information governance” is an all-encompassing term for how an organization manages the totality of its information.
According to the Association of Records Managers and Administrators (ARMA), IG is “a strategic framework composed of standards, processes, roles, and metrics that hold organizations and individuals accountable to create, organize, secure, maintain, use, and dispose of information in ways that align with and contribute to the organization’s goals.”18
IG includes the set of policies, processes, and controls to manage information in compliance with external regulatory requirements and internal governance frameworks . Specifi c policiess apply to specifi c data and document types, records series, and other business informa- tion, such as e-mail and reports.
Stated differently, IG is “a quality-control discipline for managing, using, improv- ing, and protecting information.” 19
Practicing good IG is the essential foundation for building legally defensible disposition practices to discard unneeded information.
THE ONSLAUGHT OF BIG DATA AND THE INFORMATION GOVERNANCE IMPERATIVE 7
c01 7 February 28, 2014 11:39 AM
IG is “a strategic framework composed of standards, processes, roles, and metrics, that hold organizations and individuals accountable to create, orga- nize, secure, maintain, use, and dispose of information in ways that align with and contribute to the organization’s goals.” 20
Fleshing out the defi nition further: “Information governance is policy-based man- agement of information designed to lower costs, reduce risk, and ensure compliance with legal, regulatory standards, and/or corporate governance.”21 IG necessarily in- corporates not just policies but information technologies to audit and enforce those policies. The IG team must be cognizant of information lifecycle issues and be able to apply the proper retention and disposition policies, including digital preservation where records need to be maintained for long periods.
IG Is Not a Project, But an Ongoing Program
IG is an ongoing program , not a one-time project. IG provides an umbrella to manage and control information output and communications. Since technologies change so quickly, it is necessary to have overarching policies that can manage the various IT platforms that an organization may use.
Compare it to a workplace safety program; every time a new location, team member, piece of equipment, or toxic substance is acquired by the organization, the workplace safety program should dictate how that is handled. If it does not, the workplace safety policies/procedures/training that are part of the workplace safety program need to be updated. Regular reviews are conducted to ensure the program is being followed and ad- justments are made based on the fi ndings. The effort never ends. s 22 The same is true for IG.
IG is not only a tactical program to meet regulatory, compliance, and litigation demands. It can be strategic , in that it is the necessary underpinning for developing a c management strategy that maximizes knowledge worker productivity while minimiz- ing risk and costs.
Why IG Is Good Business
IG is a tough sell. It can be diffi cult to make the business case for IG, unless there has been some major compliance sanction, fi ne, legal loss, or colossal data breach. In fact, the largest
IG is how an organization maintains security, complies with regulations, and meets ethical standards when managing information.
IG is a multidisciplinary program that requires an ongoing effort.
8 INFORMATION GOVERNANCE
c01 8 February 28, 2014 11:39 AM
impediment to IG adoption is simply identifying its benefi ts and costs, according to the Economist Intelligence Unit. Sure, the enterprise needs better control over its information, but how much better? At what cost? What is the payback period and the return on investment? 23
It is challenging to make the business case for IG, yet making that case is funda- mental to getting IG efforts off the ground.
Here are eight reasons why IG makes good business sense, from IG thought leader Barclay Blair:
1. We can’t keep everything forever. IG makes sense because it enables organiza- tions to get rid of unnecessary information in a defensible manner. Organi- zations need a sensible way to dispose of information in order to reduce the cost and complexity of the IT environment. Having unnecessary informa- tion around only makes it more diffi cult and expensive to harness informa- tion that has value.
2. We can’t throw everything away. IG makes sense because organizations can’t keep everything forever, nor can they throw everything away. We need information—the right information, in the right place, at the right time. Only IG provides the framework to make good decisions about what infor- mation to keep.
3. E-discovery. IG makes sense because it reduces the cost and pain of discov- ery. Proactively managing information reduces the volume of information exposed to e-discovery and simplifi es the task of fi nding and producing responsive information.
4. Your employees are screaming for it—just listen. IG makes sense because it helps knowledge workers separate “signal” from “noise” in their informa- tion fl ows. By helping organizations focus on the most valuable informa- tion, IG improves information delivery and improves productivity.
5. It ain’t gonna get any easier. IG makes sense because it is a proven way for organizations to respond to new laws and technologies that create new re- quirements and challenges. The problem of IG will not get easier over time, so organizations should get started now.
6. The courts will come looking for IG. IG makes sense because courts and regu- lators will closely examine your IG program. Falling short can lead to fi nes, sanctions, loss of cases, and other outcomes that have negative business and fi nancial consequences.
7. Manage risk: IG is a big one. Organizations need to do a better job of identi- fying and managing risk. The risk of information management failures is a critical risk that IG helps to mitigate.
8. E-mail: Reason enough. IG makes sense because it helps organizations take con- trol of e-mail. Solving e-mail should be a top priority for every organization. 24
Failures in Information Governance
The failure to implement and enforce IG can lead to vulnerabilities that can have dire consequences. The theft of confi dential U.S. National Security Agency documents
THE ONSLAUGHT OF BIG DATA AND THE INFORMATION GOVERNANCE IMPERATIVE 9
c01 9 February 28, 2014 11:39 AM
by Edward Snowden in 2013 could have been prevented by properly enforced IG. Also, Ford Motor Company is reported to have suffered a loss estimated at $50 to $100 million as a result of the theft of confi dential documents by one of its own em- ployees. A former product engineer who had access to thousands of trade secret docu- ments and designs sold them to a competing Chinese car manufacturer. A strong IG program would have controlled and tracked access and prevented the theft while pro- tecting valuable intellectual property. 25
Law enforcement agencies have also suffered from poor IG. In a rather frivolous case in 2013 that highlighted the lack of policy enforcement for the mobile environ- ment, it was reported that U.S. agents from the Federal Bureau of Investigation used government-issued mobile phones to send explicit text messages and nude photographs to coworkers. The incidents did not have a serious impact but did compromise the agency and its integrity, and “adversely affected the daily activities of several squads.” 26 Proper mobile communications policies were obviously not developed and enforced.
IG is also about information security and privacy, and serious thought must be given when creating policies to safeguard personal, classifi ed or confi dential informa- tion. Schemes to compromise or steal information can be quite deceptive and devious, masked by standard operating procedures—if proper IG controls and monitoring are not in place. To wit: Granting remote access to confi dential information assets for key personnel is common. Granting medical leave is also common. But a deceptive and dishonest employee could feign a medical leave while downloading volumes of confi dential information assets for a competitor—and that is exactly what happened at Accenture, a global consulting fi rm. During a fraudulent medical leave, an employee was allowed access to Accenture’s Knowledge Exchange (KX), a detailed knowledge base containing previous proposals, expert reports, cost-estimating guidelines, and case studies. This activity could have been prevented by monitoring and analytics that would have shown an inordinate amount of downloads—especially for an “ailing” em- ployee. The employee then went to work for a direct competitor and continued to download the confi dential information from Accenture, estimated to be as many as 1,000 critical documents. While the online access to KX was secure, the use of the electronic documents could have been restricted even after the documents were down-r loaded, if IG measures were in place and newer technologies (such as information rights management [IRM] software) were deployed to secure them directly and main- tain that security remotely. With IRM, software security protections can be employed to seal the e-documents and control their use—even after they leave the organization. More details on IRM technology and its capabilities is presented later in this book.
Other recent high-profi le data and document leakage cases revealing information security weaknesses that could have been prevented by a robust IG program include:
■ Huawei Technologies, the largest networking and mobile communications company in China, was sued by U.S.-based Motorola for allegedly conspiring to steal trade secrets through former Motorola employees.
Ford’s loss from stolen documents in a single case of intellectual property (IP) theft was estimated at $50 to $100 million.
10 INFORMATION GOVERNANCE
c01 10 February 28, 2014 11:39 AM
■ MI6, the U.K. equivalent of the U.S. Central Intelligence Agency, learned that one of its agents in military intelligence attempted to sell confi dential docu- ments to the intelligence services of the Netherlands for £2 million GBP ($3 million USD).
And breaches of personal information revealing failures in privacy protection abound; here are just a few:
■ Health information of 1,600 cardiology patients at Texas Children’s Hospital was compromised when a doctor’s laptop was stolen. The information includ- ed personal and demographic information about the patients, including their names, dates of birth, diagnoses, and treatment histories. 27
■ U.K. medics lost the personal records of nearly 12,000 National Health Service patients in just eight months. Also, a hospital worker was suspended after it was discovered he had sent a fi le containing pay-slip details for every member of staff to his home e-mail account. 28
■ Personal information about more than 600 patients of the Fraser Health Authority in British Columbia, Canada, was stored on a laptop stolen from Burnaby General Hospital.
■ In December 2013, Target stores in the U.S. reported that as many as 110 million customer records had been breached in a massive attack that lasted weeks.
The list of breaches and IG failures could go on and on, more than fi lling the pages of this book. It is clear that it is occurring and that it will continue. IG controls to safeguard confi dential information assets and protect privacy cannot rely solely on the trustwor- thiness of employees and basic security measures. Up-to-date IG policies and enforcement efforts and newer technology sets are needed, with active, consistent monitoring and program adjustments to continue to improve.
Executives and senior managers can no longer avoid the issue, as it is abundantly clear that the threat is real and the costs of taking such avoidable risks can be high. A single security breach is an IG failure and can cost the entire business. According to Debra Logan of Gartner, “When organizations suffer high-profi le data losses, espe- cially involving violations of the privacy of citizens or consumers, they suffer serious reputational damage and often incur fi nes or other sanctions. IT leaders will have to take at least part of the blame for these incidents.” 29
Form IG Policies, Then Apply Technology for Enforcement
Typically, some policies governing the use and control of information and records may have been established for fi nancial and compliance reports, and perhaps e-mail, but they are often incomplete and out-of-date and have not been adjusted for changes in the business environment, such as new technology platforms (e.g., Web 2.0, social
IG controls to safeguard confi dential information assets and protect privacy can- not rely solely on the trustworthiness of employees and basic security measures.
THE ONSLAUGHT OF BIG DATA AND THE INFORMATION GOVERNANCE IMPERATIVE 11
c01 11 February 28, 2014 11:39 AM
media), changing laws (e.g., U.S. Federal Rules of Civil Procedure 2006 changes), and additional regulations.
Further adding to the challenge is the rapid proliferation of mobile devices like tablets, phablets, and smartphones used in business—information can be more easily lost or stolen—so IG efforts must be made to preserve and protect the enterprise’s information assets.
Proper IG requires that policies are fl exible enough not to hinder the proper fl ow of information in the heat of the business battle yet strict enough to control and audit for misuse, policy violations, or security breaches. This is a continuous iterative policy- making process that must be monitored and fi ne-tuned. Even with the absolute best efforts, some policies will miss the mark and need to be reviewed and adjusted.
Getting started with IG awareness is the crucial fi rst step. It may have popped up on an executive’s radar at one point or another and an effort might have been made, but many organizations leave these policies on the shelf and do not revise them on a regular basis.
IG is the necessary underpinning for a legally defensible disposition program that discards data debris and helps narrow the search for meaningful information on which to base business decisions. IG is also necessary to protect and preserve critical infor- mation assets. An IG strategy should aim to minimize exposure to risk, at a reasonable cost level, while maximizing productivity and improving the quality of information delivered to knowledge users.
But a reactive, tactical project approach is not the way to go about it—haphazardly t swatting at technological, legal, and regulatory fl ies. A proactive, strategic program, with a clear, accountable sponsor, an ongoing plan, and regular review process, is the only way to continuously adjust IG policies to keep them current so that they best serve the organization’s needs.
Some organizations have created formal governance bodies to establish strat- egies, policies, and procedures surrounding the distribution of information inside and outside the enterprise. These governance bodies, steering committees, or teams should include members from many different functional areas, since proper IG ne- cessitates input from a variety of stakeholders. Representatives from IT, records man- agement, corporate or agency archiving, risk management, compliance, operations, human resources, security, legal, fi nance, and perhaps knowledge management are typically a part of IG teams. Often these efforts are jump-started and organized by an executive sponsor who utilizes third-party consulting resources that specialize in IG efforts, especially considering the newness of IG and its emerging best practices.
So in this era of ever-growing Big Data, leveraging IG policies to focus on re- taining the information that has real business value, while discarding the majority of information that has no value and carries associated increased costs and risks, is criti- cal to success for modern enterprises. This must be accomplished in a systematic, consistent, and legally defensible manner by implementing a formal IG program. Other crucial elements of an IG program are the steps taken to secure confi dential information by enforcing and monitoring policies using the appropriate information technologies.
Getting started with IG awareness is the crucial fi rst step.
12 INFORMATION GOVERNANCE
c01 12 February 28, 2014 11:39 AM
CHAPTER SUMMARY: KEY POINTS
■ The onslaught of Big Data necessitates that IG be implemented to discard unneeded data in a legally defensible way.
■ Big Data values massive accumulation of data, whereas in business, e-discovery realities and potential legal liabilities dictate that data be culled to only that which has clear business value.
■ Only about one quarter of the information organizations are managing has real business value.
■ With a smaller information footprint, it is easier for organizations to fi nd the information they need and derive business value from it.
■ IG is a subset of corporate governance and encompasses the policies and leveraged technologies meant to manage what corporate information is re- tained, where, and for how long, and also how it is retained.
■ IG is a sort of super discipline that encompasses a variety of key concepts from a variety of related and overlapping disciplines.
■ Practicing good IG is the essential foundation for building legally defensible disposition practices to discard unneeded information.
■ According to ARMA, IG is “a strategic framework composed of standards, processes, roles, and metrics that hold organizations and individuals account- able to create, organize, secure, maintain, use, and dispose of information in ways that align with and contribute to the organization’s goals.” 30
■ IG is how an organization maintains security, complies with regulations and laws, and meets ethical standards when managing information.
■ IG is a multidisciplinary program that requires an ongoing effort and active participation of a broad cross-section of functional groups and stakeholders.
■ IG controls to safeguard confi dential information assets and protect privacy cannot rely solely on the trustworthiness of employees and basic security measures.
■ Getting started with IG awareness is the crucial fi rst step.
Notes
1. The Economist, “Data, Data Everywhere,” February 25, 2010, www.economist.com/node/15557443 2. Gartner, Inc., “IT Glossary: Big Data,” www.gartner.com/it-glossary/big-data/ (accessed April 15, 2013). 3. Webopedia, “Big Data,” www.webopedia.com/TERM/B/big_data.html (accessed April 15, 2013).
THE ONSLAUGHT OF BIG DATA AND THE INFORMATION GOVERNANCE IMPERATIVE 13
c01 13 February 28, 2014 11:39 AM
4. World Economic Forum, “Personal Data:The Emergence of a New Asset Class”(January 2011), http:// www3.weforum.org/docs/WEF_ITTC_PersonalDataNewAsset_Report_2011.pdf
5. Deidra Paknad, “Defensible Disposal: You Can’t Keep All Your Data Forever,” July 17, 2012, www .forbes.com/sites/ciocentral/2012/07/17/defensible-disposal-you-cant-keep-all-your-data-forever/
6. Susan Karlin, “Earth’s Nervous System: Looking at Humanity Through Big Data,” www.fastcocreate .com/1681986/earth-s-nervous-system-looking-at-humanity-through-big-data#1(accessed March 5, 2013).
7. IDC Press Release, December 18, ,2013, http://www.idc.com/getdoc.jsp?containerId=prUS24542113 New IDC Worldwide Big Data Technology and Services Forecast Shows Market Expected to Grow to $32.4 Billion in 2017
8. Steve Lohr, “How Big Data Became So Big,” New York Times, August 11, 2012, www.nytimes. com/2012/08/12/business/how-big-data-became-so-big-unboxed.html?_r=2&smid=tw-share&
9. Kahn Consulting, “Information Governance Brief,” sponsored by IBM, www.delve.us/downloads/ Brief-Defensible-Disposal.pdf (accessed March 4, 2013).
10. Barclay T. Blair, “Girding for Battle,” Law Technology News, October 1, 2012, www.law.com/jsp/lawtech- nologynews/PubArticleLTN.jsp?id=1202572459732&thepage=1
11. Ibid. 12. Paknad, “Defensible Disposal.” 13. Randolph A. Kahn, https://twitter.com/InfoParkingLot/status/273791612172259329, November 28, 2012. 14. Gartner Press Release, “Gartner Says Master Data Management Is Critical to Achieving Effective
Information Governance,” www.gartner.com/newsroom/id/1898914, January 19, 2012 15. Ibid. 16. Monica Crocker, e-mail to author, June 21, 2012. 17. Economist Intelligence Unit, “The Future of Information Governance,” www.emc.com/leadership/
business-view/future-information-governance.htm (accessed November 14, 2013). 18. ARMA International, Glossary of Records and Information Management Terms , 4th ed., 2012, TR 22–2012.s 19. Arvind Krishna, “Three Steps to Trusting Your Data in 2011,” IT Business Edge , posted March 9, 2011,
www.itbusinessedge.com/guest-opinions/three-steps-trusting-your-data-2011 . (accessed November 14, 2013).
20. ARMA International, Glossary of Records and Information Management Terms , 4th ed., 2012, TR 22–2012.s 21. Laura DuBoisand Vivian Tero, “Practical Information Governance: Balancing Cost, Risk, and Pro-
ductivity,” IDC White Paper (August 2010), www.emc.com/collateral/analyst-reports/idc-practical- information-governance-ar.pdf
22. Monica Crocker, e-mail to author, June 21, 2012. 23. Barclay T. Blair, Making the Case for Information Governance: Ten Reasons IG Makes Sense , ViaLumina
Ltd, 2010. Online at http://barclaytblair.com/making-the-case-for-ig-ebook/ (accessed November 14, 2013).
24. Barclay T. Blair, “8 Reasons Why Information Governance (IG) Makes Sense,” June 29, 2009, www. digitallandfi ll.org/2009/06/8-reasons-why-information-governance-ig-makes-sense.html
25. Peter Abatan, “Corporate and Industrial Espionage to Rise in 2011,” Enterprise Digital Rights Man- agement, http://enterprisedrm.tumblr.com/post/2742811887/corporate-espionage-to-rise-in-2011 . (accessed November 14, 2013).
26. BBC News, “FBI Staff Disciplined for Sex Texts and Nude Pictures,” February 22, 2013, www.bbc. co.uk/news/world-us-canada-21546135
27. Todd Ackerman, “Laptop Theft Puts Texas Children’s Patient Info at Risk,” Houston Chronicle , July 30, 2009, e www.chron.com/news/houston-texas/article/Laptop-theft-puts-Texas-Children-s-patient-info-1589473. php . (accessed March 2, 2012).
28. Jonny Greatrex, “Bungling West Midlands Medics Lose 12,000 Private Patient Records,” Sunday Mer- cury, September 5, 2010, www.sundaymercury.net/news/sundaymercuryexclusives/2010/09/05/bun- gling-west-midlands-medics-lose-12–000-private-patient-records-66331–27203177/ (accessed March 2, 2012).
29. Gartner Press Release, “Gartner Says Master Data Management Is Critical to Achieving Effective Information Governance.”
30. ARMA International, Glossary of Records and Information Management Terms. s
15
c02 15 February 28, 2014 6:22 PM
Information Governance, IT Governance, Data Governance: What’s the Difference?
C H A P T E R 2
T here has been a great deal of confusion around the term information gover- nance (IG) and how it is distinct from other similar industry terms, such as information technology (IT) governance and data governance . They are all
a subset of corporate governance, and in the above sequence, become increasingly more granular in their approach. Data governance is a part of broader IT governance, which is also a part of even broader information governance. The few texts that exist have compounded the confusion by offering a limited defi nition of IG, or sometimes offering a defi nition of IG that is just plain incorrect , often confusing it with simple datat governance.
So in this chapter we spell out the differences and include examples in hopes of clarifying what the meaning of each term is and how they are related.
Data Governance
Data governance involves processes and controls to ensure that information at the data level—raw alphanumeric characters that the organization is gathering and inputting— is true and accurate, and unique (not redundant). It involves data cleansing ( or data scrubbing) to strip out corrupted, inaccurate, or extraneous data and gg de-duplication, to eliminate redundant occurrences of data.
Data governance focuses on information quality from the ground up at the lowest or root level, so that subsequent reports, analyses, and conclusions are based on clean, reliable, trusted data (or records) in database tables. Data governance is the most rudi- mentary level at which to implement information governance. Data governance efforts seek to ensure that formal management controls—systems, processes, and accountable employees who are stewards and custodians of the data—are implemented to govern critical data assets to improve data quality and to avoid negative downstream effects of poor data. The biggest negative consequence of poor or inaccurate data is poorly and inaccurately based decisions.
Information Governance: Concepts, Strategies and Best Practices By Robert F. Smallwood Copyright © 2014 by Robert F. Smallwood
16 INFORMATION GOVERNANCE
c02 16 February 28, 2014 6:22 PM
Data governance is a newer, hybrid quality control discipline that includes elements of data quality, data management, IG policy development, business process improvement, and compliance and risk management.
Data Governance Strategy Tips
Everyone in an organization wants good-quality data to work with. But it is not so easy to implement a data governance program. First of all, data is at such a low level that executives and board members are typically unaware of the details of the “smoky back room” of data collection: cleansing, normalization, and input. So it is diffi cult to gain an executive sponsor and funding to initiate the effort. 1 And if a data governance program does move forward, there are challenges in getting business users to adhere to new policies. This is a crucial point, since much of the data is being generated by business units. But there are some general guidelines that can help improve a data governance program’s chances for success:
■ Identify a measureable impact. A data governance program must be able to dem- onstrate business value, or it will not get the executive sponsorship and funding it needs to move forward. A readiness assessment should capture the current state of data quality and whether an enterprise or business unit level effort is warranted. Other key issues include: Can the organization save hard costs by implementing data governance? Can it reach more customers or increase revenue generated from existing customers?2
■ Assign accountability for data quality to business units, not IT. Typically, IT has had responsibility for data quality, yet it is mostly not under that department’s con- trol, since most of the data is being generated in the business units. A pointed effort must be made to push responsibility and ownership for data to the busi- ness units that create and use the data.
■ Recognize the uniqueness of data as an asset. Unlike other assets, such as people, factories, equipment, and even cash, data is largely unseen, out of sight, and intangible. It changes daily. It spreads throughout business units. It is copied and deleted. Data growth can spiral out of control, obscuring the data that has true business value. So data has to be treated differently, and its unique qualities must be considered.
■ Forget the past; implement a going-forward strategy. It is a signifi cantly greater task to try to improve data governance across the enterprise for existing data. Remember, you may be trying to fi x decades of bad behavior, mismanagement, and lack of governance. Taking an incremental approach with an eye to the future provides for a clean starting point and can substantially reduce the pain required to implement. A proven best practice is to implement a from-this- point-on strategy where new data governance policies for handling data are implemented beginning on a certain date.
Data governance uses techniques like data cleansing and de-duplication to improve data quality and reduce redundancies.
INFORMATION GOVERNANCE, IT GOVERNANCE, DATA GOVERNANCE 17
c02 17 February 28, 2014 6:22 PM
Good data governance ensures that downstream negative effects of poor data are avoided and that subsequent reports, analyses, and conclusions are based on reliable, trusted data.
■ Manage the change. Educate, educate, educate. People must be trained to under- stand why the data governance program is being implemented and how it will benefi t the business. The new policies represent a cultural change, and people need supportive program messages and training in order to make the shift. 3
IT Governance
IT governance is the primary way that stakeholders can ensure that investments in IT create business value and contribute toward meeting business objectives.4 This strategic align- ment of IT with the business is challenging yet essential. IT governance programs go further and aim to “improve IT performance, deliver optimum business value and ensure regulatory compliance.” 5
Although the CIO typically has line responsibility for implementing IT gover- nance, the CEO and board of directors must receive reports and updates to discharge their responsibilities for IT governance and to see that the program is functioning well and providing business benefi ts.
Typically, in past decades, board members did not get involved in overseeing IT governance. But today it is a critical and unavoidable responsibility. According to the IT Governance Institute’s Board Briefi ng on IT Governance , “IT governance is the re- sponsibility of the board of directors and executive management. It is an integral part of enterprise governance and consists of the leadership and organizational structures and processes that ensure that the organization’s IT sustains and extends the organiza- tion’s strategies and objectives.” 6
The focus is on the actual software development and maintenance activities of the IT department or function, and IT governance efforts focus on making IT effi cient and effective. That means minimizing costs by following proven software develop- ment methodologies and best practices, principles of data governance and information quality, and project management best practices while aligning IT efforts with the busi- ness objectives of the organization.
IT Governance Frameworks
Several IT governance frameworks can be used as a guide to implementing an IT governance program. (They are introduced in this chapter in a cursory way; detailed discussions of them are best suited to books focused solely on IT governance.)
IT governance seeks to align business objectives with IT strategy to deliver business value.
18 INFORMATION GOVERNANCE
c02 18 February 28, 2014 6:22 PM
Although frameworks and guidance like CobiT® and ITIL have been widely adopted, there is no absolute standard IT governance framework; the combination that works best for an organization depends on business factors, corporate culture, IT maturity, and staffi ng capability. The level of implementation of these frameworks will also vary by organization.
CobiT® CobiT (Control Objectives for Information and related Technology) is a process-T based IT governance framework that represents a consensus of experts worldwide. Codeveloped by the IT Governance Institute and ISACA (previously known as the Information Systems Audit and Control Association), CobiT addresses business risks, control requirements, compliance, and technical issues. 7
CobiT offers IT controls that:
■ Cut IT risks while gaining business value from IT under an umbrella of a glob- ally accepted framework.
■ Assist in meeting regulatory compliance requirements. ■ Utilize a structured approach for improved reporting and management deci-
sion making. ■ Provide solutions to control assessments and project implementations to im-
prove IT and information asset control. 8
CobiT consists of detailed descriptions of processes required in IT and also tools to measure progress toward maturity of the IT governance program. It is industry agnostic and can be applied across all vertical industry sectors, and it continues to be revised and refi ned. 9
CobiT is broken out into three basic organizational levels and their responsibili- ties: (1) board of directors and executive management; (2) IT and business manage- ment; and (3) line-level governance, and security and control knowledge workers. 10
The CobiT model draws on the traditional “plan, build, run, monitor” paradigm of traditional IT management, only with variations in semantics. The CobiT framework is divided into four IT domains—(1) plan and organize, (2) acquire and implement, (3) deliver and support, and (4) monitor and evaluate—which contain 34 IT processes and 210 control objectives. Specifi c goals and metrics are assigned, and responsibilities and accountabilities are delineated.
The CobiT framework maps to the international information security standard, ISO 17799, and is also compatible with IT Infrastructure Library (ITIL) and other y “accepted practices” in IT development and operations.11
ValIT® ValIT is a newer value-oriented framework that is compatible with and complemen- tary to CobiT. Its principles and best practices focus is on leveraging IT investments to gain maximum value. Forty key ValIT essential management practices (analogous to CobiT’s control objectives) support three main processes: value governance, portfolio management, and investment management. ValIT and CobiT “provide a full frame- work and supporting tool set” to help managers develop policies to manage business risks and deliver business value while addressing technical issues and meeting control objectives in a structured, methodic way. 12
INFORMATION GOVERNANCE, IT GOVERNANCE, DATA GOVERNANCE 19
c02 19 February 28, 2014 6:22 PM
ITIL ITIL (Information Technology Infrastructure Library) is a set of process-oriented best practices and guidance originally developed in the United Kingdom to standard- ize delivery of IT service management. ITIL is applicable to both the private and public sectors and is the “most widely accepted approach to IT service management in the world.”13 As with other IT governance frameworks, ITIL provides essential guidance for delivering business value through IT, and it “provides guidance to or- ganizations on how to use IT as a tool to facilitate business change, transformation and growth.”14
ITIL best practices form the foundation for ISO/IEC 20000 (previously BS15000), the International Service Management Standard for organizational certifi cation and compliance. 15 ITIL 2011 is the latest revision (as of this printing), and it consists of fi ve core published volumes that map the IT service cycle in a systematic way:
1. ITIL Service Strategy 2. ITIL Service Design 3. ITIL Service Transition 4. ITIL Service Operation 5. ITIL Continual Service Improvement 16
ISO 38500 ISO/IEC 38500:2008 is an international standard that provides high-level principles and guidance for senior executives and directors, and those advising them, for the effective and effi cient use of IT. 17 Based primarily on AS 8015, the Australian IT gov- ernance standard, it “applies to the governance of management processes” that are performed at the IT service level, but the guidance assists executives in monitoring IT and ethically discharging their duties with respect to legal and regulatory compliance of IT activities.
The ISO 38500 standard comprises three main sections:
1. Scope, Application and Objectives 2. Framework for Good Corporate Governance of IT 3. Guidance for Corporate Governance of IT
CobiT is process-oriented and has been widely adopted as an IT governance framework. ValIT is value-oriented and compatible and complementary with CobiT, yet focuses on value delivery.
ITIL is the “most widely accepted approach to IT service management in the world.”
20 INFORMATION GOVERNANCE
c02 20 February 28, 2014 6:22 PM
It is largely derived from AS 8015, the guiding principles of which were:
■ Establish responsibilities ■ Plan to best support the organization ■ Acquire validly ■ Ensure performance when required ■ Ensure conformance with rules ■ Ensure respect for human factors
The standard also has relationships with other major ISO standards, and embraces the same methods and approaches. 18
Information Governance
Corporate governance is the highest level of governance in an organization, and a key aspect of it is IG. IG processes are higher level than the details of IT governance and much higher than data governance, but both data and IT governance can be (and should be) a part of an overall IG program. The IG approach to governance focuses not on detailed IT or data capture and quality processes but rather on controlling the information that is generated by IT and offi ce systems. d
IG efforts seek to manage and control information assets to lower risk, ensure com- pliance with regulations, and improve information quality and accessibility while imple- menting information security measures to protect and preserve information that has busi- ness value.19 (See Chapter 1 for more detailed defi nitions.)
Impact of a Successful IG Program
When making the business case for IG and articulating its benefi ts, it is useful to focus on its central impact. Putting cost-benefi t numbers to this may be diffi cult, unless you
ISO 38500 is an international standard that provides high-level principles and guidance for senior executives and directors responsible for IT governance.
IG is how an organization maintains security, complies with regulations and laws, and meets ethical standards when managing information.
INFORMATION GOVERNANCE, IT GOVERNANCE, DATA GOVERNANCE 21
c02 21 February 28, 2014 6:22 PM
also consider the worst-case scenario of loss or misuse of corporate or agency records. What is losing the next big lawsuit worth? How much are confi dential merger and acquisition documents worth? How much are customer records worth? Frequently, executives and managers do not understand the value of IG until it is a crisis, an ex- pensive legal battle is lost, heavy fi nes are imposed for noncompliance, or executives go to jail.
There are some key outputs from implementing an IG program. A successful IG program should enable organizations to:
■ Use common terms across the enterprise. This means that departments must agree on how they are going to classify document types, which requires a cross- functional effort. With common enterprise terms, searches for information are more productive and complete. This normalization process begins with developing a standardized corporate taxonomy, which defi nes the terms (and substitute terms in a custom corporate thesaurus), document types, and their relationships in a hierarchy.
■ Map information creation and usage. This effort can be buttressed with the use of technology tools such as data loss prevention , which can be used to discover the fl ow of information within and outside of the enterprise. You must fi rst determine who is accessing which information when and where it is going. Then you can monitor and analyze these information fl ows. The goal is to stop the erosion or misuse of information assets and to stem data breaches with moni- toring and security technology.
■ Obtain “information confi dence” —that is, the assurance that information has ” integrity, validity, accuracy, and quality; this means being able to prove that the information is reliable and that its access, use, and storage meet compliance and legal demands.
■ Harvest and leverage information. Using techniques and tools like data min- ing and business intelligence, new insights may be gained that provide an enterprise with a sustainable competitive advantage over the long term, since managers will have more and better information as a basis for busi- ness decisions.21
Summing Up the Differences
IG consists of the overarching polices and processes to optimize and leverage informa- tion while keeping it secure and meeting legal and privacy obligations in alignment with stated organizational business objectives.
IT governance consists of following established frameworks and best practices to gain the most leverage and benefi t out of IT investments and support accomplishment of business objectives.
Data governance consists of the processes, methods, and techniques to ensure that data is of high quality, reliable, and unique (not duplicated), so that downstream uses in reports and databases are more trusted and accurate.
22 INFORMATION GOVERNANCE
c02 22 February 28, 2014 6:22 PM
Notes
1. “New Trends and Best Practices for Data Governance Success,” SeachDataManagement.com eBook, http://viewer.media.bitpipe.com/1216309501_94/1288990195_946/Talend_sDM_SO_32247_EB- ook_1104.pdf, accessed March 11, 2013.
2. Ibid. 3. Ibid. 4. M.N. Kooper, R. Maes, and E.E.O. RoosLindgreen, “On the Governance of Information: Introducing
a New Concept of Governance to Support the Management of Information,” International Journal of Information Management 31 (2011): 195–120, http://dl.acm.org/citation.cfm?id=2297895 . (accessed t November 14, 2013).
5. Nick Robinson, “The Many Faces of IT Governance: Crafting an IT Governance Architecture,” ISACA Journal 1 (2007), www.isaca.org/Journal/Past-Issues/2007/Volume-1/Pages/The-Many-Faces-l of-IT-Governance-Crafting-an-IT-Governance-Architecture.aspx
6. Bryn Phillips, “IT Governance for CEOs and Members of the Board,” 2012, p.18. 7. Ibid., p.26. 8. IBM Global Business Services/Public Sector, “Control Objectives for Information and related Tech-
nology (CobiT®) Internationally Accepted Gold Standard for IT Controls & Governance,” http:// www-304.ibm.com/industries/publicsector/fi leserve?contentid=187551(accessed March 11, 2013).
CHAPTER SUMMARY: KEY POINTS
■ Data governance uses techniques like data cleansing and de-duplication to improve data quality and reduce redundancies.
■ Good data governance ensures that downstream negative effects of poor data are avoided and that subsequent reports, analyses, and conclusions are based on reliable, trusted data.
■ IT governance seeks to align business objectives with IT strategy to deliver business value.
■ CobiT is processoriented and has been widely adopted as an IT governance framework. ValIT is valueoriented and compatible and complementary with CobiT yet focuses on value delivery.
■ The CobiT framework maps to the international information security stan- dard ISO 17799 and is also compatible with ITIL (IT Infrastructure Library).
■ ITIL is the “most widely accepted approach to IT service management in the world.”
■ ISO 38500 is an international standard that provides high-level principles and guidance for senior executives and directors responsible for IT governance.
■ Information governance is how an organization maintains security, complies with regulations and laws, and meets ethical standards when managing information.
INFORMATION GOVERNANCE, IT GOVERNANCE, DATA GOVERNANCE 23
c02 23 February 28, 2014 6:22 PM
9. Phillips, “IT Governance for CEOs and Members of the Board.” 10. IBM Global Business Services/Public Sector, “Control Objectives for Information and related Tech-
nology (CobiT®) Internationally Accepted Gold Standard for IT Controls & Governance.” 11. Ibid. 12. Ibid. 13. www.itil-offi cialsite.com/ (accessed March 12, 2013). 14. ITIL, “What Is ITIL?” www.itil-offi cialsite.com/AboutITIL/WhatisITIL.aspx(accessed March 12, 2013). 15. Ibid. 16. Ibid. 17. “ISO/IEC 38500:2008 “Corporate Governance of Information Technology” www.iso.org/iso/
catalogue_detail?csnumber=51639(accessed November 14, 2013). 18. ISO 38500 www.38500.org/ (accessed March 12, 2013). 19. www.naa.gov.au/records-management/agency/digital/digital-continuity/principles/ (accessed November 14,
2013). 20. ARMA International, Glossary of Records and Information Management Terms , 4th ed. TR 22–2012 (from s
ARMA.org). 21. Arvind Krishna, “Three Steps to Trusting Your Data in 2011,” CTO Edge , March 9, 2011, www.ctoedge
.com/content/three-steps-trusting-your-data-2011
25
c03 25 February 28, 2014 11:41 AM
Information Governance Principles *
C H A P T E R 3
P rinciples of information governance (IG) are evolving and expanding. Successful IG programs are characterized by ten key principles, which are the basis for best practices and should be designed into the IG approach. They include:
1. Executive sponsorship. No IG effort will survive and be successful if it does not have an accountable, responsible executive sponsor. The sponsor must drive the effort, clear obstacles for the IG team or committee, communicate the goals and business objectives that the IG program addresses, and keep upper management informed on progress.
2. Information policy development and communication. Clear policies must be es- tablished for the access and use of information, and those policies must be communicated regularly and crisply to employees. Policies for the use of e- mail, instant messaging, social media, cloud computing, mobile computing, and posting to blogs and internal sites must be developed in consultation with stakeholders and communicated clearly. This includes letting employees know what the consequences of violating IG policies are, as well as its value.
3. Information integrity. This area considers the consistency of methods used to create, retain, preserve, distribute, and track information. Adhering to good IG practices include data governance techniques and technologies to ensure quality data. Information integrity means there is the assurance that informa- tion is accurate, correct, and authentic. IG efforts to improve data quality and information integrity include de-duplicating (removing redundant data) and maintaining only unique data to reduce risk, storage costs, and informa- tion technology (IT) labor costs while providing accurate, trusted information for decision makers. Supporting technologies must enforce policies to meet legal standards of admissibility and preserve the integrity of information to guard against claims that it has been altered, tampered with, or deleted (called “ spoliation ”). Audit trails must be kept and monitored to ensure compliance with IG policies to assure information integrity. 1
4. Information organization and classifi cation. This means standardizing formats, categorizing all information, and semantically linking it to related information. It also means creating a retention and disposition schedule that spells out how
* Portions of this chapter are adapted from Chapter 3 of Robert F. Smallwood, Managing Electronic Records: Methods, Best Practices, and Technologies , © John Wiley & Sons, Inc., 2013. Reproduced with permission of John Wiley & Sons, Inc. s
Information Governance: Concepts, Strategies and Best Practices By Robert F. Smallwood Copyright © 2014 by Robert F. Smallwood
26 INFORMATION GOVERNANCE
c03 26 February 28, 2014 11:41 AM
long the information (e.g. e-mail, e-documents, spreadsheets, reports) and records should be retained and how they are to be disposed of or archived. Information, and particularly documents, should be classifi ed according to a global or corporate taxonomy that considers the business function and owner of the information, and semantically links related information. Information must be standardized in form and format. Tools such as document labeling can assist in identifying and classifying documents. Metadata associated with documents and records must be standardized and kept up-to-date. Good IG means good metadata management and utilizing metadata standards that are appropriate to the organization.
5. Information security. This means securing information in its three states: at rest, in motion, and in use. It means implementing measures to protect information from damage, theft, or alteration by malicious outsiders and insiders as well as nonmalicious (accidental) actions that may compromise information. For instance, an employee may lose a laptop with confi dential information, but if proper IG policies are enforced using security-related information tech- nologies, the information can be secured. This can be done by access control methods, data or document encryption, deploying information rights manage- ment software, using remote digital shredding capabilities, and implement- ing enhanced auditing procedures. Information privacy is closely related to information security and is critical when dealing with personally identifi able information (PII).n
6. Information accessibility. Accessibility is vital not only in the short term but also over time using long-term digital preservation (LTDP) techniques when appropriate (generally if information is needed for over fi ve years). Accessibil- ity must be balanced with information security concerns. Information acces- sibility includes making the information as simple as possible to locate and access, which involves not only the user interface but also enterprise search principles, technologies, and tools. It also includes basic access controls, such as password management, identity and access management , and delivering t information to a variety of hardware devices.
7. Information control. Document management and report management software must be deployed to control the access to, creation, updating, and printing of documents and reports. When documents or reports are declared records, they must be assigned to the proper retention and disposition schedule to be retained for as long as the records are needed to comply with legal retention periods and regulatory requirements. Also, information that may be needed or requested in legal proceedings is safeguarded through a legal hold process.
8. Information governance monitoring and auditing. To ensure that guidelines and policies are being followed and to measure employee compliance levels, in- formation access and use must be monitored. To guard against claims of spo- liation, use of e-mail, social media, cloud computing, and report generation should be logged in real time and maintained as an audit record. Technology tools such as document analytics can track how many documents or reports users access and print and how long they spend doing so.
9. Stakeholder consultation. Those who work most closely to information are the ones who best know why it is needed and how to manage it, so business units must be consulted in IG policy development. The IT department understands
c03 27 February 28, 2014 11:41 AM
INFORMATION GOVERNANCE PRINCIPLES 27
its capabilities and technology plans and can best speak to those points. Le- gal issues must always be deferred to the in-house council or legal team. A cross-functional collaboration is needed for IG policies to hit the mark and be effective. The result is not only more secure information but also better information to base decisions on and closer adherence to regulatory and legal demands. 2
10. Continuous improvement. IG programs are not one-time projects but rather ongoing programs that must be reviewed periodically and adjusted to account for gaps or shortcomings as well as changes in the business environment, tech- nology usage, or business strategy.
Accountability Is Key
According to Debra Logan at Gartner Group, none of the proffered defi nitions of IG in- cludes “any notion of coercion, but rather ties governance to accountability [emphasis added] that is designed to encourage the right behavior. . . . The word that matters most is accountability .” The root of many problems with managing information is the “fact that there is no accountability for information as such.” 3
Establishing policies, procedures, processes, and controls to ensure the quality, in- tegrity, accuracy, and security of business records are the fundamental steps needed to reduce the organization’s risk and cost structure for managing these records. Then it is essential that IG efforts are supported by IT. The auditing, testing, maintenance, and im- provement of IG is enhanced by using electronic records management (ERM) software along with other complementary technology sets, such as workfl ow and business process management suite (BPMS) software and digital signatures.
Generally Accepted Recordkeeping Principles ®
Contributed by Charmaine Brooks, CRM A major part of an IG program is managing formal business records. Although they account for only about 7 to 9 percent of the total information that an organization holds, they are the most critically important subset to manage, as there are serious compliance and legal ramifi cations to not doing so.
Principles of successful IG programs are emerging. They include executive sponsorship, information classifi cation, integrity, security, accessibility, control, monitoring, auditing, policy development, and continuous improvement.
Accountability is a key aspect of IG.
28 INFORMATION GOVERNANCE
c03 28 February 28, 2014 11:41 AM
Records and recordkeeping are inextricably linked with any organized business activity. Through the information that an organization uses and records, creates, or receives in the normal course of business, it knows what has been done and by whom. This allows the organization to effectively demonstrate compliance with applicable standards, laws, and regulations as well as plan what it will do in the future to meet its mission and strategic objectives.
Standards and principles of recordkeeping have been developed by records and information management (RIM) practitioners to establish benchmarks for how or-t ganizations of all types and sizes can build and sustain compliant, defensible records management (RM) programs. t
The Principles
In 2009 ARMA International published a set of eight Generally Accepted Recordkeep- ing Principles,® known as The Principles 4 (or sometimes GAR Principles), to foster awareness of good recordkeeping practices. These principles and associated metrics provide an IG framework that can support continuous improvement.
The eight Generally Accepted Recordkeeping Principles are:
1. Accountability. A senior executive (or person of comparable authority) oversees the recordkeeping program and delegates program responsibility to appro- priate individuals. The organization adopts policies and procedures to guide personnel, and ensure the program can be audited.
2. Transparency. The processes and activities of an organization’s recordkeeping program are documented in a manner that is open and verifi able and is avail- able to all personnel and appropriate interested parties.
3. Integrity. A recordkeeping program shall be constructed so the records and information generated or managed by or for the organization have a reason- able and suitable guarantee of authenticity and reliability.
4. Protection. A recordkeeping program shall be constructed to ensure a reason- able level of protection to records and information that are private, confi den- tial, privileged, secret, or essential to business continuity.
5. Compliance. The recordkeeping program shall be constructed to comply with ap- plicable laws and other binding authorities, as well as the organization’s policies.
6. Availability. An organization shall maintain records in a manner that ensures timely, effi cient, and accurate retrieval of needed information.
7. Retention. An organization shall maintain its records and information for an appropriate time, taking into account legal, regulatory, fi scal, operational, and historical requirements.
8. Disposition. An organization shall provide secure and appropriate disposition for records that are no longer required to be maintained by applicable laws and the organization’s policies. 5
The Generally Accepted Recordkeeping Principles consist of eight principles that provide an IG framework that can support continuous improvement.
c03 29 February 28, 2014 11:41 AM
INFORMATION GOVERNANCE PRINCIPLES 29
The Principles apply to all sizes of organizations, in all types of industries, in both the private and public sectors, and can be used to establish consistent practices across business units. The Principles are an IG maturity model, and it is used as a preliminary evaluation of recordkeeping programs and practices.
Interest in and the application of The Principles for assessing an organization’s recordkeeping practices have steadily increased since their establishment in 2009. The Principles form an accountability framework that includes the processes, roles, stan- dards, and metrics that ensure the effective and effi cient use of records and informa- tion in support of an organization’s goals and business objectives.
As shown in Table 3.1 , the Generally Accepted Recordkeeping Principles matu- rity model associates characteristics that are typical in fi ve levels of recordkeeping capabilities ranging from 1 (substandard) to 5 (transformational). The levels are both descriptive and color coded for ease of understanding. The eight principles and levels (metrics) are applied to the current state of an organization’s recordkeeping capabili- ties and can be cross-referenced to the policies and procedures. While it is not unusual for an organization to be at different levels of maturity in the eight principles, the question “How good is good enough?” must be raised and answered ; a rating of less than “transforma-d tional” may be acceptable, depending on the organization’s tolerance for risk and an analysis of the costs and benefi ts of moving up each level.
The maturity levels defi ne the characteristics of evolving and maturing RM programs. The assessment should refl ect the current RM environment and practices. The principles and maturity level defi nitions, along with improvement recommendations (roadmap), outline the tasks required to proactively approach addressing systematic RM practices and reach the next level of maturity for each principle. While the Generally Accepted
Table 3.1 Generally Accepted Recordkeeping Principles Levels
Level 1
Substandard
Characterized by an environment where recordkeeping concerns are either not addressed at all or are addressed in an ad hoc manner.
Level 2
In Development
Characterized by an environment where there is a developing recognition that recordkeeping has an impact on the organization, and the organization may benefi t from a more defi ned information governance program.
Level 3
Essential
Characterized by an environment where defi ned policies and procedures exist that address the minimum or essential legal and regulatory requirements, but more specifi c actions need to be taken to improve recordkeeping.
Level 4
Proactive
Characterized by an environment where information governance issues and considerations are integrated into business decisions on a routine basis, and the organization consistently meets its legal and regulatory obligations.
Level 5
Transformational
Characterized by an environment that has integrated information governance into its corporate infrastructure and business processes to such an extent that compliance with program requirements is routine.
Source: Used with permission from ARMA.
The Generally Accepted Recordkeeping Principles maturity model measures recordkeeping maturity in fi ve levels.
30 INFORMATION GOVERNANCE
c03 30 February 28, 2014 11:41 AM
Recordkeeping Principles are broad in focus, they illustrate the requirements of good RM practices. The Principles Assessment can also be a powerful communication tool to promote cross-functional dialogue and collaboration among business units and staff.
Accountability The principle of accountability covers the assigned responsibility for RM at a seniory level to ensure effective governance with the appropriate level of authority. A senior- level executive must be high enough in the organizational structure to have suffi cient authority to operate the RM program effectively. The primary role of the senior ex- ecutive is to develop and implement RM policies, procedures, and guidance and to provide advice on all recordkeeping issues. The direct responsibility for managing or operating facilities or services may be delegated.
The senior executive must possess an understanding of the business and legislative environment within which the organization operates, business functions and activities, and the required relationships with key external stakeholders to understand how RM contributes to achieving the corporate mission, aims, and objectives.
It is important for top-level executives to take ownership of the RM issues of the organization and to identify corrective actions required for mitigation or ensure resolution of problems and recordkeeping challenges. An executive sponsor should identify opportunities to raise awareness of the relevance and importance of RM and effectively communicate the benefi ts of good RM to staff and management.
The regulatory and legal framework for RM must be clearly identifi ed and understood. The senior executive must have a sound knowledge of the organization’s information and technological architecture and actively participate in strategic deci- sions for IT systems acquisition and implementation.
The senior executive is responsible for ensuring that the processes, procedures, governance structures, and related documentation are developed. The policies should identify the roles and responsibilities at all levels of the organization.
An audit process must be developed to cover all aspects of RM within the organization, including substantiating that suffi cient levels of accountability have been assigned and accountability defi ciencies are identifi ed and remedied. Audit processes should include compliance with the organization policies and procedures for all records, regardless of format or media. Accountability audit requirements for electronic records include employing appropriate technology to audit the information architecture and systems. Accountability structures must be updated and maintained as changes occur in the technology infrastructure.
The audit process must reinforce compliance and hold individuals accountable. The results should be constructive, encourage continuous improvement, but not be used as a means of punishment. The audit should contribute to records program improve- ments in risk mitigation, control, and governance issues and have the capacity to support sustainability.
An audit process must be developed to cover all aspects of RM in the organization.
c03 31 February 28, 2014 11:41 AM
INFORMATION GOVERNANCE PRINCIPLES 31
Transparency Policies are broad guidelines for the operation of the organization and provide a basic guide to action that prescribes the boundaries within which business activities are to take place. They state the course of action to be followed by the organization, business unit, department, and employees.
Transparency of recordkeeping practices includes documenting processes and y promoting an understanding of the roles and responsibilities of all stakeholders. To be effective, policies must be formalized and integrated into business processes. Business rules and recordkeeping requirements need to be communicated and installed at all levels of the organization.
Senior management must recognize that transparency is fundamental to IG and compliance. Documentation must be consistent, current, and complete. A review and approval process must be established to ensure that the introduction of new programs or changes can be implemented and integrated into business processes.
Employees must have ready access to RM policies and procedures. They must re- ceive guidance and training to ensure they understand their roles and requirements for RM. Recordkeeping systems and business processes must be designed and developed to clearly defi ne the records lifecycle.
In addition to policies and procedures, guidelines and operational instructions, diagrams and fl owcharts, system documentation, and user manuals must include clear guidance on how records are to be created, retained, stored, and dispositioned. The documentation must be readily available and incorporated in communications and training provided to staff.
Integrity Record generating systems and repositories must be assessed to determine record- keeping capabilities. A formalized process must be in place for acquiring or developing new systems, including requirements for capturing the metadata required for lifecycle management of records in the systems. In addition, the record must contain all the necessary elements of an offi cial record, including structure, content, and context. Records integrity, y reliability, and trustworthiness are confi rmed by ensuring that a record was created by a competent authority according to established processes.
Maintaining the integrity of records means that they are complete and protected from being altered. The authenticity of a record is ascertained from internal and exter- nal evidence, including the characteristics, structure, content, and context of the records, to verify they are genuine and not corrupted or altered. In order to trust that a record is authentic, organizations must ensure that recordkeeping systems that create, capture , and manage electronic records are capable of protecting re- cords from accidental or unauthorized alteration or deletion while the record has value.
To be effective, policies must be formalized and integrated into business processes.
32 INFORMATION GOVERNANCE
c03 32 February 28, 2014 11:41 AM
Protection Organizations must ensure the protection of records and ensure they are unaltered through loss, tampering, or corruption. This includes technological change or the failure of digital storage media and protecting records against damage or deterioration.
This principle applies equally to physical and electronic records, each of which has unique requirements and challenges.
Access and security controls need to be established, implemented, monitored, and reviewed to ensure business continuity and minimize business risk. Restrictions on access and disclosure include the methods for protecting personal privacy and propri- etary information. Access and security requirements must be integrated into the busi- ness systems and processes for the creation, use, and storage of records.
LTDP is a series of managed activities required to ensure continued access to digi- tal materials for as long as necessary. Electronic records requiring long-term retention may require conversion to a medium and format suitable to ensure long-term access and readability.
Compliance RM programs include the development and training of the fundamental components, including compliance monitoring to ensure sustainability of the program.g
Monitoring for compliance involves reviewing and inspecting the various facets of records management, including ensuring records are being properly created and captured, im- plementation of user permissions and security procedures, workfl ow processes through sampling to ensure adherence to policies and procedures, ensuring records are being retained following disposal authorization, and documentation of records destroyed or transferred to determine whether destruction/transfer was authorized in accordance with disposal instructions.
Compliance monitoring can be carried out by an internal audit, external organiza- tion, or RM and must be done on a regular basis.
Availability Organizations should evaluate how effectively and effi ciently records and information are stored and retrieved using present equipment, networks, and software . The evaluation should identify current and future requirements and recommend new systems as appropriate. Certain factors should be considered before upgrading or imple- menting new systems. These factors are practicality, cost, and effectiveness of new confi gurations.
A major challenge for organizations is ensuring timely and reliable access to and use of information and that records are accessible and usable for the entire length of the retention period. Rapid changes and enhancements to both hardware and software compound this challenge.
Retention Retention is the function of preserving and maintaining records for continuing use. The reten- tion schedule identifi es the actions needed to fulfi ll the requirements for the retention and disposal of records and provides the authority for employees and systems to retain, destroy, or transfer records. The records retention schedule documents the record- keeping requirements and procedures, identifying how records are to be organized
c03 33 February 28, 2014 11:41 AM
INFORMATION GOVERNANCE PRINCIPLES 33
and maintained, what needs to happen to records and when, who is responsible for doing what, and whom to contact with questions or guidance.
Organizations must identify the scope of their recordkeeping requirements for documenting business activities based on regulated activities and jurisdictions that im- pose control over records. This includes business activities regulated by the govern- ment for every location or jurisdiction in which the company does business. Other considerations for determining retention requirements include operational, legal, fi s- cal, and historical ones.
Records appraisal is the process of assessing the value and risk of records to determine their retention and disposition requirements. Legal research is outlined in appraisal reports. This appraisal process may be accomplished as a part of the process of developing the records retention schedules as well as conducting a regular review to ensure that citations and requirements are current.
The records retention period is the length of time that records should be retained and d the actions taken for them to be destroyed or preserved. The retention periods for different records should be based on legislative or regulatory requirements as well as on admin- istrative and operational requirements.
It is important to document the legal research conducted and used to determine whether the law or regulation has been reasonably applied to the recordkeeping prac- tices and provide evidence to regulatory offi cials or courts that due diligence has been conducted in good faith to comply with all applicable requirements.
Disposition Disposition is the last stage in the life cycle of records. When the retention requirements have been met and the records no longer serve a useful business purpose, records may be destroyed. Records requiring long-term or permanent retention should be trans- ferred to an archive for preservation. The timing of the transfer of physical or elec- tronic records should be determined through the records retention schedule process. Additional methods, including migration or conversion, are often required to preserve electronic records.
Records must be destroyed in a controlled and secure manner and in accordance with authorized disposal instructions. The destruction of records must be clearly doc- umented to provide evidence of destruction according to an agreed-on program.
Destruction of records must be undertaken by methods appropriate to the con- fi dentiality of the records and in accordance with disposal instructions in the records retention schedule. An audit trail documenting the destruction of records should be maintained, and certifi cates of destruction should be obtained for destruction under- taken by third parties. In the event disposal schedules are not in place, written autho- rization should be obtained prior to destruction. Procedures should specify who must supervise the destruction of records. Approved methods of destruction must be speci- fi ed for each media type to ensure that information cannot be reconstructed.
Disposition is the last stage in the life cycle of records. Disposition is not syn- onymous with destruction, although destruction may be one disposal option.
34 INFORMATION GOVERNANCE
c03 34 February 28, 2014 11:41 AM
Disposition is not synonymous with destruction, although destruction may be one disposal option. Destruction of records must be carried out under controlled, confi dential conditions by shredding or permanent disposition. This includes the destruction of confi dential microfi lm, microfi che, computer cassettes, and computer tapes as well as paper.
Methods of Disposition
■ Discard. The standard destruction method for nonconfi dential records. If pos- sible, all records should be shredded prior to recycling. Note that transitory records can also be shredded.
■ Shred. Confi dential and sensitive records should be processed under strict security. This may be accomplished internally or by secure on-site shredding by a third party vendor who provides certifi cates of secure destruction. The shredded material is then recycled.
■ Archive. This designation is for records requiring long-term or permanent preservation. Records of enduring legal, fi scal, administrative, or historical value are retained.
■ Imaging. Physical records converted to digital images, after which the original paper documents are destroyed.
■ Purge. This special designation is for data, documents, or records sets that need to be purged by removing material based on specifi ed criteria. This often ap- plies to structure records in databases and applications.
Assessment and Improvement Roadmap
The Generally Accepted Recordkeeping Principles® maturity model can be lever- aged to develop a current state assessment of an organization’s recordkeeping prac- tices and resources, identify gaps and assess risks, and develop priorities for desired improvements.
The Principles were developed by ARMA International to identify characteristics of an effective recordkeeping program. Each of the eight principles identifi es issues and practices that, when evaluated against the unique needs and circumstances of an organization, can be applied to improvements for a recordkeeping program that meets recordkeeping requirements. The Principles identify requirements and can be used to guide incremental improvement in creation, organization, security, maintenance, and other activities over a period of one to fi ve years. Fundamentally, RM and information governance are business disciplines that must be tightly integrated with operational policies, procedures, and infrastructure.
The Principles can be mapped to the four improvement areas in Table 3.2 . As an accepted industry guidance maturity model, the Principles provide a con-
venient and complete framework for assessing the current state of an organization’s recordkeeping and developing a roadmap to identify improvements that will bring the organization into compliance. An assessment/analysis of the current RM practices, procedures, and capabilities together with current and future state practices provides two ways of looking at the future requirements of a complete RM (see Table 3.3 ).
c03 35 February 28, 2014 11:41 AM
INFORMATION GOVERNANCE PRINCIPLES 35
Table 3.2 Improvement Areas for Generally Accepted Recordkeeping Principles
Improvement Area A cc
o u
n ta
b ili
ty
Tr an
sp ar
e n
cy
In te
g ri
ty
P ro
te ct
io n
C o
m p
lia n
ce
A va
ila b
ili ty
R e te
n ti
o n
D is
p o
si ti
o n
Roles and responsibilities ◊ ◊ ◊
Policies and procedures ◊ ◊ ◊ ◊ ◊ ◊ ◊ ◊
Communication and training ◊ ◊ ◊ ◊ ◊
Systems and automation ◊ ◊ ◊ ◊ ◊ ◊
Who Should Determine IG Policies?
When forming an IG steering committee or board, it is essential to include represen- tatives from cross-functional groups and at different levels of the organization. The committee must be driven by an executive sponsor and include active members from key business units as well as other departments, including IT, fi nance, risk, compli- ance, RM, and legal. Then corporate training/education and communications must be involved to keep employees trained and current on IG policies. This function may be performed by an outside consulting fi rm if there is no corporate education staff.
Knowledge workers who work with records and sensitive information in any ca- pacity best understand the nature and value of the records they work with as they perform their day-to-day functions. IG policies must be developed and communicated clearly and consistently. Policies are worthless if people do not know or understand them or how to comply with them . And training is a crucial element that will be examined in any compliance hearing or litigation that may arise. “Did senior management not only cre- ate the policies but provide adequate training on them on a consistent basis?” This will be a key question raised. So a training plan is a necessary piece of IG, and education should be heavily emphasized. 6
The need for IG is increasing due to increased and tightened regulations, in- creased litigation, and the increased incidence of theft and misuse of internal docu- ments and records. Organizations that do not have active IG programs should reevaluate IG policies and their internal processes following any major loss of records, the inability to
When forming an IG steering committee or board, it is essential to include representatives from cross-functional groups.
Knowledge workers who work with records in any capacity best understand the nature and value of the records they work with.
36
c03 36 February 28, 2014 11:41 AM
T ab
le 3
.3
A ss
es sm
en t
R ep
or t
an d
R oa
d M
ap .
P ri
n ci
p le
Le ve
l Fi
n d
in g
s R
e q
u ir
e m
e n
ts t
o M
o ve
t o
t h
e N
e xt
S te
p
A cc
o u n
ta b
ili ty
Le ve
l 1
Su b
st an
d ar
d
N o s
en io
r ex
ec u ti
ve (
o r
p er
so n
o f
co m
p ar
ab le
a u th
o ri
ty )
is r
es p
o n
si b
le f
o r
th e
R M
p ro
g ra
m .
T h
e re
co rd
s m
an ag
er r
o le
is la
rg el
y n
o n
ex is
te n
t o r
is a
n a
d m
in is
tr at
iv e
an d
/ o r
cl er
ic al
r o le
d is
tr ib
u te
d a
m o n
g g
en er
al s
ta ff
.
1 .
A ss
ig n
R M
r es
p o n
si b
ili ti
es t
o s
en io
r ex
ec u ti
ve .
2 .
H ir
e o r
p ro
m o te
r ec
o rd
s m
an ag
er .
Tr an
s p ar
en cy
Le ve
l 1
Su b
st an
d ar
d
It is
d iffi
c u lt
t o o
b ta
in in
fo rm
at io
n a
b o u t
th e
o rg
an iz
at io
n o
r it
s re
co rd
s in
a
ti m
el y
fa sh
io n
. N
o c
le ar
d o cu
m en
ta ti
o n
is r
ea d
ily a
va ila
b le
.
T h
er e
is n
o e
m p
h as
is o
n t
ra n
sp ar
en cy
.
P u b
lic r
e q u es
ts f
o r
in fo
rm at
io n
, d
is co
ve ry
f o r
lit ig
at io
n , re
g u la
to ry
r es
p o n
se s,
o r
o th
er r
e q u es
ts (
e. g
., f
ro m
p o te
n ti
al b
u si
n es
s p
ar tn
er s,
in ve
st o rs
, o r
b u ye
rs )
ca n
n o t
b e
re ad
il y a
cc o m
m o d
at ed
.
T h
e o rg
an iz
at io
n h
as n
o t
es ta
b lis
h ed
c o n
tr o ls
t o e
n su
re t
h e
co n
si st
en cy
o f
in f o
rm at
io n
d is
cl o su
re .
B u si
n es
s p
ro ce
ss es
a re
n o t
w el
l d efi
n ed
.
1 .
D ev
el o p
p o lic
ie s
an d
p ro
ce d
u re
s.
2 .
D ev
el o p
t ra
in in
g f
o r
al l l
ev el
s o f
st af
f.
3 .
Id en
ti fy
r eq
u ir
em en
ts f
o r
re co
rd s
fi n d
ab ili
ty
an d
a cc
es si
b ili
ty .
4 .
D efi
n e
b u si
n es
s p
ro ce
ss es
.
In te
g ri
ty Le
ve l 1
Su b
st an
d ar
d
T h
er e
ar e
n o s
ys te
m at
ic a
u d
it s
o r
d efi
n ed
p ro
ce ss
es f
o r
sh o w
in g
t h
e o ri
g in
an
d a
u th
en ti
ci ty
o f
a re
co rd
.
V ar
io u s
o rg
an iz
at io
n al
f u n
ct io
n s
u se
a d
h o c
m et
h o d
s to
d em
o n
st ra
te
au th
en ti
ci ty
a n
d c
h ai
n o
f cu
st o d
y, a
s ap
p ro
p ri
at e,
b u t
th ei
r tr
u st
w o rt
h in
es s
ca n
n o t
ea si
ly b
e g
u ar
an te
ed .
1 .
D ev
el o p
a u d
it p
ro ce
ss .
2 .
Id en
ti fy
b u si
n es
s ac
ti vi
ti es
f o r
cr ea
ti o n
a n
d
st o ra
g e
o f
re co
rd s.
P ro
te ct
io n
Le ve
l 1
Su b
st an
d ar
d
N o c
o n
si d
er at
io n
is g
iv en
t o r
ec o rd
p ri
va cy
.
R ec
o r d
s ar
e st
o re
d h
ap h
az ar
d ly
, w
it h
p ro
te ct
io n
t ak
en b
y va
ri o u s
g ro
u p
s an
d
d ep
ar tm
en ts
w it
h n
o c
en tr
al iz
ed a
cc es
s co
n tr
o ls
.
A cc
es s
co n
tr o ls
, if
an y,
a re
a ss
ig n
ed b
y th
e au
th o r.
1 .
A ss
es s
se cu
ri ty
a n
d a
cc es
s co
n tr
o ls
.
2 .
D ev
e l o p
a cc
es s
an d
s ec
u ri
ty c
o n
tr o l s
ch em
e.
C o m
p lia
n ce
Le ve
l 3
Es se
n ti
al
T h
e o rg
an iz
at io
n h
as id
en ti
fi e d
a ll
re le
va n
t co
m p
lia n
ce la
w s
an d
r eg
u la
ti o n
s.
R ec
o rd
c re
at io
n a
n d
c ap
tu re
a re
s ys
te m
at ic
al ly
c ar
ri ed
o u t
in a
cc o rd
an ce
w it
h R
M p
ri n
ci p
le s.
T h
e o rg
an iz
at io
n h
as a
s tr
o n
g c
o d
e o f
b u si
n es
s co
n d
u ct
, w
h ic
h is
in te
g ra
te d
in
to it
s o ve
ra ll
IG s
tr u ct
u re
a n
d r
ec o rd
-k ee
p in
g p
o lic
ie s.
C o m
p lia
n ce
a n
d t
h e
re co
rd s
th at
d em
o n
st ra
te it
a re
h ig
h ly
v al
u ed
a n
d m
ea su
ra b
le .
1 .
Im p
le m
en t
sy st
em s
to c
ap tu
re a
n d
p ro
te ct
re co
rd s.
2 .
D ev
el o p
m et
ad at
a sc
h em
e.
3 .
D ev
el o p
r em
ed ia
ti o n
p la
n a
n d
im p
le m
en t
co rr
ec ti
ve a
ct io
n s.
37
c03 37 February 28, 2014 11:41 AM
T h
e h
o ld
p ro
ce ss
is in
te g
ra te
d in
to t
h e
o rg
an iz
at io
n ’s
in fo
rm at
io n
m an
a g em
en t
an d
d is
co ve
ry p
ro ce
ss es
f o r
th e
m o st
c ri
ti ca
l s ys
te m
s.
T h
e o rg
an iz
at io
n h
as d
efi n
ed s
p ec
ifi c
g o al
s re
la te
d t
o c
o m
p lia
n ce
.
A va
ila b
ili ty
Le ve
l 2
In D
ev el
o p
m en
t
R ec
o rd
r et
ri ev
al m
ec h
an is
m s
h av
e b
ee n
im p
le m
en te
d in
c er
ta in
a re
as o
f th
e o rg
an iz
at io
n .
In t
h o se
a re
as w
it h
r et
ri ev
al m
ec h
an is
m s,
it is
p o ss
ib le
t o d
is ti
n g
u is
h b
et w
ee n
o ffi c
ia l r
ec o rd
s, d
u p
lic at
es , an
d n
o n
re co
rd m
at er
ia ls
.
T h
er e
ar e
so m
e p
o lic
ie s
o n
w h
er e
an d
h o w
t o s
to re
o ffi c
ia l r
ec o rd
s, b
u t
a st
an d
ar d
is n
o t
im p
o se
d a
cr o ss
t h
e o rg
an iz
at io
n .
Le g
al d
is co
ve ry
is c
o m
p lic
at ed
a n
d c
o st
ly d
u e
to t
h e
in co
n si
st en
t tr
ea tm
en t
o f
in fo
rm at
io n
.
1 .
D ev
el o p
e n
te rp
ri se
c la
ss ifi
ca ti
o n
s ch
em e.
2 .
Id en
ti fy
u se
r se
ar ch
a n
d r
et ri
ev al
re
q u ir
em en
ts .
3 .
D ev
e l o p
s ta
n d
ar d
s fo
r m
an ag
in g
t h
e re
co rd
s lif
ec yc
le .
R et
en ti
o n
Le ve
l 2
In D
ev el
o p
m en
t
A r
et en
ti o n
s ch
ed u le
is a
va ila
b le
b u t
d o es
n o t
en co
m p
as s
al l r
ec o rd
s, d
id
n o t
g o t
h ro
u g
h o
ffi c
ia l r
ev ie
w , an
d is
n o t
w el
l k n
o w
n t
h ro
u g
h o u t
th e
o rg
an iz
at io
n .
T h
e re
te n
ti o n
s ch
ed u le
is n
o t
re g
u la
rl y
u p
d at
ed o
r m
ai n
ta in
ed .
Ed u ca
ti o n
a n
d t
ra in
in g
a b
o u t
th e
re te
n ti
o n
p o lic
ie s
ar e
n o t
av ai
la b
le .
1 .
D ev
el o p
e n
te rp
ri se
-w id
e fu
n ct
io n
al r
et en
ti o n
sc
h ed
u le
.
2 .
M ap
r et
en ti
o n
s ch
ed u le
t o c
la ss
ifi ca
ti o n
sc h
em e.
3 .
Im p
le m
en t
an a
n n
u al
r ev
ie w
p ro
ce ss
f o r
re co
rd s
er ie
s an
d le
g al
r es
ea rc
h .
4 .
D ev
el o p
t ra
in in
g f
o r
cl as
si fi c
at io
n s
ch em
e an
d
r e te
n ti
o n
s ch
ed u le
.
D is
p o si
ti o n
Le ve
l 2
In D
ev el
o p
m en
t
P re
lim in
ar y
g u id
el in
es f
o r
d is
p o si
ti o n
a re
e st
ab lis
h ed
.
T h
er e
is a
r ea
liz at
io n
o f
th e
im p
o rt
an ce
o f
su sp
en d
in g
d is
p o si
ti o n
in a
co
n si
st en
t m
an n
er , re
p ea
ta b
le b
y ce
rt ai
n le
g al
g ro
u p
in g
s.
T h
er e
m a y
o r
m ay
n o t
b e
en fo
rc em
en t
an d
a u d
it in
g o
f d
is p
o si
ti o n
.
1 .
D ev
el o p
p ro
ce d
u re
s fo
r re
co rd
s d
is p
o si
ti o n
.
2 .
Im p
le m
en t
d is
p o si
ti o n
p ro
ce ss
es .
3 .
D ev
e l o p
a u d
it t
ra ils
f o r
re co
rd s
tr an
sf er
s an
d
d es
tr u ct
io n
.
O ve
ra ll
Le ve
l 1
Su b
st an
d ar
d
38 INFORMATION GOVERNANCE
c03 38 February 28, 2014 11:41 AM
CHAPTER SUMMARY: KEY POINTS
■ Principles of successful IG programs are emerging. They include executive sponsorship, information classifi cation, integrity, security, accessibility, control, monitoring, auditing, policy development, and continuous improvement.
■ Accountability is a key aspect of IG.
■ The Generally Accepted Recordkeeping Principles® (“The Principles”) consist of eight principles that provide an IG framework that can support continuous improvement.
■ An audit process must be developed to cover all aspects of RM in the organization.
■ To be effective, policies must be formalized and integrated into business processes.
■ Disposition is the last stage in the life cycle of records. Disposition is not synonymous with destruction, although destruction may be one disposal option.
■ Knowledge workers who work with records in any capacity best understand the nature and value of the records they work with.
■ When forming an information governance steering committee or board, it is essential to include representatives from cross-functional groups.
■ Organizations without active IG programs should reevaluate IG policies and their internal processes following any major loss of records, the inability to produce accurate records in a timely manner, or any document security breach or theft.
produce accurate records in a timely manner, or any document security breach or theft. If review boards include a broad section of critical players on the IG committee and leverage executive sponsorship, theywill better prepare the organization for legal and regulatory rigors.
Notes
1. Laura DuBois and Vivian Tero, “Practical Information Governance: Balancing Cost, Risk, and Produc- tivity,” IDC White Paper, August 2010, www.emc.com/collateral/analyst-reports/idc-practical-infor- mation-governance-ar.pdf
2. Ibid. 3. Debra Logan, “What Is Information Governance? And Why Is It So Hard?” January 11, 2010, http://
blogs.gartner.com/debra_logan/2010/01/11/what-is-information-governance-and-why-is-it-so-hard/ .
c03 39 February 28, 2014 11:41 AM
INFORMATION GOVERNANCE PRINCIPLES 39
4. ARMA International, “Generally Accepted Recordkeeping Principles,” www.arma.org/r2/generally- accepted-br-recordkeeping-principles/copyright (accessed November 14, 2013).
5. ARMA International,“Information Governance Maturity Model,” www.arma.org/r2/generally- accepted-br-recordkeeping-principles (accessed November 14, 2013).
6. “Governance Overview (SharePoint Server 2010),” http://technet.microsoft.com/en-us/library/ cc263356.aspx (accessed April 19, 2011).
c04 41 February 28, 2014 11:42 AM
PA RT T W O Information Governance Risk Assessment and Strategic Planning
43
c04 43 February 28, 2014 11:42 AM
C H A P T E R 4 Information Risk Planning and Management
I nformation risk planning involves a number of progressive steps: identifying poten- tial risks to information, weighing those risks, creating strategic plans to mitigate the risks, and developing those plans into specifi c policies. Then it moves to develop-
ing metrics to measure compliance levels and identifying those who are accountable for executing the new risk mitigating processes. These processes must be audited and tested periodically not only to ensure compliance, but also to fi ne tune and improve the processes.
Depending on the jurisdiction, information is required by specifi c laws and regu- lations to be retained for specifi ed periods, and to be produced in specifi ed situations. To determine which laws and regulations apply to your organization’s information, re- search into the legal and regulatory requirements for information in the jurisdictions in which your organization operates must be conducted.
Step 1: Survey and Determine Legal and Regulatory Applicability and Requirements
There are federal, provincial, state, and even municipal laws and regulations that may apply to the retention of information (data, documents, and records). Organizations operating in multiple jurisdictions must maintain compliance with laws and regula- tions that may cross national, state, or provincial boundaries. Legally required pri- vacy requirements and retention periods must be researched for each jurisdiction (e.g. county, state, country) in which the business operates, so that it complies with all ap- plicable laws.
IG, compliance, and records managers must conduct their own legislative research to apprise themselves of mandatory information retention requirements, as well as privacy considerations and requirements, especially in regard to personally identifi - able information (PII). This information must be analyzed and structured and pre- sented to legal staff for discussion. Then further legal and regulatory research must be conducted, and fi rm legal opinions must be rendered by legal counsel regarding information retention, privacy, and security requirements in accordance with laws and regulations. This is an absolute requirement. In order to arrive at a consensus on records that have legal value to the organization and to construct an appropriate retention
Information Governance: Concepts, Strategies and Best Practices By Robert F. Smallwood Copyright © 2014 by Robert F. Smallwood
44 INFORMATION GOVERNANCE
c04 44 February 28, 2014 11:42 AM
schedule, your legal staff or outside legal counsel should explain the legal hold process, provide opinions and interpretations of law that apply to your organization, and ex- plain the value of formal records.
Legal requirements trump all others. The retention period for a particular type of document or PII data or records series must meet minimum retention, privacy, and security requirements as mandated by law. Business needs and other considerations are secondary. So, legal research is required before determining and implementing reten- tion periods, privacy policies, and security measures.
In order to locate the regulations and citations relating to retention of records, there are two basic approaches. The fi rst approach is to use a records retention citation service, which publishes in electronic form all of the retention-related citations. These services usually are purchased on a subscription basis, as the cita- tions are updated on an annual or more frequent basis as legislation and regula- tions change.
Figure 4.1 is an excerpt from a Canadian records retention database product called FILELAW®. 1 In this case, the act, citation, and retention periods are clearly identifi ed.
Another approach is to search the laws and regulations directly using online or print resources. Records retention requirements for corporations operating in the United States may be found in the Code of Federal Regulations (CFR).
In identifying information requirements and risks, legal requirements trump all others.
Figure 4.1 Excerpt from Canadian Records Retention Database Source: Ontario, Electricity Act, FILELAW database, Thomson Publishers, May 2012.
c04 45 February 28, 2014 11:42 AM
INFORMATION RISK PLANNING AND MANAGEMENT 45
The Code of Federal Regulations (CFR) annual edition is the codifi cation of the general and permanent rules published in the Federal Register by the de- partments and agencies of the federal government. It is divided into 50 titles that represent broad areas subject to federal regulation. The 50 subject matter titles contain one or more individual volumes, which are updated once each calendar year, on a staggered basis. The annual update cycle is as follows: titles 1 to 16 are revised as of January 1; titles 17 to 27 are revised as of April 1; titles 28 to 41 are revised as of July 1; and titles 42 to 50 are revised as of October 1. Each title is divided into chapters, which usually bear the name of the issu- ing agency. Each chapter is further subdivided into parts that cover specifi c regulatory areas. Large parts may be subdivided into subparts. All parts are organized in sections, and most citations to the CFR refer to material at the section level. 2
There is an up-to-date version that is not yet a part of the offi cial CFR but is updated daily, the Electronic Code of Federal Regulations (e-CFR) . “It is not an offi cial legal edition of the CFR. The e-CFR is an editorial compilation of CFR ma- terial and Federal Register amendments produced by the National Archives and Re- cords Administration’s Offi ce of the Federal Register . . . and the Government Printing Offi ce.”3 According to the gpoaccess.gov Web site:
The Administrative Committee of the Federal Register (ACFR) has autho- rized the National Archives and Records Administration’s (NARA) Offi ce of the Federal Register (OFR) and the Government Printing Offi ce (GPO) to develop and maintain the e-CFR as an informational resource pending ACFR action to grant the e-CFR offi cial legal status. The OFR/GPO partnership is committed to presenting accurate and reliable regulatory information in the e-CFR editorial compilation with the objective of establishing it as an ACFR sanctioned publication in the future. While every effort has been made to en- sure that the e-CFR on GPO Access is accurate, those relying on it for legal research should verify their results against the offi cial editions of the CFR, Federal Register and List of CFR Sections Affected (LSA), all available online at www.gpoaccess.gov . Until the ACFR grants it offi cial status, the e-CFR editorial compilation does not provide legal notice to the public or judicial notice to the courts.
The OFR updates the material in the e-CFR on a daily basis. Generally, the e-CFR is current within two business days. The current update status is displayed at the top of all e-CFR web pages.
For governmental agencies, a key consideration is complying with requests for information as a result of freedom of information laws like the U.S. Freedom of
In the United States the Code of Federal Regulations lists retention require- ments for businesses, divided into 50 subject matter areas.
46 INFORMATION GOVERNANCE
c04 46 February 28, 2014 11:42 AM
Information Act, Freedom of Information Act 2000 (in the United Kingdom), and similar legislation in other countries. So the process of governing information is criti- cal to meeting these requests by the public for governmental records.
Step 2: Specify IG Requirements to Achieve Compliance
Once the legal research has been conducted and a process for keeping updated on laws and regulations has been established, specifi c external compliance requirements can be listed and those data, document, and record sets that apply to those external compliance requirements can be mapped back to applicable holdings of data sets, document col- lections, and records series. The crucial task is keeping your legal and records manage- ment staff apprised of changes and updating the policies and processes appropriately.
Internal IG retention policies may be different from the legally mandated minimums. For instance, an organization that is not operating in a highly regulated industry that wants to balance defensible disposition with a need to retain corporate memory and develop knowledge management (KM) content or “knowledge bases” may have the optiont to dispose of e-mail that is not declared a record or cited for legal hold after 90 days, but may choose, based on corporate culture and other business factors, to retain e-mail messages for a year. Similarly, the organization may make legally defensible disposition decisions that reduce the total amount of information it must manage by using a “last ac- cessed” rationale, whereby information that has not been accessed for over one year (or whatever the specifi ed period is) may be destroyed and discarded, as a matter of policy.
Step 3: Create a Risk Profi le
Creating a risk profi le is a basic building block in enterprise risk management (yet t another ERM acronym), which assists executives in understanding the risks associatedr with stated business objectives and allocating resources, within a structured evaluation approach or framework. There are multiple ways to create a risk profi le, and how often it is done, the external sources consulted, and stakeholders who have input will vary from organization to organization. 4 A key tenet to bear in mind is that simpler is better and that sophisticated tools and techniques should not make the process overly complex. According to the ISO, risk is defi ned as “the effect of uncertainty on objectives,” and a risk profi le is “a description of a set of risks.”5 Creating a risk profi le involves identifying, docu- menting, assessing, and prioritizing risks that an organization may face in pursuing its business objectives. It can be a simple table chart. Those associated risks can then be evaluated and delineated within a risk or IG framework.
The corporate risk profi le should be an informative tool for executive manage- ment, the CEO, and the board of directors, so it should refl ect that tone. In other
The risk profi le is a high-level, executive decision input tool.
c04 47 February 28, 2014 11:42 AM
INFORMATION RISK PLANNING AND MANAGEMENT 47
words, it should be clear, succinct, and simplifi ed. A risk profi le may also serve to in- form the head of a division or subsidiary, in which case it may contain more detail. The process can also be applied to public and nonprofi t entities.
The time horizon for a risk profi le varies, but looking out three to fi ve years is a good rule of thumb . 6 The risk profi le typically will be created annually, although semiannually would serve the organization better and account for changes in the business and legal environment. But if an organization is competing in a market sector with rapid busi- ness cycles or volatility, the risk profi le should be generated more frequently, perhaps quarterly.
There are different types of risk profi le methodologies; common methodologies are a top-10 list, a risk map , and a heat map . The top-10 list is a simple identifi cation and ranking of the 10 greatest risks in relation to business objectives. The risk map is a visual tool that is easy to grasp, with a grid depicting a likelihood axis and an impact axis, usually rated on a scale of 1 to 5. In a risk assessment meeting, stakeholders can weigh in on risks using voting technology to generate a consensus. A heat map is a color-coded matrix generated by stakeholders voting on risk level by color (e.g., red being highest).
Information gathering is a fundamental activity in building the risk profi le. Surveys are good for gathering basic information, but for more detail, a good method to employ is direct, person-to-person interviews, beginning with executives and risk professionals.7 Select a representative cross section of functional groups to gain a broad view. Depend- ing on the size of the organization, you may need to conduct 20 to 40 interviews, with one person asking the questions and probing while another team member takes notes and asks occasionally for clarifi cation or elaboration. Conduct the interviews in a com- pressed timeframe—knock them out within one to three weeks and do not drag the process out, as business conditions and personnel can change over the course of months.
Here are three helpful considerations to conducting successful interviews.
1. Prepare some questions for interviewees in advance and provide them to in- terviewees so they may prepare and do some of their own research.
2. Schedule the interview close to their offi ces, and at their convenience. 3. Keep the time as short as possible but long enough to get the answers you will
need: approximately 20 to 45 minutes. Be sure to leave some open time be- tween interviews to collect your thoughts and prepare for the next interview. And follow up with interviewees after analyzing and distilling your notes to confi rm you have gained the correct insights.
The information you will be harvesting will vary depending on the interviewee’s level and function. You will need to look for any hard data or reports that show performance and trends related to information risk. There may be benchmarking data
A common risk profi le method is to create a prioritized or ranked top-10 list of greatest risks to information.
48 INFORMATION GOVERNANCE
c04 48 February 28, 2014 11:42 AM
available as well. Delve into information access and security policies, policy devel- opment, policy adherence, and the like. Ask questions about retention of e-mail and legal hold processes. Ask about records retention and disposition policies. Ask about long-term preservation of digital records. Ask about data deletion policies. Ask for documentation regarding IG-related training and communications. Dig into policies for access to confi dential data and securing vital records. Try to get a real sense of the way things are run, what is standard operating procedure, and also how workers might get around overly restrictive policies, or operate without clear policies. Learn enough so that you can grasp the management style and corporate culture, and then distill that information into your fi ndings.
Key events and developments must also be included in the risk profi le. For in- stance, a major data breach, the loss or potential loss of a major lawsuit, pending regu- latory changes that could impact your IG policies, or a change in business ownership or structure must all be accounted for and factored into the information risk profi le. Even changes in governmental leadership should be considered, if they might impact IG policies. These types of developments should be tracked on a regular basis and should continue to feed into the risk equation. 8 Key events should be monitored and incorporated in developing and subsequently updating the risk profi le.
At this point, it should be possible to generate a list of specifi c potential risks. It may be useful to group or categorize the potential risks into clusters, such as natural disaster, regulatory, safety, competitive, and so forth . Armed with this list of risks, you should solicit input from stakeholders as to the likelihood and timing of the threats or risks. As the organization matures in its risk identifi cation and handling capabilities, a good practice is to look at the risks and their ratings from previous years to attempt to gain insights into change and trends—both external and internal—that affected the risks.
Step 4: Perform Risk Analysis and Assessment
Once you have created a risk profi le and identifi ed key risks, you must conduct an as- sessment of the likelihood that these risks hold and their resultant impact.
There are fi ve basic steps in conducting a risk assessment: 9
1. Identify the risks. This should be an output of creating a risk profi le, but if con- ducting an information risk assessment, fi rst identify the major information- related risks.
2. Determine potential impact. If a calculation of a range of economic impact is possible (e.g., lose $5 to $10 million in legal damages), then include it. If not, be as specifi c as possible as to how a negative event related to an identifi ed risk can impact business objectives.
Once a list of risks is developed, grouping them into basic categories helps stakeholders grasp them more easily and consider their likelihood and impact.
c04 49 February 28, 2014 11:42 AM
INFORMATION RISK PLANNING AND MANAGEMENT 49
3. Evaluate risk levels and probabilities and recommend action. This may be in the form of recommending new procedures or processes, new investments in in- formation technology (IT), or other actions to mitigate identifi ed risks.
4. Create a report with recommendations and implement. You may want to include a risk assessment table (see Table 4.1 ) as well as written recommendations, then implement.
5. Review periodically. Review annually or semiannually, as appropriate for your organization.
A helpful exercise and visual tool is to draw up a table of top risks, their potential impacts, actions that have been taken to mitigate the risks, and suggested new risk countermeasures, as in Table 4.1 .
Step 5: Develop an Information Risk Mitigation Plan
After setting out the risks, their potential impacts, and suggested countermeasures for mitigation, you must create the information risk mitigation plan , which means developing options and tasks to reduce the specifi ed risks and improve the odds of achieving business objectives. 10 Basically, you are putting in writing the information you have collected and analyzed in creating the risk profi le and risk assessment, and as- signing specifi cs. The information risk mitigation plan should include a timetable and milestones for implementation of the recommended risk mitigation measures, includ- ing IT acquisition and implementation and assigning roles and responsibilities, such as executive sponsor, project manager (PM), and project team.
Table 4.1 Risk Assessment
What Are the Risks?
How Might They Impact Business Objectives?
Actions and Processes Currently in Place
Additional Resources Needed to Manage This Risk
Action by Whom?
Action by When? Done
Breach of confi dential documents
Compromise confi dential information
Compromise competitive position
Compromise business negotiations
Utilizing ITIL and CobiT IT frameworks
Published security policies
Semiannual security audits
Implement newer technologies including information rights management
Implement quarterly audits
IT staff, security offi cer
01/10/2016 01/10/2016
The risk mitigation plan develops risk reduction options and tasks to reduce specifi ed risks and improve the odds for achieving business objectives.
50 INFORMATION GOVERNANCE
c04 50 February 28, 2014 11:42 AM
Step 6: Develop Metrics and Measure Results
How do you know how well you are doing? Have you made progress in reducing your organization’s exposure to information risk? To measure conformance and per- formance of your IG program, you must have an objective way to measure how you are doing, which means numbers and metrics. Assigning some quantitative measures that are meaningful and do, in fact, measure progress may take some serious effort and consultation with stakeholders. Determining relevant ways of measuring progress will allow executives to see progress, as, realistically, reducing risk is not something anyone can see or feel—the painful realizations are made only when the risk comes home to roost. Also, valid metrics help to justify investment in the IG program.
Although the proper metrics will vary from organization to organization, some specifi c metrics include:
■ Reduce the data lost on stolen or misplaced laptops by 50 percent over the previous fi scal year.
■ Reduce the number of hacker intrusion events by 75 percent over the previous fi scal year.
■ Reduce e-discovery costs by 25 percent over the previous fi scal year. ■ Reduce the number of adverse fi ndings in the risk and compliance audit by 50
percent over the previous fi scal year. ■ Provide information risk training to 100 percent of the knowledge-level work-
force this fi scal year. ■ Roll out the implementation of information rights management software to
protect confi dential e-documents to 50 users this fi scal year. ■ Provide confi dential messaging services for the organization’s 20 top executives
this fi scal year.
Your organization’s metrics should be tailored to address the primary goals of your IG program and should tie directly to stated business objectives.
Step 7: Execute Your Risk Mitigation Plan
Now that you have the risk mitigation plan, it must be executed. To do so, you must set up regular project/program team meetings, develop key reports on your information risk mitigation metrics, and manage the process. This is done using proven project and pro- gram management tools and techniques, which you may want to supplement with collab- oration software tools, knowledge management software, or even internal social media.
But most important, execution of the risk mitigation plan involves communicating clearly and regularly with the IG team on the progress and status of the IG effort to reduce information risk.
Metrics are required to measure progress in the risk mitigation plan.
c04 51 February 28, 2014 11:42 AM
INFORMATION RISK PLANNING AND MANAGEMENT 51
Step 8: Audit the Information Risk Mitigation Program
The metrics you have developed to measure risk mitigation effectiveness must also be used for audit purposes. Put a process in place to separately and independently audit compliance to risk mitigation measures, to see that they are being implemented. The result of the audit should be a useful input in improving and fi ne-tuning the program. It should not be viewed as an opportunity to cite shortfalls and implement punitive actions. It should be a periodic and regular feedback loop into the IG program.
Notes
1. Ontario, Electricity Act, FILELAW database, Thomson Publishers, May 2012. 2. U.S. Government Printing Offi ce (GPO), “Code of Federal Regulations,” www.gpo.gov/help/index
.html#about_code_of_federal_regulations.htm (accessed April 22, 2012). 3. National Archives and Records Administration, “Electronic Code of Federal Regulations,” http://ecfr
.gpoaccess.gov/cgi/t/text/text-idx?c=ecfr&tpl=%2Findex.tpl (accessed October 2, 2012). 4. John Fraser and Betty Simkins, eds., Enterprise Risk Management: Today’s Leading Research and Best
Practices for Tomorrow’s Executives (Hoboken, NJ: John Wiley & Sons, 2010), p. 171. s 5. “ISO 31000 2009 Plain English, Risk Management Dictionary,” www.praxiom.com/iso-31000-terms
.htm (accessed March 25, 2013). 6. Fraser and Simkins, p. 172. 7. Ibid. 8. Ibid., p. 179. 9. Health and Safety Executive, “Five Steps to Risk Assessment,” www.hse.gov.uk/risk/fi vesteps.htm
(accessed March 25, 2013). 10. Project Management Institute, A Guide to the Project Management Body of Knowledge ( PMBOK Guide ),
4th ed. (Project Management Institute, 2008), ANSI/PMI 99-001-2008, pp. 273–312.
CHAPTER SUMMARY: KEY POINTS
■ In identifying information requirements and risks, legal requirements trump all others.
■ In the United States, the Code of Federal Regulations lists information reten- tion requirements for businesses, divided into 50 subject matter areas.
■ The risk profi le is a high-level, executive decision input tool.
■ A common risk profi le method is to create a prioritized or ranked top-10 list of greatest risks to information.
■ Once a list of risks is developed, grouping them into basic categories helps stake- holders to grasp them more easily and consider their likelihood and impact.
■ The risk mitigation plan develops risk reduction options and tasks to reduce specifi ed risks and improve the odds for achieving business objectives.
■ Metrics are required to measure progress in the risk mitigation plan.
■ The risk mitigation plan must be reviewed and audited regularly and proper adjustments made.
53
c05 53 February 28, 2014 11:43 AM
C H A P T E R 5 Strategic Planning and Best Practices for Information Governance
Securing a sponsor at the executive management level is always crucial to projectsand programs, and this is especially true of any strategic planning effort. An gexecutive must be on board and supporting the effort in order to garner the re- sources needed to develop and execute the strategic plan, and that executive must be held accountable for the development and execution of the plan. These axioms apply to the development of an information governance (IG) strategic plan.
Also, resources are needed—time, human capital, and budget money. The fi rst is a critical element: It is not possible to require managers to take time out of their other duties to participate in a project if there is no executive edict and consistent follow up, support, and communication. Executive sponsorship is a best practice and supports the key principle of accountability of the Generally Accepted Recordkeeping Principles ® (The Principles)1 (see Chapter 3 for more detail). And, of course, without an allocated budget, no program can proceed.
The higher your executive sponsor is in the organization, the better. 2 The imple- mentation of an IG program may be driven by the chief compliance offi cer, chief information offi cer (CIO), or, ideally, the chief executive offi cer (CEO). With CEO sponsorship come many of the key elements needed to complete a successful project, including allocated management time, budget money, and management focus.
It is important to bear in mind that this IG effort is truly a change management effort, in that it aims to change the structure, guidelines, and rules within which em- ployees operate. The change must occur at the very core of the organization’s culture. It must be embedded permanently, and for it to be, the message must be constantly and consistently reinforced. Achieving this kind of change requires commitment from the very highest levels of the organization.
Executive sponsorship is critical to project success. There is no substitute. Without it, a project is at risk of failure.
Information Governance: Concepts, Strategies and Best Practices By Robert F. Smallwood Copyright © 2014 by Robert F. Smallwood
54 INFORMATION GOVERNANCE
c05 54 February 28, 2014 11:43 AM
If the CEO is not the sponsor, then another high-level executive must lead the ef- fort and be accountable for meeting milestones as the program progresses. Programs with no executive sponsor can lose momentum and focus, especially as competing projects and programs are evaluated and implemented. Program failure is a great risk without an executive sponsor. Such a program likely will fade or fi zzle out or be relegated to the back burner. Without strong high-level leadership, when things go awry, fi nger pointing and political games may take over, impeding progress and cooperation.
The executive sponsor must be actively involved, tracking program objectives and milestones on a regular, scheduled basis and ensuring they are aligned with business objectives. He or she must be aware of any obstacles or disputes that arise, take an ac- tive role in resolving them, and push the program forward.
Crucial Executive Sponsor Role
The role of an executive sponsor is high level, requiring periodic and regular atten- tion to the status of the program, particularly with budget issues, staff resources, and milestone progress. The role of a program or project manager (PM) is more detailed and day to day, tracking specifi c tasks that must be executed to make progress toward milestones. Both roles are essential. The savvy PM brings in the executive sponsor to push things along when more authority is needed but reserves such project capital for those issues that absolutely cannot be resolved without executive intervention. It is best for the PM to keep the executive sponsor fully informed but to ask for assistance only when absolutely needed.
At the same time, the PM must manage the relationship with the executive spon- sor, perhaps with some gentle reminders, coaxing, or prodding, to ensure that the role and tasks of executive sponsorship are being fulfi lled. “[T]he successful Project Manager knows that if those duties are not being fulfi lled, it’s time to call a timeout and have a serious conversation with the Executive Sponsor about the viability of the project.” 3
The executive sponsor serves six key purposes on a project:
1. Budget. The executive sponsor ensures an adequate fi nancial commitment is made to see the project through and lobbies for additional expenditures when change orders are made or cost overruns occur.
2. Planning and control. The executive sponsor sets direction and tracks accom- plishment of specifi c, measureable business objectives.
3. Decision making. The executive sponsor makes or approves crucial decisions and resolves issues that are escalated for resolution.
4. Expectation Management. The executive sponsor must manage expectation, since success is quite often a stakeholder perception.
5. Anticipation. Every project that is competing for resources can run into un- foreseen blockages and objections. Executive sponsors run interference and provide political might for the PM to lead the project to completion, through a series of milestones.
6. Approval. The executive sponsor signs off when all milestones and objectives have been met.
c05 55 February 28, 2014 11:43 AM
STRATEGIC PLANNING AND BEST PRACTICES FOR INFORMATION GOVERNANCE 55
An eager and effective executive sponsor makes all the difference to a project—if the role is properly managed by the PM. It is a tricky relationship, since the PM is always below the executive sponsor in the organization’s hierarchy, yet the PM must coax the superior into tackling certain high-level tasks. Sometimes a third-party con- sultant who is an expert in the specifi c project can instigate and support requests made of the sponsor and provide a solid business rationale.
Evolving Role of the Executive Sponsor
The role of the executive sponsor necessarily evolves and changes over the life of the initial IG program launch, during the implementation phases, and on through the continued IG program.
To get the program off the ground, the executive sponsor must make the business case and get adequate budgetary funding. But an effort such as this takes more than money; it takes time— not just time to develop new policies and implement new tech-— nologies, but the time of the designated PM, program leaders, and needed program team members.
In order to get this time set aside, the IG program must be made a top prior- ity of the organization. It must be recognized, formalized, and aligned with orga- nizational objectives. All this up-front work is the responsibility of the executive sponsor.
Once the IG program team is formed, team members must clearly understand why the new program is important and how it will help the organization meet its busi- ness objectives. This message must be regularly reinforced by the executive sponsor; he or she must not only paint the vision of the future state of the organization but articulate the steps in the path to get there.
When the formal program effort commences, the executive sponsor must remain visible and accessible. He or she cannot disappear into everyday duties and expect the program team to carry the effort through. The executive sponsor must be there to help the team confront and overcome business obstacles as they arise and must praise the successes along the way. This requires active involvement and a willingness to spend the time to keep the program on track and focused.
The executive sponsor must be the lighthouse that shows the way even through cloudy skies and rough waters. This person is the captain who must steer the ship, even if the fi rst mate (PM) is seasick and the deckhands (program team) are drenched and tired.
After the program is implemented, the executive sponsor is responsible for main- taining its effectiveness and relevance. This is done through periodic compliance au- dits, testing and sampling, and scheduled meetings with the ongoing PM.
While the executive sponsor role is high level, the PM’s role and tasks are more detailed and involve day-to-day management.
56 INFORMATION GOVERNANCE
c05 56 February 28, 2014 11:43 AM
Building Your IG Team
Who should make up the IG team? Although there are no set requirements or for- mulas, the complex nature of IG and the fact that it touches upon a number of spe- cialized disciplines and functional areas dictates that a cross-functional approach be taken. So you will need representatives from several departments. There are some absolutes: you must have a representative from your legal staff or outside counsel, your information technology (IT) department, a senior records offi cer (SRO) or the equivalent, a risk management specialist or manager, an executive sponsor, and the IG program manager. In addition, there may be a need for input from managers of hu- man resources, company communications, and certain business units. Depending on the scope of the effort, other possible IG team members might include an IT security expert, the corporate or agency archivist, business analysts, chief knowledge offi cer or knowledge management (KM) professional, litigation support head, fi nancial analyst, business process specialist, project management professional, and other professionals in functions related to these areas.
Assigning IG Team Roles and Responsibilities
The executive sponsor will need to designate an IG PM. Depending on the focus of the IG effort, that person could come from several areas, including legal, compliance, risk management, records management, or IT.
In terms of breaking down the roles and responsibilities of the remainder of the IG team, the easy decision is to have IG team representatives take responsibility for the functional areas of their expertise. But there will be overlap, and it is best to have some pairs or small work groups teamed up to gain the broadest amount of input and optimum results. This will also facilitate cross training. For instance, inside legal counsel may be responsible for rendering the fi nal legal opinions, but because they are not expert in records, document management, or risk management, they could benefi t from input of others in specialized functional areas, which will inform them and help narrow and focus their legal research. Basic research into which regulations and laws apply to the
The role of the executive sponsor changes during the inception, planning, and execution of the IG program.
The risk mitigation plan develops risk reduction options and tasks to reduce specifi ed risks and improve the odds for achieving business objectives.
c05 57 February 28, 2014 11:43 AM
STRATEGIC PLANNING AND BEST PRACTICES FOR INFORMATION GOVERNANCE 57
organization regarding security, retention, and preservation of e-mail, e-records, and personally identifi able information (PII) could be conducted by the SRO or records management head, in consultation with the corporate archivist and CIO, with the results of their fi ndings and recommendations drafted and sent to the legal counsel. The draft report may offer up several alternative approaches that need legal input and decisions. Then the legal team lead can conduct its own, focused research and make fi nal recom- mendations regarding the organization’s legal strategy, business objectives, fi nancial po- sition, and applicable laws and regulations.
The result of the research, consultation, and collaboration of the IG team should result in a fi nal draft of the IG strategic plan. It will still need more input and devel- opment to align the plan with business objectives, an analysis of internal and external drivers, applicable best practices, competitive analysis, applicable IT trends, an analysis and inclusion of the organization’s culture, and other factors.
Align Your IG Plan with Organizational Strategic Plans
The IG plan must support the achievement of the organization’s business objectives and there-s fore must be melded into the organization’s overall strategic plan. Integration with the strategic plan means that the business objectives in the IG plan are consistent with, and in support of, the enterprise strategic plan.
So, for example, if the corporate strategy includes plans for acquiring smaller com- petitors and folding them into the organization’s structure as operating divisions, then the IG plan must assist and contribute to this effort. Plans for standardizing operating policies and procedures must include a consistent, systematized approach to the com- ponents of IG, including stakeholder consultation, user training and communications, and compliance audits. The IG plan should bring a standard approach across the spec- trum of information use and management within the organization and it must be forged to accommodate the new technology acquisitions. This means that e-mail policies, e-discovery policies, mobile device policies, social media policies, cloud collaboration and storage use, and even nitty-gritty details like report formats, data structures, document taxonomies, and metadata must be consistent and aligned with the overall strategic plan. In other words, the goal is to get all employees on the same page and working to support the business objectives of the strategic plan in everyday small steps within the IG plan.
The IG team must include a cross-functional group of stakeholders from various departments, including legal, records management, IT, and risk management.
The IG strategic plan must be aligned and synchronized with the organiza- tion’s overall strategic plans, goals, and business objectives.
58 INFORMATION GOVERNANCE
c05 58 February 28, 2014 11:43 AM
The organization will also have an IT plan that must be aligned with the strategic plan to support overall business objectives. The IT strategy may be to convert new acquisitions to the internal fi nancial and accounting systems of the organization and to train new employees to use the existing software applications under the umbrella of the IG plan. Again, the IG plan needs to be integrated with the IT strategy and must consider the organization’s approach to IT.
The result of the process of aligning the IG effort with the IT strategy and the organization’s overall strategic plan will mean, ideally, that employee efforts are more effi cient and productive since they are consistently moving toward the achievement of the organization’s overall strategic goals. The organization will be healthier and will have less dissent and confusion with clear IG policies that leverage the IT strategy and help employees pursue overall business objectives.
Further considerations must be folded into the IG plan. As every corporate cul- ture is different and has a real impact on decision-making and operational approaches, corporate culture must be included in the plan. Corporate culture includes the organi- zation’s appetite for risk, its use of IT (e.g., forward-thinking fi rst adopter), its capital investment strategies, and other management actions.
So, if the organization is conservative and risk averse, it may want to hold off on implementing some emerging e-discovery technologies that can cut costs but also induce greater risk. Or if it is an aggressive, progressive, risk-taking organi- zation, it may opt to test and adopt newer e-discovery technologies under the IT strategy and umbrella of IG policies. An example may be the use of predictive coding technology in early case assessment (ECA). Predictive coding uses text auto-classifi cation technology and neural technology with the assistance of human input to “learn” which e-documents might be relevant in a particular legal matter and which may not be. Through a series of steps of testing and checking subsets of the documents, humans can provide input to improve the document sorting and selection process. The software uses machine learning (artifi cial intelligence whereby the software can change and improve on a particular task, as its decision engine is shaped and “trained” by input ) to improve its ability to cull through and sort documents.
Predictive coding can reduce e-discovery costs, yet there are risks that the ap- proach can be challenged in court and could, in fact, affect the case adversely. Thus, a decision on a technology like predictive coding can involve and include elements of the IG plan, IT strategy, and overall organizational strategic plan.
And there are resource issues to consider: How much management time, or band- width, is available to pursue the IG plan development and execution? Is there a budget item to allow for software acquisitions and training and communications to support the execution of the IG plan? Obviously, without the allocated management time and budget money, the IG plan cannot be executed.
Survey and Evaluate External Factors
The IG plan is now harmonized and aligned with your organization’s strategic plan and IT strategy, but you are not fi nished yet, because the plan cannot survive in a vacuum: Organizations must analyze and consider the external business, legal, and technological environment and fold their analysis into their plans.
c05 59 February 28, 2014 11:43 AM
STRATEGIC PLANNING AND BEST PRACTICES FOR INFORMATION GOVERNANCE 59
Analyze IT Trends
IG requires IT to support and monitor implementation of polices, so it matters what is s developing and trending in the IT space. What new technologies are coming online? Why are they being developed and becoming popular? How do these changes in the business environment that created opportunities for new technologies to be developed affect your organization and its ability execute its IG plan? How can new technologies assist? Which ones are immature and too risky? These are some of the questions that must be addressed in regard to the changing IT landscape.
Some changes in information and communications technology (ICT) are rathery obvious, such as the trends toward mobile computing, tablet and smartphone devices, cloud storage, and social media use. Each one of these major trends that may affect or assist in implementing IG needs to be considered within the framework of the organiza- tion’s strategic plan and IT strategy. If the corporate culture is progressive and supportive of remote work and telecommuting, and if the organizational strategy aims to lower fi xed costs by reducing the amount of offi ce space for employees and moving to a more mobile workforce, then trends in tablet and smartphone computing that are relevant to your or- ganization must be analyzed and considered. Is the organization going to provide mobile devices or support a bring-your-own-device (BYOD) environment? Which equipment will you support? Will you support iOS, Android, or both? What is your policy going to be on phone jacking? What is the IG policy regarding confi dential documents on mobile devices? Will you use encryption? If so, which software? Is your enterprise moving to the cloud computing model? Utilizing social media? What about Big Data and analytics ? Are you going to consider deploying auto-classifi cation and predictive coding technolo- gies? What are the trends that might affect your organization?
Many, many questions must be addressed, but the evaluation must be narrowed down to those technology trends that specifi cally might impact the execution of your IG plan and rollout of new technology.
On a more granular level, you must evaluate even supported fi le and document formats. It gets that detailed, when you are crafting IG policy. For instance, PDF/A is the standard format for archiving electronic documents. So your plans must include long-term digital preservation (LTDP) standards and best practices.
Survey Business Conditions and the Economic Environment
If the economy is on a down cycle, and particularly if your business sector has been nega- tively affected, resources may be scarcer than in better times. Hence, it may be more dif- fi cult to get budget approval for necessary program expenses, such as new technologies, staff, training materials, communications, and so forth. This means your IG plan may need to be scaled back or its scope reduced. Implementing the plan in a key division rath- er than attempting an enterprise rollout may be the best tactic in tough economic times.
The IG strategic plan must be informed with an assessment of relevant tech- nology trends.
60 INFORMATION GOVERNANCE
c05 60 February 28, 2014 11:43 AM
But if things are booming and the business is growing fast, budget money for in- vestments in the IG program may be easier to secure, and the goals may be expanded.
IG should be an ongoing program, but it takes time to implement, and it takes resources to execute, audit, and continue to refi ne. So an executive looking for a quick and calculable payback on the investment may want to focus on narrower areas. For instance, the initial focus may be entirely on the legal hold and e-discovery process, with business objectives that include reducing pretrial costs and attorney fees by a cer- tain percentage or amount. It is much easier to see concrete results when focusing on e-discovery, since legal costs are real, and always will be there. The business case may be more diffi cult to make if the IG effort is broader and improves the ability to or- ganize and search for information faster and to execute more complete searches to improve the basis for management decision making. Improved management decision making will improve the organization’s competitiveness long-term, but it may be dif- fi cult to cite specifi c examples where costs were saved or revenues were increased as a result of the “better decisions” that should come about through better IG.
Analyze Relevant Legal, Regulatory, and Political Factors
In consultation with your legal team or lead, the laws and regulations that affect your industry should be identifi ed. Narrowing the scope of your analysis, those that specifi - cally could impact your governance of information should be considered and analyzed. What absolute requirements do they impose? Where there is room for interpretation, where, legally, does your organization want to position itself? How much legal risk is acceptable? These are the types of questions you will have to look to your legal and risk management professionals to make. Again, legal requirements trump all others.
Your decision process must include considerations for the future and anticipated fu- ture changes. Changes in the legal and regulatory environment happen based on the po- litical leaders who are in place and any pending legislation. So you must go further and analyze the current political environment and make some judgments based on the best information you can gather, the organization’s culture and appetite for risk, management style, available resources, and other factors. Generally, a more conservative environment means less regulation, and this analysis must also be folded into your IG strategic plan.
Trends and conditions in the internal and external business environment must be included in the IG strategic plan.
Laws and regulations relevant to your organization’s management and distri- bution of information in all jurisdictions must be considered and included in the IG strategic plan. Legal requirements trump all others.
c05 61 February 28, 2014 11:43 AM
STRATEGIC PLANNING AND BEST PRACTICES FOR INFORMATION GOVERNANCE 61
Survey and Determine Industry Best Practices
IG is a developing hybrid discipline. In a sense, it is a superset of records management and a subset of governance, risk management, and compliance (GRC), that emerged to help manage the explosion in the amount of records, documents, and data that must be managed in today’s increasingly high-volume and velocity business environment and highly regulated compliance and litigation environment. As such, best practices are still being formed and added to. This process of testing, proving, and sharing best practices will continue for some time as the practices are expanded, revised, and refi ned.
The most relevant study of IG best practices is one that is conducted for your organization and surveys your industry and what some of your more progressive com- petitors are doing in regard to IG. Often the best way to accomplish such a study is by engaging a third-party consultant, who can more easily contact, study, and interview your competitors in regard to their practices. Business peer groups and trade associa- tions also can provide some consensus as to emerging best practices.
Twenty-fi ve IG best practices covering a number of areas in which IG has an im- pact or should be a major consideration are listed next.
1. IG is a key underpinning for a successful RM program. Practicing good IG is the essential foundation for building a legally defensible RM program; it pro- vides the basis for consistent, reliable methods for managing documents and records. Having trusted and reliable records, reports, and databases allows managers to make key decisions with confi dence.4 And accessing that infor- mation and business intelligence in a timely fashion can yield a long-term sustainable competitive advantage, creating more agile enterprises.
To implement a successful IG program, enterprises must standardize and systematize their handling of information, in particular their formal busi- ness records. They must analyze and optimize how information is accessed, controlled, managed, shared, stored, preserved, and audited. They must have complete, current, and relevant policies, processes, and technologies to man- age and control information, including who is able to access what information ,t and when , to meet external legal and regulatory demands and internal gover- nance requirements. This, in short, is IG.
2. IG is not a project but rather an ongoing program that provides an umbrella of rules and policies, monitored and enforced with the support of IT to manage and control information output and communications. Since technologies change so quickly, it is necessary to have overarching technology-agnostic policies that can manage the various IT platforms that an organization may use.
Compare the IG program to a workplace safety program; every time a new location, team member, piece of equipment, or toxic substance is acquired by the organization, the workplace safety program should dictate how that is
Include a best practices review in your IG strategic plan. The most relevant best practices in IG are those in your industry proven by peers and competitors.
62 INFORMATION GOVERNANCE
c05 62 February 28, 2014 11:43 AM
handled. If it does not, the workplace safety policies/procedures/training that are part of the workplace safety program need to be updated. Regular reviews are conducted to ensure the program is being followed, and adjustments are made based on the fi ndings. The effort never ends.5
3. Using an IG framework or maturity model is helpful in assessing and guiding IG programs. Various models are offered, such as The Principles from ARMA International; the Information Governance Reference Model, which grew out of the Electronic Discovery Reference Model (found at EDRM.net); 6 or MIKE2.0, which was developed by the consulting fi rm Bearing Point and released to the public domain. Another tool that is particularly used in the Australian market for records management projects is Designing and Imple- menting Recordkeeping Systems (DIRKS).
4. Defensible deletion of data debris and information that no longer has value is critical in the era of Big Data. You must have IG polices in place and be able to prove that you follow them consistently and systematically in order to justify, to the courts and regulators, deletion of information. With a smaller information footprint, organizations can more easily fi nd what they need and derive busi- ness value from it. 7 Data debris must be eliminated regularly and consistently, and to do this, processes and systems must be in place to cull out valuable information and discard the data debris. An IG program sets the framework to accomplish this.
5. IG policies must be developed before enabling technologies are deployed to assist in enforcement. After the policy-making effort, seek out the proper technology tools to assist in monitoring, auditing, and enforcement.
6. To provide comprehensive e-document security throughout a document’s life cycle, documents must be secured upon creation using highly sophisticated technologies, such as information rights management (IRM) technology. IRM acts as a sort of “secu- rity wrapper” that denies access without proper credentials. Document access and use by individuals having proper and current credentials is also tightly monitored IRM software controls the access, copying, editing, forwarding, and printing of documents using a policy engine that manages the rights to view and work on an e-document. Access rights are set by levels or “roles” that employees are responsible for within an organization.
7. A records retention schedule and legal hold notifi cation (LHN) process are the two primary elements of a fundamental IG program. These are the basics. Implemen- tation will require records inventorying, taxonomy development, metadata normalization and standardization, and a survey of LHN best practices.
8. A cross-functional team is required to implement IG. Since IG contains and requires elements of a number of established disciplines, representatives from the key areas must be included in the planning and implantation effort. At a minimum, you will need team leaders from legal, IT, records manage- ment, compliance and risk management, human resources, and executive management. Members from corporate communications, knowledge man- agement, systems security, fi nance and accounting, and other functional areas also may be needed. Depending on the circumstances, you may need repre- sentatives from major business units within the organization.
9. The fi rst step in information risk planning is to consider the applicable laws and regulations that apply to your organization in the jurisdictions in which it conducts
c05 63 February 28, 2014 11:43 AM
STRATEGIC PLANNING AND BEST PRACTICES FOR INFORMATION GOVERNANCE 63
business . Federal, provincial, state, and even municipal laws and regulationss may apply to the retention of data, documents, and records. Organizations operating in multiple jurisdictions must be compliant with laws and regula- tions that may cross national, state, or provincial boundaries. Legally required privacy requirements and retention periods must be researched for each ju- risdiction (state, country) in which the business operates, so that all applicable laws are complied with.
10. Developing a risk profi le is a basic building block in enterprise risk management, which assists executives in understanding the risks associated with stated business objectives and in allocating resources within a structured evaluation approach or framework . There are multiple ways to create a risk profi le, and the frequency with which it is created, the external sources consulted, and stakeholders who have input will vary from organization to organization. 8 A key tenet to bear in mind is that simpler is better and that sophisticated tools and techniques should not make the process overly complex.
11. An information risk mitigation plan is a critical part of the IG planning process. An information risk mitigation plan helps in developing risk mitigation options and tasks to reduce the specifi ed risks and improve the odds of achieving busi- ness objectives. 9
12. Proper metrics are required to measure the conformance and performance of your IG program. You must have an objective way to measure how you are doing, which means numbers and metrics. Assigning some quantitative measures that are meaningful before rolling out the IG program is essential.
13. IG programs must be audited for effectiveness. Periodic audits will tell you how your organization is doing and where to fi ne-tune your efforts. To keep an IG program healthy, relevant, and effective, changes and fi ne-tuning will always be required.
14. An enterprise wide retention schedule is preferable because it eliminates the possibility that different business units will have confl icting records retention periods. For exam- ple, if one business unit discards a group of records after 5 years, it would not make sense for another business unit to keep the same records for 10 years. Where enterprise-wide retention schedules are not possible, smaller business units, such as divisions or regions, should operate under a consistent retention schedule.
15. Senior management must set the tone and lead sponsorship for vital records program governance and compliance. Although e-records are easier to protect and back- up, most vital records today are e-records. These are an organization’s most essential records. Without them, an organization cannot continue operations.
16. Business processes must be redesigned to improve and optimize the management and security of information and especially the most critical of information, electronic re- cords, before implementing enabling technologies. For instance, using electronic records management (ERM) software fundamentally changes the way people work, and greater effi ciencies can be gained with business process redesign (versus simply using ERM systems as electronic fi ling cabinets to speed up poor processes).
17. E-mail messages, both inbound and outbound, should be archived automatically and (preferably) in real time. This ensures that spoliation (i.e., the loss of proven authenticity of an e-mail) does not occur. Archiving preserves legal validity
64 INFORMATION GOVERNANCE
c05 64 February 28, 2014 11:43 AM
and forensic compliance. By policy, most messages will be deleted in a short timeframe. Additionally, e-mail should be indexed to facilitate the searching process, and all messages should be secured in a single location (with backups). With these measures, the authenticity and reliability of e-mail records can be ensured.
18. Personal archiving of e-mail messages should be disallowed. Although users will want to save certain e-mail messages for their own reasons, control and man- agement of e-mail archiving must be at the organization level or as high of a level as is practical, such as division or region.
19. Destructive retention of e-mail helps to reduce storage costs and legal risk while im- proving “fi ndability” of critical records. It makes good business sense to have a policy to, say, destroy all e-mail messages after 90 or 120 days that are not fl agged as potential records (which, e.g., help document a transaction or a situ- ation that may come into dispute in the future) or those that have a legal hold.
20. Take a practical approach and limit cloud use to documents that do not have long retention periods and carry a low litigation risk. Doing this will reduce the risk of compromising or losing critical documents and e-records. Some duplicate copies of vital records may be stored securely in the cloud to help the organi- zation recover in the event of a disaster.
21. Manage social media content by IG policies and monitor it with controls that ensure protection of critical information assets and preservation of business records. Your organization must state clearly what content and tone is acceptable in social media use, and it must retain records of that use, which should be captured in real time.
22. International and national standards provide effective guidance for implementing IG. Although there are no absolutes, researching and referencing International Organization for Standardization (ISO) and other standards must be a part of any IG effort.
23. Creating standardized metadata terms should be part of an IG effort that enables faster, more complete, and more accurate searches and retrieval of records. This is important not only in everyday business operations but also when delv- ing through potentially millions of records during the discovery phase of litigation. Good metadata management also assists in the maintenance of corporate memory and in improving accountability in business operations. 10 Using a standardized format and controlled vocabulary provides a “precise and comprehensible description of content, location, and value.”11 Using a controlled vocabulary means your organization has standardized a set of terms used for metadata elements that describe records. This ensures consistency across a collection and helps with optimizing search and retrieval functions and records research as well as with meeting e-discovery requests, compliance demands, and other legal and regulatory requirements.
24. Some digital information assets must be preserved permanently as part of an orga- nization’s documentary heritage.12 It is critical to identify records that must be kept long term as early in the process as possible; ideally, these records should be identifi ed prior to or upon creation. LTDP applies to content that is born digital as well as content that is converted to digital form. Digital preservation is defi ned as long-term, error-free storage of digital information, with means for retrieval and interpretation, for the entire time span that the information
c05 65 February 28, 2014 11:43 AM
STRATEGIC PLANNING AND BEST PRACTICES FOR INFORMATION GOVERNANCE 65
is required to be retained. Dedicated repositories for historical and cultural memory, such as libraries, archives, and museums, need to move forward to put in place trustworthy digital repositories that can match the secu- rity, environmental controls, and wealth of descriptive metadata that these institutions have created for analog assets (such as books and paper records). Digital challenges associated with records management affect all sectors of society—academic, government, private, and not-for-profi t enterprises—and ultimately citizens of all developed nations.
25. Executive sponsorship is crucial. Securing an executive sponsor at the senior management level is key to successful IG programs. It is not possible to require managers to take time out of their other duties to participate in a project if there is no executive edict. It is a best practice across industry sec- tors and technology sets and supports the Accountability principle of The Principles.13
Formulating the IG Strategic Plan
Now comes the time to make sense of all the data and input your IG team has gathered and hammer it into a workable IG strategic plan. Doing this will involve some give-and-take among IG team members, each having their own perspective and priorities. Everyone will be lobbying for the view of their functional groups. It is the job of the executive sponsor to set the tone and to emphasize organizational business objectives so that the effort does not drag out or turn into a competition but is a well-informed consensus development process that results in a clear, workable IG strategic plan.
Synthesize Gathered Information and Fuse It into IG Strategy
Your IG team will have gathered a great deal of information, which needs to be ana- lyzed and distilled into actionable strategies. This process will depend on the expertise and input of the specialized knowledge your team brings to the table within your organizational culture. Team members must be able to make decisions and establish priorities that refl ect organizational business objectives and consider a number of in- fl uencing factors.
Do not prolong the strategy development process. The longer it lasts, the more key factors infl uencing it can change. You want to develop a strategic plan that is durable enough to withstand changes in technology, legislation, and other key infl uencing factors, but it should be relevant to that snapshot of information that was collected early on. When all the parts and pieces start changing and require reconsideration, a dated IG plan does not serve the organization well.
Develop IG strategies for each of the critical areas, including the legal hold pro- cess, e-discovery action plans, e-mail policy, mobile computing policy, IT acquisition strategy, confi dential document handling, vital records and disaster planning, social media policy, and other areas that are important to your organization. To maintain focus, do this fi rst without regard to the prioritization of these areas.
66 INFORMATION GOVERNANCE
c05 66 February 28, 2014 11:43 AM
Then you must go through the hard process of prioritizing your strategies and aligning them to your organizational goal and objectives . This may not be diffi cult in the beginning—fors instance, your IG strategies for legal holds and e-discovery readiness are likely going to take higher priority than your social media policy, and protecting vital records is paramount to any organization. As the process progresses, it will become more chal- lenging to make trade-offs and establish priorities. Then you must tie these strategies to overall organizational goals and business objectives.
A good technique to keep goals and objectives in mind may be to post them prom- inently in the meeting room where these strategy sessions take place. This will help to keep the IG team focused.
Develop Actionable Plans to Support Organizational Goals and Objectives
Plans and policies to support your IG efforts must be developed that identify specifi c tasks and steps and defi ne roles and responsibilities for those who will be held ac- countable for their implementation. This is where the rubber meets the road. But you cannot simply create the plan and marching orders: You must build in periodic checks and audits to test that new IG policies are being followed and that they have hit their mark. Invariably, there will be adjustments made continually to craft the policies for maximum effectiveness and continued relevance in the face of changes in external factors, such as legislation and business competition, and internal changes in manage- ment style and structure.
Create New IG Driving Programs to Support Business Goals and Objectives
You have to get things moving and get employees motivated, and launching new sub- programs within the overall IG program is a good way to start. For instance, a new “e-discovery readiness” initiative can show almost immediate results if implemented properly, with the support of key legal and records management team members, driven by the executive sponsor. You may want to revamp the legal hold process to make it more complete and verifi able, assigning specifi c employees accountabil- ity for specifi c tasks. Part of that effort may be evaluating and implementing new technology-assisted review (TAR) processes and predictive coding technology. So you will need to bring in the IG team members responsible for IT and perhaps busi- ness analysis. Working cooperatively on smaller parts of the overall IG program is a way to show real results within defi ned time frames. Piecing together a series of pro- gram components is the best way to get started, and it breaks the overall IG program
Fuse the fi ndings of all your analyses of external and internal factors into your IG strategic plan. Develop strategies and then prioritize them.
c05 67 February 28, 2014 11:43 AM
STRATEGIC PLANNING AND BEST PRACTICES FOR INFORMATION GOVERNANCE 67
down into digestible, doable chunks. A small win early on is crucial to maintain mo- mentum and executive sponsorship. And e-discovery has real costs: yet progress can be measured objectively in terms of reducing the cost of activities such as early case assessment (ECA). Benefi ts can be measured in terms of reduced attorney review hours, reduced costs, and reduced time to accomplish pretrial tasks.
To be clear, you will need to negotiate and agree on the success metrics the pro- gram will be measured on in advance.
There are other examples of supporting IG subprograms, such as e-mail manage- ment and archiving, where storage costs, search times, and information breaches can be measured in objective terms. Or you may choose to roll out new policies for the use of mobile devices within your organization, where adherence to policy can be mea- sured by scanning mobile devices and monitoring their use.
Draft the IG Strategic Plan and Gain Input from a Broader Group of Stakeholders
Once you have the pieces of the plan drafted and the IG team is in agreement that it has been harmonized and aligned with overall organizational goals and objectives, you must test the waters to see if you have hit the mark. It is a good practice to expose a broader group of stakeholders to the plan to gain their input. Perhaps your IG team has become myopic or has passed over some points that are important to the broader stakeholder audience. Solicit and discuss their input, and to the degree that there is a consensus, refi ne the IG strategic plan one last time before fi nalizing it. But remember, it is a living document, a work in progress, which will require revisiting and updating to ensure it is in step with changing external and internal factors. Periodic auditing and review of the plan will reveal areas that need to be adjusted and revised to keep it relevant and effective.
Get Buy-in and Sign-off and Execute the Plan
Take the fi nalized plan to executive management, preferably including the CEO, and present the plan and its intended benefi ts to them. Field their questions and address any concerns to gain their buy-in and the appropriate signatures. You may have to make some minor adjustments if there are signifi cant objections, but, if you have ex- ecuted the stakeholder consultation process properly, you should be very close to the mark. Then begin the process of implementing your IG strategic plan, including regu- lar status meetings and updates, steady communication and reassurance of your execu- tive sponsor, and planned audits of activities.
Create supporting subprograms to jump-start your IG program effort. Smaller programs should be able to measure real results based on metrics that are agreed on in advance.
68 INFORMATION GOVERNANCE
c05 68 February 28, 2014 11:43 AM
CHAPTER SUMMARY: KEY POINTS
■ Engaged and vested executive sponsors are necessary for IG program success. It is not possible to require managers to take time out of their other duties to participate in a project if there is no executive edict or allocated budget.
■ The executive sponsor must be: (1) directly tied to the success of the pro- gram, (2) fully engaged in and aware of the program, and (3) actively elimi- nating barriers and resolving issues.
■ The role of the executive sponsor evolves over the life of the IG program and IG program effort. Initially, the focus is on garnering the necessary resources, but as the program commences, the emphasis is more on supporting the IG program team and clearing obstacles. Once the program is implement- ed, the responsibilities shift to maintaining the effectiveness of the program through testing and audits.
■ While the executive sponsor role is high level, the project manager’s role and tasks involve more detailed and day-to-day management.
■ The risk mitigation plan develops risk reduction options and tasks to reduce specifi ed risks and improve the odds for achieving business objectives.
■ The IG team must include a cross-functional group of stakeholders from various departments, including legal, records management, IT, and risk management.
■ The IG strategic plan must be aligned and synchronized with the organiza- tion’s overall strategic plans, goals, and business objectives.
■ The IG strategic plan must include an assessment of relevant technology trends.
■ Trends and conditions in the internal and external business environment must be included in the IG strategic plan.
■ Laws and regulations relevant to your organization’s management and distri- bution of information in all jurisdictions must be considered and included in the IG strategic plan. Legal requirements trump all others.
■ Include a best practices review in your IG strategic plan. The most relevant best practices in IG are those in your industry proven by peers and competitors. (Twenty-fi ve IG best practices are listed in this chapter for the fi rst time in print.)
■ Fuse the fi ndings of all your analysis of external and internal factors into your IG strategic plan. Develop strategies and then prioritize them.
■ Creating supporting subprograms to jump-start your IG program effort. Smaller programs should be able to measure real results based on metrics that are agreed on in advance.
■ Make sure to get executive sign-off on your IG strategic plan before moving to execute it.
c05 69 February 28, 2014 11:43 AM
STRATEGIC PLANNING AND BEST PRACTICES FOR INFORMATION GOVERNANCE 69
Notes
1. ARMA International, “How to Cite GARP,” www.arma.org/garp/copyright.cfm (accessed October 9, 2013).
2. Roger Kastner, “Why Projects Succeed—Executive Sponsorship,” February 15, 2011, http://blog .slalom.com/2011/02/15/why-projects-succeed-%E2%80%93-executive-sponsorship/
3. Ibid. 4. Economist Intelligence Unit, “The Future of Information Governance,” www.emc.com/leadership
/business-view/future-information-governance.htm (accessed October 9, 2013). 5. Monica Crocker, e-mail to author, June 21, 2012. 6. EDRM, “Information Governance Reference Model (IGRM) Guide,” www.edrm.net/resources
/guides/igrm (accessed November 30, 2012). 7. Randolph A. Kahn, https://twitter.com/InfoParkingLot/status/273791612172259329, Nov. 28, 2012. 8. John Fraser and Betty Simkins, eds., Enterprise Risk Management: Today’s Leading Research and Best Prac-
tices for Tomorrow’s Executives (Hoboken, NJ: John Wiley & Sons, 2010), p. 171. s 9. Project Management Institute, A Guide to the Project Management Body of Knowledge (PMBOK Guide ),
4th ed. (Newtown Square, PA Project Management Institute, 2008), ANSI/PMI 99–001–2008, pp. 273–312.
10. Kate Cumming, “Metadata Matters,” in Julie McLeod and Catherine Hare, eds., Managing Electronic Records , p. 34 (London: Facet, 2005).s
11. Minnesota State Archives, Electronic Records Management Guidelines, “Metadata,” March 12, 2012, www.mnhs.org/preserve/records/electronicrecords/ermetadata.html .
12. Charles Dollar and Lori Ashley, e-mail to author, August 10, 2012. 13. ARMA International, “How to Cite GARP.”
71
c06 71 March 8, 2014 5:16 PM
Information Governance Policy Development
C H A P T E R 6
To develop an information governance (IG) policy, you must inform and frame the policy with internal and external frameworks, models, best practices, and standards—those that apply to your organization and the scope of its planned IG program. In this chapter, we fi rst present and discuss major IG frameworks and models and then identify key standards for consideration.
A Brief Review of Generally Accepted Recordkeeping Principles®
In Chapter 3 we introduced and discussed ARMA International’s eight Generally Accepted Recordkeeping Principles ® , known as The Principles 1 (or sometimes GAR Principles). These Principles and associated metrics provide an IG framework that can support continuous improvement.
To review, the eight Principles are:
1. Accountability 2. Transparency 3. Integrity 4. Protection 5. Compliance 6. Availability 7. Retention 8. Disposition2
The Principles establish benchmarks for how organizations of all types and sizes can build and sustain compliant, legally defensible records management (RM)t programs. Using the maturity model (also presented in Chapter 3 ), organizations can assess where they are in terms of IG, identify gaps, and take steps to improve across the eight areas The Principles cover.
Information Governance: Concepts, Strategies and Best Practices By Robert F. Smallwood Copyright © 2014 by Robert F. Smallwood
72 INFORMATION GOVERNANCE
c06 72 March 8, 2014 5:16 PM
IG Reference Model
In late 2012, with the support and collaboration of ARMA International and the Com- pliance, Governance and Oversight Council (CGOC), the Electronic Discovery Ref- erence Model (EDRM) Project released version 3.0 of its Information Governance Reference Model (IGRM), which added information privacy and security “as pri-y mary functions and stakeholders in the effective governance of information.” 3 The model is depicted in Figure 6.1 .
The IGRM is aimed at fostering IG adoption by facilitating communication and collaboration between disparate (but overlapping) IG stakeholder functions, includ- ing information technology (IT), legal, RM, risk management, and business unit
Figure 6.1 Information Governance Reference Model Source: EDRM.net
Linking duty + value to information asset = efficient, effective management
Duty: Legal obligation
for specific information
Value: Utility or business
purpose of specific information
Asset: Specific container of information
VALUE
Create, Use
DUTY ASSET
Dispose
Hold, Discover
Store, Secure
Retain Archive
UN IFIED G
OVERNANCE
BUSINESS Profit
IT Efficiency
LEGAL Risk
RIM Risk
PRIVACY AND
SECURITY Risk
PROCESS TRAN SP
AR EN
C
Y
POL ICY INTEGRATION
Information Governance Reference Model / © 2012 / v3.0 / edrm.net
INFORMATION GOVERNANCE POLICY DEVELOPMENT 73
c06 73 March 8, 2014 5:16 PM
stakeholders. 4 It also aims to provide a common, practical framework for IG that will foster adoption of IG in the face of new Big Data challenges and increased legal and regulatory demands. It is a clear snapshot of where IG touches and shows critical in- terrelationships and unifi ed governance.5 It can help organizations forge policy in an orchestrated way and embed critical elements of IG policy across functional groups. Ultimately, implementation of IG helps organizations leverage information value, re- duce risk, and address legal demands.
The growing CGOC community (2,000+ members and rising) has widely adopted the IGRM and developed a process maturity model that accompanies and leverages IGRM v3.0. 6
Interpreting the IGRM Diagram *
Outer Ring Starting from the outside of the diagram, successful information management is about conceiving a complex set of interoperable processes and implementing the procedures and structural elements to put them into practice. It requires:
■ An understanding of the business imperatives of the enterprise, ■ Knowledge of the appropriate tools and infrastructure for managing informa-
tion, and ■ Sensitivity to the legal and regulatory obligations with which the enterprise
must comply.
For any piece of information you hope to manage, the primary stakeholder is the business user of that information [emphasis added]. We use the term “business” broadly; the same ideas apply to end users of information in organizations whose ultimate goal might not be to generate a profi t.
Once the business value is established, you must also understand the legal duty at- tached to a piece of information. The term “legal” should also be read broadly to refer to a wide range of legal and regulatory constraints and obligations, from e-discovery and government regulation to contractual obligations such as payment card industry requirements.
Finally, IT organizations must manage the information accordingly, ensuring pri- vacy and security as well as appropriate retention as dictated by both business and legal or regulatory requirements.
* This section is adapted with permission by EDRM.net, http://www.edrm.net/resources/guides/igrm (accessed January 24, 2014).
You must inform and frame IG policy with internal and external frameworks, models, best practices, and standards.
74 INFORMATION GOVERNANCE
c06 74 March 8, 2014 5:16 PM
Center
In the center of the diagram is a work-fl ow or life-cycle diagram. We include this com- ponent in the diagram to illustrate the fact that information management is important at all stages of the information life cycle—from its creation through its ultimate disposition. This part of the diagram, once further developed, along with other secondary-level diagrams, will outline concrete, actionable steps that organizations can take in imple- menting information management programs.
Even the most primitive business creates information in the course of daily operations, and IT departments spring up to manage the logistics; indeed, one of the biggest challeng- es in modern organizations is trying to stop individuals from excess storing and securing of information. Legal stakeholders can usually mandate the preservation of what is most critical, though often at great cost. However, it takes the coordinated effort of all three groups to defensibly dispose of a piece of information that has outlived its usefulness and retain what is useful in a way that enables accessibility and usability for the business user. s
How the IGRM Complements the Generally Accepted Recordkeeping Principles *
The IGRM supports ARMA International’s “Principles” by identifying the cross- functional groups of key information governance stakeholders and by depicting their intersecting objectives for the organization. This illustration of the relation- ship among duty, value, and the information asset demonstrates cooperation among stakeholder groups to achieve the desired level of maturity of effective information governance.
Effective IG requires a continuous and comprehensive focus. The IGRM will be used by proactive organizations as an introspective lens to facilitate visualization and discussion about how best to apply The Principles. The IGRM puts into sharp focus The Principles and provides essential context for the maturity model.
* This section is adapted with permission by EDRM.net, http://www.edrm.net/resources/guides/igrm (accessed January 24, 2014).
The business user is the primary stakeholder of managed information.
Information management is important at all stages of the life cycle.
Legal stakeholders can usually mandate the preservation of what is most criti- cal, though often at great cost.
INFORMATION GOVERNANCE POLICY DEVELOPMENT 75
c06 75 March 8, 2014 5:16 PM
Best Practices Considerations
IG best practices should also be considered in policy formulation . Best practices in IG are evolv- ing and expanding, and those that apply to organizational scenarios may vary. A best practices review should be conducted, customized for each particular organization.
In Chapter 5 , we provided a list of 25 IG best practices, with some detail. The IG world is maturing, and more best practices will evolve. The 25 best practices, summa- rized next, are fairly generic and widely applicable.
1. IG is a key underpinning for a successful ERM program. 2. IG is not a project but rather an ongoing program. 3. Using an IG framework or maturity model is helpful in assessing and guiding
IG programs. 4. Defensible deletion of data debris and information that no longer has value is
critical in the era of Big Data. 5. IG policies must be developed before enabling technologies are added to as-
sist in enforcement. 6. To provide comprehensive e-document security throughout a document’s life
cycle, documents must be secured upon creation using highly sophisticated technologies, such as information rights management (IRM) technology.
7. A records retention schedule and legal hold notifi cation process (LHN) are the two primary elements of a fundamental IG program.
8. A cross-functional team is required to implement IG. 9. The fi rst step in information risk planning is to consider the applicable laws
and regulations that apply to your organization in the jurisdictions in which it conducts business.
10. A risk profi le is a basic building block in enterprise risk management, assisting executives in understanding the risks associated with stated business objec- tives and in allocating resources within a structured evaluation approach or framework.
11. An information risk mitigation plan is a critical part of the IG planning process. An information risk mitigation plan involves developing risk mitiga- tion options and tasks to reduce the specifi ed risks and improve the odds of achieving business objectives. 7
12. Proper metrics are required to measure the conformance and performance of your IG program.
13. IG programs must be audited for effectiveness. 14. An enterprise-wide retention schedule is preferable because it eliminates the
possibility that different business units will have different records retention periods.
The IGRM was developed by the EDRM Project to foster communication among stakeholders and adoption of IG. It complements ARMA’s Generally Accepted Recordkeeping Principles.
76 INFORMATION GOVERNANCE
c06 76 March 8, 2014 5:16 PM
15. Senior management must set the tone and lead sponsorship for vital records program governance and compliance.
16. Business processes must be redesigned to improve the management of electron- ic records or implement an electronic records management (ERM) system. t
17. E-mail messages, both inbound and outbound, should be archived automati- cally and (preferably) in real time.
18. Personal archiving of e-mail messages should be disallowed. 19. Destructive retention of e-mail helps to reduce storage costs and legal risk
while improving “fi ndability” of critical records. 20. Take a practical approach and limit cloud use to documents that do not have
long retention periods and carry a low litigation risk. 21. Manage social media content by IG policies and monitor it with controls that en-
sure protection of critical information assets and preservation of business records. 22. International and national standards provide effective guidance for imple-
menting IG. 23. Creating standardized metadata terms should be part of an IG effort that
enables faster, more complete, and more accurate searches and retrieval of records. 8
24. Some digital information assets must be preserved permanently as part of an organization’s documentary heritage.
25. Executive sponsorship is crucial.
Standards Considerations
Standards must also be considered in policy development. There are two general types of standards: de jure and de facto. De jure (“the law”) standards are those published by recognized standards-setting bodies, such as the International Organization for Stan- dardization (ISO), American National Standards Institute (ANSI), National Institute of Standards and Technology (NIST—this is how most people refer to it, as they do not know what the acronym stands for), British Standards Institute (BSI), Standards Council of Canada, and Standards Australia. Standards promulgated by authorities such as these have the formal status of standards.
De facto (“the fact”) standards are not formal standards but are regarded by many as if they were. They may arise though popular use (e.g., Windows at the busi- ness desktop in the 2001–2010 decade) or may be published by other bodies, such as the U.S. National Archives and Records Administration (NARA) or Department of Defense (DoD) for the U.S. military sector. They may also be published by formal standards-setting bodies without having the formal status of a “standard” (such as some technical reports published by ISO). 9
Benefi ts and Risks of Standards
Some benefi ts of developing and promoting standards are:
■ Quality assurance support. If a product meets a standard, you can be confi dent of a certain level of quality.
INFORMATION GOVERNANCE POLICY DEVELOPMENT 77
c06 77 March 8, 2014 5:16 PM
■ Interoperability support. Some standards are detailed and mature enough to allow for system interoperability between different vendor platforms.
■ Implementation frameworks and certifi cation checklists. These help to provide guides for projects and programs to ensure all necessary steps are taken.
■ Cost reduction , due to supporting uniformity of systems. Users have lower main- tenance requirements and training and support costs when systems are more uniform.
■ International consensus. Standards can represent “best practice” recommenda- tions based on global experiences. 10
Some downside considerations are:
■ Possible decreased fl exibility in development or implementation. Standards can, at times, act as a constraint when they are tied to older technologies or methods, which can reduce innovation.
■ “Standards confusion” from competing and overlapping standards. For instance, ” an ISO standard may be theory-based and use different terminology, whereas regional or national standards are more specifi c, applicable, and understandable than broad international ones.
■ Real-world shortcomings due to theoretical basis. Standards often are guides based on theory rather than practice.
■ Changing and updating requires cost and maintenance. There are costs to develop- ing, maintaining, and publishing standards. 11
Key Standards Relevant to IG Efforts
Below we introduce and discuss some established standards that should be researched and considered as a foundation for developing IG policy.
Risk Management
ISO 31000:2009 is a broad, industry-agnostic (not specifi c to vertical markets) risk management standard. It states “principles and generic guidelines” of risk manage- ment that can be applied to not only IG but also to a wide range of organizational ac- tivities and processes throughout the life of an organization.12 It provides a structured framework within which to develop and implement risk management strategies and programs.
ISO 31000 defi nes a risk management framework as a set of two basic compo-k nents that “support and sustain risk management throughout an organization.” 13 The stated components are: foundations, which are high level and include risk management policy, objectives, and executive edicts; and organizational arrangements, which are more specifi c and actionable, including strategic plans, roles and responsibilities, al- located budget, and business processes that are directed toward managing an organiza- tion’s risk.
Additional risk management standards may be relevant to your organization’s IG policy development efforts, depending on your focus, scope, corporate culture, and demands of your IG program executive sponsor.
78 INFORMATION GOVERNANCE
c06 78 March 8, 2014 5:16 PM
Information Security and Governance
ISO/IEC 27001:2005 is an information security management system (ISMS) stan- dard that provides guidance in the development of security controls to safeguard information assets. Like ISO 31000, the standard is applicable to all types of organiza- tions, irrespective of vertical industry. 14 It “specifi es the requirements for establishing, implementing, operating, monitoring, reviewing, maintaining and improving a docu- mented information security management system within the context of the organiza- tion’s overall business risks.”
ISO/IEC 27001 is fl exible enough to be applied to a variety of activities and pro- cesses when evaluating and managing information security risks, requirements, and objectives, and compliance with applicable legal and regulatory requirements. This includes use of the standards guidance by internal and external auditors as well as internal and external stakeholders (including customers and potential customers).
ISO/IEC 27002:2005, “Information Technology—Security Techniques—Code of Practice for Information Security,” 15
establishes guidelines and general principles for initiating, implementing, maintaining, and improving information security management in an orga- nization and is identical to the previous published standard, ISO 17799. The objectives outlined provide general guidance on the commonly accepted goals of information security management. ISO/IEC 27002:2005 contains best practices of control objectives and controls in the following areas of informa- tion security management:
■ security policy; ■ organization of information security; ■ asset management; ■ human resources security; ■ physical and environmental security; ■ communications and operations management; ■ access control; ■ information systems acquisition, development, and maintenance; ■ information security incident management; ■ business continuity management; and ■ compliance.
The control objectives and controls in ISO/IEC 27002:2005 are intended to be implemented to meet the requirements identifi ed by a risk assessment. ISO/ IEC 27002:2005 is intended as a common basis and practical guideline for de- veloping organizational security standards and effective security management practices, and to help build confi dence in inter-organizational activities.
ISO 31000 is a broad risk management standard that applies to all types of businesses.
INFORMATION GOVERNANCE POLICY DEVELOPMENT 79
c06 79 March 8, 2014 5:16 PM
ISO/IEC 38500:2008 is an international standard that provides high-level prin- ciples and guidance for senior executives and directors, and those advising them, for the effective and effi cient use of IT.16 Based primarily on AS 8015, the Australian IT governance standard, it “applies to the governance of management processes” that are performed at the IT service level, but the guidance assists executives in monitoring IT and ethically discharging their duties with respect to legal and regulatory compliance of IT activities.
The ISO 38500 standard comprises three main sections:
1. Scope, Application and Objectives 2. Framework for Good Corporate Governance of IT 3. Guidance for Corporate Governance of IT
It is largely derived from AS 8015, the guiding principles of which were:
■ Establish responsibilities ■ Plan to best support the organization ■ Acquire validly ■ Ensure performance when required ■ Ensure conformance with rules ■ Ensure respect for human factors
The standard also has relationships with other major ISO standards, and em- braces the same methods and approaches. It is certain to have a major impact upon the IT governance landscape. 17
Records and E-Records Management
ISO 15489–1:2001 is the international standard for RM. It identifi es the elements of RM and provides a framework and high-level overview of RM core principles. RM is defi ned as the “fi eld of management responsible for the effi cient and systematic control of the creation, receipt, maintenance, use and disposition of records, including the processes for capturing and maintaining evidence of and information about busi- ness activities and transactions in the form of records.”18
ISO/IEC 27001 and ISO/IEC 27002 are information security management systems standards that provide guidance in the development of security controls.
ISO 38500 is an international standard that provides high-level principles and guidance for senior executives and directors responsible for IT governance.
80 INFORMATION GOVERNANCE
c06 80 March 8, 2014 5:16 PM
The second part of the standard, ISO 15489–2:2001, contains the technical specifi cations and a methodology for implementing the standard, originally based on early standards work in Australia ( Design and Implementation of Recordkeeping Systems—DIRKS ). Note: Although still actively used in Australian states, the National Archives of Australia has not recommended use of DIRKS by Australian national agencies since 2007 and has removed DIRKS from its Web site.)19
The ISO 15489 standard makes little mention of electronic records, as it is written to ad- dress all kinds of records; nonetheless it was widely viewed as the defi nitive framework of what RM means.
In 2008, the International Council on Archives (ICA) formed a multination- al team of experts to develop “Principles and Functional Requirements for Records in Electronic Offi ce Environments,” commonly referred to as ICA-Req. q 20 The project was cosponsored by the Australasian Digital Recordkeeping Initiative (ADRI), which was undertaken by the Council of Australasian Archives and Records Authorities, which “com- prises the heads of the government archives authorities of the Commonwealth of Australia, New Zealand, and each of the Australian States and Territories.” 21 The National Archives of Australia presented a training and guidance manual to assist in implementing the prin- ciples at the 2012 International Congress on Archives Congress in Brisbane, Australia.
In Module 1 of ICA-Req, principles are presented in a high-level overview; Mod- ule 2 contains specifi cations for electronic document and records management sys- tems (EDRMS) that are “globally harmonized”; and Module 3 contains a require- ments set and “implementation advice for managing records in business systems.”22 Module 3 recognizes that digital recordkeeping does not have to be limited to the EDRMS paradigm—the insight that has now been picked up by “Modular Require- ments for Records Systems” (MoReq2010, the European standard released in 2011).23
Parts 1 to 3 of ISO 16175 were fully adopted in 2010–2011 based on the ICA-Req standard. The standard may be purchased at www.ISO.org, and additional information on the Australian initiative may be found at www.adri.gov.au.
ISO 16175 is guidance, not a standard that can be tested and certifi ed against. This is the criticism by advocates of testable, certifi able standards like U.S. DoD 5015.2 and the European standard, MoReq2010.
In November 2011, ISO issued new standards for ERM, the fi rst two in the ISO 30300 series, which are based on a managerial point of view and targeted at a manage-l ment-level audience rather than at records managers or technical staff:
■ ISO 30300:2011 , “Information and Documentation—Management Systems for Records—Fundamentals and Vocabulary”
■ ISO 30301:2011 , “Information and Documentation—Management Systems for Records—Requirements”
ISO 15489 is the international RM standard.
The ICA-Req standard was adopted as ISO 16175. It does not contain a testing regime for certifi cation.
INFORMATION GOVERNANCE POLICY DEVELOPMENT 81
c06 81 March 8, 2014 5:16 PM
The standards apply to “management systems for records ” (MSR), a term that, as of this printing, is not typically used to refer to ERM or RM application [RMA] software in the United States or Europe and is not commonly found in ERM research or literature.
The ISO 30300 series is a systematic approach to the creation and management of records that is “ aligned with organizational objectives and strategies. ” [italics added] 24
“ISO 30300 MSR ‘Fundamentals and Vocabulary’ explains the rationale behind the creation of an MSR and the guiding principles for its successful implementation. and it provides the terminology that ensures that it is compatible with other manage- ment systems standards.
ISO 30301 MSR ‘Requirements’ specifi es the requirements necessary to develop a records policy. It also sets objectives and targets for an organization to implement systemic improvements. This is achieved through designing records processes and systems; estimating the appropriate allocation of resources; and establishing bench- marks to monitor, measure, and evaluate outcomes. These steps help to ensure that corrective action can be taken and continuous improvements are built into the sys- tem in order to support an organization in achieving its mandate, mission, strategy, and goals.”25
Major National and Regional ERM Standards
For great detail on national and regional standards related to ERM, see the book l Managing Electronic Records: Methods, Best Practices, and Technologies (Wiley 2013) by s Robert F. Smallwood. Below is a short summary:
United States E-Records Standard
The U.S. Department of Defense 5015.2 Design Criteria Standard for Electronic Records Management Software Applications , standard was established in 1997 and is endorsed by s the leading archival authority, the U.S. National Archives and Records Administration (NARA). There is a testing regime that certifi es software vendors that is adminis- tered by JITC. JITC “builds test case procedures, writes detailed and summary fi nal reports on 5015.2-certifi ed products, and performs on-site inspection of software.” 26 The DoD standard was built for the defense sector, and logically “refl ects its govern- ment and archives roots.”
Since its endorsement by NARA, the standard has been the key requirement for ERM system vendors to meet, not only in U.S. public sector bids, but also in the com- mercial sector.
The 5015.2 standard has since been updated and expanded, in 2002 and 2007, to include requirements for metadata, e-signatures and Privacy and Freedom of Information Act requirements, and, as previously stated, was scheduled for update by 2013.
The U.S. DoD 5015.2-STD has been the most infl uential worldwide since it was fi rst introduced in 1997. It best suits military applications.
82 INFORMATION GOVERNANCE
c06 82 March 8, 2014 5:16 PM
Canadian Standards and Legal Considerations for Electronic Records Management *
The National Standards of Canada for electronic records management are: (1) Electronic Records as Documentary Evidence CAN/CGSB-72.34–2005 (“72.34”), published in December 2005; and, (2) Microfi lm and Electronic Images as Documen- tary Evidence CAN/CGSB-72.11–93, fi rst published in 1979 and updated to 2000 (“72.11”).27 72.34 incorporates all that 72.11 deals with and is therefore the more important of the two. Because of its age, 72.11 should not be relied upon for its “legal” content. However, 72.11 has remained the industry standard for “imaging” procedures—converting original paper records to electronic storage. The Canada Revenue Agency has adopted these standards as applicable to records concerning taxation.28
72.34 deals with these topics: (1) management authorization and accountability; (2) documentation of procedures used to manage records; (3) “reliability testing” of electronic records according to existing legal rules; (4) the procedures manual and the chief records offi cer; (5) readiness to produce (the “prime directive”); (6) records recorded and stored in accordance with “the usual and ordinary course of business” and “system integrity,” being key phrases from the Evidence Acts in Canada; (7) re- tention and disposal of electronic records; (8) backup and records system recovery; and, (9) security and protection. From these standards practitioners have derived many specifi c tests for auditing, establishing, and revising electronic records man- agement systems. 29
The “prime directive” of these standards states: “An organization shall always be prepared to produce its records as evidence.”30 The duty to establish the “prime directive” falls upon senior management:31
5.4.3 Senior management, the organization’s own internal law-making author- ity, proclaims throughout the organization the integrity of the organization’s records system (and, therefore, the integrity of its electronic records) by establishing and de- claring:
a. the system’s role in the usual and ordinary course of business; b. the circumstances under which its records are made; and c. its prime directive for all RMS [records management system] purposes, i.e.,
an organization shall always be prepared to produce its records as evidence. This dominant principle applies to all of the organization’s business records, including electronic, optical, original paper source records, microfi lm, and other records of equivalent form and content.
* This section was contributed by Ken Chasse J.D., LL.M., a records management attorney and consultant, and mem- ber of the Law Society of Upper Canada (Ontario) and of the Law Society of British Columbia, Canada.
The 5015.2 standard has been updated to include specifi cations such as those for e-signatures and FOI requirements.
INFORMATION GOVERNANCE POLICY DEVELOPMENT 83
c06 83 March 8, 2014 5:16 PM
Being the “dominant principle” of an organization’s electronic records manage- ment system, the duty to maintain compliance with the “prime directive” should fall upon its senior management.
Legal Considerations Because an electronic record is completely dependent upon its ERM system for every- thing, compliance with these National Standards and their “prime directive” should be part of the determination of the “admissibility” (acceptability) of evidence and of electronic discovery in court proceedings (litigation) and in regulatory tribunal proceedings. 32
There are 14 legal jurisdictions in Canada: 10 provinces, 3 territories, and the federal jurisdiction of the Government of Canada. Each has an Evidence Act (the Civil Code in the province of Quebec 33 ), which applies to legal proceedings within its leg- islative jurisdiction. For example, criminal law and patents and copyrights are within federal legislative jurisdiction, and most civil litigation comes within provincial legisla- tive jurisdiction. 34
The admissibility of records as evidence is determined under the “business record” provi- sions of the Evidence Acts.35 They require proof that a record was made “in the usual and ordinary course of business,” and of “the circumstances of the making of the record.” In addition, to obtain admissibility for electronic records, most of the Evidence Acts contain electronic record provisions, which state that an electronic record is admis- sible as evidence on proof of the “integrity of the electronic record system in which the data was recorded or stored.” 36 This is the “system integrity” test for the admissibility of electronic records. The word “integrity” has yet to be defi ned by the courts. 37
However, by way of sections such as the following, the electronic record provi- sions of the Evidence Acts make reference to the use of standards such as the National Standards of Canada:
For the purpose of determining under any rule of law whether an electronic record is admissible, evidence may be presented in respect of any standard, procedure, usage or practice on how electronic records are to be recorded or stored, having regard to the type of business or endeavor that used, recorded, or stored the electronic record and the nature and purpose of the electronic record. 38
U.K. and European Standards
In the United Kingdom, The National Archives (TNA) (formerly the Public Record Offi ce, or PRO) “has published two sets of functional requirements to promote the development of the electronic records management software market (1999 and 2002).” It ran a program to evaluate products against the 2002 requirements.39 Initially these requirements were established in collaboration with the central government, and they later were utilized by the public sector in general, and also in other nations. The Na- tional Archives 2002 requirements remain somewhat relevant, although no additional development has been underway for years. It is clear that the second version of Model Requirements for Management of Electronic Records, MoReq2, largely supplanted the UK standard, and subsequently the newer MoReq2010 may further supplant the UK standard.
84 INFORMATION GOVERNANCE
c06 84 March 8, 2014 5:16 PM
MoReq2010 “unbundles” some of the core requirements in MoReq2, and sets out functional requirements in modules. The approach seeks to permit the later creation of e-records software standards in various vertical industries such as defense, health care, fi nancial services, and legal services.
MoReq2010 is available free—all 525 pages of it (by comparison, the U.S. DoD 5015.2 standard is less than 120 pages long). For more information on MoReq2010, visit www.moreq2010.eu. The entire specifi cation may be downloaded at: http:// moreq2010.eu/pdf/moreq2010_vol1_v1_1_en.pdf.
MoReq2010 In November 2010, the DLM Forum, a European Commission–supported body, announced the availability of the fi nal draft of the MoReq2010 specifi cation for electronic records manage- ment systems (ERMS), following extensive public consultation. The fi nal specifi cation was published in mid-2011. 40
The DLM Forum explains that “With the growing demand for [electronic] re- cords management, across a broad spectrum of commercial, not-for-profi t, and gov- ernment organizations, MoReq2010 provides the fi rst practical specifi cation against which all organizations can take control of their corporate information. IT software and services vendors are also able to have their products tested and certifi ed that they meet the MoReq2010 specifi cation.” 41
MoReq2010 supersedes its predecessor MoReq2 and has the continued support and backing of the European Commission.
Australian ERM and Records Management Standards
Australia has adopted all three parts of ISO 16175 as its e-records management standard. 42 (For more detail on this standard go to ISO.org.)
Australia has long led the introduction of highly automated electronic document management systems and records management standards. Following the approval and release of the AS 4390 standard in 1996, the international records management com- munity began work on the development of an International standard. This work used AS 4390–1996 Records Management as its starting point.
Development of Australian Records Standards In 2002 Standards Australia published a new Australian Standard on records manage- ment, AS ISO 15489, based on the ISO 15489 international records management stan- dard. It differs only in its preface verbiage. 43 AS ISO 15489 carries through all these main components of AS 4390, but internationalizes the concepts and brings them up to date. The standards thereby codify Australian best practice but are also progressive in their recommendations.
Additional Relevant Australian Standards The Australian Government Recordkeeping Metadata Standard Version 2.0 pro- vides guidance on metadata elements and subelements for records management. It is a baseline tool that “describes information about records and the context in which they are captured and used in Australian Government agencies.” This standard is intended to help Australian agencies “meet business, accountability and archival requirements
INFORMATION GOVERNANCE POLICY DEVELOPMENT 85
c06 85 March 8, 2014 5:16 PM
in a systematic and consistent way by maintaining reliable, meaningful and accessible records.” The standard is written in two parts, the fi rst describing its purpose and features and the second outlining the specifi c metadata elements and subelements.44
The Australian Government Locator Service , AGLS, is published as AS 5044– 2010, the metadata standard to help fi nd and exchange information online. It updates the 2002 version, and includes changes made by the Dublin Core Metadata Initiative (DCMI).
Another standard, AS 5090:2003, “Work Process Analysis for Recordkeep- ing ,” complements AS ISO 15489 and provides guidance on understanding business g processes and workfl ow so that recordkeeping requirements may be determined. 45
Long-Term Digital Preservation
Although many organizations shuffl e dealing with digital preservation issues to the back burner, long-term digital preservation (LTDP) is a key area in which IG policy should be applied. LTDP methods, best practices, and standards should be applied to preserve an organization’s historical and vital records ( those without which it cannot operate or restart operations) and to maintain its corporate or organizational memory. The key standards that apply to LTDP are listed next.
The offi cial standard format for preserving electronic documents is PDF/A-1, based on PDF 1.4 originally developed by Adobe. ISO 19005–1:2005, “Document Manage- ment—Electronic Document File Format for Long-Term Preservation—Part 1: Use of PDF 1.4 (PDF/A-1),” is the published specifi cation for using PDF 1.4 for LTDP, which is applicable to e-documents that may contain not only text characters but also graphics (either raster or vector). 46
ISO 14721:2012 , “Space Data and Information Transfer Systems—Open Archival Information Systems—Reference Model (OAIS),” is applicable to LTDP. 47 ISO 14271 “specifi es a reference model for an open archival information system (OAIS). The pur- pose of ISO 14721 is to establish a system for archiving information, both digitalized and physical, with an organizational scheme composed of people who accept the re- sponsibility to preserve information and make it available to a designated commu- nity.” 48 The fragility of digital storage media combined with ongoing and sometimes rapid changes in computer software and hardware poses a fundamental challenge to ensuring access to trustworthy and reliable digital content over time. Eventually, ev- ery digital repository committed to long-term preservation of digital content must have a strategy to mitigate computer technology obsolescence. Toward this end, the
The ISO 30300 series of e-records standards are written for a managerial audi- ence and encourage ERM that is aligned to organizational objectives.
LTDP is a key area to which IG policy should be applied.
86 INFORMATION GOVERNANCE
c06 86 March 8, 2014 5:16 PM
Consultative Committee for Space Data Systems developed the OAIS reference model to support formal standards for the long-term preservation of space science data and information assets. OAIS was not designed as an implementation model.
OAIS is the lingua franca of digital preservation, as the international digital pres- ervation community has embraced it as the framework for viable and technologically sustainable digital preservation repositories. An LTDP strategy that is OAIS compliant offers the best means available today for preserving the digital heritage of all organizations, private and public. (See Chapter 17 .)
ISO TR 18492 (2005) , “ Long-Term Preservation of Electronic Document Based Information,” provides practical methodological guidance for the long-term preser- vation and retrieval of authentic electronic document-based information, when the retention period exceeds the expected life of the technology (hardware and software) used to create and maintain the information assets. ISO 18492 takes note of the role of ISO 15489 but does not cover processes for the capture, classifi cation, and disposition of authentic electronic document-based information.
ISO 16363:2012 , “ Space Data and Information Transfer Systems—Audit and Certifi cation of Trustworthy Digital Repositories,” “defi nes a recommended prac- tice for assessing the trustworthiness of digital repositories. It is applicable to the entire range of digital repositories.”49 It is an audit and certifi cation standard orga- nized into three broad categories: Organization Infrastructure, Digital Object Man- agement, and Technical Infrastructure and Security Risk Management. ISO 16363 represents the gold standard of audit and certifi cation for trustworthy digital repositories. (See Chapter 17 .)
Business Continuity Management
ISO 22301:2012, “Societal Security—Business Continuity Management Systems— Requirements,” spells out the requirements for creating and implementing a stan- dardized approach to business continuity management (BCM, also known as di- saster recovery [DR]), in the event an organization is hit with a disaster or major business interruption. 50 The guidelines can be applied to any organization regard- less of vertical industry or size. The specifi cation includes the “requirements to plan, establish, implement, operate, monitor, review, maintain and continually im- prove a documented management system to protect against, reduce the likelihood
An LTDP strategy that is OAIS compliant (based on ISO 14721) offers the best means available today for preserving the digital heritage of all organizations.
ISO 16363 represents the gold standard of audit and certifi cation for trustwor- thy digital repositories.
INFORMATION GOVERNANCE POLICY DEVELOPMENT 87
c06 87 March 8, 2014 5:16 PM
of occurrence, prepare for, respond to, and recover from disruptive incidents when they arise.”
The UK business continuity standard, BS25999-2, which heavily infl uenced the newer ISO standard, was withdrawn when ISO 22301 was released. 51 The business rationale is that, with the increasing globalization of business, ISO 22301 will allow and support more consistency worldwide not only in business continuity planning and practices but also will promote common terms and help to embed various ISO management systems standards within organizations. U.S.-based ANSI, Standards Australia, Standards Singapore, and other standards bodies also contributed to the development of ISO 22301.
Benefi ts of ISO 22301
■ Threat identifi cation and assessment. Discover, name, and evaluate potential seri- ous threats to the viability of the business.
■ Threat and recovery planning. so the impact and resultant downtime and recov- ery from real threats that do become incidents is minimized
■ Mission-critical process protection. Identifying key processes and taking steps to ensure they continue to operate even during a business interruption.
■ Stakeholder confi dence. Shows prudent management planning and business re- silience to internal and external stakeholders, including employees, business units, customers, and suppliers. 52
Making Your Best Practices and Standards Selections to Inform Your IG Framework
You must take into account your organization’s corporate culture, management style, and organizational goals when determining which best practices and standards should receive priority in your IG framework. However, you must step through your business rationale in discussions with your cross-functional IG team and fully document the reasons for your approach. Then you must present this approach and your draft IG
ISO 22301 spells out requirements for creating and implementing a standard- ized approach to business continuity management.
You must take into account your organization’s corporate culture, manage- ment style, and organizational goals when determining which best practice and standards should be selected for your IG framework.
88 INFORMATION GOVERNANCE
c06 88 March 8, 2014 5:16 PM
framework to your key stakeholders and be able to defend your determinations while allowing for input and adjustments. Perhaps you have overlooked some key factors that your larger stakeholder group uncovers, and their input should be folded into a fi nal draft of your IG framework.
Next, you are ready to begin developing IG policies that apply to various aspects of information use and management, in specifi c terms. You must detail the policies you expect employees to follow when handling information on various information deliv- ery platforms (e.g., e-mail, blogs, social media, mobile computing, cloud computing). It is helpful at this stage to collect and review all your current policies that apply and to gather some examples of published IG policies, particularly from peer organiza- tions and competitors (where possible). Of note: You should not just adopt another organization’s polices and believe that you are done with policy making. Rather, you must enter into a deliberative process, using your IG framework for guiding principles and considering the views and needs of your cross-functional IG team. Of paramount importance is to be sure to incorporate the alignment of your organizational goals and business objectives when crafting policy.
With each policy area, be sure that you have considered the input of your stake- holders, so that they will be more willing to buy into and comply with the new policies and so that the policies do not run counter to their business needs and required busi- ness processes. Otherwise, stakeholders will skirt, avoid, or halfheartedly follow the new IG policies, and the IG program risks failure.
Once you have fi nalized your policies, be sure to obtain necessary approvals from your executive sponsor and key senior managers.
Roles and Responsibilities
Policies will do nothing without people to advocate, support, and enforce them. So clear lines of authority and accountability must be drawn , and responsibilities must be assigned.
Overall IG program responsibility resides at the executive sponsor level, but beneath that, an IG program manager should drive team members toward mile- stones and business objectives and should shoulder the responsibility for day-to-day program activities, including implementing and monitoring key IG policy tasks. These tasks should be approved by executive stakeholders and assigned as appropri- ate to an employee’s functional area of expertise. For instance, the IG team member from legal may be assigned the responsibility for researching and determining legal requirements for retention of business records, perhaps working in conjunction with the IG team member from RM, who can provide additional input based on interviews with representatives from business units and additional RM research into best practices.
Lines of authority, accountability, and responsibility must be clearly drawn for the IG program to succeed.
INFORMATION GOVERNANCE POLICY DEVELOPMENT 89
c06 89 March 8, 2014 5:16 PM
Program Communications and Training
Your IG program must contain a communications and training component, as a stan- dard function. Your stakeholder audience must be made aware of the new policies and practices that are to be followed and how this new approach contributes toward the organization’s goals and business objectives.
The fi rst step in your communications plan is to identify and segment your stake- holder audiences and to customize or modify your message to the degree that is neces- sary to be effective. Communications to your IT team can have a more technical slant, and communications to your legal team can have some legal jargon and emphasize le- gal issues. The more forethought you put into crafting your communications strategy, the more effective it will be.
That is not to say that all messages must have several versions: Some core concepts l and goals should be emphasized in communications to all employees.
How should you communicate? The more ways you can get your IG message to your core stakeholder audiences, the more effective and lasting the message will be. So posters, newsletters, e-mail, text messages, internal blog or intranet posts, and company meetings should all be a part of the communications mix. Remember, the IG program requires not only training but re training, and the aim should be to create a compliance culture that is so prominent and expected that employees adopt the new practices and policies and integrate them into their daily activities. Ideally, employees will provide valuable input to help fi ne-tune and improve the IG program.
Training should take multiple avenues as well. Some can be classroom instruc- tion, some online learning, and you may want to create a series of training videos. But the training effort must be consistent and ongoing to maintain high levels of IG effectiveness. Certainly, this means you will need to add to your new hire training pro- gram for employees joining or transferring to your organization.
Program Controls, Monitoring, Auditing, and Enforcement
How do you know how well you are doing? You will need to develop metrics to de- termine the level of employee compliance, its impact on key operational areas, and progress made toward established business objectives.
Testing and auditing the program provides an opportunity to give feedback to employees on how well they are doing and to recommend changes they may make. But having objective feedback on key metrics also will allow for your executive sponsor to see where progress has been made and where improvements need to focus.
Communications regarding your IG program should be consistent and clear and somewhat customized for various stakeholder groups.
90 INFORMATION GOVERNANCE
c06 90 March 8, 2014 5:16 PM
CHAPTER SUMMARY: KEY POINTS
■ You must inform and frame IG policy with internal and external frameworks, models, best practices, and standards
■ The business user is the primary stakeholder of managed information.
■ Information management is important at all stages of the life cycle.
■ Legal stakeholders usually can mandate the preservation of what is most criti- cal, though often at great cost.
■ The IGRM was developed by the EDRM Project to foster communication among stakeholders and adoption of IG. It complements ARMA’s The Principles.
■ ISO 31000 is a broad risk management standard that applies to all types of businesses.
■ ISO/IEC 27001 and ISO/IEC 27002 are ISMS standards that provide guidance in the development of security controls.
■ ISO 15489 is the international RM standard.
■ The ICA-Req standard was adopted as ISO 16175. It does not contain a test- ing regime for certifi cation.
■ The ISO 30300 series of e-records standards are written for a managerial au- dience and encourage ERM that is aligned to organizational objectives.
■ DoD 5015.2 is the U.S. ERM standard; the European ERM standard is MoReq2010. Australia has adopted all three parts of ISO 16175 as its e-records management standard.
■ LTDP is a key area to which IG policy should be applied.
■ An LTDP strategy that is OAIS compliant (based on ISO 14721) offers the best means available today for preserving the digital heritage of all organizations.
■ ISO 16363 represents the gold standard of audit and certifi cation for trust- worthy digital repositories.
■ ISO 38500 is an international standard that provides high-level principles and guidance for senior executives and directors responsible for IT governance.
■ ISO 22301 spells out requirements for creating and implementing a standardized approach to business continuity management.
Clear penalties for policy violations must be communicated to employees so they know the seriousness of the IG program and how important it is in helping the orga- nization pursue its business goals and accomplish stated business objectives.
INFORMATION GOVERNANCE POLICY DEVELOPMENT 91
c06 91 March 8, 2014 5:16 PM
Notes
1. ARMA International, “Generally Accepted Recordkeeping Principles,” www.arma.org/r2/generally- accepted-br-recordkeeping-principles/copyright (accessed November 25, 2013).
2. ARMA International, “Information Governance Maturity Model,” www.arma.org/r2/generally- accepted-br-recordkeeping-principles/metrics (accessed November 25, 2013).
3. Electronic Discovery, “IGRM v3.0 Update: Privacy & Security Offi cers As Stakeholders – Electronic Discovery,” http://electronicdiscovery.info/igrm-v3-0-update-privacy-security-offi cers-as-stakehold- ers-electronic-discovery/ (accessed April 24, 2013).
4. EDRM, “Information Governance Reference Model (IGRM),” www.edrm.net/projects/igrm (accessed October 9, 2013).
5. Ibid. 6. Ibid. 7. Project Management Institute, A Guide to the Project Management Body of Knowledge (PMBOK Guide ),
4th ed. (Newtown Square, PA, Project Management Institute, 2008), ANSI/PMI 99-001-2008, pp. 273–312.
8. Kate Cumming, “Metadata Matters,” in Julie McLeod and Catherine Hare, eds., Managing Electronic Records , p. 34 (London: Facet, 2005).s
9. Marc Fresko, e-mail to author, May 13, 2012. 10. Hofman, “The Use of Standards and Models,” in Julie McLeod and Catherine Hare, eds., Managing
Electronic Records , p. 34 (London: Facet, 2005) pp. 20–21. s 11. Ibid. 12. International Organization for Standardization, “ISO 31000:2009 Risk Management—Principles and
Guidelines,” www.iso.org/iso/home/store/catalogue_tc/catalogue_detail.htm?csnumber=43170 (accessed April 22, 2013).
13. Ibid. 14. International Organization for Standardization, ISO/IEC 27001:2005, “Information Technology—
Security Techniques—Information Security Management Systems—Requirements,” www.iso.org/iso/ catalogue_detail?csnumber=42103 (accessed April 22, 2013).
15. International Organization for Standardization, ISO/IEC 27002:2005, “Information Technology— Security Techniques—Code of Practice for Information Security Management,” www.iso.org/iso/cata- logue_detail?csnumber=50297 (accessed July 23, 2012).
16. International Organization for Standardization, ISO/IEC 38500:2008, www.iso.org/iso/catalogue_ detail?csnumber=51639 (accessed March 12, 2013).
17. ISO 38500 IT Governance Standard, www.38500.org/ (accessed March 12, 2013). 18. International Organization for Standardization, ISO 15489-1: 2001 Information and Documentation—
Records Management. Part 1: General (Geneva: ISO, 2001), section 3.16. l
■ You must take into account your organization’s corporate culture, manage- ment style, and organizational goals when determining which best practices and standards should be selected for your IG framework.
■ Lines of authority, accountability, and responsibility must be clearly drawn for the IG program to succeed.
■ Communications regarding your IG program should be consistent and clear and somewhat customized for various stakeholder groups.
■ IG program audits are an opportunity to improve training and compliance, not to punish employees.
CHAPTER SUMMARY: KEY POINTS (Continued )
92 INFORMATION GOVERNANCE
c06 92 March 8, 2014 5:16 PM
19. National Archives of Australia, www.naa.gov.au/records-management/publications/DIRKS-manual .aspx (accessed October 15, 2012).
20. International Council on Archives, “ICA-Req: Principles and Functional Requirements for Records in Electronic Offi ce Environments: Guidelines and Training Material,” November 29, 2011, www .ica.org/11696/activities-and-projects/icareq-principles-and-functional-requirements-for-records-in- electronic-offi ce-environments-guidelines-and-training-material.html.
21. Council of Australasian Archives and Records Authorities, www.caara.org.au/ (accessed May 3, 2012). 22. Adrian Cunningham, blog post comment, May 11, 2011. http://thinkingrecords.co.uk/2011/05/06/
how-moreq-2010-differs-from-previous-electronic-records-management-erm-system-specifi cations/. 23. Ibid. 24. “Relationship between the ISO 30300 Series of Standards and Other Products of ISO/TC 46/SC
11: Records Processes and Controls,” White Paper, ISO TC46/SC11- Archives/Records Management (March 2012), www.iso30300.es/wp-content/uploads/2012/03/ISOTC46SC11_White_paper_rela- tionship_30300_technical_standards12032012v6.pdf
25. Ibid. 26. Julie Gable, Information Management Journal, November 1, 2002, www.thefreelibrary.com/Everything-
+you+wanted+to+know+about+DoD+5015.2:+the+standard+is+not+a…-a095630076. 27. These standards were developed by the CGSB (Canadian General Standards Board), which is a stan-
dards-writing agency within Public Works and Government Services Canada (a department of the federal government). It is accredited by the Standards Council of Canada as a standards development agency. The Council must certify that standards have been developed by the required procedures be- fore it will designate them as being National Standards of Canada. 72.34 incorporates by reference as “normative references”: (1) many of the standards of the International Organization for Standardiza- tion (ISO) in Geneva, Switzerland. (“ISO,” derived from the Greek word isos (equal) so as to provide s a common acronym for all languages); and (2) several of the standards of the Canadian Standards Association (CSA). The “Normative references” section of 72.34 (p. 2) states that these “referenced documents are indispensable for the application of this document.” 72.11 cites (p. 2, “Applicable Pub- lications”) several standards of the American National Standards Institute/Association for Information and Image Management (ANSI/AIIM) as publications “applicable to this standard.” The process by which the National Standards of Canada are created and maintained is described within the standards themselves (reverse side of the front cover), and on the CGSB’s Web site (see, “Standards Develop- ment”), from which Web site these standards may be obtained; http://www.ongc-cgsb.gc.ca.
28. The Canada Revenue Agency (CRA) informs the public of its policies and procedures by means, among others, of its Information Circulars (IC’s), and s GST/HST Memoranda . (GST: goods and services tax; HST: harmonized sales tax, i.e. , the harmonization of federal and provincial sales taxes into one retail sales tax.) In particular, see: IC05-1 , dated June 2010, entitled, Electronic Record Keeping , paragraphs 24, 26 and 28.g Note that use of the National Standard cited in paragraph 26, Microfi lm and Electronic Images as Documen- tary Evidence CAN/CGSB-72.11-93 is mandatory for, “Imaging and microfi lm (including microfi che) reproductions of books of original entry and source documents . . .” Paragraph 24 recommends the use of the newer national standard, Electronic Records as Documentary Evidence CAN/CGSB-72.34-2005, “To ensure the reliability, integrity and authenticity of electronic records.” However, if this newer standard is given the same treatment by CRA as the older standard, it will be made mandatory as well. And similar statements appear in the GST Memoranda, Computerized Records 500-1-2, s Books and Records 500-1. IC05-s 1. Electronic Record Keeping , concludes with the note, “Most Canada Revenue Agency publications areg available on the CRA Web site www.cra.gc.ca under the heading ‘Forms and Publications.’”
29. There are more than 200 specifi c compliance tests that can be applied to determine if the principles of 72.34 are being complied with. The analysts—a combined team of records management and legal expertise—analyze: (1) the nature of the business involved; (2) the uses and value of its records for its various functions; (3) the likelihood and risk of the various types of its records being the subject of legal proceedings, or of their being challenged by some regulating authority; and (4) the consequences of the unavailability of acceptable records—for example, the consequences of its records not being accepted in legal proceedings. Similarly, in regard to the older National Standard of Canada, 72.11, there is a comparable series of more than 50 tests that can be applied to determine the state of compliance with its principles.
30. Electronic Records as Documentary Evidence CAN/CGSB-72.34-2005 (“72.34”), clause 5.4.3 c) at p. 17; and Microfi lm and Electronic Images as Documentary Evidence CAN/CGSB-72.11-93 (“72.11”), paragraph 4.1.2 at p. 2, supra note 49.
31. 72.34, Clause 5.4.3, ibid. 32. “Admissibility” refers to the procedure by which a presiding judge determines if a record or other
proffered evidence is acceptable as evidence according the rules of evidence. “Electronic discovery”
INFORMATION GOVERNANCE POLICY DEVELOPMENT 93
c06 93 March 8, 2014 5:16 PM
is the compulsory exchange of relevant records by the parties to legal proceedings prior to trial.” As to the admissibility of records as evidence see: Ken Chasse, “The Admissibility of Electronic Business Records” (2010), 8 Canadian Journal of Law and Technology 105; and Ken Chasse, “Electronic Re- cords for Evidence and Disclosure and Discovery” (2011) 57 The Criminal Law Quarterly 284. For the electronic discovery of records see: Ken Chasse, “Electronic Discovery— Sedona Canada is Inadequate on Records Management—Here’s Sedona Canada in Amended Form,” Canadian Journal of Law and Tech- nology 9 (2011): 135; and Ken Chasse, “Electronic Discovery in the Criminal Court System,” Canadian Criminal Law Review 14 (2010): 111. See also note 18 infra , and accompanying text.
33. For the province of Quebec, comparable provisions are contained in Articles 2831-2842, 2859-2862, 2869-2874 of Book 7 “Evidence” of the Civil Code of Quebec, S.Q. 1991, c. C-64, to be read in con- junction with, An Act to Establish a Legal Framework for Information Technology, R.S.Q. 2001, c. C-1.1, ss. 2, 5-8, and 68.
34. For the legislative jurisdiction of the federal and provincial governments in Canada, see The Constitu- tion Act, 1867 (U.K.) 30 & 31 Victoria, c. 3, s. 91 (federal), and s. 92 (provincial), www.canlii.org/en/ca/ laws/stat/30—31-vict-c-3/latest/30—31-vict-c-3.html.
35. The two provinces of Alberta and Newfoundland and Labrador do not have business record provisions in their Evidence Acts. Therefore “admissibility” would be determined in those jurisdictions by way of the court decisions that defi ne the applicable common law rules; such decisions as, Ares v. Venner [1970]r S.C.R. 608, 14 D.L.R. (3d) 4 (S.C.C.), and decisions that have applied it.
36. See for example, the Canada Evidence Act, R.S.C. 1985, c. C-5, ss. 31.1-31.8; Alberta Evidence Act, R.S.A. 2000, c. A-18, ss. 41.1-41.8; (Ontario) Evidence Act, R.S.O. 1990, c. E.23, s. 34.1; and the (Nova Scotia) Evidence Act, R.S.N.S. 1989, c. 154, ss. 23A-23G. The Evidence Acts of the two provinces of British Columbia and Newfoundland and Labrador do not contain electronic record provisions. However, because an electronic record is no better than the quality of the record system in which it is recorded or stored, its “integrity” (reliability, credibility) will have to be determined under the other provincial laws that determine the admissibility of records as evidence.
37. The electronic record provisions have been in the Evidence Acts in Canada since 2000. They have been applied to admit electronic records into evidence, but they have not yet received any detailed analysis by the courts.
38. This is the wording used in, for example, s. 41.6 of the Alberta Evidence Act, s. 34.1(8) of the (Ontario) Evidence Act; and s. 23F of the (Nova Scotia) Evidence Act, supra note 10. Section 31.5 of the Canada Evidence Act, supra note 58, uses the same wording, the only signifi cant difference being that the word “document” is used instead of “record.” For the province of Quebec, see sections 12 and 68 of, An Act to Establish a Legal Framework for Information Technology, R.S.Q., chapter C-1.1.
39. “Giving Value: Funding Priorities for UK Archives 2005–2010, a key new report launched by the Na- tional Council on Archives (NCA) in November 2005,” www.nationalarchives.gov.uk/documents/stan- dards_guidance.pdf (accessed October 15, 2012).
40. DLM Forum Foundation, MoReq2010 ® : Modular Requirements for Records Systems—Volume 1: Core Ser- vices & Plug-in Modules, 2011, http://moreq2010.eu/ (accessed May 7, 2012, published in paper form ass ISBN 978-92-79-18519-9 by the Publications Offi ce of the European Communities, Luxembourg.
41. DLM Forum, Information Governance across Europe, www.dlmforum.eu/ (accessed December 14, 2010).
42. National Archives of Australia, “Australian and International Standards,” 2012, www.naa.gov.au /records-management/strategic-information/standards/ASISOstandards.aspx (accessed July 16, 2012).
43. E-mail to author from Marc Fresko, May 13, 2012. 44. National Archives of Australia, “Australian Government Recordkeeping Metadata Standard,” 2012,
www.naa.gov.au/records-management/publications/agrk-metadata-standard.aspx (accessed July 16, 2012).
45. National Archives of Australia, “Australian and International Standards,” 2012, www.naa.gov.au /records-management/strategic-information/standards/ASISOstandards.aspx (accessed July 16, 2012).
46. International Organization for Standardization, ISO 19005-1:2005, “Document Management— Electronic Document File Format for Long-Term Preservation—Part 1: Use of PDF 1.4 (PDF/A-1),” www.iso.org/iso/catalogue_detail?csnumber=38920 (accessed July 23, 2012).
47. International Organization for Standardization, ISO 14721:2012, “Space Data and Information Trans- fer Systems Open Archival Information System—Reference Model,” www.iso.org/iso/iso_catalogue/ catalogue_ics/catalogue_detail_ics.htm?csnumber=57284 (accessed November 25, 2013).
48. Ibid. 49. International Organization for Standardization, ISO 16363:2012, “Space Data and Information
Transfer Systems—Audit and Certifi cation of Trustworthy Digital Repositories,” www.iso.org/iso/ iso_catalogue/catalogue_tc/catalogue_detail.htm?csnumber=56510 (accessed July 23, 2012).
94 INFORMATION GOVERNANCE
c06 94 March 8, 2014 5:16 PM
50. International Organization for Standardization, ISO 22301:2012 “Societal Security—Business Conti- nuity Management Systems—Requirements,” www.iso.org/iso/catalogue_detail?csnumber=50038 (ac- cessed April 21, 2013).
51. International Organization for Standardization, “ISO Business Continuity Standard 22301 to Replace BS 25999-2,” www.continuityforum.org/content/news/165318/iso-business-continuity-standard-22301- replace-bs-25999-2 (accessed April 21, 2013).
52. BSI, “ISO 22301 Business Continuity Management,” www.bsigroup.com/en-GB/iso-22301-business- continuity (accessed April 21, 2013).
c07 95 February 28, 2014 11:44 AM
PA RT T H R E E Information Governance Key Impact Areas Based on the IG Reference Model
97
c07 97 February 28, 2014 11:44 AM
Business Considerations for a Successful IG Program
C H A P T E R 7
By Barclay T. Blair
T he business case for information governance (IG) programs has historically been diffi cult to justify. It is hard to apply a strict, short-term return on invest- ment (ROI) calculation. A lot of time, effort, and expense is involved before true
economic benefi ts can be realized. So a commitment to the long view and an un- derstanding of the many areas where an organization will improve as a result of a successful IG program are needed. But the bottom line is that reducing exposure to business risk, improving the quality and security of data and e-documents, cutting out unneeded stored information, and streamlining information technology (IT) develop- ment while focusing on business results add up to better organizational health and viability and, ultimately, an improved bottom line.
Let us take a step back and examine the major issues affecting information costing and calculating the real cost of holding information, consider Big Data and e-discov- ery ramifi cations, and introduce some new concepts that may help frame information costing issues differently for business managers. Getting a good handle on the true cost of information is essential to governing it properly, shifting resources to higher- value information, and discarding information that has no discernible business value and carries inherent, avoidable risks.
Changing Information Environment
The information environment is changing. Data volumes are growing, but unstructured information (such as e-mail, word processing documents, social media posts) is grow- ing faster than our ability to manage it. Some unstructured information has more structure than others containing some identifi able metadata (e.g., e-mail messages all have a header, subject line, time/date stamp, and message body). This is often termed as semistructured information, but for purposes of this book, we use the term “unstruc-d tured information” to include semistructured information as well.
The volume of unstructured information is growing dramatically. Analysts estimate that, over the next decade, the amount of data worldwide will grow by 44 times (from .8 zettabytes to 35 zettabytes: 1 zettabyte = 1 trillion gigabytes). 1 However, the volume
Information Governance: Concepts, Strategies and Best Practices By Robert F. Smallwood Copyright © 2014 by Robert F. Smallwood
98 INFORMATION GOVERNANCE
c07 98 February 28, 2014 11:44 AM
of unstructured information will actually grow 50 percent faster than structured data. Analysts also estimate that fully 90 percent of unstructured information will require formal governance and management by 2020. In other words, the problem of unstruc- tured IG is growing faster than the problem of data volume itself.
What makes unstructured information so challenging? There are several factors, including
■ Horizontal versus vertical. Unstructured information is typically not clearly at- tached to a department or a business function. Unlike the vertical focus of an enterprise resource planning (ERP) database, for example, an e-mail system serves multiple business functions—from employee communication to fi ling with regulators—for all parts of the business. Unstructured information is much more horizontal, making it diffi cult to develop and apply business rules.
■ Formality. The tools and applications used to create unstructured information often engender informality and the sharing of opinions that can be problematic in litigation, investigations, and audits—as has been repeatedly demonstrated in front-page stories over the past decade. This problem is not likely to get any easier as social media technologies and mobile devices become more common in the enterprise.
■ Management location. Unstructured information does not have a single, obvious home. Although e-mail systems rely on central messaging servers, e-mail is just as likely to be found on a fi le share, mobile device, or laptop hard drive. This makes the application of management rules more diffi cult than the application of the same rules in structured systems, where there is a close marriage between the application and the database.
■ “Ownership” issues. Employees do not think that they “own” data in an accounts receivable system like they “own” their e-mail or documents stored on their hard drive. Although such information generally has a single owner (i.e., the organization itself), this non-ownership mind-set can make the imposition of management rules for unstructured information more challenging than for structured data.
■ Classifi cation. The business purpose of a database is generally determined prior to its design. Unlike structured information, the business purpose of unstruc- tured information is diffi cult to infer from the application that created or stores the information. A word processing fi le stored in a collaboration environment could be a multimillion-dollar contract or a lunch menu. As such, classifi ca- tion of unstructured content is more complex and expensive than structured information.
Taken together, these factors reveal a simple truth: Managing unstructured infor- mation is a separate and distinct discipline from managing databases. It requires different
The problem of unstructured IG is growing faster than the problem of data volume itself.
BUSINESS CONSIDERATIONS FOR A SUCCESSFUL IG PROGRAM 99
c07 99 February 28, 2014 11:44 AM
methods and tools. Moreover, determining the costs and benefi ts of owning and man- aging unstructured information is a unique—but critical—challenge.
The governance of unstructured information creates enormous complexity and risk for business managers to consider while making it diffi cult for organizations to generate real value from all this information. Despite the looming crisis, most organi- zations have limited ability to quantify the real cost of owning and managing unstruc- tured information. Determining the total cost of owning unstructured information is an essential precursor to managing and monetizing that information while cutting information costs—key steps in driving profi t for the enterprise.
Storing things is cheap . . . I’ve tended to take the attitude, “Don’t throw elec- tronic things away.”
—Data scientist quoted in Anne Eisenberg, “What 23 Years of E-Mail May Say About You,” New York Times, ” April 7, 2012
The company spent $900,000 to produce an amount of data that would con- sume less than one-quarter of the available capacity of an ordinary DVD.
— Nicholas M. Pace and Laura Zakaras, “Where the Money Goes: Understanding Litigant Expenditures for Producing Electronic
Discovery,” RAND Institute for Civil Justice, 2012
Calculating Information Costs
We are not very good at fi guring out what information costs— truly costs. Many orga- nizations act as if storage is an infi nitely renewable resource and the only cost of in- formation. But, somehow, enterprise storage spending rises each year and IT support costs rise, even as the root commodity (disk drives) grows ever cheaper and denser. Obviously, they are not considering labor and overhead costs incurred with managing information, and the additional knowledge worker time wasted sifting through moun- tains of information to fi nd what they need.
Some of this myopic focus on disk storage cost is simple ignorance. The executive who concludes that a terabyte costs less than a nice meal at a restaurant after browsing storage drives on the shelves of a favorite big-box retailer on the weekend is of little help.
Rising information storage costs cannot be dismissed. Each year the billions that or- ganizations worldwide spend on storage grows, even though the cost of a hard drive is less than 1 percent of what it was about a decade ago. We have treated storage as a resource that has no cost to the organization outside of the initial capital outlay and basic operational costs. This is shortsighted and outdated.
Some of the reason that managers and executives have diffi culty comprehending the true cost of information is old-fashioned miscommunication. IT departments do not see (or pay for) the full cost of e-discovery and litigation. Even when IT “part- ners” with litigators, what IT learn rarely drives strategic IT decisions. Conversely, law departments (and outside fi rms) rarely own and pay for the IT consequences of their litigation strategies. It is as if when the litigation fi re needs to be put out, nobody calculates the cost of gasoline and water for the fi re trucks.
100 INFORMATION GOVERNANCE
c07 100 February 28, 2014 11:44 AM
But calculating the cost of information—especially information that does not sit neatly in the rows and columns of enterprise database “systems of record”—is complex. It is more art than science. And it is more politics than art. There is no Aristotelian Golden Mean for information.
The true cost of mismanaging information is much more profound than simply calculating storage unit costs. It is the cost of opportunity lost—the lost benefi t of in- formation that is disorganized, created and then forgotten, cast aside and left to rot. It is the cost of information that cannot be brought to market. Organizations that realize this, and invest in managing and leveraging their unstructured information, will be the winners of the next decade.
Most organizations own vast pools of information that is effectively “dark”: They do not know what it is, where it is, who is responsible for managing it, or whether it is an asset or a liability. It is not classifi ed, indexed, or managed according to the or- ganization’s own policies. It sits in shared drives, mobile devices, abandoned content systems, single-purpose cloud repositories, legacy systems, and outdated archives.
And when the light is fi nally fl icked on for the fi rst time by an intensive hunt for information during e-discovery, this dark information can turn out to be a liability. An e-mail message about “paying off fat people who are a little afraid of some silly lung problem” might seem innocent—until it is placed in front of a jury as evidence that a drug company did not care that its diet drug was allegedly killing people. 2
The importance of understanding the total cost of owning unstructured informa- tion is growing. We are at the beginning of a “seismic economic shift” in the informa- tion landscape, one that promises to not only “reinvent society,” (according to an MIT data scientist) but also to create “the new oil . . . a new asset class touching all aspects of society.” 3
Big Data Opportunities and Challenges
We are entering the epoch of Big Data—an era of Internet-scale enterprise infrastruc- ture, powerful analytical tools, and massive data sets from which we can potentially wring profound new insights about business, society, and ourselves. It is an epoch that, according to the consulting fi rm McKinsey, promises to save the European Union public sector billions of euros, increase retailer margins by 60 percent, and reduce U.S. national health care spending by 8 percent, while creating hundreds of thousands of jobs. 4 Sounds great, right?
However, the early days of this epoch are unfolding in almost total ignorance of the true cost of information. In the near nirvana contemplated by some Big Data
Smart leaders across industries will see using big data for what it is: a manage- ment revolution.
—Andrew McAfee and Erik Brynjolfsson, “Big Data: The Management Revolution,” Harvard Business Review ” (October 2012)
BUSINESS CONSIDERATIONS FOR A SUCCESSFUL IG PROGRAM 101
c07 101 February 28, 2014 11:44 AM
proponents, all data is good, and more data is better . Yet it would be an exaggeration to r say that there is no awareness of potential Big Data downsides. A recent study by the Pew Research Center was positive overall but did note concerns about privacy, social control, misinformation, civil rights abuses, and the possibility of simply being over- whelmed by the deluge of information. 5
But the real-world burdens of managing, protecting, searching, classifying, retain- ing, producing, and migrating unstructured information are foreign to many Big Data cheerleaders. This may be because the Big Data hype cycle 6 is not yet in the “trough of disillusionment” where the reality of corporate culture and complex legal require- ments sets in. But set in it will, and when it does, the demand for intelligent analysis of costs and benefi ts will be high.
IG professionals must be ready for these new challenges and opportunities—ready with new models for thinking about unstructured information. Models that calculate the risks of keeping too much of the wrong information as well as the s benefi ts of clean,s reliable, and accessible pools of the right information. Models that drive desirable behavior in the enterprise, and position organizations to succeed on the “next frontier for innovation, competition, and productivity.”7
Full Cost Accounting for Information
It is diffi cult for organizations to make educated decisions about unstructured infor- mation without knowing its full cost. Models like total cost of ownership (TCO) and ROI are designed for this purpose and have much in common with full cost account- ing (FCA) models. FCA seeks to create a complete picture of costs that includes past, g future, direct, and indirect costs rather than direct cash outlays alone.
FCA has been used for many purposes, including the decidedly earthbound task of determining what it costs to take out the garbage and the loftier task of calculating how much the International Space Station really costs. A closely related concept, often called triple bottom line, has gained traction in the world of environmental account- ing, positing that organizations must take into account societal and environmental costs as well as monetary costs.
The U.S. Environmental Protection Agency promotes the use of FCA for mu- nicipal waste management, and several states have adopted laws requiring its use. It is fascinating—and no accident—that this accounting model has been widely used to calculate the full cost of managing an unwanted by-product of modern life. The anal- ogy to outdated, duplicate, and unmanaged unstructured information is clear.
Applying the principles of FCA to information can increase cost transparency and drive better management decisions. In municipal garbage systems where citizens do not see a separate bill for taking out the garbage, it is more diffi cult to get new
IG professionals must be ready with new models that calculate the risks of stor- ing too much of the wrong information and also the benefi ts of clean, reliable, accessible information.
102 INFORMATION GOVERNANCE
c07 102 February 28, 2014 11:44 AM
spending on waste management approved. 8 Without visibility into the true cost, how can citizens—or CEOs—make informed decisions?
Responsible, innovative managers and executives should investigate FCA models for calculating the total cost of owning unstructured information. Consider costs such as:
■ General and administrative costs, such as cost of IT operations and personnel, facilities, and technical support.
■ Productivity gains or losses related to the information. s ■ Legal and e-discovery costs associated with the information and information systems. y ■ Indirect costs, such as the accounting, billing, clerical support, contract manage-
ment, insurance, payroll, purchasing, and so on. ■ Up-front costs, such as the acquisition of the system, integration and confi gura-
tion, and training. This should include the depreciation of capital outlays. ■ Future costs, such as maintenance, migration, and decommissioning of informa-
tion systems. Future outlays should be amortized.
Calculating the Cost of Owning Unstructured Information
Any system designed to calculate the cost or benefi t of a business strategy is inher- ently political. That is, it is an argument designed to convince an t audience. Well-known models like TCO and ROI are primarily decision tools designed to help organizations predict the economic consequences of a decision. While there are certainly objective truths about the information environment, human decision making is a complex and imperfect process. There are plenty of excellent guides on how to create a standard TCO or ROI. That is not our purpose here. Rather, we want to inspire creative think- ing about how to calculate the cost of owning unstructured information and help or- ganizations minimize the risk—and maximize the value—of unstructured information.
Any economic model for calculating the cost of unstructured information depends on reliable facts. But facts can be hard to come by. A client recently went in search of an accurate number for the annual cost per terabyte of Tier 1 storage in her company. The company’s storage environment was completely outsourced, leading her to believe that the number would be transparent and easy to fi nd. However, after days spent poring over the massive contract, she was no closer to the truth. Although there was a line item for storage costs, the true costs were buried in “complexity fees” and other opaque terms.
Organizations need tools that help them establish facts about their unstructured information environment. The business case for better management depends on these facts. Look for tools that can help you:
■ Find unstructured information wherever it resides across the enterprise, including s e-mail systems, shared network drives, legacy content management systems, and archives.
Organizations can learn from accounting models used by cities to calculate the total cost of managing municipal waste and apply them to the IG problem.
BUSINESS CONSIDERATIONS FOR A SUCCESSFUL IG PROGRAM 103
c07 103 February 28, 2014 11:44 AM
■ Enable fast and intuitive access to basic metrics , such as size, date of last access,s and fi le type.
■ Provide sophisticated analysis of the nature of the content itself to drive classifi ca-s tion and information life cycle decisions.
■ Deliver visibility into the environment through dashboards that are easy to fors nonspecialists to confi gure and use.
Sources of Cost
Unstructured information is ubiquitous. It is typically not the product of a single-pur- pose business application. It often has no clearly defi ned owner. It is endlessly duplicat- ed and transmitted across the organization. Determining where and how unstructured information generates cost is diffi cult.
However, doing so is possible. Our research shows that at least 10 key factors that s drive the total cost of owning unstructured information. These 10 factors identify where organizations typically spend money throughout the life cycle of managing un- structured information. These factors are listed in Figure 7.1 , along with examples of elements that typically increase cost (“Cost Drivers,” on the left side) and elements that typically reduce costs (“Cost Reducers,” on the right side).
1. E-discovery: fi nding, processing, and producing information to support law- suits, investigations, and audits. Unstructured information is typically the most common target in e-discovery, and a poorly managed information environment can add millions of dollars in cost to large lawsuits. Simply reviewing a gigabyte of information for litigation can cost $14,000 or more. 9
2. Disposition: getting rid of information that no longer has value because it is duplicate, out of date, or has no value to the business. In poorly man- aged information environments, separating the wheat from the chaff can cost large organizations millions of dollars. For enterprises with frequent litigation, the risk of throwing away the wrong piece of information only increases risk and cost. Better management and smart IG tools drive costs down.
3. Classifi cation and organization: keeping unstructured information organized so that employees can use it. It also is necessary so management rules supporting privacy, privilege, confi dentiality, retention, and other requirements can be applied.
4. Digitization and automation. Many business processes continue to be a combi- nation of digital, automated steps and paper-based, manual steps. Automating
Identifying and building consensus on the sources of cost for unstructured information is critical to any TCO or ROI calculation. It is critical that all stake- holders agree on these sources, or they will not incorporate the output of the calculation in their strategy and planning.
104 INFORMATION GOVERNANCE
c07 104 February 28, 2014 11:44 AM
and digitizing these processes requires investment but also can drive signifi - cant returns. For example, studies have shown that automating accounts pay- able “can reduce invoice processing costs by 90 percent.”10
5. Storage and network infrastructure: the cost of the devices, networks, software, and labor required to store unstructured information. Although the cost of the baseline commodity (i.e., a gigabyte of storage space) continues to fall, for most organizations overall volume growth and complexity means that storage budgets go up each year. For example, between 2000 and 2010, organization more than doubled the amount they spent on storage-related software even though the cost of raw hard drive space dropped by almost 100 times. 11
6. Information search, access, and collaboration: the cost of hardware, software, and services designed to ensure that information is available to those who need it, when they need it. This typically includes enterprise content management systems, enterprise search, case management, and the infrastructure necessary to support employee access and use of these systems.
7. Migration: the cost of moving unstructured information from outdated sys- tems to current systems. In poorly managed information environments, the cost of migration can be very high—so high that some organizations maintain legacy systems long after they are no longer supported by the vendor just to avoid (more likely, simply to defer ) the migration cost and complexity.rr
8. Policy management and compliance: the cost of developing, implementing, enforcing, and maintaining IG policies on unstructured information. Good policies, consistently enforced, will drive down the total cost of owning un- structured information.
9. Discovering and structuring business processes: the cost of identifying, improv- ing, and systematizing or “routinizing” business processes that are currently ad hoc and disorganized. Typical examples include contract management and
Cost Drivers: Examples
Outdoted, unenforced policies
Poorly defined information ownership and governance
Open loop, reactive e-discovery processes
Uncontrolled information respositiories
Modernist, paper-focused information rules
Ad hoc, unstructured business processes
Disconnected governance programs
Formal, communicated, and enforced policies
Automated classification and organization
Defensible deletion and selective content migration
Data maps
Proactive, repeatable e-discovery procedures
Clear corporate governance
Managed and structured repositories
Cost Reducers: Examples
1
2
3
4
5
6
7
8
9
10
E-Discovery
Disposition
Classification and Organization
Digitization and Automation
Storage and Network Infrastructure
Information Search, Access, Collaboration
Migration
Policy Management and Compliance
Discovering and Structuring Business Processes
Knowledge Capture and Transfer
Figure 7.1 Key Factors Driving Cost Source: Barclay T. Blair
BUSINESS CONSIDERATIONS FOR A SUCCESSFUL IG PROGRAM 105
c07 105 February 28, 2014 11:44 AM
accounts receivable as well as revenue-related activities, such as sales and cus- tomer support. Moving from informal e-mail and document-based processes to fi xed work fl ows drives down cost.
10. Knowledge capture and transfer: the cost of capturing critical business knowl- edge held at the department and employee level and putting that information in a form that enables other employees and parts of the organization to ben- efi t from it. Examples include intranets and their more contemporary cousins such as wikis, blogs, and enterprise social media platforms.
The Path to Information Value
At its peak during World War II, the Brooklyn Navy Yard had 70,000 people coming to work every day. The site was once America’s premier shipbuilding facility, build- ing the steam-powered Ohio in 1820 and the aircraft carrier USS Independence in the 1950s. But the site fell apart after it was decommissioned in the 1960s. Today, an “Admiral’s Row” of Second Empire–style mansions once occupied by naval offi cers are an extraordinary sight, with gnarled oak trees pushing through the rotting mansard roofs. 12
Seventy percent of managers and executives say data are “extremely impor- tant” for creating competitive advantage. “The key, of course, is knowing which data matter, who within a company needs them, and fi nding ways to get that data into users’ hands.”
— The Economist Intelligence Unit, “Levelling the Playing Field: How Companies Use Data to Create Advantage” (January 2011)
However, after decades of decay, the Navy Yard is being reborn as the home of YY hundreds of businesses—from major movie studios to artisanal whisky makers—taking advantage of abundant space and a desirable location. There were three phases in the yard’s rebirth:
1. Clean. Survey the site to determine what had value and what did not. Dispose of toxic waste and rotting buildings, and modernize the infrastructure.
2. Build and maintain. Implement a plan to continuously improve, upgrade, and maintain the facility.
3. Monetize. Lease the space.
Most organizations face a similar problem. However, our Navy Yards are the vast YY piles of unstructured information that were created with little thought to how and when the pile might go away. They are records management programs built for a dif- ferent era—like an automobile with a metal dashboard, six ashtrays, and no seat belts. Our Navy Yards are information environments no longer fi t for purpose in the Big YY Data era, overwhelmed by volume and complexity.
We are doing a bad job at managing information. McKinsey estimates that in some circumstances, companies are using up to 80 percent of their infrastructure to store duplicate data.13 Nearly half of respondents in a survey ViaLumina recently conducted
106 INFORMATION GOVERNANCE
c07 106 February 28, 2014 11:44 AM
said that at least 50 percent of the information in their organization is duplicate, out- dated, or unnecessary. 14 We can do better.
1. Clean
We should put the Navy Yard’s blueprint to work, fi rst by identifying our piles of rot-YY ting unstructured information. Duplicate information. Information that has not been accessed in years. Information that no longer supports a business process and has little value. Information that we have no legal obligation to keep. The economics of such “defensible deletion” projects can be compelling simply on the basis of recovering the storage space and thus reallocating capital that would have been spent on the annual storage purchase.
2. Build and Maintain
Cleaning up the Navy Yard is only the fi rst step. We cannot repeat the past mistakes.YY We avoid this by building and maintaining an IG program that establishes our infor- mation constitution (why), laws (what), and regulations (how). We need a corporate governance, compliance, and audit plan that gives the program teeth, and a technology infrastructure that makes it real. It must be a defensible program to ensure we comply with the law and manage regulatory risk.
3. Monetize
IG is a means to an end, and that end is value creation. IG also mitigates risk and drives down cost. But extracting value is the key. Although monetization and value creation often are associated with structured data, new tools and techniques create exciting new opportunities for value creation from unstructured information.
For example, what if an organization could use sophisticated analytics on the e- mail account of their top salesperson (the more years of e-mail the better), look for markers of success, then train and hire salespeople based on that template? What is the pattern of a salesperson’s communications with customers and prospects in her territory? What is the substance of the communications? What is the tone? When do successful salespeople communicate? How are the patterns different between suc- cessful deals and failed deals? What knowledge and insight resides in the thousands of messages and gigabytes of content? The tools and techniques of Big Data applied to e-mail can bring powerful business insights. However, we have to know what questions to ask. According to Computerworld , “the hardest part of using big data is trying to get business people to sit down and defi ne what they want out of the huge amount of unstructured and semi-structured data that is available to enterprises these days.”15
Key steps in driving information value are: (1) clean; (2) build and maintain; and (3) monetize.
BUSINESS CONSIDERATIONS FOR A SUCCESSFUL IG PROGRAM 107
c07 107 February 28, 2014 11:44 AM
The analytics challenges of Big Data create opportunities. For example, McKinsey pre- dicts that demand for “deep analytical talent in the United States could be 50 to 60 percent greater than its projected supply by 2018.” A chief reason for this gap is that “this type of talent is diffi cult to produce, taking years of training in the case of some- one with intrinsic mathematical abilities.” However, the more profound opportunity is for the “1.5 million extra additional managers and analysts in the United States who can ask the right questions and consume the results of the analysis of big data effectively.” 16
Some companies are using analytics to set prices. For example, the largest dis- tributor of heating oil in the United States sets prices on the fl y, based on commodity prices and customer retention risks. 17 In a case that caught the attention of morning news shows, with breathless headlines like “Are Mac Users Paying More?” an online travel company revealed that “Mac users are 40 percent more likely to book four or fi ve-star hotels . . . compared to PC users.”18 Despite the headlines, the company was not charging Mac users more. Rather, computer brand was a variable used to deter- mine which products were highlighted.
The path to information value is not necessarily linear. Different parts of your business may achieve maturity at different rates, driven by the unique risks and op- portunities of the information they possess.
Challenging the Culture
The best models for calculating the total cost of owning unstructured are those that information professionals can use to challenge and change organizational culture. Much of the unstructured information that represents the greatest cost and risk to organizations is created, communicated, and managed directly by employees—that is, by human beings. As such, better IG relies in part on improving the way those human beings use and manage information.
New Information Models
The “information calorie” and “information cap-and-trade,” explored next, are two new models designed to help with the challenge of governing information.
Table 7.1 Key Steps in the IG Process
1. Clean 2. Build and Maintain 3. Monetize
Information inventory IG policies and procedures Create value through information, e.g., drive sales and improve customer satisfaction
Defensible deletion Corporate governance, compliance and audit
Business insights
Records retention and legal hold Technology Increase margins
Source: Barclay T. Blair
108 INFORMATION GOVERNANCE
c07 108 February 28, 2014 11:44 AM
Information Calorie
The Western world is suffering from an embarrassment of riches when it comes to calories. The calorie has been weaponized in the form of tasty, cheap, and fast food loaded with sugar and fat. Even a cup of “coffee” can contain as much as 800 calories.19 We have gotten very, very good at maximizing available calories, at a staggering cost: $190 billion per year in additional medical spending as a result of obesity in the United States, greater than the cost of smoking. 20
Governments are taking action. A new national health care law in the United States requires restaurant chains to disclose calorie counts for the food they sell by 2013, building on similar state laws.21 Calories are not inherently bad. We would liter- ally die without them. But too many calories make us sick.
The analogy to information is clear. Information is the “lifeblood” of our organi- zations and is central to our survival. But too much unmanaged unstructured informa- tion leaves us fat, slow, and coughing and wheezing at the back of the pack.
In 2012, New York City initially passed a controversial law limiting the size of soft drinks that can be sold at movie theaters and convenience stores (later chal- lenged in court). The “Bloomberg soda ban” was based on the premise that humans need help making good choices. There is some basis for this approach, with studies showing that, for example, the size of the candy scoop determines how much free candy we eat.22 Under the new law, it was still possible in New York to buy two smaller cups of soda, but it was hoped that inconvenience (and cost) will reduce overconsumption.
A new study . . . examined consumer behavior before and after calorie counts were posted, and determined that when restaurants post calories on menu boards, there is a reduction in calories per transaction.
—Bryan Bollinger, Phillip Leslie, Alan Sorensen, “Calorie Posting in Chain Restaurants,” Stanford University, January 2010
Thinking about information as calories at your organization can improve aware- ness of its costs and drive change. The goal is not to add friction to desirable behaviors, like collaboration and mobile work, but rather to make it more diffi cult to create and consume empty information calories.
Here are some tips to get started:
■ Educate executives and employees about the cost of information mismanagement s through anecdotes, case studies, and facts.
■ Show employees their information footprint by regularly exposing them to the t amount of data storage they are using in e-mail, shared drives, content man- agement systems, and other environments they work with. With a little creative programming, you can post “information calories” on your menus.
■ Design systems to minimize information calories. Examples include: preventing employees from exporting e-mail to .pst fi les; turning off the ability to store documents on desktop hard drives to encourage the use of managed collabo- ration environment; and requiring employees to send links to shared content rather than creating yet another e-mail attachment. Clever technology and social engineering, like the soda ban, can drive healthy information behavior.
BUSINESS CONSIDERATIONS FOR A SUCCESSFUL IG PROGRAM 109
c07 109 February 28, 2014 11:44 AM
Information Cap-and-Trade
Originally designed as a regulatory approach for fi ghting acid rain in the 1980s, cap-and-trade has gained new attention as a method of curbing carbon emissions. Cap-and-trade systems differ from command-and-control regulatory approaches that mandate, rather than economically encourage, a course of action. In other words, rather than forcing companies to install scrubbers on power plant exhausts (command and control), cap-and-trade provides companies with an emissions quota, which they can hit as they see fi t, and even profi t from. Companies with unused room on their quota can sell those “credits” on specialized markets.
Consider a cap-and-trade system for information. Do not limit the creation and storage of useful information—that defeats the purpose of investing in IT in the fi rst l place. Rather, design a cap-and-trade system that controls the amount of information pollution and rewards innovation and management discipline.
While there is no objective “right amount” of information for every organization or department, we can certainly do better than “as much as you want, junk or not.” After all, “nearly all sectors in the US economy had at least an average of 200 terabytes of stored data . . . and many sectors had more than 1 petabyte in mean stored data per company.” 23 Moreover, up to 50 percent of that information is easily identifi able as data pollution. 24 So, we have a reasonable starting point.
Here are some tips for creating an information cap-and-trade system:
■ Baseline the desired amount of information per system, department, and/or type t of user. How much information do you currently have? How much has value? How much should you have? These are not easy questions to answer, but even rough calculations can make a big difference.
■ Create information volume targets or quotas, and allocate them by business unit, system, or user. This is the “cap” part of the system.
■ Calculate the fully loaded cost of a unit of information , and adopt it as a baseline metric for the “trade” part of the system. Consider whether annual e-discovery costs can be allocated to this unit in a reasonable way.
■ Create an internal accounting system for tracking and trading information units, s or credits within the organization. Innovative departments will be rewarded, laggards will be motivated.
■ Get creative in what the credits can purchase. New revenue-generating software? Headcount?
“There’s not a person in a business anywhere who gets up in the morning and says, ‘Gee, I want to race into the offi ce to follow some regulation.’ On the other hand, if you say, ‘There’s an upside potential here, you’re going to make money,’ people do get up early and do drive hard around the possibility of fi nding themselves winners on this.”
—Dan Etsy, environmental policy professor at Yale University, quoted in Richard Conniff, “The Political History of Cap and Trade,”
Smithsonian Magazine (August 2009)
110 INFORMATION GOVERNANCE
c07 110 February 28, 2014 11:44 AM
Future State: What Will the IG-Enabled Organization Look Like?
When an organization is IG enabled, or “IG mature”—meaning IG is infused into op- erations throughout the enterprise and coordinated on an organization-wide level—it will look signifi cantly different from most organizations today. Not only will the or- ganization have a solid handle on the total cost of information; not only will it have shifted resources to capitalize on the opportunities of Big Data; not only will it be managing the deluge in a systematic, business-oriented way by cutting out data debris and leveraging information value; it will also look signifi cantly different in key opera- tional areas including legal, records and information management (RIM), and IT.
In legal matters, the mature IG-enabled organization will be better suited to ad- dress litigation in a more effi cient way through a standardized legal hold notifi cation (LHN) process. Legal risk is reduced through improved IG, which will manage infor- mation privacy in accordance with applicable laws and regulations. During litigation, your legal team will be able to sort through information more rapidly and effi ciently, improving your legal posture, cutting e-discovery costs, and allowing for attorney time to be focused on strategy and to zero in on key issues. This means attorneys should have the technology tools to be more effective. Adherence to retention schedules means that records and documents can be discarded at the earliest possible time, which reduces the chances that some information could pose a legal risk. Hard costs can be saved by eliminating that approximately 69 percent of stored information that no lon- ger has business value. That cost savings may be the primary rationale for the initial IG program effort. By leveraging advanced technologies such as predictive coding, the organization can reduce the costs of e-discovery and better utilize attorney time.
Your RIM functions will operate with more effi ciency and in compliance with laws and regulations. Appropriate retention periods will be applied and enforced, and authentic, original copies of business records will be easily identifi able, so that manag- ers are using current and accurate information on which to base their decisions. Over the long term, valuable information from projects, product development, marketing programs, and strategic initiatives will be retained in corporate memory, reducing the impact of turnover and providing distilled information and knowledge to contribute to a knowledge management (KM) program. KM programs can facilitate innovation int organizations, as a knowledge base is built, retained, expanded, and leveraged.
In your IT operations, a focus on how IT can contribute to business objectives will bring about a new perspective. Using more of a business lens to view IT projects will help IT to contribute toward the achievement of business objectives. IT will be work- ing more closely with legal, RIM, risk, and other business units, which should help these groups to have their needs and issues better addressed by IT solutions. Having a standardized data governance program in place means cleaning up corrupted or dupli- cated data and providing users with clean, accurate data as a basis for line-of-business software applications and for decision support analytics in business intelligence (BI) applications. Better data is the basis for improved insights, which can be gained by leveraging BI and will improve management decision-making capabilities and help to provide better customer service, which can impact customer retention. It costs a lot more to gain a new customer than to retain an existing one, and with better data quality, the opportunities to cross-sell and upsell customers are improved. This can provide a sustainable competitive advantage. Standardizing the use of business terms will facilitate improved communications between IT and other business units, which
BUSINESS CONSIDERATIONS FOR A SUCCESSFUL IG PROGRAM 111
c07 111 February 28, 2014 11:44 AM
should lead to improved software applications that address user needs. Adhering to information life cycle management principles will help the organization to apply the proper level of IT resources to its high-value information while decreasing costs by managing information of declining value appropriately. IT effectiveness and effi ciency will be improved by using IT frameworks and standards, such as CobiT 5 and ISO/ IEC 38500:2008, the international standard that provides high-level principles and guidance for senior executives and directors, and those advising them, for the effec- tive and effi cient governance of IT. 25 Implementing a master data management pro- gram will help larger organizations with complex IT operations to ensure that they are working with consistent data from a single source. Improved database security through data masking, database activity monitoring, database auditing, and other tools will help guard the organization’s critical databases against the risk of rogue attacks by hackers. Deploying document life cycle security tools such as data loss prevention and informa- tion rights management will help secure your confi dential information assets and keep them from prying eyes. This helps to secure the organization’s competitive position and protect its valuable intellectual property.
By securing your electronic documents and data, not only within the organization but also for mobile use, and by monitoring and complying with applicable privacy laws, your confi dential information assets will be safeguarded, your brand will be bet- ter protected, and your employees will be able to be productive without sacrifi cing the security of your information assets.
Moving Forward
We are not very good at fi guring out what unstructured information costs. The Big Data deluge is upon us. If we hope to manage—and, more important, to monetize— this deluge, we must form cross-functional teams and challenge the way our organi- zations think about unstructured information. The fi rst and most important step is developing the ability to convincingly calculate what unstructured information really costs and then to discover ways we can recue those costs and drive value. These are foundational skills for information professionals in the new era of Big Data. In this era, information is currency—but a currency that has value only when IG professionals drive innovation and management rigor in the unstructured information environment.
CHAPTER SUMMARY: KEY POINTS
■ The business case for IG programs has historically been diffi cult to justify.
■ It takes a commitment to the long view to develop a successful IG program.
■ The problem of unstructured IG is growing faster than the problem of data volume itself.
■ IG professionals must be ready with new models that calculate the risks of storing too much of the wrong information and also the benefi ts of clean, reliable, accessible information.
(continued)dd
112 INFORMATION GOVERNANCE
c07 112 February 28, 2014 11:44 AM
■ Key steps in driving information value are: (1) clean; (2) build and maintain; and (3) monetize.
■ The information calorie approach and information cap-and-trade are two new models for assisting in IG.
■ Legal risk is reduced through improved IG, and legal costs are reduced.
■ Leveraging newer technologies like predictive coding can improve the ef- fi ciency of legal teams.
■ Adherence to retention schedules means that records and documents can be discarded at the earliest possible time, which reduces costs by eliminating unneeded information that no longer has business value.
■ RIM functions will operate with more effi ciency and in compliance with laws and regulations under a successful IG program.
■ A compliant RIM program helps to build the organization’s corporate memo- ry of essential “lessons learned,” which can foster a KM program.
■ KM programs can facilitate innovation in organizations.
■ Focusing on business impact and customizing your IG approach to meet business objectives are key best practices for IG in the IT department.
■ Effective data governance can yield bottom-line benefi ts derived from new insights, especially with the use of business intelligence software.
■ IT governance seeks to align business objectives with IT strategy to deliver business value.
■ Using IT frameworks like CobiT 5 can improve the ability of senior manage- ment to monitor IT value and processes.
■ Identifying sensitive information in your databases and implementing data- base security best practices help reduce organizational risk and the cost of compliance.
■ By securing your electronic documents and data, your information assets will be safeguarded and your organization can more easily comply with privacy laws and regulations.
■ We are not very good at fi guring out what unstructured information costs. To thrive in the era of Big Data requires challenging the way we think about the cost of managing unstructured information.
CHAPTER SUMMARY: KEY POINTS (Continued )
BUSINESS CONSIDERATIONS FOR A SUCCESSFUL IG PROGRAM 113
c07 113 February 28, 2014 11:44 AM
Notes
1. International Data Corporation, “The 2011 Digital Universe Study,” June 2011. www.emc.com/ leadership/programs/digital-universe.htm (accessed November 25, 2013).
2. Richard B. Schmidt, “The Cyber Suit: How Computers Aided Lawyers In Diet-Pill Case,” Wall Street Journal , October 8, 1999. http://webreprints.djreprints.com/00000000000000000012559001.htmll
3. Nick Bilton, “At Davos, Discussions of a Global Data Deluge,” New York Times , January 25, 2012,s http://bits.blogs.nytimes.com/2012/01/25/at-davos-discussions-of-a-global-data-deluge/; Alex Pent- land, quoted by Edge.org in “Reinventing Society in the Wake of Big Data,” August 8, 2012, www .edge.org/conversation/reinventing-society-in-the-wake-of-big-data; World Economic Forum, “Per- sonal Data: The Emergence of a New Asset Class” (January 2011), http://www3.weforum.org/docs/ WEF_ITTC_PersonalDataNewAsset_Report_2011.pdf
4. James Manyika et al., “Big Data: The Next Frontier for Innovation, Competitions, and Productivity,” McKinsey Global Institute, May 2011, www.mckinsey.com/insights/business_technology/big_data_ the_next_frontier_for_innovation
5. Janna Quitney Anderson and Lee Ranie, “Future of the Internet: Big Data,” Pew Internet and American Life Project, July 20, 2012, http://pewinternet.org/~/media//Files/Reports/2012/PIP_Future_of_ Internet_2012_Big_Data.pdf
6. Louis Columbus, “Roundup of Big Data Forecasts and Market Estimates, 2012,” Forbes , August 16, s 2012, www.forbes.com/sites/louiscolumbus/2012/08/16/roundup-of-big-data-forecasts-and-market- estimates-2012/
7. McKinsey Global Institute, “Big Data: The Next Frontier for Innovation, Competitions, and produc- tivity,” May 2011.
8. U.S. EPA, “Making Solid Waste Decisions with Full Cost Accounting,” n.d., www.epa.gov/osw/ conserve/tools/fca/docs/primer.pdf (accessed November 25, 2013).
9. Nicholas M. Pace and Laura Zakaras, “Where the Money Goes: Understanding Litigant Expenditures for Producing Electronic Discovery,” RAND Institute for Civil Justice, 2012. www.rand.org/content/ dam/rand/pubs/monographs/2012/RAND_MG1208.pdf (accessed November 25, 2013).
10. Accounts Payable Network, “A Detailed Guide to Imaging and Workfl ow ROI,” 2010. 11. Various sources. See, for example: Barclay T. Blair, “Today’s PowerPoint Slide: The Origins of Informa-
tion Governance by the Numbers,” October 28, 2010. http://barclaytblair.com/origins-of-information- governance-powerpoint/ (accessed November 25, 2013).
12. Brooklyn Navy Yard Development Corporation, “The History of Brooklyn Navy Yard,” www .brooklynnavyyard.org/history.html (accessed November 25, 2013).
13. James Manyika et al., “Big Data.” 14. Barclay Blair and Barry Murphy, “Defi ning Information Governance: Theory or Action? Results of the
2011 Information Governance Survey,” ViaLumina, eDiscovery Journal (September 2011).l 15. Jaikumar Vijayan, “Finding the Business Value in Big Data Is a Big Problem,” Computerworld , Septemberd
12, 2012, www.computerworld.com/s/article/9231224/Finding_the_business_value_in_big_data_is_a_ big_problem
16. James Manyika et al., “Big Data.” 17. Economist Intelligence Unit, “Leveling the Playing Field: How Companies Use Data to Create
Advantage” (January 2011), http://blogs.sap.com/wp-content/blogs.dir/15/fi les/2012/02/EIU_ Levelling_The_Playing_Field_1.pdf
18. Genevieve Shaw Brown, “Mac Users My See Pricier Options on Orbitz,” ABC Good Morn- ing America , June 25, 2012, http://abcnews.go.com/Travel/mac-users-higher-hotel-prices-orbitz/ story?id=16650014#.UDlkVBqe7oV
19. “Health Care Bill Requires Calories on Menus at Chain Restaurants,” USA Today , March 23, 2010, http://usatoday30.usatoday.com/news/health/weightloss/2010-03-23-calories-menus_N.htm
20. Sharon Beley, “As America’s Waistline Expands, Cost Soar,” Reuters, April 30, 2012, www.reuters .com/article/2012/04/30/us-obesity-idUSBRE83T0C820120430
21. Stephanie Rosenbloom, “Calorie Data to Be Posted at Most Chains,” New York Times , March 23, 2010,s www.nytimes.com/2010/03/24/business/24menu.html
22. James Surowiecki, “Downsizing Supersize,” New Yorker , August 13, 2012, www.newyorker.com/talk/r fi nancial/2012/08/13/120813ta_talk_surowiecki
23. Manyika et al., “Big Data.” 24. Blair and Murphy, “Defi ning Information Governance.” 25. International Organization for Standardization, ISO/IEC 38500:2008, Corporate governance of infor-
mation technology. www.iso.org/iso/catalogue_detail?csnumber=51639 (accessed November 25, 2013).
115
c08 115 February 28, 2014 11:57 AM
By Robert Smallwood with Randy Kahn, Esq. , and Barry Murphy
Information Governance and Legal Functions
C H A P T E R 8
P erhaps the key functional area that information governance (IG) impacts most is legal functions, since legal requirements are paramount. Failure to meet them can literally put an organization out of business or land executives in prison. Privacy,
security, records management, information technology (IT), and business manage- ment functions are important—very important—but the most signifi cant aspect of all of these functions relates to legality and regulatory compliance.
Key legal processes include electronic discovery (e-discovery) readiness and as- sociated business processes, information and record retention policies, the legal hold notifi cation (LHN) process, and legally defensible disposition practices.
Some newer technologies have become viable to assist organizations in imple- menting their IG efforts, namely, predictive coding and g technology-assisted review (TAR; also known as computer-assisted review ). In this chapter we explore the need ww for leveraging IT in IG efforts aimed at defensible disposition, the intersection be- tween IG processes and legal functions, policy implications, and some key enabling technologies.
Introduction to e-Discovery: The Revised 2006 Federal Rules of Civil Procedure Changed Everything
Since 1938, the Federal Rules of Civil Procedure (FRCP) “have governed the discovery of evidence in lawsuits and other civil cases.” 1 In law, discovery is an early y phase of civil litigation where plaintiffs and defendants investigate and exchange evidence and testimony to better understand the facts of a case and to make early determinations of the strength of arguments on either side. Each side must produce evidence requested by the opposition or show the court why it is unreasonable to pro- duce the information.
The FRCP apply to U.S. district courts, which are the trial courts of the fed- eral court system. The district courts have jurisdiction (within limits set by Congress and the Constitution) to hear nearly all categories of federal cases, including civil and criminal matters. 2
Information Governance: Concepts, Strategies and Best Practices By Robert F. Smallwood Copyright © 2014 by Robert F. Smallwood
116 INFORMATION GOVERNANCE
c08 116 February 28, 2014 11:57 AM
The FRCP were amended in 2006, and some of the revisions apply specifi cally to the preservation and discovery of electronic records in the litigation process. 3 These changes were a long time coming, refl ecting the lag between the state of technology and the courts’ ability to catch up to the realities of electronically generated and stored information.
After years of applying traditional paper-based discovery rules to e-discovery, amendments to the FRCP were made to accommodate the modern practice of discov- ery of electronically stored information (ESI). ESI is any information that is created or stored in electronic format. The goal of the 2006 FRCP amendments was to recog- nize the importance of ESI and to respond to the increasingly prohibitive costs of document review and protection of privileged documents. These amendments rein- forced the importance of IG policies, processes, and controls in the handling of ESI. 4 Organizations must produce requested ESI reasonably quickly, and failure to do so, or failure to do so within the prescribed time frame, can result in sanctions. This require- ment dictates that organizations put in place IG policies and procedures to be able to produce ESI accurately and in a timely fashion. 5
All types of litigation are covered under the FRCP, and all types of e-documents— most especially e-mail—are included, which can be created, accessed, or stored in a wide variety of methods, and on a wide variety of devices beyond hard drives. The FRCP apply to ESI held on all types of storage and communications devices: thumb drives, CDs/DVDs, smartphones, tablets, personal digital assistants (PDAs), personal computers, servers, zip drives, fl oppy disks, backup tapes, and other storage media. ESI content can include information from e-mail, reports, blogs, social media posts (e.g., Twitter posts), voicemails, wikis, websites (internal and external), word processing documents, and spreadsheets, and includes the metadata associated with the content itself, which provides descriptive information. 6
Under the FRCP amendments, corporations must proactively manage the e-discovery process to avoid sanctions, unfavorable rulings, and a loss of public trust. Corporations must be prepared for early discussions on e-discovery with all depart- ments. Topics should include the form of production of ESI and the methods for pres- ervation of information. Records management and IT departments must have made available all relevant ESI for attorney review. 7
This new era of ESI preservation and production demands the need for cross- functional collaboration: records management, IT, and legal teams particularly need to work closely together. Legal teams, with assistance and input of records management staff, must identify relevant ESI, and IT teams must be mindful of preserving and pro- tecting the ESI to maintain its legal integrity and prove its authenticity.
Legal functions are the most important area of IG impact.
ESI is any information that is created or stored in electronic format.
INFORMATION GOVERNANCE AND LEGAL FUNCTIONS 117
c08 117 February 28, 2014 11:57 AM
Big Data Impact
Now throw in the Big Data effect: The average employee creates roughly one giga- byte of data annually (and growing), and data volumes are expected to increase over the next decade not 10-fold, or even 20-fold, but as much as 40 to 50 times what it is today! 8 This underscores the fact that organizations must meet legal requirements while paring down the mountain of data debris they are holding to reduce costs and potential liabilities hidden in that monstrous amount of information. There are also costs associated with dark data— unknown or useless data, such as old log fi les, that takes up space and continues to grow and needs to be cleaned up.
Some data is important and relevant, but distinctions must be made by IG policy to classify, prioritize, and schedule data for disposition and to dispose of the majority of it in a systematic, legally defensible way. If organizations do not accomplish these critical IG tasks they will be overburdened with storage and data handling costs and will be unable to meet legal obligations.
According to a recent survey, approximately 25 percent of information stored in organizations has real business value, while 5 percent must be kept as business records and about 1 percent is retained due to a litigation hold. 9 “This means that [about] 69 per- cent of information in most companies has no business, legal, or regulatory value. Companies that are able to [identify and] dispose of this debris return more profi t to sharehold- ers, can use more of their IT budgets for strategic investments, and can avoid excess expense in legal and regulatory response” (emphasis added).
If organizations are not able to draw clear distinctions between that roughly 30 percent of “high-value” business data, records, and that which is on legal hold, their IT department are tasked with the impossible job of managing all data as if it is high value. This “overmanaging” of information is a signifi cant waste of IT resources. 10
More Details on the Revised FRCP Rules
Here we present a synopsis of the key points in FRCP rules that apply to e-discovery.
FRCP 1—Scope and Purpose. This rule is simple and clear; its aim is to “secure the just, speedy, and inexpensive determination of every action.”11 Your discovery effort and responses must be executed in a timely manner.
The amended FRCP reinforce the importance of IG. Only about 25 percent of business information has real value, and 5 percent are business records.
The goal of the FRCP amendments is to recognize the importance of ESI and to respond to the increasingly prohibitive costs of document review and pro- tection of privileged documents.
118 INFORMATION GOVERNANCE
c08 118 February 28, 2014 11:57 AM
FRCP 16—Pretrial Conferences; Scheduling; Management . This rule provides guide-t lines for preparing for and managing the e-discovery process; the court expects IT and network literacy on both sides, so that pretrial conferences regarding discoverable evidence are productive.
FRCP 26—Duty to Disclose; General Provisions Governing Discovery. This rule pro- tects litigants from costly and burdensome discovery requests, given certain guidelines.
FRCP 26(a)(1)(C): Requires that you make initial disclosures no later than 14 days after the Rule 26(f) meet and confer, unless an objection or another time is set by stipulation or court order. If you have an objection, now is the time to voice it.
Rule 26(b)(2)(B): Introduced the concept of not reasonably accessible ESI. The concept of not reasonably accessible paper had not existed. This rule pro-r vides procedures for shifting the cost of accessing not reasonably accessible ESI to the requesting party.
FRCP 26(b)(5)(B): Gives courts a clear procedure for settling claims when you hand over ESI to the requesting party that you shouldn’t have.
Rule 26(f): This is the meet and confer rule. This rule requires all par- ties to meet within 99 days of the lawsuit’s fi ling and at least 21 days before a scheduled conference.
Rule 26(g): Requires an attorney to sign every e-discovery request, re- sponse, or objection.
FRCP 33—Interrogatories to Parties . This rule provides a defi nition of business e-s records that are discoverable and the right of opposing parties to request and access them.
FRCP 34—Producing Documents, Electronically Stored Information, and Tangible Things, or Entering onto Land, for Inspection and Other Purposes . In disputes overs document production, this rule outlines ways to resolve and move forward. Specifi cally, FRCP 34(b) addresses the format for requests and requires that e-records be accessible without undue diffi culty (i.e., the records must be orga- nized and identifi ed). The requesting party chooses the preferred format, which are usually native fi les (which also should contain metadata). The key point is that electronic fi les must be accessible, readable, and in a standard format.
FRCP 37—Sanctions . Rule 37(e) is known as the safe harbor rule. In principle, it s keeps the court from imposing sanctions when ESI is damaged or lost through routine, “good faith” operations, although this has proven to be a high standard to meet. This rule underscores the need for a legally defensible document man- agement program under the umbrella of clear IG policies.
The Big Data trend underscores the need for defensible deletion of data debris.
INFORMATION GOVERNANCE AND LEGAL FUNCTIONS 119
c08 119 February 28, 2014 11:57 AM
Landmark E-Discovery Case: Zubulake v. UBS Warburg
A landmark case in e-discovery arose from the opinions rendered in Zubulake v. U.B.S. Warburg , an employment discrimination case where the plaintiff, Laura Zubulake, g sought access to e-mail messages involving or naming her. Although UBS produced over 100 pages of evidence, it was shown that employees intentionally deleted some relevant e-mail messages. 12 The plaintiffs requested copies of e-mail from backup tapes, and the defendants refused to provide them, claiming it would be too expensive and burdensome to do so.
The judge ruled that U.B.S. had not taken proper care in preserving the e-mail evidence, and the judge ordered an adverse inference (assumption that the evidence was damaging) instruction against U.B.S. Ultimately, the jury awarded Zubulake over $29 million in total compensatory and punitive damages. “The court looked at the proportionality test of Rule 26(b)(2) of the Federal Rules of Civil Procedure and applied it to the electronic communication at issue. Any electronic data that is as ac- cessible as other documentation should have traditional discovery rules applied.” 13 Although Zubulake’s award was later overturned on appeal, it is clear the stakes are huge in e-discovery and preservation of ESI.
E-Discovery Techniques
Current e-discovery techniques include online review, e-mail message archive review, and cyberforensics. Any and all other methods of seeking or searching for ESI may be employed in e-discovery. Expect capabilities for searching, retrieving, and translating ESI to improve, expanding the types of ESI that are discoverable. Consider this potential when evaluating and developing ESI management practices and policies.14
E-Discovery Reference Model
The E-Discovery Reference Model is a visual planning tool created by EDRM.net to assist in identifying and clarifying the stages of the e-discovery process. Figure 8.1 is the graphic depiction with accompanying detail on the process steps.
Information Management. Getting your electronic house in order to miti- gate risk and expenses should e-discovery become an issue, from initial cre- ation of electronically stored information through its fi nal disposition
Identifi cation. Locating potential sources of ESI and determining their scope, breadth, and depth
In the landmark case Zubulake v. U.B.S. Warburg , the defendants were severelyg punished by an adverse inference for deleting key e-mails and not producing copies on backup tapes.
120 INFORMATION GOVERNANCE
c08 120 February 28, 2014 11:57 AM
Preservation. Ensuring that ESI is protected against inappropriate altera- tion or destruction
Collection. Gathering ESI for further use in the e-discovery process (pro- cessing, review, etc.)
Processing. Reducing the volume of ESI and converting it, if necessary, to forms more suitable for review and analysis
Review. Evaluating ESI for relevance and privilege Analysis. Evaluating ESI for content and context, including key patterns,
topics, people, and discussion Production. Delivering ESI to others in appropriate forms, and using ap-
propriate delivery mechanisms
SEVEN STEPS OF THE E-DISCOVERY PROCESS
In the e-discovery process, you must perform certain functions for identifying and preserving electronically stored (ESI), and meet requirements regarding conditions such as relevancy and privilege. Typically, you follow this e-disco- very process:
1. Create and retain ESI according to an enforceable electronic records reten- tion policy and electronic records management (ERM) program. Enforce the policy, and monitor compliance with it and the ERM program.
2. Identify the relevant ESI, preserve any so it cannot be altered or destroyed, and collect all ESI for further review.
3. Process and fi lter the ESI to remove the excess and duplicates. You reduce costs by reducing the volume of ESI that moves to the next stage in the e-discovery process.
4. Review and analyze the fi ltered ESI for privilege because privileged ESI is not discoverable, unless some exception kicks in.
5. Produce the remaining ESI, after fi ltering out what’s irrelevant, duplicated, or privileged. Producing ESI in native format is common.
6. Clawback the ESI that you disclosed to the opposing party that you should have fi ltered out, but did not. Clawback is not unusual, but you have to work at getting clawback approved, and the court may deny it.
7. Present at trial if your case hasn’t settled. Judges have little to no patience with lawyers who appear before them not understanding e-discovery and the ESI of their clients or the opposing side.
Source: Linda Volonino and Ian Redpath, e -Discovery for Dummies (Hoboken, NJ: John Wiley s & Sons, 2010), http://www.dummies.com/how-to/content/ediscovery-for-dummies-cheat- sheet.html (accessed May 22, 2013). Used with permission.
INFORMATION GOVERNANCE AND LEGAL FUNCTIONS 121
c08 121 February 28, 2014 11:57 AM
Presentation. Displaying ESI before audiences (at depositions, hearings, trials, etc.), especially in native and near-native forms, to elicit further infor- mation, validate existing facts or positions, or persuade an audience15
The Electronic Discovery Reference Model can assist organizations in focusing and segmenting their efforts when planning e-discovery initiatives.
Guidelines for E-Discovery Planning 1. Implement an IG program. The highest impact area to focus are your legal
processes, particularly e-discovery. From risk assessment to processes, com- munications, training, controls, and auditing, fully implement IG to improve and measure compliance capabilities.
2. Inventory your ESI. File scanning and e-mail archiving software can assist you. You also will want to observe fi les and data fl ows by doing a walk-through beginning with centralized servers in the computer room and moving out into business areas. Then, using a prepared inventory form, you should interview users to fi nd out more detail. Be sure to inventory ESI based on computer systems or applications, and diagram it out.
3. Create and implement a comprehensive records retention policy, and also include an e-mail retention policy and retention schedules for major ESI areas. This is required since all things are potentially discoverable. You must devise a comprehensive retention and disposition policy that is legally defensible.
Figure 8.1 Electronic Discovery Reference Model Source: EDRM (edrm.net)
Information Management
VOLUME RELEVANCE
Identification
Preservation
Processing
Review Production Presentation
Analysis
Electronic Discovery Reference Model/©2009/v2.0/edrm.net
Collection
The E-Discovery Reference Model is in a planning tool that presents key e-discovery process steps.
122 INFORMATION GOVERNANCE
c08 122 February 28, 2014 11:57 AM
So, for instance, if your policy is to destroy all e-mail messages that do not have a legal hold (or are expected to) after 90 days and you apply that policy uniformly, you will be able to defend the practice in court. Also, implementing the retention policy reduces your storage burden and costs while cutting the risk of liability that might be buried in obscure e-mail messages.
4. As an extension of your retention policy, implement a legal hold policy that is enforceable, auditable, and legally defensible. Be sure to include all potentially discoverable ESI XE “litigation:e-discovery”. We discuss legal holds in more depth later in this chapter, but be sure to cast a wide net when developing retention policies so that you include all relevant electronic records, such as e-mail, e-documents and scanned documents, storage discs, and backup tapes.
5. Leverage technology. Bolster your e-discovery planning and execution efforts by deploying enabling technologies, such as e-mail archiving, advanced enter- prise search, TAR, and predictive coding.
6. Develop and execute your e-discovery plan. You may want to begin from this point forward with new cases, and bear in mind that starting small and piloting is usually the best course of action.
The Intersection of IG and E-Discovery
By Barry Murphy
Effective IG programs can alleviate e-discovery headaches by reducing the amount of information to process and review, allowing legal teams to get to the facts of a case quickly and effi ciently, and can even result in better case outcomes. Table 8.1 shows the impact of IG on e-discovery, by function.
Legal Hold Process
The legal hold process is a foundational element of IG.16 The way the legal hold process is supposed to work is that a formal system of polices, processes, and controls is put in place to notify key employees of a civil lawsuit (or impending one) and the set of documents that must put on legal hold. These documents, e-mail messages, and other relevant ESI must be preserved in place and no longer edited or altered so that they may be reviewed by attorneys during the discovery phase of the litigation. But, in prac- tice, this is not always what takes place. In fact, the opposite can take place —employees can quickly edit or even delete relevant e-documents that may raise questions or even
Implementing IG, inventorying ESI, and leveraging technology to implement records retention and LHN policies are key steps in e-discovery planning.
INFORMATION GOVERNANCE AND LEGAL FUNCTIONS 123
c08 123 February 28, 2014 11:57 AM
implicate them. This is possible only if proper IG controls are not in place, monitored, enforced, and audited.
Many organizations start with Legal Hold Notifi cation (LHN) management as a very discrete IG project. LHN management is arguably the absolute minimum an orga- nization should be doing in order to meet the guidelines provided by court rules, com-g mon law, and case law precedent. It is worth noting, though, that the expectation is that organizations should connect the notifi cation process to the actual collection and preservation of information in the long term.
Table 8.1 IG Impact on E-Discovery
Impact Function
Cost reduction Reduce downstream costs of processing and review by defensibly disposing of data according to corporate retention policies
Reduce cost of collection by centralizing collection interface to save time
Keep review costs down by prioritizing documents and assigning to the right level associates (better resource utilization)
Reduce cost of review by culling information with advanced analytics
Risk management Reduce risk of sanctions by managing the process of LHN and the collection and preservation of potentially responsive information
Better litigation win rates Optimize decision making (e.g., settling cases that can’t be won) quickly with advanced analytics that prioritize hot documents
Quickly fi nd the necessary information to win cases with advanced searches and prioritized review
Strategic planning for matters based on merit
Determine the merits of a matter quickly and decide if it is a winnable case
Quickly route prioritized documents to the right reviewers via advanced analytics (e.g., clustering)
Strategic planning for matters based on cost
Quickly determine how much litigation will cost via early access to amount of potentially responsive information and prioritized review to make decisions based on the economics of the matter (e.g., settle for less than the cost of litigation)
Litigation budget optimization Minimize litigation budget by only pursuing winnable cases
Minimize litigation budget by utilizing the lowest cost resources possible while putting high-cost resource on only the necessary documents
Source: Barry Murphy, eDiscovery Journal http://ediscoveryjournal.com/l
LHN management is the absolute minimum an organization should imple- ment to meet the guidelines, rules, and precedents.
124 INFORMATION GOVERNANCE
c08 124 February 28, 2014 11:57 AM
How to Kick-Start Legal Hold Notifi cation
Implementing an LHN program attacks some of the lower-hanging fruit within an or- ganization’s overall IG position. This part of the e-discovery life cycle must not be outsourced. d Retained counsel provides input, but the mechanics of LHN are managed and owned by internal corporate resources.
In preparing for a LHN implementation project, it is important to fi rst lose the perception that LHN tools are expensive and diffi cult to deploy. It is true that some of these tools cost considerably more than others and can be complex to deploy; however, that is because the tools in question go far beyond simple LHN and reach into enter- prise systems and also handle data mapping, collection, and workfl ow processes. Other options include Web-based hosted solutions, custom-developed solutions, or process- es using tools already in the toolbox (e.g., e-mail, spreadsheets, word processing).
The most effective approach involves three basic steps:
1. Defi ne requirements. 2. Defi ne the ideal process. 3. Select the technology.
Defi ning both LHN requirements and processes should include input from key stakeholders—at a minimum—in legal, records management, and IT. Be sure to take into consideration the organization’s litigation profi le, corporate culture, and available resources as part of the requirements and process defi ning exercise. Managing steps 1 and 2 thoroughly makes tool selection easier because defi ning requirements and processes creates the confi dence of knowing exactly what the tool must accomplish.
IG and E-Discovery Readiness
Having a solid IG underpinning means that your organization will be better prepared to respond and execute key tasks when litigation and the e-discovery process proceed. Your policies will have supporting business processes, and clear lines of responsibility and accountability are drawn. The policies must be reviewed and fi ne-tuned periodically, and business processes must be streamlined and continue to aim for improvement over time.
In order for legal hold or defensible deletion (discussed in detail in the next section—disposing of unneeded data, e-documents, and reports based on set policy) projects to deliver the promised benefi t to e-discovery, it is important to avoid the very real roadblocks that exist in most organization. To get the light to turn green at the intersection of e-discovery and IG, it is critical to:
■ Establish a culture that both values information and recognizes the risks inherent in it. Every organization must evolve its culture from one of keeping everything to one of information compliance. This kind of change requires high-level ex- ecutive support. It also requires constant training of employees about how to create, classify, and store information. While this advice may seem trite, many managers in leading organizations say that without this kind of culture change, IG projects tend to be dead on arrival.
■ Create a truly cross-functional IG team. Culture change is not easy, but it can be even harder if the organization does not bring all stakeholders together when setting requirements for IG. Stakeholders include: legal; security and ethics; IT;
INFORMATION GOVERNANCE AND LEGAL FUNCTIONS 125
c08 125 February 28, 2014 11:57 AM
records management; internal audit; corporate governance; human resources; compliance; and business units and employees. That is a lot of stakeholders. In organizations that are successfully launching and executing IG projects, many have dedicated IG teams. Some of those IG teams are the next generation of records management departments, while others are newly formed. The stake- holders can be categorized into three areas: legal/risk, IT, and the business. The IG team can bring those areas together to ensure that any projects meet requirements of all stakeholders.
■ Use e-discovery as an IG proof of concept . Targeted programs like e-discovery,t compliance, and archiving have a history of return on investment (ROI) and an ability to get budget. These projects are also challenging, but more straightforward to implement and can address sub-sets of information in ear- ly phases (e.g., only those information assets that are reasonable to account for). The lessons learned from these targeted projects can then be applied to other IG initiatives.
■ Measure ROI on more than just cost savings . Yes, one of the primary benefi ts of ad-s dressing e-discovery via IG is cost reduction, but it is wise to begin measuring all e-discovery initiatives on how they impact the life cycle of legal matters. The effi ciencies gained in collecting information, for example, have benefi ts that go way beyond reduced cost; the IT time not wasted on reactive collection is more time available for innovative projects that drive revenue for companies. And a better litigation win rate will make any legal team happier.
Building on Legal Hold Programs to Launch Defensible Disposition
By Barry Murphy
Defensible deletion programs can build on legal hold programs, because legal hold management is a necessary fi rst step before defensibly deleting anything. The standard is “reasonable effort” rather than “perfection.” Third-party consultants or auditors can support the diligence and reasonableness of these efforts.
Next, prioritize what information to delete and what information the organiza- tion is capably able to delete in a defensible manner. Very few organizations are deleting information across all systems. It can be overly daunting to try to apply deletion to all en- terprise information. Choosing the most important information sources—e-mail, for example—and attacking those fi rst may make for a reasonable and tenable approach. For most organizations, e-mail is the most common information source to begin deleting. Why e-mail? It is fairly easy for companies to put systematic rules on e-mail because the technology is already available to manage e-mail in a sophisticated manner. Because e-mail is such a critical data system, e-mail providers and e-mail archiving providers early on provided for systematic deletion or application of retention rules. However, in
IG serves as the underpinning for effi cient e-discovery processes.
126 INFORMATION GOVERNANCE
c08 126 February 28, 2014 11:57 AM
non–e-mail systems, the retention and deletion features are less sophisticated; there- fore, organizations do not systematically delete across all systems.
Once e-mail is under control, the organization can begin to apply lessons learned to other information sources and eventually have better IG policies and processes that treat information consistently based on content rather than on the repository.
Destructive Retention of E-mail
A destructive retention program is an approach to e-mail archiving where e-mail messages are retained for a limited time (say, 90 days), followed by the permanent manual or automatic deletion of the messages from the organization network, so long as there is no litigation hold or the e-mail has not been declared a record.
E-mail retention periods can vary from 90 days to as long as seven years:
■ Osterman Research reports that “nearly one-quarter of companies delete e- mail after 90 days.” 17
■ Heavily regulated industries, including energy, technology, communications, and real estate, favor archiving for one year or more, according to Fulbright and Jaworski research.
■ The most common e-mail retention period traditionally has been seven years; however, some organizations are taking a hard-line approach and stating that e-mails will be kept for only 90 days or six months, unless it is declared as a record, classifi ed, and identifi ed with a classifi cation/retention category and tagged or moved to a repository where the integrity of the record is protected (i.e., the record cannot be altered and an audit trail on the history of the re- cord’s usage is maintained).
Newer Technologies That Can Assist in E-Discovery
Few newer technologies are viable for speeding the document review process and im- proving the ability to be responsive to court-mandated requests. Here we introduce pre- dictive coding and technology-assisted review (also known as computer-assisted review), the most signifi cant of new technology developments that can assist in e-discovery.
For most organizations, e-mail is the most common information source to begin deleting according to established retention policies.
Destructive retention of e-mail is a method whereby e-mail messages are re- tained for a limited period and then destroyed.
INFORMATION GOVERNANCE AND LEGAL FUNCTIONS 127
c08 127 February 28, 2014 11:57 AM
Predictive Coding
During the early case assessment (ECA) phase of e-discovery, t predictive coding is ag “court-endorsed process” 18 utilized to perform document review. It uses human exper- tise and IT to facilitate analysis and sorting of documents. Predictive coding software leverages human analysis when experts review a subset of documents to “teach” the software what to look for, so it can apply this logic to the full set of documents, 19 mak- ing the sorting and culling process faster and more accurate than solely using human review or automated review.
Predictive coding uses a blend of several technologies that work in concert:20 soft- ware that performs machine learning (a type of g artifi cial intelligence software that “learns” and improves its accuracy, fostered by guidance from human input and pro- gressive ingestion of data sets—in this case documents); 21 workfl ow software, which w routes the documents through a series of work steps to be processed; and text analyt- ics software, used to perform functions such as searching for keywords (e.g., “asbestos” in a case involving asbestos exposure). Then using keyword search capabilities, or con- cepts using s pattern search or meaning-based search, and sifting through and sorting documents into basic groups using fi ltering technologies, based on document content,g and sampling a portion of documents to fi nd patterns and to review the accuracy of g fi ltering and keyword search functions.
The goal of using predictive coding technology is to reduce the total group of documents a legal team needs to review manually (viewing and analyzing them one by one) by fi nding that gross set of documents that is most likely to be relevant or responsive (in legalese) to the case at hand. It does this by automating, speeding up, and improving the accuracy of the document review process to locate and “digitally categorize” documents that are responsive to a discovery request. 22 Predictive coding, when deployed properly, also reduces billable attorney and paralegal time and there- fore the costs of ECA. Faster and more accurate completion of ECA can provide valu- able time for legal teams to develop insights and strategies, improving their odds for success. Skeptics claim that the technology is not yet mature enough to render more accurate results than human review.
The fi rst state court ruling allowing the use of predictive coding technology in- stead of human review to cull through approximately 2 million documents to “execute a fi rst-pass review” was made in April 2012 by a Virginia state judge.23 This was the fi rst time a judge was asked to grant permission without the two opposing sides fi rst coming to an agreement. The case, Global Aerospace, Inc., et al. v. Landow Aviation, LP, et al., stemmed from an accident at Dulles Jet Center.
In an exhaustive 156-page memorandum, which included dozens of pages of legal analysis, the defendants made their case for the reliability, cost- effectiveness, and legal merits of predictive coding. At the core of the memo
Predictive coding software leverages human analysis when experts review a subset of documents to “teach” the software what to look for, so it can apply this logic to the full set of documents.
128 INFORMATION GOVERNANCE
c08 128 February 28, 2014 11:57 AM
was the argument that predictive coding “is capable of locating upwards of seventy-fi ve percent of the potentially relevant documents and can be effec- tively implemented at a fraction of the cost and in a fraction of the time of linear review and keyword searching.”24
This was the fi rst big legal win for predictive coding use in e-discovery.
Basic Components of Predictive Coding Here is a summary of the main foundational components of predictive coding.
■ Human review. Human review is used to determine which types of document content will be legally responsive based on a case expert’s review of a sampling of documents. These sample documents are fed into the system to provide a seed set of examples. 25
■ Text analytics. This involves the ability to apply “keyword-agnostic” (through a thesaurus capability based on contextual meaning, not just keywords) to locate responsive documents and build create seed document sets.
■ Workfl ow. Software to route e-documents through the processing steps auto- matically to improve statistical reliability and streamlined processing.
■ Machine learning. The software “learns” what it is looking for and improves its capabilities along the way through multiple, iterative passes.
■ Sampling. Sampling is best applied if it is integrated so that testing for accuracy is an ongoing process. This improves statistical reliability and therefore defen- sibility of the process in court.
Predictive Coding Is the Engine; Humans Are the Fuel Predictive coding sounds wonderful, but it does not replace the expertise of an attorney; it merely helps leverage that knowledge and speed the review process. It “takes all the documents related to an issue, ranks and tags them so that a human reviewer can look over the documents to confi rm relevance.” So it cannot work without human input to let the software know what documents to keep and which ones to discard, but it is an emerging technology tool that will play an increasingly important role in e-discovery.26
Technology-Assisted Review
TAR, also known as computer-assisted review, is not predictive coding. TAR includest aspects of the nonlinear review process, such as culling, clustering and de-duplication, but it does not meet the requirements for comprehensive predictive coding.
Many technologies can help in making incremental reductions in e-discovery costs. Only fully integrated predictive coding, however, can completely transform the economics of e-discovery .
Mechanisms of Technology-Assisted Review There are three main mechanisms, or methods, for using technology to make legal review faster, less costly, and generally smarter. 27
1. Rules driven. “I know what I am looking for and how to profi le it.” In this sce- nario, a case team creates a set of criteria, or rules, for document review and
INFORMATION GOVERNANCE AND LEGAL FUNCTIONS 129
c08 129 February 28, 2014 11:57 AM
builds what is essentially a coding manual. The rules are fed into the tool for execution on the document set. For example, one rule might be to “redact for privilege any time XYZ term appears and add the term ‘redacted’ where the data was removed.” This rule-driven approach requires iteration to truly be effective. The case team will likely have rules changes and improvements as the case goes on and more is learned about strategy and merit. This approach assumes that the case team knows the document set well and can apply very specifi c rules to the corpus in a reasonable fashion.
2. Facet driven. “I let the system show me the profi le groups fi rst.” In this sce- nario, a tool analyzes documents for potential items of interest or groups potentially similar items together so that reviewers can begin applying decisions. Reviewers typically utilize visual analytics that guide them through the process and take them to prioritized documents. This mechanism can also be called present and direct.
3. Propagation based. “I start making decisions and the system looks for similar- related items.” This type of TAR is about passing along, or propagating, what is known based on a sample set of documents to the rest of the documents in a corpus. In the market, this is often referred to as predictive coding because the system predicts whether documents will be responsive or privileged based on how other documents were coded by the review team. Propagation-based TAR comes in different fl avors, but all involve an element of machine learning. In some scenarios, a review team will have access to a seed set of documents that the team codes and then feeds into the system. The system then mimics the action of the review team as it codes the remainder of the corpus. In other scenarios, there is not a seed set; rather, the systems give reviewers random documents for coding and then create a model for relevance and nonrelevance. It is important to note that propagation-based TAR goes beyond simple mimicry; it is about creating a linguistic mathematical model for what relevance looks like.
These TAR mechanisms are not mutually exclusive. In fact, combining the mecha- nisms can help overcome the limitations of individual approaches. For example, if a doc- ument corpus is not rich (e.g., does not have a high enough percentage of relevant documents), it can be hard to create a seed set that will be a good training set for the propagation-based system. However, it is possible to use facet-based TAR—for example, concept searching—to more quickly fi nd the documents that are relevant so as to create a model for relevance that the propagation-based system can leverage. 28
It is important to be aware that these approaches require more than just technology. It is critical to have the right people in place to support the technology and the work- fl ow required to conduct TAR. Organizations looking to exercise these mechanisms of TAR will need:
■ Experts in the right tools and information retrieval. Software is an important part of TAR. The team executing TAR will need someone that can program the tool set with the rules necessary for the system to intelligently mark documents. Furthermore, information retrieval is a science unto itself, blending linguistics, statistics, and computer science. Anyone practicing TAR will need the right team of experts to ensure a defensible and measurable process.
130 INFORMATION GOVERNANCE
c08 130 February 28, 2014 11:57 AM
■ Legal review team . While much of the chatter around TAR centers on its ability to cut lawyers out of the review process, the reality is that the legal review team will become more important than ever. The quality and consistency of the deci- sions this team makes will determine the effectiveness that any tool can have in applying those decisions to a document set.
■ Auditor. Much of the defensibility and acceptability of TAR mechanisms will rely on the statistics behind how certain the organization can be that the out- put of the TAR system matches the input specifi cation. Accurate measures of performance are important not only at the end of the TAR process, but also throughout the process in order to understand where efforts need to be focused in the next cycle or iteration. Anyone involved in setting or performing mea- surements should be trained in statistics.
For an organization to use a propagated approach, in addition to people it may need a “seed” set of known documents. Some systems use random samples to create seed sets while others enable users to supply small sets from the early case investigations. These documents are reviewed by the legal review team and marked as relevant, privi- leged, and the like. Then, the solution can learn from the seed set and apply what it learns to a larger collection of documents. Often this seed set is not available, or the seed set does not have enough positive data to be statistically useful.
Professionals using TAR state that the practice has value, but it requires a sophisticated team of users (with expertise in information retrieval, statistics, and law) who understand the potential limitations and danger of false confi dence that can arise from improper use. For example, using a propagation-based approach with a seed set of documents can have issues when less than 10 percent of the seed set documents are positive for relevance. In contrast, rules driven and other systems can result in false negative decisions when based on narrow custodian example sets.
However TAR approaches and tools are used, they will only be effective if usage is anchored in a thought out, methodically sound process. This requires a defi nition of what to look for, searching for items that meet that defi nition, measuring results, and then refi ning those results on the basis of the measured results. Such an end-to-end plan will help to decide what methods and tools should be used in a given case. 29
Defensible Disposal: The Only Real Way To Manage Terabytes TT and Petabytes
By Randy Kahn, Esq. Records and information management (RIM) is not working. At least, it is not working well. Information growth and management complexity has meant that the old records l retention rules and the ways businesses apply them are no longer able to address the lifecycle of information. So the mountains of information grow and grow and grow, often unfettered.
Too much data has outlived its usefulness, and no one seems to know how or is willing to get rid of it. While most organizations need to right-size their information footprint by cleaning out the digital data debris, they are stymied by the complexity and enormity of the challenge.
INFORMATION GOVERNANCE AND LEGAL FUNCTIONS 131
c08 131 February 28, 2014 11:57 AM
Growth of Information
According to International Data Corporation (IDC), from now until 2020, the digital universe is expected by expand to more than 14 times its current size. 30 One exabyte is the data equivalent of about 50,000 years of DVD movies running continuously. With about 1,800 exabytes of new data created in 2011, 2840 exabytes in 2012, and a predicted 6,120 exabytes in 2014, the volumes are truly staggering. While the data footprint grows signifi cantly each year, that says nothing of what has already been cre- ated and stored.
Contrary to what many say (especially hardware salespeople) storage is not cheap.t In fact, it is really becomes quite expensive when you add up not only the hard- ware costs but also maintenance, air conditioning and space overhead, and the highly skilled labor needed to keep it running. Many large companies spend tens if not hun- dreds of millions of dollars per year just to store data. This is money that could go straight to the bottom line if the unneeded data could be discarded. When you con- sider that most organizations’ information footprints are growing at between 20 and 50 percent per year and the cost of storage is declining by a few percentage points per year, in real terms they are spending way more this year than last to simply house information.
Volumes Now Impact Effectiveness
The law of diminishing returns applies to information growth. Assuming information is an asset, at some point when there is so much data, its value starts to decline. That is not because the intrinsic value goes down (although many would argue there is a lot of idle chatter in the various communications technologies). Rather the decline is related to the inability to expeditiously fi nd or have access to needed business information. According the Council of Information Auto-Classifi cation “Information Explosion” Survey, there is now so much information that nearly 50 percent of companies need to re-create business records to run their business and protect their legal interests because they cannot fi nd the original retained record.31 It is a poor business practice to spend resources to retain information and then, when it cannot be found, to spend more to reconstitute it.
There is increasing regulatory pressure, enforcement, and public scrutiny on all of an organization’s data storage activities. Record sanctions and fi nes, new regula- tions, and stunning court decisions have converged to mandate heightened controls and accountability from government regulators, industry and standards groups as well as the public. When combined with the volume of data, information privacy, security, protection of trade secrets, and records compliance become complex and critical, high- risk business issues that only executive management can truly fi x. However, executives typical view records and information management (RIM) as a low-importance cost center activity, which means that the real problem does not get solved.
In most companies, there is no clear path to classify electronic records, to for- mally manage offi cial records, or to ensure the ultimate destruction of these records. Vast stores of legacy data are unclassifi ed, and most data is never touched again shortly after creation. Further, traditional records retention rules are too voluminous, too complex, and too granular and do not work well with the technology needed to manage records.
132 INFORMATION GOVERNANCE
c08 132 February 28, 2014 11:57 AM
Finally, it is clear that employees can no longer be expected to pull the oars to cut through the information ocean, let alone boil it down into meaningful chunks of good information. Increasingly, technology has to play a more central role in manag- ing information. Better use of technology will create business value by reducing risk, driving improvements in productivity, and facilitating the exploitation and protection of ungoverned corporate knowledge.
How Did This Happen?
Over the past several years, organizations have come to realize that the exposure posed by uncontrolled data growth requires emergency, reactive action, as seemingly no oth- er viable approach exists. Faced with massive amounts of unknown unstructured data, many organizations have chosen to adopt a risk-averse save-everything policy. This approach has brought with it immediate repercussions:
■ Inability to quickly locate needed business content buried in ill-managed fi le systems.
■ Sharply increased storage costs, with some companies refusing to allocate any more storage to the business. The users’ reaction, out of necessity, is to store data wherever they can fi nd a place for it. (Do not buy the argument that stor-t age is cheap—everyone is spending more on storing unnecessary data, even if the per-gigabyte media cost has gone down).
■ Soaring litigation and discovery costs, as organizations have lost track of what is where, who owns it, and how to collect, sort, and process it.
■ Buried intellectual property, trade secrets, personally identifi able information, and regulated content, which are subject to leakage and unauthorized deletion, and are a clear target for opposing counsel—or anyone who can access them.
■ Lack of centralized policies and systems for the storage of records, which re- sults in hard-to-manage record sites spread throughout the organization.
■ The lack of a clear strategy for managing records that have long-term, rather than short-term, business, legal, and research value.
Information Glut in Organizations ■ 71 percent of organizations surveyed have no idea of the content in their stored
data. ■ 58 percent of organizations are keeping information indefi nitely. ■ 79 percent of organizations say too much time and effort is spent manually
searching and disposing information. ■ 58 percent of organizations still rely on employees to decide how to apply cor-
porate policies. 32
What Is Defensible Disposition, and How Will It Help?
A solution to the unmitigated data sprawl is to defensibly dispose of the business con- tent that no longer has business or legal value to the organization. In the old days of records management, it was clear that courts and regulators alike understood that records came into being and eventually were destroyed in the ordinary course of business. It is good business practice to destroy unneeded content, provided that the
INFORMATION GOVERNANCE AND LEGAL FUNCTIONS 133
c08 133 February 28, 2014 11:57 AM
rules on which those decisions are made consider legal requirements and business needs. Today, however, the good business practice of cleaning house of old records has somehow become taboo for some businesses. Now it needs to start again.
An understanding of how technology can help defensibly dispose and how meth- odology and process help an organization achieve a thinner information footprint is critical for all companies overrun with outdated records that do not know where to start to address the issue. While no single approach is right for every organization, re- cords and legal teams need to take an informed approach, looking at corporate culture, risk tolerance, and litigation profi le.
A defensible disposition framework is an ecosystem of technology, policies, proce- dures, and management controls designed to ensure that records are created, managed, and disposed at the end of their life cycle.
New Technologies—New Information Custodians
Responsibility for records management and IG have changed dramatically over time. In the past, the responsibility rested primarily with the records manager. However, the nature of electronic information is such that its governance today requires the partici- pation of IT, which frequently has custody, control, or access to such data, along with guidance from the legal department. As a result, IT personnel with no real connection or ownership of the data may be responsible for the accuracy and completeness of the business-critical information being managed. See the problem?
For many organizations, advances in technology mixed with an explosive growth of data forced a reevaluation of core records management processes. Many organi- zations have deployed archiving, litigation, and e-discovery point solutions with the intent of providing record retention compliance and responsiveness to litigation. Such systems may be tactically useful but fail to strategically address the heart of the matter: too much information, poorly managed over years and years—if not decades.
A better approach is for organizations to move away from a reactive keep- everything strategy to a proactive strategy that allows the reasonable and reliable identifi cation and deletion of records when retention requirements are reached, absent a preservation obligation. Companies develop retention schedules and processes pre- cisely for this reason; it is not misguided to apply them.
Why Users Cannot, Will Not—and Should Not—Make the Hard Choices
Employees usually are not suffi ciently trained on records management principles and methods and have little incentive (or downside) to properly manage or dispose of records. Further, many companies today see that requiring users to properly declare or man- age records places an undue burden on them. The employees not only do not provide a
A defensible disposition framework is an ecosystem of technology, policies, procedures, and management controls designed to ensure that records are created, managed, and disposed at the end of their life cycle.
134 INFORMATION GOVERNANCE
c08 134 February 28, 2014 11:57 AM
reasonable solution to the huge data pile (which for some companies may be petabytes of data) but contribute to its growth by using more unsanctioned technologies and parking company information in unsanctioned locations. So the digital landfi ll continues to grow.
Most organizations have programs that address paper records, but these same organizations commonly fail to develop similar programs for electronic records and other digital content.
Technology Is Essential to Manage Digital Records Properly
Having it all—but not being able to fi nd it—is like not having it at all. t While the content of a paper document is obvious, viewing the content of an electron-
ic document depends on software and hardware. Further, the content of electronic storage media cannot be easily accessed without some clue as to its structure and format. Conse- quently, the proper indexing of digital content is fundamental to its utility. Without an index, retrieving electronic content is expensive and time consuming, if it can be retrieved at all.
Search tools have become more robust, but they do not provide a panacea for fi nding electronic records when needed because there is too much information spread out across way too many information parking lots. Without taxonomies and common business terminology, accessing the one needed business record may be akin to fi nding the needle in a stadium-size haystack.
Technological advances can help solve the challenges corporations face and ad- dress the issues and burdens for legal, compliance, and information governance. When faced with hundreds of terabytes to petabytes of information, no amount of user inter- vention will begin to make sense of the information tsunami.
Auto-Classifi cation and Analytics Technologies
Increasingly companies are turning to new analytics and classifi cation technologies that can analyze information faster, better, and cheaper. These technologies should be considered essential for helping with defensible disposition, but do not make the mistake of underestimating their expense or complexity.
As discussed in the previous section by Barry Murphy, machine learning tech- nologies mean that software can “learn” and improve at the tasks of clustering fi les and assigning information (e.g., records, documents) to different preselected topical categories based on a statistical analysis of the data characteristics. In essence, classifi cation technology evaluates a set of data with known classifi cation mappings and attempts to map newly encountered data within the existing classifi cations. This type of technology should be on the list of considerations when approaching defen- sible disposition in large, uncontrolled data environments.
Can Technology Classify Information?
What is clear is that IT is better and faster than people in classifying information. Period.
A better approach is for organizations to move away from a reactive keep- everything strategy to a proactive strategy of defensible deletion.
INFORMATION GOVERNANCE AND LEGAL FUNCTIONS 135
c08 135 February 28, 2014 11:57 AM
Increasingly studies and court decisions make clear that, when appropriate, com- panies should not fear using enabling technologies to help manage information.
For example, in the recent Da Silva Moore v. Publicis Groupe case, Judge Andrew Peck stated:
Computer-assisted review appears to be better than the available alternatives, and thus should be used in appropriate cases. While this Court recognizes that computer-assisted review is not perfect, the Federal Rules of Civil Procedure do not require perfection. . . . Counsel no longer have to worry about being the “fi rst” or “guinea pig” for judicial acceptance of computer assisted review.
This work presents evidence supporting the contrary position: that a technology-assisted process, in which only a small fraction of the document collection is ever examined by humans, can yield higher recall and/or preci- sion than an exhaustive manual review process, in which the entire document collection is examined and coded by humans. 33
Moving Ahead by Cleaning Up the Past
Organizations can improve disposition and IG programs with a systemized, repeatable, and defensible approach that enables them to retain and dispose of all data types in compliance with the business and statutory rules governing the business’s operations.
Generally, an organization is under no legal obligation to retain every piece of in- formation it generates in the course of its business. Its records management process is there to clean up the information junk in a consistent, reasonable way. That said, what should companies do if they have not been following disposal rules, so information has piled up and continues unabated? They need to clean up old data. But how?
Manual intervention (by employees) will likely not work, due to the sheer volumes of data involved. Executives will not and should not have employees abdicate their regular jobs in favor of classifying and disposing of hundreds of millions of old stored fi les. (Many companies have billions of old fi les.) This buildup necessitates leveraging tech- nology, specifi cally, technologies that can discern the meaning of stored unstructured content, in a variety of formats, regardless of where it is stored.
Here is a starting point: Most likely, fi le shares, legacy e-mail systems, and other large repositories will prove the most target-rich environments, while better-managed document management, records management, or archival systems will be in less need of remediation. A good time to undertake a cleanup exercise is when litigation will not prevent action or when migrating to a new IT platform. (Trying to conduct a compre- hensive, document-level inventory and disposition is neither reasonable nor practical. In most cases, it will create limited results and even further frustration.)
Technology choices should be able to withstand legal challenges in court. Sophisticated technologies available today should also look beyond mere keyword searches (as their defensibility may be called into question) and should look to
Organizations can improve disposition and IG programs with a systemized, repeatable, and defensible approach.
136 INFORMATION GOVERNANCE
c08 136 February 28, 2014 11:57 AM
advanced techniques such as automatic text classifi cation (auto-classifi cation), concept search, contextual analysis, and automated clustering. While technology is imperfect, it is better than what employees can do and will never be able to accomplish—to man- age terabytes of stored information and clean up big piles of dead data.
Defensibility Is the Desired End State; Perfection Is Not
Defensible disposition is a way to take on huge piles of information without personally cracking each one open and evaluating it. Perhaps it is, in essence, operationalizing a retention schedule that is no longer viable in the electronic age. Defensible disposition is a must because most big companies have hundreds of millions or billions of fi les, which makes their individualized management all but impossible.
As the list of eight steps to defensible disposition makes clear, different chunks of data will require different diligence and analysis levels. If you have 100,000 backup tapes from 20 years ago, minimal or cursory review may be required before the whole lot of tapes can be comfortably discarded. If, however, you have an active shared drive with records and information that is needed for ongoing litigation, there will need to be deeper analysis with analytics and/or classifi cation technologies that have become much more powerful and useful. In other words, the facts surrounding the information will help inform if the information can be properly disposed with minimal analysis or if it requires deep diligence.
Kahn’s Eight Essential Steps to Defensible Disposition 1. Defi ne a reasonable diligence process to assess the business needs and legal
requirements for continued information retention and/or preservation, based on the information at issue.
2. Select a practical information assessment and/or classifi cation approach, given information volumes, available resources, and risk profi le.
3. Develop and document the essential aspects of the disposition program to ensure quality, effi cacy, repeatability, auditability, and integrity.
4. Develop a mechanism to modify, alter, or terminate components of the dispo- sition process when required for business or legal reasons.
5. Assess content for eligibility for disposition, based on business need, record retention requirements, and/or legal preservation obligations.
6. Test, validate, and refi ne as necessary the effi cacy of content assessment and disposition capability methods with actual data until desired results have been attained.
7. Apply disposition methodology to content as necessary, understanding that some content can be disposed with suffi cient diligence without classifi cation.
8. On an ongoing basis, verify and document the effi cacy and results of the dis- position program and modify and/or augment the process as necessary.
Source: “Chucking Daises: Ten Rules for Taking Control of Your Organization’s Digital Debris,” Randy Kahn, Esq., and Galena Datskovsky Ph.D., CRM (ARMA International, 2013), Overland Park, KS.
Business Case around Defensible Disposition
What is clear is that defensible disposition can have signifi cant ROI impact to a com- pany’s fi nancial picture. This author has clients for whom we have built the defensible
INFORMATION GOVERNANCE AND LEGAL FUNCTIONS 137
c08 137 February 28, 2014 11:57 AM
disposition business case, which saves them tens of millions of dollars on a net basis but also makes them a more effi cient business, reduces litigation cost and risks, mitigates the information security and privacy risk profi les, and makes their work force more productive, and so on.
However, remember auto-classifi cation technology is neither simple nor inexpen- sive, so be realistic and conservative when building the business case. Often it is easiest to simply use only hardware storage cost savings to make the case because it is a hard number and provides a conservative approach to justifying the activities. Then you can add on the additional benefi ts, which are more diffi cult to calculate, and also the intangible benefi ts of giving your employees a cleaner information stack to search and base decisions on.
Defensible Disposition Summary
Defensible disposition is a way to bring your records management program into to- day’s business reality—information growth makes management at the record level all but impossible. Defensible disposition should be about taking simplifi ed retention rules and applying them to both structured and unstructured content with the least amount of human involvement possible. While it can be a daunting challenge, it is also an opportunity to establish and promote operational excellence through better IG and to signifi cantly enhance an organization’s business performance and competitive advantage.
Retention Policies and Schedules
By Robert Smallwood, edited by Paula Lederman, MLS
With limited resources, today’s legal counsel, compliance managers, and records man- ager are faced with an onslaught of increasingly pressing and complex compliance and legal demands. At the core of these demands is the ability of the organization to demonstrate that it has legally defensible records management practices that can hold up in court.
Organizations can legally destroy records—but will have a greater legal defensi- bility if:
■ The authority to destroy the records is identifi ed on a retention schedule. ■ The retention requirements have been met. ■ The records are slated for destruction in the normal course of business. ■ There are no existing legal or fi nancial holds. ■ Al records of the same type are treated consistently and systematically.
The foundation of legally defensible records management practices is a solid IG underpinning, where policies and processes, supported and enforced by IT, help the organization meet its externally mandated legal requirements and internally mandated IG requirements for handling and controlling information.
A complete, current, and documented records retention program reduces stor- age and handling costs and improves searchability for records by making records
138 INFORMATION GOVERNANCE
c08 138 February 28, 2014 11:57 AM
easier and faster to fi nd. This reduced search time and more complete search capability improves knowledge worker productivity. It also reduces legal risk by improving the ability to meet compliance demands while also reducing e-discovery costs and improving the ability to more effi ciently respond to discovery requests during litigation.
Most large organizations maintain records retention schedules by business unit, department, or functional area. Some organizations, particularly smaller ones, may establish organization-wide IG programs that call for the developing, updating, and improvement of an enterprise or master retention schedule. This is a tall order and is almost never accomplished—but it is possible with a determined, sustained effort. Developing enterprise-wide records retention schedules requires consultation with stakeholder groups that have valuable input to contribute to the overall development of the IG effort and to specifi c schedules for retaining record collections and their planned disposition. Consultation by the records manage- ment department, senior records offi cer , or records team must take place with representatives from the business units that create and own the records as well as with legal, compliance, risk management, IT, and other relevant stakeholder groups.
Meeting Legal Limitation Periods
A key consideration in developing retention schedules is researching and determin- ing the minimum time required to keep records that may be demanded in legal actions. “A limitation period is the length of time after which a legal action cannot be brought before the courts. Limitation periods are important because they de- termine the length of time records must be kept to support court action [including subsequent appeal periods]. It is important to be familiar with the purpose, prin- ciples, and special circumstances that affect limitation periods and therefore records retention.”34
Legal Requirements and Compliance Research
As stated at the beginning of this chapter, legal requirements trump all others. The reten- tion period for a particular records series must meet minimum retention requirements as mandated by law. Business needs and other considerations are secondary. So, legal research is required before determining retention periods. Legally required retention periods must be researched for each jurisdiction (state, country) in which the business operates, so that it complies with all applicable laws.
A limitation period is the length of time after which a legal action cannot be brought before the courts. Such a period must be factored into retention policies.
INFORMATION GOVERNANCE AND LEGAL FUNCTIONS 139
c08 139 February 28, 2014 11:57 AM
In order to locate the regulations and citations relating to retention of records, there are two basic approaches. The fi rst approach is to use a records retention citation service, which publishes in electronic form all of the retention-related citations. These services usually are bought on a subscription basis, as citations are updated on an an- nual or more frequent basis as legislation and regulations change.
Another approach is to search the laws and regulations directly using online or print resources. Records retention requirements for corporations operating in the United States may be found in the Code of Federal Regulations (CFR), the annual edition of which:
is the codifi cation of the general and permanent rules published in the Fed- eral Register by the departments and agencies of the federal government. It is divided into 50 titles that represent broad areas subject to federal regulation. The 50 subject matter titles contain one or more individual volumes, which are updated once each calendar year, on a staggered basis. The annual update cycle is as follows: titles 1 to 16 are revised as of January 1; titles 17 to 27 are revised as of April 1; titles 28 to 41 are revised as of July 1, and titles 42 to 50 are revised as of October 1. Each title is divided into chapters, which usually bear the name of the issuing agency. Each chapter is further subdivided into parts that cover specifi c regulatory areas. Large parts may be subdivided into subparts. All parts are organized in sections, and most citations to the CFR refer to material at the section level. 35
There is an up-to-date version that is not yet a part of the offi cial CFR but is updated daily, the Electronic Code of Federal Regulations (e-CFR) . “It is not an offi cial legal edition of the CFR. The e-CFR is an editorial compilation of CFR mate- rial and Federal Register amendments produced by the National Archives and Records Administration’s Offi ce of the Federal Register (OFR) and the Government Printing Offi ce.”36 According to the gpoaccess.gov Web site:
The Administrative Committee of the Federal Register (ACFR) has authorized the National Archives and Records Administration’s (NARA) Offi ce of the Fed- eral Register (OFR) and the Government Printing Offi ce (GPO) to develop and maintain the e-CFR as an informational resource pending ACFR action to grant the e-CFR offi cial legal status. The OFR/GPO partnership is committed to presenting accurate and reliable regulatory information in the e-CFR edito- rial compilation with the objective of establishing it as an ACFR sanctioned publication in the future. While every effort has been made to ensure that the e-CFR on GPO Access is accurate, those relying on it for legal research should verify their results against the offi cial editions of the CFR, Federal Register and List of CFR Sections Affected (LSA), all available online at www.gpoaccess.gov. Until the ACFR grants it offi cial status, the e-CFR editorial compilation does not provide legal notice to the public or judicial notice to the courts.
The OFR updates the material in the e-CFR on a daily basis. Generally, the e-CFR is current within two business days. The current update status is displayed at the top of all e-CFR web pages.
140 INFORMATION GOVERNANCE
c08 140 February 28, 2014 11:57 AM
What Is a Records Retention Schedule?
A records retention schedule delineates how long a (business) record series is to be retained, and its disposition after its life cycle is complete (e.g., destruc- tion, transfer, archiving); the schedule also contains “lists of records by name or type that authorize the disposition of records.”37 Retention schedules apply to all records regardless of their format or media (e.g., physical or electronic). Retention schedules are developed for records not individually but rather by records series, categories, functions, or systems. Ideally, they include all of the record series in an organization, although they may be broken down into smaller subset schedules, such as by busi- ness unit.
Retention schedules may be maintained separately for electronic records, or they may be included in a combined schedule that includes both e-records and paper or other physical records.
Corporate records retention schedules are increasingly being maintained online, where users and also IT, legal, risk, and records management personnel can view and reference them. Electronic data and documents can easily reference these schedules and initiate a process based on a trigger event so that the life cycle of the electronic document can be automated and managed in a consistent manner. Retention schedules are basic tools that allow an organization to prove that it has a legally defensible basis on which to dispose records.
Retention schedules in large organizations typically are broken down and by business function. A functional retention schedule groups record series based on business functions, such as fi nancial, legal, product management, or sales. Each func- tion or grouping also is used for classifi cation. Rather than detail every sequence of records, these larger functional groups are less numerous and are easier for users to understand.
Some organizations are able to reach the ultimate retention goal: to keep an enterprise-wide master retention schedule, which includes the retention and
Retention schedules are developed by records series, category, function, or system—not for individual records.
Retention schedules are basic tools that allow an organization to prove that it has a legally defensible basis on which to dispose records.
A complete, current, and documented records retention program reduces storage and handling costs and improves searchability for records by making records easier and faster to fi nd.
INFORMATION GOVERNANCE AND LEGAL FUNCTIONS 141
c08 141 February 28, 2014 11:57 AM
disposition requirements for records series that cross business unit boundaries. The master retention schedule contains all records series in the entire enterprise. An enterprise-wide retention schedule is preferable because it eliminates the possibility that different business units will follow confl icting records retention periods. For example, if one business unit is discarding a group of records after 5 years, it would not make sense for another business unit to keep the same records for 10 years.
Benefi ts of a Retention Schedule
According to the U.S. National Archives and Records Administration, developing and maintaining a records retention schedule provides the following benefi ts. The reten- tion schedule: 38
1. Reduces legal risk and legal liability exposure. 2. Supports a legally defensible records management program. 3. Improves IG by enforcing uniformity and standardization. 4. Improves search quality and reduces search time. 5. Provides higher-quality records information to improve decision support for
knowledge workers. 6. Prevents inadvertent, malicious, or premature destruction of records. 7. Improves accountability for life cycle management of records on an enter-
prise-wide basis. 8. Improves security for confi dential records assets. 39 9. Reduces and minimizes costs for maintaining records. 10. Determines which records have historic value. 11. Saves hardware, utility, and labor costs by deleting records after their life
span. 12. Optimizes use of online storage and access resources.
A formal approach to records management has been around since the mid-1900s, so a great deal of guidance is available before embarking on developing or updating your records retention program. Models and guides can be used to assist in the devel- opment of records retention schedules for your organization, including the interna- tional standard for records management, ISO 15489—Part 1 and 2:2001, “Information and Documentation—Records Management”; the ISO 15489 standard was written to address all kinds of records. Additional guidance may be obtained by referencing national standards, such as those in Canada, Europe, Australia, and other countries. 40 Often, in the public sector, retention guidelines are published by an authority such as the offi ce of the national, state, or provincial archivist. Some additional insights may be gleaned from ISO 16175–1:2010, “Information and Documentation—Principles and Functional Requirements for Records in Electronic Offi ce Environments—Part 1: Overview and Statement of Principles,” which establishes fundamental principles and functional requirements for software used to create and manage digital records in offi ce environments. 41
A records retention schedule is an essential part of an overall IG program. Due to the fact that a concerted IG program standardizes and enforces uniformity and
142 INFORMATION GOVERNANCE
c08 142 February 28, 2014 11:57 AM
control, the entire organization benefi ts in terms of productivity, reduced risk, and improved compliance and e-discovery processes. These overarching goals and benefi ts should be championed by senior management in words and deeds. This means making the IG effort visible and providing the proper budgetary resources in terms of money and employee time to achieve its aims.
More detail on retention schedules can be found in Chapter 9 on IG and RIM functions.
The master retention schedule contains all records series in the entire enterprise.
CHAPTER SUMMARY: KEY POINTS
■ Legal functions are the most important area of IG impact.
■ IG serves as the underpinning for effi cient e-discovery processes.
■ ESI is any information that is created or stored in electronic format.
■ The goal of the FRCP amendments is to recognize the importance of ESI and to respond to the increasingly prohibitive costs of document review and pro- tection of privileged documents.
■ The amended FRCP reinforce the importance of IG. Only about 25 percent of business information has real value and 5 percent are business records.
■ The Big Data trend underscores the need for defensible deletion of data debris.
■ In the landmark case Zubulake v. U.B.S. Warburg, the defendants were se-g verely punished by an adverse inference for deleting key e-mails and not producing copies on backup tapes.
■ The E-Discovery Reference Model is a planning tool that depicts key e-discovery process steps.
■ Implementing IG, inventorying ESI, and leveraging technology to implement records retention and LHN policies are key steps in e-discovery planning.
■ LHN management is the absolute minimum an organization should imple- ment to meet the guidelines, rules, and precedents.
■ Predictive coding software leverages human analysis when experts review a subset of documents to “teach” the software what to look for, so it can apply this logic to the full set of documents.
INFORMATION GOVERNANCE AND LEGAL FUNCTIONS 143
c08 143 February 28, 2014 11:57 AM
■ Many technologies assist in making incremental reductions in e-discovery costs, but only fully integrated predictive coding is able to completely trans- form the economics of e-discovery.
■ TAR, also known as computer-assisted review, speeds the review process by leveraging IT tools.
■ In TAR, there are three main ways to use technology to make legal review faster, less costly, and generally smarter: rules driven, facet driven, and propa- gation based.
■ It is important to have the right people in place to support the technology and the work fl ow required to conduct TAR.
■ A defensible disposition framework is an ecosystem of technology, policies, procedures, and management controls designed to ensure that records are created, managed, and disposed of at the end of their life cycle.
■ A better approach is for organizations to move away from a reactive “keep- everything” strategy to a proactive strategy of defensible deletion.y
■ Organizations can improve disposition and IG programs with a systemized, repeatable, and defensible approach.
■ A limitation period—the length of time after which a legal action cannot be brought before the courts—must be factored into retention policies.
■ A complete, current, and documented records retention program reduces storage and handling costs and improves searchability for records by making records easier and faster to fi nd.
■ Retention schedules are developed by records series, not for individual records.
■ Retention schedules are basic tools that allow an organization to prove that it has a legally defensible basis on which to dispose of records.
■ The master retention schedule contains all records series in the entire enterprise.
■ “Records retention” defi nes the length of time that records are to be kept and considers legal, regulatory, operational, and historical requirements.
■ Disposition means not just destruction but can also mean archiving and a change in ownership and responsibility for the records.
■ For most organizations, e-mail is the most common information source to begin deleting according to established retention policies.
CHAPTER SUMMARY: KEY POINTS (Continued )
144 INFORMATION GOVERNANCE
c08 144 February 28, 2014 11:57 AM
Notes
1. Linda Volonino and Ian Redpath, e-Discovery for Dummies (Hoboken, NJ: John Wiley & Sons, 2010),s p. 9. This material is reproduced with permission from John Wiley & Sons, Inc.
2. “New Fed. Rules to Civil Procedure,” www.uscourts.gov/FederalCourts/UnderstandingtheFederalCourts/ DistrictCourts.aspx; (accessed November 26, 2013).
3. Ibid. 4. Ibid. 5. Volonino and Redpath, e-Discovery for Dummies, p. 13.s 6. Ibid., p. 11. 7. “New Fed. Rules to Civil Procedure.” www.uscourts.gov/FederalCourts/UnderstandingtheFederalCourts/
DistrictCourts.aspx; (accessed November 26, 2013). 8. “The Digital Universe Decade—Are You Ready?” IDC iView (May 2010). 9. Deidra Paknad, “Defensible Disposal: You Can’t Keep All Your Data Forever,” July 17, 2012, www.forbes
.com/sites/ciocentral/2012/07/17/defensible-disposal-you-cant-keep-all-your-data-forever/ 10. Sunil Soares, Selling Information Governance to the Business (MC Press Online, Ketchum, ID, 2011), p. 229. s 11. All quotations from the FRCP are from Volonino and Redpath, e-Discovery for Dummies , www.dummiess
.com/how-to/content/ediscovery-for-dummies-cheat-sheet.html (accessed May 22, 2013). 12. Linda Volonino and Ian Redpath, e-Discovery for Dummies (Hoboken, NJ: John Wiley & Sons, 2010), p. 13. s 13. Case Briefs, LLC, “Zubulake v. UBS Warburg LLC,” www.casebriefs.com/blog/law/civil-procedure/
civil-procedure-keyed-to-friedenthal/pretrial-devices-of-obtaining-information-depositions-and-dis- covery-civil-procedure-keyed-to-friedenthal-civil-procedure-law/zubulake-v-ubs-warburg-llc/2/ (ac- cessed May 21, 2013).
14. Amy Girst, “E-discovery for Lawyers,” IMERGE Consulting Report, 2008. 15. ECM2, “15-Minute Guide to eDiscovery and Early Case Assessment,” www.emc.com/collateral/
15-min-guide/h9781-15-min-guide-ediscovery-eca-gde.pdf (accessed May 21, 2013 16. Barry Murphy, telephone interview with author, April 12, 2013. 17. Email to author August 16, 2012. 18. Recommind, “What Is Predictive Coding?” www.recommind.com/predictive-coding (accessed
May 7, 2013). 19. Michael LoPresti, “What Is Predictive Coding?: Including eDiscovery Applications,” KMWorld,
January 14, 2013, www.kmworld.com/Articles/Editorial/What-Is-…/What-is-Predictive-Coding-Including- eDiscovery-Applications-87108.aspx
20. “Predictive Coding,” TechTarget.com, http://searchcompliance.techtarget.com/defi nition/predictive- coding, August 31, 2012 (accessed May 7, 2013).
21. “Machine Learning,” TechTarget.com http://whatis.techtarget.com/defi nition/machine-learning, accessed May 7, 2013.
22. “Predictive Coding.” 23. LoPresti, “What Is Predictive Coding?” 24. Ibid. 25. “What Does Predictive Coding Require?” Recommind Corp., www.recommind.com/predictive-coding
(accessed May 24, 2013). 26. Ibid. 27. Barry Murphy, e-mail to author, May 10, 2013. 28. Ibid. 29. Ibid. 30. “The digital universe in 2020: Big Data, Bigger Digital Shadows, and Biggest Grow in the Far East,”
www.emc.com/collateral/analyst-reports/idc-the-digital-universe-in-2020.pdf (accessed November 26, 2013).
31. Council of Information Auto-Classifi cation, “Information Explosion” survey, http://infoautoclassifi cation .org/survey.php (accessed November 26, 2013).
32. Ibid. 33. Maura R. Grossman and Gordon V. Cormack, “Technology-Assisted Review in E-Discovery Can Be
More Effective and More Effi cient Than Exhaustive Manual Review.” http://delve.us/downloads/Tech- nology-Assisted-Review-In-Ediscovery.pdf (accesssed November 26, 2013).
34. Government of Alberta, “Developing Retention and Disposition Schedules,” July 2004, p. 122, www .rimp.gov.ab.ca/publications/pdf/SchedulingGuide.pdf
35. U.S. Government Printing Offi ce (GPO), “Code of Federal Regulations,” www.gpo.gov/help/index .html#about_code_of_federal_regulations.htm (accessed April 22, 2012).
INFORMATION GOVERNANCE AND LEGAL FUNCTIONS 145
c08 145 February 28, 2014 11:57 AM
36. National Archives and Records Administration, “Electronic Code of Federal Regulations,” October 2, 2012 http://ecfr.gpoaccess.gov/cgi/t/text/text-idx?c=ecfr&tpl=%2Findex.tpl
37. U.S. Department of Energy, Records Retention Schedule Defi nition, https://commons.lbl.gov/display/ aro/Records+Retention+Schedule+Defi nition (accessed July 30, 2012).
38. National Archives, “Frequently Asked Questions about Records Scheduling and Disposition,” updated June 6, 2005, www.archives.gov/records-mgmt/faqs/scheduling.html#whysched
39. Government of Alberta, “Developing Retention and Disposition Schedules.” 40. National Archives, “Frequently Asked Questions about Records Scheduling and Disposition.” 41. International Organization for Standardization, ISO 16175-1:2010, “Information and Documentation—
Principles and Functional Requirements for Records in Electronic Offi ce Environments—Part 1: Overview and Statement of Principles,” www.iso.org/iso/catalogue_detail.htm?csnumber=55790 (accessed July 30, 2012).
147
c09 147 February 28, 2014 6:23 PM
R ecords management (RM) is a key impact area of t information governance (IG)—so much so that in the RM space, IG is often thought of as synonymous with or a simple superset of RM. But IG is much more than that. We delve into
the details of RM here—a sort of crash course on how to identify and inventory re- cords, conduct the necessary legal research, develop retention and disposition sched- ules, and more. Also, we identify the relationship and impact of IG on the RM function in an organization in this chapter.
The International Organization for Standardization (ISO) defi nes (business) records as “information created, received, and maintained as evidence and informa- tion by an organization or person, in pursuance of legal obligations or in the transac- tion of business.” 1 It further defi nes RM as “[the] fi eld of management responsible for the effi cient and systematic control of the creation, receipt, maintenance, use, and disposition of records, including the processes for capturing and maintaining evidence of and information about business activities and transactions in the form of records.” 2
The U.S.-based Association of Records Managers and Administrators (ARMA) defi nes records as “evidence of what an organization does. They capture its business activities and transactions, such as contract negotiations, business correspondence, personnel fi les, and fi nancial statements.” 3
Records and information management (RIM) extends beyond RM (although t the terms are often used interchangeably) to include information—that is, information such as data, electronic documents, and reports. For this reason, RIM professionals must expand their reach and responsibilities to include policies for retention and dis- position of all legally discoverable forms of information, such as e-mail, social media posts, mobile data and documents held on portable devices, cloud storage and applica- tions, and other enterprise data and information.
Electronic records management (ERM) has moved to the forefront of busi-t ness issues with the increasing automation of business processes and the vast growth in the volume of electronic documents and records that organizations create. These
Portions of this chapter are adapted from Chapters 1 , 5 , and 7 of Robert F. Smallwood, Managing Electronic Records: Methods, Best Practices, and Technologies , © John Wiley & Sons, Inc., 2013. Reproduced with permission of John Wiley s & Sons, Inc.
C H A P T E R 9 Information Governance and Records and Information Management Functions
Information Governance: Concepts, Strategies and Best Practices By Robert F. Smallwood Copyright © 2014 by Robert F. Smallwood
148 INFORMATION GOVERNANCE
c09 148 February 28, 2014 6:23 PM
factors, coupled with expanded and tightened reporting laws and compliance regula- tions, have made ERM essential for most enterprises—especially highly regulated and public ones.
ERM follows generally the same principles as traditional paper-based records management: There are classifi cation and taxonomy needs to group and organize y the records, and there are retention and disposition schedules to govern the length of time a record is kept and its ultimate disposition (destruction, transfer, or long-term archiving) destruction or long-term archiving. Yet e-records must be handled differ- ently, and they contain more detailed data about their contents and characteristics, known as metadata. (For more detail on these topics see Appendix A. )
E-records are also subject to changes in information technology (IT) that may y make them diffi cult to retrieve and view and therefore render them obsolete. These is- sues can be addressed through a sound ERM program that includes long-term digital preservation (LTDP) methods and technologies.
ERM is primarily the organization, management, control, monitoring, and auditing of formal business records that exist in electronic form. But automated ERM systems also track paper-based and other physical records. So ERM goes beyond simply managing elec- tronic records; it is the management of electronic records and the electronic management of non- electronic records (e.g., paper, CD/DVDs, magnetic tape, audio-visual, and other physical records).
Most electronic records, or e-records, originally had an equivalent in paper form, such as memos (now e-mail), accounting documents (e.g., purchase orders, invoices), personnel documents (e.g., job applications, resumes, tax documents), contractual documents, line-of-business documents (e.g., loan applications, insurance claim forms, health records), and required regulatory documents (e.g., material safety data sheets). Before e-document and e-record software began to mature in the 1990s, many of these documents were fi rst archived to microfi lm or microform/microfi che.
Not all documents rise to the level of being declared a formal business record that needs to be retained; that defi nition depends on the specifi c regulatory and legal re- quirements imposed on the organization and the internal defi nitions and requirements the organization imposes on itself, through internal IG measures and business policies. IG is the policies, processes, and technologies used to manage and control information through- out the enterprise to meet internal business requirements and external legal and compliance demands.
E-records management has become much more critical to enterprises with in- creased compliance legislation and massively increasing volumes of electronic information.
ERM follows the same basic principles as paper-based records management.
c09 149 February 28, 2014 6:23 PM
INFORMATION GOVERNANCE AND RECORDS 149
ERM is a component of enterprise content management (ECM), just as document management, Web content management, digital asset management, enterprise report management, and several other technology sets are components. ECM encompasses all an organization’s unstructured digital content, which means it excludes structured l data (i.e., databases). ECM includes the vast majority—over 90 percent—of an organi- zation’s overall information that must be governed and managed.
ERM extends ECM to provide control and to manage records through their life cycle—from creation to destruction. ERM is used to complete the life cycle manage- ment of information, documents, and records.
ERM adds the functionality to complete the management of information and records by applying business rules to manage the maintenance, preservation, and disposition of records. Both ERM and ECM systems aid in locating and managing the records and infor- mation needed to conduct business effi ciently, to comply with legal and regulatory requirements, and to effectively destroy (paper) and delete (digital) records that have met their retention policy time frame requirement, freeing up valuable physical and digital space and eliminating records that could be a liability if kept.
Records Management Business Rationale
Historically, highly regulated industries, such as banking, energy, and pharmaceuticals, have had the greatest need to implement RM programs, due to their compliance and reporting requirements. 4 However, over the past decade or so, increased regulation and changes to legal statutes and rules have made RM a business necessity for nearly every enterprise (beyond very small businesses).
Notable industry drivers include:
■ Increased government oversight and industry regulation. Government regulations that require enhanced reporting and accountability were early business drivers that fueled the implementation of formal RM programs. This is true at the federal and state or provincial level. In the United States, the Sarbanes–Oxley Act of 2002 (SOX) created and enhanced standards of fi nancial reporting and transparency for the boards and executive management of public corporations and accounting fi rms. It also addressed auditor independence and corporate governance concerns. SOX imposes fi nes or imprisonment penalties for non- compliance and requires that senior offi cers sign off on the veracity of fi nancial statements. It states clearly that pertinent business records cannot be destroyed during litigation or compliance investigations. Since SOX was enacted, Japan, Australia, Germany, France, and India also have adopted stricter “SOX-like” governance and fi nancial reporting standards.
ERM includes the management of electronic and nonelectronic records, such as paper and other physical records.
150 INFORMATION GOVERNANCE
c09 150 February 28, 2014 6:23 PM
■ Changes in legal procedures and requirements during civil litigation. In 2006, the need to amend the U.S. Federal Rules of Civil Procedure (FRCP) to contain specifi c rules for handling electronically generated evidence was addressed. The changes included processes and requirements for legal discovery of elec- tronically stored information (ESI) during civil litigation. Today, e-mail is the leading form of evidence requested in civil trials. The changes to the U.S. FRCP had a pervasive impact on American enterprises and required them to gain control over their ESI and implement formal RM and electronic discovery (e-discovery) programs to meet new requirements. Although they have been ahead of the United States in their development and maturity of RM practic- es, Canadian, British, and Australian law is closely tracking that of the United States in legal discovery. The United States is a more litigious society, so this is not unexpected.
■ IG awareness. IG, in short, is the set of rules, policies, and business process- es used to manage and control the totality of an organization’s information. Monitoring technologies are required to enforce and audit IG compliance. Beginning with SOX in 2002 and continuing with the massive U.S. FRCP changes in 2006, enterprises have become more IG aware and have ramped up efforts to control, manage, and secure their information. A signifi cant component of any IG program is implementing an RM program that specifi es the retention periods and disposition (e.g., destruction, transfer, archive) of formal business records. This program, for instance, allows enterprises to destroy records once their required retention period (based on external regulations, legal requirements, and inter- nal IG policies) has been met and allows them to legally destroy records with no negative impact or lingering liability.
■ Business continuity concerns. In the face of real disasters, such as the 9/11 terror- ist attacks, Hurricane Katrina, and Superstorm Sandy, executives now realize that disaster recovery and business resumption must be planned and prepared for. Disasters really happen, and businesses that are not well prepared really go under. The focus is on vital records that are necessary to resume operations in the event of a disaster, and managing those records is part of an overall RM program.
Why Is Records Management So Challenging?
With these changes in the business environment and in regulatory, legal, and IG infl u- ences comes increased attention to RM as a driver for corporate compliance. For most organizations, a lack of defi ned policies and the enormous and growing volumes
A number of factors provide the business rationale for ERM, including facilitating compliance, supporting IG, and providing backup capabilities in the event of a disaster.
c09 151 February 28, 2014 6:23 PM
INFORMATION GOVERNANCE AND RECORDS 151
of documents (e.g., e-mail messages) make implementing a formal RM program chal- lenging and costly. Some reasons for this include:
■ Changing and increasing regulations. Just when records and compliance managers have sorted through the compliance requirements of federal regulations, new ones at the state or provincial level are created or tightened down.
■ Maturing IG requirements within the organization. As senior managers become increasingly aware of IG—the rules, policies, and processes that control and manage information—they promulgate more reporting and auditing require- ments for the management of formal business records.
■ Managing multiple retention and disposition schedules. Depending on the type of record, retention requirements vary, and they may vary for the same type of record based on state and federal regulations. Further, internal information governance policies may extend retention periods and may fl uctuate with management changes.5
■ Compliance costs and requirements with limited staff. RM and compliance depart- ments are notoriously understaffed, since they do not generate revenue. De- partments responsible for executing and proving compliance with new and increasing regulatory requirements must do so expediently, often with only skeletal staffs. This leads to expensive outsourcing solutions or staff increases. The cost of compliance must be balanced with the risk of maintaining a mini- mum level of compliance.
■ Changing information delivery platforms. With cloud computing, mobile com- puting, Web 2.0, social media, and other changes to information delivery and storage platforms, records and compliance managers must stay apprised of the latest IT trends and provide records on multiple platforms all while maintain- ing the security and integrity of organizational records.
■ Security concerns. Protecting and preserving corporate records is of paramount importance, yet users must have reasonable access to offi cial records to conduct everyday business. “Organizations are struggling to balance the need to provide accessibility to critical corporate information with the need to protect the in- tegrity of corporate records.” 6
■ Dependence on the IT department or provider. Since tracking and auditing use of formal business records requires IT, and records and compliance departments typically are understaffed, those departments must rely on assistance from the IT department or outsourced IT provider—which often does not have the same perspective and priorities as the departments they serve.
■ User assistance and compliance. Users often go their own way with regard to records, ignoring directives from records managers to stop storing shadow fi les of records on their desktop (for their own convenience) and inconsistently following directives to classify records as they are created. Getting users across a range of departments in the enterprise to adhere uniformly with records and compliance requirements is a daunting and unending task that requires constant attention and reinforcement. 7
Implementing ERM is challenging because it requires user support and com- pliance, adherence to changing laws, and support for new information deliv- ery platforms, such as mobile and cloud computing.
152 INFORMATION GOVERNANCE
c09 152 February 28, 2014 6:23 PM
Benefi ts of Electronic Records Management
A number of business drivers and benefi ts combine to create a strong case for imple- menting an enterprise ERM program. Most are tactical, such as cost savings, time savings, and building space savings. But some drivers can be thought of as strategic , in that c they proactively give the enterprise an advantage. One example may be the advantages gained in litigation by having more control and ready access to complete business records, which yields more accurate results and more time for corporate attorneys to develop strategies while the opposition is wading through reams of information, never knowing if it has found the complete set of records it needs. Another example is more complete and better information for managers to base decisions on.
Implementing ERM represents a signifi cant investment. An investment in ERM is an investment in business process automation and yields document control, document integrity, and security benefi ts. The volume of records in organizations often exceeds employees’ ability to manage them. ERM systems do for the information age what the assembly line did for the industrial age. The cost/benefi t justifi cation for ERM is sometimes diffi cult to determine, although there are real labor and cost savings. Also, many of the benefi ts are intangible or diffi cult to calculate but help to justify the capital investment. There are many ways in which an organization can gain signifi cant business benefi ts with ERM.
More detail on business benefi ts is provided in Chapter 7 , but hard, calculable benefi ts (when compared to storing paper fi les) include offi ce space savings, offi ce supplies savings, cutting wasted search time, and reduced offi ce automation costs (e.g., fewer printers, copiers, cutting automated fi ling cabinets).
In addition, implementing ERM will provide the organization with:
■ Improved capabilities for enforcing IG over business documents and records ■ Improved, more complete, and more accurate searches ■ Improved knowledge worker productivity ■ Reduced risk of compliance actions or legal consequences ■ Improved records security ■ Improved ability to demonstrate legally defensible RM practices ■ Increased working confi dence in making searches, which should improve deci-
sion making
An investment in ERM is an investment in business process automation and yields document control, document integrity, and security benefi ts.
ERM benefi ts are both tangible and intangible or diffi cult to calculate.
c09 153 February 28, 2014 6:23 PM
INFORMATION GOVERNANCE AND RECORDS 153
Additional Intangible Benefi ts
The U.S. Environmental Protection Agency (EPA), a pioneer and leader in e-records im- plementation in the federal sector, lists some additional benefi ts of implementing ERM:
1. To control the creation and growth of records. Despite decades of using vari- ous nonpaper storage media, the amount of paper in our offi ces continues to escalate. An effective records management program addresses both cre- ation control (limits the generation of records or copies not required to operate the business) and records retention (a system for destroying useless records or retiring inactive records), thus stabilizing the growth of records in all formats.
2. To assimilate new records management technologies. A good records manage- ment program provides an organization with the capability to assimilate new technologies and take advantage of their many benefi ts. Investments in new computer systems don’t solve fi ling problems unless current manual record-keeping systems are analyzed (and occasionally, overhauled) before automation is applied.
3. To safeguard vital information. Every organization, public or private, needs a comprehensive program for protecting its vital records and information from catastrophe or disaster, because every organization is vulnerable to loss. Operated as part of the overall records management program, vital records programs preserve the integrity and confi dentiality of the most important records and safeguard the vital information assets according to a “plan” to protect the records.
4. To preserve the corporate memory. An organization’s fi les contain its institu- tional memory, an irreplaceable asset that is often overlooked. Every busi- ness day, you create the records that could become background data for future management decisions and planning. These records document the activities of the agency that future scholars may use to research the work- ings of the Environmental Protection Agency.
5. To foster professionalism in running the business. A business offi ce with fi les askew, stacked on top of fi le cabinets and in boxes everywhere, creates a poor working environment. The perceptions of customers and the public, and “image” and “morale” of the staff, though hard to quantify in cost-benefi t terms, may be among the best reasons to establish a good records management program.8
Thus, there are a variety of tangible and intangible benefi ts derived from ERM programs, and the business rationale that fi ts for your organization depends on its specifi c needs and business objectives.
Improved professionalism, preserving corporate memory, and support for bet- ter decision making are key intangible benefi ts of ERM.
154 INFORMATION GOVERNANCE
c09 154 February 28, 2014 6:23 PM
Inventorying E-Records
According to the U.S. National Archives and Records Administration (NARA), “In records management, an t inventory is a descriptive listing of each record series ory system, together with an indication of location and other pertinent data. It is not a list of each document or each folder but rather of each series or system ”9 (emphasis added).
Conducting an inventory of electronic records is more challenging than perform- ing a physical records inventory, but the purposes are the same: to ferret out RM problems and to use the inventory as the basis for developing the retention schedule. Some of the RM problems that may be uncovered
include inadequate documentation of offi cial actions, improper applications of record-keeping technology, defi cient fi ling systems and maintenance prac- tices, poor management of nonrecord materials, insuffi cient identifi cation of vital records, and inadequate records security practices. When completed, the inventory should include all offi ces, all records, and all nonrecord materials. An inventory that is incomplete or haphazard can only result in an inadequate schedule and loss of control over records. 10
The fi rst step in gaining control over an organization’s records and imple- menting IG measures to control and manage them is to complete an inventory of all groupings of business records, including electronic records, 11 at the system or fi le series level.
The focus of this book is on IG and more granually e-records, and when it comes to e-records, NARA has a specifi c recommendation: Inventory at the computer systems level. This differs from advice given by experts in the past.
The records inventory is the basis for developing a records retention schedule that spells out how long different types of records are to be held and how they will be archived or disposed of at the end of their life cycle. But fi rst you must determine where business records reside, how they are stored, how many exist, and how they are used in the normal course of business.
There are a few things to keep in mind when approaching the e-records invento- rying process:
■ Those who create and work with the records themselves are the best source of information about how the records are used. They are your most critical resource in the inventorying process.
■ RM is something that everyone wants done but no one wants to do (although everyone will have an opinion on how to do it).
■ The people working in business units are touchy about their records. It will take some work to get them to trust a new RM approach. 12
NARA recommends that electronic records are inventoried by information sys- tem, not by record series.
c09 155 February 28, 2014 6:23 PM
INFORMATION GOVERNANCE AND RECORDS 155
These knowledge workers are your best resource and can be your greatest allies or worst enemies when it comes to gathering accurate inventory data; developing a workable fi le plan; and keeping the records declaration, retention, and disposition process operating effi ciently. A sound RM program will keep the records inventory accurate and up to date.
Generally Accepted Recordkeeping Principles®
See Chapter 3 for more detail on applicable principles in IG. To summarize: It may be useful to use a model or framework to guide your records inventorying efforts. Such frameworks could be the D.I.R.K.S. (Designing and Implementing Recordkeeping Systems) used in Australia or the Generally Accepted Recordkeeping Principles® (or “the Principles”) that originated in the United States at ARMA International. The Principles are a “framework for managing records in a way that supports an organization’s immediate and future regulatory, legal, risk mitigation, environmental, and operational requirements. ” 13
Special attention should be given to creating an accountable, open inventorying process that can demonstrate integrity. The result of the inventory should help the or- ganization adhere to records retention, disposition, availability, protection, and com- pliance aspects of The Principles.
The Generally Accepted Recordkeeping Principles were created with the as- sistance of ARMA International and legal and IT professionals who reviewed and distilled global best practice resources. These included the international records management standard ISO15489–1 from the American National Standards Institute and court case law. The principles were vetted through a public call-for-comment process involving the professional records informa- tion management . . . community. 14
E-Records Inventory Challenges
If your organization has received a legal summons for e-records, and you do not have an accurate inventory, the organization is already in a compromising position: You do not know where the requested records might be, how many copies there might be, or the process and cost of producing them. Inventorying must be done sooner rather than later and proactively rather than reactively.
E-records present challenges beyond those of paper of microfi lmed records due to their (elec- tronic) nature :
1. You cannot see or touch them without searching online, as opposed to simply thumbing through a fi ling cabinet or scrolling through a roll of microfi lm.
What are The Principles? They are guidelines for information management and governance of record creation, organization, security, maintenance, and other activities used to effectively support the recordkeeping of an organization.
156 INFORMATION GOVERNANCE
c09 156 February 28, 2014 6:23 PM
2. They are not sitting in a central fi le room but rather may be scattered about on servers, shared network drives, or on storage attached to mainframe or minicomputers.
3. They have metadata attached to them that may distinguish very similar- looking records.
4. Additional “shadow” copies of the e-records may exist, and it is diffi cult to determine the true or original copy.15
Records Inventory Purposes
The completed records inventory contributes toward the pursuit of an organization’s IG ob- jectives in a number of ways : It supports the ownership, management, and control of s records; helps to organize and prepare for the discovery process in litigation; reduces exposure to business risk; and provides the foundation for a disaster recovery/business continuity plan.
Completing the records inventory offers at least eight additional benefi ts:
1. It identifi es records ownership and sharing relationships, both internal and external.
2. It determines which records are physical, electronic, or a combination of both. 3. It provides the basis for retention and disposition schedule development. 4. It improves compliance capabilities. 5. It supports training objectives for those handling records. 6. It identifi es vital and sensitive records needing added security and backup
measures. 7. It assesses the state of records storage, its quality and appropriateness. 8. It supports the release of information for Freedom of Information Act (FOIA),
Data Protection Act, and other mandated information release requirements for governmental agencies. 16
With respect to e-records, the purpose of the records inventory should include the following objectives:
■ Provide a survey of the existing electronic records situation. ■ Locate and describe the organization’s electronic record holdings. ■ Identify obsolete electronic records. ■ Determine storage needs for active and inactive electronic records. ■ Identify vital and archival electronic records, indicating need for their on-
going care. ■ Raise awareness within the organization of the importance of electronic
records management. ■ Lead to electronic record keeping improvements that increase effi ciency. ■ Lead to the development of a needs assessment for future actions. ■ Provide the foundation of a written records management plan with a de-
termination of priorities and stages of actions, ensuring the continuing im- provement of records management practices. 17
c09 157 February 28, 2014 6:23 PM
INFORMATION GOVERNANCE AND RECORDS 157
Records Inventorying Steps
NARA’s guidance on how to approach a records inventory applies to both physical and e-records.
The steps in the records inventory process are:
1. Defi ne the inventory’s goals. While the main goal is gathering information for scheduling purposes, other goals may include preparing for conversion to other media, or identifying particular records management problems.
2. Defi ne the scope of the inventory; it should include all records and other materials.
3. Obtain top management’s support , preferably in the form of a directive, and t keep management and staff informed at every stage of the inventory.
4. Decide on the information to be collected (the elements of the inventory). Ma-d terials should be located, described, and evaluated in terms of use.
5. Prepare an inventory form , or use an existing one. 6. Decide who will conduct the inventory, and train them properly. 7. Learn where the agency’s [or business’s] s fi les are located , both physically and d
organizationally. 8. Conduct the inventory. 9. Verify and analyze the results. s 18
Goals of the Inventory Project
The goals of the inventorying project must be set and conveyed to all stakeholders. At a basic level, the primary goal can be simply to generate a complete inventory for compli- ance and reporting purposes. It may focus on a certain business area or functional group or on the enterprise as a whole. An enterprise approach requires segmenting the effort into smaller, logically sequenced work efforts, such as by business unit. Perhaps the organization has a handle on its paper and microfi lmed records but e-records have been growing exponentially and spiraling out of control, without good policy guidelines or IG controls. So a complete inventory of records and e-records by system is needed, which may include e-records generated by application systems, residing in e-mail, created in offi ce documents and spreadsheets, or other potential business records. This is a tactical approach that is limited in scope.
The goal of the inventorying process may be more ambitious: to lay the ground- work for the acquisition and implementation of an ERM system that will manage the retention, disposition, search, and retrieval of records. It requires more business
The completed records inventory contributes toward the pursuit of an organi- zation’s IG objectives in a number of ways.
158 INFORMATION GOVERNANCE
c09 158 February 28, 2014 6:23 PM
process analysis and redesign, some rethinking of business classifi cation schemes or fi le plans, and development of an enterprise-wide taxonomy. This redesign will allow for more sharing of information and records; faster, easier, and more complete retrievals; and a common language and approach for knowledge professionals across the enter- prise to declare, capture, and retrieve business records.
The plan may be still much greater in scope and involve more challenging goals: That is, the inventorying of records may be the fi rst step in the process of implementing an orga- nization-wide IG program to manage and control information by rolling out ERM and IG systems and new processes; to improve litigation readiness and stand ready for e-discovery requests; and to demonstrate compliance adherence with business agility and confi dence. Doing this involves an entire cultural shift in the organization and a long-term approach.
Whatever the business goals for the inventorying effort, they must be conveyed to all stake- holders, and that message must be reinforced periodically and consistently, and through multiple means. It must be clearly spelled out in communications and presented in meetings as the overarching goal that will help the organization meet its business objectives. The scope of the inventory must be appropriate for the business goals and objectives it targets.
Scoping the Inventory
“With senior-level support, the records manager must decide on the scope of the re- cords inventory. A single inventory could not describe every electronic record in an organization; an appropriate scope might enumerate the records of a single program or divi- sion, several functional series across divisions, or records that fall within a certain time frame. ” [emphasis added.] 19 Most organizations have not deployed an enterprise-wide records management system, which makes the e-records inventorying process arduous and time-consuming. It is not easy to fi nd where all the electronic records reside—they are scattered all over the place, and on different media. But impending (and inevitable) litigation and compliance demands require that it be done. And, again, sooner has been proven to be better than later. Since courts have ruled that if lawsuits have been fi led against your competitors over a certain (industry-specifi c) issue, your organiza- tion should anticipate and prepare for litigation—which means conducting records inventories and placing a litigation hold on documents that might be relevant. Simply doing nothing and waiting on a subpoena is an avoidable business risk.
Whatever the business goals for the inventorying effort are, they must be con- veyed to all stakeholders, and that message must be reinforced periodically and consistently, and through multiple means.
An appropriate scope might enumerate the records of a single program or division, several functional series across divisions, or records that fall within a certain time frame.
c09 159 February 28, 2014 6:23 PM
INFORMATION GOVERNANCE AND RECORDS 159
A methodical, step-by-step approach must be taken—it is the only way to ac- complish the task. A plan that divides up the inventorying tasks into smaller, ac- complishable pieces is the only one that will work. It has been said, “How do you eat an elephant?” And the answer is “One bite at a time.” So scope the inventorying process into segments, such as a business unit, division, or information system/ application.
Management Support: Executive Sponsor
It is crucial to have management support to drive the inventory process to completion. There is no substitute for an executive sponsor. Asking employees to take time out for yet another survey or administrative task without having an executive sponsor will likely not work. Employees are more time-pressed than ever, and they will need a clear directive from above, along with an understanding of what role the inventorying pro- cess plays in achieving a business goal for the enterprise, if they are to take the time to properly participate and contribute meaningfully to the effort.
Information/Elements for Collection
During the inventory you should collect the following information at a minimum:
■ What kind of record it is—contracts, fi nancial reports, memoranda, etc. ■ What department owns it ■ What departments access it ■ What application created the record (e-mail, MS Word, Acrobat PDF) ■ Where it is stored, both physically (tape, server) and logically (network
share, folder) ■ Date created ■ Date last changed ■ Whether it is a vital record (mission-critical to the organization) ■ Whether there are other forms of the record (for example, a document
stored as a Word document, a PDF, and a paper copy) and which of them is considered the offi cial record
Removable media should have a unique identifi er and the inventory r should include a list of records on the particular volume as well as the characteristics of the volume, e.g., the brand, the recording format, the capacity and volume used, and the date of manufacture and date of last update.20 (Emphasis added.)
Additional information not included in inventories of physical records must be collected in any inventory of e-records.
160 INFORMATION GOVERNANCE
c09 160 February 28, 2014 6:23 PM
IT Network Diagram Laying out the overall topology of the IT infrastructure in the form of a network diagram is an exercise that is helpful in understanding where to target efforts and to map information fl ows. Creating this map of the IT infrastructure is a crucial step in inventorying e-records. It graphically depicts how and where computers are connected to each other and the software operating environments of various applications that are in use. This high-level diagram does not need to include every device; rather, it should indicate each type of device and how it is used.
The IT staff usually has a network diagram that can be used as a reference; per- haps after some simplifi cation it can be put into use as the underpinning for inventory- ing e-records. It does not need great detail, such as where network bridges and routers are located, but it should show which applications are utilizing the cloud or hosted applications to store and/or process documents and records.
In diagramming the IT infrastructure for purposes of the inventory, it is easiest to start in the central computer room where any mainframe or other centralized servers are located and then follow the connections out into the departments and business unit areas, where there may be multiple shared servers and drives supported a network of desktop personal computers or workstations.
Microsoft’s SharePoint® is a prevalent document and RM portal platform, and many organizations have SharePoint servers to house and process e-documents and records. Some utilities and tools may be available to assist in the inventorying process on SharePoint systems.
Mobile devices (e.g., tablets, smartphones, and other portable devices) that are processing documents and records should also be represented. And any e-records re- siding in cloud storage should also be included.
Creating a Records Inventory Survey Form
The record inventory survey form must suit its purpose. Do not collect data that is ir- relevant, but, in conducting the survey, be sure to collect all the needed data elements. You can use a standard form, but some customization is recommended. The sample records survey form in Figure 9.1 is wide ranging yet succinct and has been used suc- cessfully in practice.
If conducting the e-records portion of the inventory, the sample form may be somewhat modifi ed, as shown in Figure 9.2 .
Who Should Conduct the Inventory?
Typically, a RM project team is formed to conduct the survey, often assisted by re- sources outside of the business units. These may be RM and IT staff members, business analysts, members of the legal staff, outside specialized consultants, or a combination of these groups. The greater the cross-section from the organization, the better, and the more expertise brought to bear on the project, the more likely it will be completed thoroughly and on time.
Critical to the effort is that those conducting the inventory are trained in the survey methods and analysis, so that when challenging issues arise, they will have the resources and know-how to continue the effort and get the job done.
c09 161 February 28, 2014 6:23 PM
INFORMATION GOVERNANCE AND RECORDS 161
Department Information
1. What is the reporting structure of the department?
2. Who is the department liaison for the records inventory?
3. Who is the IT or business analyst liaison?
Record Requirements
4. Are there any external agencies that impose guidelines, standards or other requirements?
5. Are there specifi c legislative requirements for creating or maintaining records? Please provide a copy.
6. Is there a departmental records retention schedule?
7. What are the business considerations that drive recordkeeping? Regulatory requirements? Legal requirements?
8. Does the department have an existing records management policy? Guidelines? Procedures? Please provide a copy.
9. Does the department provide guidance to employees on what records are to be created?
10. How are policies, procedures and guidance disseminated to the employees?
11. What is the current level of employees’ awareness of their responsibilities for records management?
12. How are nonrecords managed?
13. What is the process for ensuring compliance with policies, procedures, and guidelines?
When an employee changes jobs/roles or is terminated?
14. Does the department have a classifi cation or fi le plans?
15. Are any records in the department confi dential or sensitive?
16. What information security controls does the department have for confi dential or sensitive records?
17. Does the department have records in sizes other than letter (8½×11)?
18. What is the cutoff date for the records?
Fiscal Year Calendar Year Other
19. Have department vital records been identifi ed?
20. Is there an existing business or disaster recovery policy?
21. Is the department subject to audits? Internal? External? Who conducts the audits?
22. Where and how are records stored?
Online? Near Line? Offl ine? On-site? Off-site? One location? Multiple locations?
23. How does the department ensure that records will remain accessible, readable, and useable throughout their scheduled retention period?
Technology and Tools
24. Are any tools used to track active records? Spreadsheets, word documents, databases, and so forth?
25. Are any tools used to track inactive records? Spreadsheets, word documents, databases, and so forth?
26. Does the department use imaging, document management, and so forth?
Disposition
27. Are there guidelines for destroying obsolete records?
Figure 9.1 Records Inventory Survey Form
(continued )
162 INFORMATION GOVERNANCE
c09 162 February 28, 2014 6:23 PM
Identifying Information
1. Name of system.
2. Program or legal authority for system.
3. System identifi cation or control number.
4. Person responsible for administering the system. Include e-mail, offi ce address, and phone contact info.
5. Date system put in service.
6. Business unit or agency supported by system.
7. Description of system (what does the application software do?).
8. Purpose of system.
System Inputs/Outputs
9. Primary sources of data inputs.
10. Major outputs of system (e.g., specifi c reports).
11. Informational content (all applicable): Description of data; applicability of data (people, places, things); geographic information; time span; update cycle; applications the system supports; how data are manipulated; key unit analysis for each fi le; public use or not?
12. Hardware confi guration.
13. Software environment, including revision levels, operating system, database, and so forth.
14. Indices or any classifi cation scheme/fi le plan that is in place?
15. Duplicate records? Location and volume of any other records containing the same information.
Record Requirements
16. Are there any external agencies that impose guidelines, standards, or other requirements?
17. Are their specifi c legislative requirements for creating or maintaining records? Please provide a copy.
18. Is there a departmental records retention schedule?
19. What are the business considerations that drive recordkeeping? Regulatory requirements? Legal requirements?
20. Does the department have an existing records management policy? Guidelines? Procedures? If so, please provide a copy.
28. What disposition methods are authorized or required?
29. How does disposition occur? Paper? Electronic? Other?
30. What extent does the department rely on each individual to destroy records? Paper? Electronic? Other?
Records Holds
31. What principles govern decisions for determining the scope of records that must be held or frozen for an audit or investigations?
32. How is the hold or freeze communicated to employees?
33. How are records placed on hold protected?
Figure 9.2 Electronic Records Inventory Survey Form
Figure 9.1 (continued )
Source: Charmain Brooks, IMERGE Consulting, e-mail to author, March 20, 2012.
c09 163 February 28, 2014 6:23 PM
INFORMATION GOVERNANCE AND RECORDS 163
Determine Where Records Are Located
The inventory process is, in fact, a surveying process, and it involves going physically out into the units where the records are created, used, and stored. Mapping out where the records are geographically is a basic necessity. Which buildings are they located in? Which offi ce locations? Computer rooms?
Also, the inventory team must look organizationally at where the records reside (i.e., de-y termine which departments and business units to target and prioritize in the survey process).
Conduct the Inventory
Several approaches can be taken to conduct the inventory, including three basic methods:
1. Distributing and collecting surveys 2. Conducting in-person interviews 3. Direct observation
21. How are nonrecords managed?
22. Are any records in the department confi dential or sensitive? How are they indicated or set apart?
23. What information security controls does the department have for confi dential or sensitive records?
24. What is the cutoff date for the records?
Fiscal Year Calendar Year Other
25. Have department vital records been identifi ed?
26. Is there an existing business or disaster recovery policy?
27. Is the department subject to audits? Internal? External? Who conducts the audits?
28. Where and how are records stored?
Online? Near line? Offl ine? On-site? Off-site? One location? Multiple locations?
29. How does the department ensure that records will remain accessible, readable, and useable throughout their scheduled retention period?
Disposition
30. Are there guidelines for destroying obsolete records?
31. What disposition methods are authorized or required?
32. How does disposition occur? Are electronic deletions verifi ed?
33. What extent does the department rely on each individual to destroy e-records?
Records Holds
34. What principles govern decisions for determining the scope of records that must be held or frozen for an audit or investigations?
35. How is the hold or freeze communicated to employees?
36. How are records placed on hold protected?
Figure 9.2 (continued )
Source: Adapted from: www.archives.gov/records-mgmt/faqs/inventories.html and Charmaine Brooks, IMERGE Consulting.
164 INFORMATION GOVERNANCE
c09 164 February 28, 2014 6:23 PM
Creating and distributing a survey form is traditional and proven way to collect e-records inventory data. This is a relatively fast and inexpensive way to gather the inventory data. The challenge is getting the surveys completed in a consistent fashion. This is where a strong executive sponsor can assist. The sponsor can make the survey a priority and tie it to business objectives, making the survey completion compulsory. The survey is a good tool, and it can be used to cover more ground in the data collection pro- cess. If following up with interviews, the survey form is a good starting point; responses can be verifi ed and clarifi ed, and more detail can be gathered.
Some issues may not be entirely clear initially, so following up with scheduled in- person interviews can dig deeper into the business processes where formal records are create and used. A good approach is to have users walk you through their typical day and how they access, use, and create records—but be sure to interview managers too, as managers and users have differing needs and uses for records. 21
You will need some direction to conduct formal observation, likely from IT staff or business analysts familiar with the recordkeeping systems and associated business processes. They will need to show you where business documents and records are created and stored. If there is an existing ERM system or other automated search and retrieval tools available, you may use them to speed the inventorying process.
When observing and inventorying e-records, starting in the server room and working outward toward the end user is a logical approach. Begin by enumerating the e-records created by enterprise software applications (such as accounting, enterprise resource planning, or customer relationship management systems), and work your way to the departmental or business unit applications, on to shared network servers, then fi nally out to individual desktop and laptop PCs and other mobile devices. With to- day’s smartphones, this can be a tricky area, due to the variety of platforms, operating systems, and capabilities. In a bring-your-own-device environment, records should not be stored on personal devices, but if they must be, they should be protected with tech- nologies like encryption or information rights management.
There are always going to be thorny areas when attempting to inventory e-records to determine what fi les series exist in the organization. Mobile devices and removable media may contain business records. These must be identifi ed and isolated, and any records on these media must be recorded for the inventory. Particularly troublesome are thumb or fl ash drives, which are compact yet can store 20 gigabytes of data or more. If your IG measures call for excluding these types of media, the ports they use can be blocked on PCs, tablets, smartphones, and other mobile computing devices. A sound IG program will con- sider the proper use of removable media and the potential impact on your RM program.22
The best approach for conducting the inventory is to combine the available inventorying methods, where possible. Begin by observing, distribute surveys, collect and analyze them, and then target key personnel for follow-up interviews and walk-throughs. Utilize whatever automated tools are available along the way. This approach is the most com- plete. Bear in mind that the focus is not on individual electronic fi les but rather, the fi le series level for physical records and the fi le series or system level for e-records (preferably the latter).
There are three ways to conduct the inventory: surveys, interviews, and observation. Combining these methods yields the best results.
c09 165 February 28, 2014 6:23 PM
INFORMATION GOVERNANCE AND RECORDS 165
Interviewing Programs/Service Staff Interviews are a very good source of records inventory information. Talking with actual users will help the records lead or inventory team to better understand how documents and records are created and used in everyday operations. Users can also report why they are needed—an exercise that can uncover some obsolete or unnecessary processes and practices. This is helpful in determining where e-records reside and how they are grouped in records series or by system and ultimately, the proper length of their retention period and whether they should be archived or destroyed at the end of their useful life. 23
Since interviewing is a time-intensive task, it is crucial that some time is spent in determining the key people to interview: Interviews not only take your time but oth- ers’ as well, and the surest way to lose momentum on an inventorying project is to have stakeholders believe you are wasting their time.
You need to interview representatives from all functional areas and levels of the program or service, including:
■ managers ■ supervisors ■ professional/technical staff ■ clerical/support staff
The people who work with the records can best describe to you their use. They will likely know where the records came from, whether copies exist, who needs the records, any computer systems that are used, how long the records are needed and other important information that you need to know to schedule the records.
Selecting Interviewees As stated earlier, it is wise to include a cross-section of staff, managers and frontline employees to get a rounded view of how records are created and used. Managers have a different perspective and may not know how workers utilize electronic records in their everyday operations.
A good lens to use is to focus on those who make decisions based on informa- tion contained in the electronic records and to follow those decision-based processes through to completion, observing and interviewing at each level.
For example, an application is received (mail room logs date and time), checked (clerk checks the application for completeness and enters into a computer sys- tem), verifi ed (clerk verifi es that the information on the application is correct), and approved (supervisor makes the decision to accept the application). These staff members may only be looking at specifi c pieces of the record and making decisions on those pieces.
Interview Scheduling and Tips One rule to consider is this: Be considerate of other people’s work time. Since they are probably not getting compensated for participating in the records inventory, the time you take to interview them is time taken away from compensated tasks they are
166 INFORMATION GOVERNANCE
c09 166 February 28, 2014 6:23 PM
evaluated on. So, once the interviewees are identifi ed, provide as much advance notice as possible, follow up to confi rm appointments, and stay within the scheduled time. Interviews should be kept to 20 to 60 minutes. Most of all—never be late!
Before starting any interviews, be sure to restate the goals and objectives of the inventorying process and how the resulting output will benefi t people in their jobs.
In some cases, it may be advisable to conduct interviews in small groups, not only to save time but to generate a discussion of how records are created, used, and stored. Some new insights may be gained.
Try to schedule interviews that are as convenient as possible for participants. That means providing participants with questions in advance and holding the interviews as close to their work area as possible. Do not schedule interviews back to back with no time for a break between. You will need time to consolidate your thoughts and notes, and, at times, interviews may exceed their planned time if a particularly enlightening line of questioning takes place.
If you have some analysis from the initial collection of surveys, share that with the interviewees so they can validate or help clarify the preliminary results. Provide it in advance, so they have some time to think about it and discuss it with their peers.
Sample Interview Questionnaire You’ll need a guide to structure the interview process. A good starting point is the sample questions presented in the questionnaire shown in Figure 9.3 . It is a useful tool that has been used successfully in actual records inventory projects.
Analyze and Verify the Results
Once collected, some follow-up will be required to verify and clarify responses. Often this can be done over the telephone. For particularly complex and important areas, a follow-up in person visit can clarify the responses and gather insights.
Once the inventory draft is completed, a good practice is to go out into the business units and/or system areas and verify what the fi ndings of the survey are. Once presented with fi ndings in black and white, key stakeholders may have ad- ditional insights that are relevant to consider before fi nalizing the report. Do not miss out on the opportunity to allow power users and other key parties to provide valuable input.
Be sure to tie the fi ndings in the fi nal report of the records inventory to the business goals that launched the effort. This helps to underscore the purpose and importance of the effort, and will help in getting that fi nal signoff from the executive sponsor that states the project is complete and there is no more work to do.
Depending on the magnitude of the project, it may (and should ) turn into a dd formal IG program that methodically manages records in a consistent fashion in accordance with internal governance guidelines and external compliance and legal demands.
Be sure to tie the fi ndings in the fi nal report of the records inventory to the business goals that launched the effort.
c09 167 February 28, 2014 6:23 PM
INFORMATION GOVERNANCE AND RECORDS 167
What is the mandate of the offi ce?
What is the reporting structure of the department?
Who is the department liaison for the records inventory?
Are there any external agencies that impose guidelines, standards, or other requirements?
Is there a departmental records retention schedule?
Are there specifi c legislative requirements for creating or maintaining records? Please provide a copy.
What are the business considerations that drives record keeping? Regulatory requirements? Legal requirements?
Does the department have an existing records management policy? Guidelines? Procedures?
Please provide a copy.
Does the department provide guidance to employees on what records are to be created?
What is the current level of awareness of employees their responsibilities for records management?
How are nonrecords managed?
Does the department have a classifi cation or fi le plans?
What are the business drivers for creating and maintaining records?
Where are records stored? Onsite? Offsite? One location? Multiple locations?
Does the department have records in sizes other than letter (8 ½×11)?
What is the cutoff date for the records?
Fiscal Year Calendar Year Other
Are any tools used to track active records? Excel, Access, and so forth?
Does the department use imaging, document management, and so forth?
Is the department subject to audits? Internal? External? Who conducts the audits?
Are any records in the department confi dential or sensitive?
Are their guidelines for destroying obsolete records?
What disposition methods are authorized or required?
How does disposition occur? Paper? Electronic? Other?
What extent does the department rely on each individual to destroy records?
Paper Electronic Other
What principles govern decisions for determining the scope of records that must be held or frozen for an audit or investigations?
How is the hold or freeze communicated to employees?
Figure 9.3 Sample Interview Questionnaire
Appraising the Value of Records Part of the process of determining the retention and disposition schedule of records is to appraise their value. Records can have value in different ways, which affects retention decisions.
Records appraisal is an analysis of all records within an agency [or business] to determine their administrative, fi scal, historical, legal, or other archival value. The purpose of this process is to determine for how long, in what format, and
Source: Charmaine Brooks, IMERGE Consulting, e-mail to author, March 20, 2012.
168 INFORMATION GOVERNANCE
c09 168 February 28, 2014 6:23 PM
under what conditions a record series ought to be preserved. Records appraisal is based upon the information contained in the records inventory. Records series shall be either preserved permanently or disposed of when no longer required for the current operations of an agency or department, depending upon:
■ Historical value or the usefulness of the records for historical research, in- cluding records that show an agency [or business] origin, administrative development, and present organizational structure.
■ Administrative value or the usefulness of the records for carrying on [a busi- ness or] an agency’s current and future work, and to document the develop- ment and operation of that agency over time.
■ Regulatory and statutory [value to meet] requirements. ■ Legal value or the usefulness of the records to document and defi ne legally
enforceable rights or obligations of [business owners, shareholders, or a] government and/or citizens.
■ Fiscal value or the usefulness of the records to the administration of [a busi- ness or] an agency’s current fi nancial obligations, and to document the de- velopment and operation of that agency over time
■ Other archival value as determined by the State [or corporate] Archivist. 24 (Emphasis added.)
Ensuring Adoption and Compliance of RM Policy
The inventorying process in not a one-shot deal: It is useful only if the records inven- tory is kept up to date, so it should be reviewed, at least annually. A process should be put in place so that business unit or agency heads notify the RM head/lead if a new fi le series or system has been put in place and new records collections are created. 25
[Five] tips can help ensure that a records management program achieves its goals:
1. Records management is everyone’s role. The volume and diversity of business records, from e-mails to reports to tweets, means that the person who cre- ates or receives a record is in the best [position] to classify it. Everyone in the organization needs to adopt the records management program.
2. Don’t micro-classify. Having hundreds, or possibly thousands, of records clas- sifi cation categories may seem like a logical way to organize the multitude of different records in a company. However, the average information worker, whose available resources are already under pressure, does not want to spend any more time than necessary classifying records. Having a few broad classifi cations makes the decision process simpler and faster.
Records appraisal is based on the information contained in the records inventory.
c09 169 February 28, 2014 6:23 PM
INFORMATION GOVERNANCE AND RECORDS 169
3. Talk the talk from the top on down. A culture of compliance starts at the top. Businesses should establish a senior-level steering committee comprised of executives from legal, compliance, and information technology (IT). A committee like this signals the company’s commitment to compliant re- cords management and ensures enterprise adoption.
4. Walk the walk, consistently. For compliance to become second nature, it needs to be clearly communicated to everyone in the organization, and policies and procedures must be accessible. Training should be rigorous and easily available, and organizations may consider rewarding compliance through fi nancial incentives, promotions and corporate-wide recognition.
5. Measure the measurable. The ability to measure adherence to policy and adoption of procedures should be included in core business operations and audits. Conduct a compliance assessment, including a gap analysis, at least once a year, and prepare an action plan to close any identifi ed holes.
The growth of data challenges a company’s ability to use and store its records in a compliant and cost-effective manner. Contrary to current practices, the solution is not to hire more vendors or to adopt multiple technologies. The key to compliance is consistency, with a unifi ed enterprise-wide approach for managing all records, regardless of their format or location. 26
So a steady and consistent IG approach that includes controls, audits, and clear communication is key to maintaining an accurate and current records inventory.
General Principles of a Retention Scheduling
We discussed records retention briefl y in Chapter 8 , mostly as it relates to legal research and determining retention and limitation periods. In this section we go more in depth.
A series of principles is common to all retention schedules: 27
■ The retention schedule must include all records. ■ Records scheduling includes all records, regardless of media or location.28 ■ All legal and regulatory requirements for records must be refl ected in the records
scheduling process. For public entities, retention scheduling fosters and enables the agency to comply with information requests (e.g., FOIA in the United States, Freedom of Information Act 2000 in the United Kingdom, Freedom of Informa- tion and Protection of Privacy Act and the Health Information Act in Canada, and Freedom of Information Amendment [Reform] Act 2010 in Australia).
■ Records scheduling is a “proactive” planning process, where schedules are set in place and standardized in advance.
■ Periodic review of the retention schedule must take place when signifi cant leg- islation, technology acquisitions, or other changes are being considered; but in any case this should be at least annually or biannually.
■ Records scheduling is a continuous process that needs updating and amending, based on legal, technology, or business changes over time.
■ Classifi cation and records scheduling are inextricably linked.
170 INFORMATION GOVERNANCE
c09 170 February 28, 2014 6:23 PM
Records retention defi nes the length of time that records are to be kept and considers legal, regulatory, operational, and historical requirements. 31
■ File series with similar characteristics or value should be assigned consistent and appropriate retention periods.
■ Records of historical value must be preserved. ■ Records retention periods should refl ect the business needs of users, the value
of the records, and any legal or compliance requirements. The best way to make these determinations is with a team that includes cross-functional rep- resentatives from RM, legal, risk, compliance, IT and business unit representa- tives, headed by an executive sponsor.
■ RM resource use is optimized, and costs are minimized by keeping records a minimum amount of time under a planned and controlled set of processes.
■ Records must be retained in a repository (fi le room or software system) where the record is protected (e.g., made read-only and monitored with an audit trail) so that the integrity of the record is maintained in a manner that meets all evidence and legal admissibility standards if or when litigation is encountered.
■ Senior management must approve of and sign off on the retention schedule and will be legally accountable for compliance with the schedule.
■ Senior management must be able to readily review retention schedules, policy documentation, and audit information to ensure users are in compliance with the retention schedule.
■ Complete documentation of scheduling requirements and activities must take place so that future users and archivists can view and track changes to the reten- tion schedule. 29
Developing a Records Retention Schedule
A records retention schedule defi nes the length of time that records are to be kept and considers legal, regulatory, operational, and historical requirements. 30 The retention schedule also includes direction as to how the length of time is calculated (i.e., the event or trigger that starts the clock [e.g., two years from completion of contract]). Legal re- search and opinions are required, along with consultation with owners and users of the records. Users typically overestimate the time they need to keep records, as they confuse the legal requirements with their own personal wishes. Some hard question- ing has to take place, since having these records or copies of records lying around the organization on hard drives, thumb drives, or in fi le cabinets may create liabilities for the organization.
Disposition means not just destruction but also can mean archiving and trans- fer and a change in ownership and responsibility for the records. The processes of archiving and preserving are an example where records may be handed over to a his- torical recordkeeping unit. At this time, the records may be sampled and only selective parts of the group of records may be retained.
c09 171 February 28, 2014 6:23 PM
INFORMATION GOVERNANCE AND RECORDS 171
A retention schedule allows for uniformity in the retention and disposition process, regardless of the media or location of the records.
Disposition means not just destruction but can also mean archiving and a change in ownership and responsibility for the records.
Why Are Retention Schedules Needed?
A retention schedule allows for uniformity in the retention and disposition process, regardless of the media or location of the records. Further, it tracks, enforces, and audits the retention and disposition of records while optimizing the amount of records kept to legal minimums, which saves on capital and labor costs, and reduces liability (by discarding unneeded re- cords that carry legal risk). 32 The Generally Accepted Recordkeeping Principles® state the critical importance of having a retention schedule (see the section “Generally Accepted Recordkeeping Principles” in Chapter 3 for more details) and provide guidelines for open collaboration in developing one. In the public sector, holding records that have passed their legally required retention period also can have negative ramifi cations and liabilities in meeting information service requests made during litigation, compliance actions, or, for example, under the U.S. FOIA, or similar acts in other countries.
Information Included on Retention Schedules
A retention schedule consists of these components:
■ Title of the record series ■ Descriptions of the records seriess ■ Offi ce responsible for the retention of the record (default is usually the offi ce of origin)e ■ Disposal decision —destroy, transfer to the archives, or, in exceptional circum-
stances, reconsider at a later (specifi ed) date ■ Timing of disposal —a minimum period for which the records should be retainedll
in the offi ce or in an off-site store before disposal action is undertaken ■ Event that triggers the disposal actions ■ Dates on which the schedule was agreed , signed, or modifi ed d ■ Legal citations or a link to a citation that reference the retention requirements of
that group of records
A sample of a simple records retention schedule is shown in Figure 9.4 .
Steps in Developing a Records Retention Schedule
If you already have existing retention schedules but are revising and updating them, there may be useful information in those schedules that can serve as a good reference
172 INFORMATION GOVERNANCE
c09 172 February 28, 2014 6:23 PM
point—but be wary, as they may be out of date and may not consider current legal requirements and business needs.
According to the U.S. National Archives, some key steps are involved in develop- ing retention schedules:
1. Review the functions and recordkeeping requirements for the [business unit or] agency or the organizational component of the agency whose records will be included on the schedule
2. Inventory the records. 3. Determine the period of time the records are needed for conducting [business
or] agency operations and meeting legal obligations 4. Draft disposition instructions including:
■ File cutoffs or fi le breaks (convenient points within a fi ling plan/system (end of a letter of the alphabet, end of year or month, etc.) at which fi les are separated for purposes of storage and/or disposition)
■ Retention periods for temporary records ■ Instructions for transferring permanent records to the National Archives
of the United States [or corporate archive for businesses] ■ Instructions for sending inactive records to off-site storage ■ Organize the schedule and clear it internally ■ Obtain approval from [your corporate archivist or] NARA [for federal
agencies], as well as from GAO if required by Title 8 of the GAO, “Policy and Procedures Manual for the Guidance of Federal Agencies.” 33
Records Retention Schedule ENVIRONMENTAL HEALTH AND SAFETY
December 10, 2015
Record Type Responsible Department
Event Retention Period
Accident/Injury Reports
Employee Medical Files
Includes: Accidents Diagnosis (Accident or Injury) First aid reports Injuries Medical reviews Occupational Health Incident Treatment and Progress (Accident or Injury) Work related accidents Workers health information Workers Compensation Claims
Includes: Audiology Lung Function Return to Work Authorization Related to: Employee Files (Active)
Health and Safety Programs Includes: Health and Safety Committee Health and Safety Reports
HR Date of Incident E+30
HR Termination E+30
Health and Safety
CY+10
Figure 9.4 Sample Records Retention Schedule Source: IMERGE Consulting, Inc.
c09 173 February 28, 2014 6:23 PM
INFORMATION GOVERNANCE AND RECORDS 173
What Records Do You Have to Schedule? Inventory and Classifi cation
Inventory and classifi cation are prerequisites for compiling a retention schedule. Be- fore starting work, develop an information map that shows where information is cre- ated, where it resides, and the path it takes. What records are created, who uses them, and how is their disposition handled? Questions like these will provide key insights in the development of the retention schedule. 34 Confi rm that the information map covers all the uses of the records by all parts of the organization, including use for account- ability, audit, and reference purposes.
In the absence of a formal information map, at a minimum you must compile a list of all the different types of records in each business area. This list should include information about who created them and what they are used for (or record provenance ), which parts of the organization have used them subsequently and for what purpose (its us- age), and the actual content.t
In the absence of any existing documentation or records inventory, you will need to conduct a records inventory or survey to fi nd out what records the business unit (or organization) holds. Tools are available to scan e-records folders to expedite the inventory process. A retention schedule developed in this way will have a shorter serviceable life than one based on an information map because it will be based on existing structures rather than functions and will remain usable only as long as the organizational structure remains unchanged.
Once a records inventory or survey is complete, building a records retention schedule begins with classifi cation of records. 35
This basic classifi cation can be grouped into three areas:
1. Business functions and activities 2. Records series 3. Document types
Business functions are basic business units such as accounting, legal, human re- sources, and purchasing. (See Appendix A, Information Organization and Classifi cation: Taxonomies and Metadata, for details on the process of developing classifi cations.) It basically answers this question: What were you doing when you created the record?
Tools are available to scan e-records folders to expedite the inventory process.
An information map is a critical fi rst step in developing a records retention schedule. It shows where information is created, where it resides, and who uses it.
174 INFORMATION GOVERNANCE
c09 174 February 28, 2014 6:23 PM
Business activities are the tasks performed to accomplish the business function. d Several activities may be associated with each function.
A records series is a group or unit of identical or related records that are normally used and fi led as a unit and that can be evaluated as a unit or business function for scheduling t purposes. 36
A document type is a term used by many software systems to refer to a group- ing of related records. When the records are all created by similar processes, then the document type is equivalent to the business functions or activities mentioned previously. However, “document type” often refers to the format of the record (e.g., presentation, meeting minutes). In this case, there is not enough information to determine a retention period because it is ambiguous regarding what type of work was being done when that document was created. Retention schedules require that record series be defi ned by business function and activity, not by record format or display type.
Rationale for Records Groupings
Records are grouped together for fundamental reasons to improve information orga- nization and access. These reasons include:
■ Grouping by “similar theme” for improved completeness ■ Improving information search speed and completeness ■ Increasing organizational knowledge and memory by providing the “context”
within which individual documents were grouped ■ Clearly identifying who the record owner or creator is and assigning and track-
ing responsibility for a group of records ■ Grouping records with the same retention requirements for consistent applica-
tion of disposition processes to records
Records Series Identifi cation and Classifi cation
After completing a records inventory including characterizing, descriptive informa- tion about the records such as their contents, use, fi le size, and projected growth vol- umes, you will need to interview staff in those target areas you are working with to determine more information about the specifi c organizational structure, its business functions, services, programs, and plans. 37
In the course of business, there are several different types of records series. There are case records , for example, which are characterized as having a beginning and
After completing an inventory, developing a retention schedule begins with records classifi cation.
c09 175 February 28, 2014 6:23 PM
INFORMATION GOVERNANCE AND RECORDS 175
an end but are added to over time. Case records generally have titles that include names, dates, numbers, or places. These titles do not provide insight into the nature of the function of the record series. Examples of case records include personnel fi les, mortgage loan folders, contract and amendment/addendum records, accident reports, insurance claims, and other records that accumulate and expand over time. Although the contents of case fi les may be similar, you should break out each type of case record under a unique title.
Subject records (also referred to as topic or function records ) “contain infor- mation relating to specifi c or general topics and that are arranged according to their informational content or by the function/activity/transaction they pertain to.”38 These types of records accumulate information on a particular topic or function to be added to the organization’s memory and make it easier for knowledge workers to fi nd infor- mation based on subject matter, topics, or business functions. Records such as those on the progression of relevant laws and statutes, policies, standard operating procedures, education and training have long-term reference value and should be kept until they are no longer relevant or are displaced by more current and relevant records. In a record retention schedule, the trigger event often is defi ned as “superseded or obsolete.” Records of this type that relate to “routine operations of a [project], program or ser- vice” do not have as much enduring value and should be scheduled to be kept for a shorter period.
Retention of E-Mail Records
Are e-mail messages records? This question has been debated for years. The short an- swer is no, not all e-mail messages constitute a record. But how do you determine whether certain messages are a business record or not? The general answer is that a record documents a transaction or business-related event that may have legal ramifi cations or historic value. Most important are business activities that may relate to compliance requirements or those that could possibly come into dispute in litigation. Particular consideration should be given to fi nancial transactions of any type.
Certainly evidence that required governance oversight or compliance activities have been completed needs to be documented and becomes a business record. Also, business transactions, where there is an exchange of money or the equivalent in goods or services is documented are also business records. Today, these transactions are often documented by a quick e-mail. And, of course, any contracts (and any pro- gressively developed or edited versions) that are exchanged through e-mail become business records.
The form or format of a potential record is irrelevant in determining whether it should be classifi ed as a business record. For instance, if a meeting of the board of directors is recorded by a digital video recorder and saved to DVD, it constitutes a
Not all e-mail messages are records; those that document a business transac- tion or progress toward it are clearly records and require retention.
176 INFORMATION GOVERNANCE
c09 176 February 28, 2014 6:23 PM
record. If photographs are taken of a ground-breaking ceremony for a new manufac- turing plant, the photos are records too. If the company’s founders tape-recorded a message to future generations of management on reel-to-reel tape, it is a record also, since it has historical value. But most records are going to be in the form of paper, microfi lm, or an electronic document.
Here are three guidelines for determining whether an e-mail message should be considered a business record:
1. The e-mail documents a transaction or the progress toward an ultimate transaction where anything of value is exchanged between two or more parties. All parts or char- acteristics of the transaction, including who (the parties to it), what, when, how much, and the composition of its components are parts of the transaction. Often seemingly minor parts of a transaction are found buried within an e-mail mes- sage. One example would be a last-minute discount offered by a supplier based on an order being placed or delivery being made within a specifi ed time frame.
2. The e-mail documents or provides support of a business activity occurring that pertains to internal corporate governance policies or compliance to externally mandated regulations.
3. The e-mail message documents other business activities that may possibly be disputed in the future, whether it ultimately involves litigation or not. (Most business disputes actually are resolved without litigation, provided that proof of your organization’s position can be shown.) For instance, your supplier may dispute the discount you take that was offered in an e-mail message and, once you forward the e-mail thread to the supplier, it acquiesces.
Managing e-mail business records is challenging, even for technology professionals. According to an AIIM and ARMA survey, fully two-thirds of records managers doubt that their IT departments really understand the concept of electronic records life cycle management. That is despite the fact that 70 percent of companies rely on IT professionals alone to manage their electronic records.
Although the signifi cance of e-mail in civil litigation cannot be overstated (it is the leading piece of evidence requested at civil trials today), one-third of IT managers state that they would be incapable of locating and retrieving e-mails that are more than one year old, d according to Osterman Research. 39
How Long Should You Keep Old E-Mails?
There are different schools of thought on e-mail retention periods and retention schedules. The retention and deletion of your electronic business records may be governed by laws or regulations. Unless your organization’s e-mail and ESI records are governed by law or regulations,
E-mail messages that document business activities, especially those that may be disputed in the future, should be retained as records.
c09 177 February 28, 2014 6:23 PM
INFORMATION GOVERNANCE AND RECORDS 177
your organization is free to determine the retention periods and deletion schedules that are most appropriate for your organization.40 If your organization’s e-mail retention periods are not specifi ed by law or regulation, consider keeping them for at least as long as you retain paper records. Many software providers provide automated software that allows e-mail messages to be moved to controlled repositories as they are declared to be records.
Destructive Retention of E-Mail
(We repeat this short section from Chapter 8 for those who are more focused on RIM than on legal functions.)
A destructive retention program is an approach to e-mail archiving where e-mail messages are retained for a limited time (say, 90 days), followed by the permanent manual or automatic deletion of the messages from the organization network, so long as there is no litigation hold or the e-mail has not been declared a record.
E-mail retention periods can vary from 90 days to as long as seven years:
■ Osterman Research reports that “nearly one-quarter of companies delete e- mail after 90 days.” 41
■ Heavily regulated industries, including energy, technology, communications, and real estate, favor archiving for one year or more, according to Fulbright and Jaworski research. 42
■ The most common e-mail retention period traditionally has been seven years; how- ever, some organizations are taking a hard-line approach and stating that e-mails will be kept for only 90 days or six months, unless it is declared as a record, classi- fi ed, and identifi ed with a classifi cation/retention category and tagged or moved to a repository where the integrity of the record is protected (i.e., the record cannot be altered and an audit trail on the history of the record’s usage is maintained)
Long-Term Archival Records
Inactive records that are have historical value or are essential for maintaining corporate memory must be kept the longest. Although they are not needed for present operations, they still have some value to the organization and must be preserved. When it comes to preserving electronic records, this process can be complex and technical. (See Chapter 17 for details.) If you have a corporate or agency archivist, his or her input is critical.43
Meeting Legal Limitation Periods
(This short section is repeated from Chapter 8 for those who are more focused on RIM than on legal functions.)
Destructive retention of e-mail is a method whereby e-mail messages are re- tained for a limited period and then destroyed.
178 INFORMATION GOVERNANCE
c09 178 February 28, 2014 6:23 PM
A key consideration in developing retention schedules is researching and deter- mining the minimum time required to keep records that may be demanded in legal actions. “A limitation period is the length of time after which a legal action cannot be brought before the courts. Limitation periods are important because they determine the length of time records must be kept to support court action [including subsequent appeal periods]. It is important to be familiar with the purpose, principles, and special circumstances that affect limitation periods and therefore records retention.” 44
Legal Requirements and Compliance Research
(Note: This section also appears in Chapter 8 but is included here for completeness.) Legal requirements trump all others. The retention period for a particular records
series must meet minimum retention requirements as mandated by law. Business needs and other considerations are secondary. So, legal research is required before determin- ing retention periods. Legally required retention periods must be researched for each jurisdiction (state, country) in which the business operates, so that it complies with all applicable laws.
In order to locate the regulations and citations relating to retention of records, there are two basic approaches. The fi rst approach is to use a records retention citation service, which publishes in electronic form all of the retention-related citations. These services usually are bought on a subscription basis, as citations are updated on an an- nual or more frequent basis as legislation and regulations change.
Figure 9.5 is an excerpt from a Canadian records retention database product called FILELAW®. In this case, the act, citation, and retention periods are clearly identifi ed.
Another approach is to search the laws and regulations directly using online or print resources. Records retention requirements for corporations operating in the United States may be found in the Code of Federal Regulations (CFR), the annual RR edition of which
is the codifi cation of the general and permanent rules published in the Fed- eral Register by the departments and agencies of the federal government. It is divided into 50 titles that represent broad areas subject to federal regulation. The 50 subject matter titles contain one or more individual volumes, which are updated once each calendar year, on a staggered basis. The annual update cycle is as follows: titles 1 to 16 are revised as of January 1; titles 17 to 27 are revised as of April 1; titles 28 to 41 are revised as of July 1, and titles 42 to 50 are revised as of October 1. Each title is divided into chapters, which usually bear the name of the issuing agency. Each chapter is further subdivided into parts that cover specifi c regulatory areas. Large parts may be subdivided into subparts. All parts are organized in sections, and most citations to the CFR refer to material at the section level. 45
There is an up-to-date version that is not yet a part of the offi cial CFR but is up- dated daily, the Electronic Code of Federal Regulations (e-CFR) . “It is not an offi cial legal edition of the CFR. The e-CFR is an editorial compilation of CFR material and Federal Register amendments produced by the National Archives and Records Admin- istration’s Offi ce of the Federal Register (OFR) and the Government Printing Offi ce.” 46
c09 179 February 28, 2014 6:23 PM
INFORMATION GOVERNANCE AND RECORDS 179
Event-Based Retention Scheduling for Disposition of E-Records
Event-based disposition is kicked off with the passage of an event, such as hiring or fi ring an employee, the end of a project, or the initiation of a lawsuit.
Event-based disposition can have an associated retention schedule, and the clock starts running once the event occurs. The required retention period begins only af- ter the triggering event occurs. The length of the retention period may be regulated by law, or it may be determined by IG guidelines set internally by the organization. So, when an employee is terminated, and personnel fi les are destroyed after (say) fi ve years, the retention schedule entry would be “Termination + 5 years.”
One other defi nition of event-based disposition comes from the U.S. e-records standard, Department of Defense 5015.2, which states that a disposition instruction in which a record is eligible for the specifi ed disposition (transfer or destroy) upon or immediately after the specifi ed event occurs. No retention period is applied and there is no fi xed waiting period, as with “timed” or combination “timed-event” dispositions. Example: “Destroy when no longer needed for current operations.” 47
Some hardware vendors, such as IBM and EMC, provide solutions that assist in executing event-based disposition with assistance from fi rmware (fi xed instructions on a microchip). The fi rmware-assisted solution should be considered if your RM or IG team aims to perform a complete and thorough retention solution analysis. These hardware-based solutions can potentially streamline the event-based disposi- tion process. 48
Event-based disposition begins with the passage of a triggering event.
Figure 9.5 Excerpt from Canadian Records Retention Database Source: Ontario, Electricity Act, FILELAW database, Thomson Publishers, May 2012.
180 INFORMATION GOVERNANCE
c09 180 February 28, 2014 6:23 PM
Triggering events may be record-related, “such as supersession or obsolescence.” This is common to a policy statement. For example, if a group of policies are to be destroyed fi ve years after superseded or obsolete, the old policy would be held for fi ve years after the new policy has been created.
Sounds simple. But in an attempt to meet retention requirements, organizations handle event-based triggers in different ways, ways that often are problematic. For in- stance, the trigger events often are not captured electronically and fed directly into the retention scheduling software or records repository to start the clock running, or the event itself is not well documented in the retention schedule so it is not consistently being applied and tracked. In other cases, the organization simply does not have the ERM functionality it needs to manage event-based triggers.
This causes many organizations to simply over-retain and keep the records indefi - nitely, or until disk storage is full, which means that those records are retained for an incorrect—and indefensible—time. The period is either too long or possibly too short, but it always is always inconsistent. s And inconsistent means legally indefensible.
The only prudent and defensible approach is to implement the proper IG policies to manage and control the implementation of event-based disposition.
Prerequisites for Event-Based Disposition
Three key prerequisite tasks must be completed before event-based disposition can be implemented:
1. Clarify trigger events. Not all of the events that can trigger the beginning of a retention period are as clear as the date an employee is terminated. For instance, “contract completion date” could be the day a vendor fi nishes work, when a fi nal invoice is rendered, when the invoice is paid, or some other period, such as 30 days following the payment of the fi nal invoice. These defi nitions, depending on the record series in question, may be regulated by law or governed by IG policies.
What is needed is an agreement as to what the defi nition is, so that the re- tention period will be uniform among the record series in question, providing a defensible policy.
To gain this agreement on these blurry areas, the RM lead/manager or team will need to work with the relevant business unit representatives, IT, compli- ance, risk management, and any other stakeholders.
The event triggers must be clear and agreed on so that they may kick off a retention period and disposition process.
In a number of cases, the answer to these questions will rely on trigger points, such as one year after completion or four months after the board of di- rectors’ meeting. It is important to choose a trigger point that you can implement. For example, there is no point in saying that records should be kept until an individual dies, if you have no reliable way of knowing the person is alive. Instead, choose a trigger point based on the information you have about the individual; in this case, the 100th birthday might be a suitable trigger point.
2. Automated capture of agreed-on trigger events must be performed and sent to the ERM. It is easy to know an employee’s termination date—most human re- sources management systems or payroll systems can supply it—but other
c09 181 February 28, 2014 6:23 PM
INFORMATION GOVERNANCE AND RECORDS 181
types of events are not so easily captured and may require some customiza- tion in order that this information is fed into an ERM. The metadata about the event must be seamlessly entered into the ERM so that it may launch the beginning of the retention period. If systems external to the ERM need to be interfaced, a common locator (e.g., contract number) can link the two.
3. The ERM systems must have complete retention and disposition capabilities. In order for the retention to start properly and run to fi nal disposition, this tracking ca- pability must be an inherent feature of the software. (In some cases, organiza- tions may use specialized retention and disposition software that can perform this task minimally without complete ERM functionality, but it falls short of the type of richness that a robust ERM system provides. What is needed is the ability to include the details or retention rules beyond simple date calculations (i.e., to store descriptive data or scope notes, and records series code in addi- tion to retention requirements, which are automatically associated with the retention rule, and to have a records hold and release capability). If destruc- tion is the fi nal disposition, then the system must be able to perform a deletion of the record (so long as there is no preservation or legal hold) with no traces that can allow reconstruction of it, and this process must be verifi able.
To accomplish clarity and agreement on event-based triggers requires close consultation and collaboration among RM staff, business units, IT, legal, com- pliance, risk management, and other stakeholders, as relevant.
Final Disposition and Closure Criteria
After completing the records values analysis and legislative and legal research, you must determine the closure criteria and fi nal disposition (e.g., destroy, transfer, archive) for each records series. To minimize costs and litigation risk, retention periods should be kept as short as possible while meeting all applicable regulatory, legal, and business requirements.49
Retention Periods: Online versus Offl ine
For e-records, retention periods may be segmented into active and inactive, or online and offl ine. Offl ine may be segmented further into on-site and off-site or archival storage.
Going back and combing through records retrieval requests and usage logs may provide helpful insights as to the needs of records users—but bear in mind that these logs may be misleading as users may have (in the past, before a formal IG program was implemented) kept shadow copies of fi les on their local hard drives or backed up to fl ash drives or other storage devices.
Closure Dates
A clear closure start date is required to kick off a retention period for any record, whether the retention is scheduled for on- or off-site. Calendar or fi scal year-ends are typical and practical closure dates for subject or topical records. The date used to indi- cate the start year is usually the date the fi le closed or the date of last use or update. In a university setting, school year-end may be more logical. Still, a reasoned analysis is re- quired to determine the best closure start date for subject records in your organization.
182 INFORMATION GOVERNANCE
c09 182 February 28, 2014 6:23 PM
Case records are different; logically, their closure date is set when a case record is completed (e.g., the date when an employee resigns, retires, or is terminated).
Future dates may be used, such as an employee promotion date, student gradua- tion, or project completion. After consulting those who create and handle the records series you are analyzing, apply good business judgment and common sense when de- termining closure dates. 50
Retaining Records Indefi nitely
There may be some vital, historical, or other critical records that, in the best interests of the organization, need to be retained permanently. This is rare, and storing records long term must be scrutinized heavily. If certain electronic records are to be retained indefi nitely or permanently, then LTDP policies and techniques must be used. (See Chapter 17 for more details.)
Retaining Transitory Records
Transitory documents usually do not rise to the level of becoming a record; they are temporary and are useful only in the short term, such as direct mail or e-mail adver- tising (brochures, price lists, etc.), draft documents (although not all are transitory, and some may need longer retention periods, such as draft contracts) and work in progress, duplicates, external publications (e.g., magazines, journals, newspapers, etc.), and temporary notices (e.g., company picnic, holiday party, or football pool). You must consider transitory records in your master records retention schedule.
Implementation of the Retention Schedule and Disposal of Records
Automated programs that interpret these retention periods are the best way to ensure that records are disposed of at the correct time and that an audit trail of the disposition is maintained.
Getting Acceptance and Formal Sign-off of the Retention Schedule
Upon completion of the records retention schedule, project management best prac- tices dictate that it be signed off by an executive or project sponsor, to indicate it has been completed and there is no more work to be done on that phase of the project. In addition, you may want to gain the sign-off and acceptance by other key stakehold- ers, such as senior representatives from legal, IT, the board of directors or executive committee, and perhaps audit and information governance. The schedule should be updated when new record types are introduced and, in any case, at least annually.
Disposition Timing: Records Disposal
It is much easier to time or schedule the disposal of e-records than of paper or physical records, but true and complete destruction of all traces of a record cannot be done
c09 183 February 28, 2014 6:23 PM
INFORMATION GOVERNANCE AND RECORDS 183
by hitting a simple “delete” key. There must be a process in place to verify the total destruction of all copies of the record. (See Chapter 17 for more details.) Records destruction can occur daily, routinely, or be scheduled at intervals (i.e., monthly or quarterly).
Automating Retention/Disposal Actions
ERM systems typically are capable of automatically executing a record deletion when a record has reached the end of its life cycle. Often these systems have a safety fea- ture that allows an operator who has the authority to review deletions before they are performed.
Disposal Date Changes
To make a retention schedule change, such as extending the life of a record series, IG controls must be in place. So, usually, ERM systems require that a person of higher authority than the system operator make these approvals. Every subsequent delay in destroying the records often requires an escalation in approval period to extend the time that records are kept past the destruction date.
Proving Record Destruction
In some environments, especially in the public sector, a certifi cate of destruction or other documentation is required to prove that a record and all its copies have been completely deleted (including its metadata—although at times it is benefi cial to retain metadata longer than the record itself; see Appendix A, “Information Organization and Classifi cation,” for more details). ERM systems can be confi gured to keep an audit trail and prove that destruction has occurred.
Ongoing Maintenance of the Retention Schedule
Records series are not static; they change, are added to, and are amended. New record functions emerge, based on changes in business, acquisitions, and divestitures. So it is necessary for organizations to review and update—at least annually—their records retention schedule.
In addition, retention requirements change as legislation changes, lawsuits are fi led, and the organization refi nes and improves its IG policies. Development of a re- cords retention schedule is not a one-time project; it requires attention, maintenance, and updating on a regular schedule, and using a controlled change process.
Audit to Manage Compliance with the Retention Schedule
Once your organization establishes records retention schedules for business units, or a master retention schedule, there must be IG policies in place to audit and ensure that policies are being followed. This is a key requirement of maintaining a legally defensible retention schedule that will hold up to legal challenges.
184 INFORMATION GOVERNANCE
c09 184 February 28, 2014 6:23 PM
CHAPTER SUMMARY: KEY POINTS
■ According to ISO, a record is “information created, received, and maintained as evidence and information by an organization or person, in pursuance of legal obligations or in the transaction of business.”
■ RM is “[the] fi eld of management responsible for the effi cient and system- atic control of the creation, receipt, maintenance, use, and disposition of records, including the processes for capturing and maintaining evidence of and information about business activities and transactions in the form of records.”
■ ERM includes the management of electronic and nonelectronic records, such as paper and other physical records.
■ ERM has become much more critical to enterprises with increased compli- ance legislation and massively increasing volumes of electronic information.
■ ERM follows the same basic principles as paper-based records management.
■ A number of factors provide the business rationale for ERM, including facilitat- ing compliance, supporting IG, and providing backup capabilities in the event of a disaster.
■ Implementing ERM is challenging since it requires user support and compli- ance, adherence to changing laws, and support for new information delivery platforms like mobile and cloud computing.
■ ERM benefi ts are both tangible and intangible or diffi cult to calculate.
■ Improved professionalism, preserving corporate memory, support for better decision making, and safeguarding vital records are key intangible benefi ts of ERM.
■ NARA recommends that e-records are inventoried by information system rather than fi le series, which is the traditional approach for physical records.
■ Generally Accepted Recordkeeping Principles® are “information management and governance of record creation, organization, security, maintenance and other activities used to effectively support recordkeeping of an organization.”
■ It may be helpful to use a record-keeping methodology such as the Principles or D.I.R.K.S. to guide inventorying efforts.
■ Perhaps the organization has a handle on their paper and microfi lmed records, but e-records have been growing exponentially and spiraling out of control.
■ Whatever the business goals for the inventorying effort are, they must be con- veyed to all stakeholders, and that message must be reinforced periodically and consistently, and through multiple means.
c09 185 February 28, 2014 6:23 PM
INFORMATION GOVERNANCE AND RECORDS 185
■ An appropriate scope might enumerate the records of a single program or division, several functional series across divisions, or records that fall within a certain time frame versus an entire enterprise.
■ The completed records inventory contributes toward the pursuit of an orga- nization’s IG objectives in a number of ways.
■ There are basic three ways to conduct the inventory: surveys, interviews, and observation. Combining these methods yields the best results.
■ Additional information not included in inventories of physical records must be collected in any inventory of e-records.
■ Be sure to tie the fi ndings in the fi nal report of the records inventory to the business goals that launched the effort.
■ Records appraisal is based on the information contained in the records inventory.
■ Records can have different types of value to organizations: historical, ad- ministrative, regulatory and statutory, legal, fi scal, or other archival value as determined by an archivist.
■ Consistency in managing records across an enterprise, regardless of media, format, or location, is the key to compliance.
■ A complete, current, and documented records retention program reduces storage and handling costs and improves searchability for records by making records easier and faster to fi nd.
■ Retention schedules are developed by records series—not for individual records.
■ Retention schedules are basic tools that allow an organization to prove that it has a legally defensible basis on which to dispose records.
■ The master retention schedule contains all records series in the entire enterprise.
■ Records retention defi nes the length of time that records are to be kept and considers legal, regulatory, operational, and historical requirements.
■ “Disposition” means not just destruction but can also mean archiving and a change in ownership and responsibility for the records.
■ An information map is a critical fi rst step in developing a records retention sched- ule. It shows where information is created, where it resides, and who uses it.
■ After inventorying, developing a retention schedule begins with records classifi cation.
■ All e-mail messages are not records; those that document a business transac- tion, or progress toward it, are clearly records and require retention.
■ E-mail messages that document business activities, especially those that may be disputed in the future, should be retained as records.
CHAPTER SUMMARY: KEY POINTS (Continued )
(continued)dd
186 INFORMATION GOVERNANCE
c09 186 February 28, 2014 6:23 PM
■ Destructive retention of e-mail is a method whereby e-mail messages are retained for a limited period and then destroyed.
■ Tools are available to scan e-records folders to expedite the inventorying process.
■ Assessing the relative value of records is key to determining their retention periods and disposition path.
■ Records have different types of value, such as fi nancial, legal, technical, and administrative/operational.
■ Event-based disposition begins with a triggering event.
■ Retention schedules, once established, must be maintained and updated to add new records series, as appropriate, and to comply with new or changed legislation and regulatory requirements.
■ Auditing to ensure compliance with established retention policies is key to maintaining a legally defensible records retention program.
CHAPTER SUMMARY: KEY POINTS (Continued )
Notes
1. International Organization for Standardization, ISO 15489-1: 2001 Information and Documentation— Records Management. Part 1: General (Geneva: ISO, 2001), section 3.15. l
2. Ibid., section 3.16 3. ARMA.org, “What Is Records Management?” 2009, www.arma.org/pdf/WhatIsRIM.pdf. (accessed
December 2, 2013). 4. Microsoft White Paper, “Records Management with Offi ce SharePoint Server,” 2007, www.microsoft
.com/en-us/download/details.aspx?id=15932, Used with permission from Microsoft. (accessed December 2, 2013).
5. Ibid. 6. Ibid. 7. Ibid. 8. U.S. Environmental Protection Agency, “Why Records Management? Ten Business Reasons,” updated
March 8, 2012, www.epa.gov/records/what/quest1.htm. 9. U.S. National Archives and Records Administration ,Disposition of Federal Records: A Records Management
Handbook , 2000, Web edition, www.archives.gov/records-mgmt/publications/disposition-of-federal- records/chapter-3.html.
10. Ibid. 11. State and Consumer Services Agency Department of General Services, Electronic Records Management
Handbook , State of California Records Management Program (February 2002), www.documents.dgs .ca.gov/osp/recs/ermhbkall.pdf .
12. U.S. Environmental Protection Agency, “Six Steps to Better Files,” updated March 8, 2012, www.epa .gov/records/tools/toolkits/6step/6step-02.htm .
13. Margaret Rouse, “Generally Accepted Recordkeeping Principles,” updated March 2011, http:// searchcompliance.techtarget.com/defi nition/Generally-Accepted-Recordkeeping-Principles-GARP (accessed March 19, 2012).
c09 187 February 28, 2014 6:23 PM
INFORMATION GOVERNANCE AND RECORDS 187
14. Ibid. 15. Ibid. 16. Public Record Offi ce, “ Guidance for an Inventory of Electronic Record Collections: A Toolkit,”
September 2000, www.humanrightsinitiative.org/programs/ai/rti/implementation/general/guidance_ for_inventory_elect_rec_collection.pdf, pp. 5–6.
17. Ibid. (accessed December 2, 2013). 18. National Archives, “Frequently Asked Questions about Records Inventories,” updated October 27, 2000,
www.archives.gov/records-mgmt/faqs/inventories.html . 19. William Saffady, “Managing Electronic Records, 4th ed.,” Journal of the Medical Library Association , 2009,
www.ncbi.nlm.nih.gov/pmc/articles/PMC2947138/ . 20. Jesse Wilkins, “The First Step: Inventory Your Electronic Records,” http://pr1vacy.blogspot
.mx/2005/11/fi rst-step-inventory-your-electronic.html (accessed October 11, 2012). 21. Ibid. 22. Ibid. 23. Quotes in this section are from Government of Alberta, Records and Information Management, www
.im.gov.ab.ca/index.cfm?page=imtopics/Records.html. (accessed December 2, 2013). 24. Maryland State Archives, “Retention Schedule Preparation,” June 1, 2012, www.msa.md.gov/msa/
intromsa/html/record_mgmt/retention_schedule.html . 25. National Health Service, “Connecting for Health,” www.connectingforhealth.nhs.uk/ (accessed
April 10, 2012). 26. Wortzman Nickle Professional Corporation, “Effective Records Management—Part 4—Ensuring
Adoption and Compliance of RM Policy,” 2009, www.wortzmannickle.com/ediscovery-blog/2011/12/14/ rmpart4/ (accessed April 12, 2012).
27. Government of Alberta, “Developing Retention and Disposition Schedules.” 28. National Archives, “Disposition of Federal Records.” 29. Government of Alberta, “Developing Retention and Disposition Schedules.” 30. National Archives, “Frequently Asked Questions about Records Scheduling and Disposition.” 31. Ibid. 32. University of Edinburgh, Records Management Section, July 5, 2012, www.recordsmanagement.ed.ac
.uk/InfoStaff/RMstaff/Retention/Retention.htm. 33. National Archives, “Frequently Asked Questions about Records Scheduling and Disposition.” http://
www.archives.gov/records-mgmt/faqs/scheduling.html#steps accessed December 2, 2013. 34. University of Edinburgh, Records Management Section. 35. National Archives, “Frequently Asked Questions about Records Scheduling and Disposition.” 36. University of Toronto Archives, “Glossary,” www.library.utoronto.ca/utarms/info/glossary.html
(accessed September 10, 2012). 37. Government of Alberta, “Developing Retention and Disposition Schedules.” 38. Ibid. 39. Marty Foltyn, “Getting Up to Speed on FRCP,” June 29, 2007, www.enterprisestorageforum.com/
continuity/features/article.php/3686491/Getting-Up-To-Speed-On-FRCP.htm. 40. Nancy Flynn, The E-Policy Handbook (New York: AMACOM, 2009), pp. 24–25. 41. ArcMail Blog http://arcmail.com/blog/archiving-rules-the-dangers-of-destructive-retention/ (accessed
Dec. 2, 2013). 42. Mary Flood, “Survey: They see a more litigious future,” October 18, 2010, http://blog.chron.com/
houstonlegal/2010/10/survey-they-see-a-more-litigious-future/ (accessed Dec. 2, 2013). 43. Ibid., pp. 127. 44. Government of Alberta, “Developing Retention and Disposition Schedules,” p. 122. 45. U.S. Government Printing Offi ce, Code of Federal Regulations , www.gpo.gov/help/index.html#about_s
code_of_federal_regulations.htm (accessed April 22, 2012). 46. U.S. National Archives and Records Administration, “Electronic Code of Federal Regulations,”
October 2, 2012, http://ecfr.gpoaccess.gov/cgi/t/text/text-idx?c=ecfr&tpl=%2Findex.tpl. 47. Department of Defense, “Design Criteria Standard for Electronic Records Management Software
Applications,” July 19, 2002, http://jitc.fhu.disa.mil/cgi/rma/downloads/p50152s2.doc. 48. Craig Rhinehart, IBM, e-mail to author, July 30, 2012. 49. Government of Alberta, “Records and Information Management.” 50. Ibid., p. 125.
189
c10 189 March 6, 2014 2:57 PM
C H A P T E R 10 Information Governance and Information Technology Functions
I nformation technology (IT) is a core function impacted by information gover-y nance (IG) efforts. IT departments typically have been charged with keeping the “plumbing” of IT intact—the network, servers, applications, and data—but although
the output of IT is in their custody, they have not been held to account for it; that is, the information, reports, and databases they generate have long been held to be owned by users in business units. This has left a gap of responsibility for governing the information that is being generated and managing it in accordance with legal and regulatory requirements, standards, and best practices.
Certainly, on the IT side, shared responsibility for IG means the IT department itself must take a closer look at IT processes and activities with an eye to IG. A focus on improving IT effi ciency, software development processes, and data quality will help contribute to the overall IG program effort. IT is an integral piece of the program.
Debra Logan, vice president and distinguished analyst at Gartner, states:
Information governance is the only way to comply with regulations, both cur- rent and future, and responsibility for it lies with the CIO and the chief legal offi cer. When organizations suffer high-profi le data losses, especially involv- ing violations of the privacy of citizens or consumers, they suffer serious repu- tational damage and often incur fi nes or other sanctions. IT leaders will have to take at least part of the blame for these incidents. 1
Gartner predicts that the need to implement IG is so critical that, by 2016, fully one in fi ve chief information offi cers (CIOs) will be terminated for their inability to implement IG successfully.
Aaron Zornes, chief research offi cer at the MDM (Master Data Management) Institute, stated: “While most organizations’ information governance efforts have fo- cused on IT metrics and mechanics such as duplicate merge/purge rates, they tend to ignore the industry- and business-metrics orientation that is required to ensure the economic success of their programs.” 2
Information Governance: Concepts, Strategies and Best Practices By Robert F. Smallwood Copyright © 2014 by Robert F. Smallwood
190 INFORMATION GOVERNANCE
c10 190 March 6, 2014 2:57 PM
Four IG best practices in this area can help CIOs and IT leaders to be successful in delivering business value as a result of IG efforts:
1. Don’t focus on technology, focus on business impact Technology often enthralls those in IT—to the point of obfuscating the
reason that technologies are leveraged in the fi rst place: to deliver business benefi t. So IT needs to reorient its language, its vernacular, its very focus when implementing IG programs. IT needs to become more business savvy, more businesslike, more focused on delivering business benefi ts that can help the organization to meet its business goals and achieve its business objectives. “Business leaders want to know why they should invest in an information gov- ernance program based on the potential resulting business outcomes, which manifest as increased revenues, lower costs and reduced risk.” 3
2. Customize your IG approach for your specifi c business, folding in any industry-specifi c best practices possible.
You cannot simply take a boilerplate IG plan, implement it in your orga- nization, and expect it to be successful. Sure, there are components that are common to all industries, but tailoring your approach to your organization is the only way to deliver real business value and results. That means embarking on an earnest effort to develop and sharpen your business goals, establish- ing business objectives that consider your current state and capabilities and external business environment and legal factors unique to your organization. It also means developing a communications and training plan that fi ts with your corporate culture. And it means developing meaningful metrics to mea- sure your progress and the impact of the IG program, to allow for continued refi nement and improvement.
3. Make the business case for IG by tying it to business objectives To garner the resources and time needed to implement an IG program, you
must develop a business case in real, measureable terms. The business case must be presented in order to gain executive sponsorship, which is an essential component of any IG effort. Without executive sponsorship, the IG effort will fail. Making the business case and having metrics to measure progress and success toward meeting business objectives are absolute musts.
4. Standardize use of business terms IG requires a cross-functional effort, so you must be speaking the same
language, which means the business terms you use in your organization must be standardized. This is the very minimum to get the conversation started. But IG efforts will delve much more deeply into information organization and seek to standardize the taxonomy for organizing documents and records and even the metadata fi elds that describe in detail those document and records across the enterprise.
Overall, being able to articulate the business benefi ts of your planned IG program will help you recruit an executive sponsor, help the program gain traction and support, and help you implement the program successfully. 4
Several key foundational programs should support your IG effort in IT, includ- ing data governance, master data management (MDM), and implementing accepted IT standards and best practices. We will now delve into these concepts in more detail.
INFORMATION GOVERNANCE AND INFORMATION TECHNOLOGY FUNCTIONS 191
c10 191 March 6, 2014 2:57 PM
Data Governance
We touched on data governance in Chapter 2 . Data is big, data is growing, data is valu- able, and the insights that can be gained by analyzing clean, reliable data with the latest analytic tools are a sort of new currency. There are nuggets of gold in those mountains of data. And leveraging those discoveries can provide a sustainable competitive advan- tage in areas such as customer acquisition, customer retention, and customer service.
The challenge is largely in garnering control over data and in cleaning, secur- ing and protecting it; doing so requires effective data governance strategies. But data governance is not only about cleaning and securing data; it is also about delivering it to the right people at the right time (sometimes this means in realtime) to provide strategic insights and opportunities. If a data governance program is successful, it can add profi ts directly to the bottom line. 5
Data governance involves processes and controls to ensure that information at the data level—raw data that the organization is gathering and inputting—is true and accurate, and unique (not redundant). It involves data cleansing ( or data scrubbing) gg to strip out corrupted, inaccurate, or extraneous data and de-duplication to eliminate redundant occurrences of data.
Data governance focuses on information quality from the ground up (at the low-y est or root level), so that subsequent reports, analyses and conclusions are based on clean, reliable, trusted data (or records) in database tables. Data governance is the most fundamental level at which to implement IG. Data governance efforts seek to ensure that formal management controls—systems, processes, and accountable employees who are stewards and custodians of the data—are implemented to govern critical data assets to improve data quality and to avoid negative downstream effects of poor data.
Data governance is a newer, hybrid quality control discipline that includes elements of data quality, data management, IG policy development, business process improve- ment, and compliance and risk management.
Good data governance programs should extend beyond the enterprise to include external stakeholders (suppliers, customers) so an organization has its fi nger on the pulse of its extended operations. In other words, enforcing data governance at the ear- liest possible point of entry—even external to the organization—can yield signifi cant effi ciencies and business benefi ts downstream. And combining data governance with real-time analytics and business intelligence (BI) software not only can yield insights into signifi cant and emerging trends but also can provide solid information for deci- sion makers to use in times of crisis—or opportunity.
Focusing on business impact and customizing your IG approach to meet business objectives are key best practices for IG in the IT department.
Effective data governance can yield bottom-line benefi ts derived from new insights.
192 INFORMATION GOVERNANCE
c10 192 March 6, 2014 2:57 PM
Steps to Governing Data Effectively
Nine key steps you can take to govern data effectively are listed next. The fi rst fi ve are based on recommendations by Steven Adler in CIO Magazine:
1. Recruit a strong executive sponsor. As in broader IG efforts, data governance re- quires cross-functional collaboration with a variety of stakeholders. To drive and facilitate this sometimes contentious conversation, a strong executive sponsor is required. This is not an easy task since executives generally do not want to deal with the minutia at the data level. You must focus on the realiz- able business benefi ts of improved data governance (i.e., specifi c applications that can assist in customer retention, revenue generation, and cost cutting).
2. Assess your current state. Survey the organization to see where the data reposi- tories or silos of data are, what problems related to data exist, and where some opportunities to improve lie. Document where your data governance program stands today and then map out your road to improvement in fundamental steps.
3. Set the ideal state vision and strategy. Create a realistic vision of where your organization wants to go in its data governance efforts, and clearly articulate the business benefi ts of getting there. Articulate a measureable impact. Track your progress with metrics and milestones.
4. Compute the value of your data. Try to put some hard numbers to it. Calculate some internal numbers on how much value data—good data—can add to specifi c business units. Data is unlike other assets that you can see or touch (cash, buildings, equipment, etc.), and it changes daily, but it has real value.
5. Assess risks. What is the likelihood and potential cost of a data breach? A major breach? What factors come into play and how might you combat these potential threats? Perform a risk assessment to rank and prioritize threats and assign probabilities to those threats so you may fashion appropriate strategies to counter them.
6. Implement a going-forward strategy. It is a signifi cantly greater task to try to improve data governance across the enterprise for existing data, versus a smaller business unit. 6 Remember, you may be trying to fi x years if not decades of bad behavior, mismanagement, and lack of governance. Taking an “incre- mental approach with an eye to the future” provides for a clean starting point and can substantially reduce the pain required to implement. A strategy where new data governance policies for handling data are implemented beginning on a certain future date is a proven best practice.
7. Assign accountability for data quality to business units, not IT. Typically, IT has had responsibility for data quality, yet the data generation is mostly not under that department’s control, since most is created out in the business units. A pointed effort must be made to push responsibility and ownership for data to the business units that create and use the data.
8. Manage the change. Educate, educate, educate. People must be trained to understand why the data governance program is being implemented and how it will benefi t the business. The new policies represent a cultural change, and supportive program messages and training are required to make the shift.
9. Monitor your data governance program. See where shortfalls might be, and con- tinue to fi ne-tune the program. 7
INFORMATION GOVERNANCE AND INFORMATION TECHNOLOGY FUNCTIONS 193
c10 193 March 6, 2014 2:57 PM
From a risk management perspective, data governance is a critical activity that supports decision makers and can mean the difference between retaining a customer and losing one. Protecting your data is protecting the lifeblood of your business, and improving the quality of the data will improve decision making, foster compliance efforts, and yield competitive advantages.
Data Governance Framework
The Data Governance Institute has created a data governance framework, a visualk model to help guide planning efforts and a “logical structure for classifying, organiz- ing, and communicating complex activities involved in making decisions about and taking action on enterprise data.” 8 (See Figure 10.1 .) The framework applies more to
Good data governance ensures that downstream negative effects of poor data are avoided and that subsequent reports, analyses, and conclusions are based on reliable, trusted data.
Figure 10.1 DGI Data Governance Framework™ Source: The Data Governance Institute (datagovernance.com).
194 INFORMATION GOVERNANCE
c10 194 March 6, 2014 2:57 PM
larger organizations, which have greater complexity, greater internal requirements, and greater, more complex regulatory demands. It allows for a conceptual look at data governance processes, rules, and people requirements.
Information Management
Information management is a principal function of IT. It is complex and spans a t number of subdisciplines but can be defi ned as the “application of management tech- niques to collect information, communicate it within and outside the organization, and process it to enable managers to make quicker and better decisions.” 9 It is about managing information, which is more than just collecting and processing data from varying sources and distributing it to various user audiences. It includes a number of subcomponent tasks, including these four:
1. Master data management (MDM) is a key process for IG success in the IT de-t partment, which extends to involved business units. An emerging discipline, MDM came into prominence around 2010 to 2012, coinciding with the Big Data trend. The goal of MDM is to ensure that reliable, accurate data from a single source is leveraged across business units. That is, a key aim is to establish a “single version of the truth”10 and eliminate multiple, inconsistent versions of data sets, which are more common than most might think, especially in larger organizations with physically distributed operations and large numbers of servers and databases. 11 MDM gets to the core of data integrity issues, es-y sentially asking “Is this data true and accurate? Is this the best and only, fi nal version?” MDM grew from the need to create a standardized, “discrete disci- pline” to ensure there was a single version to base BI analyses on and to base decisions on. 12 According to Gartner, MDM is a technology-enabled disci- pline in which business and IT work together to ensure the uniformity, accu- racy, stewardship, semantic consistency and accountability of the enterprise’s offi cial shared master data assets. Master data is the consistent and uniform set of identifi ers and extended attributes that describes the core entities of the en- terprise, including customers, prospects, citizens, suppliers, sites, hierarchies and chart of accounts. 13
What is the business impact? How are operations enhanced and how does that contribute to business goals? One set of reliable, clean data is critical to delivering quality customer service, reducing redundant efforts and therefore operational costs, improving decision making, and even po- tentially lowering product and marketing costs. “A unifi ed view of custom- ers, products, or other data elements is critical to turning these business goals into reality.” 14
Again, the larger the organization, the greater the need for MDM.
Master data management is a key IG process in IT.
INFORMATION GOVERNANCE AND INFORMATION TECHNOLOGY FUNCTIONS 195
c10 195 March 6, 2014 2:57 PM
2. Information lifecycle management (ILM) is managing information appropriately t and optimally at different stages of its useful life, from creation through distribution and use, including meeting legal and regulatory requirements, and through its fi nal disposition, which can be destruction, archiving, or transfer to another entity. Organizations historically over-retain informa- tion; however, studies show that information quickly loses its value and that once data has aged 10 to 15 days, the likelihood it will be used again is around 1 percent. 15 Based on its use characteristics, differing storage management strategies are appropriate. It defi es business logic to manage information that has little value with as much IT resource as information that is high value. Doing so is a misuse of resources . To execute ILM properly, the value of s certain data sets and records must be appraised and policies must be formed to manage it, recognizing that information value changes over the life cycle, which requires varying strategies and resource levels.16 ILM conceptually includes and can begin with MDM and is linked to compliance require- ments and capabilities.
3. Data architecture refers to the “design of structured and unstructured infor- mation systems” 17 in an effort to optimize data fl ow between applications and systems so that they are able to process data effi ciently. Further, data architecture uses data modeling, standards, IG policies, and rules for gov- erning data and how it populates databases and how those databases and applications are structured.18 Some key issues to uncover when researching data architecture and design include data structure, or schema , which da- tabases are used (e.g., Oracle Database 11g, DB2, SQL Server), methods of query and access (e.g., SQL), the operating systems the databases operate on, and even their hardware (which can affect data architecture features and capabilities).
4. Data modeling can be complex, yet it is an important step in overall IG for g the IT department. It “illustrates the relationships between data.” Data modeling is an application software design process whereby data processes and fl ows between applications are diagrammed graphically in a type of fl owchart that formally depicts where data is stored, which applications share it, where it moves, and the interactions regarding data movement between applications. “Data modeling techniques and tools capture and translate complex system designs into easily understood representations of the data fl ows and processes, creating a blueprint for construction and/ or re-engineering.” 19 Good data models allow for troubleshooting before applications are written and implemented.
The importance of data modeling as a foundation for the application devel- opment process is depicted in Figure 10.2 .
Once the data model is developed, business rules and logic can be applied through application development. A user interface is constructed for the appli- cation, followed by movement of data or e-documents through work steps us- ing work fl ow capabilities, and then integration with existing applications (e.g., enterprise resource planning or customer relationship management systems). Typically this is accomplished through an application programming inter- face, a sort of connector that allows interaction with other applications and databases.
196 INFORMATION GOVERNANCE
c10 196 March 6, 2014 2:57 PM
There are six approaches to data modeling:
1. Conceptual. The conceptual approach merely diagrams data relationships at the “highest level” 20 showing the storage, warehousing, and movement of data between applications.
2. Enterprise. The enterprise approach is a more business-oriented version of conceptual data modeling that includes specifi c requirements for an enter- prise or business unit.
3. Logical. Pertinent to the design and architecture of physical storage, logical data modeling “illustrates the specifi c entities, attributes and relationships in- volved in a business function.”
4. Physical. The physical approach depicts the “implementation of a logical data model” relative to a specifi c application and database system.
5. Data integration. This approach is just what it says; it involves merging data from two or more sources, processing the data, and moving it into a database. “This category includes Extract, Transform, and Load (ETL) capabilities.” 21
6. Reference data management. This approach often is confused with MDM, although they do have interdependencies. Reference data is a way to refer to data in categories (e.g., having lookup tables— standard industry classifi cation or SIC codes) to insert values, 22 and is used only to “categorize other data found in a database, or solely for relating data in a database to information beyond the boundaries of the enterprise.” 23 So reference data is not your actual data itself but a reference to categorize data.
Figure 10.3 shows different categories of data.
IT Governance
As introduced in Chapter 2 , IT governance is about effi ciency and value creation. IT governance is the primary way that stakeholders can ensure that investments in IT create
Figure 10.2 Key Steps from Data Modeling to Integration Source: Reproduced from Orangescape.com ( www.orangescape.com/wp-content/uploads/2010/10/ Application-Development-Lifecycle-OrangeScape.png ).
Data Model Business Logic
User Interface
Work Flows Integration
INFORMATION GOVERNANCE AND INFORMATION TECHNOLOGY FUNCTIONS 197
c10 197 March 6, 2014 2:57 PM
business value and contribute toward meeting business objectives.24 This strategic align- ment of IT with the business is challenging yet essential. IT governance programs go further and aim to “improve IT performance, deliver optimum business value and ensure regulatory compliance.” 25
Although the CIO typically has line responsibility for implementing IT gover- nance, the chief executive offi cer and board of directors must receive reports and up- dates to discharge their responsibilities for IT governance and to see that the program is functioning well and providing business benefi ts.
The focus of governance in IT is on the actual software development and mainte- nance activities of the IT department or function, and IT governance efforts focus on making IT effi cient and effective. That means minimizing costs by following proven software development methodologies and best practices, principles of data governance and information quality, and project management best practices while aligning IT efforts with the business objectives of the organization.
IT Governance Frameworks
Several IT governance frameworks can be used as a guide to implementing an IT governance program.
Although frameworks and guidance like CobiT® and T ITIL have been widely adopted, there is no absolute standard IT governance framework; the combination that works best for your organization depends on business factors, corporate culture, IT maturity, and staffi ng capability. The level of implementation of these frameworks will also vary by organization.
Figure 10.3 Categories of Data Source: http://www.information-management.com/issues/20060401/1051002-1.html?zkPrintable =1&nopagination=1
Increasing: DATABASE
Semantic content Metadata Most relevant
to design
Most relevant to outside world
Most relevant to business
Most relevant to technology
Reference Data
Master Data
Enterprise Structure Data
Transaction Activity Data
Transaction Audit Data
Data quality importance
Volume of data
Rates of update
Population later in time
Shorter life span
IT governance seeks to align business objectives with IT strategy to deliver business value.
198 INFORMATION GOVERNANCE
c10 198 March 6, 2014 2:57 PM
CobiT®
CobiT (Control Objectives for Information and related Technology) is a process-T based IT governance framework that represents a consensus of experts worldwide. It was codeveloped by the IT Governance Institute and ISACA. CobiT addresses busi- ness risks, control requirements, compliance, and technical issues.26
CobiT offers IT controls that:
■ Cut IT risks while gaining business value from IT under an umbrella of a glob- ally accepted framework.
■ Assist in meeting regulatory compliance requirements. ■ Utilize a structured approach for improved reporting and management deci-
sion making. ■ Provide solutions to control assessments and project implementations to
improve IT and information asset control. 27
CobiT consists of detailed descriptions of processes required in IT and tools to measure progress toward maturity of the IT governance program. It is industry agnos- tic and can be applied across all vertical industry sectors, and it continues to be revised and refi ned. 28
CobiT is broken into three basic organizational levels and their responsibilities: (1) board of directors and executive management; (2) IT and business management; and (3) line-level governance, security, and control knowledge workers.29
The CobiT model draws on the traditional “plan, build, run, monitor” paradigm of traditional IT management, only with variations in semantics. There are four IT domains in the COBIT framework, which contain 34 IT processes and 210 control objectives that map to the four specifi c IT processes of:
1. Plan and organize. 2. Acquire and implement. 3. Deliver and support. 4. Monitor and evaluate.
Specifi c goals and metrics are assigned, and responsibilities and accountabilities are delineated.
The CobiT framework maps to ISO 17799 of the International Organization for Standardization and is compatible with Information Technology Infrastructure Library (ITIL) and other accepted practices in IT development and operations. 30
COBIT 5
Released in 2012, CobiT 5 is the latest version of the business framework for the gov- ernance of IT from ISACA. CobiT 5
builds and expands on COBIT 4.1 by integrating other major frameworks, standards and resources, including ISACA’s Val IT and Risk IT, Information Technology Infrastructure Library (ITIL®) and related standards from the International Organization for Standardization (ISO). 31
INFORMATION GOVERNANCE AND INFORMATION TECHNOLOGY FUNCTIONS 199
c10 199 March 6, 2014 2:57 PM
Key Principles and Enablers “CobiT 5 is based on fi ve key principles for governance and management of enterprise IT:
■ Principle 1: Meeting Stakeholder Needs ■ Principle 2: Covering the Enterprise End-to- End ■ Principle 3: Applying a Single, Integrated Framework ■ Principle 4: Enabling a Holistic Approach ■ Principle 5: Separating Governance From Management
The CobiT 5 framework describes seven categories of enablers:
■ Principles, policies and frameworks are the vehicle to translate the desired behavior into practical guidance for day-to-day management.
■ Processes describe an organized set of practices and activities to achieve cer- tain objectives and produce a set of outputs in support of achieving overall IT-related goals.
■ Organizational structures are the key decision-making entities in an enterprise.
■ Culture, ethics and behavior of individuals and of the enterprise are very oftenr underestimated as a success factor in governance and management activities.
■ Information is required for keeping the organization running and well gov- erned, but at the operational level, information is very often the key product of the enterprise itself.
■ Services, infrastructure and applications include the infrastructure, technol- ogy and applications that provide the enterprise with information technology processing and services.
People, skills and competencies are required for successful completion of all activi- ties, and for making correct decisions and taking corrective actions.” 32
ValIT®
ValIT is a newer value-oriented framework that is compatible with and complemen- tary to CobiT. Its principles and best practices focus is on leveraging IT investments to gain maximum value. Forty key ValIT essential management practices (analogous to CobiT’s control objectives) support three main processes: value governance, port- folio management, and investment management. ValIT and CobiT “provide a full framework and supporting tool set to help managers develop policies to manage
CobiT 5 is the latest version of the business framework for the governance of IT. It has just fi ve principles and seven enablers.
200 INFORMATION GOVERNANCE
c10 200 March 6, 2014 2:57 PM
business risks and deliver business value while addressing technical issues and meeting control objectives in a structured, methodic way.” 33
ValIT Integrated with CobiT 5
The ValIT framework has been folded into the CobiT 5 framework. 34 For more de- tails, you may download free or acquire publications and operational tools on this and related topics at isaca.org.
Key functions of ValIT include:
■ Defi ne the relationship between IT and the business and those functions in the organization with governance responsibilities;
■ Manage an organization’s portfolio of IT-enabled business investments; ■ Maximize the quality of business cases for IT-enabled business investments
with particular emphasis on the defi nition of key fi nancial indicators, the quantifi cation of “soft” benefi ts and the comprehensive appraisal of the downside risk.
Val IT addresses assumptions, costs, risks and outcomes related to a balanced portfolio of IT-enabled business investments. It also provides benchmarking capability and allows enterprises to exchange experiences on best practices for value management. 35
ITIL
ITIL is a set of process-oriented best practices and guidance originally developed in the United Kingdom to standardize delivery of IT service management. ITIL is applicable to both the private and public sectors and is the “most widely accepted ap- proach to IT service management in the world.” 36 As with other IT governance frame- works, ITIL provides essential guidance for delivering business value through IT, and it “provides guidance to organizations on how to use IT as a tool to facilitate business change, transformation and growth.” 37
ITIL best practices form the foundation for ISO/IEC 20000 (previously BS 15000), the International Service Management Standard for organizational certifi cation and compliance. 38 ITIL 2011 is the latest revision (as of this writing).
CobiT is process-oriented and has been widely adopted as an IT governance framework. ValIT is value-oriented and compatible and complementary with CobiT yet focuses on value delivery.
The Val IT framework has been folded into the COBIT 5 framework.
INFORMATION GOVERNANCE AND INFORMATION TECHNOLOGY FUNCTIONS 201
c10 201 March 6, 2014 2:57 PM
It consists of fi ve core published volumes that map the IT service cycle in a systematic way:
1. ITIL Service Strategy 2. ITIL Service Design 3. ITIL Service Transition 4. ITIL Service Operation 5. ITIL Continual Service Improvement
ISO 38500
ISO/IEC 38500:2008 is an international standard that provides high-level principles and guidance for senior executives and directors, and those advising them, for the effec- tive and effi cient use of IT. 39 Based primarily on AS 8015, the Australian IT governance standard, it “applies to the governance of management processes” performed at the IT service level, but the guidance assists executives in monitoring IT and ethically discharg- ing their duties with respect to legal and regulatory compliance of IT activities.
The ISO 38500 standard comprises three main sections:
1. Scope, Application and Objectives 2. Framework for Good Corporate Governance of IT 3. Guidance for Corporate Governance of IT
It is largely derived from AS 8015, the guiding principles of which were:
■ Establish responsibilities ■ Plan to best support the organization ■ Acquire validly ■ Ensure performance when required ■ Ensure conformance with rules ■ Ensure respect for human factors
The standard also has relationships with other major ISO standards, and em- braces the same methods and approaches.40
CobiT is process oriented and has been widely adopted as an IT governance framework. ValIT is value oriented and compatible and complementary with CobiT yet focuses on value delivery.
ITIL is the “most widely accepted approach to IT service management in the world.”
202 INFORMATION GOVERNANCE
c10 202 March 6, 2014 2:57 PM
IG Best Practices for Database Security and Compliance
Although security is a topic primarily for Chapter 11 , it is a technical topic that we address here as well. Best practices have been developed over the past few years and can prevent leakage of structured data from databases and Web services due to SQL injections (where hackers attack SQL databases) and other types of attacks.
An organization and its data needs to be connected to its stakeholders—employees, customers, suppliers, and strategic partners. In this interconnected world that keeps ex- panding (e.g., cloud, mobile devices) proprietary data is exposed to a variety of threats. It is critical to protect the sensitive information assets that reside in your databases. 41
Perimeter security often is easily penetrated. Web apps are vulnerable to attacks such as SQL injection (a favorite among malicious approaches). Hackers also can gain access by spear phishing (very specifi c phishing attacks that include personal informa- tion) to glean employee login credentials in order to get access to databases.
Streamlining your approach to database security by implementing a uniform set of policies and processes helps in compliance efforts and reduces costs. Here are some proven database security best practices:
■ Inventory and document. You must fi rst identify where your sensitive data and databases reside in order to secure them. So a discovery and mapping process must take place. You can begin with staff interviews but also use tools such as data loss prevention to map out data fl ows. Include all locations, includ- ing legacy applications, and intellectual property such as price lists, marketing and strategic plans, product designs, and the like. This inventorying/discovery process must be done on a regular basis with the assistance of automated tools, since the location of data can migrate and change.
■ Assess exposure/weaknesses. Look for security holes, missing updates and patches, and any irregularities on a regular basis, using
standard checklists such as the CIS Database Server Benchmarks and the DISA Security Technical Implementation Guides (STIGs). Do not forget to check OS-level parameters such as fi le privileges for database confi guration fi les and database confi guration options such as roles and permissions, or how many failed logins result in a locked account (these types of database-specifi c checks are typically not performed by network vulnerability assessment scanners).
■ Shore up the database. Based on your evaluation of potential vulnerabilities, take proper steps and also be sure to that used database functions are disabled.
■ Monitor. On a regular basis, monitor and document any confi guration changes, and make sure the “gold” confi guration is stable and unchanged. “Use change auditing tools that compare confi guration snapshots and immediately alert whenever a change is made that affects your security posture.” 42
ISO 38500 is an international standard that provides high-level principles and guidance for senior executives and directors responsible for IT governance.
INFORMATION GOVERNANCE AND INFORMATION TECHNOLOGY FUNCTIONS 203
c10 203 March 6, 2014 2:57 PM
■ Deploy monitoring/auditing tools . Deploy these tools to immediately detect intrusions or suspicious activity, use your database’s database activity monitoring (DAM) and database auditing tools continuously and in real time. Note any anomalies, such as usually large numbers of records being downloaded even by authorized users—this could indicate, for instance, a rogue employee gathering information. But also higher-level “privileged users—such as database administrators (DBAs), developers and outsourced personnel” must be monitored to comply with certain regulations. Watch for attackers who have gained access through authorized credentials. DAM creates an audit trail generated in real time that can be the forensic smoking gun in investigations after attacks have occurred. Also, monitor the applica- tion layer, as
well-designed DAM solutions associate specifi c database transactions performed by the application with specifi c end-user IDs, in order to deterministically identify individuals violating corporate policies. In ad- dition, combining database auditing information with OS [operating system] and network logs via a security information and event manage- ment . . . system to see everything that a user has done can also provide critical information for forensic investigations.
■ Verify privileged access . In your audit process, periodically review the list of privi-s leged users and entitlement reports to ensure that superusers and those with access to sensitive information are still authorized.
■ Protect sensitive data . Known sensitive data should be encrypted, so that even if attackers gain access, it is unreadable. “File-level encryption at the OS lay- er, combined with granular real-time monitoring and access control at the database layer, is typically accepted as a practical alternative to column-level encryption and a compensating control for Requirement 3.3 of PCI-DSS.” 43
■ Deploy masking. Hide your live production data by masking test data. “Masking is a key database security technology that de-identifi es live production data, replacing it with realistic but fi ctional data that can then be used for testing, training and development purposes, because it is contextually appropriate to the production data it has replaced.”
■ Integrate and automate standardized security processes. To pass compliance audits, you need to show that processes and system are in place to reduce risks and detect potential intrusions, attacks, and unauthorized use. Standardizing and automating these tasks as much as possible helps minimize compliance costs while protecting the organization’s data.
Implementing these best practices will help keep sensitive data in your databases secure.
Identifying sensitive information in your databases and implementing database security best practices help reduce organizational risk and the cost of compliance.
204 INFORMATION GOVERNANCE
c10 204 March 6, 2014 2:57 PM
Tying It All Together
Multiple frameworks and standards can be applied to the IT process to more effectively govern it and focus the processes on business impact. Beginning with a robust data governance program, organizations can ensure, at the more fundamental level, that the information they are using to base decisions on is clean, reliable, and accurate. Implementing an MDM program will help larger organizations with complex IT operations ensure that they are working with consistent data from a single source. Implementing the CobiT 5 business framework for delivering IT results will help support a more effi cient IT operation and include other major frameworks, standards, and best practices. Leveraging the use of the ISO 38500 standard will help senior executives to better manage and govern IT operations, and employing database security best practices will help guard against outside threats.
■ Focusing on business impact and customizing your IG approach to meet business objectives are key best practices for IG in the IT department.
■ Effective data governance can yield bottom-line benefi ts derived from new insights.
■ Good data governance ensures that downstream negative effects of poor data are avoided and that subsequent reports, analyses, and conclusions are based on reliable, trusted data.
■ Master data management is a key IG process in IT.
■ IT governance seeks to align business objectives with IT strategy to deliver business value.
■ CobiT 5 is the latest version of the business framework for the governance of IT. It has just fi ve principles and seven enablers.
■ CobiT is process oriented and has been widely adopted as an IT governance framework. ValIT is value oriented and compatible and complementary with CobiT yet focuses on value delivery.
■ ValIT is a framework that focuses on delivering IT vale. It is folded into CobiT 5.
■ ITIL is the “most widely accepted approach to IT service management in the world.”
■ ISO 38500 is an international standard that provides high-level principles and guidance for senior executives and directors responsible for IT governance
■ Identifying sensitive information in your databases and implementing data- base security best practices help reduce organizational risk and the cost of compliance.
CHAPTER SUMMARY: KEY POINTS
INFORMATION GOVERNANCE AND INFORMATION TECHNOLOGY FUNCTIONS 205
c10 205 March 6, 2014 2:57 PM
Notes
1. Ibid. Gartner Says Master Data Management Is Critical to Achieving Effective Information Gover- nance, www.gartner.com/newsroom/id/1898914 (accessed on January 19, 2012).
2. IBM, “Selling Information Governance to Business Leaders,” www.information-management.com/ newsletters/governance-ROI-BI-business-rules-GRC-10021663-1.html (accessed June 3, 2013).
3. Ibid. 4. Ibid. 5. Steven Adler, “Six Steps to Data Governance Success,” May 31, 2007, www.cio.com/article/114750/Six_
Steps_to_Data_Governance_Success . 6. “New Trends and Best Practices for Data Governance Success,” SeachDataManagement.com e-book,
http://viewer.media.bitpipe.com/1216309501_94/1288990195_946/Talend_sDM_SO_32247_EB- ook_1104.pdf (accessed March 11, 2013).
7. Ibid. 8. “The DGI Data Governance Framework,” DataGovernance.com, www.datagovernance.com/fw_the_
DGI_data_governance_framework.html (accessed June 4, 2013). 9. “Information Management,” BusinessDictionary.com, www.businessdictionary.com/definition/
information-management.html (accessed June 4, 2013). 10. Sunil Soares, Selling Information Governance to the Business (Ketcham, ID: MC Press, 2011), p. 4. s 11. Daniel Teachey, “The Year of Master Data Management,” May 1, 2012, http://tdwi.org/articles/2012/05/01/
lesson-2012-the-year-of-master-data-management.aspx . 12. Andrew White, “We Are Only Half Pregnant with MDM,” April 17, 2013, http://blogs.gartner.com/
andrew_white/2013/04/17/we-are-only-half-pregnant-with-master-data-management/ 13. Gartner IT Glossary, “Master Data Management,” www.gartner.com/it-glossary/master-data-management-
mdm/ (accessed June 11, 2013). 14. Teachey, “Year of Master Data Management.” 15. Bill Tolson, “Information Governance 101,” May 21, 2013, http://informationgovernance101.
com/2013/05/21/the-lifecycle-of-information/. 16. Gartner IT Glossary, “Information Lifecycle Management,” www.gartner.com/it-glossary/information-
life-cycle-management-ilm (accessed June 11, 2013). 17. Soares, Selling Information Governance to the Business. s 18. “Data Architecture,” BusinessDictionary.com, www.businessdictionary.com/defi nition/data-architecture
.html (accessed June 11, 2013). 19. “Data Modeling,” TechTarget, http://searchdatamanagement.techtarget.com/defi nition/data-model-
ing (accessed June 11, 2013).Ibid. 20. Ibid . 21. Soares, Selling Information Governance to the Business. s 22. Ibid. 23. Malcolm Chisholm, “Master Data Versus Reference Data,” Information Management , April 1, 2006, t
www.information-management.com/issues/20060401/1051002-1.html . 24. M. N. Kooper, R. Maes, and E.E.O. Roos Lindgreen, “On the Governance of Information: Introducing a
New Concept of Governance to Support the Management of Information,” International Journal of Information Management 31 (2011): 195–20, www.sciencedirect.com/science/article/pii/S0268401210000708 .t
25. Nick Robinson, “The Many Faces of IT Governance: Crafting an IT Governance Architecture,” ISACA Journal 1 (2007), www.isaca.org/Journal/Past-Issues/2007/Volume-1/Pages/The-Many-Faces-l of-IT-Governance-Crafting-an-IT-Governance-Architecture.aspx.
26. Bryn Phillips, “IT Governance for CEOs and Members of the Board,” 2012, p. 26. 27. IBM Global Business Services—Public Sector, “Control Objectives for Information and related Technol-
ogy (CobiT®) Internationally Accepted Gold Standard for IT Controls and Governance,” 2008, http:// www-304.ibm.com/industries/publicsector/fi leserve?contentid=187551 (accessed March 11, 2013).
28. Phillips, “IT Governance for CEOs and Members of the Board.” 29. IBM Global Business Services—Public Sector, “CobiT®.” 30. Ibid. 31. “COBIT 5: A Business Framework for the Governance and Management of Enterprise IT,” www.isaca
.org/COBIT/Pages/default.aspx (accessed December 8, 2013). 32. Ibid. 33. IBM Global Business Services—Public Sector, “CobiT®.” 34. IASCA, “Val IT Framework for Business Technology Management,” www.isaca.org/Knowledge-Center/
Val-IT-IT-Value-Delivery-/Pages/Val-IT1.aspx?utm_source=multiple&utm_medium=multiple&utm_ content=friendly&utm_campaign=valit (accessed June 12, 2013).
206 INFORMATION GOVERNANCE
c10 206 March 6, 2014 2:57 PM
35. Ibid. 36. ITIL, “Welcome to the Official ITIL® Website,” www.itil-officialsite.com/ (accessed
March 12, 2013). 37. ITIL, “What Is ITIL?” www.itil-offi cialsite.com/AboutITIL/WhatisITIL.aspx (accessed March 12,
2013). 38. Ibid. 39. ISO, “ISO/IEC 38500:2008: Corporate Governance of Information Technology,” www.iso.org/iso/
catalogue_detail?csnumber=51639 (accessed March 12, 2013). 40. “ISO 38500 IT Governance Standard” (2008), www.38500.org/ (accessed March 12, 2013). 41. The following discussion and quotes are from Phil Neray, “Beating the Breach: 10 Best Practices
for Database Security and Compliance,” November 3, 2011, http://datasafestorage.wordpress .com/2011/11/15/beating-the-breach-10-best-practices-for-database-security-and-compliance/.
42. Ibid 43. Ibid
207
c11 207 March 6, 2014 2:58 PM
P rivacy and security go hand in hand. Privacy cannot be protected without imple- menting proper security controls and technologies. Organization must make not only reasonable efforts to protect privacy of data, but they must go much further
as privacy breaches are damaging to its customers, reputation, and potentially, could put the company out of business.
Breaches are increasingly being carried out by malicious attacks, but also a sig- nifi cant source of breaches is internal mistakes caused by poor information gover- nance (IG) practices, software bugs, and carelessness. The average cost of a data breach in 2013 was over $5 million dollars, according to the Ponemon Institute, 1 but some spectacular breaches have occurred, such as the $45 million in fraudulent automated teller machine cash withdrawals in New York City within hours in early 2013, and the 110 million customer records breached at giant retailer Target in late 2013. Millions of breaches occur each year: There were an estimated 354 million privacy breaches between 2005 and 2010 in the United States alone.
Cyberattacks Proliferate
Online attacks and snooping continue at an increasing rate. Organizations must be vigilant about securing their internal, confi dential documents and e-mail messages. In 2011, security experts at Intel/McAfee “discovered an unprecedented series of cyber attacks on the networks of 72 organizations globally, including the United Nations, governments and corporations, over a fi ve-year period.” 2 Dmitri Alperovitch of McAfee described the incident as “ the biggest transfer of wealth in terms of intellectual“ property in history.”3 The level of intrusion is ominous.
The targeted victims included governments, including the United States, Canada, India, and others; corporations, including high-tech companies and defense contrac- tors; the International Olympic Committee; and the United Nations. “In the case of the United Nations, the hackers broke into the computer system of its secretariat in
Information Governance and Privacy and Security Functions
C H A P T E R 11
Portions of this chapter are adapted from Chapters 11 and 12, Robert F. Smallwood, Safeguarding Critical E-Documents: Implementing a Program for Securing Confi dential Information Assets , © John Wiley & Sons, Inc., 2012. Reproduced with s permission of John Wiley & Sons, Inc.
Information Governance: Concepts, Strategies and Best Practices By Robert F. Smallwood Copyright © 2014 by Robert F. Smallwood
208 INFORMATION GOVERNANCE
c11 208 March 6, 2014 2:58 PM
Geneva in 2008, hid there for nearly two years, and quietly combed through reams of secret data, according to McAfee.” 4 Attacks can be occurring in organizations for years before they are uncovered—if they are discovered at all. This means that an organization may be covertly monitored by criminals or competitors for extended periods of time.
And they are not the only ones spying—look no further than the U.S. National Security Agency (NSA) scandal of 2013. With Edward Snowden’s revelations, it is clear that governments are accessing, monitoring, and storing massive amounts of private data.
Where this stolen information is going and how it will be used is yet to be determined. But it is clear that possessing this competitive intelligence could give a government or company a huge advantage economically, competitively, diplomatically, and militarily.
The information assets of companies and government agencies are at risk globally. Some are invaded and eroded daily, without detection. The victims are losing economic advantage and national secrets to unscrupulous rivals, so it is imperative that IG policies are formed, followed, enforced, tested, and audited. It is also imperative to use the best available technology to counter or avoid such attacks. 5
Insider Threat: Malicious or Not
Ibas, a global supplier of data recovery and computer forensics, conducted a survey of 400 business professionals about their attitudes toward intellectual property (IP) theft:
■ Nearly 70 percent of employees have engaged in IP theft, taking corporate property upon (voluntary or involuntary) termination.
■ Almost one-third have taken valuable customer contact information, databases, or other client data.
■ Most employees send e-documents to their personal e-mail accounts when pil- fering the information.
■ Almost 60 percent of surveyed employees believe such actions are acceptable. ■ Those who steal IP often feel that they are entitled to partial ownership rights,
especially if they had a hand in creating the fi les. 6
These survey statistics are alarming, and by all accounts the trend continuing to worsen today. Clearly, organizations have serious cultural challenges to combat prevailing attitudes toward IP theft. A strong and continuous program of IG aimed at secur- ing confi dential information assets can educate employees, raise their IP security
Attacks can continue in organizations for years before they are uncovered—if they are discovered at all.
The average cost of a data breach in 2013 was over $5 million.
c11 209 March 6, 2014 2:58 PM
INFORMATION GOVERNANCE AND PRIVACY AND SECURITY FUNCTIONS 209
awareness, and train them on techniques to help secure valuable IP. And the change needs to be driven from the top: from the CEO and boardroom. However, the mag- nitude of the problem in any organization cannot be accurately known or measured. Without the necessary IG monitoring and enforcement tools, executives cannot know the extent of the erosion of information assets and the real cost in cash and intangible terms over the long term.
Countering the Insider Threat
Frequently ignored, the insider has increasingly become the main threat—more than the external threats outside of the perimeter. Insider threat breaches can be more costly than outsider breaches. Most of the insider incidents go unnoticed or unreported.7
Companies have been spending a lot of time and effort protecting their perimeters from outside attacks. In recent years, most companies have realized that the insider threat is something that needs to be taken more seriously.
Malicious Insider
Malicious insiders and saboteurs comprise a very small minority of employees. A dis- gruntled employee or sometimes an outright spy can cause a lot of damage. Malicious insiders have many methods at their disposal to harm the organization by destroying equipment, gaining unsanctioned access to IP, or removing sensitive information by USB drive, e-mail, or other methods.
Nonmalicious Insider
Fifty-eight percent of Wall Street workers say they would take data from their company if they were terminated, and believed they could get away with it, according to a recent survey by security fi rm CyberArk.8 Frequently, they do this without malice. The majority of users indicated having sent out documents accidentally via e-mail. So, clearly it is easy to leak documents without meaning to do any harm, and that is the cause of most leaks.
Solution
Trust and regulation are not enough. In the case of a nonmalicious user, companies should invest in security, risk education, and IG training. A solid IG program can reduce IP leaks through education, training, monitoring, and enforcement.
Security professionals state that insider threat breaches are often more costly than outsider ones.
Information assets are invaded and eroded daily, often without detection. This compromises competitive position and has real fi nancial impact.
210 INFORMATION GOVERNANCE
c11 210 March 6, 2014 2:58 PM
In the case of the malicious user, companies need to take a hard look and see whether they have any effective IG enforcement and document life cycle security (DLS) technology such as information rights management (IRM) in place. Most often, the answer is no. 9
Privacy Laws
The protection of personally identifi able information (PII) is a core focus of IG efforts. PII is any information that can identify an individual, such as name, Social Security number, medical record number, credit card number, and so on. Various privacy laws have been enacted in an effort to protect privacy. You must consult your legal counsel to determine which laws and regulation apply to your organization and its data and documents.
In the United States, the Federal Wiretap Act “prohibits the unauthorized inter- ception and disclosure of wire, oral, or electronic communications.” The Electronic Communications Privacy Act (ECPA) of 1986 amended the Federal Wiretap Act sig- nifi cantly and included specifi c on e-mail privacy. 10 The Stored Communications and Transactional Records Act (SCTRA) was created as a part of ECPA and is “sometimes useful for protecting the privacy of e-mail and other Internet communications when discovery is sought.” The Computer Fraud and Abuse Act makes it a crime to in- tentionally breach a “protected computer” (one used by a fi nancial institution or for interstate commerce).
Also relevant for public entities is the Freedom of Information Act, which allows U.S. citizens to request government documents that have not previously been released, although sometime sensitive information is redacted (blacked out), and specifi es the steps for disclosure as well as the exemptions. In the United Kingdom, the Freedom of Information Act 2000 provides for similar disclosure requirements and mandatory steps.
In the United Kingdom, privacy laws and regulations include these:
■ Data Protection Act 1998 ■ Freedom of Information Act 2000 ■ Public Records Act 1958 ■ Common law duty of confi dentiality ■ Confi dentiality National Health Service (NHS) Code of Practice ■ NHS Care Record Guarantee for England ■ Social Care Record Guarantee for England ■ Information Security NHS Code of Practice ■ Records Management NHS Code of Practice
Also, the international information security standard ISO/IEC 27002: 2005 comes into play when implementing security.
Redaction
Redaction is the process of blocking out sensitive fi elds of information. In a paper environment, this was done with a black marking pen; however, privacy software can redact certain fi elds in digital documents, making them unreadable. Redaction is used
c11 211 March 6, 2014 2:58 PM
INFORMATION GOVERNANCE AND PRIVACY AND SECURITY FUNCTIONS 211
for confi dential patient information in medical records as well as other confi dential document types, such as birth certifi cates, fi nancial documents, property deeds, and other unstructured information that is managed.
A complete audit trail should be enabled that shows when specifi c users accessed or printed specifi c confi dential information.
Limitations of Perimeter Security
Traditionally, central computer system security has been primarily perimeter security—securing the fi rewalls and perimeters within which e-documents are stored and attempting to keep intruders out—rather than securing e-documents directly upon their creation. The basic access security mechanisms implemented, such as passwords, two-factor authentication, and identity verifi cation, are rendered totally ineffective once the confi dential e-documents or records are legitimately accessed by an authorized employee. The documents are usually bare and unsecured. This poses tremendous challenges if the employee is suddenly terminated, if the person is a rogue intent on doing harm, or if outside hackers are able to penetrate the secured perimeter. And, of course, it is com- mon knowledge that they do it all the time. The focus should be on securing the documents themselves, directly.
Restricting access is the goal of conventional perimeter security, but it does not directly protect the information inside. Perimeter security protects information the same way a safe protects valuables; if safecrackers get in, the contents are theirs. There are no protections once the safe is opened. Similarly, if hackers penetrate the perimeter security, they have complete access to the information inside, which they can steal, alter, or misuse. 11 The perimeter security approach has four fundamental limitations:
1. Limited effectiveness. Perimeter protection stops dead at the fi rewall, even though sensitive information is sent past it and circulates around the Web, unsecured. Today’s extended computing model and the trend toward global business means that business enterprises and government agencies frequently share sensitive information externally with other stakeholders, including busi- ness partners, customers, suppliers, and constituents.
2. Haphazard protections. In the normal course of business, knowledge workers send, work on, and store copies of the same information outside the organi- zation’s established perimeter. Even if the information’s new digital environ- ment is secured by other perimeters, each one utilizes different access controls or sometimes no access control at all (e.g., copying a price list from a sales folder to a marketing folder; an attorney copying a case brief or litigation strategy document from a paralegal’s case folder).
3. Too complex. With this multi-perimeter scenario, there are simply too many pe- rimeters to manage, and often they are out of the organization’s direct control.
4. No direct protections. Attempts to create boundaries or portals protected by pe- rimeter security within which stakeholders (partners, suppliers, shareholders, or customers) can share information causes more complexity and administra- tive overhead while it fails to protect the e-documents and data directly. 12
Despite the current investment in e-document security, it is astounding that once information is shared today, it is largely unknown who will be accessing it tomorrow.
212 INFORMATION GOVERNANCE
c11 212 March 6, 2014 2:58 PM
Defense in Depth
Defense in depth is an approach that uses multiple layers of security mechanisms to protect information assets and reduce the likelihood that rogue attacks can succeed.13 The idea is based on military principles that an enemy is stymied by complex layers and approaches compared to a single line. That is, hackers may be able to penetrate one or two of the defense layers, but multiple security layers increase the chances of catching the attack before it gets too far. Defense in depth includes a fi rewall as a fi rst line of defense and also antivirus and anti-spyware software, identity and access management (IAM), hierarchical passwords, intrusion detection, and biometric t verifi cation. Also, as a part of an overall IG program, physical security measures are deployed, such as smartcard or even biometric access to facilities and intensive IG training and auditing.
Controlling Access Using Identity Access Management
IAM software can provide an important piece of the security solution. It aims to pre- vent unauthorized people from accessing a system and to ensure that only authorized individuals engage with information, including confi dential e-documents.
Today’s business environment operates in a more extended and mobile model, often including stakeholders outside of the organization. With this more complex and fl uctuating group of users accessing information management applications, the idea of identity management has gained increased importance.
The response to the growing number of software applications using inconsistent or incompatible security models is strong identity management enforcement software. These scattered applications offer opportunities not only for identity theft but also for identity drag , where the maintenance of identities does not keep up with changing g identities, especially in organizations with a large workforce. This can result in theft of confi dential information assets by unauthorized or out-of-date access and even failure to meet regulatory compliance, which can result in fi nes and imprisonment.14
IAM—along with sharp IG policies—“manages and governs user access to infor- mation through an automated, continuous process.” 15 Implemented properly, good IAM does keep access limited to authorized users while increasing security, reducing IT complexity, and increasing operating effi ciencies.
Critically, “IAM addresses ‘access creep’ where employees move to a different department of business unit and their rights to access information fail to get updated” (emphasis added).” 16
In France in 2007, a rogue stock trader at Société Générale had in-depth knowl- edge of the bank’s access control procedures from his job at the home offi ce. 17 He used that information to defraud the bank and its clients out of over €7 billion (over $10 billion). If the bank had implemented an IAM solution, the crime might not have been possible.
“IAM addresses ‘access creep’ where employees move to a different depart- ment of business unit and their rights to access information fail to get updated.”
c11 213 March 6, 2014 2:58 PM
INFORMATION GOVERNANCE AND PRIVACY AND SECURITY FUNCTIONS 213
A robust and effective IAM solution provides for:
■ Auditing . Detailed audit trails of g who attempted to access which information , and when . Stolen identities can be uncovered if, for instance, an authorized user attempts to log in from more than one computer at a time.
■ Constant updating. Regular reviews of access rights assigned to individuals, in- cluding review and certifi cation for user access, an automated recertifi cation process ( attestation ), and enforcement of IG access policies that govern the way users access information in respect to segregation of duties.
■ Evolving roles. Role life cycle management should be maintained on a continuous basis, to mine and manage roles and their associated access rights and policies.
■ Risk reduction. Remediation regarding access to critical documents and information.
Enforcing IG: Protect Files with Rules and Permissions
One of the fi rst tasks often needed when developing an IG program that secures confi - dential information assets is to defi ne roles and responsibilities for those charged with implementing, maintaining, and enforcing IG policies. Corollaries that spring from that effort get down to the nitty-gritty of controlling information access by rules and permissions.
Rules and permissions specify who (by roles) is allowed access to which documents and information, and even contextually from where (offi ce, home, travel) and at what times (work hours, or extended hours). Using the old policy of the s need-to-know basis is a good rule of thumb to apply when setting up these access policies (i.e., only those who are at a certain level of the organization or are directly involved in certain projects are allowed access to confi dential and sensitive information). The roles are relatively easy to defi ne in a traditional hierarchical structure, but today’s fl atter and more col- laborative enterprises present challenges.
To effectively wall off and secure information by management level, many compa- nies and governments have put in place an information security framework—a model that delineates which levels of the organization have access to specifi c documents and databases as a part of implemented IG policy. This framework shows a hierarchy of the company’s management distributed across a range of defi ned levels of information access. The U.S. Government Protection Profi le for Authorization Server for Basic Robustness Environments is an example of such a framework.
Challenge of Securing Confi dential E-Documents
Today’s various document and content management systems were not initially designed to allow for secure document sharing and collaboration while also preventing docu- ment leakage. These software applications were mostly designed before the invention and adoption of newer business technologies that have extended the computing environment. The introduction of cloud computing, mobile PC devices, smartphones, social media, and online collaboration tools all came after most of today’s document and content management systems were developed and brought to market.
214 INFORMATION GOVERNANCE
c11 214 March 6, 2014 2:58 PM
Thus, vulnerabilities have arisen that need to be addressed with other, comple- mentary technologies. We need to look no further than the WikiLeaks incident and the myriad of other major security breaches resulting in document and data leakage to see that there are serious information security issues in both the public and private sectors.
Technology is the tool, but without proper IG policies and a culture of compli- ance that supports the knowledge workers following IG policies, any effort to secure confi dential information assets will fail. An old IT adage is that even perfect technology will fail without user commitment.
Protecting Confi dential E-Documents: Limitations of Repository-Based Approaches
Organizations invest billions of dollars in IT solutions that manage e-documents and records in terms of security, auditing, search, records retention and disposition, version control, and so on. These information management solutions are predominantly re- pository-based, including enterprise content management (ECM) systems and collab- orative workspaces (for unstructured information, such as e-documents). With content or document repositories, the focus has always been on perimeter security—keeping intruders out of the network. But that provides only partial protection. Once intrud- ers are in, they are in and have full access to confi dential e-documents. For those who are authorized to access the content, there are no protections, so they may freely copy, forward, print, or even edit and alter the information. 18
The glaring vulnerability in the security architecture of ECM systems is that few protec- tions exist once the information is legitimately accessed.
These confi dential information assets, which may include military plans, price lists, patented designs, blueprints, drawings, and fi nancial reports, often can be printed, e-mailed, or faxed to unauthorized parties without any security attached. 19
Also, in the course of their normal work processes, knowledge workers tend to keep an extra copy of the electronic documents they are working on stored at their desktop, or they download and copy them to a tablet or laptop to work at home or while traveling. This creates a situation where multiple copies of these e-documents are scat- tered about on various devices and media, which creates a security problem, since they are out- side of the repository and no longer secured, managed, controlled, or audited.
The glaring vulnerability in the security architecture of ECM systems is that few protections exist once the information is legitimately accessed.
Technologies like fi rewalls, access controls, and gateway fi lters can grant or deny access but cannot provide granular enforcement of acceptable use policies that defi ne what users can and cannot do with confi dential data and documents.
c11 215 March 6, 2014 2:58 PM
INFORMATION GOVERNANCE AND PRIVACY AND SECURITY FUNCTIONS 215
It also creates records management issues in terms of the various versions that might be out there and determining which one is the offi cial business record.
Apply Better Technology for Better Enforcement in the Extended Enterprise
Protecting E-Documents in the Extended Enterprise
Sharing e-documents and collaborating are essential in today’s increasingly mobile and global world. Businesses are operating in a more distributed model than ever be- fore, and they are increasingly sharing and collaborating not only with coworkers but also with suppliers, customers, and even at times competitors (e.g., in pharmaceutical research). This reality presents a challenge to organizations dealing in sensitive and confi dential information.20
Basic Security for the Microsoft Windows Offi ce Desktop
The fi rst level of protection for e-documents begins with basic protections at the desktop level. Microsoft Offi ce provides ways to password-protect Microsoft Offi ce fi les, such as those created in Word and Excel, quickly and easily. Many corporations and government agencies around the world use these basic protections. A key fl aw or caveat is that passwords used in protecting documents cannot be retrieved if they are forgotten or lost.
Where Do Deleted Files Go?
When you delete a fi le it is gone, right? Actually, it is not (with the possible exception of solid state hard drives). For example, after a fi le is deleted in Windows, a simple undelete DOS command can bring back the fi le, if it has not been overwritten. That is because when fi les are deleted, they are not really deleted; rather, the space where they reside is marked for reuse and can be overwritten. If it is not yet overwritten, the fi le is still there. The same process occurs as drafts of documents are created and temp (for temporary ) fi les are stored. The portions of a hard drive where deleted or temp fi les are stored can be overwritten. This is called unallocated space. Most users are unaware that deleted fi les and fragments of documents and drafts are stored temporarily on their computer’s unallocated space. So it must be wiped clean and completely erased to ensure that any confi dential documents or drafts are completely removed from the hard drive.
IG programs include the highest security measures, which means that an organi- zation must have a policy that includes deleting sensitive materials from a computer’s unallocated space and tests that verify such deletion actions are successful periodically.
Lock Down: Stop All External Access to Confi dential E-Documents
Organizations are taking other approaches to stop document and data leakage: physi- cally restricting access to a computer by disconnecting it from any network con- nections and forbidding or even blocking use of any ports. Although cumbersome, these methods are effective in highly classifi ed or restricted areas where confi dential
216 INFORMATION GOVERNANCE
c11 216 March 6, 2014 2:58 PM
e-documents are held. Access is controlled by utilizing multiple advanced identity ver- ifi cation methods, such as biometric means.
Secure Printing
Organizations normally expend a good amount of effort making sure that computers, documents, and private information are protected and secure. However, if your com- puter is hooked up to a network printer (shared by multiple knowledge workers), all of that effort might have been wasted. 21
Some basic measures can be taken to protect confi dential documents from being compromised as they are printed. You simply invoke some standard Microsoft Offi ce protections, which allow you to print the documents once you arrive in the copy room or at the networked printer. This process varies slightly, depending on the printer’s manufacturer. (Refer to the documentation for the printer for details.)
In Microsoft Offi ce, there is an option in the Print Dialog Box for delayed print- ing of documents (when you physically arrive at the printer).
Serious Security Issues with Large Print Files of Confi dential Data
According to Canadian output and print technology expert William Broddy, in a company’s data center, a print fi le of, for instance, investment account statements or bank statements contains all the rich information that a hacker or malicious insider needs. It is information distilled to the most important core data about customers, and has been referred to as data syrup since it has been boiled down and contains no mountains of extraneous data, only the culled, cleaned, essential data that gives criminals exactly what they need.d 22
What most managers are not aware of is that entire print fi les and sometimes remnants of them stay on the hard drives of high-speed printers and are vulnerable to security breaches. Data center security personnel closely monitor calls to their data- base. To extract as much data as is contained in print fi les, a hacker requires hundreds or even thousands of calls to the database, which sets off alerts by system monitor- ing tools. But retrieving a print fi le takes only one intrusion, and it may go entirely unnoticed. The fi les are sitting there; a rogue service technician or fi eld engineer can retrieve them on a routine service call.
To help secure print fi les, specialized hardware devices designed to sit between the print server and the network and cloak server print fi les are visible only to those who have a cloaking device on the other end.
Organizations must practice good IG and have specifi c procedures to erase sensitive print fi les once they have been utilized. For instance, in the example of preparing statements to mail to clients, fi les are exposed to possible intrusions in at least six points in the process (starting with print fi le preparation and ending with the actual mailing). These points must be tightly monitored and controlled. Typically, an
A print fi le contains all the distilled customer information a hacker might want. Retrieving a print fi le takes only one intrusion and may go entirely unnoticed.
c11 217 March 6, 2014 2:58 PM
INFORMATION GOVERNANCE AND PRIVACY AND SECURITY FUNCTIONS 217
organization retains a print fi le for about 14 days, though some keep fi les long enough for customers to receive statements in the mail and review them. Organizations must make sure that print fi les or their remnants are secured and then completely erased when the printing job is fi nished.
E-Mail Encryption
Encrypting (scrambling using advanced algorithms) sensitive e-mail messages is an effective step to securing confi dential information assets while in transit. Encryption can also be applied to desktop folders and fi les and even entire disk drives (full disk en- cryption, or FDE). All confi dential or sensitive data and e-documents that are exposed to third parties or transferred over public networks should be secured with fi le-level encryption, at a minimum. 23
Secure Communications Using Record-Free E-Mail
What types of tools can you use to encourage the free fl ow of ideas in collaborative efforts without compromising your confi dential information assets or risking litigation or compliance sanctions?
Stream messaging is an innovation that became commercially viable around 2006. It is similar in impact to IRM software, which limits the recipients’ ability to forward, print, or alter data in an e-mail message (or reports, spreadsheets, etc.) but goes further by leaving no record on any computer or server.r
Stream messaging is a simple, safe, secure electronic communications system ideal for ensuring that sensitive internal information is kept confi dential and not publicly released. Stream messaging is not intended to be a replacement for enterprise e-mail but is a complement to it. If you need an electronic record, e-mail it; if not, use stream messaging. 24
What makes stream messaging unique is its recordlessness. Streamed messages cannot be forwarded, edited, or saved. A copy cannot be printed as is possible with e-mail. That is because stream messaging separates the sender’s and receiver’s names and the date from the body of the message, never allowing them to be seen together. Even if the sender or receiver were to attempt to make a copy using the print-screen function, these ele- ments are never captured together.25
Files are exposed to possible intrusions in at least six points between print fi le preparation and fi nal hard-copy mailing.
With stream messaging, no record or trace of communication is left.
218 INFORMATION GOVERNANCE
c11 218 March 6, 2014 2:58 PM
The instant a stream message is sent, it is placed in a temporary storage buffer space. When the recipient logs in to read the message, it is removed from the buffer space. By the time the recipient opens it, the complete stream message no longer exists on the server or any other computer.
This communications approach is Web based, meaning that no hardware or soft- ware purchases are required. It also works with existing e-mail systems and e-mail addresses and is completely immune to spam and viruses. Other solutions (both past and present) have been offered, but these have taken the approach of encrypting e-mail or generating e-mail that disappears after a preset time. Neither of these approaches is truly recordless.
Stream messaging is unique because its technology effectively eliminates the ability to print, cut, paste, forward, or save a message. It may be the only electronic commu- nications system that separates the header information—date, name of sender, name of recipient—from the body of the message. This eliminates a traceable record of the communication. Soon many other renditions of secure messaging will be developed.
In addition, stream messaging offers the added protection of being an indiscrimi- nate Web-based service, meaning that the messages and headers are never hosted on the subscribing companies’ networks. This eliminates the risk that employers, com- petitors, or hackers could intercept stream messages, which is a great security benefi t for end users. 26
Digital Signatures
Digital signatures are more than just digitized autographs—they carry detailed audit information used to “detect unauthorized modifi cations” to e-documents and to “authenticate the identity of the signatory.” 27
Online transactions can be conducted with full trust that they are legal, proper, and binding. They prove that the person whose signature is on the e-document did, in fact, authorize it. A digital signature provides evidence in demonstrating to a third party that the signature was genuine, true, and authentic, which is known as nonrepudiation . To repudiate is to dispute, and with digital signatures, a signatory is unable to claim that the signature is forged.
Digital signatures can be implemented a variety of ways—not just through soft- ware but also through fi rmware (programmed microchips), computer hardware, or a combination of the three. Generally, hardware- and fi rmware-based implementations are more diffi cult to hack, since their instructions are hardwired.
Here is a key point: For those who are unfamiliar with the technology, there is a big difference between electronic signatures and digital signatures. 28
An “electronic signature is likely to be a bit-map image, either from a scanned image, a fax copy or a picture of someone’s signature, or may even be a typed acknowledgement or acceptance.” A digital signature contains “extra data appended to
There is a big difference between digital and electronic signatures. Digital signatures contain additional authenticating information.
c11 219 March 6, 2014 2:58 PM
INFORMATION GOVERNANCE AND PRIVACY AND SECURITY FUNCTIONS 219
a message which identifi es and authenticates the sender and message data using public-key encryption.”29”
So digital signatures are the only ones that offer any real security advantages. Digital signatures are verifi ed by the combination of applying a signatory’s private
signing key and the public key that comes from the signatory’s personal ID certifi - cate. After that, only the public key ID certifi cate is required for future verifi cations. “In addition, a checksum mechanism confi rms that there have been no modifi cations to the content .” t 30
A formal, trusted certifi cate authority (CA) issues the certifi cate associated with the public-private key. It is possible to generate self-certifi ed public keys, but these do not verify and authenticate the recipient’s identity and are therefore fl awed from a security standpoint. The interchange of verifi ed signatures is possible on a global scale, as “digital signature standards are mature and converging internationally.” 31
After more than 30 years of predictions, the paperless offi ce is almost here. Business process cycles have been reduced, and great effi ciencies have been gained since the majority of documents today are created digitally and spend most of their life cycle in digital form, and they can be routed through work steps using business process management (BPM) and work fl ow software. However, the requirement for a physical signature frequently disrupts and holds up these business processes . Documents have to bes printed out, physically routed, and physically signed—and often they are scanned back into a document or records management (or contract management) system, which defeats the effi ciencies sought.
Often multiple signatures are required in an approval process, and some organiza- tions require each page to be initialed, which makes the process slow and cumbersome when it is executed without the benefi t of digital signatures. Also, multiple copies are generated—as many as 20—so digital signature capability injected into a business pro- cess can account for signifi cant time and cost savings. 32
Document Encryption
There is some overlap and sometimes confusion between digital signatures and document encryption. Suffi ce it to say that they work differently, in that document encryption secures a document for those who share a secret key, and digital signatures prove that the document has not been altered and the signature is authentic.
There are e-records management implications of employing document encryption:
Unless it is absolutely essential, full document encryption is often advised against for use within electronic records management systems as it prevents full-text indexing, and requires that the decryption keys (and application) are available for any future access. Furthermore, if the decryption key is lost or
Requiring a physical signature can disrupt and slow business processes. Digital signatures speed that up and add a layer of security.
220 INFORMATION GOVERNANCE
c11 220 March 6, 2014 2:58 PM
an employee leaves without passing it on, encrypted documents and records will in effect be electronically shredded as no one will be able to read them.
Correctly certifi ed digital signatures do not prevent unauthorized per- sons reading a document nor are they intended to. They do confi rm that the person who signed it is who they say they are, and that the document has not been altered since they signed it. Within a records management system a digi- tal signature is often considered to be an important part of the metadata of a document, confi rming both its heritage and its integrity.33
Data Loss Prevention (DLP) Technology
The aforementioned document security challenges have given rise to an emerging but critical set of capabilities by a new breed of IT companies that provide data loss prevention (DLP) (also called data leak prevention). DLP providers create software and hardware appliances that thoroughly inspect all e-documents and e-mail messages before they leave the organization’s perimeter and attempt to stop sensitive data from exiting the fi rewall.
This fi ltering is based on several factors, but mostly using specifi ed critical content keywords that are fl agged by the implementing organization. DLP can also stop the exit of information assets by document types, origin, time of day, and other factors.
DLP systems are designed to detect and prevent unauthorized use and transmission of confi dential information.34 In more detail, DLP is a computer security term referring to systems that identify, monitor, and protect data/documents in all three states: (1) in use (endpoint actions), (2) in motion (network actions), and (3) at rest (data/document stor-t age). DLP accomplishes this by deep content inspection and contextual security analysis of transaction data (e.g., attributes of the originator, the data object, medium, timing, recipient/destination, etc.) with a centralized management framework.
Promise of DLP
Gartner reports that the DLP market reached an estimated $670 million in 2013, up from $425 million in 2011, and “with adoption of DLP technologies moving quickly down to the small to medium enterprise, DLP is no longer an unknown quantity.” 35 Although the DLP market has matured, it suffers from confusion about how DLP best fi ts into the new mix of security approaches, how it is best utilized (endpoint or gateway), and even the defi nition of DLP itself. 36
Data loss is very much on managers’ and executives’ minds today. The series of WikiLeaks incidents exposed hundreds of thousands of sensitive government and mili- tary documents. According to the Ponemon Institute (as reported by DLP Experts), data leaks continue to increase annually. Billions of dollars are lost every year as a result of data leaks, with the cost of each breach ranging from an average of $700,000 to $31 million. Some interesting statistics from the study include:
■ Almost half of breaches happen while an enterprise’s data was in the hands of a third party.
■ Over one-third of breaches involved lost or stolen mobile devices.
c11 221 March 6, 2014 2:58 PM
INFORMATION GOVERNANCE AND PRIVACY AND SECURITY FUNCTIONS 221
■ The cost per stolen record is approximately $200 to $225. ■ One-quarter of breaches were conducted by criminals or with malicious intent. ■ More than 80 percent of breaches compromised over 1,000 records. 37
What DLP Does Well (and Not So Well)
DLP has been deployed successfully as a tool used to map the fl ow of data inside and exiting the organization to determine the paths that content takes, so that more sophisticated information mapping, monitoring, and content security can take place.
This use as a traffi c monitor for analysis purposes has been much more successful than relying on DLP as the sole enforcement tool for compliance and to secure information assets. s Today’s technology is simply not fast enough to catch everything. It catches many e-mail messages and documents that users are authorized to send, which slows the network and the business down. This also adds unnecessary overhead, as someone has to go back and release each and every one of the e-mails or documents that were wrongly stopped.
Another downside: Since DLP relies on content inspection, it cannot detect and monitor encrypted e-mail or documents.
Basic DLP Methods
DLP solutions typically apply one of three methods:
1. Scanning traffi c for keywords or regular expressions, such as customer credit card or Social Security numbers.
2. Classifying documents and content based on a predefi ned set to determine what is likely to be confi dential and what is not.
3. Tainting (in the case of agent-based solutions), whereby documents are tagged and then monitored to determine how to classify derivative documents. For example, if someone copies a portion of a sensitive document into a different document, this document receives the same security clearance as the original document. 38
All these methods involve the network administrator setting up a policy clearly defi ning what is allowed to be sent out and what should be kept in confi dence. This policy creating effort is extremely diffi cult: Defi ning a policy that is too broad means ac-d cidentally letting sensitive information get out, and defi ning a policy that is too narrow means getting a signifi cant amount of false positives and stopping the fl ow of normal business communications.
Although network security management is well established, defi ning these types of IG policies is extremely diffi cult for a network administrator. Leaving this job to network administrators means there will be no collaboration with business units, no standardization, and no real forethought. As a result, many installations are plagued with false positives that are fl agged and stopped, which can stifl e and frustrate knowl- edge workers. The majority of DLP deployments simply use DLP for monitoring and audit- ing purposes.
Examining the issue of the dissolving perimeter more closely, a deeper problem is revealed: DLP is binary; it is black or white. Either a certain e-document or e-mail can
222 INFORMATION GOVERNANCE
c11 222 March 6, 2014 2:58 PM
leave the organization’s boundaries or it cannot. This process has been referred to as outbound content compliance.
But this is not how the real world works today. Now there is an increasing need for collaboration and for information to be shared or reside outside the organization on mobile devices or in the cloud.
Most of today’s DLP technology cannot address these complex issues on its own. Often additional technology layers are needed.
Data Loss Prevention: Limitations
DLP has been hyped in the past few years, and major security players have made sev- eral large acquisitions—especially those in the IRM market. Much like fi rewalls, DLP started in the form of network gateways that searched e-mail, Web traffi c, and other forms of information traveling out of the organization for data that was defi ned as internal. When it found such data, the DLP blocked transmission or monitored its use.
Soon agent-based solutions were introduced, performing the same actions locally on users’ computers. The next step brought a consolidation of many agent- and net- work-based solutions to offer a comprehensive solution.
IG policy issues are key. What is the policy? All these methods depend on manage- ment setting up a policy that clearly defi nes what is acceptable to send out and what should be kept in confi dence.
With DLP, a certain document can either leave the organization’s boundaries or it can’t. But this is not how the real world works. In today’s world there is an increasing need for information to be shared or reside outside the organization on mobile devices or in the cloud. Simply put, DLP is not capable of addressing this issue on its own, but it is a helpful piece of the overall technology solution.
Missing Piece: Information Rights Management (IRM)
Another technology tool for securing information assets is information rights manage- ment (IRM) software (also referred to as enterprise rights management [ERM] and previously as enterprise digital rights management [e-DRM].) For purposes of this book, we use the term “IRM” when referring to this technology set, so as not to be confused with elec- tronic records management. Major software companies also use the term “IRM.”
IRM technology provides a sort of security wrapper around documents and pro- tects sensitive information assets from unauthorized access. 39 We know that DLP can search for key terms and stop the exit of sensitive data from the organization by in- specting its content. But it can also prevent confi dential data from being copied to external media or sent by e-mail if the person is not authorized to do so. If IRM is deployed, fi les and documents are protected wherever they may be, with persistent security. The ability to apply security to an e-document in any state (in use, in motion, and at rest), across media types, inside or outside of the organization, is called persistent security .
The ability to secure data at any time, in any state, is called persistent protection.
c11 223 March 6, 2014 2:58 PM
INFORMATION GOVERNANCE AND PRIVACY AND SECURITY FUNCTIONS 223
This is a key characteristic of IRM technology, and it is all done transparently without user intervention. 40
IRM has the ability to protect e-documents and data wherever they may reside, however they may be used, and in all three data states (at rest, in use, and in transit). 41
IRM allows for e-documents to be remote controlled , meaning that security protectionsd can be enforced even if the document leaves the perimeter of the organization. This means that e-documents (and their control mechanisms) can be separately created, viewed, edited, and distributed.
IRM provides persistent, ever-present security and manages access to sensitive e-documents and data. IRM provides embedded fi le-level protections that travel with the document or data, regardless of media type.42 These protections and prevent un- authorized viewing, editing, printing, copying, forwarding, or faxing. So, even if fi les are somehow copied to a thumb drive and taken out of the organization, e-document protections and usage are still controlled.
The major applications for IRM services include cross-protection of e-mails and attachments, dynamic content protection on Web portals, secure Web-based training, secure Web publishing, and secure content storage and e-mail repositories all while meeting compliance requirements of Sarbanes–Oxley, the Health Insurance Portabil- ity and Accountability Act, and others. Organizations can comply with regulations for securing and maintaining the integrity of digital records, and IRM will restrict and track access to spreadsheets and other fi nancial data too.
In investment banking, research communications must be monitored, according to National Association of Securities Dealers rule (NASD) 2711, and IRM can help support compliance efforts. In consumer fi nance, personal fi nancial information col- lected on paper forms and transmitted by fax (e.g., auto dealers faxing credit applica- tions) or other low-security media can be secured using IRM, directly from a scanner or copier. Importers and exporters can use IRM to ensure data security and prevent the loss of cargo from theft or even terrorist activities, and they also can comply with U.S. Customs and trade regulations by deploying IRM software. Public sector data security needs are numerous, including intelligence gathering and distribution, espionage, and Homeland Security initiatives. Firms that generate intellectual property IP, such as re- search and consulting groups, can control and protect access to IP with it. In the highly collaborative pharmaceutical industry, IRM can secure research and testing data.
IRM protections can be added to nearly all e-document types including e-mail, word processing fi les, spreadsheets, graphic presentations, computer-aided design (CAD) plans, and blueprints. This security can be enforced globally on all documents or granularly down to the smallest level, protecting sensitive fi elds of information from prying eyes. This is true even if there are multiple copies of the e-documents scattered about on servers in varying geographic locations. Also, the protections can be applied permanently or within controlled time frames. For instance, a person may be granted access to a secure e-document for a day, a week, or a year.
Key IRM Characteristics
Three requirements are recommended to ensure effective IRM:
1. Security is foremost; documents, communications, and licenses should be en- crypted, and documents should require authorization before being altered.
224 INFORMATION GOVERNANCE
c11 224 March 6, 2014 2:58 PM
2. The system can’t be any harder to use than working with unprotected documents. 3. It must be easy to deploy and manage , scale to enterprise proportions, and work
with a variety of common desktop applications. 43
IRM software enforces and manages document access policies and use rights (view, edit, print, copy, e-mail forward) of electronic documents and data. Controlled information can be text documents, spreadsheets, fi nancial statements, e-mail messages, policy and pro- cedure manuals, research, customer and project data, personnel fi les, medical records, intranet pages, and other sensitive information. IRM provides persistent enforcement of IG and access policies to allow an organization to control access to information that needs to be secured for privacy, competitive, or compliance reasons. Persistent content security is a necessary part of an end-to-end enterprise security architecture.
Well, it sounds like fabulous technology, but is IRM really so new? No, it has been has been around for a decade or more, and continues to mature and improve. It has es- sentially entered the mainstream around 2004/2005 (when this author began tracking its development and publishing researched articles on the topic).
IRM software currently is used for persistent fi le protection by thousands of or- ganizations throughout the world. Its success depends on the quality and consistency of the deployment, which includes detailed policy-making efforts. Diffi culties in policy maintenance and lack of real support for external sharing and mobile devices have kept fi rst- wave IRM deployments from becoming widespread, but this aspect is being addressed by a second wave of new IRM technology companies.
Other Key Characteristics of IRM
Policy Creation and Management IRM allows for the creation and enforcement of policies governing access and use of sensitive or confi dential e-documents. The organization’s IG team sets the policies for access based on role and organizational level, determining what employees can and cannot do with the secured e-documents. 44 The IG policy defi ned for a document type includes these following controls:
1. Viewing 2. Editing 3. Copy/Paste (including screen capture) 4. Printing 5. Forwarding e-mail containing secured e-documents
Access to sensitive e-documents may be revoked at any time, no matter where they are located or what media they are on, since each time a user tries to access a document, access rights are verifi ed with a server or cloud IRM application. This can be done remotely—that is, when an attempt is made to open the document, an authorization must take place. In cloud-based implementations, it is a matter of simply denying access.
Decentralized Administration One of the key challenges of e-document security traditionally is that a system administrator had access to documents and reports that were meant only for
c11 225 March 6, 2014 2:58 PM
INFORMATION GOVERNANCE AND PRIVACY AND SECURITY FUNCTIONS 225
executives and senior managers. With IRM, the e-document owner administers the security of the data, which considerably reduces the risk of a document theft, alteration, or misuse.
Auditing Auditing provides the smoking-gun evidence in the event of a true security breach. Good IRM software provides an audit trail of how all documents secured by it are used. Some go further, providing more detailed document analytics of usage.
Integration To be viable, IRM must integrate with other enterprise-wide systems, such as ECM, customer relationship management, product life cycle management, enter- prise resource planning, e-mail management, message archiving, e-discovery, and a myriad of cloud-based systems. This is a characteristic of today’s newer wave of IRM software.
This ability to integrate with enterprise-based systems does not mean that IRM has to be deployed at an enterprise level. The best approach is to target one critical depart- ment or area with a strong business need and to keep the scope of the project narrow to gain an early success before expanding the implementation into other departments.
IRM embeds protection into the data (using encryption technology), allowing fi les to pro- tect themselves. IRM may be the best available security technology for the new mobile computing world of the permeable perimeter. 45
With IRM technology, a document owner can selectively prevent others from viewing, editing, copying, or printing it. Despite its promise, most enterprises do not use IRM, and if they do, they do not use it on an enterprisewide basis. This is due to the high complexity, rigidity, and cost of legacy IRM solutions.
It is clearly more diffi cult to use documents protected with IRM—especially when policy making and maintenance is not designed by role but rather by individual. Some early implementations of IRM by fi rst-to-market software development fi rms had as many as 200,000 different policies to maintain (for 200,000 employees). These have since been replaced by newer, second-wave IRM vendors, who have reduced that num- ber to a mere 200 policies, which is much more manageable. Older IRM installations require intrusive plug-in installation; they are limited in the platforms they support, and they largely prevent the use of newer platforms, such as smartphones, iPads, and other tablets. This is a real problem in a world where almost all executives carry a smartphone and use of tablets (especially the iPad) is growing.
Moreover, due to their basic design, fi rst-wave or legacy IRM is not a good fi t for organiza- tions aiming to protect documents shared outside company boundaries. These outdated IRM solutions were designed and developed in a world where organizations were more concerned with keeping information inside the perimeter than protecting information beyond the perimeter.
IRM technology protects e-documents and data directly rather than relying on perimeter security.
226 INFORMATION GOVERNANCE
c11 226 March 6, 2014 2:58 PM
Most initial providers of IRM focused on internal sharing and are heavily depen- dent on Microsoft Active Directory (AD) and lightweight directory access protocol (LDAP) for authentication. Also, the delivery model of older IRM solutions involves the deployment and management of multiple servers, SQL databases, AD/LDAP integration, and a great deal of confi guration. This makes them expensive and cum- bersome to implement and maintain. Furthermore, these older IRM solutions do not take advantage of or operate well in a cloud computing environment.
Although encryption and legacy IRM solutions have certain benefi ts, they are extremely unwieldy and complex and offer limited benefi ts in today’s technical and business environment. Newer IRM solutions are needed to provide more complete DLS.
Embedded Protection
IRM embeds protection into the data (using encryption technology), allowing fi les to protect themselves. IRM may be the best available security technology for the new mobile com- puting world of the permeable perimeter. 46
Is Encryption Enough?
Many of the early solutions for locking down data involved encryption in one form or another:
■ E-mail encryption ■ File encryption ■ Full Disk Encryption (FDE) ■ Enterprisewide encryption
These encryption solutions can be divided into two categories: encryption in transit (e.g., e-mail encryption) and encryption t at rest (e.g., FDE).t
The various encryption solutions mitigate some risks. In the case of data in transit, these risks could include an eavesdropper attempting to discern e-mail or network traffi c. In the case of at-rest data, risks include loss of a laptop or unauthorized access to an employee’s machine. The most advanced solutions are capable of applying a policy across the organization and encrypting fi les, e-mails, and even databases. However, encryption has its caveats.
Most simple encryption techniques necessarily involve the decryption of documents so they can be viewed or edited. At these points, the fi les are essentially exposed. Malware (e.g., Trojan horses, keystroke loggers) installed on a computer may use the opportunity to send out the plain-text fi le to unauthorized parties. Alternatively, an employee may copy the contents of these fi les and remove them from the enterprise.
Device Control Methods
Another method that is related to DLP is device control . Many vendors offer software or hardware that prevents users from copying data via the USB port to
c11 227 March 6, 2014 2:58 PM
INFORMATION GOVERNANCE AND PRIVACY AND SECURITY FUNCTIONS 227
portable drives and removing them from the organization in this manner. These solutions are typically as simple as blocking the ports; however, some DLP so- lutions, when installed on the client side, can selectively prevent the copying of certain documents. 47
Thin Clients
One last method worth mentioning is the use of thin clients to prevent data leaks. These provide a so-called walled garden containing only the applications users require to do their work, via a diskless terminal. This prevents users from copying any data onto portable media; however, if they have e-mail or Web access applications, they still can send information out via e-mail, blogs, or social networks.
Note about Database Security
Database security and monitoring is addressed in Chapter 10 , “IG for IT.”
Compliance Aspect
Compliance has been key in driving companies to invest in improving their security measures, such as fi rewalls, antivirus software, and DLP systems. More than 400 regulations exist worldwide mandating a plethora of information and data secu- rity requirements. One example is the Payment Card Industry Data Security Stan- dard (PCI-DSS), which is one of the strictest regulations for credit card processors. Companies that fail to comply with these regulations are subject to penalties of up to $500,000 per month for lost fi nancial data or credit card information. It is estimated that the per-record cost of a breach is $90 to $305.” 48 But do compliance activities always result in adequate protection of your sensitive data? In many cases the answer is no. It is important to keep in mind that being formally compliant does not mean the organization is actually secure. In fact, compliance is sometimes used as a fi g leaf, covering a lack of real document security. One needs to look no further than to the recent series of major document leakage incidents to understand this. Those all came from highly secure and regulated entities, such as banks, hospitals, and the military.
Hybrid Approach: Combining DLP and IRM Technologies
An idea being promoted recently is to make IRM an enforcement mechanism for platforms like DLP. Together, DLP and IRM accomplish what they independently cannot. Enterprises may be able to use their DLP tools to discover data fl ows, map them out, and detect transmissions of sensitive information. They can then apply their IRM or encryption protection to enforce their confi dentiality and information integrity goals. 49
Several vendors in the fi elds of DLP, encryption, and IRM have already announced in- tegrated products . However, at this point in time, most IRM solutions are by no meanss ready for prime time when it comes to this use. Only a select few second-wave IRM
228 INFORMATION GOVERNANCE
c11 228 March 6, 2014 2:58 PM
software providers can offer comprehensive, streamlined, persistent security across many platforms.
As the enterprise perimeter dissolves, document and data security should become the focus of the Internet security fi eld. However, most legacy solutions, such as encryp- tion and legacy IRM, are complex and expensive and provide only a partial solution to the key problems. Combining several methods offers effective countermeasures, but an ultimate solution has not yet arrived.
Securing Trade Secrets after Layoffs and Terminations
In today’s global economy—which has shifted labor demands—huge layoffs are not uncommon in the corporate and public sectors. The act of terminating an employee creates document security and IP challenges while raising the question: How does the organization retrieve and retain its IP and confi dential data? An IG program to secure information assets must also deal with everyday resignations of employees who are in possession of sensitive documents and information. 50
According to Peter Abatan, author of the Enterprise Digital Rights Management blog, “As a general rule all organizations should classify all their documents with the aim of identifying the ones that need persistent protection” (emphasis added). That is to say, docu-” ments should be protected at all times, regardless of where they travel and who is using them, while the organization still retains control of usage rights. There are two basic technological approaches to this protection:
1. The fi rst, as discussed earlier in this chapter, is combining IRM with DLP ; P DLP is used to conduct deep content inspection and identify all documents that may contain sensitive information, then the DLP agent “notifi es the en- terprise [information] rights management engine that sensitive information is about to be copied to external media or outside the fi rewall and therefore needs to be encrypted.”
2. The second is using a form of context-sensitive IRM “in which all documents M that contain sensitive data defi ned in the [global] data dictionary [are] auto- matically encrypted.”
These two technological approaches must be fostered by an IG program. They can have signifi cant positive impact in protecting sensitive information, no matter where it is located, and can help document owners withdraw access to its sensitive documents at any time.
Organizations must educate their employees to increase awareness of the fi nancial and competitive impact of breaches and to clarify that sensitive documents are the property of the organization. If those handling sensitive documents are informed of the benefi ts of IRM and related technologies, they will be more vigilant in their efforts to keep information assets secure.
Persistently Protecting Blueprints and CAD Documents
Certain IRM software providers have focused on securing large-format engineer- ing and design documents, and they have made great strides in the protection of
c11 229 March 6, 2014 2:58 PM
INFORMATION GOVERNANCE AND PRIVACY AND SECURITY FUNCTIONS 229
computer-aided design fi les. As much as 95 percent of CAD fi les are proprietary designs and represent valuable, proprietary IP of businesses worldwide. And CAD fi les are just as vulnerable as any other e-document in that, when unprotected, they “can be emailed or transferred to another party without the knowledge of the owner of the content.”51
In today’s global economy, it is common to conduct manufacturing operations in markets where labor is inexpensive and regulations are lax. Many designs are sent to China, Indonesia, and India for manufacturing. Although they usually are accompa- nied by binding confi dential disclosure contracts, but these agreements are often dif- fi cult to enforce, especially given the disparity in cultures and laws. And what happens if a rogue employee in possession of designs and trade secrets absconds with them and sells them to a competitor? Or starts a competing business? There are a number of examples of this happening.
Owners of valuable proprietary IP must vigilantly protect it; the very survival of the business may depend on it. Monitoring and securing IP wherever it might travel is now a business imperative.
Theft of IP and confi dential information represents a clear and present danger to all types of businesses, especially global brands dependent on proprietary designs for a competitive advantage. Immediate IG action by executive management is required to identify possible leaks and plug the holes. Not safeguarding IP and confi dential or sensitive documents puts the organization’s competitive position, strategic plans, rev- enue stream, and very future at risk.
Securing Internal Price Lists
In 2010, it was reported that confi dential information about the advertising expen- ditures of some of Google’s major accounts was leaked to the public. 52 This may not seem like a signifi cant breach, but, in fact, with this information, Google’s custom- ers can determine if they are getting a preferred price schedule, and competitors can easily undercut Google’s pricing for major customers. According to Peter Abatan, “[It is clear] why this information is so critical to Google that this information is tight- ly secured.”
Is your company’s price list secured at all times? Price lists are confi dential infor- mation assets, and if they are revealed publicly, major customers could demand steeper discounts and business relationships could suffer irreparable damage, especially if cus- tomers fi nd out they are paying more for a product or service than their competitors.
A company’s price list is critical to an organization because it impacts all aspects of the business, from the ability to generate revenue to private dealings with customers and suppliers. IRM should be used to protect price lists, and printing of these valuable
As much as 95 percent of CAD fi les are proprietary designs and represent valuable IP.
230 INFORMATION GOVERNANCE
c11 230 March 6, 2014 2:58 PM
lists must be monitored and controlled using secure printing methods and document analytics.
Confi dential information should be persistently protected throughout their docu- ment life cycle in all three states (at rest, in motion, and in use) so that if they are com- promised or stolen, they are still protected and controlled by the owning organization.
Approaches for Securing Data Once It Leaves the Organization
It is obvious with today’s trends that, as Andrew Jaquith of SilverSky (formerly with Forrester Research) states, “The enterprise security perimeter is quickly dissolving.” A lot of valuable information is routed outside the owning organization through unse- cured e-mail. A breach can compromise competitive position, especially in cases deal- ing with personnel fi les and marketing plans or merger details. Consider for a moment that even proprietary software and company fi nancial statements are sent out. Expo- sure of this data can have real fi nancial impact. Without additional protections, such as IRM and e-mail encryption, these valuable information assets are often out of the control of the IT department of the owning organization. 53
Third-party possession or control of enterprise data is a critical point of vulner- ability, and many organizations realize that securing data outside the organizational perimeter is a high priority. But a new concept has cropped up of late that bucks un- conventional wisdom: “ Control does not require ownership.”
Instead of focusing on securing devices where confi dential data is accessed, the new thinking focuses on securing the data and documents directly. With this new mind-set, security can be planned under the assumption that the enterprise owns its data but none of the devices that access it. As Forrester’s report states, “Don’t trust the endpoints. Treat them as hostile”. This is referred to as the zero-trust model of infor- mation security. The report states: “...trust but verify applies here. Enterprises must put teeth into their contractual language and audit their partners.” 54
Forrester has developed a new network architecture that builds security into the DNA of a network, using a mixture of fi ve data security design patterns:
1. Thin client. Access information online only, with no local operations, using a diskless terminal that cannot store data, documents, or programs so confi den- tial information stays stored and secured centrally. For additional security, “IT can restrict host copy-and-paste operations, limit data transfers, and require strong or two-factor authentication using SecurID or other tokens.”
2. Thin device. Devices such as smartphones, which have limited computing resources, Web surfi ng, e-mail, and basic Web apps that locally conduct no real information processing, are categorized as thin devices. In practice, these devices do not hold original documents but merely copies, so the offi cial busi- ness record or master copy cannot be altered or deleted. A nice feature of many smartphones is the ability to erase or wipe data remotely, in the event the device is lost. According to the Forrester report, “For insurance, thin de- vices can be remotely wiped—making them truly ‘disposable,’ unlike PCs.” 55
3. Protected process. This approach allows local processing with a PC where confi - dential e-documents and data are stored and processed in a partition that is highly secure and controlled. This processing can occur even if the PC is not
c11 231 March 6, 2014 2:58 PM
INFORMATION GOVERNANCE AND PRIVACY AND SECURITY FUNCTIONS 231
owned and controlled by the organization. “The protected process pattern has many advantages: local execution, offl ine operation, central manage- ment, and a high degree of granular security control, including remote wipe [erase].” A mitigating factor to consider here is most business PCs today are Windows based, and the world is rapidly moving to other, more nimble platforms.
4. Protected data. Deploying IRM and embedding security into the documents (or data) provides complete DLS. The newer wave of more sophisticated, easier-to-use IRM vendors have role-based policy implementation and such features as “contextual” enforcement, where document rights are dependent on the context —that is, tt where and when a user attempts access. For instance, allow access to documents on workers’ desktops but not on their laptops; or provide access to printing confi dential documents at the facility during offi ce hours but not after. “ Of all the patterns in the Zero Trust data security strategy, protected data is the most fi ne-grained and effective because it focuses on the informa- tion, not its containers.”
5. Eye in the sky. This design pattern uses technologies such as DLP to scan network traffi c content and halt confi dential documents or sensitive data at the perimeter. Deployed properly, DLP is “ideal for understanding the veloc- ity and direction of information fl ow and for detecting potential breaches, outliers, or anomalous transmissions.” It should be noted that DLP does not provide complete protection. To do so would mean that many legitimate and sanctioned e-mails and documents would be held up for inspection, thus slow- ing the business process. As stated earlier, DLP is best for discovering infor- mation fl ows and monitoring network traffi c. Another negative is that you cannot always require partner organizations and suppliers to install DLP on their computers. So this is a complementary technology, not a complete solu- tion to securing confi dential information assets.
By discarding the “age-old confl ation of ownership and control, enterprises will be able to build data protection programs that encompass all possible ownership sce- narios, including Tech Populism, offshoring, and outsourcing.”
Document Labeling
Document labeling is “an easy way to g increase user awareness about the sensitivity of information in a document”(emphasis added).56 What is it? It is the process of attach- ing a label to classify a document. For instance, who would not know that a document labeled “confi dential” is indeed confi dential? If the label appears prominently at the top of a document, it is diffi cult for persons accessing it to claim they did not know it was sensitive.
The challenge is to standardize and formalize the process of s getting the label onto the document— tt enterprisewide. This issue would be addressed in an IG effort focused on se- curing confi dential e-documents, or may also be a part of a classifi cation and taxonomy design effort. It cannot simply be left up to users to type in labels themselves, or it will not be suffi ciently executed and will end up leaving a mishmash of labeled documents without any formal classifi cation.
232 INFORMATION GOVERNANCE
c11 232 March 6, 2014 2:58 PM
Another great challenge are legacy or archived documents, which are the lion’s share of an organization’s information assets. How do you go back and label those? One by one? Nope. Not practical.
Some content repositories or portals, such as Microsoft SharePoint®, provide some functionality toward addressing the document labeling challenge. SharePoint is the most popular platform for sharing documents today.
SharePoint has an information management policy tool called Labels, which can be used to add document labels, such as Confi dential , to the top of documents:l
There are several options available for administrators to customize the labels, including the ability to:
1. Prompt users to add the label when they save or print, rather than relying on the user to click the Label button in the ribbon;
2. Specify labels containing static text and/or variables such as Project Name; 3. Control the appearance of the labels, such as font, size, and justifi cation. 57
The labels are easily added from within Microsoft Offi ce Word, PowerPoint, and Excel. One method that can be used is for the user to click the Label button on the Insert ribbon group; another method is to add the label through a prompt that appears when a user saves or prints a document (if the administrator has confi gured this option).
The labeling capabilities in document and content management systems such as Microsoft’s SharePoint are a good start for increasing user awareness and improving the handling of sensitive documents. However, the document labeling capabilities of Share- Point are basic and limited . These basic capabilities may provide a partial or temporary d solution, although organizations aiming for a high level of security and confi dentiality for their documents will need to search for supplemental technologies from third- party software providers. For instance, fi nding the capabilities to label documents in bulk rather than one by one, add watermarks, or force users to save or print documents with a standard document label that cannot be altered may require looking at alterna- tives. Some are software vendors have enhanced the SharePoint document labeling capability and may provide the complete solution.
Document Analytics
Some software providers also provide document analytics capabilities that monitor the access, use, and printing of documents and create real-time graphical reports of docu- ment use activities. These capabilities are very valuable.
Document analytics allows a compliance offi cer or system administrator to view exactly how many documents a user accesses in a day and how many documents the user accesses on average. Using this information, analytics monitors can look for spikes or anomalies in use. It is also possible to establish baselines and compare usage with that of an employee’s peers, as well as with his or her past document usage. If, for instance, a user normally accesses an average of 25 documents a day and that sud- denly spikes to 200, the system sends an alert, and perhaps it is time to pay a visit to that person’s offi ce. Or, if an employee normally prints 50 pages per day, then one day prints 250 pages, a fl ag is raised. Document analytics capabilities can go so far as to
c11 233 March 6, 2014 2:58 PM
INFORMATION GOVERNANCE AND PRIVACY AND SECURITY FUNCTIONS 233
calculate the average time a user spends reading a document; signifi cant time fl uctua- tions can be fl agged as potentially suspicious activity.
Confi dential Stream Messaging
E-mail is dangerous. It contains much of an organization’s confi dential information, and 99 percent of the time it is sent out unsecured. It has been estimated that as many as 20 percent of e-mail messages transmitted pose a legal, fi nancial, or regulatory threat to the organization. Specifi cally, “34 of employers investigated a leak of confi dential busi- ness information via email, and an additional 26% of organizations suffered the expo- sure of embarrassing or sensitive information during the course of a year,” according to Nancy Flynn, Executive Director of the ePolicy Institute. These numbers are rising, giv- ing managers and business owners cause to look for confi dential messaging solutions. 58
Since stream messaging separates the header and identifying information from the message, sends them separately, and leaves no record or trace, it is a good option for executives and managers, particularly when engaged in sensitive negotiations, litigation, or other highly confi dential activities. Whereas e-mail leaves behind an indelible fi n- gerprint that lives forever on multiple servers and systems, stream messaging does not.
Business records, IP and trade secrets, and confi dential executive communications can be protected by implementing stream messaging. It can be implemented alongside and in concert with a regular e-mail system, but clear rules on the use of stream mes- saging must be established, and access to it must be tightly restricted to a small circle of key executives and managers.
The ePolicy Institute offers seven steps to controlling stream messaging:
1. Work with your legal counsel to defi ne “business record” for your organization on a companywide basis. Establish written records retention policies, dispo- sition and destruction schedules. And litigation hold rules. Support the email retention policy with a bona fi de email archiving solution to facilitate the in- dexing, preservation and production of legally authentic records. Implement a formal electronic records management system to manage all records.
2. Work with your legal counsel to determine when, how, why, and with whom confi dential stream messaging is the most appropriate, effective— and legally compliant—way to hold recordless, confi dential business dis- cussions when permanent records are not required.
3. In order to preserve attorney-client privilege, a phone call or confi dential electronic messaging may be preferable to email. Have corporate counsel spell out the manner in which executives and employees should communi- cate with lawyers when discussing business, seeking legal advice, or asking questions related to specifi c litigation.
4. Defi ne key terms for employees. Don’t assume employees understand what management means when using terms like “confi dential,” “proprietary,” or “private” or “intellectual property,” etc. Employees must clearly understand defi nitions If they are to comply with confi dentiality rules.
5. Implement written rules and policies governing the use of email and con- fi dential stream messaging. E-policies should be written clearly and should
234 INFORMATION GOVERNANCE
c11 234 March 6, 2014 2:58 PM
be easy for employees to access, and understand. Make them [as] “short and sweet” as possible. Do not leave anything up to interpretation.
6. Distribute a hard copy of the new confi dential messaging policy, email pol- icy and other electronic communications (e.g., social media, blogs). Insist that each and every employee signs and dates the policy, acknowledging that they understand and accept it and that disciplinary action including termi- nation may result from violation of the organization’s established policies.
7. Educate, educate, educate. Ensure that all employees who need to know the difference between email which leaves a potential business record and stream messaging which does not, and is confi dential. 59
Securing personal, classifi ed, or confi dential information effectively requires an eclectic, multifaceted approach. It takes clear and enforced IG policies, a collection of technologies, and regular testing and audits, both internally and by a trusted third party.
CHAPTER SUMMARY: KEY POINTS
■ The average cost of a data breach in 2013 was over $5 million.
■ Attacks on organizations’ networks and theft of their IP continue to increase. There were an estimated 354 million privacy breaches between 2005 and 2010 in the United States alone.
■ Attacks can continue in organizations for years before they are uncovered—if they are discovered at all.
■ All organizations should classify all their documents with the aim of identify- ing the ones that need persistent security protection.
■ Today’s ECM and document management solutions rely mostly on perimeter security and were not designed to allow for secure document sharing and collaboration.
■ Businesses are operating in a more distributed model than ever before, and they are increasingly sharing and collaborating—exposing confi dential documents.
■ Secure document printing reduces the chance that fi les can be compro- mised during or after printing. There are various methods to secure the print stream, depending on the print manufacturer. Copies or remnants of large print fi les often exist unsecured on the hard drives of high-speed printers. These fi les must be completely wiped to ensure security.
■ Identity and access management (IAM) software governs user access to in- formation through an automated, continuous process that addresses access creep, whereby employees move to a different business unit and their access rights are not updated.
c11 235 March 6, 2014 2:58 PM
INFORMATION GOVERNANCE AND PRIVACY AND SECURITY FUNCTIONS 235
■ Data governance software is another tool that looks at who is accessing which documents and creates a matrix of roles and access along behavioral lines.
■ Encrypting sensitive e-mail messages is an effective step to securing con- fi dential information assets while in transit. Encryption can be applied to desktop folders and fi les.
■ For e-mail communication with no trace or record, stream messaging is a solution.
■ Digital signatures authenticate the identity of the signatory and prove that the signature was, in fact, generated by the claimed signatory. This is known as nonrepudiation.
■ Data loss prevention technology performs a “deep content inspection” of all e-documents and e-mails before they leave the organization’s perimeter to stop sensitive data from exiting the fi rewall.
■ DLP can be used to discover the fl ow of information within an organization. Additional security tools can then be applied. This may be the best use for DLP.
■ Information rights management software enforces and manages use rights of electronic documents. IRM provides a sort of security wrapper around docu- ments and protects sensitive information assets from unauthorized use or copying. IRM is also known as enterprise rights management.
■ Persistent security tools like IRM should be enforced on price lists, proprietary blueprints, and CAD designs. Printing these documents should be highly restricted.
■ Most legacy or fi rst-to-market providers of IRM focused on internal sharing and are heavily dependent on Microsoft Active Directory and lightweight di- rectory access protocol (LDAP) for authentication. These early solutions were not built for cloud use or the distributed enterprises of today, where mobile devices are proliferating.
■ DLP started in the form of network gateways (much like fi rewalls) that searched e-mails, Web traffi c, and other forms of information for data that was defi ned as internal. When it detected such data, it blocked it from leav- ing the perimeter or monitored its use.
■ Soon agent-based DLP technologies were introduced, performing the same action locally on users’ computers. The next step brought a consolidation of many agent- and network-based technologies to offer a more comprehen- sive solution.
CHAPTER SUMMARY: KEY POINTS (Continued )
(( dcontinued ) )dd
236 INFORMATION GOVERNANCE
c11 236 March 6, 2014 2:58 PM
Notes
1. Ponemon Institute Research Report, “2013 Cost of Data Breach Study: United States,” May 2013, www .symantec.com/content/en/us/about/media/pdfs/b-cost-of-a-data-breach-us-report-2013.en-us.pdf
2. Jim Finkle, “‘State Actor’ behind Slew of Cyber Attacks,” Reuters, August 3, 2011, www.reuters.com/ article/2011/08/03/us-cyberattacks-idUSTRE7720HU20110803 (accessed August 18, 2011).
3. Ibid. 4. Ibid. 5. Ibid. 6. Peter Abatan, “Persistently Protecting Your Computer Aided Designs,” Enterprise Digital Rights Man-
agement, http://enterprisedrm.tumblr.com/post/1423979379/persistently-protecting-your-computer- aided-designs (accessed August 18, 2011).
7. Ari Ruppin, March 20, 2011 via e-mail. 8. Sam Narisi, “IT’s role in secure staff cuts,” March 2, 2009. www.fi nancetechnews.com/its-role-in-
secure-staff-cuts/ 9. Ibid. 10. Shira Scheindlin and Daniel Capra, The Sedona Conference, Electronic Discovery and Digital Evidence ,
Thomson Reuters, 2009, p. 204, www.amazon.com/Scheindlin-Conferences-Electronic-Discovery-Evidence- ebook/dp/B00AUE0LRI
11. Oracle White Paper, “Oracle Information Rights Management 11g—Managing Information Every- where It Is Stored and Used,” March 2010 p. 4, www.oracle.com/technetwork/middleware/webcenter/ content/irm-technical-whitepaper-134345.pdf (accessed December 23, 2011).
12. Ibid. 13. Open Web Application Security Project, “Defense in Depth,” https://www.owasp.org/index.php/
Defense_in_depth (accessed June 24, 2013). 14. HCL, “Identity and Access Management Services,” www.hclisd.com/identity-and-access-management
.aspx (accessed September 2, 2011). 15. Ibid. 16. Ibid. 17. Nicola Clark and David Jolly, “Fraud Costs Bank 7.1 Billion,” New York Times , January 25, 2008, wwws
.nytimes.com/2008/01/25/business/worldbusiness/25bank-web.html?hp (accessed September 2, 2011).
■ Combining IRM and DLP technologies is the best available approach to securing e-documents and data. Other encryption methods should also be utilized, such as e-mail encryption and FDE).
■ The use of thin-client and thin-device architecture can reduce security threats to confi dential information assets.
■ Document analytics monitor the access, use, and printing of documents and create real-time graphical reports of document use activities.
■ Document labeling is an easy way to increase user awareness about the sen- sitivity of information in a document.
■ Stream messaging is a way to conduct sensitive business negotiations and activities without leaving a business record. Legal counsel must be consulted, and clear policies for regular e-mail versus stream messaging must be estab- lished and enforced.
CHAPTER SUMMARY: KEY POINTS (Continued )
c11 237 March 6, 2014 2:58 PM
INFORMATION GOVERNANCE AND PRIVACY AND SECURITY FUNCTIONS 237
18. Oracle White Paper, “Oracle Information Rights Management 11g.” 19. Robert Smallwood, “E-DRM Plugs ECM Security Gap,” KM World, April 1, 2008, www.kmworld.com/
Articles/News/News-Analysis/E-DRM-plugs-ECM-security-gap-41333.aspx (accessed March 30, 2012). 20. Adi Ruppin, March 20, 2011, via e-mail to author. 21. Annik Stahl, “Secure Printing: No More Mad Dashes to the Copy Room,” http://offi ce.microsoft.com/
en-us/help/secure-printing-no-more-mad-dashes-to-the-copy-room-HA001227631.aspx (accessed August 22, 2011).
22. Telephone interview of William Broddy by author, August 7, 2011. 23. Bill Blake, “WikiLeaks, the Pearl Harbor of the 21st Century,” eDocument Sciences LLC, December 6,
2010, http://edocumentsciences.com/wikileaks-the-pearl-harbor-of-the-21st-century. 24. VaporStream, www.vaporstream.com (accessed December 9, 2013). 25. Ibid. 26. Ibid. 27. NIST, “Federal Information Processing Standards Publication,” FIPS PUB 186-3, issued June 2009, http://
csrc.nist.gov/publications/fi ps/fi ps186-3/fi ps_186-3.pdf (accessed August 15, 2011). FIPS Publication 186-3 (dated June 2009), was superseded on July 19, 2013 and is provided here only for historical purposes. For the most current revision of this publication, see: http://csrc.nist.gov/publications/PubsFIPS.html
28. Doug Miles, AIIM White Paper, “Digital Signatures – Making the Business Case,” http://www.arx .com/fi les/DOCUMENTS/Digital-Signatures-for-Document-Workfl ow-and-SharePoint-Survey.pdf (accessed December 9, 2013).
29. Computer Desktop Encyclopedia, www.computerlanguage.com, retrieved March 30, 2012. 30. Doug Miles, AIIM White Paper, “Digital Signatures – Making the Business Case.” 31. Ibid. 32. Ibid. 33. Ibid. 34. Ari Ruppin, March 20, 2011, via e-mail. 35. Fred Donovan, “Gartner: Enterprise Content-Aware Data Loss Prevention Market to Reach $670 Million
This Year,” February 7, 2013, www.fi erceenterprisecommunications.com/story/gartner-enterprise-content- aware-data-loss-prevention-market-reach-670-mill/2013-02-07
36. Data Loss Prevention Experts, “DLP Product Guide for RSA Conference Expo 2011,” January 17, 2011, www.dlpexperts.com/dlpxblog/2011/1/17/dlp-product-guide-for-rsa-conference-expo-2011 .html (accessed August 22, 2011).
37. Ibid. 38. Ibid. 39. Ibid. 40. Peter Abatan, “Who Should Be Blamed for a Data Breach?” Enterprise Digital Rights Management,
http://enterprisedrm.tumblr.com/post/1087100940/who-should-be-blamed-for-a-data-breach (accessed December 9, 2013).
41. Peter Abatan, “Understanding Enterprise Rights Management,” Enterprise Digital Rights Manage- ment, www.enterprisedrm.info/page/2 (accessed August 3, 2011).
42. Robert Smallwood, “Securing Documents in the WikiLeaks Era,” May 28, 2011, www.kmworld.com/ Articles/Editorial/Feature/Securing-documents-in-the-WikiLeaks-era-75642.aspx (accessed August 1, 2011).
43. Oracle, IRM Technical White Paper , Oracle.com, February 2008 (accessed December 9, 2013). r 44. Abatan, “Understanding Enterprise Rights Management,” http://enterprisedrm.tumblr.com/page/3
(accessed December 9, 2013). 45. Ibid. 46. Ibid. 47. Ibid. 48. “http://www.bankersonline.com/bankrobbery/2007/04/if-you-remember-old-tv-commercials-for
.html?” 49. Abatan, “Understanding Enterprise Rights Management,” http://enterprisedrm.tumblr.com/page/3
(accessed December 9, 2013). 50. This discussion and quotes are from Peter Abatan, “Preparing for Staff Layoffs/Resignations where
Confi dential Information Is Concerned,” Enterprise Digital Rights Management, http://enterprisedrm .tumblr.com /post/1230356519/preparing-for-staff-layoffs-resignations (accessed December 9, 2013).
51. Ibid. 52. This discussion and quotes are from Peter Abatan, “Is Your Price List under Lock and Key?” Enter-
prise Digital Rights Management, http://enterprisedrm.tumblr.com/post/1120104758/is-your-price- list-under-lock-and-key (accessed August 18, 2011).
238 INFORMATION GOVERNANCE
c11 238 March 6, 2014 2:58 PM
53. This discussion and quotes are from “Own Nothing. Control Everything”, Forrester Research, Inc., January 22, 2010.
54. “Own Nothing. Control Everything”, Forrester Research, Inc., January 22, 2010. 55. “Own Nothing. Control Everything”, Forrester Research, Inc., January 22, 2010. 56. This discussion and quotes are from Charlie Pulfer, “Document Labeling in SharePoint,” September 13,
2009, www.contentmanagementconnection.com/Home/21196/ (accessed January 28, 2014. 57. Ibid. 58. Nancy Flynn, The E-Policy Handbook: Rules and Best Practices to Safely Manage Your Company’s E-Mail, Blogs,
Social Networking, and Other Electronic Communication Tools , 2nd ed. (New York: AMACOM, 2009), p. 57. s 59. Ibid., pp. 68–70.
c12 239 February 28, 2014 12:48 PM
PA RT F O U R Information Governance for Delivery Platforms
241
c12 241 February 28, 2014 12:48 PM
E -mail is a major area of focus for information governance (IG) efforts: It is the most common business software application and the backbone of business com- munications today, and e-mail is the leading piece of evidence requested during
the discovery phase of civil trials, so it is critically important to implement IG mea- sures for e-mail communications.
Employees utilize e-mail all day, including during their personal time, some- times mixing business and personal use of e-mail. Social media use has skyrocketed in recent years and actually has surpassed e-mail for personal use, but the fact remains that in business, knowledge workers rely on e-mail for almost all communications, including those of a sensitive nature. A 2013 survey of 2,400 corporate e-mail users worldwide found that nearly two-thirds stated that e-mail was their favorite form of business communication, surpassing not only social media but also telephone and in-person contact. 1
These e-mail communications may contain discoverable information in litigation, and a percentage of them will be declared formal business records. E-mail often contains records, such as fi nancial spreadsheets and reports, product price lists, marketing plans, com- petitive analyses, safety data, recruitment and salary details, progressing contract ne- gotiations, and other information that may be considered as constituting a business record.
E-mail systems can be hacked, monitored, and compromised and cause far-reaching damage to a victimized organization. The damage may occur slowly and go undetected while information assets—and business value—are eroded.
In mid-2011, the “hacktivist” group AntiSec claimed responsibility for hacking a U.S. government contractor, Booz Allen Hamilton, and publicly exposing 90,000 military e-mail addresses and passwords from the contractor by posting them online. It was the second attack on a government defense contractor in a single week. 2
Booz Allen employees “maintain high government security clearances” while working with the defense sector (yet in 2013 another Booz Allen employee, Edward Snowden, gained access to secret communications monitoring programs that the U.S.
Information Governance for E-Mail and Instant Messaging*
C H A P T E R 12
* Portions of this chapter are adapted from Chapter 11 , Robert F. Smallwood, Managing Electronic Records: Methods, Best Practices, and Technologies , © John Wiley & Sons, Inc., 2013. Reproduced with permission of John Wiley & Sons, Inc.s
Information Governance: Concepts, Strategies and Best Practices By Robert F. Smallwood Copyright © 2014 by Robert F. Smallwood
242 INFORMATION GOVERNANCE
c12 242 February 28, 2014 12:48 PM
National Security Agency operated to capture metadata and other information from the private e-mail and telephone conversations of American citizens on a broad scale). AntiSec penetrated the communications systems with relative ease and noted there were “basically had no security measures in place.” 3 AntiSec was able to go even fur- ther, by running its own rogue application to steal software source code and to search and fi nd access credentials to steal data from other servers, which the group said would help it to infi ltrate other federal contractors and agencies. It even stated it might pass the security information on to other hackers.
The attack did not stop there. Later that week, another federal defense and FBI contractor, IRC Federal, was hacked, databases were invaded, the Web site was modi- fi ed, and information from internal e-mail messages was posted online. 4
Employees Regularly Expose Organizations to E-Mail Risk
A 2011 global e-mail survey, commissioned by a leading hosted e-mail services pro- vider, found that nearly 80 percent of all employees send work e-mail to and from their personal accounts, and 20 percent do so regularly, which means that critical informa- tion assets are exposed to uncontrolled security risks. 5
“Awareness of the security risks this behavior poses does not act as a deterrent” (emphasis” added). Over 70 percent of people questioned recognize that there is an additional risk in sending work documents outside the corporate e-mail environment, but almost half of “these same respondents feel it is acceptable to send work emails and documents to personal email accounts anyway.” According to the survey, the reasons for using personal e-mail accounts for work purposes range from working on documents remotely (71 percent), to sending fi les that are too big for the company mailbox (21 percent), to taking documents with them when they leave a company (18 percent), to simply not wanting to carry a laptop home (9 percent). The top two frustrations users had with work e-mail were restrictions on mailbox size, which has a negative impact on e-mail management, and the inability to send large attachments. This second issue often forces workers to use a personal account to send and receive necessary fi les. If size limits are imposed on mailboxes and attachments, companies must provide a secure alternative for fi le storage and transfer. Otherwise, employees are pushed into risking corporate information assets via personal e-mail. This scenario not only complicates things for e-mail administrators but has serious legal and regulatory implications. Clearly, as stated by Paul Mah in his “Email Admin” blog, “email retention and archival becomes an impossible task when emails are routed in a haphazard manner via personal accounts.”6
This means that security, privacy, and records management issues must be ad- dressed by fi rst creating IG policies to control and manage the use of e-mail. These policies can utilize the e-mail system’s included security features and also employ ad- ditional monitoring and security technologies where needed.
The e-mail survey also found an overall lack of clear e-mail policies and weak communication of existing guidelines. This means a lack of IG. Nearly half of the respondents stated either that their company had no e-mail policy or that they were unaware of one. Among those aware of a corporate e-mail policy, 4 in 10 think it could be communicated better. Among companies that have a policy, most (88 percent) deal with the appropriate use of e-mail as a business tool, but less than one-third (30 percent) address e-mail retention from a security standpoint.
c12 243 February 28, 2014 12:48 PM
INFORMATION GOVERNANCE FOR E-MAIL AND INSTANT MESSAGING 243
Generally, employees are aware that sending work documents outside of their corporate network is unsafe, yet they continue to do so. It is abundantly clear that e-mail policies have to be updated and upgraded to accommodate and manage the increasingly sophisticated and computer-savvy generation of users who are able to fi nd ways to work around corporate e-mail restrictions. (These users have been dubbed Generation Gmail. ) In addition, new e-mail monitoring and security technologies need to be deployed to counter this risky practice, which exposes information assets to prying eyes or malicious attacks.
E-Mail Polices Should Be Realistic and Technology Agnostic
E-mail policies as part of your IG program must not be too restrictive. It may be tempting to include catchall policies that attempt to tamp down user behavior, but such efforts cannot succeed. 7 An important step is consulting with stakeholders to understand their usage patterns and needs and then going through a series of drafts of the policy, allowing for input. It may be determined that some exceptions and changes in technologies need to be factored in and that some additional technology is needed to accommodate users while keeping information assets safer and meeting compliance and legal demands. Specifi cs of these policies and tools should be progressively tight- ened on a regular basis as the process moves forward.
These new IG guidelines and policies need to refer to technology in a generic sense—a “technology-neutral” sense—rather than specifying proprietary software programs or features. 8 That is to say, they should be written so that they are not in t need of revision as soon as new technologies are deployed.
Developing organization-wide IG policies is time consuming and expensive; they are a defensive measure that does not produce revenue, so managers, pressed for performance, often relegate policy making to the low-priority list. Certainly, it is a tedious, diffi cult task, so organizations should aim to develop policies that are fl exible enough to stand the test of time. But it is also necessary to establish a review process to periodically revise policies to accommodate changes in the business environment, the law, and technology.
Here is an example of a technology-agnostic policy directive:
All confi dential information must be encrypted before being transmitted over the Internet.
This statement does not specify the technology to be used, or the mode of trans- mission. The policy is neutral enough to cover not only e-mail and instant messaging (IM) but also social media, cloud computing, mobile computing, and other means of communication. The policy also does not specify the method or brand of the encryp- tion technology, so the organization can select the best method and technology avail- able in the future without adapting the policy.9
E-Record Retention: Fundamentally a Legal Issue
Considering the massive volume of e-mail exchanged in business today, most e-mail messages do not rise to the level of being formal business records. But many of them do and are subject to IG, regulatory compliance, and legal requirements for maintain- ing and producing business records.
244 INFORMATION GOVERNANCE
c12 244 February 28, 2014 12:48 PM
Although often lumped in with other information technology (IT) concerns, the retention of e-mail and other e-records is ultimately a legal issue. Other departments, including records management and business units, should certainly have input and should work to assist the legal team to record retention challenges and archiving solutions. But e-mail and e-record retention is “fundamentally a legal issue,”l particularly for public or highly regulated companies. According to Nancy Flynn of the ePolicy Institute, “It is essential for the organization’s legal department to take the lead in determining precisely which types of email messages will be preserved, exactly how and where data will be stored, and specifi cally when —if ever—electronically stored information [ESI] will be deleted” 10 (emphasis added).
Since they are often shot out in the heat of battle, many times e-mail messages are evidence of a smoking gun in lawsuits and investigations. In fact, they are the most requested type of evidence in civil litigation today. The content and timing of e-mail messages can provide exonerating information too.
In January 2010, a U.S. House of Representatives committee probing bailout deals subpoenaed the Federal Reserve Bank of New York for e-mail and other correspon- dence from Treasury Secretary Timothy Geithner (former president of the New York Federal Reserve Bank) and other offi cials. The House Oversight and Government Reform Committee was in the process of examining New York Fed decisions that fun- neled billions of dollars to big banks, including Goldman Sachs Group and Morgan Stanley.11
This is just one example of how crucial e-mail messages can be in legal investiga- tions and how they play an important role in reconstructing events and motives for legal purposes.
Preserve E-Mail Integrity and Admissibility with Automatic Archiving
Most users are not aware that e-mail contents and characteristics can be changed— “and rendered legally invalid”—by anyone with malicious motives, including those who are essentially “covering their tracks.” Not only can the content be edited, but metadata that includes such information as the time, date, and total number of charac- ters in the message can also be changed retroactively. 12
To offset this risk and ensure that spoliation (i.e., the loss of proven authenticity of an e-mail) does not occur, all messages, both inbound and outbound, should be captured and archived automatically and in real time. This preserves legal validity and forensic compliance. Additionally, e-mail should be indexed to facilitate the searching process, and all messages should be secured in a single location. With these measures, e-mail records can be assured to be authentic and reliable.
Managing e-records is primarily a legal issue, especially for public and heavily regulated companies.
c12 245 February 28, 2014 12:48 PM
INFORMATION GOVERNANCE FOR E-MAIL AND INSTANT MESSAGING 245
E-Mail Archiving Rationale: Compliance, Legal, and Business Reasons
There are good reasons to archive e-mail and retain it according to a specifi c retention schedule that follows your organization’s IG policies. Having a handle on managing voluminous e-mail archives translates to being able to effectively and rapidly search and retrieve exactly the right messages, which can provide a signifi cant legal advantage. It gives your legal team more and better information and more time to fi gure out how to leverage it in legal strategy sessions. This means the odds are tipped in your organization’s favor in the inevitable litigation arena. Your legal opponent may be driven to settle a weak claim when confronted with indisputable e-mail evidence, and, in fact, “email often produces supportive evidence that may help ‘save the day’ by providing valuable legal proof” of innocence.13 This evidence may stop frivolous lawsuits in their tracks. Further, reliable e-mail evidence also can curtail lengthy and expensive lawsuits, and prevail. And if your company is public, Sarbanes–Oxley regulations require the archiving of e-mail.
Don’t Confuse E-Mail Archiving with Backup
All backups are not created equal. There is a big difference between traditional system back- ups and specialized e-mail archiving software.
Backups are huge dumps to mass storage, where the data is stored sequentially and not compressed or indexed. 14 It is impossible to search backups except by date, and even doing that would mean combing through troves of raw, non-indexed data.
The chief executive may not be aware of it, but without true e-mail archiving, system administrators could spend long nights loading old tapes and churning out volumes of data, and legal teams will bill hourly for manual searches through troves of data. This compromises your enterprise’s legal position and not only increases raw costs but also leads to less capable and informed legal representation. According to one study, fully one-third of IT managers state they would have diffi culty producing an e-mail that is more than one year old. “A backup system is no substitute for automatic archiving technology”15 (emphasis added).
No Personal Archiving in the Workplace
Employees are naturally going to want to back up their most important fi les, just as they probably do at home. But for an overall IG information-security program to be effective, personal archiving at work must be prohibited. This underground archiving results in hidden shadow fi les and is time consuming and risky. According to Flynn, “Self-managed email can result in the deletion of electronic records, alteration of email evidence, time-consuming searches for back-up tapes, and failure to comply with legal discovery demands” (emphasis added). Also, users may compromise formal electronic records, or they may work from unoffi cial records, which therefore by defi nition might be inaccurate or out-of-date, posing compliance and legal ramifi cations. 16
Are All E-Mails Records?
Are e-mail messages records? This question has been debated for years. The short answer is no, not all e-mail messages constitute a record. But how do you determine
246 INFORMATION GOVERNANCE
c12 246 February 28, 2014 12:48 PM
whether certain messages are a business record or not? The general answer is that a record documents a transaction or business-related event that may have legal rami- fi cations or historic value. Most important are business activities that may relate to compliance requirements or those that could possibly come into dispute in litigation. Particular consideration should be given to fi nancial transactions of any type.
Certainly evidence that required governance oversight or compliance activities have been completed needs to be documented and becomes a business record. Also, business transactions, in which there is an exchange of money or the equivalent in goods or services, are also business records. Today, these transactions are often documented by a quick e-mail. And, of course, any contracts (and any progressively developed or edited versions) that are exchanged through e-mail become business records.
The form or format of a potential record is irrelevant in determining whether it should be classifi ed as a business record. For instance, if a meeting of the board of directors is recorded by a digital video recorder and saved to DVD, it constitutes a record. If photographs are taken of a ground-breaking ceremony for a new manufac- turing plant, the photos are records too. If the company’s founders tape-recorded a message to future generations of management on reel-to-reel tape, it is a record also, since it has historical value. But most records are going to be in the form of paper, microfi lm, or an electronic document.
Here are three guidelines for determining whether an e-mail message should be considered a business record:
1. The e-mail documents a transaction or the progress toward an ultimate trans- action where anything of value is exchanged between two or more parties. All parts or characteristics of the transaction, including who (the parties to it), what, when, how much, and the composition of its components, are parts of the transaction. Often seemingly minor parts of a transaction are found bur- ied within an e-mail message. One example would be a last-minute discount offered by a supplier based on an order being placed or delivery being made within a specifi ed time frame.
2. The e-mail documents or provides support of a business activity occurring that pertains to internal corporate governance policies or compliance to externally mandated regulations.
3. The e-mail message documents other business activities that may possibly be disputed in the future, whether it ultimately involves litigation or not. (Most business disputes actually are resolved without litigation, provided that proof of your organization’s position can be shown.) For instance, your supplier may dispute the discount you take that was offered in an e-mail message and, once you forward the e-mail thread to the supplier, it acquiesces. 17
Destructive Retention of E-Mail
Destructive retention is an approach to e-mail archiving where e-mail messages are retained for a limited time (say, 90 days or six months), followed by their permanent manual or automatic deletion of messages from the company’s network, so long as there is no litigation hold or the e-mail has not been declared a record in accordance with IG and records management policies. Implementing this as a policy may shield
c12 247 February 28, 2014 12:48 PM
INFORMATION GOVERNANCE FOR E-MAIL AND INSTANT MESSAGING 247
the enterprise from retaining potentially libelous or litigious e-mail that is not a formal business record (e.g., off-color jokes or other personnel violations).
For heavily regulated industries, such as health care, energy, and fi nancial services, organizations may need to archive e-mail for longer periods of time.
Instant Messaging
Instant messaging (IM) use in enterprises has proliferated—despite the fact that fre- quently proper policies, controls, and security measures are not in place to prevent e-document and data loss. There are a variety of threats to IM use that enterprises must defend against to keep their information assets secure.
The fi rst basic IM systems, which came into use in the mid-1960s, had real-time text capabilities for routing messages to users logged on to the same mainframe com- puter. Early chat systems, such as AOL Instant Messenger, have been in use since the late 1980s, but true IM systems that included buddy list features appeared on the scene in the mid-1990s, followed by the release of Yahoo! and Microsoft IM systems. The use of these personal IM products in the workplace has created new security risks. 18
More secure enterprise instant messaging (EIM) products can be deployed. Leading EIM installed systems include IBM Lotus Sametime, Microsoft Offi ce Com- munications Server, Cisco Unifi ed Presence, and Jabber XCP. In the fi nancial sector, Bloomberg Messaging and Reuters Messaging are leading platforms.
By the year 2000, it was estimated that nearly 250 million people worldwide were making use of IM, and today estimates are that more than 2 billion people use IM, with the addition of hundreds of millions of users in China.
As with many technologies, IM became popular fi rst for personal use, then crept into the workplace—and exploded. IM is seen as a quicker and more effi cient way to communicate short messages than engaging in a telephone conversation or going through rounds of sending and receiving endless e-mail messages. The problem with IM is that many organizations are blind to the fact that their employees are going to use it one way or another , sometimes for short personal conversations outside the organization.r If unchecked, such messaging exposes the organization to a myriad of risks and gives hackers another way to compromise confi dential information assets.
Best Practices for Business IM Use
Employing best practices for enterprise IM use can help mitigate its security risks while helping to capitalize on the business agility and velocity benefi ts IM can provide. Best practices must be built in to IG policies governing the use of IM, although “the specifi cs of these best practices must be tailored for each organization’s unique needs.”
A methodology for forming IM-specifi c IG policies and implementing more secure use of IM must begin with surveying and documenting the proliferation of IM use in the organization. It should also discover how and why users are relying on IM—perhaps there is a shortcoming with their available IT tools and IM is a work-around.
Typically, executives will deny there is much use of IM and that if it is being used, its impact is not worth worrying about. Also, getting users to come clean about
248 INFORMATION GOVERNANCE
c12 248 February 28, 2014 12:48 PM
their IM use may be diffi cult, since this may involve personal conversations and vio- lations of corporate policy. A survey is a good place to start, but more sophisticated network monitoring tools need to be used to factually discover what IM systems are actually in use.
Once this discovery process has concluded and the use of IM is mapped out, the IG team or steering committee must create or update policies to: decide which IM systems it will allow to be used, how, when, and by whom; decide what restrictions or safeguards must be imposed; and create guidelines as to appropriate use and content. As a part of an overall IG effort, Quest Software determined that a successful IM policy will:
■ Clearly and explicitly explain the organization’s instant messaging objectives. Users should know why the organization permits IM and how it is expected to be used.
■ Defi ne expectations of privacy. Users should be made aware that the organiza- tion has the right to monitor and log all IM sessions for corporate compli- ance, safety, and security reasons.
■ Detail acceptable and unacceptable uses. An exhaustive list of permitted and forbidden activities may not be necessary, but specifi c examples are helpful in establishing a framework of IM behaviors for users.
■ Detail content and contact restrictions (if any). Most organizations will want to limit the amount of idle IM chat that may occur with family, friends, and other nonbusiness-related contacts. There may also be additional issues related to information confi dentiality and privacy. Some businesses may choose to block the distribution of certain types of information via live IM chat session or fi le transfer.
■ Defi ne consequences for violations of the policy. Users should be advised of the consequences of policy violations. Generally these should be aligned with the company’s personnel and acceptable use policies.
The use of a standard disclaimer, to be inserted into all users’ IM sessions, can remind employees of appropriate IM use and that all chat sessions are being moni- tored and archived, and can be used in court or compliance hearings.
The next major step is to work with the IT staff to fi nd the best and most appropriate security and network monitoring tools, given the computing environ- ment. Alternatives must be researched, selected, and deployed. In this research and selection process, it is best to start with at least an informal survey of enterprises within the same industry to attempt to learn what has worked best for them.
The key to any compliance effort or legal action will be ensuring that IM records are true and authentic, so the exact, unaltered archiving of IM messages along with associated metadata should be implemented in real time. This is the only way to
Documenting IM use in the organization is the fi rst step in building IG policies to govern its use. Those policies must be tailored to the organization and its IM use.
c12 249 February 28, 2014 12:48 PM
INFORMATION GOVERNANCE FOR E-MAIL AND INSTANT MESSAGING 249
preserve business records that may be needed in the future. But in addition, a policy for deleting IM messages after a period of time, so long as they are not declared busi- ness records, must be formulated.
IG requires that these policies and practices not be static; rather, they must be reg- ularly revisited and updated to refl ect changes in technology and legal requirements and to address any shortcoming or failure of the IG policies or technologies deployed.
Technology to Monitor IM
Today, it has been estimated that as much as 80 percent of all IM used by corporate employees comes from free IM providers like Yahoo!, MSN, or AOL. These programs are also the least secure. Messages using these IM platforms can fl y around the Inter- net unprotected. Any monitoring technology implemented must have the capability to apply and enforce established IM use policies by constantly monitoring Internet traffi c to discover IM conversations. Traffi c containing certain keywords can be monitored or blocked, and chat sessions between forbidden users (e.g., those who are party to a lawsuit) can be stopped before they start. But this all necessarily starts with IG and policy formulation.
Tips for Safer IM
Organizations should assume that IM is being used, whether they have sanctioned it or not. And that may not be a bad thing—employees may have found a reasonable business use for which IM is expedient and effective. So management should not rush to ban its use in a knee-jerk reaction. Here are some tips for safer use of corporate IM:
■ Just as e-mail attachments and embedded links are suspect and can contain ma- licious executable fi les, beware of IM attachments too. The same rules governing s e-mail use apply to IM, in that employees should never open attachments from people they do not know. Even if they do know them, with phishing and social engineering scams, these attachments should fi rst be scanned for malware using antivirus tools.
■ Do not divulge any more personal information than is necessary. This comes into play even when creating screen names—so the naming convention for IM screen names must be standardized for the enterprise. Microsoft advises, “Your screen name should not provide or allude to personal information. For example, use a nickname such as SoccerFan instead of BaltimoreJenny.” 19
■ Keep IM screen names private ; treat them as another information asset that needs to be protected to reduce unwanted IM requests, phishing, or spam (actually spim , in IM parlance).
Records of IM use must be captured in real time and preserved to ensure they are reliable and accurate.
250 INFORMATION GOVERNANCE
c12 250 February 28, 2014 12:48 PM
■ Prohibit transmission of confi dential corporate information. It is fi ne to set up a meeting with auditors, but do not attach and route the latest fi nancial report through unsecured IM.
■ Restrict IM contacts to known business colleagues. If personal contacts are allowed for emergencies, limit personal use for everyday communication. In other words, do not get into a long personal IM conversation with a spouse or teen- ager while at work. Remember, these conversations are going to be monitored and archived.
■ Use caution when displaying default messages when you are unavailable or away. Details such as where an employee is going to have lunch or where their child is being picked up from school may expose the organization to liability if a hacker takes the information and uses it for criminal purposes. Employees may be un- knowingly putting themselves in harm’s way by giving out too much personal information.
■ Ensure that IM policies are being enforced by utilizing IM monitoring and fi ltering tools and by archiving messages in real time for a future verifi able record, should it be needed.
■ Conduct an IM usage policy review at least annually ; more often in the early stages of policy development.
CHAPTER SUMMARY: KEY POINTS
■ E-mail is a critical area for IG implementation, as it is a ubiquitous business communication tool and the leading piece of evidence requested at civil trials.
■ Nearly 80 percent of all employees send work e-mail messages to and from their personal e-mail accounts, which exposes critical information assets to uncontrolled security risks.
■ Meeting e-mail retention and archival requirements becomes an impossible task when e-mail messages are routed in a haphazard manner via personal accounts.
■ In developing e-mail policies, an important step is consulting with stakeholders.
■ E-mail policies must not be too restrictive or tied to a specifi c technology. They should be fl exible enough to accommodate changes in technology and should be reviewed and updated regularly.
■ Not all e-mail messages constitute a business record.
■ Not all e-mail rises to the level of admissible legal evidence. Certain condi- tions must be met.
■ Automatic archiving protects the integrity of e-mail for legal purposes.
c12 251 February 28, 2014 12:48 PM
INFORMATION GOVERNANCE FOR E-MAIL AND INSTANT MESSAGING 251
Notes
1. “Research Finds that Restrictive Email Policies are Creating Hidden Security Risks for Businesses,” BusinessWire , March 9, 2011, www.businesswire.com/news/home/20110309005960/en/Research- Finds-Restrictive-Email-Policies-Creating-Hidden .
2. Elizabeth Montalbano , “AntiSec Hacks Booz Allen, Posts Confi dential Military Email,” Information- Week , July 12, 2011, www.informationweek.com/news/security/attacks/231001418?cid=nl_IW_dai- ly_2011-07-12_html .
3. Ibid. 4. Mathew J. Schwartz, “AntiSec Hacks FBI Contractor,” InformationWeek , July 11, 2011, www.informa-
tionweek.com/news/security/attacks/231001326 . 5. Quotes from this survey are from “Research Finds That Restrictive Email Policies Are Creating Hid-
den Security Risks for Businesses.” 6. Paul Mah, “How to Reduce the Email Security Risks to Your Business,” EmailAdmin , March 10, 2011,
www.theemailadmin.com/2011/03/how-to-reduce-the-email-security-risks-to-your-business/ . 7. Blair Kahn, Information Nation: Seven Keys to Information Management Compliance (Silver Spring, MD:
AIIM International, 2004), pp. 98–99. 8. Ibid, pp. 95–96. 9. Ibid. 10. Nancy Flynn, The E-Policy Handbook: Rules and Best Practices to Safely Manage Your Company’s E-Mail, Blogs,
Social Networking, and Other Electronic Communication Tools , 2nd ed. (New York: AMACOM, 2009), 20.s 11. Hugh Son and Andrew Frye, “Geithner’s E-mails, Phone Logs Subpoenaed by House (update3),”
January 13, 2010, www.bloomberg.com/apps/news?pid=newsarchive&sid=aGzbhrSxFlXw ,. 12. Flynn, E-Policy Handbook , p. 37. 13. Flynn , E-Policy Handbook , pp. 40–41. 14. Nancy Flynn and Randolph Kahn, Email Rules, A Business Guide to Managing Policies, Security, and Legal
Issues for E-Mail and Digital Communication (New York: AMACOM, 2003), pp. 81–82.
■ Instant messaging use in business and the public sector has become wide- spread, despite the fact that often few controls or security measures are in place.
■ Typically as much as 80 percent of all IM use in corporations today is over free public networks, which heightens security concerns.
■ IM monitoring and management technology provides the crucial compo- nents that enable the organization to fully implement best practices for business IM.
■ Enterprise IM systems provide a greater level of security than IM from free services.
■ Regular analysis and modifi cation (if necessary) of business IM policies and practices will help organizations leverage the maximum benefi t from the technology.
■ Records of IM use must be captured in real time and preserved to ensure they are reliable and accurate.
CHAPTER SUMMARY: KEY POINTS (Continued )
252 INFORMATION GOVERNANCE
c12 252 February 28, 2014 12:48 PM
15. Flynn, The E-Policy Handbook , p. 41. 16. Ibid., p. 43. 17. Robert F. Smallwood, Taming the Email Tiger: Email Management for Compliance, Governance, & Litiga-
tion Readiness (New Orleans, LA: Bacchus Business Books, 2008). s 18. This discussion is based on Quest Software White Paper, “Best Practices in Instant Messaging
Management” (October 2008), http://media.govtech.net/Digital_Communities/Quest%20Software/ Best_Practices_in_Instant_Messaging_Management.pdf , p. 5.
19. M. Adeel Ansari, “10 Tips for Safer IM Instant Messaging,” July 6, 2008, http://adeelansari.wordpress. com/tag/safer-im-instant-messaging/ .
253
c13 253 February 28, 2014 6:24 PM
By Dr. Patricia Franks and Robert Smallwood
Information Governance for Social Media*
C H A P T E R 13
I nformation is the lifeblood of every organization, and an increasing volume of infor- mation today is created and exchanged through the use of social networks and Web 2.0 tools like blogs, microblogs, and wikis.
Corporations use public social media technology to create a visible brand, strengthen relations with current customers while attracting new connections and cli- ents, highlight their products and services, and gather intelligence that can be used in decision making.
Governments use public social media technologies to consult with and engage citi- zens, provide services, and keep pace with fast-moving events (e.g., natural disasters).
Both types of enterprises also benefi t from the use of internal social media solu- tions that facilitate communication and collaboration, improve employee engagement, and boost productivity and effi ciency.
Content created through or posted to these new social media platforms must be managed, monitored, and, quite often, archived. Content that meets the organization’s defi nition of a record (i.e., documents business activities) must be retained in accor- dance with the organization’s records retention and disposition policy.
Too often, social media content is not managed by information governance (IG) policies or monitored with controls that ensure protection of the brand and critical information assets and preservation of business records.
Types of Social Media in Web 2.0
The term “Web 2.0” was coined to characterize the move from static Web sites that passively provided information to consumers to more participative, interactive, col- laborative, and user-oriented Web sites and Web applications that allow for input, discussion, and sharing. Users can add content, increasing the value of the Web site or service. Examples include blogs and Web pages containing podcasts (digital me- dia, usually audio) where readers can post comments or pose questions; wikis that
* Portions of this chapter are adapted from Chapter 13 , Robert F. Smallwood, Managing Electronic Records: Methods, Best Practices, and Technologies , © John Wiley & Sons, Inc., 2013. Reproduced with permission of John Wiley & Sons, Inc.s
Information Governance: Concepts, Strategies and Best Practices By Robert F. Smallwood Copyright © 2014 by Robert F. Smallwood
254 INFORMATION GOVERNANCE
c13 254 February 28, 2014 6:24 PM
hyperlink to related information to create a knowledge base that shows interrelation- ships and allow users to add content; and RSS (really simple syndication) feeds that provide a stream of fresh content to the user or consumer.
Web 2.0 is the term used to describe the second generation of the World Wide Web, which is comprised of a combination of technologies that allow consumers of Web content to participate, collaborate, and share information online. The improved functionality refl ects consumer needs and preferences that surfaced as a result of in- creased use of the Web for daily information and communications.
Social media sites like LinkedIn, Twitter, and Facebook encourage social interac- tions by allowing users to create their own close network of business associates or friends—essentially a hand-picked audience—and to post their own content in the form of comments, links, photos, videos, and so forth. Others in their social network may view, forward, share, organize, and comment on this content.1
Web 2.0 and social media platforms began as outward-facing, public Web services that could link users from around the world. Subsequently, businesses discovered that social media technology could also be leveraged for internal use in various ways, such as by creating a directory and network of subject matter experts that users can search when working on special projects or by sending out microblog messages to keep their workforce informed. These internal social networks may be extended to include external stakeholders, such as suppliers and customers, in a controlled environment. A number of platform and software options exist for enterprise social media develop- ment and use.
According to the U.S. National Archives and Records Administration:
Social media platforms can be grouped into the categories below. Some spe- cifi c platforms may fi t into more than one category depending on how the platform is used.
■ Web Publishing . Platforms used to create, publish, and reuse content. g ■ Microblogging (Twitter, Plurk) ■ Blogs (WordPress, Blogger) ■ Wikis (Wikispaces, PBWiki) ■ Mashups (Google Maps, popurls)
■ Social networking. Platforms used to provide interactions and collaboration among users.
■ Social networking tools (Facebook, LinkedIn) ■ Social bookmarks (Delicious, Digg) ■ Virtual worlds (Second Life, OpenSim) ■ Crowdsourcing/Social voting (IdeaScale, Chaordix)
■ File sharing/storage. Platforms used to share fi les and host content storage. ■ Photo libraries (Flickr, Picasa) ■ Video sharing (YouTube, Vimeo) ■ Storage (Google Drive, Dropbox) ■ Content management (SharePoint, Drupal)
Agencies [and businesses] use a variety of software tools and platforms. The examples given above are not meant to be an exhaustive list. 2
INFORMATION GOVERNANCE FOR SOCIAL MEDIA 255
c13 255 February 28, 2014 6:24 PM
Additional Social Media Categories
Breaking out the categories of social media further, we can see in Table 13.1 examples of the wide range of social media applications that exist in the marketplace today. These categories will increase and fl uctuate as the market matures and the companies providing the social media technologies and services expand, merge, are acquired, or die off.
There are certainly additional categories, and the categories will continue to grow. In addition, social media companies do not always fi t neatly into one category. Applica- tions (apps) for smartphones and tablets offer instant gratifi cation and combine several functions. For example, Snapchat allows the sender to share an experience by snapping an image or video, adding a caption, and sending it to a friend.3 The image, unless saved by the recipient, is visible only for the number of seconds set by the sender. The goal is to share a moment in time by sending a fl eeting message. Another app, Vine, introduced by Twitter in early 2013, allows anyone to capture and share short looping videos. 4 Popular for personal use, a number of fi rms (e.g., GE, Urban Outfi tters, and
Table 13.1 Social Media by Application Type
Category Examples
Content curation Buzzfeed, Flipboard, Skygrid, Storify, Summify
Content sharing Yelp, Scribd, Slideshare, Digg, Topix
Photo sharing Flickr, Picasa, SmugMug, Photobucket
Social ad networks Lifestreet, AdKnowledge, Media6degrees, BurstMedia
Social analytics Awe.sm, Bluefi n Labs, Mixpanel, Webtrends
Social bookmarking BibSonomy, Delicious, Diigo, Folkd
Social business software Lithium, Jive, Pluck, Mzinga, Telligent, Ingage, Leverage Software, Huddle, Cubetree, Yammer (Microsoft), Socialcast, Igloo, Socialtext, Watchtoo, Acquia*
Social brand engagement Socialvibe, Mylikes, Adly, Sharethrough
Social commerce platforms Ecwid, Moontoast, Shop Tab, Dotbox, Storenvy, VendorShop
Social community platforms Ning, Mixxt, Grou.ps, Groupsite
Social data GNIP, DataSift, Rapleaf, RavenPack
Social intelligence software SDL, Netbase, Postrank, Google Analytics, Trendrr, Trackur, Visible
Social marketing management Shoutlet, Syncapse, Objective Marketer, Immobi, MediaFunnel
Social promotion platforms Offerpop, Seesmic, Strutta, Votigo, Fanzila, Zuberance, Extole, Social AppsHQ, Social Amp
Social publishing platforms Hootsuite, Spredfast, Hearsaysocial, MutualMind, SproutSocial, Flowtown, Socialware
Social referral 500Friends, Curebit, Tip or Skip, Turnto
Social search and browsing StumbleUpon, Topsy, Wink, Kurrently, SocialMention
Social scoring Klout, EmpireAvenue, PeerIndex
Source: Luma Partners and Terry Kawaja, http://static5.businessinsider.com/image/4fb5077becad04 5f47000003-960/buddy-media-social-marketing.jpg (accessed May 21, 2012).
256 INFORMATION GOVERNANCE
c13 256 February 28, 2014 6:24 PM
20th Century Fox) have begun to integrate Vine into their marketing/branding strat- egy, including major brands.
Social Media in the Enterprise
Public-facing social media integrates Internet-based applications, technology, social interaction, and content creation to enable communication, collaboration, and content sharing within and across subnetworks of millions of public users. Implementing tight security on these types of mass networks would likely slow response time and inhibit the user experience, and it may not provide a suffi cient level of security to warrant the investment on the part of the social media provider.
While popular consumer-based technologies (Facebook, Twitter, and LinkedIn) top the list of social media technologies used in enterprises today, 5 these services were not designed with the business in mind. Enterprises that need tight security but wish to take advantage of the many benefi ts of social media use are increasingly implementing enter- prisewide social media solutions in addition to or in place of public-facing social media.
In the business world, Facebook-like social networking software is offered for pri- vate, closed networks with a fi nite number of users. In this computing environment, implementing security is more manageable and practical. Some services are cloud based; others operate internally behind the enterprise fi rewall; and some operate ei- ther way or in conjunction as hybrid architecture. Usage statistics that refl ect trends, adoption rates, and areas of content interest can be provided to help feed the metrics needed to chart the progress and effectiveness of the enterprise social network. 6
Enterprise social networking is being adopted by business and public-sector entities at a rapid rate. With the entry of Generation Gmail into the workforce, many of these l initiatives took on an experimental, “cool” image. However, it is crucial to establish so- cial media business objectives, to defi ne time-limited metrics, and to measure progress. There does need to be some leeway, as calculating return on investment (ROI) for en- terprise social networks is very new, and all the benefi ts (and pitfalls) have not yet been discovered or defi ned. Certainly the network load and required bandwidth for e-mail and attachments will decrease; instead of sending a 25MB PowerPoint fi le back and forth among 10 coworkers, the fi le can sit in a common workspace for collaboration.
Another intangible benefi t is the competitive value in being a market leader or industry innovator. But to keep that edge, companies need to continually scan the horizon for new technologies and services. Engaging in online conversations with cus- tomers and other stakeholders is the norm rather than the exception. One sign of a progressive-thinking organization is its ability to leverage social media technology to refi ne operations, improve customer services, and make employees’ lives easier. An organization with a strong social media reputation likely will be better able to attract, recruit, and retain qualifi ed, high-achieving employees.
Implementing security is more manageable and practical with enterprise so- cial networking software.
INFORMATION GOVERNANCE FOR SOCIAL MEDIA 257
c13 257 February 28, 2014 6:24 PM
Key Ways Social Media Is Different from E-Mail and Instant Messaging
Social media offers some of the same functionality as other communication and col- laboration systems like e-mail and instant messaging (IM), yet its architecture and underlying assumptions are quite different.
When implementing enterprise versions of social media applications, a company may exert more control over the computing and networking environment through in-house implementation rather than outsourcing. Consumer-oriented social media applications, such as Facebook and Twitter, reside on application servers outside the enterprise controlled by third-party providers. This creates IG and records manage- ment (RM) challenges and poses legal risks. 7
Obviously, social media is an emerging technology, so standards, design, and archi- tecture are in fl ux, whereas e-mail has been stable and established for 15 to 20 years. E-mail is a mature technology set, meaning it is unlikely to change much. There are standard e-mail communications protocols, and the technology’s use is pervasive and constant. So when e-mail IG policies are formed, less updating and fi ne-tuning are required over time. With social media, new features are being added, standards are non- existent, privacy settings change overnight, and the legalese in terms of service agree- ments is continually modifi ed to include new features and settings, which means that your social media policy must be more closely monitored and frequently fi ne-tuned.
E-mail, IM, and social media are all communication tools used to share content and collaborate, but social media also offers user interaction features, such as “Like” on Facebook or “retweet” (copying and posting a 140-character tweet) on Twitter, that bring attention to the content in the user’s network and can be construed as an endorsement or rejection of content based on user opinions expressed and associated with the content. 8
Further confounding the organization’s ability to control the social media envi- ronment is the fact that the social media sites are dynamic and ever changing, with comments and opinions being published in real time. This is not true with e-mail and IM systems, which are more structured, stable, and technologically mature.
Biggest Risks of Social Media
Social media is the Wild West of collaboration and communication. Vulnerabilities still are being exposed, and rules still are being established. Users often are unsure of exactly who can see what they have posted. They may believe that they have posted a comment only for the eyes of a friend or colleague, not realizing it may have been posted publicly. “One of the biggest risks that social networking poses to organizations
Social media differs greatly from e-mail use. E-mail is mature and stable. Social media is not. These distinctions have important ramifi cations for IG policy development.
258 INFORMATION GOVERNANCE
c13 258 February 28, 2014 6:24 PM
is that employees may be exposing information that’s not meant for public consumption , es- pecially in highly regulated environments like banking and healthcare, in industries that rely heavily on proprietary research and development, or even in the military”9 (emphasis added).
Organizations that believe they can ban social media in order to avoid risks are mistaken. Prohibition of social media can result in social media use being driven underground. Employees accustomed to the ease of communicating and collaborating through social networks may turn to the use of personal devices and accounts outside the control of the organization. Even strict adherence to a nonuse policy can harm the organization’s reputation, fi nances, ability to gather information that can be used to improve operations, and ability to remain competitive.
Once an organization decides it will engage in social media initiatives, it must identify different types of risks to initiate its IG effort in this area. According to Chris Nerney of Network World , two of the greatest social media security threats are:d
1. Lack of a social media policy. Many organizations are just now discovering the extent to which social media has popped up in various pockets of their organization. They may believe that their e-mail and communications policy will pretty much cover social media use and that it is not worth the time and expense to update IG policies to include social media.
This invites complexities, vagaries, and potential disaster. A simple Twitter comment could invite litigation: “Our new project is almost ready, but I’m not sure about the widget assembly.” It’s out there. There is a record of it. Instant potential liability in 140 characters or less. s
Social media can add value to an organization’s efforts to reach out to cus- tomers and other stakeholders, but this must be weighed carefully against the accompanying risks.
The objectives of a social media initiative must be spelled out, and metrics must be in place to measure progress. But more than that, who can utilize social media on behalf of the company and what they can state needs to be established with clarity in the IG policy. If not, employees are essentially fl ying blindly without controls, and they are more likely to put the enterprise at risk. 10
More than policy development is needed. If your organization is going to embark on a social media program, it needs an executive sponsor to champion and drive the program, communicating policy to key leaders. You will also need to conduct training—on a consistent basis. Training is key, since social me- dia is a moving target.
2. Employees—the accidental and intentional insider threat. This may be in part due to lack of social media policy or due to lack of monitoring and enforcement. Sometimes an employee harms an organization intentionally. Remember Pri- vate Bradley Manning’s release of hundreds of thousands of classifi ed gov- ernment documents to WikiLeaks?11 But most times employees do not realizes the negative impact of their behavior in posting to social media sites. People might use social media to vent about a bad day at work, but the underlying message can damage the company’s reputation and alienate coworkers and clients. Other times a post that is seemingly unrelated to work can backfi re and take a toll on business. We’re all human and sometimes emotion gets the better of us, before we have rationally thought out the consequences. And that
INFORMATION GOVERNANCE FOR SOCIAL MEDIA 259
c13 259 February 28, 2014 6:24 PM
is especially true in the new world of social media, where it may be unclear exactly who can see a comment.
The dangers of social media are quite different from those posed by an iso- lated, off-color, or offensive verbal comment made in the workplace, or even one errant e-mail. With social media it is possible that the whole world will be able to see a comment meant only for a limited and controlled audience. For example, consider Ketchum public relations vice president James Andrews, who in 2009 “fi red off an infamous tweet trashing the city of Memphis, home- town of a little Ketchum client called FedEx, the day before he was to make a presentation to more than 150 FedEx employees (on digital media, no less!).” FedEx employees complained to Ketchum and their own executives, point- ing out that while they suffered salary reductions, money was being spent on Ketchum, which had been clearly disrespectful of FedEx. Andrews was forced to make a “very public and humiliating apology.” 12
This story shows that high-level executives must be just as careful as lower- level employees. Andrews was not only a corporate vice president, but also a public relations, communications, and social media expert, well versed in the fi rm’s policies and mission. He also had no ill intent. Knowing this, consider what a rogue employee intent on damaging the company might do. Such im- pact could be much worse. For instance, what if a chief executive’s assistant were to release details of strategic plans, litigation, or ethics investigations to the public? Or embarrassing details of the CEO’s private life? The impact could be quite costly.
Legal Risks of Social Media Posts
With over 554 million active registered users and an estimated average of 58 million tweets per day in 2013 to the microblogging site Twitter, 13 a number that continues to increase, surely some employees in your organization are tweeting. As of the fi rst quarter of 2013, more than 225 million professionals in over 200 countries and ter- ritories were members of the LinkedIn network, and the network continues to expand, with students and recent college graduates being the fastest-growing segment. Ap- proximately 33 percent of members are in the United States.14
The casual use of public comments can easily create liability for a company. With no IG policy, guidelines, monitoring, or governance, legal risks of using social media increase signifi cantly. This is an avoidable risk.
Many people are posting birthday wishes and pictures of what they had for dinner, but others may be venting about specifi c companies and individuals within those companies. There’s a difference between “I can’t stand Wall Street,” and “Goldman is run by Satan, and his name is John Smith. We’re going to sue his butt off.” Instant liability .
Two of the biggest threats of social media use for organizations come from the lack of a social media policy and threats presented by employee use.
260 INFORMATION GOVERNANCE
c13 260 February 28, 2014 6:24 PM
The specifi cs of where and how an employee posted or tweeted a message may mean whether a lawsuit against your company is successful or not. If a personal LinkedIn or Twitter account is used, and it was posted after hours using a PC from home, the company may be off the hook. But if it was done using a company computer or network, or from a company-authorized account, a defense will be diffi cult. Opposing counsel likely will ask questions about the policy for posting fi rst. One thing is true: “Much of this remains unsettled ground.”15
Just when compliance and records managers thought they had nailed down IG for e-mail, IM, and electronic records, social media came on the scene creating new, dynamic challenges!
Even though not all social media content will rise to the level of a record, accord- ing to the defi nition in use, the organization still may be responsible for managing the nonrecord content. For example, an organization may consider a social networking profi le a record but consider comments nonrecords. That decision will have an impact on what must be retained according to the records retentions schedule. It does not, however, absolve the organization from monitoring and evaluating the comments. 16
“Tweets are no different from letters, e-mail, or text messages—they can be dam- aging and discoverable, which is especially problematic for companies that are required to preserve electronic records, such as the securities industry and federal contractors. Yet another compliance headache is born.”
Blogs are simply Web logs, a sort of online journal that is focused on a particular topic. Blog readers can become followers and receive notices when new content is posted as well as add their own comments, which may be moderated or restricted. It seems confounding, but with the explosion in the use of blogs, there have been actual incidents where employees have “disclosed trade secrets and insider trading informa- tion on their blogs. Blogs have also led to wrongful termination and harassment suits.”
So the liability and potential for leakage or erosion of information assets is not theoretical; it is real.
To safeguard the enterprise that sanctions and supports blog use, IG policies must be clear, and real-time capture and management of blog posts should be implemented. Re- member, these can be business records that are subject to legal holds, and authenticity and accuracy are crucial in supporting a legal case. So a true and original copy must be retained. This may, in fact, be a legal or regulatory requirement, depending on the industry.
If content-posting guidelines are not clear, then the informal nature of social me- dia posts potentially can be damaging to an organization. The usual fact checking and vetting that is done for traditional press releases and advertising may not be con- ducted, so social media posts can be unscreened and unfi ltered, which poses problems when IG policies are not clear and fully enforced. 17 Beyond that, the consequences of violating policy should be severe and clearly stated in policies, as should the penalties imposed, a message that should be reinforced consistently over time.
With no IG policy, guidelines, monitoring, or governance, legal risks of using social media increase signifi cantly. This is an avoidable risk.
INFORMATION GOVERNANCE FOR SOCIAL MEDIA 261
c13 261 February 28, 2014 6:24 PM
Tools to Archive Social Media
New approaches to capture, manage, and archive social media are emerging. Some are free or inexpensive and appropriate for personal and small business use. Others require a more substantial investment of resources but better meet the needs of midsize and large organizations.
Public Social Media Solutions
Launched as a personal cloud organizing service in March 2012, Jolicloud took a fi le system approach to social media so Facebook, Flickr, Instagram, Picasa, and Twitter content that was previously interacted with or shared could be sorted and searched. 18 The service “slurps” (extracts) content from social media sites and makes it available for viewing through any mainstream Internet browser, tablet, or smartphone. As users perform social media functions like sharing, “liking,” and “favoriting” content on their various social media services, the content is automatically saved to their Jolicloud ac- count, which can later be sorted and searched.
Jolicloud has similarities with other “personal social Web memory” products, such as Facebook Timeline and TimeHop. In 2013, Jolicloud added the ability to view and edit fi les and rebranded its unifi ed cloud platform Jolidrive.19
If you prefer to maintain copies of all fi les on your own computer, an alternative to Jolicloud is a product called SocialFolders. This app lives on your computer and con- nects directly to your favorite social media sites so you can manage, backup, and sync your photos, videos, and documents in a centralized location. 20
Since Facebook and Twitter initially did not provide archiving tools, some third- party applications have popped up to perform the task.
TwInbox is a free MS Outlook plug-in that archives Twitter postings and allows us- ers to install a (Twitter) menu option to send tweets directly from Outlook; these tweets are archived into a standard Outlook folder. The folder can be confi gured to capture tweets that a user sends outside of Outlook, so that everything is stored in one folder.
TweetTake is a free utility that archives followers and tweet posts. It does not require a software download, and the archive can be stored as a zip fi le and then im- ported into a spreadsheet (e.g., Excel) for further analysis. By the time this book goes to press, there will be even more options, and the existing ones will have changed and (it is hoped) improved.
If your organization uses Twitter and social media archiving is required by law, regulations, or internal IG policies, a good place to start your research is with software like TwInbox (if you operate in a Microsoft Offi ce environment) and TweetTake as well as other new entrants to the market or other options your organization may have. 21
For archiving Facebook posts, there are several options. Facebook users can down- load and archive their Facebook data from their account settings page. Also, there are free plug-ins for Mozilla’s Firefox browser. One comes directly from Mozilla, which archives everything but fan pages into a zip fi le. Another is a Firefox add-on called ArchiveFacebook, which allows you to save Facebook content directly to your hard drive and view the content exactly as it looks on Facebook. Other tools, including So- cialSafe, PageFreezer, and Wayback Machine, charge a small fee. All of these options and new ones need to be evaluated when selecting an archiving solution for Facebook that meets your organization’s requirements.
262 INFORMATION GOVERNANCE
c13 262 February 28, 2014 6:24 PM
For archiving LinkedIn posts and information, SocialSafe, PageFreezer, and Way- back Machine can be used, and other tools will surface.
To convert records to a standard format for use outside of the social media application, there are also options to create PDF documents out of social media posts using products like PDF995 and PrimoPDF.22 Nuance Software also provides PDFCreate.
Additional archiving tools are being developed as the social media market matures. Bear in mind that tools developed by third parties always carry some risk that tools directly from the software or service provider do not.
These tools may not provide a legally defensible audit trail in court. Choosing among the tools requires a critical analysis and may require additional technology layers. Other alternatives, such as real-time content archiving tools and even in-house developed customizations, also have to be considered.
Government and Industry Solutions
Most of the products and methods that could be of use for personal or small business archiving of social media content involves manual intervention, which can be time consuming. All organizations must focus on their core business and would benefi t from tools and services that streamline and automate the archiving process as much as possible—however, there is a cost. Midsize and large organizations, often using both public and enterprise social media technologies, may fi nd the investment in com- mercial products and services worth the additional cost, especially those products that integrate and manage social media content with other enterprise content. Capture and management of social media content is an area that must be addressed as part of an overall IG strategy. Some of the solutions available at this time are described in Table 13.2 ; however, because of the recent increased focus on archiving solutions for public and enterprise social media content, the landscape will continue to become more effi cient, effective, and possibly unifi ed.d
In addition to providing archiving functions, unifi ed and integrated solutions provide business intelligence applications and tools to enable the enterprise to better achieve its organizational goals, processes, and performance requirements.
IG Considerations for Social Media
The report “How Federal Agencies Can Effectively Manage Records Created Us- ing Social Media Tools” addresses building an IG framework for social media. An IG model provides the overarching policies, guidelines, and boundaries for social media initiatives. 23
An IG framework for social media should incorporate social media policy, controls, and operational guidelines as well as spell out consequences for violations. Best practices for social media still are being established, and those that have been established are evolving. In addition to establishing policies to govern the use of social media across the organiza- tion, best practices should include industry-specifi c, vertical market considerations. A cross-section of functional groups within the enterprise should provide input into the policy-making process. At the very minimum, internal audit, marketing, fi nance, infor- mation technology (IT), legal, human resources, and RM must be consulted, and all
INFORMATION GOVERNANCE FOR SOCIAL MEDIA 263
c13 263 February 28, 2014 6:24 PM
Table 13.2 Social Media Archiving and Management Software
Type of Solution Description Examples
Archiving solution Services that capture, protect, and retain social media for compliance, e-discovery, digital preservation, and records management
Archives Social; Smarsh; RegEd by Arkovi
Unifi ed solutions Services and software that facilitate the management of various fi le types across the enterprise (e.g., social media, legacy data, word fi les, SharePoint fi les) for storage, optimization, e-discovery, compliance, and records management
Unifi ed Archive® by ZL Technologies; Symantec Enterprise Vault; HP Autonomy
Integrated solutions Services that integrate various types of systems (e.g., customer relationship management in the cloud with social media tools, enterprise content management [ECM], and/or records management) to manage records and information for business operations and compliance.
Microsoft SharePoint 2013 and Yammer (contains social and collaboration features as well as RM and compliance features); Salesforce and Chatter (integrates social collaboration technology and potential to integrate with ECM content repository and ECM Documentum Records Manager).
business units should be represented. Clear roles and responsibilities must be spelled out, and controls must be established to govern acceptable use—essentially what is al- lowed and what is not. Even writing style, logo format, branding, and other marketing considerations should be weighed. The enterprise’s image and brand are at risk, and prudent steps must be taken to protect this valuable, intangible asset. And most im- portant, all legal and regulatory considerations must be folded into the new IG policy governing the use of social media.
Key Social Media Policy Guidelines
Your social media policy development process can begin by examining the published policies of major organizations in your industry or closely related industries. It should also be based on changes in the workplace as well as established standards, such as guidance developed as the result of a January 2013 ruling by the National Labor Rela- tions Board. More important, social media policies must be hand-crafted and customized for each organization.
An IG framework for social media should incorporate social media policy, con- trols, and operational guidelines, and spell out consequences for violations.
264 INFORMATION GOVERNANCE
c13 264 February 28, 2014 6:24 PM
A prudent and properly crafted social media policy:
■ Specifi es who is authorized to create social media accounts for the organization. ■ Authorizes specifi cally who can speak on the organization’s behalf and who
cannot (by role/responsibility). ■ Outlines the types of negative impact on the company’s brand and reputation
that unscreened, poorly considered posts may have. 24 ■ Draws clear distinctions between business and personal use of social media and
specifi es whether personal access is allowed during work hours. ■ Underscores the fact that employees should not have any expectation of privacy
when using social media for corporate purposes, just as in using other forms of communications such as e-mail, IM, and voicemail, which may be monitored.
■ Clearly states what is proper and allowed on the organization’s behalf and what is forbidden in social media posts or using organization resources.
■ Instructs employees to always avoid engaging in company-confi dential or even controversial discussions.
■ Encourages/requires employees to include a standard disclaimer when pub- lishing content that makes clear the views shared are representative of the em- ployee and not the organization.
■ Strictly forbids the use of profanity and uses a professional business tone, albeit more informal than in other corporate communications.
■ Strictly forbids any statements that could be construed as defamatory, discrimi- native, or infl ammatory.
■ Outlines clear punishments and negative actions that will occur to enforce so- cial media policy.
■ Draws clear rules on the use of the company name and logo.25
The policy need not be long but should be clear. Best Buy’s social media policy, for example, uses the slogan, “Be smart. Be respectful. Be human.”26 It then breaks the guid- ance into two major sections: what you should do and what you should never disclose. A word of caution contained in the Best Buy Social Media Policy explains the rationale for the employee to abide by the social media policy: Protect the brand, protect yourself.
To ensure compliance with the organization’s IG strategy, it is also necessary to include a reference to the organization’s related policies, including the records and information management policy.
Records Management and Litigation Considerations for Social Media
Legal requirements and demands trump all others when making decisions about captur- ing and preserving social media records. Social media is no different from other forms of electronically stored information (ESI) in that it is potentially discoverable during n litigation.27 Not all ESI residing in social media are records, but all are discoverable. If an organization employs social media and makes a conscious decision not to archive t all or some portion of that data, it is taking risks. A legally defensible records retention schedule must be in place, and it must be based on specifi c laws that identify the records that must be retained and to a records retention policy that explains the process for iden- tifying, categorizing, and managing information and records.
INFORMATION GOVERNANCE FOR SOCIAL MEDIA 265
c13 265 February 28, 2014 6:24 PM
From an RM perspective, it is critical to consider that social media posts are more than the posts themselves; for legal or compliance purposes, they include metadata and hyperlinks to external content—and that external content in its native format— that must also be preserved, preferably in real time. That external content may be a PDF document, a PowerPoint presentation, Web site content, or even a video on YouTube, which would require that video archiving, along with associated metadata, is in place.
To truly capture the necessary content required by law, records and compli- ance managers must understand how software programs communicate with each other in order to recommend possible solutions to the IT department. One way to preserve the Web-based data of social media applications is to use the application programming interfaces (APIs) that social media providers offer. APIs offer standard “hooks” into an application. Another way, perhaps preferable, is to enlist a service that can capture and archive information from multiple social networks. Further innovations in tools and services that will make capturing these records easier are being developed.
Content found in social media networks can be static or dynamic. Profi les in Face- book and blog posts are examples of static content. They can be captured before being posted to the Web. Blog comments and endorsements through “liking” or “favoriting” a post are examples of dynamic content. The ideal method from a RM standpoint is to capture all dynamic social media content in real time in order to be able to prove authenticity and fi ght claims of records spoliation (corruption or adulteration of evi- dence) in the event of a discovery request.
Regardless of method of capture, social media content that meets record status criteria should be moved to a repository in an electronic records management
U.S. corporations must archive social media records under Rule 34 of the FRCP.
U.S. corporations that utilize social media are compelled to preserve those records, including metadata and associated linked content , according to Rule 34 of the t Federal Rules of Civil Procedure (FRCP), which states that opposing parties in litigation may request “any designated documents or ESI—including writings, drawings, graphs, charts, photographs, sound recordings, images, and other data or data compilations—stored in any medium from which information can be obtained either directly or, if necessary, after translation by the responding party into a usable form.”28 This echoes a key principle of the Sedona Confer- ence ®, a leading RM and legal retention think tank. Also, Rule 26 of the FRCPe requires that any and all information that might be discoverable or “potentially responsive” must be preserved and produced if requested by the opposing party. So it is clear that there is a legal duty to preserve social media records.
266 INFORMATION GOVERNANCE
c13 266 February 28, 2014 6:24 PM
(ERM) system application. Then business rules for retention should be applied to those records. Typical functions of an ERM system include these:
■ Marking an electronic document as a read-only electronic record ■ Protecting the record against modifi cation or tampering ■ Filing a record against an organizational fi le plan or taxonomy for categorization ■ Marking records as vital records ■ Assigning disposal (archival or destruction rules) to records ■ Freezing and unfreezing disposal rules ■ Applying access and security controls (Security rules may differ from the source
elec tronic document in an electronic document management system or enter- prise content management [ ECM] software.)
■ Executing disposal processing (usually an administrative function) ■ Maintaining organizational/historical metadata that preserves the business
context of the record in the case of organizational change ■ Providing a history/audit trail 29
Robust search capabilities are perhaps the most crucial component of a social media ERM or archiving solution. It is fi ne to preserve the records and their associated metadata perfectly, but if you cannot easily fi nd and produce the information, compliance and e- discovery efforts will fall short and may cost the organization dearly.
Social media policy will be unique to each particular organization. It is fi ne to start with a social media policy example or template, but it must be tailored to the needs of the organization for it to be effective and legally defensible. 30
Records Retention Guidelines
Here are some basic records retention guidelines:
■ Make records threshold determinations. Examine the content to see if it in fact constitutes a record by your own organization’s defi nition of a record , which should d be contained in your IG policies. This records determination process likely also will require consultation with your legal counsel. If the social media site has not been kept operating, or it was used for a specifi c project that has been completed (and all pertinent records for that project have been retained), then its content may not require retention of records. 31
■ Use existing retention schedules if they apply. If your organization already has reten- tion policies for, say, e-mail, then any e-mail sent by social media should adhere to that same scheduling guideline, unless there is some legal reason to change it.
■ Apply basic content management principles. Focus on capturing all related content for social media posts, including conversation threads, and associated metadata that may be required in legal discovery to provide context and maintain the completeness, authenticity, and integrity of the records.
Social media policy must be unique to each particular organization.
INFORMATION GOVERNANCE FOR SOCIAL MEDIA 267
c13 267 February 28, 2014 6:24 PM
■ Risk avoidance in content creation. Instruct and reinforce the message to employ- ees participating in corporate social media that content on the Web stays there indefi nitely and that it carries potential legal risks. In addition, once something is posted on the Web, completely erasing and destroying the content at the end of its retention period is nearly impossible.
Content Control Models
There are several basic ways to manage social media content, ranging from tightly con- trolling it through one single, accountable person, to delegating control to the busi- ness unit level, all the way to letting the social media participants post their thoughts, unmoderated and unfettered, to encourage spontaneity and enthusiastic use of the tool. The approach your organization takes will depend on the specifi ed business ob- jectives you have for utilizing social media and your organization’s appetite for risk.
Emerging Best Practices for Managing Social Media Records
Best practices for managing social media business records are still evolving, and will continue to develop as records and information practitioners gain more experience with social media records. Here are some emerging best practices:
■ Identify records during the social media planning stage. Both a social media policy and the records and information policy should refer to a form to be completed by the person or unit proposing a new social media initiative. The person com- pleting the form should indicate if records will be created and, if so, how they will be managed.
■ Promote cross-functional communications. A social media team of representatives from various departments, such as IT, social media, legal, compliance, records management, and other stakeholders, is formed, and communication and col- laboration is encouraged and supported.
■ Require consultation in policy development. Extending beyond the social media team, input and advice from multiple stakeholder groups is essential for creat- ing IG policies that cover social media records management.
■ Establish clear roles and responsibilities. The cross-functional social media team must lay out clear expectations and responsibilities and draw lines of account- ability so that stakeholders understand what is expected of them.
■ Utilize content management principles. Management of social media content should fall under an ECM software implementation, which can capture and track content, including associated metadata and external content, and manage that social media content through its life cycle.
■ Implement RM functionality. Management by an ERM system that offers fea- tures that enable records retention and disposition, implementation of legal holds, and lifting of legal holds is essential.
■ Control the content. Clear guidelines and monitoring mechanisms must be in place to control and manage content before it gets published on the Web, when possible (e.g., static content on blogs and profi les in social networks) if there is any potential legal risk at all.
268 INFORMATION GOVERNANCE
c13 268 February 28, 2014 6:24 PM
■ Capture content in real time. By implementing a real-time content capture solu- tion for content posted directly to social media (e.g., comments on blogs and posting of someone else’s content or retweets), organizations will begin their control and management of the content at soonest point and can more easily prove it is authentic and reliable from a legal perspective.
■ Champion search capabilities. After capture and preservation of records and as- sociated metadata, search capabilities are the single most important feature that the technology must provide.
■ Train, train, train. Social media is a new and emerging technology that changes rapidly. Users must be trained, and that training must be updated and rein- forced on a regular basis so that employees have clear guidelines, understand the technology, and understand the business objectives for its use.
CHAPTER SUMMARY: KEY POINTS
■ Organizations are increasingly using social media and Web 2.0 platforms to connect people to companies and government.
■ Social media use presents unique challenges because of key differences with other electronic communications systems, such as e-mail and IM.
■ Two of the biggest risks that social networking poses to organizations are (1) not having a social media policy; and (2) employees may be—intentionally or not—exposing information that is not meant for public consumption.
■ Enterprise social networking software has many of the features of consumer social applications such as Facebook, but with more oversight and control, and they come with analytics features to measure adoption and use.
■ Various software tools have become available in recent years for archiving social media posts and followers for RM purposes.
■ An IG framework provides the overarching policies, guidelines, and bound- aries for social media initiatives, so that they may be controlled, monitored, and archived.
■ Social media posts are more than the post itself; they include metadata and also include hyperlinks to external content—and that external content must be preserved in its native format to meet legal standards.
■ Robust search capabilities are the most crucial component of a social media ERM or archiving solution.
■ Social media policy will be unique to each particular organization.
■ Best practices for managing social media business records are still evolving but include forming cross-functional social media teams with clear responsibilities, encouraging communication, and capturing complete content in real time.
INFORMATION GOVERNANCE FOR SOCIAL MEDIA 269
c13 269 February 28, 2014 6:24 PM
Notes
1. U.S. National Archives and Records Administration, NARA Bulletin 2011-02, “Guidance on Manag- ing Records in Web 2.0/Social Media Platforms,” October 20, 2010, www.archives.gov/records-mgmt/ bulletins/2011/2011-02.html .
2. Ibid. 3. See www.snapchat.com/ (accessed June 3, 2013). 4. See http://vine.com/ (accessed June 3, 2013). 5. Nancy Gohring , “Facebook and Twitter Rule the Enterprise, Too,” May 20, 2013, www.citeworld.com/
social/21893/facebook-twitter-rule-enterprise (accessed June 4, 2013). 6. Andrew Conry-Murray, “Can Enterprise Social Networking Pay Off?” Internet Evolution, March 21, 2009,
www.internetevolution.com/document.asp?doc_id=173854 . 7. Patricia C. Franks, “How Federal Agencies Can Effectively Manage Records Created Using New
Social Media Tools,” IBM Center for the Business of Government, San Jose State University, 2010, www.businessofgovernment.org/sites/default/files/How%20Federal%20Agencies%20Can%20 Effectively%20Manage%20Records%20Created%20Using%20New%20Social%20Media%20Tools. pdf , pp. 20–21 (accessed March 30, 2012).
8. Ibid. 9. Paul McDougall, “Social Networking Here to Stay Despite Security Risks,” Information Week , May 12,
2011, www.informationweek.com/news/security/privacy/229500138 . 10. Chris Nerney, “5 Top Social Media Security Threats,” Network World , May 31, 2011, www.network-d
world.com/news/2011/053111-social-media-security.html . 11. C. Savage, “Soldier Admits Providing Files to WikiLeaks,” New York Times , February 23, 2013, wwws
.nytimes.com/2013/03/01/us/bradley-manning-admits-giving-trove-of-military-data-to-wikileaks
.html?ref=bradleyemanning&_r=0 (accessed May 19, 2013). 12. Ibid. 13. Twitter Statistics, Statistic Brain, www.statisticbrain.com/twitter-statistics/ (accessed May 18, 2013). 14. LinkedIn, “About Us,” www.linkedin.com/about-us (accessed May 18, 2013). 15. Sharon Nelson, John Simek, and Jason Foltin, “Capturing Quicksilver: Records Management for
Blogs, Twittering and Social Networks,” Sensei Enterprises, 2009, www.senseient.com/storage/articles/ Capturing_Quicksilver.pdf (accessed December 10, 2013).
16. This discussion and the next quotes in this section are from Patricia C. Franks, Records and Information Management (Chicago: American Library Association Neal-Schuman, 2013), p. 179.t
17. Sharon Nelson and John Simek, “Mitigating Legal Risks of Using Social Media,” Information Manage- ment 45, no. 5 (September/October 2011), ARMA International.t
18. Liz Gannes, “Saving the Social Web for Later Use: Jolicloud Organizes Everything You’ve Shared, Liked, and Favorited,” March 19, 2012, http://allthingsd.com/20120319/saving-the-social-web-for- later-use-jolicloud-organizes-everything-youve-shared-liked-and-favorited/ .
19. Nick Summers, “Jolicloud Rebrands Its Unifi ed Cloud Platform as Jolidrive, Adds the Ability to View and Edit Files,” TNW , March 6, 2013, http://thenextweb.com/insider/2013/03/06/jolicloud-rebrands-its-WW unifi ed-cloud-service-as-jolidrive-adding-the-ability-to-edit-and-view-fi les/ (accessed May 18, 2013).
20. Social Folders, “About Us,” http://socialfolders.me/about-us/ (accessed May 18, 2013). 21. Andy Opsahl, “Backing Up Twitter and Facebook Posts Challenges Governments,” Government
Technology , January 20, 2010, www.govtech.com/policy-management/Backing-Up-Twitter-and-Face- book-Posts.html?utm_source=related&utm_medium=direct&utm_campaign=Backing-Up-Twitter- and-Facebook-Posts .
22. Ibid. 23. The next discussion is based on Franks, “How Federal Agencies Can Effectively Manage Records.” 24. Nelson and Simek, “Mitigating Legal Risks of Using Social Media.” 25. Ibid. 26. Best Buy Social Media Policy, http://forums.bestbuy.com/t5/Welcome-News/Best-Buy-Social-Media-
Policy/td-p/20492 (accessed December 10, 2013). 27. The next discussion is based on Rakesh Madhava, “10 Things to Know about Preserving Social Media,”
Information Management (September/October 2011): 34–35, 37. ARMA International.t 28. Federal Rules of Civil Procedure, http://www.uscourts.gov/uscourts/rulesandpolicies/rules/cv2009.pdf
(accessed 2/20/14). 29. Franks, Records and Information Management , p. 151. t 30. Ibid., pp. 36–37. 31. Guidelines here and in the next section are from New York State Archives, “Records Advisory: Preliminary
Guidance on Social Media,” May 24, 2010, www.archives.nysed.gov/a/records/mr_social_media.shtml .
271
c14 271 March 6, 2014 4:43 PM
Information Governance for Mobile Devices*
C H A P T E R 14
* Portions of this chapter are adapted from Chapter 7 , Robert F. Smallwood, Safeguarding Critical E-Documents: Imple- menting a Program for Securing Confi dential Information Assets , © John Wiley & Sons, Inc., 2012. Reproduced withs permission of John Wiley & Sons, Inc.
T he use of mobile devices is ubiquitous in today’s society. According to CTIA (the Wireless Association), over 326 million mobile devices were in use within the United States as of December 2012. 1 This is a more than 100 percent penetra-
tion rate, since many users have more than one mobile device, and usage continues to grow. Citizens of China, India, and the European Union (EU) have even greater mobile phone usage than those in the United States.
Mobile computing has vastly accelerated in popularity over the last decade. Sev- eral factors have contributed to this: Improved network coverage, physically smaller devices, improved processing power, better price points, a move to next-generation operating systems (OSs) such as Google’s Android and Apple’s iOS, and a more mobile workforce have fueled the proliferation of mobile devices.
Mobile devices include laptops, netbooks, tablet PCs, personal digital assistants (PDAs) such as BlackBerries, and smartphones such as Apple’s iPhone and those based on Google’s Android platform. What used to be simple cell phones are now small com- puters with nearly complete functionality and some unique communications capabilities. These devices all link to an entire spectrum of public and private networks.
Gartner has estimated that “by 2016, 40 percent of the global workforce will be mobile , with 67 percent of workers using smartphones” 2 (emphasis added).
With these new types of devices and operating environments come new demands for information governance (IG) policies and unknown security risks. 3 The Digital Systems Knowledge Transfer Network, a UK think tank, found: “The plethora of mo- bile computing devices fl ooding into the market will be one of the biggest ongoing security challenges [moving forward].” “With mobile devices connecting to Wi-Fi and Bluetooth networks, there are suddenly many more opportunities [for hackers] to get in and steal personal information.”4
Due to this rapid shift toward mobile computing, companies with mobile person- nel, such as salespeople and service technicians, need to be aware of and vigilant toward these impending security threats, which can compromise confi dential information.
Securing mobile devices is critical: A survey by Aberdeen Group, an IT research and analysis fi rm, estimates that that data leakage or loss can cost an organization anywhere from $10,600 to over $400,000 . 5
Information Governance: Concepts, Strategies and Best Practices By Robert F. Smallwood Copyright © 2014 by Robert F. Smallwood
272 INFORMATION GOVERNANCE
c14 272 March 6, 2014 4:43 PM
The reality is that most mobile devices are not designed with security in mind ; in fact, d some compromises have been made to enable new smartphone operating systems to run on a variety of hardware, such as the Android OS from Google. This is analogous to the trade-offs Microsoft made when developing the Windows OS to run across a variety of hardware designs from many PC manufacturers.
Smartphone virus infections are particularly diffi cult to detect and thorny to remove. Users may be unaware that all their data is being monitored and captured and that a hacker is waiting for just the right time to use it. Businesses can suffer economic and other damage, such as erosion of information assets or even negative goodwill from a damaged image.
The smartphone market is rapidly expanding with new developments almost daily, each providing criminals with a new opportunity. An International Data Corporation report indicated that “ smartphone sales outpaced PC sales for the fi rst time ever in the fourth quarter of 2010 , with 100.9 million smartphones shipped versus 92.1 million PCs” (em- phasis added). 6 The growth in smartphone sales and new services from banks—such as making deposits remotely by snapping a picture of a check—means that there are new and growing opportunities for fraud and identity theft.
Awareness and education are key. The fi rst line of defense is for users to better under- stand cybercriminal techniques and to become savvier in their use of information and commu- nications technologies. s
A large part of the battle will be won when biometric authentication technolo- gies (those that use retina, voice, and fi ngerprint recognition) are mature enough to positively identify a user to ensure the correct person is accessing fi nancial or confi dential accounts. Application suppliers are fi rst concerned about functionality and widespread adoption; security is not their top priority. Users must be aware and vigilant to protect themselves from theft and fraud. On a corporate level, organi- zations must step up their training efforts in addition to adding layers of security technology to safeguard critical electronic documents and data and to protect infor- mation assets.
Social engineering —using various ways of fooling the user into providing privategg data—is the most common approach criminal hackers use , and it is on the rise. Machines do their job, and software performs exactly as it is programmed to do, but human beings are the weakest link in the security chain. As usage trends in the direction of a more mobile and remote workforce, people need to be trained as to what threats exist and constantly updated on new criminal schemes and approaches. This training is all part of an overall IG effort, controlling who has access to what information, t when, and from where.
With more and more sensitive business information being pushed out to mo- bile devices (e.g., fi nancial spreadsheets, business contracts, strategic plans, etc.) and advancing and evolving threats to mobile the mobile realm, IG becomes an imperative; and the most important part of IG is that it is done on an ongoing basis, con- sistently and regularly . Policies must be reviewed when a new mobile device starts to be utilized, when new threats are uncovered, as employees use unsecured public Wi-Fi networks more and more, and as business operations change to include more and more mobile strategies. Information technology (IT) divisions must ensure their mobile devices are protected from the latest security risks, and users must regularly be apprised of changing security threats and new criminal approaches by hackers.
INFORMATION GOVERNANCE FOR MOBILE DEVICES 273
c14 273 March 6, 2014 4:43 PM
Mobile device management (MDM) is critical to secure confi dential informa-t tion assets and managing mobile devices. Some available technologies can wipe devices free of confi dential documents and data remotely, even after they are lost or stolen. These types of utilities need to be deployed to protect an enterprise’s information assets.
Current Trends in Mobile Computing
With the rapid pace of change in mobile computing, it is crucial to convey an under- standing of trends, to better know what developments to anticipate and how to plan for them. When a new mobile device or operating system is released, the best thing may be to wait to see what security threats pop up. It is important to understand the direction mobile computing usage and deployment are taking in order to plan and develop IG policies to protect information assets.
From CIOZone.com, here are the top trends in mobile computing:
1. Long Term Evolution (LTE). The so-called fourth generation of mobile computing (4G) is expected to be rolled out across North America over the next several years [2013–2015], making it possible for corporate users to run business applications on their devices simultaneously with Voice over IP (VoIP) capabilities.
2. WiMax [Worldwide Interoperability for Microwave Access]. As LTE andx WiMax networks are deployed in the U.S. through [2013 and beyond], expect to see more netbooks and laptops equipped with built-in radio fre- quency identifi cation (RFID) and wireless support. [WiMax is protocol for communications that provides up to 40 megabits/second speeds (much faster than Wi-Fi) for fi xed and mobile Internet access. The next IEEE 802.16m update will push the speed to up to 1 gigabyte bit/second fi xed speeds.]
3. 3G and 4G interoperability. Sprint has developed a dual mode card which will enable mobile device users to work on both 3G and 4G networks. Other carriers are expected to follow suit.
4. Smartphone applications. Third-party software vendors will increasingly make enterprise applications available for smartphones, including inven- tory management, electronic medical records management, warehousing, distribution and even architectural and building inspection data for the construction industry.
5. GPS. Global Positioning Systems (GPS) will increasingly be used to iden- tify end users by their whereabouts and also to analyze route optimization for delivery workers and service technicians.
6. Security. As new and different types of mobile devices are introduced, cor- porate IT departments will fi nd it increasingly challenging to identify and authenticate individual end users. As such, expect to see a combination of improvements in both Virtual Private Network (VPN) software and hard- ware-based VPNs to support multiple device types.
274 INFORMATION GOVERNANCE
c14 274 March 6, 2014 4:43 PM
7. Antivirus. As more third-party business applications are made available on smartphones and other mobile devices, CIOs [chief information offi cers] will also have to be cognizant about the potential for viruses and worms.
8. Push-button applications. Let’s say a waste disposal truck arrives at an indus- trial site and is unable to empty a Dumpster because a vehicle is blocking its path. Smartphones will increasingly have applications built into them that would make it possible for the disposal truck driver to photograph the impeding object and route the picture to a dispatcher to document and time-stamp the obstruction.
9. Supplemental broadband. As carriers implement LTE and WiMax networks, companies such as Sprint and Verizon are looking at potentially extending wireless broadband capabilities to small businesses which don’t have fi ber optic or copper connections on the ground. Under this scenario, a small packaging company in New Jersey could potentially be able to receive T-1 level (high-speed) broadband capabilities in regions of the U.S. where it has offi ces but doesn’t have wireline broadband connections.
10. Solid State Drives (SSDs). Corporate customers should expect to see contin- ued improvements in the controllers and fi rmware built into SSDs in order to improve the longevity of the write cycles in notebooks. 7
Security Risks of Mobile Computing
Considering their small size, mobile computing devices store a tremendous amount of data, and storage capacities are increasing with the continued shrinking of circuits and advancement in SSD technologies. Add to that the fact that they are highly portable and often unsecured and you have a vulnerable mix that criminals can target. Consid- ering how often people lose or misplace their mobile devices daily, and what valuable targets they are for physical theft (this author had a laptop stolen in the Barcelona air- port, right from under his nose), and it is clear that the use of mobile devices represents an inherent security risk.
But they do not have to be lost or stolen to be compromised, according to Stan- ford University’s guidelines, which are intended to help mobile computing device us- ers protect the information the devices contain. “ Intruders can sometimes gain all the access they need if the device is left alone and unprotected, or if data is ‘sniffed out of the air’ during wireless communications” s 8 (emphasis added). The devices can be compromised with the use of keystroke loggers that capture every single entry a user makes. This can be done without the user having any knowledge of it. That means company passwords, confi dential databases, and fi nancial data (including personal and corporate credit card numbers) are all at risk.
Securing Mobile Data
The fi rst and best way to protect confi dential information assets is to remove confi dential, un- necessary, or unneeded data from the mobile device. Confi dential data should not be stored on the device unless explicit permission is given by the IT department, business unit
INFORMATION GOVERNANCE FOR MOBILE DEVICES 275
c14 275 March 6, 2014 4:43 PM
head, or the IG board to do so. This includes price lists, strategic plans, competi- tive information, photo images of corporate buildings or coworkers, and fi nancial data such as tax identifi cation numbers, company credit card or banking details, and other confi dential information.
If it is necessary for sensitive data to be stored on mobile devices, there are options to secure the data more tightly, using USB drives, fl ash drives, and hard drives that have integrated digital identity and cryptographic (encryption) capabilities.
Mobile Device Management
MDM software helps organizations to remotely monitor, secure, and manage devices such as smartphones and tablet PCs. 9 MDM improves security and streamlines enterprise management of mobile devices by providing ways to contact the remote devices individually or en masse to add, upgrade, or delete software, change confi guration settings, and “wipe,” or erase, data, and make other security-related changes and updates. More sophisticated MDM offerings can manage not only homogenous company-owned mobile devices but also those that employees use in the workplace in a bring-your-own-device (BYOD) environment.
The ability to control confi guration settings and secure data remotely allows or- ganizations to better manage and control mobile devices, which reduces the risk of data leakage and reduces support costs by providing more uniformity and the ability to monitor enforce company-dictated IG policy for mobile devices.
Key vendors in the MDM marketplace include AirWatch, Apple (Profi le Man- ager) AppSense, BoxTone, Centrify, Citrix, Good Technology, IBM (Endpoint Man- ager for Mobile Devices), LANDesk, MobileIron, SAP (Afaria MDM), and Symantec (Mobile Management Suite).
Rapid growth is expected in the MDM marketplace, with Gartner projecting that nearly two-thirds of organizations will deploy MDM software by 2018. 10 And Frost & Sullivan projects that “the market for enterprise MDM will grow from $178.6 million in 2011 to $712.4 million by 2018.” 11
Trends in MDM
Six key trends in the MDM marketplace are discussed next.
1. MDM software expansion and maturity. Many experts believe that MDM will develop and reach beyond just mobile endpoints to include deep integration with mobile infrastructure and applications (apps). 12 What is important is securing and authenticating data. To ensure that, MDM must expand beyond remote device locking, tracking, and wiping. A more comprehensive life cycle management approach will emerge beginning with the acquisition or introduction of the device into the enterprise network until its retirement or destruction. In addition, monitoring and controlling costs through integrated expense management will likely occur.
2. Consolidation of MDM major players. Acquisitions by Citrix, Good Technology, TT and others signal that fewer but stronger market leaders are likely to emerge.
276 INFORMATION GOVERNANCE
c14 276 March 6, 2014 4:43 PM
3. Cloud-based MDM. This will become the norm, not the exception, and it will happen quite rapidly.
4. Emphasis on mobile device policy. Technology can do only so much—an orga- nization must have its IG policies, processes, and audit practices formalized, tested, and monitored. The IT department must have clear direction on which data and devices to monitor and secure, and employee rights and responsibili- ties must be clearly delineated and communicated.
5. Diversifying and expanding mobile monitoring and security. This means that MDM may go beyond today’s mobile devices and include remote instruments and machines that are churning out data in applications, such as process man- agement, transportation management, and enterprise resource management.
6. Infrastructure consolidation. The currently disparate pieces, including social computing, mobile computing, and cloud computing, may consolidate and become the new construct for the infrastructure paradigm. This means that tools will emerge to manage all these pieces in a centralized and holistic way.
IG for Mobile Computing
Stanford University’s guidelines are a helpful foundation for IG of mobile devices. They are “relatively easy to implement and use and can protect your privacy” and safeguard data “in the event that the device becomes compromised, lost or stolen.” 13
Smartphones and Tablets ■ Encrypt communications. For phones that support encrypted communication
(secure sockets layer [SSL], virtual private network [VPN], hypertext transfer protocol secure [https]), always confi gure defaults to use encryption.
■ Encrypt storage. Phones approved to access confi dential information assets must encrypt their bulk storage with hardware encryption.
■ Password protect. Confi gure a password to gain access and or use the device. Passwords for devices that access confi dential information assets should be at least seven characters in length and use upper- and lowercase letters as well as some numerical characters. Passcodes should be changed every 30 days.
■ Timeout. Set the device so that it is locked after a period of idleness or timeout, perhaps as short as a few minutes.
■ Update. Keep all system and application patches up to date, including mobile OSs and installed applications. This allows for the latest security measures and patches to be installed to counter ongoing threats.
■ Protect from hacking. Phones approved to access confi dential and restricted data must not be jailbroken (hacked to gain privileged access on a smartphone us- ing the Apple iOS) or rooted (typically refers to jailbreaking on a smartphone running the Android OS). The process of rooting varies widely by device. It usually includes exploiting a security weakness in the fi rmware shipped from the factory. “‘Jailbreaking’ and ‘rooting’ removes the manufacturer’s protection against malware.”
■ Manage. Phones approved to gain access to confi dential information assets must be operating in a managed environment to maintain the most current security and privacy settings, and monitor use for possible attacks.
INFORMATION GOVERNANCE FOR MOBILE DEVICES 277
c14 277 March 6, 2014 4:43 PM
Portable Storage Devices These include thumb drives or memory sticks, removable hard drives, and even devices like iPods that are essentially mobile disc storage units with extra bells and whistles.
■ Create a user name and password to protect the device from unauthorized ac-d cess—especially if lost or stolen.
■ Utilize encryption to protect data on devices used to store and/or transport con- fi dential information assets.
■ Use additional levels of authentication and management for accessing the device,t where possible.
■ Use biometric identifi cation to authenticate users, where possible.
Laptops, Netbooks, Tablets, and Portable Computers ■ Password protect. This is the most basic protection, yet it is often not used. Cre-
ate a user name and password to protect the device from unauthorized access; require that they are entered each time the computer is used.
■ Timeout. Require that the password is reentered after a timeout period for the screensaver.
■ Encrypt. Laptops, notebooks, or tablets used to access confi dential information assets should be required to be encrypted with whole disk encryption.
■ Secure physically. Physical locks should be used “ whenever the system is in a station- ary location for extended periods of times.” s
Building Security into Mobile Applications
While it is a relatively new channel, mobile electronic commerce (e-commerce) is growing rapidly, and new software apps are emerging for consumers as well as business and public sector enterprises. These apps are reducing business process cycle times and making the organizations more agile, more effi cient, and more productive. Some key strategies can be used to build secure apps.
As is the case with any new online delivery channel, security is at the forefront for organizations as they rush to deploy or enhance mobile business apps in the fast- growing smartphone market. Their priorities are different from those of the software developers churning out apps.
In the banking sector, initially many mobile apps limited customers to a walled-off set of basic functions—checking account balances and transaction histories, fi nding a branch or automated teller machine location, and initiating transfers—but “a new wave of apps is bringing person-to-person payments, remote deposit capture and bill pay to the mobile channel. Simply, the apps are getting smarter and more capable. But with those capabilities comes the potential for greater threats”s 14 (emphasis added).
Security experts state that the majority of the challenges that could result from mobile fraud have not been seen before. Mobile e-commerce is relatively new and has not been heavily targeted—yet. But industrial espionage and the theft of trade secrets by targeting mobile devices is going to be on the rise and the focus of rogue competitive intelligence-gathering organizations. User organizations have to be even
278 INFORMATION GOVERNANCE
c14 278 March 6, 2014 4:43 PM
more proactive, systematic, and diligent in designing and deploying mobile apps than they did with Web-based apps.
Software developers of mobile apps necessarily seek the widest audience possible, so they often deploy them across multiple platforms, which forces some security trade- offs: Enterprises have to build apps for the “strengths and weaknesses intrinsic to every device, which adds to the security challenges”15 (emphasis added).
A side effect of mobile app development efforts from the user perspective is that it can reshape the way users interact with core information management (IM) applica- tions within the enterprise.
The back-offi ce IM systems, such as accounting, customer relationship manage- ment, human resources, and other enterprise apps that are driving online and mobile, are the same as before, but the big difference comes in how stakeholders (employees, customers, and suppliers) are interacting with the enterprise. In the past, when deploy- ing basic online applications for browser access, there was much more control over the operating environment; with newer mobile applications running on smartphones and tablets, that functionality has been pushed out to end user devices.
Real Threats Are Poorly Understood
The list of threats to mobile apps is growing, and existing threats are poorly under- stood, in general. They are just too new, because mobile commerce by downloadable app is a relatively new phenomenon—the Apple iTunes App Store and the Android Marketplace debuted in the second half of 2008. “But that doesn’t mean the threat isn’t real—even if the app itself is not the problem.” 16 The problem could be the unsecure network users are on or a device infection of some sort.
For mobile apps, antivirus protection is not the focus as it is in the PC world; the security effort mostly focuses on keeping malware off the device itself by addressing software development methods and network vulnerabilities. Surely, new types of at- tacks on mobile devices will continue to be introduced. That is the one thing that can be counted on.
There already have been some high-profi le examples of mobile devices being compromised. For example, in 2010:
New York–based Citibank’s iPhone app was found to be storing customers’ [private] data on their phones, with obvious privacy implications [and expos- ing it to theft and fraud]. Meanwhile, Google (New York) has had to pull a number of apps from the Android Marketplace built by an anonymous [crim- inal] developer who was creating fake bank apps [with realistic and usable features] that attempted to exploit information on users’ devices to commit banking and [credit] card fraud.
There are many more examples, but the cited incidents make it imperative to understand the mobile app marketplace itself in order that effective IG policies and controls may be developed, deployed, and enforced. Simply knowing how Google has approached soliciting app development is key to developing an IG strategy for Android devices. Google’s relatively open-door approach initially meant that almost anyone could develop and deploy an app for Google Android. Although the policy has evolved somewhat to protect Android users, it is still quite easy for any app developer—well
INFORMATION GOVERNANCE FOR MOBILE DEVICES 279
c14 279 March 6, 2014 4:43 PM
intentioned or malicious—to release an app to the Android Marketplace. This in itself can pose a risk to end users, who sometimes cannot tell the difference between a real app released by a bank and a banking app built by a third party, which may be fraudulent. Apple has taken a more prudent and measured approach by enforcing a quality-controlled approval process for all apps released to its iTunes App Store. Sure, it slows development, but it also means apps will be more thoroughly tested and secure.
Both approaches have their positives and negatives the companies and for the de- vice users. But clearly, Apple’s curated and quality-controlled approach is better from a security risk standpoint.
Understanding the inherent strengths and, perhaps more important, weaknesses of specifi c mobile hardware devices and OS—and their interaction with each other— is key when entering the software design phase for mobile apps.
The development environment is altogether different. Windows programmers will experience a learning curve. Mobile apps under Android or Apple OS operate in a more restricted and less transparent fi le management environment.
Bearing that in mind—regardless of the mobile OS—fi rst ensure that data is secured, — and then check the security of the application itself. That is, practice good IT governance to ensure that the software source code is also secure. Malicious code can be inserted into the program; once it is deployed, hackers will have an easy time stealing confi dential data or documents.
Innovation versus Security: Choices and Trade-offs
As organizations deploy mobile apps, they must make choices, given the limited or confi ned software development environment and the need to make agile, intuitive apps that run fast so users will adopt them. To ensure that a mobile offering is secure, many businesses are limiting their apps’ functionality. So stakeholder users get mobile access that they didn’t have before and a new interface with new functionality, but it is not possible to offer as much functionality as in Web apps. And more security means some sacrifi ces and choices will need to be made versus speed and innovative new features.
Some of the lessons learned in the deployment of online Web apps still apply to mobile apps. Hackers are going to try social engineering like phishing (duping users into providing access or private information) and assuming the identity of an account holder, bank, or business. They will also attempt man-in-the-middle attacks. (More on that topic soon).
With mobile applications, typically the app is operated directly on a mobile de- vice, such as a smartphone. This is a key difference between apps and traditional PC-based interfaces that rely on browser access or using basic mobile phone text messaging. Connect- ing to a business via app can be more secure than relying on a browser or texting platform, which require an additional layer of software (e.g., the browser, texting platform, or Wi-Fi connection) to execute sensitive tasks. These security vulnerabili- ties can compromise the safety of information transmitted to a secure site. Thank- fully, if the app is developed in a secure environment, it can be entirely self-contained, and the opportunity to keep mobile data secure is greatest when using the app as opposed to a browser-based platform.
This is because a mobile app provides a direct connection between the user’s de- vice and the business, governmental agency, or e-commerce provider. Some security experts believe that mobile apps potentially could be more secure than browser-based
280 INFORMATION GOVERNANCE
c14 280 March 6, 2014 4:43 PM
access from the desktop because they can communicate on an app-to-app (or comput- er-to-computer) level.
In fact, “a customer using a bank app on a mobile network might just be safer than a customer accessing online banking on a PC using an open Wi-Fi connection” that anyone can monitor.
How do you combat this browser-based vulnerability if it is required to access an online interface? The most effective and simplest way to counter security threats in the PC- based browser environment and to eliminate man-in-the-browser or man-in-the-middle r attacks is to use two different devices rather than communicate over a standard Internet s connection. This approach can be built into IG guidelines.
Consider this: Mobile apps actually can bring about greater security. For exam- ple, do you receive alerts from your bank when hitting a low-balance threshold? Or a courtesy e-mail when a transaction is posted? Just by utilizing these types of alerts—and they can be applied to any type of software application beyond bank- ing—tech-savvy users themselves can serve as an added layer of protection. If they receive an alert of account activity regularly, they may be able to identify fraudulent activity immediately and take action to counter it and stop it in its tracks, limiting the damage and potential exposure of additional private data or confi dential infor- mation assets.
Best Practices to Secure Mobile Applications
Mobile computing is not going away; it is only going to increase in the future. Most businesses and governments are going to be forced to deploy mobile apps to compete and provide services customers will require. There is the potential for exposure of confi dential data and e-documents, but this does not mean that organizations must shy away from deploying mobile apps. 17 Some proven best practice approaches can help to ensure that mobile apps are secure.
Some steps can be taken to improve security—although there can never be any guarantees— and some of these should be folded into IG guidelines in the policy de- velopment process. BankTech magazine identifi ed six best practices that can shape an organization’s app development process:
1. Make sure your organization or outside development fi rm uses seasoned application developers who have had secure-coding training and use a se- cure software development life cycle (SDLC).
2. [Developed for banking apps, this approach can be applied to other vertical apps too.] Follow the guidance suggested by the Federal Deposit Insur- ance Corp. (FDIC FIL-103-2005) regarding authentication in an Inter- net banking environment. The guidance describes enhanced authentication methods, such as multifactor authentication, that regulators expect banks to use when authenticating the identity of customers using the bank’s online products and services.
3. Make sure that the customer (or employee) is required to re-enter his or her credentials after a certain time period to prevent someone other than the mo-d bile device’s owner from obtaining access to private account information.
INFORMATION GOVERNANCE FOR MOBILE DEVICES 281
c14 281 March 6, 2014 4:43 PM
4. Hire an information security expert to assess the security around your mobile t application servers. Unfortunately, an organization’s servers are often over- looked during a risk assessment, as they require a specialized skill set to test d them.
5. Encrypt sensitive data that is stored on a mobile device and account data that travels from the handset across the Internet. Ensure that the encryption is implemented properly.
6. Hire a security expert to test the security of a mobile application before you implement it across your customer base. 18 (Emphasis added throughout.)
Developing Mobile Device Policies
Where do you start? Developing a comprehensive mobile strategy is key before you craft your mobile device policies. You will need input from a variety of stakeholders, and you will need to understand where mobile devices fi t in your overall technology infrastructure and strategy. Here are some best practices for developing your mobile device policies.
1. Form a cross-functional mobility strategy team. You will need the input of primary stakeholder groups, including IT, fi eld business units, and human resourc- es (for policy creation and distribution). Your strategy development process should also tap into the expertise of your risk management, compliance, re- cords management, and legal departments. The aim will be to balance risks and benefi ts to improve employee productivity and guard against risk while focusing on the goals and business objectives of the organization. 19
2. Clarify goals for your mobile strategy. Start your discussion with the big picture, the “30,000 foot view” of the business drivers, challenges, threats, and op- portunities that mobile computing provides in today’s technology context and your business context. Draw a direct line from your mobile business needs to your planned mobile support strategy and infrastructure. Keep your business goals in mind and link them to the discussion.
3. Drill down into policy requirement details. You may want to survey other exist- ing mobile device policies to inform your mobility strategy team. Those from peer organizations and competitors will be most relevant. Then start with the basics: which types of devices and OS make sense for your organization to support, what changes and trends are occurring in the technology market- place, which sensitive e-documents and data you must protect (or disallow) on mobile devices, and what available security technologies (e.g. MDM, mobile VPNs, encryption, information rights management) you might deploy. It may be helpful to segment your mobile users into broad categories, and break out a list of their specifi c business needs related to mobile computing. Your strategy and policies for executives will be somewhat different than those for users in fi eld business units. And you will need BYOD policies if your organization opts to go this route.
4. Budgeting and expense control. Is the organization going buy devices and pay all mobile expenses through direct billing each month? What cost controls need
282 INFORMATION GOVERNANCE
c14 282 March 6, 2014 4:43 PM
to be in place? Or will mobile device use expenses be reimbursed by a fl at rate or by processing expense reports? What about BYOD? Roaming charge limits? Decisions on the fi nancial and cost control aspects of mobile comput- ing use must be made by your mobility policy team, under the guidance of an executive sponsor.
5. Consider legal aspects and liability issues. Consult your legal counsel on this. What key laws and regulations apply to mobile use? Where could users run afoul? What privacy and security issues are most prominent to consider? What about the private data that users may hold on their own (BYOD) devices? An overarching consideration is to maintain security for private information and to have a policy in place for data leaks and lost or stolen devices. That includes your policy on remote “wipes” of sensitive data or perhaps all data.l
6. Weigh device and data security issues. Since most mobile devices—especially smartphones—were not designed with security as a foremost consideration, you must take steps to protect your sensitive data and to secure the devices themselves without impeding business or making operation too diffi cult for the end user. The world of mobile computing presents new challenges that were not present when IT had full control of endpoint devices and internal networks. Clear mobile security policies and controls must be in place.
7. Develop your communications and training plan. Users must be apprised and re- minded of your mobile device policy if they are going to adhere to it. They also need to know the consequences of violating your policies. Your commu- nications and training plan should be creative—from wall posters to text and e-mail messages, from corporate newsletters to group training sessions. You may want to fi rst pilot your new policy with a small group of users. But com- munication and training are key: A perfect mobile device policy will not work if it is not communicated properly and users are not trained properly.
8. Update and fi ne-tune. There will be some misses, some places where after your deploy your mobile policy you fi nd room for improvement. You will receive user feedback, which should be considered too. And there will be changes in the technology marketplace and user trends. A program must be in place to periodically (every six months, perhaps) review your mobile device policy and any audit information to make improvements in the policy.
If your organization sanctions the use of mobile devices, you must have a clear, updated IG policy for their use, and you must be able to monitor, test, and audit com- pliance with the policy. Bear in mind that mobile devices are inherently unsecured and have many vulnerabilities, and you will have to consider possible security threats. If your organization plans to utilize a BYOD approach, your support for mobile de- vices will be more challenging and complex. Critical to success in leveraging mobile devices is training employees on your IG policy and policy updates and consistently reinforcing the message of cautiousness with confi dential company data. If you are us- ing mobile devices to conduct business, there will be business records that are created that must be captured and archived with their integrity and authenticity intact. All information on an employee’s smartphone or tablet is potentially discoverable in legal proceedings, so you must include your legal team in policy development and periodic updates. Mobile device use can allow for great productivity gains, but the gains come with associated risks.
INFORMATION GOVERNANCE FOR MOBILE DEVICES 283
c14 283 March 6, 2014 4:43 PM
Notes
1. CTIA, “Wireless Quick Facts,” www.ctia.org/advocacy/research/index.cfm/aid/10323 (accessed May 13, 2013).
2. Alan Joch, “How to Create an Effective Mobile Device Policy,” Biztech , www.biztechmagazine.com/ article/2013/03/how-create-effective-mobile-device-policy , March 26, 2013.
3. “Current Mobile Computing Calls for Security as Powerful as Titanium,” http://techreview.blogpool .co.uk/2011/02/10/modern-day-mobile-computing-calls-for-security-as-powerful-as-titanium (accessed March 30, 2012).
CHAPTER SUMMARY: KEY POINTS
■ The plethora of mobile computing devices fl ooding into the market will be one of the biggest ongoing security challenges moving forward.
■ An IDC report indicated that smartphone sales outpaced PC sales for the fi rst time ever in the fourth quarter of 2010.
■ As businesses work to deploy mobile apps, they walk a fi ne line between in- novation and risk. To ensure that a mobile offering is secure, many businesses are limiting their apps’ functionality.
■ Human beings remain the weakest link in security, particularly with the in- creasing use of mobile devices. IG policies must be established and employ- ees must be trained to be aware of security and privacy risks.
■ Connecting to a business directly via an app can be more secure than rely- ing on a browser or texting platform, which require an additional layer of software.
■ Over the next several years North America will be upgrading to 4G networks, faster WiMax will be deployed, and there will be 3G and 4G interoperability.
■ MDM software helps organizations to remotely monitor, secure, and manage devices such as smartphones and tablet PCs.
■ There will be new enhanced security and antivirus products developed to combat the increasing threat of cyberattacks.
■ Mobile computing security challenges require that organizations follow best practices when developing and deploying apps. Some keys are: encrypting sensitive data, using the secure software development life cycle (SDLC) meth- odology and enhanced authentication methods, and hiring a security expert to test new apps.
■ Develop a comprehensive mobile strategy before you craft your mobile de- vice policies. You will need input from a variety of stakeholders, and you will need to understand where mobile devices fi t in your overall technology infrastructure and strategy.
284 INFORMATION GOVERNANCE
c14 284 March 6, 2014 4:43 PM
4. Warwick Ashford, “Mobility among the Top IT Security Threats in 2011, Says UK Think Tank,” Computer Weekly , January 7, 2011, www.computerweekly.com/Articles/2011/01/07/244797/Mobility- among-the-top-IT-security-threats-in-2011-says-UK-think.htm (accessed March 30, 2012).
5. Ann All, “Mobile Device Management: 6 Trends to Watch,” eSecurity Planet , www.esecurityplanet.com/t mobile-security/mobile-device-management-6-trends-to-watch.html (accessed February 8, 2013).
6. Matt Gunn, “How to Build a Secure Mobile App,” Bank Systems and Technology , July 6, 2011, www .banktech.com/risk-management/231001058?itc=edit_stub (accessed December 19, 2011).
7. “Top Ten Trends in Mobile Computing,” CIO Zone , www.ciozone.com/index.php/Editorial-Research/ Top-Ten-Trends-in-Mobile-Computing/2.html (accessed December 19, 2011).
8. Stanford University, “Guidelines for Securing Mobile Computing Devices,” www.stanford.edu/group/ security/securecomputing/mobile_devices.html (accessed December 19, 2011).
9. Symantec, “Business Challenge: Mobile Device Management,” www.symantec.com/mobile-device- management (accessed May 14, 2013).
10. All, “Mobile Device Management: 6 Trends to Watch.” 11. Vikrant Gandhi, “U.S. Mobile Device Management (MDM) Market,” October 4, 2012, www.frost
.com/sublib/display-report.do?ctxixpLink=FcmCtx1&searchQuery=mdm&bdata=aHR0cDovL3d3d y5mcm9zdC5jb20vc3JjaC9jYXRhbG9nLXNlYXJjaC5kbz9xdWVyeVRleHQ9bWRtQH5AU2Vhc- mNoIFJlc3VsdHNAfkAxMzYwMzI5NTg4NTc5&ctxixpLabel=FcmCtx2&id=NB29-01-00-00-00
12. All, “Mobile Device Management: 6 Trends to Watch.” 13. Quotes in this section are from Stanford University, “Guidelines for Securing Mobile Computing
Devices.” www.stanford.edu/group/security/securecomputing/mobile_devices.html 14. Quotations in this section are from Matt Gunn, “How to Build a Secure Mobile App,” Bank Systems
and Technology , July 6, 2011, www.banktech.com/risk-management/231001058?itc=edit_stub (accessed March 30, 2012).
15. Ibid. 16. Ibid. 17. Beau Woods, “6 Ways to Secure Mobile Apps,” Bank Systems and Technology , May 26, 2011, www
.banktech.com/architecture-infrastructure/229700033 (accessed March 30, 2012). 18. Ibid. 19. Joch, “How to Create an Effective Mobile Device Policy.”
285
c15 285 March 8, 2014 5:17 PM
Information Governance for Cloud Computing*
C H A P T E R 15
By Monica Crocker CRM, PMP, CIP, and Robert Smallwood
* Portions of this chapter are adapted from Chapter 12 , Robert F. Smallwood, Managing Electronic Records: Methods, Best Practices, and Technologies , © John Wiley & Sons, Inc., 2013. Reproduced with permission of John Wiley & Sons, Inc.s
C loud computing represents one of the most signifi cant paradigm shifts in infor- mation technology (IT) history. It may have evolved as an extension of sharing an application-hosting provider, which has been around for a half century and
was common in highly regulated vertical industries, such as banks and health care institutions. But cloud computing is a very different computing resource, utilizing advances in IT architecture, system software, improved hardware speeds, and lower storage costs.
The impetus behind cloud computing is that it provides economies of scale by spreading costs across many client organizations and pooling computing resources while matching client computing needs to consumption in a fl exible, (nearly) real- time way. Cloud computing can be treated as a utility that is vastly scalable and can be readily modulated, just as the temperature control on your furnace regulates your energy consumption. This approach has great potential, promising on-demand computing power, off-site backups, strong security, and “innovations we cannot yet imagine.”1
When executives hear of the potential cost savings and elimination of capital outlays associated with cloud computing, their ears perk up. Cloud deployments can give users some autonomy and independence from their IT department, and IT departments are enthused to have instant resources at their disposal and to shed some of the responsibilities for infrastructure so they can focus on business applica- tions. Most of all, they are excited by the agility offered by the on-demand provision- ing of computing and the ability to align IT with business strategies more nimbly and readily.
But for all the hoopla and excitement, there are also grave concerns about security risks and loss of direct IT control , which call for strict information governance (IG) policies andl processes. Managers and IT leaders who are customers of cloud computing services are ultimately responsible for IT performance. A number of critical IG challenges as- sociated with cloud computing must be addressed. These include privacy and security issues, records management (RM) issues, and compliance issues, such as the ability to
Information Governance: Concepts, Strategies and Best Practices By Robert F. Smallwood Copyright © 2014 by Robert F. Smallwood
286 INFORMATION GOVERNANCE
c15 286 March 8, 2014 5:17 PM
respond to legal discovery orders. In addition, there are metadata management and custody challenges to consider. An investigation and analysis of how the cloud services provider(s) will deliver RM capability is crucial to supporting IG functions, such as archiving and e-discovery, and meeting IG policy requirements.
Organizations need to understand the security risks of cloud computing, and they must have IG policies and controls in place for leveraging cloud technology to manage electronic information before moving forward with a cloud computing strategy.
Defi ning Cloud Computing
The defi nition of cloud computing is, rather, well, g cloudy , if you will. The fl urry of developments in cloud computing makes it diffi cult for managers and policy makers to defi ne it clearly and succinctly, and to evaluate available options. Many misconceptions and vagaries surround cloud computing. Some misconceptions and questions include:
■ “That hosting thing is like SaaS” ■ “Cloud, SaaS, all the same, we don’t own anything” ■ “OnDemand is Cloud Computing” ■ “ASP, Hosting, SaaS seems all the same” ■ “It all costs the same so what does it matter to me?” ■ “Why should I care if it’s multi-tenant or not?” ■ “What’s this private cloud versus public cloud?” 2
Cloud computing is a shared resource that provides dynamic access to computing services that may range from raw computing power, to basic infrastructure, to fully operational and supported applications.
It is a set of newer information technologies that provides for on-demand, modu- lated, shared use of computing services remotely. This is accomplished by telecom- munications via the Internet or a virtual private network (which may provide more security). It eliminates the need to purchase server hardware and deploy IT infrastruc- ture to support computing resources and gives users access to applications, data, and storage within their own business unit environments or networks. 3 Perhaps the best feature of all is that services can be turned on or off, increased or decreased, depending on user needs.
There are a range of interpretations and defi nitions of cloud computing, some of which are not completely accurate. Some merely defi ne it as renting storage space or applications on a host organization’s servers; others center defi nitions around Web- based applications like social media and hosted application services.
Someone has to be the offi cial referee, especially in the public sector. The Na- tional Institute of Standards and Technology (NIST) is the offi cial federal arbiter of
“Cloud computing encompasses any subscription-based or pay-per-use service that, in (near) real time over the Internet, extends IT’s existing capabilities.”
INFORMATION GOVERNANCE FOR CLOUD COMPUTING 287
c15 287 March 8, 2014 5:17 PM
defi nitions, standards, and guidelines for cloud computing. NIST defi nes cloud com- puting as:
a model for enabling convenient, on-demand network access to a shared pool of confi gurable computing resources (e.g., networks, servers, storage, applica- tions, and services) that can be rapidly provisioned and released with minimal management effort or service provider interaction. 4
NIST has offered its offi cial defi nition, but “the problem is that (as with Web 2.0) everyone seems to have a different defi nition.” 5 The phrase “the cloud” has entered the mainstream—it is promoted on prime-time TV—but its meaning and description are in fl ux: that is, if you ask 10 different people to defi ne it, you will likely get 10 dif- ferent answers. According to Eric Knorr and Galen Gruman in InfoWorld, it’s really just “a metaphor for the Internet,” but when you throw in “computing” alongside it, “the meaning gets bigger and fuzzier.” Cloud computing provides “a way to increase capacity [e.g., computing power, network connections, storage] or add capabilities dy- namically on the fl y without investing in new infrastructure, training new personnel, or licensing new software. Cloud computing encompasses any subscription-based or pay-per-use service that, in (near) real time over the Internet, extends IT’s existing capabilities.” 6
Given the changing nature of IT, especially for newer developments, NIST has stated that the defi nition of cloud computing “is evolving.” People looking for the lat- est offi cial defi nition should consult the most current defi nition available from NIST’s Web site at www.nist.gov (and other resources).
Key Characteristics of Cloud Computing
NIST also identifi es fi ve essential characteristics of cloud computing:
1. On-demand self-service. A [computing] consumer can unilaterally provision computing capabilities, such as server time and network storage, as needed automatically without requiring human interaction with each service’s provider.
2. Broad network access. Capabilities are available over the network and accessed through standard mechanisms that promote use by heterogeneous thin or thick client platforms (e.g., mobile phones, laptops, and PDAs [personal digi- tal assistants]).
3. Resource pooling. The [hosting] provider’s computing resources are pooled to serve multiple consumers using a multi-tenant model, with different physi- cal and virtual resources dynamically assigned and reassigned according to
Cloud computing enables convenient, on-demand network access to a shared pool of confi gurable computing resources that can be rapidly provisioned.
288 INFORMATION GOVERNANCE
c15 288 March 8, 2014 5:17 PM
consumer demand. There is a sense of location independence in that the customer generally has no control or knowledge over the exact location of the provided resources but may be able to specify location at a higher level of abstraction (e.g., country, state, or datacenter). Examples of resources include storage, processing, memory, network bandwidth, and virtual ma- chines.
4. Rapid elasticity. Capabilities can be rapidly and elastically provisioned, in some cases automatically, to quickly scale out, and rapidly released to quickly scale in. To the consumer, the capabilities available for provisioning often appear to be unlimited and can be purchased in any quantity at any time.
5. Measured service. Cloud systems automatically control and optimize resource use by leveraging a metering capability at some level of abstraction appro- priate to the type of service (e.g., storage, processing, bandwidth, and active user accounts). Resource usage can be monitored, controlled, and reported, providing transparency for both the provider and consumer of the utilized service.7
What Cloud Computing Really Means
Cloud computing growth is expected to continue to climb dramatically. A recent Gart- ner study shows that the United States is the leader in adopting cloud computing, and the market is expanding rapidly. 8 The cloud computing market is expected to grow 21 percent annually from 2012 to 2016, exceeding $16 billion in 2014 and growing to over $22 billion in 2016. 9
The use of service-oriented architecture —which separates infrastructure, ap- plications, and data into layers—permeates enterprise applications, and the idea of loosely coupled services running on an agile, scalable infrastructure may eventually “make every enterprise a node in the cloud.” That is the direction the trend is headed.
A common misconception is that an organization “moves to the cloud.” In reality, the organization may decide to transition some specifi c business applications to the cloud. Those specifi c business applications are selected because a cloud architecture may offer crucial functions that the internally hosted solution does not or because the internal solution is burdensome to maintain. Some examples of business applications that frequently are moved to the cloud include advertising, collaboration, e-mail, of- fi ce productivity applications, sales support solutions, customer response systems, fi le storage, and system backups.
Another common misconception is that if your organization does not decide to migrate to a cloud solution, you are protected from all the dangers of cloud computing. The hard facts are that, for the vast majority of organizations, users are already putting information in the cloud. They are simply using cloud solutions to compensate for
Among metatrends, “Cloud computing is the hardest one to argue with in the long term.”
INFORMATION GOVERNANCE FOR CLOUD COMPUTING 289
c15 289 March 8, 2014 5:17 PM
limitations of the current environment. They may be using Box.com to get at infor- mation when working remotely or Dropbox.com to share information with an outside business partner. Or they are using SkyDrive get to documents from their iPad. They may not even realize they have posted company information to a cloud environment, so they do not realize they violated any policy against doing that. To complicate mat- ters, they probably also left a copy of the information within your organization’s fi re- wall. Internal users might not realize they are not using the current version, and your records manager does not know another copy is fl oating around out there. This is completely ungoverned information in the cloud . The best defense against it is to deliver d solutions for those business needs so that users do not have to fi nd their own.
Cloud Deployment Models
Depending on user needs and other considerations, cloud computing services typically are deployed using one of four models, as defi ned by NIST:
1. Private cloud. This is dedicated to and operated by a single enterprise. This is a particularly prudent approach when privacy and security are key issues, such as in the health care and fi nancial services industries and also for sensitive gov- ernment or military applications and data. A private cloud may be managed by the organization or a third party and may exist on or off premises.
2. Community cloud. Think co-ops, nonprofi t organizations, and nongovernmen- tal organizations. In this deployment, the cloud infrastructure is shared by sev- eral organizations and supports a specifi c community that has shared concernss (e.g., mission, security requirements, policy, and compliance considerations). It may be managed by the organizations or a third party and may exist on or off premises.
3. Public cloud. Open to the public, this cloud can be maintained by a user group or even a fan club. In this case, “the cloud infrastructure is made available to the general public or a large industry group and is owned by an organization selling cloud services.”
4. Hybrid cloud. This utilizes a combined approach, using parts of the aforemen- tioned deployment models: private, community, and/or public. The cloud infrastructure is a “ composition of two or more clouds, (private, community, or public) that remain unique entities but are bound together by standardized
The idea of loosely coupled services running on an agile, scalable infrastruc- ture should eventually “make every enterprise a node in the cloud.”
There are four basic cloud computing models: private, public, community, and hybrid (which is a combined approach).
290 INFORMATION GOVERNANCE
c15 290 March 8, 2014 5:17 PM
or proprietary technology that enables data and application portability (e.g., cloud bursting for load-balancing between clouds)” (emphasis added). 11
Security Threats with Cloud Computing
Cloud computing comes with serious security risks—some of which have not yet been uncovered. In planning your cloud deployment, these risks must be borne in mind and dealt with through controls and countermeasures. Controls must be tested and audited, and the actual enforcement must be carried out by management. Key cloud computing security threats are discussed next, along with specifi c examples and reme- dial measures that can be taken (fi xes). The majority of this information and quotations are from the Cloud Security Alliance. 12
Information Loss
When information is deleted or altered without a backup, it may be lost forever. Information also can be lost by unlinking it from its indices, deleting its identifying metadata, or losing its encoding key, which may render it unrecoverable. Another way data/document loss can occur is by storing it on unreliable media. And as with any architecture—not just cloud computing—unauthorized parties must be prevented from hacking into the system and gaining access to sensitive data. In general, pro- viders of cloud services have more resources at their disposal than their individual clients typically have.
Examples ■ Basic operational failures, such as server or disk drive crashes. ■ Data center reliability, backup, and disaster recovery/business continuity issues. ■ Implementation of information purging without your approval (e.g., purging
all data over three years old without regard to your retention schedule or exist- ing legal holds).
The Fixes ■ Agreement by cloud provider to follow standard operating procedures for data
backup, archiving, and retention. ■ Standard procedures for information purges that require your signoff before
they are completed. ■ Check your insurance coverage. Are you covered for the costs or liability asso-
ciated with a breach or loss of information that is stored in the cloud? ■ Clear delineation of the process for notifying the client of a security breach or
data loss.
Cloud computing carries serious security risks—some of which have not yet been uncovered.
INFORMATION GOVERNANCE FOR CLOUD COMPUTING 291
c15 291 March 8, 2014 5:17 PM
Information Breaches
Many times damage to information is malicious, while other times damage is unintentional. Lack of training and awareness, for example, can cause an information user to accidentally compromise sensitive data. Organizations must have proactive IG policies that combat either type of breach. The loss of data, documents, and records is always a threat and can occur whether cloud computing is utilized or not.
But the threat of data compromise inherently increases when using cloud comput- ing, due to “the number of and interactions between risks and challenges which are either unique to cloud, or more dangerous because of the architectural or operational characteristics of the cloud environment.”
Examples ■ Lack of document life cycle security (DLS) technologies, such as data lossy
prevention (DLP) and information rights management (IRM) technologies. ■ Insuffi cient authentication, authorization, and audit controls to govern log-t
in access. ■ Ineffective encryption and software keys, including lost keys or inconsistent
encryption. ■ Security challenges related to persistent data or ineffective disposal methods. ■ Inability to verify disposal at the end of information lifecycle.
The Fixes ■ DLS implementation where needed to protect information from creation to
their fi nal disposition. ■ Strong encryption to protect sensitive data at rest, in use, and in transit. ■ IG policies for data and document security during the software application de-
sign phase as well as testing and auditing the controls for those policies during live operation.
■ Secure storage, management, and document destruction practices. ■ Contractual agreement by cloud service providers to completely delete data
before storage media are reused by other clients. ■ Check your insurance coverage. Are you covered for the costs or liability asso-
ciated with a breach or loss of information that is stored in the cloud? ■ Clear delineation of the process for notifying the client of a security breach or
data loss.
The Enemy Within: Insider Threats
Since the advent of the National Security Agency controversy and the slew of examples in the corporate world, the threat of the malicious insider is well known. “ This threat is amplifi ed for consumers of cloud services by the convergence of IT services and customers under
Lack of training on cloud use can lead to users compromising sensitive data.
292 INFORMATION GOVERNANCE
c15 292 March 8, 2014 5:17 PM
a single management domain, combined with a general lack of transparency into provider process and procedure” (emphasis added). It is important to understand your cloud pro-” vider’s security procedures for its employees: How are they screened? Are background checks performed? How is physical access to the building and data center granted and monitored? What are its remedial procedures for noncompliance?
When these security, privacy, and support issues are not fully investigated, it cre- ates an opportunity for identity thieves, industrial spies, and even “nation-state spon- sored intrusion. The level of access granted could enable such an adversary to harvest confi dential data or gain complete control over the cloud services with little or no risk of detection.”
Examples ■ A cloud provider’s employee steals information to give or sell to one of your
company’s competitors. ■ Inadequate screening processes (by your company or a cloud provider) can
result in the hiring of people with criminal records, granting them access to sensitive information.
■ A cloud provider’s subcontractor steals information to give or sell to one of your company’s competitors.
■ A cloud provider’s employee allows unauthorized access to data that your com- pany believes is secure in the cloud.
■ The physical cloud storage facility lacks security, so anyone can enter the build- ing and access information.
The Fixes ■ Implementation of DLP and IRM technologies and related technology sets at
all stages of DLS. ■ Assessment of suppliers’ practices and complete supply chain, especially those
services that are subcontracted. ■ Screening and hiring requirements (e.g., background checks) for employees as
part of contract with cloud provider. ■ Transparent policies regarding information security, data management, com-
pliance, and reporting, as approved by the client. ■ Clear delineation of the process for notifying the client of a security breach or
data loss.
Hacking and Rogue Intrusions
Although cloud computing providers, as a rule, invest heavily in security, they also can be the target of attacks, and those attacks can affect many client enterprises. Pro- viders of cloud infrastructure service (e.g., network management, computing power,
It is prudent to investigate the security and personnel screening processes of a potential cloud provider.
INFORMATION GOVERNANCE FOR CLOUD COMPUTING 293
c15 293 March 8, 2014 5:17 PM
databases, storage) offer their customers the illusion of unlimited infrastructure expan- sion in the form of computing, network resources, and storage capacity. Often this is coupled with a very easy sign-up process, free trials (even for anonymous users), and simple activation with a credit card. This is a boon to hackers who can assume multiple identities. Using these anonymous accounts to their advantage, hackers and spammers can engage in criminal operations while remaining elusive.
Examples ■ Cloud services providers have often unknowingly hosted malicious code,
including Trojan horses, keystroke loggers, bot applications, and other pro- grams that facilitate data theft. Recent examples include the Zeus botnet and InfoStealer.
■ Malware can masquerade as downloads for Microsoft Offi ce, Adobe PDFs, or other innocuous fi les.
■ Botnets can infect a cloud provider to gain access to a wide range of data, while leveraging the cloud provider’s control capabilities.
■ Spam is a perennial problem—each new countermeasure is met with new ways to sneak spam through fi lters to phish for sensitive data.
The Fixes ■ IG policies and monitoring controls must require tighter initial registration
and thorough user verifi cation processes. ■ IG policies and technologies to combat credit card fraud. ■ Total network monitoring, including deep content inspection. ■ Requirement that the cloud provider regularly monitor public blacklists to
check for exploitation.
Insecure Points of Cloud Connection
By their very nature, cloud computing solutions involve the movement of information. Information moves from a workstation in your network to the cloud, from the cloud to a mobile device user, from an external partner to the cloud and then to one of your workstations, and so on. Further, information may be moved automatically from an application in the cloud to an application you host internally and vice versa. The movement of information complicates the process of securing it, as it now must be protected at the point of origin, the point of receipt, on the device that transmits it, on the device that receives it and at all times when it is in transit.
An application programming interface (API) is a way of standardizing the con- nection between two software applications. APIs are essentially standard hooks that an application uses to connect to another software application—in this case, a system in
Easy sign-up procedures for cloud services mean that hackers can easily assume multiple identities and carry out malicious attacks.
294 INFORMATION GOVERNANCE
c15 294 March 8, 2014 5:17 PM
the cloud. System actions like provisioning, management, orchestration, and monitor- ing can be performed using these API interfaces.
It comes down to this: A chain is only as strong as its weakest link, so APIs must be thoroughly tested to ensure that all connections abide by established policy. Doing this will thwart hackers seeking work-arounds for ill intent as well as valid users who have made a mistake. It is possible for third parties to piggyback value-added services on APIs, resulting in a layered interface that is more vulnerable to security breaches.
Examples ■ Anonymous logins and reusable passwords can undermine the security of an
entire cloud community. ■ Unencrypted transmission or storage and unencrypted verifi cation allow suc-
cessful man-in-the-middle data theft. ■ Rigid basic access controls or false authorizations pose a threat. ■ Poor management, monitoring, and recording of cloud logins and activity
make it diffi cult to detect malicious behavior. ■ Weak APIs provide opportunities for data compromise. ■ Dependency on unregulated API interfaces, especially third-party add-ons, can
allow critical information to be stolen as necessary connections are made.
The Fixes ■ Utilization of multiple logon authentication steps and strong access controls. ■ Encryption of sensitive data during transmission. ■ More robust and secure API access control. ■ An understanding of the security model of cloud provider APIs and interfaces,
including any third-party or organization-created dependencies. ■ Understanding how the API impacts associated cloud usage.
Issues with Multitenancy and Technology Sharing
Basic cloud infrastructure is designed to leverage scale through the sharing of components. Despite this, many component manufacturers have not designed their products to function in a multitenant system. Newer architectures will evolve to address this issue.
In the meantime, virtual computing is often used, allowing for multiple instances of an operating system (OS) (and applications) to be walled off from others that are running on the same computer. Essentially, each instance of the OS runs indepen- dently, as if it were the only one on the computer. A “virtualization hypervisor me- diates access between guest operating systems and the physical compute resources” (like central processing unit processing power). Yet fl aws have been found in these hypervisors “that have enabled guest operating systems to gain inappropriate levels of control or infl uence on the underlying platform”—and therefore indirectly impact
APIs must be thoroughly tested to ensure they are secure and abide by policy.
INFORMATION GOVERNANCE FOR CLOUD COMPUTING 295
c15 295 March 8, 2014 5:17 PM
the other guest OSs running on the machine. To combat this, “security enforcement and monitoring” of all shared computing resources must be employed. Solid partitions between the guest OSs—known as compartmentalization—should be employed to en- sure that one client’s activities do not interfere with others running on the same cloud provider. Customers should never have access to any other tenant’s “actual or residualr data, network traffi c” or other proprietary data.
Examples ■ Joanna Rutkowska’s Blue Pill root technique, which describes how an unau-
thorized user could intercept data by using virtual hardware called a hypervisor. The Blue Pill would be undetectable as long as the host system was functioning properly. Rutkowska also developed a Red Pill, which could detect a Blue Pill hypervisor, allowing the owner to eliminate it.
■ Kostya Kortchinksy’s CloudBurst is another example of hypervisor exploitation.
The Fixes ■ Security IG that leverages best practices for installation, confi guration, moni-
toring, testing, and auditing of cloud computing resources. ■ Requirements for monitoring the computing environment for any rogue
intrusions or misuse of cloud resources. ■ Control and verifi cation of access. Promote a more secure two-factor authen-
tication procedure. ■ Enforceable service-level agreements (SLAs) for patching software bugs,
addressing data breaches, and fi xing vulnerabilities. ■ An IG policy that requires regular audits and evaluations to detect weaknesses
in cloud security and confi guration.
Hacking, Hijacking, and Unauthorized Access
Hacking into accounts to assume the identity of an authorized user has been happen- ing almost since personal e-mail existed. It can be as simple as stealing passwords with a keystroke logger. Attack methods such as social engineering (e.g., phishing), fraud by identity theft, and exploitation of software vulnerabilities are still effective at com- promising systems. Most people recycle a few passwords and reuse them for multiple accounts, so once one is breached, criminals can gain access to additional accounts. If login credentials are compromised, a hacker can monitor nearly everything your or- ganization is doing: A less passive hacker might alter or destroy sensitive documents, create false information, or replace your links with fraudulent ones that direct users to sites harboring malware or phishing scams. Once they have control, it can look like your organization is the origin of the malicious downloads or information capture. From here, the attackers can assume the good name and reputation of an organization to further their attacks.
Cloud providers use virtualization heavily and hypervisors may allow intrusions.
296 INFORMATION GOVERNANCE
c15 296 March 8, 2014 5:17 PM
Examples ■ Examples are widespread in the general population; however, no clear instances
of this occurring with cloud services providers are known (as this book goes to press).
The Fixes ■ IG policies should clearly state that users and providers should never reveal
their account information to anyone. ■ An IG policy should require more secure two-factor authentication techniques
to verify login identity, where possible. ■ Require your cloud services provider to actively monitor and log all activity
in order to quickly identify users engaging in fraudulent actions or those that otherwise fail to comply with the client’s IG policy.
■ Understand, analyze, and evaluate the cloud provider’s contract, especially re- garding security protocols. Negotiate improved terms in SLAs to improve or enhance security and privacy.
Who Are Your Neighbors?
Knowing your neighbors—those who are sharing the same infrastructure with you—is also important, and, as we all know, good fences make good neighbors. If the cloud services provider will not or cannot be forthcoming about who else is sharing its infra- structure services with your organization and this becomes a signifi cant issue, you may want to insert contract language that forbids any direct competitor from sharing your servers. These types of terms are always diffi cult to verify and enforce, so moving to a private cloud architecture may be the best option.
Examples ■ The Internal Revenue Service (IRS) utilized Amazon’s Elastic Compute Cloud
service. When the IRS asked Amazon for a certifi cation and accreditation (C&A) report, Amazon declined. (Note: The C&A process was developed to help ensure compliance with NIST standards and mandated by the Offi ce of Management and Budget, which oversees Federal Information Security Man- agement Act of 2002 compliance.)
■ Heartland, a payment processing corporation, suffered a data breach in 2008. Hackers stole account details for over 100 million credit and debit cards. This data was stored on Heartland’s network, which the hackers broke into using information (pertaining to employees, corporate structure, company networks, and related systems) it had stolen in the weeks leading up to the major breach.
It is important to know what other clients are being hosted with your cloud services provider, as they may represent a threat. Moving to a private cloud architecture is a solution.
INFORMATION GOVERNANCE FOR CLOUD COMPUTING 297
c15 297 March 8, 2014 5:17 PM
The Fixes ■ An IG policy that requires full disclosure of activity and usage logs, and related
information. Audit the policy for compliance. ■ Investigate the architecture of your cloud services provider (e.g., version levels,
network OSs, fi rewalls, etc.). ■ Robust and vigilant supervision, logs, and reporting of all system activity,
particularly requesting expansive and detailed reports on the handling of sensi- tive information.
Additional IG Threats and Concerns
A primary selling point of cloud computing is that enterprises are freed up to focus on their core business rather than being focused on providing IT services. Modulating computer hardware and software resources without making capital expenditures is an- other key advantage. Both of these business benefi ts allow companies to invest more heavily in line-of-business activities and focus on their core products, services, and operations. However, the security risks must be weighed against the fi nancial and operational advantages. Further complicating things is the fact that cloud deployments often are enthusiastically driven by advocates who focus inordinately on potential ben- efi ts and do not factor in risk and security issues. Additional examples of IG concerns are listed next.
■ Lack of clarity about who owns the information (and if that changes at any point). ■ Risk of association with any larger failures of the cloud provider. ■ Inability of the cloud services provider to manage records at the fi le level. ■ Inability to closely follow the user’s retention schedule and produce certifi cates of
destruction at the end of the information life cycle. This may result in informa- tion that is held for too long and ends up costing the client unnecessary expense if it is deemed to be responsive to litigation or other legal action.
■ Lack of RM functionality in many cloud-based applications. This problem is not unique to cloud platforms, but the key difference is that internal storage resource systems may have functionality that supports integration with a RM solution. It is unlikely that a cloud provider will provide the option of integrat- ing your in-house RM system with its system. Too many potential security, access control, and performance issues may result.
■ Inability to implement legal holds when litigation is pending or anticipated.s ■ Poor response time—inability to deliver fi les quickly and in line with user expectations. ■ Limited ability to ensure your cloud provider meets your duties to follow regulations
related to the governance of your information . ■ Jurisdiction and political issues that may arise due to the fact that the cloud
provider resides outside of the client’s geographic region. ■ Storage of personally identifi able information (PII) on servers in Europe or
other locales that prohibit or restrict the release of PII back to the United States (or s home country of the cloud services client organization). 13
An analysis of an organization’s exposure to risk must include checking on software t versions and revision levels, overall security design, and general IG practices. This includes updating software, tools, and policy, as needed.
298 INFORMATION GOVERNANCE
c15 298 March 8, 2014 5:17 PM
Finally, for each of these challenges, “IG policies and controls to secure informa- tion assets” and “IG policies and controls to protect the most sensitive documents and data” are a key part of the solution.
Benefi ts of the Cloud
The risks and security vulnerabilities of cloud computing have been reviewed in this chapter—so much so that perhaps some readers wondering whether cloud computing really is worth it. The answer is a qualifi ed yes—it can be, based on your organization’s d business needs and computing resource capabilities. Besides the obvious benefi t of getting your company out of the IT infrastructure business and back to focusing on its real business goals, there are many benefi ts to be gained from cloud computing solutions.
Some of the specifi c benefi ts offered by cloud computing solution are listed next.
■ Cloud computing solutions provide a means to support bring-your-own-device (BYOD) initiatives. As long as users have an Internet browser and Internet connectivity, they can use any device to access an application deployed in the cloud.
■ Your workers need to be able to access corporate information via a mobile device. Some cloud solutions allow them to access information stored in a secure location that only requires a smart phone and a login. Some of these solutions can even ensure that the information is not actually stored on the device itself. Entire applications, such as expense reporting, can be deployed this way and incorporate mobile capture technology as well.
■ Cloud computing solutions provide a mechanism to support collaboration with external business partners. You need to exchange information with an outside business partner in a manner that e-mail just will not support. For instance, you want to create one copy of the information that anyone on your team or on a business partner’s team can access and that refl ects any updates or changes on an ongoing basis. Or you need to exchange fi les that are large or in a format that is prohibited by your e-mail servers. And you do not want to grant part- ners access to information within your fi rewall and they do not want to grant you access to information within theirs. A third-party cloud-based fi le-sharing solution may provide the answer. You can post fi les there, partners can access them, you can update them as necessary, and everyone always has access to the most current version of the information without compromising security to your network.
■ A cloud fi le storage solution provides a better alternative to remote infor- mation access than having users copy information to unsecured removable media or send an e-mail to their personal e-mail account. Again, it prevents duplication of information, provides access to the most current version of information, and stores information in an environment that only authenti- cated users can access.
■ Cloud computing solutions also can form a key part of your organization’s disaster recovery/business continuity strategy. If your data center is rendered inoperable, users still can access applications and information hosted by cloud
INFORMATION GOVERNANCE FOR CLOUD COMPUTING 299
c15 299 March 8, 2014 5:17 PM
providers. Most cloud providers have redundant data centers so that even if one of their data centers was affected by the same incident that rendered your data center inaccessible, all your information is available. Many organizations deploy solutions to back up their in-house applications to a cloud-based storage provider for just this reason. It is a way to provide geographic diversifi cation.
The business benefi ts of cloud computing may largely outweigh the security threats for the vast majority of enterprises, so long as they are anticipated and the preventive actions described are taken.
Managing Documents and Records in the Cloud
The National Archives and Records Administration has established guidelines for cre- ating standards and policies for managing an organization’s e-documents records that are created, used, or stored in cloud computing environments.
1. Include the Chief Records Management Offi cer and/or lead RM staff in the planning, development, deployment, and use of cloud computing solutions.
2. Defi ne which copy of records will be declared as the organization’s record copy and manage these in accordance with information governance poli- cies and regulations. . . . Remember, the value of records in the cloud may be greater than the value of any other set because of indexing or other reasons. In such instances, this added value may require designation of the copies as records.
3. Include instructions for determining if records in a cloud environment are covered under an existing records retention schedule.
4. Include instructions on how all records will be captured, managed, re- tained, made available to authorized users, and retention periods applied.
5. Include instructions on conducting a records analysis, developing and sub- mitting records retention schedules to an organization’s central records department for unscheduled records in a cloud environment. These instructions should include scheduling system documentation, metadata, and related records.
6. Include instructions to periodically test transfers of records to other environments, including departmental servers, to ensure the records remain portable.
7. Include instructions on how data will be migrated to new formats, operating systems, etc., so that records are readable throughout their entire life cycles. Include in your migration planning provisions for transferring permanent records in the cloud to central records.
8. Resolve portability and accessibility issues through good records man- agement policies and other data governance practices. Data governance typically addresses interoperability of computing systems, portability of data (able to move from one system to another), and information security
300 INFORMATION GOVERNANCE
c15 300 March 8, 2014 5:17 PM
and access. However, such policies by themselves will not address an organization’s compliance and information governance demands and requirements.14
IG Guidelines for Cloud Computing Solutions
A set of guidelines aimed at helping you leverage cloud computing in a way that meets your business objectives without compromising your IG profi le is presented next.
1. As with any technology implementation, it is critical that you defi ne your business objectives fi rst, then select the provider that best meets your busi- ness objectives—provided, of course, it can meet your IG requirements. This is consistent with applying a proven IT project management methodology to the initiative. Even though the solution may reside outside your environment, the same basic phases for your project approach still apply, especially for those tasks related to documentation.
2. As part of the project documentation, make sure to identify roles and respon- sibilities related to the system in at least the same level of detail you do fort internally supported systems (preferably in more detail).
3. The biggest deviation from your standard approach is the need to incorporate the investigation and application of the appropriate fi xes described in the “Se- curity Threats with Cloud Computing” section into your project plan. Again, as with any service contract, it is helpful to involve a good contract negotiator. The contract negotiation phase is when you have the most infl uence with your provider. Therefore, you have the greatest chance of mitigating potential risks and optimizing the benefi ts if you can incorporate specifi c requirements into the contract language.
4. If the cloud computing paradigm is relatively new to your organization, try to fi gure out approaches to issues and high-level processes that can be reused in subsequent cloud computing projects. For instance, during the course of your project, you need to fi gure out:
■ How to migrate information, including metadata, to the cloud solution. ■ How to get your information, including metadata, back if you quit using
that solution. ■ How to implement a legal hold.
Utilizing cloud computing resources provides an economic way to scale IT resources which allows more focus on core business operations. It can render signifi cant business benefi ts, but its risks must be carefully weighed, and specifi c threats must be coun- tered, in the context of a long-range cloud deployment plan.
Most cloud services providers do not have mass content migration or RM capabilities.
INFORMATION GOVERNANCE FOR CLOUD COMPUTING 301
c15 301 March 8, 2014 5:17 PM
Notes
1. Cloud Security Alliance, “Top Threats to Cloud Computing V1.0,” March 2010, https://cloudsecurity- alliance.org/topthreats/csathreats.v1.0.pdf , p. 6.
2. R. “Ray” Wang, “Tuesday’s Tip: Understanding the Many Flavors of Cloud Computing and SaaS,” March 22, 2010, http://blog.softwareinsider.org/2010/03/22/tuesdays-tip-understanding-the-many- fl avors-of-cloud-computing-and-saas/ .
3. NARA Bulletin 2010-05, “Guidance on Managing Records in Cloud Computing Environments,” September 8, 2010, www.archives.gov/records-mgmt/bulletins/2010/2010-05.html .
4. Peter Mell and Tim Grance, “NIST Defi nition of Cloud Computing,” Version 15, 10-07-09, www.nist .gov/itl/cloud/upload/cloud-def-v15.pdf (accessed December 12, 2013).
5. Knorr and Gruman, “What Cloud Computing Really Means.” 6. Ibid. 7. Mell and Grance, “NIST Defi nition of Cloud Computing.” 8. Gartner Press Release, “Gartner Says Worldwide Public Cloud Services Market to Total $131 Billion,”
February 28, 2013, www.gartner.com/newsroom/id/2352816 (accessed October 11, 2013). 9. This and the next quotes in this section are from Louis Columbus, “451 Research: Cloud-Enabling
■ Cloud computing represents a paradigm shift in computing capabilities. It can streamline operations and cut costs but because it also has inherent risks, a well-researched and documented IG policy is needed.
■ Organizations need to understand cloud computing’s security risks and for- mulate IG policies and controls before deploying it.
■ Organizations are rapidly moving applications and storage to the cloud. Cloud computing allows users to access and use shared data and computing services via the Internet or a VPN.
■ Five key characteristics of cloud computing are: (1) on-demand self-service, (2) broad network access, (3) resource pooling, (4) rapid elasticity, and (5) measured service.
■ Cloud computing services typically are deployed using one of four models: (1) private cloud, (2) public cloud, (3) community cloud, and (4) hybrid cloud.
■ Utilizing cloud computing carries signifi cant security risks, which can be off- set by establishing IG policies and preventive measures so that the business benefi ts of agility and reduced cost may be exploited.
■ Cloud application services may have weaknesses related to supporting RM functions, such as: the inability to manage records at the fi le level; the inabil- ity to closely follow the user’s RM retention schedule, the inability to migrate data and documents to other platforms for preservation, and the inability to enforce legal holds when litigation is pending or anticipated.
CHAPTER SUMMARY: KEY POINTS
302 INFORMATION GOVERNANCE
c15 302 March 8, 2014 5:17 PM
Technologies Revenue Will Reach $22.6B by 2016,” September 26, 2013, http://softwarestrategies- blog.com/2013/09/26/451-research-cloud-enabling-technologies-revenue-will-reach-22-6b-by-2016/ (accessed October 11, 2013).
10. It’s a long-running trend with a far-out horizon. But among big metatrends, cloud computing is the hardest one to argue with in the long term. (emphasis added).
11. All defi nitions are from Mell and Grance, “NIST Defi nition of Cloud Computing.” 12. Cloud Security Alliance, “Top Threats to Cloud Computing V1.0.” 13. Gordon E. J. Hoke, CRM, e-mail to author, June 10, 2012. 14. NARA Bulletin 2010-05, “Guidance on Managing Records in Cloud Computing Environments.”
303
c16 303 February 28, 2014 1:22 PM
SharePoint® Information Governance*
C H A P T E R 16
By Monica Crocker, CRM, PMP, CIP, edited by Robert Smallwood
* Portions of this chapter are adapted from Chapter 14 , Robert F. Smallwood, Managing Electronic Records: Methods, Best Practices, and Technologies , © John Wiley & Sons, Inc., 2013. Reproduced with permission of John Wiley & Sons, Inc.s
M icrosoft’s SharePoint® server product dramatically altered the content and records management (RM) markets. Previous to SharePoint, solutions were somewhat cumbersome, managed large quantities of documents, and required
extensive implementation effort for each business application. SharePoint provided an enterprise level platform for the remaining small-volume, ad hoc solutions.
At a basic level, it is a collaboration platform, but it is often leveraged to be a con- tent repository as well. If properly implemented, SharePoint can reduce duplication of information, automate business processes, serve up a common lexicon for categorizing information, provide a social media platform, give users access to current and histori- cal e-documents, dramatically reduce network traffi c loads (by cutting the number of e-mails with attachments), and stop the growth of shared drives. It can also provide a secure platform to support bring-your-own-device (BYOD) mobile programs and other mobile solutions.
Given all its stated capabilities, SharePoint can be used to help organizations govern their information. But, in order to achieve those benefi ts, the implementing organization must take a structured approach to the deployment of its SharePoint environment. The 2006 amendment to the U.S. Federal Rules of Civil Procedure re- quire American organizations to produce any and all “electronically stored information that is relevant, not privileged, and reasonably accessible.” Similar legal requirements exist in Canada, the United Kingdom and Europe, Australia, and other developed countries. Information stored in SharePoint often is included in the “relevant” infor- mation that must be produced. So SharePoint should be deployed in a manner that makes all information contained within it fi ndable, accessible, securable by a legal hold notifi cation (LHN) and available for production in a timely manner.r
For SharePoint deployments, an ounce of prevention truly is worth a pound of cure. Since every SharePoint environment includes corporate information, organiza- tions can avoid a lot of headaches and future information governance (IG) risks if they invest time and deliberation in planning how they will deploy SharePoint. Theseg plans should be based on the business objectives for SharePoint that are tied to the
Information Governance: Concepts, Strategies and Best Practices By Robert F. Smallwood Copyright © 2014 by Robert F. Smallwood
304 INFORMATION GOVERNANCE
c16 304 February 28, 2014 1:22 PM
organization’s overall business objectives and include making all the necessary IG policy decisions before rolling out the solution to users.
SharePoint itself is a tool; it is not a panacea for poor IG, and simply deploying it will not resolve business issues or compliance problems. When it comes to managing business records, “Like any RM solution, SharePoint alone will not solve your needs unless it is used to support clearly defi ned [business] processes.”1 Therefore, IG policy development and business process analysis are critical in the planning process.
SharePoint often is expected to perform content management and records man- agement, and also support e-discovery requests and legal holds. But sometimes, instead of solving records and IG problems, they become worse in an ungoverned SharePoint environment, since users often:
■ Do not understand which SharePoint content (documents, discussions, announcements, lists) should be managed as a record.
■ Are not clear on when or how to declare content a business record (and as a result make either everything a record or nothing a record).
■ Simply replicate their existing fi le share folder structure, creating a new (often redundant) set of disorganized documents on SharePoint.
■ Do not know how to attach well-defi ned metadata to information to make it fi ndable in the long term.
■ Do not understand how to apply appropriate security restrictions to information.
The unacceptable result of this lack of governance is that, instead of being a plat- form that can positively transform business processes, SharePoint actually can make it more diffi cult for people to do their jobs. And if users decide that SharePoint is actually t making their work harder, they will begin to revert back to old, familiar (disorganized) ways of managing their information. In other words, they may continue to keep du- plicate documents on their local C drives, go back to their existing shared drives, and keep sharing information by attaching documents to e-mails.
The SharePoint governance model should make it clear where and how users should both store and fi nd information. A well-governed SharePoint environment pro- vides enough consistency in how information is categorized to support sorting and fi ltering of search results so that users can quickly narrow results to the specifi c infor- mation or documents they need.
But keep in mind that a SharePoint governance model needs to be tailored to your organization. It will not work if it does not fi t with your culture, technology standards, and staffi ng resources.
There is no such thing as one set of SharePoint governance best practices that every orga- nization can adopt. Rather, developing a SharePoint governance model involves deter- mining the appropriate answer to a series of questions regarding your organization’s business goals, resource limitations and policy constraints. Once the initial plan is de- veloped, it should be validated against a broad sample of use cases for the system.
Process Change, People Change
As with any initiative that requires behavior change or additional effort, you will encounter resistance. The nature of the resistance will depend on the culture of your organization and the personalities of the individuals involved. Some of the
SHAREPOINT INFORMATION GOVERNANCE 305
c16 305 February 28, 2014 1:22 PM
SharePoint-specifi c objections you should be prepared to counter include the prem- ise that nothing in SharePoint is a record or that the very nature of SharePoint dictates that it should just be turned on and allowed to spread virally. Others are that “Users won’t follow those procedures” and “Governance is too much of a burden to the user.” And then, of course, there is all the standard user resistance to any system change implementation.
Too many organizations deploy SharePoint without putting the necessary effort t into planning how this technology tool will be governed. The result is similar to what is often found with e-mail or network shared drives —scattered information and docu-ss ments with no organization or governing policies. Only the situation is worse , because SharePoint has more types of content and quickly collects an even greater volume of information. At the highest level, all these types of content are part of SharePoint: sites, pages, libraries, and lists. And there are many subtypes within each of these content types. For instance, the list content type includes announcements, calendars, contacts, tasks, discussions, issues, surveys, and custom lists. And the site content type includes “MySites,” which allows users to store a vast array of content, including their own documents (which could be personal and/or work related) and social content, such as tags and ratings of content on other sites.
Another contributing risk factor for SharePoint is that, to a large degree, it is self- provisioned. This means that, while the environment typically is deployed by central information technology (IT) staff, business users usually are given the authority to cre- ate new repositories for information within that environment without IT intervention. This allows SharePoint to function as a dynamic collaboration platform.
Because of its nature, in an ungoverned SharePoint environment, you may have:
■ Information chaos because there is no way to identify who owns specifi c informa-s tion, no context for information, and no consistent organization or hierarchy to information.
■ Orphaned information , which results when the individual who understood the context of the information leaves the organization or when the site, page, list, or library is no longer in use.
■ Redundant information. If no one knows who should put what on SharePoint, t multiple users may upload the same new document to a dozen different loca- tions, and users have no way to identify the “authentic” version of a piece of information when multiples are found.
■ Unfi ndable information , which results when everyone decides for themselves how to secure a given piece of information and if and how to tag it with metadata. Then no one can fi nd anything outside the sphere of the information they con- trol or know if they have found everything in a search.
■ Noncompliant retention. The organization cannot apply any records retention periods to information if there is no means to determine which records series applies to specifi c information.
As with any initiative that requires behavior change or additional effort, you will encounter resistance when implementing a new SharePoint system.
306 INFORMATION GOVERNANCE
c16 306 February 28, 2014 1:22 PM
■ E-discovery risk. Ungoverned information limits the means to narrow the list of potentially responsive information, requiring the organization to fi nd and review a lot of information in response to an e-discovery request. t
■ Inappropriate use. Lack of governance means the organization is at risk from individuals or teams deciding to use SharePoint in a way that may not be ap- propriate or legally defensible.
In sum, lack of governance can signifi cantly diminish the business value and increase the risk of your SharePoint deployment.
This is more than a mess. It is a costly mess, because the organization is not achiev- ing the maximum business benefi t from SharePoint. Further, retrieving information during e-discovery for legal proceedings will be fraught with search and retrieval chal- lenges and will be more costly and less effi cient.
However, even if you have already started your SharePoint project or need to deploy before you feel your governance model is complete, you still can implement some IG strategies. That is, late is better than never, and gradual implementation of governance is better than none at all.
Where to Begin the Planning Process
As with any well-managed project, the fi rst step in a SharePoint deployment is to draft a project charter that defi nes the scope, budget, timeline, and business objectivesr for your s SharePoint environment.
The next step is to draft a project schedule that includes copious amounts of s time for the up-front planning effort necessary to create the SharePoint Governance Model. Have the project executive sponsor sign off on this timeline so that he orr she understands that the project will include time to think through key issues prior to deployment and why that is critical for your organization.
Then assemble your governance team. Include someone who understands the organization’s culture and the business objectives for SharePoint (such as a business analyst), someone who understands the technical aspects of SharePoint (like a system administrator), someone who understands the compliance aspects of SharePoint (such as a compliance offi cer, records manager, or legal counsel), and someone who can help
Lack of governance can signifi cantly diminish the business value and increase the risk of your SharePoint deployment.
Critical to success in SharePoint deployments is consulting with users about their processes and needs.
SHAREPOINT INFORMATION GOVERNANCE 307
c16 307 February 28, 2014 1:22 PM
implement the training and communications plan (perhaps from the human resources department). And, most important, make sure your governance team has the necessary authority level to determine the governance approach.
The SharePoint governance model planning process necessarily involves consulting with users about their collaboration, business process, document usage, and information s storage needs. If the governance structure interferes with their ability to do their jobs, users will start creating and storing documents without knowing what rules to follow, or why the rules exist, and they will fi nd their own work-arounds to satisfy their busi- ness requirements. For instance, if you restrict fi le size requirements too much, users still will store large fi les somewhere—perhaps unsecured in the cloud. If you do not allow certain fi le types and users need them, they will fi nd another place to store them where they might be diffi cult for other users to fi nd. And soon you will have all sorts of variations of folder and fi le systems and scattered documents and information, which results in the aforementioned information chaos scenario.
Regulatory and compliance factors also must be incorporated into SharePoint governance decisions for most organizations. Therefore, the process must include RM staff for guidance on crucial RM issues and legal staff for legal and compliance requirements.
Finally, create a formal SharePoint governance model “document.” Do not rely on meeting notes or design documents to refl ect the decisions made during governance discussions, though it may be valuable to keep those as a way to retain the reasoning and decision paths that led to the fi nal model. Governance decisions can be controversial, so the governance model selected should be explicitly stated in a dedicated document and offi cially “approved” by the appropriate stakeholders.
Begin at a High Level
Start from a high level, with strategy and corporate governance issues. Develop a problem statement in your project charter so that you know what you are trying to accomplish, and then develop measureable, time-constrained business objectives so progress and success toward milestones can be measured. Next, be sure to align these objectives with your organization’s overall vision statement or strategic plan. Aligning the technology with business considerations is key to a successful SharePoint deployment.
Governance decisions can be very controversial and require documentation.
First, develop a problem statement and formulate business objectives for the SharePoint deployment. Then align those objectives with your overall Strategic Plan.
308 INFORMATION GOVERNANCE
c16 308 February 28, 2014 1:22 PM
In order to identify specifi c business objectives for SharePoint, you may fi nd it useful to conduct some focus group sessions with thought leaders from across the organization. Some examples of questions you might ask are listed next:
■ How do you fi nd information owned by your unit? ■ How do you share information within your team? ■ How do you fi nd information owned by other units? ■ How do you share information with other teams? ■ How do you fi nd expertise to assemble a project team? ■ How do you fi nd expertise to perform a single task? ■ How do you exchange information with external business partners? ■ What processes are particularly painful? ■ How comfortable would you be sharing information with others in your unit?
With others outside your unit? ■ How would you like to connect with others in your organization?
Look for these themes in survey responses that might apply to your organization:
■ It is diffi cult to fi nd information without prior knowledge of its existence and location.
■ It is diffi cult to fi nd personnel resources with specifi c expertise (a subject matter expert ). t
■ It is diffi cult to determine whether a given piece of information is the current version.
■ The organization relies heavily on e-mail to create, share, and manage informa- tion. Therefore, the effort spent managing e-mail is burdensome.
■ Most document creation processes included review and approval steps among multiple users, which slow down critical business processes.
■ Users are struggling to fi nd a way to communicate outside their immediate work group, but they have strong motivation to do so.
■ It takes too long to onboard a new employee. ■ Users want solutions that provide seamless access for remote workers.
Understanding the organization’s current information management challenges al- lows the SharePoint governance team to identify business objectives for SharePoint and ensure that each individual governance decision supports accomplishment of the business objectives while at the same time supporting compliance with IG policy.
Once business objectives are formed, use them to defi ne the guiding principles for the SharePoint governance model. It is prudent to lay out the guiding principles early in the governance document, since they provide a framework for everything that follows. Decision categories that can help shape the guiding principles are:
■ Required or optional. Is this governance model a “mandated” approach or just “recommendations”? The answer must be clear to users, and enforcement ac- tions against violations must be taken if governance is mandated.
■ Appropriate use. What are the rules for SharePoint usage? For instance, you could declare that SharePoint is for business information only so that users know it is not OK to run their fantasy football league on a SharePoint site.
SHAREPOINT INFORMATION GOVERNANCE 309
c16 309 February 28, 2014 1:22 PM
■ Information access policy. Clarify your organization’s philosophy about access to information; is it open to every authenticated user by default, or is it strictly se- cured and available on a need-to-know basis only? As a compromise, sites could be open to all by default, with secured information as an exception.
■ Accountability. Who is accountable for information and managing governance at a site level?
■ Level of control. Clarify how tightly SharePoint will be managed. This might range from rigid control, where a typical user can publish only information that has gone through a review process; to “semicontrolled,” which permits superusers to create libraries and lists; to very loosely controlled, where site owners in the business are given complete site collections to manage according to their needs.
■ Information ownership. Since users come and go and site administrators are very often administrative staff with little authority, information ownership must be clearly defi ned (e.g., the responsibility of the manager or director of a business unit).
Each of these guiding principles should be linked to any appropriate organiza- tional policy or applicable law. In addition, they all should be linked to the business objectives for SharePoint. For instance, this could be a guiding principle:
Every site and page in SharePoint must have a clearly identifi ed owner and a backup owner.
This sets a standard for the project team to follow, which helps end users identify the authoritative copy of information and addresses the governance issue regarding orphaned content.
Establish Scope
After business objectives are formed and sharpened and guiding principles are es- tablished, determine the scope of the SharePoint deployment: Just where are the boundaries of information you are going to govern? Any governance model likely will cover sites and pages and documents. But will it also include specifi c types of content, such as calendar items, announcements, discussions, and lists? Which spe- cifi c documents will be governed in SharePoint (all/only those declared “records”/ only those that are fl agged as “fi nal”)? How will documents be managed in the different stages of their life cycle (delete anything that has not been modifi ed for a year/move anything declared fi nal to an archive)? How will your organization address e-discovery requirements? Which document and content types are not governed in SharePoint? For instance, some organizations govern down to the
Once business objectives are formed, use them to defi ne the guiding principles for the SharePoint governance model.
310 INFORMATION GOVERNANCE
c16 310 February 28, 2014 1:22 PM
“X” level (e.g., three levels deep in the site structure) but not below. Some choose to manage content on MySites while others simply impose a storage size limit on MySites.
These are the types of questions you should be asking, not only from an IG perspective but also to optimize future system performance of SharePoint. Better processes and fewer documents means faster performance when you are in the heat of the business battle.
Your governance model needs to address the two issues related to scope:
1. Describe the scope of SharePoint as a technology solution. In terms of the scope of SharePoint itself, document whether it is purely for internal use or whether it also includes external access, whether MySites are deployed, and which existing systems it was designed to replace, if applicable. Add any other information you can about what is included when you refer to “the SharePoint solution” in your organization, such as interfaces with other systems
2. Defi ne the scope of the governance model. In your description of the scope of the governance model, you should enumerate whether governance applies to all types of sites, all types of content, all users, or some subset of those; and who has the authority to change the scope of SharePoint governance.
Exactly what information will be stored and managed in SharePoint? And, of that,t which information or documents rise to the level of being records?
The selection criteria for storing information in SharePoint must be clear to all system us- ers and administrators. They need to know not only what fi le sizes are allowed but also what fi le formats are permitted—or prohibited—as well as size limits for lists, libraries, and the entire site itself.
Policy Considerations
You must determine how your organization’s IG policies relate to SharePoint. Micro- soft has structured SharePoint so that every piece of information is a “content type.” In addition, the tool allows you to confi gure RM policies/actions at various levels in the system; you can set them at a site collection level, a site level, a library or list level, or all the way down to the specifi c item level. Every particular instance of every content type could have a retention schedule and resulting actions associated with it, but that might be a lot of overhead for very little payback. What do you manage and what do you not manage? Examples of things you might not manage are work fl ow confi gurations, t views, searches, and page templates. Examples of things you probably want to manage are documents and lists.
Be sure to clearly state the selection criteria for storing information in SharePoint.
SHAREPOINT INFORMATION GOVERNANCE 311
c16 311 February 28, 2014 1:22 PM
Your IG policy section should answer these questions:
■ How is each type of content in SharePoint governed? ■ Who decides what gets governed? ■ At what point in the information’s SharePoint existence is a governance action
taken?
Any existing retention schedules must be translated into defensible disposition policies within your SharePoint environment. Finally, specifi c processes for managing business records must be established. s
For instance, if your SharePoint charter identifi ed “sharing administrative in- formation such as meeting agendas and minutes” as a primary objective of your deployment, you could create standard libraries for “administrative” documents on each division’s site, create an “administrative record” content type to categorize any document in that library, and associate the retention policy for that content to all those documents. This method would automate the purging of all administrative documents after the retention period has expired.
At some point in the SharePoint governance model document, you also need to address if and how you going to use document IDs and how major and minor versions of information are used and retained. For example, you could decide not to keep any previous versions of meeting agendas but to keep previous versions of policies for a number of years after they are superseded with new versions. The IG policy section is a good place for those items.
Roles and Responsibilities
Clear roles and their associated responsibilities for contributing to, maintaining, and utilizing the information in SharePoint must be established during the governance planning process. Only by spelling out who is responsible for what are you able to expect that your SharePoint environment will continue to follow the governance model.
Questions to ask with regard to defi nition of roles and responsibilities include these:
■ Who is the executive sponsor for the solution? ■ Who “owns” the system (and what does “ownership” entail)? ■ Who is the sponsor/steward for a specifi c site or site collection? ■ Who owns the information in the site? ■ Who is responsible for completing the initial deployment of a site or collection? ■ Who is responsible for day-to-day administration of the site? ■ Who defi nes and sets up various information architecture components, such as
content types, columns (metadata), and the term store (enterprise taxonomy)? ■ Who is responsible for controlling access to a site? For making changes to
security access as users’ roles change or as users are terminated? ■ Who will train super users and users initially? On an ongoing basis? ■ Who will contribute information? ■ Who will be allowed to view and/or edit information?
312 INFORMATION GOVERNANCE
c16 312 February 28, 2014 1:22 PM
Some examples of possible SharePoint roles within a given organization are listed next.
■ Executive sponsor ■ Information owner or “steward” for a site or site collection ■ Site owner ■ Site member ■ Site contributor ■ Site visitor ■ System administrator ■ Site collection administrator ■ Business analyst ■ Training, education, and user support ■ Information architect/taxonomist ■ IG representative
The roles and responsibilities section of the SharePoint governance model will need to describe how users can request a site and how they get support for their sites, including the support escalation process. For this purpose, a service-level agreement (SLA) that outlines the basic support levels, time frames, problem escalation processes, cost allocations, and other issues related to service is useful. Wherever possible, create an SLA and refer to it so that users have clear expectations regarding how long it will take them to get a new site or get support for an existing site.
Establish Processes
Guiding principles provide the “what” of SharePoint governance. Roles and responsibili- ties defi ne the “who.” The governance model, or a separate set of procedures referenced by the model, also needs to describe the “how” of governance. Most important, it should detail the process of requesting and creating SharePoint sites. Also critical, the model must include a process for decommissioning sites. Further, as the ownership of the site may change in the future, the process of transferring site ownership must be established and standardized. In addition, more specifi c processes, such as those for migrating information into SharePoint, must be created. If a business record is created, you need a process to manage it accordingly, whether that is by sending it to a central records repository to com- plete its life cycle or by managing it in the library where it originated. When legal holds are required, standard processes must be established to produce information requested dur- ing e-discovery. A demonstrated ability to produce trustworthy information—information that can be proven to be authentic and unaltered—is an absolute requirement. All these processes must be designed to be as effi cient and low cost as possible.
While guiding principles provide the “what” of SharePoint Governance, roles and responsibilities provide the “who”—that is, who can store information, access it, and make changes to the system.
SHAREPOINT INFORMATION GOVERNANCE 313
c16 313 February 28, 2014 1:22 PM
Training Plan
A well-defi ned training model as part of your SharePoint governance plan shows that your organization gave users the rules about SharePoint usage and the necessary tools to comply with those rules.
The training section of your SharePoint governance model should break down the overall training strategy: train everyone, just train site owners, or simply refer users to training resources. This section should explain the process for requesting training. It also should describe or include a reference to a detailed training plan. The train- ing plan describes the ways training will be delivered and how training content will be created. It should include a level of detail suffi cient to identify the different types of training (site owner training, information custodian training, user training, basic training, advanced training, etc.). As you defi ne the training plan, remember that any given individual may fi ll more than one role; one person might be an owner on one site, a contributor on another, and a reader on many. So the training plan should allow people to get all the training they need, without having to endure the same training modules (such as “Introduction to Our SharePoint environment”) multiple times.
An important training consideration is that SharePoint is a popular technol- ogy right now, and individuals with SharePoint skills are hot commodities in the marketplace. Therefore, in order to eliminate any single points of failure in your SharePoint roles, make sure to cross-train key roles to ensure that more than one person can perform critical functions.
Communication Plan
Your communication plan for SharePoint governance needs to take into account that you are asking people to change the fundamental way in which they manage much of the core information they use to do their work. So your communication plan needs to clearly state that the proposed SharePoint governance model:
■ Is good for the organization as a whole, not just for IT or the compliance offi ce. d ■ Makes it easier for team members to manage and fi nd the information they
need to do their jobs.
Your training plan needs to recognize that a given individual may fi ll more than one role on different SharePoint sites.
Your communication plan needs to recognize that you are asking people to change the fundamental way they access and manage documents.
314 INFORMATION GOVERNANCE
c16 314 February 28, 2014 1:22 PM
An understanding of the SharePoint governance model should make it clear to users what the organization intends to do with SharePoint: the business drivers behind the deployment. It also should be very clear what users are expected to do and the training they will receive so that they can work well in the SharePoint environment. Every person assigned a SharePoint role should be able to review the communications regarding governance and understand how, exactly, it will impact them.
Note
1. Don Lueders, “It’s All About the Processes,” June 18, 2009, http://sharepointrecordsmanagement. com/2009/06/18/its-all-about-the-processes/ .
■ As with any initiative that requires behavior or attitude change, you will en- counter resistance when implementing IG within SharePoint.
■ Lack of governance can signifi cantly diminish the business value and increase the risk of your SharePoint deployment.
■ Critical to success in most SharePoint deployments is an understanding of the business objectives for the solution and how those map to the organization’s strategic plan.
■ Your SharePoint governance model needs to be tailored to your organization.
■ Governance decisions can be very controversial and require documentation.
■ First, develop a problem statement and formulate business objectives for the SharePoint deployment. Then align those objectives with your overall strate- gic plan.
■ Once business objectives are formed, use them to defi ne the guiding prin- ciples for the SharePoint governance model.
■ While guiding principles provide the “what” of SharePoint governance, roles and responsibilities provide the “who”—that is, who can store information, access it, and make changes to the system.
■ Be sure to clearly state the selection criteria for storing information in Share- Point.
■ Your communication plan needs to consider that you are asking people to change the fundamental way they access, share and manage documents.
■ A well-designed SharePoint governance model can help your organization achieve its IG objectives and can contribute to the achievement of business objectives.
CHAPTER SUMMARY: KEY POINTS
c17 315 March 6, 2014 3:01 PM
PA RT F I V E Long-Term Program Issues
317
c17 317 March 6, 2014 3:01 PM
C H A P T E R 17 Long-Term Digital Preservation*
* Portions of this chapter are adapted from Chapter 17 , Robert F. Smallwood, Managing Electronic Records: Methods, Best Practices, and Technologies , © John Wiley & Sons, Inc., 2013. Reproduced with permission of John Wiley & Sons, Inc.s
By Charles M. Dollar and Lori J. Ashley
E very organization—public, private, or not for profi t—now has electronic records and digital content that it wants to access and retain for periods in excess of 10 years. This may be due to regulatory or legal reasons, a desire to preserve
organizational memory and history, or entirely by operational reasons. But long-term continuity of digital information does not happen by accident— it takes information gover-— nance (IG), planning, sustainable resources, and a keen awareness of the information technology (IT) and fi le formats in use by the organization, as well as evolving stan- dards and computing trends.
Defi ning Long-Term Digital Preservation
Information is universally recognized as a key asset that is essential to organizational success. Digital information, which relies on complex computing platforms and net- works, is created, received, and used daily to deliver services to citizens, consumers and customers, businesses, and government agencies. Organizations face tremendous challenges in the 21st century to manage, preserve, and provide access to electronic records for as long as they are needed.
Digital preservation is defi ned as long-term, error-free storage of digital infor- mation, with means for retrieval and interpretation, for the entire time span the information is required to be retained. Digital preservation applies to content that is born digital as well as content that is converted to digital form.
Some digital information assets must be preserved permanently as part of an organiza- tion’s documentary heritage. Dedicated repositories for historical and cultural memory, such as libraries, archives, and museums, need to move forward to put in place trust- worthy digital repositories that can match the security, environmental controls, and wealth of descriptive metadata that these institutions have created for analog assets (such as books and paper records). Digital challenges associated with records manage- ment affect all sectors of society—academic, government, private and not-for-profi t enterprises—and ultimately all citizens of all developed nations.
Information Governance: Concepts, Strategies and Best Practices By Robert F. Smallwood Copyright © 2014 by Robert F. Smallwood
318 INFORMATION GOVERNANCE
c17 318 March 6, 2014 3:01 PM
The term “preservation” implies permanence, but it has been found that elec- tronic records, data, and information that is retained for only 5 to 10 years is likely to face challenges related to storage media failure and computer hardware/software obsolescence. A useful point of reference for the defi nition of “long term” comes from the International Organization for Standardization (ISO) standard 14721, which de- fi nes long-term as “long enough to be concerned with the impacts of changing tech- nologies, including support for new media and data formats, or with a changing user community. Long Term may extend indefi nitely.” 1
Long-term records are common in many different sectors, including govern- ment, health care, energy, utilities, engineering and architecture, construction, and manufacturing. During the course of routine business, thousands or millions of elec- tronic records are generated in a wide variety of information systems. Most records are useful for only a short period of time (up to seven years), but some may need to be retained for long periods or permanently. For those records, organizations must plan for and allocate resources for preservation efforts to ensure that the data remains acces- sible, usable, understandable, and trustworthy over time.
In addition, there may be the requirement to retain the metadata associated with records even longer than the records themselves.2 A record may have been destroyed according to its scheduled disposition at the end of its life cycle, but the organization still may need its metadata to identify the record, its life cycle dates, and the authority or person who authorized its destruction.
Key Factors in Long-Term Digital Preservation
Some electronic records must be preserved, protected, and monitored over long pe- riods of time to ensure they remain authentic, complete, and unaltered and available into the future. Planning for the proper care of these records is a component of an overall records management program and should be integrated into the organization’s information governance (IG) policies and technology portfolio as well as its privacy and security protocols.
Digital preservation is defi ned as long-term, error-free storage of digital infor- mation, with means for retrieval and interpretation, for the entire time span that the information is required to be retained.
Total capability for properly ensuring access to authentic electronic records over time, (in addition to the challenges of technological obsolescence), is a sophisticated combination of policies, strategies, processes, specialized re- sources, and adoption of standards.
LONG-TERM DIGITAL PRESERVATION 319
c17 319 March 6, 2014 3:01 PM
Enterprise strategies for sustainable and trustworthy digital preservation reposi- tories have to take into account several prevailing and compound conditions: the complexity of electronic records, decentralization of the computing environment, obsolescence and aging of storage media, massive volumes of electronic records, and software and hardware dependencies.
The challenges of managing electronic records signifi cantly increased with the trend of decentralization of the computing environment. In the centralized environ- ment of a mainframe computer, prevalent from the 1960s to 1980s but also in use today, it is relatively easy to identify, assess, and manage electronic records. This is not the case in the decentralized environment of specialized business applications and of- fi ce automation systems, where each user creates electronic objects that may constitute a formal record and thus will have to be preserved under IG polices that address record retention and disposition rules, processes, and accountability.
Electronic records have evolved from simple text-based word processing fi les or reports to include complex mixed media digital objects that may contain embedded images (still and animated), drawings, sounds, hyperlinks, or spreadsheets with compu- tational formulas. Some portions of electronic records, such as the content of dynamic Web pages, are created on demand from databases and exist only for the duration of the viewing session. Other digital objects, such as electronic mail, may contain mul- tiple attachments, and they may be threaded (i.e., related e-mail messages linked in send-reply chains). These records cannot be converted to paper or text formats for preservation without the loss of context, functionality, and metadata.
Electronic records are being created at rates that pose signifi cant threats to our ability to organize, control, and make them accessible for as long as they are needed. This continued volume increase includes documents that are digitally scanned or imaged from a vari- ety of formats to be stored as electronic records.
Electronic records are stored as representations of bits—1s and 0s—and therefore depend on software applications and hardware networks for the entire period of retention, whether it is 3 days, 3 years, or 30 years or longer. As information technologies become obsolete and are replaced by new generations, the capability of a specifi c software application to read the representations of 1s and 0s and render them into human- understandable form will degrade to the point that the records are neither readable nor understandable. As a practical matter, this means that the readability and understandability of the records can never be recovered, and there can be serious legal consequences.
Most records are useful for only a short period of time, but some may need to be retained for long periods or permanently.
Electronic records are being created at rates that pose signifi cant threats to our ability to organize, control, and make them accessible for as long as they are needed.
320 INFORMATION GOVERNANCE
c17 320 March 6, 2014 3:01 PM
Storage media are affected by the dual problems of obsolescence and decay. They are fragile, have limited shelf life, and become obsolete in a matter of a few years. Mitigating media obsolescence is critical to long-term digital preservation (LTDP) because the bitstreams of 1s and 0s that comprise electronic records must be kept “alive” through periodic transfer to new storage media.
In addition to these current conditions associated with technology and records management, organizations face tremendous internal change management challenges t with regard to reallocation of resources, business process improvements, collaboration and coordination between business areas, accountability, and the dynamic integration of evolving recordkeeping requirements. Building and sustaining the capability to manage digital information over long periods of time is a shared responsibility of all stakeholders.
Threats to Preserving Records
A number of known threats may degrade or destroy electronic records and data:
■ Failure of storage media. Storage media is inherently vulnerable to errors and malfunction, including disk crashes. Solid-state drives (SSD) largely address these concerns, as there are no moving parts and data can be stored without needing electrical power.
■ Failure of computer systems. Computer hardware has moving parts and circuits that deteriorate and fail over time, at an average rate called mean time between failure. Some failures are complete and irrecoverable, and some are minor and can be fi xed with no loss of data. Computer software is prone to bugs and mal- ware that can compromise the safekeeping of data.
■ Systems and network communications failures. A small number of network commu- nications is likely to contain errors or misreads, especially undetected check- sum errors, which may impact the authenticity of a record. Network errors can occur from changes or redirection of URLs, and any communication over a network is subject to intrusions, errors, and hackers.
■ Component obsolescence. As hardware, software, and media age, they become ob- solete over time, due to the continued innovation and advances by the computer industry. Sometimes obsolescence is due to outdated component parts, changes in software routines, or changes in the hardware to read removable media.
■ Human error. People make mistakes, and they can make mistakes in selecting, classifying, storing, or handling archived records. Some of these errors may be detected and can be remedied; some go unnoticed or cannot be fi xed.
■ Natural disaster. Hurricane Katrina is the clearest U.S. example of how a natu- ral disaster can interrupt business operations and destroy business records, al- though in some instances, damaged records were able to be recovered. Floods, fi res, earthquakes, and other natural disasters can completely destroy or cause media or computer hardware/software failures.
■ Attacks. Archived electronic records are subject to external attacks from malware, such as viruses and worms, so preserved records must be scanned for malware and kept separate from external threats. Preserved records also can be subject to theft or damage from insiders, such as the theft of historical ra-
LONG-TERM DIGITAL PRESERVATION 321
c17 321 March 6, 2014 3:01 PM
dio recordings by a National Archives And Records Administration employee, which was reported in 2012. Proper monitoring and auditing procedures must be in place to detect and avoid these types of attacks.
■ Financial shortfall. It is expensive to preserve and maintain digital records. Power, cooling and heating systems, personnel costs, and other preservation- associated costs must be budgeted and funded.
■ Business viability. If an organization has fi nancial or legal diffi culties or suffers a catastrophic disaster, it may not survive, placing the preserved records at risk. Part of the planning process is to include consideration of successor organiza- tion alternatives, should the originating organization go out of business. 3
The impact on the preserved records can be gauged by determining what per- centage of the data has been lost and cannot be recovered or, for the data that can be recovered, what the impact or delay to users may be.
It should be noted that threats can be interrelated and more than one type of threat may impact records at a time. For instance, in the event of a natural disaster, operators are more likely to make mistakes, and computer hardware failures can create new software failures.
Digital Preservation Standards
The digital preservation community recognizes that open standard technology-neutral standards play a key role in ensuring that digital records are usable, understandable, and reliable for as far into the future as may be required.
There are two broad categories of digital preservation standards. The fi rst category in- volves systems infrastructure capabilities and services that support a trustworthy re- pository. The second category relates to open standard technology-neutral fi le formats.
Digital preservation infrastructure capabilities and services that support trust- worthy digital repositories include the international standard ISO 14721:2003 , 2012 Space Data and Information Transfer Systems —Open Archival Information System (OAIS)—Reference Model , which is a key standard applicable to LTDP. 4
The fragility of digital storage media in concert with ongoing and sometimes rapid changes in computer software and hardware poses a fundamental challenge to ensuring access to trustworthy and reliable digital content over time. Eventually, ev- ery digital repository committed to LTDP must have a strategy to mitigate computer technology obsolescence. Toward this end, the Consultative Committee for Space Data Systems developed an Open Archival Information System (OAIS) reference model to support formal standards for the long-term preservation of space science data and information assets. OAIS was not designed as an implementation model.
Threats to LTDP of records can be internal or external, from natural disasters, computer or storage failures, and even from the fi nancial viability of an organization.
322 INFORMATION GOVERNANCE
c17 322 March 6, 2014 3:01 PM
The OAIS Reference Model defi nes an archival information system as an archive, consisting of an organization of people and systems that has accepted the responsibil- ity to preserve information and make it available and understandable for a designated community (i.e., potential users or consumers), who should be able to understand the information. Thus, the context of an OAIS-compliant digital repository includes producers who originate the information to be preserved in the repository, consumers who retrieve the information, and a management/organization that hosts and admin- isters the digital assets being preserved.
OAIS encapsulates digital objects into information packages. Each information package includes the digital object content (a sequence of bits) and representation infor- mation that enables rendering of an object into human usable information along with preservation description information (PDI) such as provenance, context, and fi xity.n
The OAIS Information Model employs three types of information packages: a submission information package (SIP), an archival information package (AIP), and a dissemination information package (DIP). An OAIS-compliant digital reposi- tory preserves AIPs and any PDI associated with them. A SIP encompasses digital con- tent that a producer has organized for submission to the OAIS. After the completion of quality assurance and transformation procedures, an AIP is created, which is the focus of preservation activity. Subsequently, a DIP is created that consists of an AIP or information extracted from an AIP customized to the requirements of the designated community of users and consumers.
The core of OAIS is a functional model that consists of six entities:
1. Ingest processes the formal incorporation (in archival terms, t accession ) of sub- mitted information (i.e., a SIP) into the digital repository. It acknowledges the transfer, conducts quality assurance, extracts metadata from the SIP, generates the appropriate AIP, and populates PDI and extracted metadata into the AIP.
2. Archival storage encompasses all of the activities associated with storage of AIPs. They include receipt of AIPs, transferring AIPs to the appropriate stor- age location, replacing media as necessary, transforming AIPs to new fi le for- mats as necessary, conducting quality assurance tests, supporting backups and business continuity procedures, and providing copies of AIPs to the access entity.
3. Data management manages the storage of description and system information, t generates reports, and tracks use of storage media.
4. Administration encompasses a host of technical and human processes that include audit, policy making, strategy, and provider and customer service, among other management and business functions. OAIS administration con- nects with all of the other OAIS functions.
5. Preservation planning does not execute any preservation activities. Rather, it g supports a technology watch program for sustainable standards, fi le formats, and software for digital preservation, monitoring changes in the access needs of the designated community, and recommending updated digital preserva- tion strategies and activities.
6. Access receives queries from the designated community, passes them to archi-s val storage, and makes them available as DIPs to the designated community.
Figure 17.1 displays the relationships between these six functional entities.5
LONG-TERM DIGITAL PRESERVATION 323
c17 323 March 6, 2014 3:01 PM
In archival storage, the OAIS reference model articulates a migration strategy based on four primary types of AIP migration that are ordered by an increas- ing risk of potential information loss: refreshment, replication, repackage, and transformation. 6
1. Migration refreshment occurs when one or more AIPs are copied exactly to the t same type of storage media with no alterations occurring in the packaging information, the content information, the PDI, or the AIP location and ac- cess archival storage mapping infrastructure.
2. Migration replication occurs when one or more AIPs are copied exactly to the same or new storage media with no alterations occurring in the packaging in- formation, the content information, and the PDI. However, there is a change in the AIP location and access archival storage mapping infrastructure.
3. Migration repackage occurs when one or more AIPs are copied exactly to new storage media with no alterations in the content information and the PDI. However, there are changes in the packaging information and the AIP loca- tion and to the access to the archival storage mapping infrastructure.
4. Migration transformation occurs when changes in bitstreams result when a new content encoding procedure replaces the current encoding procedure (e.g., Unicode representation of A through Z replaces the ASCII representation of A through Z), a new fi le format replaces an existing one, or a new software application is required to access and render the AIP content.
OAIS is the lingua franca of digital preservation. The international digital pres- ervation community has embraced it as the framework for viable and technologically sustainable digital preservation repositories. An LTDP strategy that is OAIS-conforming offers the best means available today for preserving the digital heritage of all organizations, private and public.
Figure 17.1 Open Archival Information System Reference Model
Preservation Planning
Data
Management
Archival
Storage
Descriptive info
Descriptive info
SIP
AIP AIP
Ingest
Access
DIP
Administration
MANAGEMENT
P R O D U C E R
C O N S U M E R
result sets
orders
queries
324 INFORMATION GOVERNANCE
c17 324 March 6, 2014 3:01 PM
ISO TR 18492 (2005), Long-Term Preservation of Electronic Document-Based Information
ISO 18492 provides practical methodological guidance for the long-term preservation and retrieval of authentic electronic document-based information, when the retention period exceeds the expected life of the technology (hardware and software) used to create and maintain the information assets. It emphasizes both the role of open stan- dard technology-neutral formats in supporting long-term access and the engagement of IT specialists, document managers, records managers, and archivists in a collabora- tive environment to promote and sustain a viable digital preservation program.
ISO 18492 takes note of the role of ISO 15489 but does not cover processes for the capture, classifi cation, and disposition of authentic electronic document-based information. Ensuring the usability and trustworthiness of electronic document-based information for as long as necessary in the face of limited media durability and technology obsolescence requires a robust and comprehensive digital preservation strategy. ISO 18492 describes such a strategy, which includes media renewal, software dependence, mi- gration, open standard technology-neutral formats, authenticity protection, and security:
■ Media renewal. ISO 18492 defi nes media renewal as a baseline requirement for digital preservation because it is the only known way to keep bitstreams of information based on electronic documents alive. It specifi es the conditions under which copying and reformatting of storage media and storage devices should occur.
■ Open standard technology-neutral formats. The fundamental premise of ISO 18492 is that open standard technology-neutral formats are at the core of a vi- able and technologically sustainable digital preservation strategy because they help mitigate software obsolescence. ISO 18492 recommends the use of several standard formats, including: eXtensible Markup Language (XML), Portable Document Format/Archival (PDF/A), tagged image fi le format (TIFF), and Joint Photographic Experts Group (JPEG).
■ Migrating electronic content. ISO 18492 recommends two ways of migrating electronic content to new technologies. The fi rst relies on backwardly compat- ible new open standard technology-neutral formats that are displacing existing ones. Generally, this is a straightforward process that typically can be executed with minimal human intervention. The second involves writing computer code that exports the electronic content to a new target application or open standard technology-neutral format. This can be a very labor-intensive activity and re- quires rigorous quality control.
■ Authenticity. ISO 18492 recommends the use of hash digest algorithms to validate the integrity of electronic content after execution of media renewal activities that do not alter underlying bit streams of electronic content. In
An OAIS-conforming LTDP strategy is the best way to preserve an organization’s digital heritage.
LONG-TERM DIGITAL PRESERVATION 325
c17 325 March 6, 2014 3:01 PM
instances where bitstreams are a result of format conversion, comprehensive preservation metadata should be captured that documents the process.
■ Security. ISO 18492 recommends protecting the security of electronic records by creating a fi rewall between electronic content in a repository and external users. In addition, procedures should be in place to maintain backup/disaster recovery capability, including at least one off-site storage location.
ISO 16363 (2012)—Space Data and Information Transfer Systems—Audit and Certifi cation of Trustworthy Digital Repositories
ISO 14721 (OAIS) acknowledged that an audit and certifi cation standard was needed that incorporated the functional specifi cations for records producers, records users, ingest of digital content into a trusted repository, archival storage of this content, and digital preserving planning and administration. ISO 16363 is this audit and certifi cation standard. Its use enables independent audits and certifi cation of trustworthy digital repositories and thereby promotes public trust in digital repositories that claim they are trustworthy. To date only a handful of ISO 16363 test audits have been undertaken; additional time is required to determine how widely adopted the standard becomes.
ISO 16363 is organized into three broad categories: organization infrastructure, digital object management, and technical infrastructure and security risk management. Each category is decomposed into a series of primary elements or components, some of which may be more appropriate for digital libraries than for public records digi- tal repositories. In some instances there are secondary elements or components. An explanatory discussion of each element accompanies “empirical metrics” relevant to that element. The “empirical metrics” typically include high-level examples of how conformance can be demonstrated. Hence, they are subjective high-level conformance metrics rather than explicit performance metrics.
Organizational infrastructure 7 consists of these primary elements:
■ Mission statement that refl ects a commitment to the preservation of, long-term t retention of, management of, and access to digital information
■ Preservation strategic plan that defi nes the approach the repository will take in the long-term support of its mission
ISO 18492 provides practical methodological guidance for the long-term pres- ervation of e-documents when the retention period exceeds the expected life of the technology that created it.
ISO 16363 is an audit and certifi cation standard organized into three broad categories: organization infrastructure, digital object management, and technical infrastructure and security risk management.
326 INFORMATION GOVERNANCE
c17 326 March 6, 2014 3:01 PM
■ Collection policy or other document that specifi es the types of information it will preserve, retain, manage, and provide access to
■ Identifi cation and establishment of the duties identifi ed and establishment of the du-d ties and roles that are required to perform along with a staff with adequate skills and experience to fulfi ll these duties
■ Dissemination of the defi nitions of its designated community and associated s knowledge base(s)
■ Preservation policies that ensure that the preservation strategic plan will be met s ■ Documentation of the history of changes to operations, procedures, software,
and hardware ■ Commitment to transparency and accountability in all actions supporting the op-
eration and management of the repository that affect the preservation of digital content over time
■ Dissemination as appropriate of the defi nition, collection, and tracking of infor- mation integrity measurements
■ Commitment to a regular schedule of self-assessment and external certifi cation t ■ Short- and long-term business planning processes in place to sustain the reposi-g
tory over time ■ Deposit agreements for digital materials transferred to the custody of the
organization ■ Written policies that specify when the preservation responsibility for contents of s
each set of submitted data objects occurs ■ Intellectual property ownership rights policies and procedures s
Digital object management,8 which is the core of the standard , comprises these pri-d mary elements:
■ Methods and factors used to determine the different types of information for which an organization accepts preservation responsibility
■ An understanding of digital collections suffi cient to carry out the preservation necessary for as long as required
■ Specifi cations that enable recognition and parsing of SIPs ■ An ingest procedure that verifi es each SIP for completion and correctness ■ An ingest procedure that validates successful ingest of each SIP ■ Defi nitions for each AIP or class of AIPs used that are adequate for parsing and
suitable for long-term preservation requirements ■ Descriptions of how AIPs are constructed from SIPs, including extraction of
metadata ■ Documentation of the fi nal disposition of SIPs, including those not ingested ■ A convention that generates unique, persistent identifi ers of all AIPs ■ Reliable linking services that support the location of each uniquely identifi ed
object, regardless of its physical location ■ Tools and resources that support authoritative representation information for
all of the digital objects in the repository, including fi le type ■ Documented processes for acquiring and creating PDI ■ Understandable content information for the designated community at the time
of creation of the AIPs
LONG-TERM DIGITAL PRESERVATION 327
c17 327 March 6, 2014 3:01 PM
■ Verifi cation of the completeness and correctness of AIPs at the point of their creation
■ Contemporaneous capture of documentation of actions and administration processes that are relevant to AIP creation
■ Documented digital preservation strategies ■ Mechanisms for monitoring the digital preservation environment ■ Documented evidence of the effectiveness of digital preservation activities ■ Specifi cations for storage of AIPs down to the bit level ■ Preservation of the content information of AIPs ■ Monitoring the integrity of AIPs ■ Documentation that preservation actions associated with AIPs complied with
the specifi cations for those actions ■ Specifi cation of minimum information requirements that enable the designated
community to discover and identify material of interest ■ Bidirectional linkage between each AIP and its associated descriptive information ■ Compliance with access policies ■ Policies and procedures that enable the dissemination of digital objects that are
traceable to the “originals,” with evidence supporting their authenticity ■ Procedures that require documentation of actions taken in response to reports
about errors in data or responses from users
Technical infrastructure and security risk management primary elements 9 include these:
■ Technology watches or other monitoring systems that track when hardware and software is expected to become obsolete
■ Procedures, commitment, and funding when it is necessary to replace hardware ■ Procedures, commitment, and funding when it is necessary to replace software ■ Adequate hardware and software support for backup functionality suffi cient for
preserving the repository content and tracking repository functions ■ Effective mechanisms that identify bit corruption or loss ■ Documentation captures of all incidents of data corruption or loss, and steps
taken to repair/replace corrupt or lost data ■ Defi ned processes for storage media and/or hardware change (e.g., refreshing,
migration) ■ Management of the number and location of copies of all digital objects ■ Systematic analysis of security risk factors associated with data, systems,
personnel, and physical plant ■ Suitable written disaster preparedness and recovery plan(s), including at least
one off-site backup of all preserved information together with an offsite copy of the recovery plan(s)
ISO 16363 represents the gold standard of audit and certifi cation for trustworthy digital repositories. In some instances the resources available to a trusted repository may not support full implementation of the audit and certifi cation specifi cations. Decisions about where full and partial implementation is appropriate should be based on a risk assessment analysis.
328 INFORMATION GOVERNANCE
c17 328 March 6, 2014 3:01 PM
PREMIS Preservation Metadata Standard
ISO 14721 specifi es that preservation metadata associated with all archival storage activities (e.g., generation of hash digests, transformation, and media renewal) should be captured and stored in PDI. This high-level guidance requirement demands greater specifi city in an operational environment.
Toward this end, the U.S. Library of Congress and the Research Library Group supported a new international working group called PREservation Metadata Informa- tion Strategies (PREMIS) 10 to defi ne a core set of preservation metadata elements with a supporting data dictionary that would be applicable to a broad range of digital pres- ervation activities and to identify and evaluate alternative strategies for encoding, man- aging, and exchanging preservation metadata. Version 2.2 was released in June 2012.11
PREMIS enables designers and managers of digital repositories to have a clear understanding of the information required to support the “functions of viability, renderability, understandability, authenticity, and identity in a preservation context.” PREMIS accomplishes this through a data model that consists of fi ve “semantic units” (think of them as high-level metadata elements, each of which is decomposed into sub- elements) and a data dictionary that decomposes these “semantic units” into a structure hierarchy. The fi ve semantic units and their relationships are displayed in Figure 17.2 .
Note the arrows that defi ne relationships between these entities:
■ Intellectual entities are considered a single intellectual unit such as a book, map, s photograph, database, or records (e.g., an AIP).
ISO 16363 represents the gold standard of audit and certifi cation for trustwor- thy digital repositories.
Figure 17.2 PREMIS Data Model Source: Library of Congress, P REMIS Data Dictionary for Preservation Metadata , Version 2.1 (January 2011).
Intellectual Entities Rights
Agents
Events
Objects
LONG-TERM DIGITAL PRESERVATION 329
c17 329 March 6, 2014 3:01 PM
■ Objects are discrete units of information in digital form that may exist as a bit-s stream, a fi le or a representation.
■ Events denote actions that involve at least one digital object and/or agent knowns to the repository. Events may include the type of event (e.g., media renewal), a description of the event, and the agents involved in the event. Events support the chain of custody of digital objects.
■ Agents are actors in digital preservation that have roles. An agent can be ans individual, organization, or a software application.
■ Rights involve the assertion of access rights and access privileges that relate tos intellectual property, privacy, or other related rights
The PREMIS Data Dictionary decomposes objects, events, agents, and rights into a structured hierarchical schema. In addition, it contains semantic units that support documentation of relationships between Objects. An important feature of the PREMIS is an XML schema for the PREMIS Data Dictionary. The primary rationale for the XML schema is to support the exchange of metadata information, which is crucial in ingest and archival storage. The XML schema enables automated extraction of preservation related metadata in SIPs and population of this preserva- tion metadata into AIPs. In addition, the XML schema can enable automatic capture of preservation events that are foundational for maintaining a chain of custody in archival storage.
Recommended Open Standard Technology-Neutral Formats
A digital fi le format specifi es the internal logical structure of digital objects (i.e., binary bits of 1s and 0s) and signal encoding (e.g., text, image, sound, etc.). File formats are crucial to long-term preservation because a computer can open, process, and render fi le formats that it recognizes. Many fi le formats are proprietary (also known as native), meaning that digital content can be opened and rendered only by the software application used to create, use, and store it. However, as IT changed, some software vendors introduced new products that no longer support earlier versions of a fi le format. In such instances these formats become “legacy” format, and digital content embedded in them can be opened only with computer code written expressly for this purpose. Other vendors, such as Microsoft, support backward compatibility across multiple generations of technology so Microsoft Word 2010 can open and render documents in Microsoft Word 95. Nonetheless, it is unrealistic to expect any software vendor to support back- ward compatibility for its proprietary fi le formats for digital content that will be pre- served for multiple decades.
The PREMIS standard defi nes a core set of preservation metadata elements with a supporting data dictionary applicable to a broad range of digital preservation activities.
330 INFORMATION GOVERNANCE
c17 330 March 6, 2014 3:01 PM
In the late 1980s, an alternative to vendor-supported backward compatibility emerged to mitigate dependence on proprietary fi le formats through open system in- teroperable fi le formats. Essentially, this meant that digital content could be exported from one proprietary fi le format and imported to one or more other proprietary fi le formats. Over time, interoperable fi le formats evolved into open standard technology- neutral formats that today have these characteristics:
■ Open means that the process is transparent and that participants in the process reach a consensus on the properties of the standard.
■ Standard means that a recognized regional or international organization (e.g.,d the ISO) published the standard.
■ Technology neutral means that the standard is interoperable on almost any tech-l nology platform that asserts conformance to the standard.
Because even open standard technology-neutral formats are not immune to tech- nology obsolescence, their selection must take into account their technical sustain- ability and implementation in digital repositories. The PRONON program of the National Archives of the United Kingdom and long-term sustainability of fi le formats of the U.S. Library of Congress assess the sustainability of open standard technology- neutral formats.
The recommended open standard technology-neutral formats for nine content types listed in Table 17.1 are based on this ongoing work, along with preferred fi le for- mats supported by Library and Archives Canada and other national archives. Unlike PDF/A, several of these fi le formats (e.g., XML, JPEG 2000, and Scalable Vector
Many digital fi le formats are proprietary, meaning that content can be viewed and controlled only by the software application used to create, use, and store it.
Table 17.1 Recommended Open Standard Technology-Neutral Formats
PDF/A XML TIFF PNG JPEG 2000 SVG MPEG-2 BWF WARC
Text √ √
Spreadsheets √
Images (raster) √ √ √
Photographs (digital) √
Vector graphics √
Moving images √
Audio √
Web √
Databases √
LONG-TERM DIGITAL PRESERVATION 331
c17 331 March 6, 2014 3:01 PM
Graphics [SVG]) were not explicitly designed for digital preservation. It cannot be em- phasized too strongly that this list of recommended open standard technology-neutral formats (or any other comparable list) is not static and will change over time as technology changes.
ISO 19005 (PDF/A)—Document Management—Electronic Document File Format for Long-Term Preservation (2005, 2011, and 2012)
PDF/A is an open standard technology-neutral format that enables the accurate repre- sentation of the visual appearance of digital content without regard for the proprietary format or application in which it was created or used. PDF/A is widely used in digital repositories as a preservation format for static textual and image content. Note that PDF/A is agnostic with regard to digital imaging processes or storage media. PDFA/A supports conversion of TIFF and PNG images to PDF/A. There are two levels of con- formance to PDF/A specifi cations. PDF/A-1a references the use of a “well-formed” hierarchical structure with XML tags that enable searching for a specifi c tag in a very large digital document. PDF/A-1b does not require this conformance, and as a practi- cal matter, it does not affect the accurate representation of visual appearance.
Since its publication in 2005, there have been two revisions of PDF/A. The fi rst revision, PDF/A-2, was aligned with the Adobe Portable Document Format 1.7 pub- lished specifi cations, which Adobe released to the public domain in 2011. The sec- ond revision, PDF/A-3, supports embedding documents in other formats, such as the original source document, in a PDF document.
Extensible Markup Language (XML)—World Wide Web Consortium (W3C) Internet Engineering Group (1998)
XML is a markup language that is a derivative of Standard General Markup Language (SGML) that logically separates the rendering of a digital document from its content to enable interoperability across multiple technology platforms. Essentially XML defi nes rules for marking up the structure of content and its content in American Standard Code for Information Interchange (ASCII) text. Any conforming interoper- able XML parser can render the original structure and content. XML-encoded text is human-readable because any text editor can display the marked-up text and content. XML is ubiquitous in IT environments because many communities of users have developed document type defi nitions unique to their purposes, including genealogy, math, and relational databases. Structure data elements work with relational databases, so this enables relational database portability.
Tagged Image File Format (1992)
Tagged image fi le format (TIFF) was initially developed by the Aldus Corporation in 1982 for storing black-and-white images created by scanners and desktop publishing
The PDF/A fi le format was designed specifi cally for digital preservation.
332 INFORMATION GOVERNANCE
c17 332 March 6, 2014 3:01 PM
application. Over the next six years, several new features were added, including a wide range of color images and compression techniques, including lossless compression. The most recent version of TIFF 6.0 was released by Aldus in 1992. Subsequently, Adobe purchased Aldus and chose not to support any further signifi cant revisions and updates. Nonetheless, TIFF is widely used in desktop scanners for creating digital images for preservation. With such a large base of users, it is likely to persist for some time, but Adobe’s decision to discontinue further development of TIFF means that it will lack features of other current and future image fi le formats. Fortunately, there are tools available to convert TIFF images to PDF and PNG images.
ISO/IEC 15498:2003—Information Technology—Computer Graphics and Image Processing-Portable Network Graphics (PNG)—Functional Specifi cations
The W3C Internet Engineering Task Force supported the development of PNG as a replacement for graphics image format (GIF) because the GIF compression algo- rithm was protected by patent rights rather than being in the public domain, as many believed. In 2003, PNG became an international standard that supports lossless com- pression, grayscale, and true-color images with bit depths that range from 1 to 16 bits per pixel, fi le integrity checking, and streaming capability.
Scalable Vector Graphics (SVG)—W3C Internet Engineering Task Force (2003)
Vector graphics images consist of two-dimensional lines, colors, curves, or other geo- metrical shapes and attributes that are stored as mathematical expressions, such as where a line begins, its shape, where it ends, and its color. Changes in these mathematical ex- pressions will result in changes in the image. Unlike raster images, there is no loss of clarity of a vector graphics image when it is made larger. SVG images and their behavior properties are defi ned in XML text fi les, which means any named element in a SVG image can be indexed and searched. SVG images also can be accessed by any text editor, which minimizes on a specifi c software application to render and edit the images.
ISO/IEC 15444-1:2004—Joint Photographic Engineers Group (JPEG 2000)
JPEG 2000 is an international standard for compressing full-color and grayscale digital im- ages and rendering them as full-size images and thumbnail images. Unlike JPEG, its s predecessor, which supported only lossy compression, JPEG 2000 supports both lossy and lossless compression. Lossy compression means that during compression, bits that are considered technically redundant are permanently deleted. Lossless compression means no bits are lost or deleted. The latter is very important for LTDP because lossy
PNG replaced GIF as an international standard for grayscale and color images in 2004.
LONG-TERM DIGITAL PRESERVATION 333
c17 333 March 6, 2014 3:01 PM
compression is irreversible. JPEG 2000 is widely used in producing digital images in digital cameras and is an optional format in many digital scanners.
ISO/IEC 13818–3:2000—Motion Picture Expert Group (MPEG-2)
MPEG-2 is an international broadcast standard for lossy compression of moving im- ages and associated audio. The major competitor for MPEG-2 appears to be Motion JPEG 2000, which is used in small devices, such as cell phones.
European Broadcasting Tech 3285—Broadcast Wave Format (BWF) (2011)
First issued by the European Broadcasting Union in 1997 and revised in 2001 (v1) and 2011 (v2), BWF is a fi le format for audio data that is an extension of the Microsoft Wave audio format. Its support of metadata ensures that it can be used for the seamless exchange of audio material between different broadcast environments and between equipment based on different computer platforms.
ISO 28500:2009—WebARChive (WARC)
WebARChive (WARC) is an extension of the Internet Archive’s ARC format to store digi- tal content harvested through “Web crawls.” WARC was developed to support the stor- age, management, and exchange of large volumes of “constituent data objects” in a single fi le. Currently, WARC is used to store and manage digital content collected through Web crawls and data collected by environmental sensing equipment, among others.
Digital Preservation Requirements
Implementing a sustainable LTDP program is not an effort that should be undertaken lightly. Digital preservation is complex and costly and requires collaboration with all of the stakeholders who are accountable for or have an interest in ensuring access to usable, understandable, and trustworthy electronic records for as far into the future as may be required.
As noted earlier, ISO 14721 and ISO 16363 establish the baseline functions and specifi cations for ensuring access to usable, understandable, and trustworthy electron- ic records, whether this involves regulatory and legal compliance for a business entity, vital records, accountability for a government unit, or cultural memory for a public or private institution. Most fi rst-time readers who review the functions and specifi cations of ISO 14721 and ISO 16363 are likely to be overwhelmed by the detail and complex- ity of almost 150 specifi cations.
JPEG 2000 is an international standard for compressing and rendering full- color and grayscale digital images in full size or as thumbnails.
334 INFORMATION GOVERNANCE
c17 334 March 6, 2014 3:01 PM
Long-Term Digital Preservation Capability Maturity Model®
A useful approach that both simplifi es these specifi cations and provides explicit criteria regard- ing conformance to ISO 14721 and ISO 16363 is the Long-Term Digital Preservation Capability Maturity Model® (DPCMM). 12 The DPCMM, which is described in some detail in this section, draws on functions and preservation services identifi ed in ISO 14721 (OAIS) as well as attributes specifi ed in ISO 16363, Audit and Certifi cation of Trustworthy Repositories. It is important to note that the DPCMM is not a one-size- fi ts-all approach to ensuring long-term access to authentic electronic records. Rather, it is a fl exible approach that can be adapted to an organization’s specifi c requirements and resources.
DPCMM can be used to identify the current state capabilities of digital preserva- tion that form the basis for debate and dialogue regarding the desired future state of digital preservation capabilities, and the level of risk that the organization is willing to assume. In many instances, this is likely to come down to the question of what constitutes digital preservation that is good enough to fulfi ll the organization’s mis- sion and meet the expectations of its stakeholders. The DPCMM has fi ve incremental stages, which are depicted in Figure 17.3 . In Stage 1, a systematic digital preservation
The Long-Term Digital Preservation Capability Maturity Model (DPCMM) sys- tematically organizes high-level conformance to ISO 14721 and ISO 16363.
Figure 17.3 Five Levels of Digital Preservation Capabilities
Nominal
Optimal
Advanced
Intermediate
Minimal
Practically all digital records that merit long-term preservation are at risk.
Most digital records that merit long-term preservation are at risk.
Many digital records that merit long-term preservation are at risk.
Some digital records that merit long-term preservation are at risk.
Few digital records that merit long-term preservation are at risk.
Evaluate capabilities and requirements for Stage 5.
Evaluate capabilities and requirements for Stage 4.
Evaluate capabilities and requirements for Stage 3.
Evaluate capabilities and requirements for Stage 2.
LONG-TERM DIGITAL PRESERVATION 335
c17 335 March 6, 2014 3:01 PM
program has not been undertaken or the digital preservation program exists only on paper, whereas Stage 5 represents the highest level of sustainable digital preservation capability and repository trustworthiness that an organization can achieve.
The DPCMM is based on the functional specifi cations of ISO 14721 and ISO 16363 and accepted best practices in operational digital repositories. It is a systems- based tool for charting an evolutionary path from disorganized and undisciplined management of electronic records, or the lack of a systematic electronic records man- agement program, into increasingly mature stages of digital preservation capability.
The goal of the DPCMM is to identify at a high level where an electronic records management program is in relation to optimal digital preservation capabilities, report gaps, capability levels, and preservation performance metrics to resource allocators and other stakeholders to establish priorities for achieving enhanced capabilities to preserve and ensure access to long-term electronic records.
Stage 5: Optimal Digital Preservation Capability
Stage 5 is the highest level of digital preservation readiness capability that an organi- zation can achieve. It includes a strategic focus on digital preservation outcomes by continuously improving the manner in which electronic records life cycle manage- ment is executed. Stage 5 digital preservation capability also involves benchmarking the digital preservation infrastructure and processes relative to other best-in-class digital preservation programs and conducting proactive monitoring for breakthrough tech- nologies that can enable the program to signifi cantly change and improve its digital preservation performance. In Stage 5, few if any electronic records that merit long-term preservation are at risk.
Stage 4: Advanced Digital Preservation Capability
Stage 4 capability is characterized by an organization with a robust infrastructure and digital preservation processes that are based on ISO 14721 specifi cations and ISO 16363 audit and certifi cation criteria. At this stage, the preservation of electronic re- cords is framed entirely within a collaborative environment in which there are mul- tiple participating stakeholders. Lessons learned from this collaborative framework serve as the basis for adapting and improving capabilities to identify and proactively bring long-term electronic records under lifecycle control and management. Some elec- tronic records that merit long-term preservation still may be at risk.
Stage 3: Intermediate Digital Preservation Capability
Stage 3 describes an environment that embraces the ISO 14721 specifi cations and other best practice standards and schemas and thereby establishes the foundation for sustaining an enhanced digital preservation capability over time. This foundation includes successfully completing repeatable projects and outcomes that support the enterprise digital preservation capability and enables collaboration, including shared resources, between record-producing units and entities responsible for managing and maintaining trustworthy digital repositories. In this environment, many electronic records that merit long-term preservation are likely to remain at risk.
336 INFORMATION GOVERNANCE
c17 336 March 6, 2014 3:01 PM
Stage 2: Minimal Digital Preservation Capability
Stage 2 describes an environment where an ISO 14721–based digital repository is not yet in place. Instead, a surrogate repository for electronic records is available to some records producers that satisfi es some but not all of the ISO 14721 specifi cations. Typically, the digital preservation infrastructure and processes of the surrogate reposi- tory are not systematically integrated into business processes or universally available, so the state of digital preservation is somewhat rudimentary and life cycle management of the organization’s electronic records is incomplete. There is some understanding of digital preservation issues, but it is limited to a relatively few individuals. There may be virtually no relationship between the success or failure of one digital preservation initiative and the success or failure of another one. Success is largely the result of ex- ceptional (perhaps even heroic) actions of an individual or a project team. Knowledge about such success is not widely shared or institutionalized. Most electronic records that merit long-term preservation are at risk.
Stage 1: Nominal Digital Preservation Capability
Stage 1 describes an environment in which the specifi cations of ISO 14721 and other standards may be known, accepted in principle, or under consideration, but they have not been formally adopted or implemented by the record-producing organization. Generally, there may be some understanding of digital preservation issues and con- cerns, but this understanding is likely to consist of ad hoc electronic records man- agement and digital preservation infrastructure, processes, and initiatives. Although there may be some isolated instances of individuals attempting to preserve electronic records on a workstation or removable storage media (e.g., DVD or hard drive), practi- cally all electronic records that merit long-term preservation are at risk.
Scope of the Capability Maturity Model
This capability maturity model consists of 15 components, or key process areas, that are necessary and required for the long-term preservation of usable, understandable, accessible, and trustworthy electronic records. Each component is identifi ed and is accompanied by explicit performance metrics for each of the fi ve levels of digital pres- ervation capability.
The objective of the model is to provide a process and performance framework (or benchmark) against best practice standards and foundational principles of digital preservation, records management, information governance, and archival science. Figure 17.4 displays the components of the DPCMM.
Scope notes for each of the graphic elements in Figure 17.4 diagram are provided next for additional clarity. Numbered components in the model are associated with performance metrics and capability levels described in the next section.
■ Producers and Users ■ Records creators and owners are stakeholders who have either the obligation or s
the option to transfer permanent and long-term (10+-year retention) electronic records to one or more specifi ed digital repositories for safekeeping and access.
LONG-TERM DIGITAL PRESERVATION 337
c17 337 March 6, 2014 3:01 PM
■ Users. Individuals or groups that have an interest in and/or right to access records held in the digital repository. These stakeholders represent a variety of interests and access requirements that may change over time.
■ Digital preservation infrastructure. Seven key organizational process areas re- quired to ensure sustained commitment and adequate resources for the long- term preservation of electronic records are: 1. Digital preservation policy. The organization charged with ensuring preser-
vation and access to long-term and permanent legal, fi scal, operational, and historical records should issue its digital preservation policy in writing, in- cluding the purpose, scope, accountability, and approach to the operational management and sustainability of trustworthy repositories.
2. Digital preservation strategy. The organization charged with the preser- vation of long-term and permanent business, government, or historical electronic records must proactively address the risks associated with technology obsolescence, including plans related to periodic renewal of storage devices, storage media, and adoption of preferred preservation fi le formats.
3. Governance. The organization has a formal decision-making framework that assigns accountability and authority for the preservation of electronic records with long-term and permanent historical, fi scal, operational, or le- gal value, and articulates approaches and practices for trustworthy digital repositories suffi cient to meet stakeholder needs. Governance is exercised in conjunction with information management and technology functions and with other custodians and digital preservation stakeholders, such as records-producing units and records consumers, and enables compliance with applicable laws, regulations, record retention schedules, and disposi- tion authorities.
4. Collaboration. Digital preservation is a shared responsibility. The organi- zation with a mandate to preserve long-term and permanent electronic
Figure 17.4 Digital Preservation Capability Maturity Model
3.
Governance
2.
Strategy
1.
Policy
4.
Collaboration
5.
Technical
Expertise
6.
Open
Sources/
Neutral
Formats
7.
Designated
Community
Digital Preservation Infrastructure
Trustworthy Digital Repository
Digital Preservation Services
9. Ingest
10. Storage
11.
Device/ Media
Renewal
12. Integrity
13. Security
14. Metadata
Producers Users
8.
Electronic
Records
Survey
15.
Access
338 INFORMATION GOVERNANCE
c17 338 March 6, 2014 3:01 PM
business, government, or historical records in accordance with accepted dig- ital preservation standards and best practices is well served by maintaining and promoting collaboration among its internal and external stakeholders. Interdependencies between and among the operations of records produc- ing units, legal and statutory requirements, IT policies and governance, and historical accountability should be addressed systematically.
5. Technical expertise. A critical component in a sustainable digital preserva- tion program is access to professional technical expertise that can proac- tively address business requirements and respond to impacts of evolving technologies. The technical infrastructure and key processes of an ISO 14721/ISO 16363–conforming archival repository requires professional expertise in archival storage, digital preservation solutions, and life cycle electronic records management processes and controls. This technical ex- pertise may exist within the organization or be provided by a centralized function or service bureau or by external service providers, and should in- clude an in-depth understanding of critical digital preservation actions and their associated recommended practices.
6. Open standard technology-neutral formats. A fundamental requisite for a sus- tainable digital preservation program that ensures long-term access to us- able and understandable electronic records is mitigation of obsolescence of fi le formats. Open standard platform-neutral fi le formats are developed in an open public setting, issued by a certifi ed standards organization, and have few or no technology dependencies. Current preferred open standard technology fi le format examples include:
■ XML and PDF/A for text ■ PDF/A for spreadsheets ■ JPEG 2000 for photographs ■ PDF/A, PNG, and TIFF for scanned images ■ SVG for vector graphics ■ BWF for audio ■ MPEG-4 for video ■ WARC for Web pages Over time, new digital preservation tools and solutions will emerge that
will require new open standard technology-neutral standard fi le formats. Open standard technology-neutral formats are backwardly compatible so they can support interoperability across technology platforms over an ex- tended period of time.
7. Designated community. The organization that has responsibility for preser- vation and access to long-term and permanent legal, operational, fi scal, or historical government records is well served through proactive outreach and engagement with its designated community. There are written proce- dures and formal agreements with records-producing units that document the content, rights, and conditions under which the digital repository will ingest, preserve, and provide access to electronic records. Written proce- dures are in place regarding the ingest of electronic records and access to its digital collections. Records producers will submit fully conforming ISO 14721/ISO 16363 SIPs while DIPs are developed and updated in conjunc- tion with its user communities.
LONG-TERM DIGITAL PRESERVATION 339
c17 339 March 6, 2014 3:01 PM
■ Trustworthy digital repository. This includes the integrated people, processes, and technologies committed to ensuring the continuous and reliable design, op- eration, and management of digital repositories entrusted with long-term and permanent electronic records. A trustworthy digital repository may range from a simple system that involves a low-cost fi le server and software that provide nonintegrated preservation services, to complex systems comprising data cen- ters and server farms, computer hardware and software, and communication networks that interoperate.
The most complete trustworthy digital repository is based on models and standards that include ISO 14721, ISO 16363, and generally accepted best digi- tal preservation practices. The repository may be managed by the organization that owns the electronic records or may be provided as a service by an external third party. It is likely that many organizations initially will rely on surrogate digital preservation capabilities and services that approximate some but not all of the capabilities and services of a conforming ISO14721/ISO 16363 trust- worthy digital repository.
■ Digital preservation processes and services. Eight key business process areas needed for continuous monitoring of the external and internal environ- ments in order to plan and take actions to sustain the integrity, security, usability and accessibility of electronic records stored in trustworthy digital repositories. 1. Electronic records survey. A trustworthy repository cannot fully execute
its mission or engage in realistic digital preservation planning without a projected volume and scope of electronic records that will come into its custody. It is likely that some information already exists in approved retention schedules, but it may require further elaboration as well as periodic updates, especially with regard to preservation ready, near pres- ervation ready, and legacy electronic records held by records-producing units.
2. Ingest. A digital repository that conforms to ISO 14721/ISO 16363 has the capability to systematically ingest (receive and accept) electronic records from records-producing units in the form of SIPs, move them to a staging area where virus checks and content and format validations are performed, transform electronic records into designated preservation formats as ap- propriate, extract metadata from SIPs and write it to PDI, create AIPs, and transfer the AIPs to the repository’s storage function. This process is con- sidered the minimal work fl ow for transferring records into a digital reposi- tory for long-term preservation and access.
3. Archival storage. ISO 14721 delineates systematic automated storage ser- vices that support receipt and validation of successful transfer of AIPs from ingest, creation of PDI for each AIP that confi rms its “fi xity”13 during any preservation actions through the generation of hash digests, capture and maintenance of error logs, updates to PDI including transformation of electronic records to new formats, production of DIPs from access, and collection of operational statistics.
4. Device and media renewal. No known digital device or storage medium is invulnerable to decay and obsolescence. A foundational digital preserva- tion capability is ensuring the readability of the bitstreams underlying the
340 INFORMATION GOVERNANCE
c17 340 March 6, 2014 3:01 PM
electronic records. ISO 14721/ ISO 16363 specify that a trustworthy digital repository’s storage devices and storage media should be monitored and re- newed (“refreshed”) periodically to ensure that the bitstreams remain read- able over time. A projected life expectancy of removable storage media does not necessarily apply in a specifi c instance of storage media. Hence, it is important that a trustworthy digital repository have a protocol for continu- ously monitoring removable storage media (e.g., magnetic tape, external tape drive, or other media) to identify any that face imminent catastrophic loss. Ideally, this renewal protocol would execute renewal automatically af- ter review by the repository.
5. Integrity. A key capability in conforming ISO 14721/ISO 16363 digital repositories is ensuring the integrity of the records in its custody, which involves two related preservation actions. The fi rst action generates a hash digest algorithm (also known as a cyclical redundancy code) to address a vulnerability to accidental or intentional alterations to elec- tronic records that can occur during device/media renewal and internal data transfers. The second action involves integrity documentation that supports an unbroken electronic chain of custody captured in the PDI in AIPs.
6. Security. Contemporary enterprise information systems typically execute a number of shared or common services that may include communica- tion, name services, temporary storage allocation, exception handling, role-based access rights, security, backup and business continuity, and directory services, among others. A conforming ISO 14721/ISO 16363 digital repository is likely to be part of an information system that may routinely provide some or perhaps all of the core security, backup, and business continuity services, including fi rewalls, role-based access rights, data-transfer-integrity validations, and logs for all preservation activities, including failures and anomalies, to demonstrate an unbroken chain of custody.
7. Preservation metadata. A digital repository collects and maintains metadata that describes actions associated with custody of long-term and permanent records, including an audit trail that documents preservation actions car- ried out, why and when they were performed, how they were carried out, and with what results. A current best practice is the use of a PREMIS-based data dictionary to support an electronic chain of custody that documents authenticity over time as preservation actions are executed. Capture of all related metadata, transfer of the metadata to any new formats/systems, and secure storage of metadata are critical. All metadata is stored in the PDI component of con- forming AIPs.
8. Access. Organizations with a mandate to support access to permanent business, government, or historical records are subject to authorized restrictions. A conforming ISO 14721/ISO 16363 digital repository will provide consumers with trustworthy records in “disclosure-free” DIPs redacted to protect, privacy, confi dentiality, and other rights, where ap- propriate, and searchable metadata that users can query to identify and retrieve records of interest to them. Production of DIPs is tracked, espe- cially when they involve extractions, to verify their trustworthiness and to
LONG-TERM DIGITAL PRESERVATION 341
c17 341 March 6, 2014 3:01 PM
identify query trends that are used to update electronic accessibility tools to support these trends.
Digital Preservation Capability Performance Metrics
Digital preservation performance metrics for each level of the fi ve levels of the model have been mapped to each of the 15 numbered components described in the previ- ous section. The performance metrics are explicit empirical indicators that refl ect an incremental level of digital preservation capability. The digital preservation capability performance metrics for digital preservation strategy listed in Table 17.2 illustrate the results of this mapping exercise.14
Conducting a gap analysis of its digital preservation capabilities using these performance metrics enables the organization to identify both its current state and desired future state of digital preservation capabilities . In all likelihood, this desired future state will depend ons available resources, the organization’s mission, and stakeholder expectations. “Good- enough” digital preservation capabilities will vary by organization; what is good enough for one organization is unlikely to coincide with what is good enough for another.
Digital Preservation Strategies and Techniques
Any organization with long-term or permanent electronic records in its custody must ensure that the electronic records can be read and correctly interpreted by a computer application, rendered in an understandable form to humans, and trusted as
Table 17.2 Digital Preservation Performance Metrics
Level Capability Description
0 A formal strategy to address technology obsolescence does not exist.
1 A strategy to mitigate technology obsolescence consists of accepting electronic records in their native format with the expectation that new software will become available to support these formats. During this interim period, viewer technologies will be relied on to render usable and understandable electronic records.
2 Electronic records in interoperable “preservation-ready”* fi le formats and transformation of one native fi le format to an open standard technology-neutral fi le format are supported. Changes in information technologies that may impact electronic records collections and the digital repository are monitored proactively and systematically.
3 The organization supports transformation of selected native fi le formats to preferred/ supported preservation fi le formats in the trustworthy digital repository. Records- producing units are advised to use preservation-ready fi le formats for permanent or indefi nite long-term (e.g., case fi les, infrastructure fi les) electronic records in their custody.
4 Electronic records in all native formats are transformed to available open standard technology-neutral fi le formats.
* The term “preservation-ready fi le formats” refers to open standard technology-neutral formats that the organiza-* tion has identifi ed as preferred for long-term digital preservation.
342 INFORMATION GOVERNANCE
c17 342 March 6, 2014 3:01 PM
accurate representations of their logical and physical structure, substantive content, and context. To achieve these goals, a digital repository should operate under the man- date of a digital preservation strategy that addresses 10 digital preservation processes and activities:
1. Adopt preferred open standard technology-neutral formats. Earlier, nine open stan- dard technology-neutral fi le formats that covered text, images, photographs, vector graphics, moving images, audio, and Web pages were discussed. Adop- tion of these fi le formats means that the digital repository will support their use in its internal digital preservation activities and notify the producers of records of the preferred formats for preservation-ready electronic records to be transferred to the repository’s custody.
2. Acquire electronic records in preservation-ready formats. Likely many born-digital electronic records along with scanned images will be created or captured in a preservation-ready format. Acquisition or ingest of electronic records already in preservation-ready formats can signifi cantly reduce the workload of the repository because it will not be necessary to transform records to open stan- dard technology-neutral formats.
3. Acquire and transform electronic records in near-preservation-ready formats. Near- preservation-ready formats are native proprietary fi le formats that can be eas- ily transformed to preservation-ready fi le formats through widely available software plug-ins. Ideally, over time, the volume of near-preservation-ready records will diminish as records producers increasingly convert records sched- uled for long-term retention into preservation-ready formats before they are transferred to the repository.
4. Acquire legacy electronic records. Legacy electronic records initially were cre- ated in a proprietary fi le format that is obsolete and no longer supported by a vendor. In most instances, electronic records embedded in legacy fi le formats can be recovered and saved in a preservation-ready format only if special com- puter code is written to extract the records from their legacy format. Once ex- tracted from the legacy format, they can be written to a contemporary format. Niche vendors provide this kind of service, but it is relatively expensive and perhaps beyond the resources of many repositories.
An alternative is to forgo this costly process in the hope that a future tech- nology, such as emulation , will be widely available and relatively inexpensive. Meanwhile, the repository would rely on a fi le viewer technology, such as Inside Out, to render legacy electronic records into format understandable to humans with the exact logical and physical structure and representation at the time they were created and used.
5. Maintain bitstream readability through device/media removal. No known digital storage device or media is exempt from degradation and technology obso- lescence. Consequently, the bitstreams of 1s and 0s that underlie electronic records are stored on media that are vulnerable to degradation and technol- ogy obsolescence. Technology obsolescence may occur when a vendor intro- duces a new form factor for storage device/media, such as the transition from 5.25-inch disk drives and disks to 3.5-inch disk drives and media to thumb drives. With today’s technology, periodic device/medial renewal is the only known way to keep bitstreams available. A rule of thumb is to renew storage
LONG-TERM DIGITAL PRESERVATION 343
c17 343 March 6, 2014 3:01 PM
device/media at least every 10 years. Failure to maintain the readability of bit- streams over time is an absolute guarantee the electronic records cannot be re- covered and that the records will be permanently lost for all practical purposes.
6. Migrate to new open standard technology-neutral formats. These formats are not im- mune to technology obsolescence. The inevitable changes in IT mean that new open standard technology formats will be created that displace current ones. The solution to this issue is migration from an older or current open standard technology-neutral format to newer ones. Seamless migration from old to new open standard technology-neutral formats is made possible through backward compatibility. “Backward compatibility” means that a new standard can interpret digital content in an old standard and then save it in the new format standard. Migration is the most widely used tool to mitigate fi le format obsolescence.
7. Protect the integrity and security of electronic records. Imperfect information tech- nologies inevitably have glitches that, along with accidental human error and intentional human actions, can corrupt or otherwise compromise the trust- worthiness of electronic records though some alteration in the underlying bitstream. Accidental alteration occurs when preservation actions are initiated for electronic records. These actions may occur during transformation, migra- tion, media renewal, accessions to digital records, and relocation of electronic records from one part of the repository to another. The most effective tool for validating that no unauthorized changes to electronic records occur is to compute a hash digest before a preservation action occurs and after the action is completed. If there is change of only one bit, a comparison of the two will identify it. Capturing these pre- and posthash digests and saving them as preser- vation description information can contribute to an electronic chain of custody.
A robust fi rewall that blocks unauthorized access with tightly controlled role-based permission rights will help protect the security of records in the custody of the repository.
A further enhancement to protect against a cataclysmic natural or man- made disaster is maintaining a backup copy of the repository’s holdings at an off-site facility.
8. Capture and save preservation metadata. Preservation metadata, which consists of tracking, capturing, and maintaining documentation of all preservation ac- tions associated with electronic records, involves identifying these events, the agents that executed the actions, and the results of the actions, including any corrective action taken. Saving this metadata along with the hash digest integ- rity validations just discussed enables a robust electronic chain of custody and establishes a strong basis for the trustworthiness of electronic records in the custody of the digital repository
9. Provide access. Access to usable and trustworthy records is the ultimate justifi cation for digital preservation. In some respects, this may be the most challenging as- pect of digital preservation because user expectations for customized retrieval tools, access speed, and delivery formats of electronic records may exceed the current resources of a trusted digital repository. Nonetheless, some form of user access through replication of records in a single open standard technol- ogy format, such as PDF/A for text and scanned images and JPEG 2000 for digital photographs, would be a major accomplishment and form the basis for a more aggressive access program over time.
344 INFORMATION GOVERNANCE
c17 344 March 6, 2014 3:01 PM
10. Engage proactively with records producers and other stakeholders. The traditional no- tion of an archive being in a reactive mode with regard records producers and other stakeholders in LTDP simply will not work in today’s world. Proactive engagement with records producers about how capturing electronic records in open standard technology-neutral formats can support both current business operation requirements and long-term requirements for usable, understand- able, and trustworthy archives can be a win-win for the digital repository and the records producers. Equally important is the notion of proactive engagement with all of the stakeholders in ensuring long-term access to usable, understand- able, and trustworthy electronic records. Support of other stakeholders can be leveraged to gain broad organizational support for the digital repository.
Evolving Marketplace
The design and implementation of a digital repository that operates under this digital preservation strategy can be carried out in several different ways. One way is to use internal expertise to build a stand-alone repository that conforms to these digital preservation strategy requirements. Typically, an internally built repository is costly, takes considerable time to implement, and may not meet all expectations because of technical inexperience. An alternative is to use the services and/or solutions offered by an external institution or supplier. A third-party solution is offered by Archivematica, a Vancouver, British Columbia, company that specializes in the use of open-source software and conformance to the specifi cations of ISO 14721. “Archivematica is a free and open-source digital preservation system that is designed to maintain standards- based, long-term access to collections of digital objects.” 15 Another company, Tessella Technology & Consulting,16 has an ISO 14721–conforming digital preservation solution called Safety Deposit Box that has been implemented in a number of national archives. In June 2012, Tessella introduced Preservica, 17 a cloud-based implementation of the Safety Deposit Box that runs on Amazon Web Services. It is likely that other repository solutions, preservation services, and cloud-based digital preservation services will emerge over the next few years. The digital preservation strategy discussed earlier can be used to assess the capabilities of these solutions.
Looking Forward
Organizations face signifi cant challenges in meeting their LTDP needs, especially organizations whose primary mission is to preserve and provide access to permanent records. They must collaborate with internal and external stakeholders, develop gov- ernance policies and strategies to govern and control information assets over long periods of time, inventory records in the custody of records producers, monitor tech- nology changes and evolving standards, and sustain trustworthy digital repositories. The most important consideration is to determine what level of LTDP maturity is appropriate, achievable, and affordable for the organization and to begin working me- thodically toward that goal for the good of the organization and its stakeholders over the long term. In addition, organizations should focus on what is doable over the next 10 to 20 years rather than the next 50 or 100 years.
LONG-TERM DIGITAL PRESERVATION 345
c17 345 March 6, 2014 3:01 PM
CHAPTER SUMMARY: KEY POINTS
■ Digital preservation is defi ned as long-term, error-free storage of digital infor- mation, with means for retrieval and interpretation, for the entire time span the information is required to be retained.
■ Digital preservation applies to content that is born digital as well as content that is converted to digital form.
■ Capability for properly ensuring access to authentic electronic records over time, (regardless of the challenges of technological obsolescence), is a sophisticated combination of policies, strategies, processes, specialized re- sources, and adoption of standards.
■ Most records are useful for only a short period of time, but some may need to be retained for long periods or permanently. For those records, organizations will need to plan for their preservation to ensure that they remain accessible, trustworthy, and useful.
■ Electronic records are being created at rates that pose signifi cant threats to our ability to organize, control, and make them accessible for as long as they are needed.
■ Threats to LTDP of records can be internal or external, from natural disasters, computer or storage failures, and even from the fi nancial viability of an orga- nization, which can limit needed funding.
■ Building and sustaining the capability to manage digital information over long periods of time is a shared responsibility among all stakeholders.
■ ISO 14721 is the lingua franca of digital preservation. The international digi- tal preservation community has embraced it as the framework for viable and technologically sustainable digital preservation repositories.
■ An ISO 14721 (OAIS)–compliant repository is the best way to preserve an organization’s long-term digital assets.
■ ISO/TR 18492 provides practical methodological guidance for the long-term preservation of e-documents, when the retention period exceeds the expect- ed life of the technology that created it.
■ ISO 16363 is an audit and certifi cation standard organized into three broad categories: organization infrastructure, digital object management, and tech- nical infrastructure and security risk management.
■ ISO 16363 represents the gold standard of audit and certifi cation for trust- worthy digital repositories.
■ The PREMIS standard defi nes a core set of preservation metadata elements with a supporting data dictionary applicable to a broad range of digital pres- ervation activities.
(Continued )
346 INFORMATION GOVERNANCE
c17 346 March 6, 2014 3:01 PM
Notes
1. Consultative Committee for Space Data Systems, Reference Model for an Open Archival Information Sys- tem (OAIS) (Washington, DC: CCSDS Secretariat, 2002), pp. 1-1.
2. Kate Cumming, “Metadata Matters,” in Julie McLeod and Catherine Hare, eds., Managing Electronic Records , p. 48 (London: Facet, 2005).s
3. David Rosenthal et al., “Requirements for Digital Preservation Systems,” D-Lib Magazine 11, no. 11 (November 2005), www.dlib.org/dlib/november05/rosenthal/11rosenthal.html .
4. “ISO 14721:2003, 2012 Space Data and Information Transfer Systems—Open Archival Informa- tion System—Reference Model,” www.iso.org/iso/catalogue_detail.htm?csnumber=24683 (accessed May 21, 2012).
5. Ibid., section 4.1. 6. Ibid., section 5.4. 7. See ISO 16363:2012 (E), sections 3.1–3.5.2. 8. See ibid., sections 4.1–4/6/2/1. 9. See ibid., sections 5.1–5.2.3. 10. For a useful overview of PREMIS, see Priscilla Caplan, “Understanding PREMIS,” Library of Con-
gress, February 1, 2009, www.loc.gov/standards/premis/understanding-premis.pdf . 11. Library of Congress, “PREMIS Data Dictionary Version 2.2: Hierarchical Listing of Semantic Units,”
September 13, 2012, www.loc.gov/standards/premis/v2/premis-dd-Hierarchical-Listing-2-2.html . 12. Charles Dollar and Lori Ashley are codevelopers of this model. Since 2007 they have used it successfully in
both the public and private sectors. The most recent instance is a digital preservation capability assessment for the U.S. Council of State Archivists (CoSA). For more information about the model, see “Digital Pres- ervation Capability Maturity Model” at www.savingthedigitalworld.com (accessed December 12, 2013).
13. ISO 14721 uses “fi xity” to express the notion that there have been no unauthorized changes to elec- tronic records and associated Preservation Description Information in the custody of the repository. See ISO 14721:2003 (E): 1.6.
■ Many digital fi le formats are proprietary, meaning that content can be viewed and controlled only by the software application used to create, use, and store it.
■ The digital preservation community recognizes that open standard technology- neutral standards play a key role in ensuring that digital records are usable, understandable, and reliable for as far into the future as may be required.
■ The PDF/A fi le format was specifi cally designed for digital preservation.
■ PNG replaced GIF as an international standard for grayscale and color images in 2004.
■ JPEG 2000 is an international standard for compressing and rendering full- color and grayscale digital images in full size or as thumbnails.
■ The Long-Term Digital Preservation Capability Maturity Model simplifi es con- formance to ISO 14721 and ISO 16363.
■ Migration, refreshment, and replication are examples of specifi c preservation techniques.
■ It is likely that new third-party repository solutions and preservation services, including cloud-based offerings, will emerge over the next few years.
CHAPTER SUMMARY: KEY POINTS (Continued )
LONG-TERM DIGITAL PRESERVATION 347
c17 347 March 6, 2014 3:01 PM
14. For information about digital preservation capability performance metrics, visit “Digital Preservation Capability Maturity Model.”
15. Archivematica, “What Is Archivematica?” October 15, 2012, www.archivematica.org/wiki/Main_Page . 16. Tessella, “Tessella SDB” www.tessella.com/tag/safety-deposit-box/ (accessed June 28, 2012). 17. Tessella, “Preservica: Digital Preservation as a Service” January 2011, www.digital-preservation.com/
wp-content/uploads/Paas-Description-V3-Alternate-Web.pdf .
349
c18 349 February 28, 2014 1:51 PM
C H A P T E R 18 Maintaining an Information Governance Program and Culture of Compliance*
* Portions of this chapter are adapted from Chapter 17 , Robert F. Smallwood, Safeguarding Critical E-Documents: Implementing a Program for Securing Confi dential Information Assets , © John Wiley & Sons, Inc., 2012. Reproduced with s permission of John Wiley & Sons, Inc.
M aintaining your information governance (IG) program beyond an initial proj- ect effort is key to realizing continued and long-term benefi ts of IG. This means that the IG program must become an everyday part of an organiza-
tion’s operations and communications. It requires vigilant and consistent monitoring and auditing to ensure that IG policies and processes are effective and consistently followed and enforced. If proper controls are in place, IG-infused processes should become a regular part of the enterprise’s operations. It also requires an ongoing train- ing and communications program to keep employees apprised of approved processes and behaviors that support IG.
Monitoring and Accountability
Monitoring and accountability require a continuous tightening and expansion of pro- tections and the implementation of newer, strategic technologies. Information tech- nology (IT) developments and innovations that can foster the effort must be steadily monitored and evaluated, and those technology subsets that can assist in providing security need to be incorporated into the mix.
The IG policies themselves must be reviewed and updated periodically to acco- mmodate changes in the business environment, laws, regulations, and technology. Program gaps and failures must be addressed, and the effort should continue to improve and adapt to new types of security threats.
That means accountability: Some individual must remain responsible for an IG policy’s administration and results.1 Perhaps the executive sponsor for the initial project becomes the chief information governance offi cer or IG czar of sorts; or the chief executive offi cer continues ownership of the program and drives its active
Information Governance: Concepts, Strategies and Best Practices By Robert F. Smallwood Copyright © 2014 by Robert F. Smallwood
350 INFORMATION GOVERNANCE
c18 350 February 28, 2014 1:51 PM
improvement. The organization also may decide to form a standing IG board, steer- ing committee, or team with specifi c responsibilities for monitoring, maintaining, and advancing the program.
However it takes shape, an IG program must be ongoing, dynamic, and aggressive in its execution in order to remain effective.
Staffi ng Continuity Plan
In today’s work environment, employees are more mobile in their careers: people take new career opportunities outside of the organization and also change jobs and move to other positions within an organization, so it is critical to have a continuity plan for your IG program. Backup and supporting designates must be named and kept current on the administration of the program. So you must have a supporting sponsor or se- nior sponsor to fi ll the role of executive sponsor, should the need arise; likewise, there needs to be other human resource/staffi ng redundancies built in to ensure the smooth and continued operation of the IG program, in the event of an unplanned incident that threatens it.
The approach to an IG program is similar to that of a a vital records (those critical business records that an organization must have to continue operations) program. Backups of backups must be built in. In vital records, there must be backups of backup copies of vital records, and they must be safely stored and also there needs to be backup IT systems and processes in place to ensure that an or- ganization can continue its operations. These redundancies must be considered, tested, and implemented. This may mean that when the formal program manager is unable to execute his or her duties, an assistant or designated backup can carry out those duties.
It is also a good idea to cross-train employees. With this approach, the legal team, for instance, will better understand the needs and requirements of the records man- agement function, and vice versa. Cross-training improves overall organization ac- ceptance and understanding of the IG program while building in safeguards to ensure that it keeps running.
Maintaining an IG program for requires that someone is accountable for continual monitoring and refi nement of policies and tools.
IG programs need built-in staffi ng redundancies to ensure their continued operation in the event of employee turnover or transfer.
MAINTAINING AN INFORMATION GOVERNANCE PROGRAM 351
c18 351 February 28, 2014 1:51 PM
Continuous Process Improvement
Maintaining IG program effectives requires implementing principles of continuous process improvement (CPI). CPI is a “never-ending effort to discover and eliminate the main causes of problems. It accomplishes this by using small-steps improvements, rather than implementing one huge improvement.” In Japan, the word kaizen refl ects this gradual and constant process, as it is enacted throughout the organization, regard- less of department, position, or level.2 To remain effective, the program must continue using CPI methods and techniques.
Maintaining and improving the program will require monitoring tools, periodic audits, and regular meetings for discussion and approval of changes to improve the program. It will require a cross section of team leaders from IT, legal, records manage- ment, compliance, internal audit, and risk management as well as functional business units participating actively and discussing possible threats and sources of information leakage.
Why Continuous Improvement Is Needed
Although the specifi c drivers of change are always evolving, the reasons that organiza- tions need to continuously improve their program for securing information assets are relatively constant. These reasons include:
■ Changing technology. New technology capabilities need to be monitored and considered with an eye to improving, streamlining, or reducing the cost of IG. The IG program needs to anticipate new types of threats and also evaluate add- ing or replacing technologies to continue to improve it.
■ Changing laws and regulations. Compliance with new or updated laws and regu- lations must be maintained.
■ Internal IG requirements. As an organization updates and improves its overall IG, the program elements that concern critical information assets must be kept aligned and synchronized.
■ Changing business plans. As the enterprise develops new business strategies and enters new markets, it must reconsider and update its IG program. If, for in- stance, a fi rm moves from being a domestic entity to a regional or global one, new laws and regulations will apply, and perhaps new threats will exist and new security strategies must be formed.
■ Evolving industry best practices. Best practices change, and new best practices arise with the introduction of each successive wave of technology and with changes in the business environment. The program should consider and leverage new best practices.
■ Fixing program shortcomings. Addressing fl aws in the IG program that are dis- covered through testing, monitoring, and auditing; or addressing an actual breach of confi dential information; or a legal sanction imposed due to non- compliance are all reasons why a program must be revisited periodically and kept updated. 3
352 INFORMATION GOVERNANCE
c18 352 February 28, 2014 1:51 PM
Maintaining the IG program requires that a senior-level offi cer of the en- terprise continues to sponsor it and pushes for enforcement, improvement, and expansion. This requires leadership and consistent and clear messages to employees. IG and the security of information assets must be on the minds of all members of the enterprise; it must be something they are aware of and think about daily. They must be on the lookout for ways to improve it, and they should be rewarded for those contributions.
Gaining this level of mindshare in employees’ heads will require follow-up messages in the form of personal speeches and presentations, newsletters, corporate announcements, e-mail messages, and even posters placed at strategic points (e.g., near the shared printing station advising about secure procedures). Employees must be reminded that information governance is everyone’s job and meeting compliance and legal demands help contribute to achieving business objectives, and also that los- ing, misusing, or leaking confi dential information harms the organization over the long term and erodes its value.
Maintaining the IG program requires that a senior-level offi cer of the enter- prise continues to push for enforcement, improvement, and expansion of the program to secure and control information.
CHAPTER SUMMARY: KEY POINTS
■ Keeping an enterprise’s IG program effective requires vigilant and consistent monitoring and auditing to ensure that IG are followed and enforced.
■ Information technologies that can assist in advancing the program must be steadily monitored, evaluated, and implemented.
■ To maintain and improve the IG program requires monitoring tools, regular audits, and regular meetings for discussion and approval of changes to the program to continually improve it.
■ IG programs need built-in staffi ng redundancies to ensure their continued operation in the event of employee turnover or transfer.
■ Organizations need to continuously improve their program for securing in- formation assets due to:
■ Changing technology
■ Changing laws and regulations
MAINTAINING AN INFORMATION GOVERNANCE PROGRAM 353
c18 353 February 28, 2014 1:51 PM
Notes
1. Mark Woeppel, “Is Your Continuous Improvement Organization a Profi t Center?” June 15, 2009, www.processexcellencenetwork.com/process-management/articles/is-your-continuous-improvement- organization-a-prof/ (accessed September 12, 2011).
2. Donald Clark, “Continuous Process Improvement,” Big Dog and Little Dog’s Performance Juxtaposi- tion (blog), March 11, 2010, www.nwlink.com/~donclark/perform/process.html (accessed September 12, 2011).
3. Randolph Kahn and Barclay T. Blair, Information Nation: Seven Keys to Information Management Compli- ance (New York: AIIM International, 2004), pp. 242–243.
■ Internal information governance requirements
■ Changing business plans
■ Evolving industry best practices
■ Program shortcomings
■ Maintaining an IG program requires that a senior-level offi cer of the enter- prise continues to push for enforcement, improvement, and expansion of the program to secure and control information.
CHAPTER SUMMARY: KEY POINTS (Continued )
355
bapp01_01 355 March 10, 2014 10:12 PM
By Barb Blackburn, CRM, with Robert Small- wood; edited by Seth Earley
A P P E N D I X A Information Organization and Classifi cation: Taxonomies and Metadata*
* Portions of this appendix are adapted from Chapter 6 and 16, Robert F. Smallwood, Managing Electronic Records: Methods, Best Practices, and Technologies , © John Wiley & Sons, Inc., 2013. Reproduced with permission of John Wiley s & Sons, Inc.
Information governance (IG) necessarily involves organizing and classifying information. IG is critical to enabling improved search results to base business deci-sions on, executing records retention schedule (RRS) tasks, and sifting through and fi nding responsive (relevant) information in the e-discovery process. Well-organized information constructs provide downstream benefi ts across the organization in not only compliance and legal efforts but also day-to-day decision-making and knowledge worker productivity. It is even more crucial in the era of Big Data.
The creation of electronic documents and records is exploding exponentially and multiplying at an increasing rate. Sifting through all this information results in a lot of wasted, unproductive (and expensive) knowledge worker time. This has real costs to the enterprise. According to the study “The High Cost of Not Finding Information,” “knowledge workers spend at least 15 to 25 percent of the workday searching for information. Only half the searches are successful.”1 Experts point to poor taxonomy design as being at the root of these failed searches and lost productivity.
Taxonomies are at the heart of the solution to harnessing and governing information. Taxonomies are hierarchical classifi cation structures used to standardize the s naming and organization of information, and their role and use in managing electronic records cannot be overestimated.
Although the topic of taxonomies can get complex, in electronic records man- agement (ERM) they are a sort of online card catalog that is cross-referenced witht hyperlinks that is used to organize and manage records and documents. 2
According to Forrester Research, taxonomies “represent agreed-upon terms and relationships between ideas or things and serve as a glossary or knowledge map help- ing to defi ne how the business thinks about itself and represents itself, its products and services to the outside world.” 3
Information Governance: Concepts, Strategies and Best Practices By Robert F. Smallwood Copyright © 2014 by Robert F. Smallwood
356 APPENDIX A
bapp01_01 356 March 10, 2014 10:12 PM
Gartner Group researchers warn that “to get value from the vast quantities of in- formation and knowledge, enterprises must establish discipline and a system of gover- nance over the creation, capture, organization, access, and utilization of information.”4
Over time, organizations have implemented taxonomies to attempt to gain control over their mounting masses of information, creating an orderly structure to harness unstructured information (such as e-documents, e-mail messages, scanned records, and other digital assets), and to improve searchability and access. 5
Taxonomies for ERM standardize the vocabulary used to describe records, making it easier and faster for searches and retrievals to be made.
Search engines are able to deliver faster and more accurate results from good taxonomy design by limiting and standardizing terms. A robust and effi cient taxonomy design is the underpinning that indexes collections of documents uniformly and helps knowledge workers fi nd the proper fi les to complete their work. The way a taxonomy is organized and implemented is critical to the long-term success of any enterprise, as it directly impacts the quality and productivity of knowledge workers who need orga- nized, trusted information to make business decisions.
It does not sound so complicated, simply categorizing and cataloging information, yet most enterprises have had disappointing or inconsistent results from the taxono- mies they use to organize information. Designing taxonomies is hard work. Developing an effi cient and consistent taxonomy is a detailed, tedious, labor-intensive team effort on the front end, and its maintenance must be consistent and regular and follow estab- lished IG guidelines in order to maintain its effectiveness.
Once a taxonomy is in place, it requires systematic updates and reviews to ensure that guidelines are being followed and new document and record types are included in the taxonomy structure. Technology tools like text mining, social tagging, and auto- classifi cation can help uncover trends and suggest candidate terms. (More on these technologies later in this chapter.)
When done correctly, the business benefi ts of good taxonomy design go much further than speeding search and retrieval; an effi cient, operational taxonomy also is a part of IG efforts that help the organization to manage and control information so that it may effi ciently respond to litigation requests, comply with governmental regu- lations, and meet customer needs (both external and internal).
Taxonomies are crucial to fi nding information and optimizing knowledge worker pro- ductivity, yet some surveys estimate that nearly half of organizations do not have a standardized taxonomy in place. 6
Knowledge workers spend at least 15 to 25 percent of the workday searching for information with only half the searches being successful.
To maximize effi cient and effective retrieval of records for legal, business, and regulatory purposes, organizations must develop and implement taxonomies.
INFORMATION ORGANIZATION AND CLASSIFICATION: TAXONOMIES AND METADATA 357
bapp01_01 357 March 10, 2014 10:12 PM
According to the Montague Institute:
The way your company organizes information (i.e., its taxonomy) is critical to its future. A taxonomy not only frames the way people make decisions, but also helps them fi nd the information to weigh all the alternatives. A good taxonomy helps decision makers see all the perspectives, and “drill down” to get details from each , and explore lateral relationships among them.7 (Emphasis added.)
Without a taxonomy, your company will fi nd it diffi cult to leverage intellectual capital, engage in electronic commerce, keep up with employee training, and get the most out of strategic partnerships.
With the explosion in growth of electronic documents and records, a standardized classifi - cation structure that a taxonomy imposes optimizes records retrievals for daily business opera- tions and also for legal and regulatory demands. s 8
Since end users can choose from topic areas, subject categories, or groups of docu- ments rather than blindly typing word searches, taxonomies narrow searches and speed search time and retrieval.9
“The link between taxonomies and usability is a strong one. The best taxonomies effi ciently guide users to exactly the content they need. Usability is judged in part by how easily content can be found,” according to the Montague Institute.10
Importance of Navigation and Classifi cation
Taxonomies need to be considered from two main perspectives: navigation and classifi cation. Most people consider the former, but not the latter. The navigational con- struct that is represented by a taxonomy is evident in most fi le structures and fi le shares—the nesting of folders within folders—and in many Web applications where users are navigating hierarchical arrangements of pages or links. However, classifi ca- tion is frequently behind the scenes. A document can “live” in a folder that the user can navigate to. But within that folder, the document can be classifi ed in different ways through the application of metadata. Metadata are descriptive fi elds that delineate a (document or) record’s characteristics, such as author, title, department of origin, date created, length, number of pages or fi le size, and so forth. The metadata is also part of the taxonomy or related to the taxonomy. In this way, usability can be impacted by giving the user multiple ways to retrieve their information. s 11
Taxonomies speed up the process of retrieving records because end users can select from subject categories or topics.
Taxonomies need to be considered from two main perspectives: navigation and classifi cation.
358 APPENDIX A
bapp01_01 358 March 10, 2014 10:12 PM
When Is a New Taxonomy Needed?
In some cases, organizations have existing taxonomy structures, but they have gone out of date or have not been maintained. They may not have been developed with best practices in mind or with correct representation of user groups, tasks, or applications. There are many reasons why taxonomies no longer provide the full value that they can offer. Certain situations clearly indicate that the organization needs a refactored or new taxonomy.12
If knowledge workers in your organization regularly conduct searches and receive hundreds of pages of results, then you need a new taxonomy. If you have developed a vast knowledge base of documents and records and designated subject matter ex- perts (SMEs), yet employees struggle to fi nd answers, you need a new taxonomy. If there is no standardization of the way content is classifi ed and cataloged, or there is confl ict between how different groups or business units classify content, you need a new taxonomy. And if your organization has experienced delays, fi nes, or undue costs in producing documentation to meet compliance requests or legal demands, your or- ganization needs to work on a new taxonomy. 13
Taxonomies Improve Search Results
Taxonomies can improve a search engine’s ability to deliver results to user queries in fi nding documents and records in an enterprise. The way the digital content is indexed (e.g., spidering, crawling, rule sets, algorithms) is a separate issue, and a good taxonomy improves search results regardless of the indexing method. 14
Search engines struggle to deliver accurate and refi ned results since the wording in queries may vary and since words can have multiple meanings. A taxonomy ad- dresses these problems since the terms are set and defi ned in a controlled vocabulary. y
Metadata (data fi elds that describe content, such as document type, creator, date of creation, etc.) must be leveraged in the taxonomy design effort.
A formal defi nition of metadata is “standardized administrative or descriptive data about a document [or record] that is common for all documents [or records] in a given repository.” Standardized metadata elements of e-documents should be utilized and supported by including them in controlled vocabularies when possible. 15
The goal of a taxonomy development effort is to help users fi nd the information they need, in a logical and familiar way, even if they are not sure what the correct search terminology is. Good taxonomy design makes it easier and more comfortable for users
Taxonomies improve search results by increasing accuracy and also improving the user experience.
Poor search results, inconsistent or confl icting fi le plans, and the inability to locate information on a timely basis are indications taxonomy work is needed.
INFORMATION ORGANIZATION AND CLASSIFICATION: TAXONOMIES AND METADATA 359
bapp01_01 359 March 10, 2014 10:12 PM
to browse topics and drill down into more narrow searches to fi nd the documents and records they need. Where it really becomes useful and helps contribute to productivity is when complex or compound searches are conducted.
Metadata and Taxonomy
One potential limitation of a purely hierarchical taxonomy is the lack of association be- tween tiers (or nodes). There are often one-to-many or many-to-many associations be- tween records. For example, an employee travels to a certifi cation course. The resultant “expense report” is classifi ed in the Finance/Accounts Payable/Travel Expense node of the taxonomy. The “course completion certifi cate” that is generated from the same travel (and is included as backup documentation for the expense report) is appropriately classifi ed in the Human Resources/Training and Certifi cation/Continuing Education node. For ERM systems that do not provide the functionality for a multifaceted taxonomy, metadata is used to provide the link between the nodes in the taxonomy (see Figure A.1 ).
Metadata, which are the characteristics of a document expressed in data fi elds, must be leveraged in taxonomy design.
Figure A.1 Metadata Link to Taxonomy Example Source: Blackburn Consulting
Finance
Accounts Payable
Travel Expense
Taxonomy
Human Resources
Applicant
Processing
Position Posting
M e ta
d a ta
L in
k
Training and
Certification
Continuing Education
Course
Completion Certificate
Expense Report
Title: Expense Report
Travel Date: 12/01/2004
Employee ID: 999-99-9999
(etc. ...)
Title: Course Completion Certificate
Subject: Real Estate
Employee ID: 999-99-9999 (etc. ...)
Metadata
Employee ID: 999-99-9999
360 APPENDIX A
bapp01_01 360 March 10, 2014 10:12 PM
Metadata schema must be structured to provide the appropriate associations as well as meet the users’ keyword search needs. It is important to limit the number of meta- data fi elds that a user must manually apply to records. Most recordkeeping systems provide the functionality to automatically assign certain metadata to records based on rules that are established in advance and set up by a system administrator (referred in this book as inherited metadata ). The record’s classifi cation or location in the taxonomy is appropriate for inherited metadata.
Metadata can also be applied by auto-categorization software. This can reduce the bur- den placed on the user and increase the quality and consistency of metadata. These approaches need to be tested and fi ne-tuned in order to ensure that they meet the needs of the organization. 16
The fi le plan will provide the necessary data to link the taxonomy to the docu- ment via inherited metadata. In most systems, this metadata is applied by the system and is transparent to the users. Additional metadata will need to be applied by the user. To maintain consistency, a thesaurus , which contains all synonyms and defi nitions, is used to enforce naming conventions (see Figure A.2 ).
Metadata Governance, Standards, and Strategies
Metadata can be a scary term to a lot of people. It just sounds complicated. And it s can get complicated. It is often defi ned as “data about data,” which is true but some- what confusing, and this does not provide enough information for most people to understand.
Figure A.2 Application of Metadata to Taxonomy Structure Source: Blackburn Consulting
Applying Metadata
Taxonomy
Services for Citizens
Mode of Delivery
Support Delivery
of Services
Management of Government
Resources
Human Resources
Applicant Processing
Position Posting
Announce- ment
Metadata
Thesaurus File Plan
User Supplied: Inherited: Business Area: Human Resources Function: Applicant Processing Subfunction: Position Posting
Title: Position Announcement Date: Position Title: (etc. ...)
INFORMATION ORGANIZATION AND CLASSIFICATION: TAXONOMIES AND METADATA 361
bapp01_01 361 March 10, 2014 10:12 PM
“Meta” derives from a Greek word that means “alongside, with, after, next.” Meta- data can be defi ned as “structured data about other data.” 17
In ERM, metadata identifi es a record and its contents. ERM metadata describes a record’s characteristics so that it may be classifi ed more easily and completely. Metadata fi elds, or terms, for e-records can be as basic as identifying the name of the document, the creator or originating department, the subject, the date it was created, the document type, the length of the document, its security classifi cation, and its fi le type.
Creating standardized metadata terms is part of an IG effort that enables faster, more complete, and more accurate searches and retrieval of records. This is impor- tant not only in everyday business operations but also, for example, when searching through potentially millions of records during the discovery phase of litigation.
Good metadata management also assists in the maintenance of corporate memory and in improving accountability in business operations. 18
Using a standardized format and controlled vocabulary provides a “precise and comprehensible description of content, location, and value.”19 Using a controlled vo- cabulary means your organization has standardized a set of terms used for metadata elements describing records. This “ensures consistency across a collection” and helps with optimiz- ing search and retrieval functions and records research as well as meeting e-discovery requests, compliance demands, and other legal and regulatory requirements. Your organization may, for instance, decide to use the standardized Library of Congress Subject Headings as standard terms for the “subject” metadata fi eld. 20
Metadata also describes a record’s relationships with other documents and records and s what actions may have been taken on the record over time. This helps to track its his- tory and development.
The role of metadata in managing records is multifaceted; it helps to:
■ Identify the records, record creators and users, and the areas within which they are utilized.
■ Determine the relationships between records and the knowledge workers who use them, and the relationships between the records and the business processes they are supporting.
■ Assist in managing and preserving the content and structure of the record. ■ Support IG efforts that outline who has access to records and the context (when
and where) in which access to the records is granted. ■ Provide an audit trail to document changes to or actions on the record and its
metadata. ■ Support the fi nding and understanding of records and their relationships. 21
In addition, good metadata management provides additional business benefi ts in- cluding increased management control over records, improved records authenticity and security, and reusability of metadata.22
Metadata terms or fi elds describe a record’s characteristics so that it may be classifi ed, managed, and found more easily.
362 APPENDIX A
bapp01_01 362 March 10, 2014 10:12 PM
Often, organizations will establish mandatory metadata terms that must accom- pany a record and some optional ones that may help in identifying and fi nding it. A record is more complete with more metadata terms included, which also facilitates search and retrieval of records.23 This additional metadata is particularly helpful when knowledge workers are not quite sure which records they are searching for and therefore enter some vague or conceptual search terms. The more detail that is in the metadata fi elds, the more likely—and faster—that end users can fi nd the records they need to complete their work. Populating metadata fi elds provides a measurable productivity benefi t to the organization, although it is diffi cult to quantify. Certainly, search times will de- crease upon implementation of a standardized metadata program, and improved work output and decisions will also follow.
Standardizing the metadata terms, defi nitions, and classifi cations for documents and records is done by developing and enforcing IG policy. This standardization effort gives users confi dence that the records they are looking for are, in fact, the complete and current set they need to work with. And it provides the basis for a legally defensible records management (RM) program that will hold up in court.
A metadata governance program must be an ongoing effort that keeps metadata up to date and accurate. Often, once a metadata project is complete, attention to it wanes, mainte- nance tasks are not executed, and soon the accuracy and completeness of searches for documents and records deteriorates. So metadata maintenance is an ongoing process, and it must be formalized into a program that is periodically checked, tested, and audited.
Types of Metadata
Several types or categories of metadata are described next.
Administrative metadata. Metadata that includes management information about the digital resource, such as ownership and rights management.
Descriptive metadata. Metadata that describes the intellectual content of a resource and is used for the indexing, discovery, and identifi cation of a digital resource.
Preservation metadata. Metadata that specifi cally captures information that helps facilitate management and access to digital fi les over time. This inherently
Metadata terms can be as basic as the name of the document, the creator, the subject, the date it was created, the document type, the length of the docu- ment, its security classifi cation, and its fi le type.
A metadata governance and management program must be ongoing.
INFORMATION ORGANIZATION AND CLASSIFICATION: TAXONOMIES AND METADATA 363
bapp01_01 363 March 10, 2014 10:12 PM
includes descriptive, administrative, structural, and technical metadata elements that focus on the provenance, authenticity, preservation activity, technical envi- ronment, and rights management of an object.
Structural metadata. Metadata that is used to display and navigate digital resources and describes relationships between multiple digital fi les, such as page order in a digitized book.
Technical metadata. Metadata that describes the features of the digital fi le, such as resolution, pixel dimension, and hardware. The information is critical for migration and long-term sustainability of the digital resource. 24
Core Metadata Issues
Some key considerations and questions that need to be answered for effective imple- mentation of a metadata governance program are listed next.
■ Who is the audience? Which users will be using the metadata in their daily opera- tions? What is their skill level? Which metadata terms/fi elds are most important to them? What has been their approach to working with documents and records in the past, and how can it be streamlined or improved? What terms are im- portant to management? How can the metadata schema be designed to accom- modate the primary audience and other secondary audiences? Answers to these questions will come only with close consultation with these key stakeholders.
■ Who else can help? That is, which other stakeholders can help build a consensus on the best metadata strategy and approach? What other records creators, us- ers, custodians, auditors, and legal counsel personnel can be added to the team to design a metadata approach that maximizes its value to the organization? Are there subject matter experts (SMEs)? What standards and best practices can be applied across functional boundaries to improve the ability of various groups to collaborate and leverage the metadata?
■ How can metadata governance be implemented and maintained? Creating IG guidelines? and rules for metadata assignment, input, and upkeep are a critical step—but how will the program continue to be updated to maintain its value to the organization? What business processes and audit checks should be in place? How will the quality of the metadata be monitored and controlled? Who is accountable?
■ What will the user training program look like? How will users be trained initially, and how will continued education and reinforcement be communicated? Will there be periodic meetings of the IG or metadata team to discuss issues and concerns? What is the process for adding or amending metadata terms as the business progresses and changes? These questions must be answered, and a documented plan must be in place.
The main types of metadata are: administrative, descriptive, preservation, structural, and technical metadata.
364 APPENDIX A
bapp01_01 364 March 10, 2014 10:12 PM
■ What will the communications plan be? Management time and resources are also needed to continue the practice of informing and updating users, and encour- aging compliance with internal metadata standards and policies. Users need to know on a consistent basis why metadata is important and the value that good metadata management can bring to the organization.
International Metadata Standards and Guidance
Metadata is what gives an e-record its record status; in other words, electronic records metadata is what makes an electronic fi le a record. There are a number of established international standards for metadata structure, and additional guidance on strategy and implementation has been provided by standards groups, such as the International Organization for Standardization (ISO) and American National Standards Institute/ National Information Standards Organization (ANSI/NISO), and other bodies, such as the Dublin Core Metadata Initiative (DCMI).
ISO 15489 Records Management Defi nitions and Relevance
The international RM standard ISO 15489 states that “a record should correctly re- fl ect what was communicated or decided or what action was taken. It should be able to support the needs of the business to which it relates and be used for accountability purposes.” Its metadata defi nition is “data describing context, content, and structure of records and their management through time.” 25
A key difference between a document and a record is that a record is fi xed, whereas a document can continue to be edited. Preventing records from being edited can be ac- complished in part by indicating their formal record status in a metadata fi eld, among other controls.
Proving that a record is, in fact, authentic and reliable necessarily includes prov- ing that its metadata has remained intact and unaltered through the entire chain of custody of the record.
ISO Technical Specifi cation 23081–1:2006 Information and Documentation—Records Management Processes—Metadata for Records—Part 1: Principles
[ISO 23081–1] covers the principles that underpin and govern records man- agement metadata. These principles apply through time to:
■ Records and their metadata; ■ all processes that affect them;
Proving that a record is authentic and reliable includes proving that its metadata has remained intact and unaltered through the record’s entire chain of custody.
INFORMATION ORGANIZATION AND CLASSIFICATION: TAXONOMIES AND METADATA 365
bapp01_01 365 March 10, 2014 10:12 PM
■ any system in which they reside; ■ any organization that is responsible for their management. 26
This standard provides guidance for metadata management within the “frame- work” of ISO 15489 and addresses the relevance and roles that metadata plays in RM intensive business processes. There are no mandatory metadata terms set, as these will differ by organization and by location and governing national and state/provincial laws. 27 The standard lists 10 purposes or benefi ts of using metadata in records manage- ment, which can help build the argument for convincing users and managers of the importance of good metadata governance and its resultant benefi ts.
Dublin Core Metadata Initiative
The DCMI produced a basic or core set of metadata terms that have served as the basis for many public and private sector metadata governance initiatives. Initial work in workshops fi lled with experts from around the world took place in 1995 in Dublin, Ohio ( not Ireland). From these working groups arose the idea of a set of “core meta-t data” or essential metadata elements with generic descriptions. “The fi fteen-element ‘Dublin Core’ achieved wide dissemination as part of the Open Archives Initiative Protocol for Metadata Harvesting (OAI-PMH) and has been ratifi ed as IETF RFC 5013, ANSI/NISO Standard Z39.85–2007, and ISO Standard 15836:2009.” 28
Dublin Core has as its goals:
Simplicity of creation and maintenance The Dublin Core element set has been kept as small and simple as possible to allow a nonspecialist to create simple descriptive records for information resources easily and inexpensively, while providing for effective retrieval of those resources in the networked environment. Commonly understood semantics Discovery of information across the vast commons of the Internet is hin- dered by differences in terminology and descriptive practices from one fi eld of knowledge to the next. The Dublin Core can help the “digital tourist”—a nonspecialist searcher—fi nd his or her way by supporting a common set of elements, the semantics of which are universally understood and supported. For example, scientists concerned with locating articles by a particular
ISO 23081 defi nes needed metadata for records and provides guidance for metadata management within the “framework” of ISO 15489.
Goals of the Dublin Core Metadata Initiative are simplicity, commonly under- stood semantics, international scope, and extensibility.
366 APPENDIX A
bapp01_01 366 March 10, 2014 10:12 PM
author, and art scholars interested in works by a particular artist, can agree on the importance of a “creator” element. Such convergence on a common, if slightly more generic, element set increases the visibility and accessibility of all resources, both within a given discipline and beyond. International scope The Dublin Core Element Set was originally developed in English, but ver- sions are being created in many other languages, including Finnish, Norwegian, Thai, Japanese, French, Portuguese, German, Greek, Indonesian, and Spanish. The DCMI Localization and Internationalization Special Interest Group is coordinating efforts to link these versions in a distributed registry. Although the technical challenges of internationalization on the World Wide Web have not been directly addressed by the Dublin Core development com- munity, the involvement of representatives from virtually every continent has ensured that the development of the standard considers the multilingual and multicultural nature of the electronic information universe. Extensibility While balancing the needs for simplicity in describing digital resources with the need for precise retrieval, Dublin Core developers have recognized the impor- tance of providing a mechanism for extending the DC [Dublin Core] element set for additional resource discovery needs. It is expected that other commu- nities of metadata experts will create and administer additional metadata sets, specialized to the needs of their communities. Metadata elements from these sets could be used in conjunction with Dublin Core metadata to meet the need for interoperability. The DCMI Usage Board is presently working on a model for accomplishing this in the context of “application profi les.” 29 The fi fteen element “Dublin Core” described in this standard is part of a larger set of metadata vocabularies and technical specifi cations maintained by the Dublin Core Metadata Initiative. . . . The full set of vocabularies, DCMI Metadata Terms . . . , also includes sets of resource classes (including the DCMI Type Vocabulary . . . ), vocabulary encoding schemes, and syntax encoding schemes. The terms in DCMI vocabularies are intended to be used in combination with terms from other, compatible vocabularies in the context of application profi les and on the basis of the DCMI Abstract Model. 30
Global Information Locator Service
Global Information Locator Service (GILS) is ISO 23950, the international standard for information searching over networked (client/server) computers, which is a sim- plifi ed version of structured query language (SQL). ISO 23950 is a federated search protocol that equates to the U.S. standard ANSI/NISO Z39.50. The U.S. Library of Congress is the offi cial maintenance agency for both standards, “which are technically identical (though with minor editorial differences).” 31
ISO 23950 grew out of the library science community, although it is widely used, particularly in the public sector. 32 The use of GILS has tapered off as other meta- data standards at the international, national, industry level, and agency level have been established. 33
INFORMATION ORGANIZATION AND CLASSIFICATION: TAXONOMIES AND METADATA 367
bapp01_01 367 March 10, 2014 10:12 PM
“It [GILS] specifi es procedures and formats for a client to search a database provid- ed by a server, retrieve database records, and perform related information retrieval func- tions.” It does not specify a format, but information retrieval can be accomplished through full-text search, although it “also supports large, complex information collections.” 34 The standard specifi es how searches are made and how results are returned.
GILS helps people fi nd information, especially in large, complex environments, such as across multiple government agencies. It is used in more than 40 U.S. states and a number of countries, including Argentina, Australia, Brazil, Canada, France, Germany, Hong Kong, India, Spain, Sweden, Switzerland, United Kingdom, and many others.
Text Mining
On a continuing basis, text mining can be conducted on documents to learn of emerg- ing potential taxonomy terms. Text mining is simply performing detailed full-text searches on the content of document. And with more sophisticated tools like neural computing and artifi cial intelligence, concepts, not just keywords, can be discovered and leveraged for improving search quality for users.
Another tool is the faceted search (sometimes referred to as faceted navigation or faceted browsing), where, for instance, document collections are classifi ed in multiple ways rather than in a single, rigid taxonomy. Knowledge workers may apply multiple fi lters to search across documents and records and fi nd better and more complete results. And when they are not quite sure what they are looking for, or if it exists, a good taxonomy can help suggest terms, related terms, and associated content, truly contributing to enterprise knowledge management (KM) efforts, adding to corpo-t rate memory and increasing the organizational knowledge base. 35 Good KM helps to provide valuable training content for new employees and helps to reduce the impact of turnover and retiring employees.
Search is ultimately about metadata —whether your content has explicit metadata or not. The search engine creates a forward index and determines what words are contained in the documents being searched. It then inverts that index to provide the documents that words are contained in. This is effectively metadata about the content. A taxonomy can be used to enrich that search index in various ways. Index enrichment does require confi guration and integration with search engines, but the result is the ability to increase both precision and recall of search results. Search results can also be grouped and clustered using a taxonomy. Doing this allows large numbers of results
ISO 23950 (GILS) is the international standard for information searching over networked computers.
Text mining is simply performing detailed full-text searches on the content of document.
368 APPENDIX A
bapp01_01 368 March 10, 2014 10:12 PM
to be scanned and understood by the user more easily. Many of these functions are de- termined by the capabilities of search tools and document and RM systems. As search functionality is developed, do not miss this opportunity to leverage the taxonomy.
Records Grouping Rationale
Records are grouped together for fi ve primary reasons:
1. They tie together documents with like content, purpose, or theme. 2. To improve search and retrieval capabilities. 3. To identify content creators, owners, and managers. 4. To provide an understandable context. 5. For retention and disposition scheduling purposes.36
Taxonomies group records with common attributes. The groupings are constructed not only for RM classifi cation and functions but also to support end users in their search and retrieval activities. Associating documents of a similar theme enables users to fi nd documents when they do not know the exact document name. Choosing the theme or topic enables the users to narrow their search to fi nd the relevant information.
The theme or grouping also places the document name into context. Words have many meanings and adding a theme to them further defi nes them. For example, the word “article” could pertain to a newspaper article, an item or object, or a section of a legal document. If it were grouped with publications, periodicals, and so on, the mean- ing would be clear. The challenge here is when to choose to have a separate category for “article” or to group “article” with other similar publications. Some people tend to develop fi ner levels of granularity in classifi cation structures. These people can be called “splitters.” Those who group things together are “lumpers.” But there can be clear rules for when to lump versus split. Experts recommend splitting into another category when business needs demand that we treat the content differently or users need to seg- ment the content for some purpose. This rule can be applied to many situations when trying to determine whether a new category is needed. 37
Management, security, and access requirements are usually based on a user’s role in a process. Grouping documents based on processes makes the job of assigning the responsibilities and access easier. For example, documents used in fi nancial processes can be sensitive, and there is a need to restrict access to only those users that have the role in the business with a need to know.
Records retention periods are developed to be applied to a series (or group) of documents. When similar documents are grouped, it is easier to apply retention rules. However, when the grouping for retention is not the same as the grouping for other user views, a cross-mapping ( fi le plan ) scheme must be developed and incorporated into the taxonomy effort.
Business Classifi cation Scheme, File Plans, and Taxonomy
In its simplest defi nition, a business classifi cation scheme (BCS) is a hierarchical conceptual representation of the business activity performed by an organization. 38 The highest level of a BCS is called an information series, which signifi es “high-level
INFORMATION ORGANIZATION AND CLASSIFICATION: TAXONOMIES AND METADATA 369
bapp01_01 369 March 10, 2014 10:12 PM
business functions” of a business or governmental agency. The next level is themes, which represent the specifi c activities that feed into the high-level functions at the information series level. These two top levels are rarely changed in an organization.39
A BCS is often viewed as synonymous with the term “fi le plan,” which is the shared fi le structure in an ERM system, but it is not a direct fi le plan.
Yet a fi le plan can be developed and mapped back to the BCS and automated through an electronic document and records management system (EDRMS) or ERM system.40
A BCS is required by ISO 15489, the international RM standard. Together with the folders and records it contains, the BCS comprises what in the paper environment was called simply a “fi le plan.” A BCS is therefore a full representation of the business of an organization.
Classifi cation and Taxonomy
Classifi cation of records extends beyond the categorization of records in the taxonomy. It also must include the application of retention requirements. These are legal and busi- ness requirements that specify the length of time a record must be maintained. A records retention schedule is a document that specifi es the periods for which an organization’s records should be retained to meet its operational needs and to comply with legal and other requirements. The RRS groups documents into records series that relate to specifi c business activities. This grouping is performed because laws and regulations are mainly based on the business activity that creates the documents. These business activities are not neces- sarily the same as the activities described in the hierarchy of the taxonomy. Therefore, there must be a method to map the RRS to the Taxonomy. This is accomplished with a File Plan. The File Plan facilitates the application of retention rules during document categorization without requiring a user to know or understand the RRS (see Figure A.3 ).
Finance
Accounts Payable
Travel Expense
Taxonomy
Record Series 10
File Plan Retention Schedule
Classification
Retention Requirement #1
Retention Requirement #2
Retention Requirement #3
Retention Requirement #4
Retention Requirement #5
Retention Requirement #6
Retention Requirement #7
Record Series 20
Record Series 20-02
Record Series 10-08
Human Resources
Applicant Processing
Position Posting
FN-AP-10
FN-AP-10-08
HS-AP -20
HS-A P-20-
02
Business Function
Business Function
Business Function
Travel
Request
Form
Expense
Report
Job
Announce-
ment
Figure A.3 Mapping the Records Retention Schedule to the Taxonomy Source: Blackburn Consulting
370 APPENDIX A
bapp01_01 370 March 10, 2014 10:12 PM
Prebuilt versus Custom Taxonomies
Taxonomy templates for specifi c vertical industries (e.g., law, pharmaceuticals, aero- space) are provided by ECM, ERM/EDRMS, KM, enterprise search vendors, and trade associations. These prebuilt taxonomies use consistent terminology, have been tried and tested, and incorporate industry best practices, where possible. They can provide a jump-start and faster implementation at a lower cost than developing a cus- tom taxonomy in-house or with external consulting assistance.
There are advantages and disadvantages to each approach. A prebuilt taxonomy typically will have some parameters that can be confi gured to better meet the busi- ness needs of an organization, yet compromises and trade-offs will have to be made. It also may introduce unfamiliar terminology that knowledge workers will be forced to adapt to, increasing training time and costs, and reducing overall effectiveness. These considerations must be factored into the build-or-buy decision. Using the custom- developed approach, a taxonomy can be tailored to meet the precise business needs of an organization or business unit and can include nuances such as company-specifi c nomenclature and terminology. 41
Frequently, the longer and more costly customized approach must be used, since no prebuilt taxonomies fi t well. This is especially the case with niche enterprises or those operating in developing or esoteric markets. For mature industries, more pre- built taxonomies and template choices exist. Attempting to tailor a prebuilt taxonomy actually can end up taking longer than building one from scratch if it is not a good fi t in the fi rst place, so best practices dictate that organizations use prebuilt taxonomies where practical and custom-design taxonomies where needed.
There really is no one size fi ts all when it comes to taxonomy. And even when two or- ganizations do the exact same thing in the exact same industry, differences in their culture, process, and content will require customization and tuning of the taxonomy. Standards are useful for improving effi ciency of a process, and taxonomy projects really are internal standards projects. However, competitive advantage is attained through differentiation. A taxonomy specifi cally tuned to meet the needs of a particular enter- prise is actually a competitive advantage. 42
There is one other alternative, which is to “auto-generate” a taxonomy from the metadata in a collection of e-documents and records by using sophisticated statisti- cal techniques, such as term frequency and entity extraction, to attempt to create a taxonomy. 43 This method seems to be perhaps the best of both worlds in that it offers instant customization at a low cost, but, although these types of tools can help provide useful insights into the data on the front end of a taxonomy project and help provide valuable statistical renderings, the only way to focus on user needs is to interview and work with users to gain insights into their business process needs and requirements while considering the business objectives of the taxonomy project. This cannot be done with mathematical computations—the human factor is key.
Best practices dictate that taxonomy development includes designing the taxonomy structure and heuristic principles to align with user needs.
INFORMATION ORGANIZATION AND CLASSIFICATION: TAXONOMIES AND METADATA 371
bapp01_01 371 March 10, 2014 10:12 PM
In essence, these auto-generated taxonomy tools can determine which terms and documents are used frequently, but they cannot assess the real value of information be- ing used by knowledge workers and how they use the information. That takes consulta- tion with stakeholders, studied observation, and business analysis. 44 Machine-generated taxonomies look like they were generated by machines —which is to say, they are not very ss usable by humans. 45
Thesaurus Use in Taxonomies
In the use of taxonomies, a thesaurus contains the agreed-on synonyms and similar names for terms used in a controlled vocabulary. So, “invoice” may be listed as the equivalent term for “bill” when categorizing records. The thesaurus goes further and lists “information about each term and their relationships to other terms within the same thesaurus.”
A thesaurus is similar to a hierarchical taxonomy but also includes “associative relationships.” 46 An associative relationship is a conceptual relationship. It is the “see also” that we may come across in the back of the book index. But the question is, why do we want to see it? Associative relationships can provide a linkage to specifi c classes of in- formation of interest to users and for particular processes. Use of associative relation- ships can provide a great deal of functionality in content and document management systems and needs to be considered in RM applications. 47
There are international standards for thesauri creation from International ISO, ANSI, and the British Standards Institution (BSI).48
ISO 25964, “Information and Documentation—Thesauri and Interoperability with Other Vocabularies,” “will draw on [the British standard, BS 8723] but reorga- nize the content to fi t into two parts.” Part 1, “Thesauri for Information Retrieval,” of the standard ISO 25964 was published in August 2011. Part 2, “Interoperability with Other Vocabularies,” was approved in 2013. 49
Taxonomy Types
Taxonomies used in ERM systems are usually hierarchical where categories (nodes) in the hierarchy progress from general to specifi c. Each subsequent node is a subset of the higher level node. There are three basic types of hierarchical taxonomies: subject, business-unit, and functional. 50
A subject taxonomy uses controlled terms for subjects. The subject headings are t arranged in alphabetical order by the broadest subjects, with more precise subjects listed under them. An example is the Library of Congress subject headings used to cat- egorize holdings in a library collection (see Figure A.4 ). Even the Yellow Pages could be considered a subject taxonomy.
There are three basic types of hierarchical taxonomies: subject, business unit, and functional.
372 APPENDIX A
bapp01_01 372 March 10, 2014 10:12 PM
It is diffi cult to establish a universally recognized set of terms in a subject taxonomy. If users are unfamiliar with the topic, they may not know the appropriate term heading with which to begin their search. For example, say people are searching through the Yellow Pages for a place to purchase eyeglasses. They begin their search alphabetically by turning to the E’s and scanning for the term “eyeglasses.” Since there are no topics titled “eyeglasses,” they consult the index, fi nd the term “eyeglasses,” and this provides a list of preferred terms or “see alsos” that direct them to “Optical—Re- tail” for a list of eyeglass businesses. (See Figure A.5 .)
In both examples, the subject taxonomy is supported by a thesaurus. Again, a the- saurus is a controlled vocabulary that includes synonyms, related terms, and preferred terms. In the case of the Yellow Pages, the index functions as a basic thesaurus.
In a business unit –based taxonomy, the hierarchy refl ects the organizational chartstt (e.g., department/division/unit). Records are categorized based on the business unit that manages them. Figure A.6 shows the partial detail of one node of a business unit– based taxonomy that was developed for a county government.
One advantage of a business unit–based taxonomy is that it mimics most exist- ing paper-fi ling system schemas. Therefore, users are not required to learn a “new” system. However, confl icts arise when documents are managed or shared among mul- tiple business units. As an example, for the county government referenced earlier, a property transfer document called the “TD1000” is submitted to the recording offi ce for recording and then forwarded to the assessor for property tax evaluation process- ing. This poses a dilemma as to where to categorize the TD1000 in the taxonomy.
Another issue arises with organizational changes. When the organizational struc- ture changes, so must the taxonomy based on business units.
In a functional taxonomy, records are categorized based on the functions andl activities that produce them (function/activity/transaction). The organization’s busi- ness processes are used to establish the taxonomy. The highest or broadest level rep- resents the business functions. The next level down the hierarchy constitutes the
Figure A.4 Library of Congress Subject Headings
...
...
H — SOCIAL SCIENCES J — POLITICAL SCIENCE K — LAW L — EDUCATION M — MUSIC AND BOOKS ON MUSIC N — FINE ARTS P — LANGUAGE AND LITERATURE Q — SCIENCE R — MEDICINE – Subclass RA Public aspects of medicine – Subclass RB Pathology – Subclass RC Internal medicine – RC31-1245 Internal medicine – RC49-52 Psychosomatic medicine – RC251 Constitutional diseases (General)
– RC254-282 Neoplasm. Tumors. Oncology
INFORMATION ORGANIZATION AND CLASSIFICATION: TAXONOMIES AND METADATA 373
bapp01_01 373 March 10, 2014 10:12 PM
Figure A.5 Yellow Pages Example
Eyeglasses
Not listed under “E”
Consult the index for
preferred term
Eyeglasses & Eye Care - see Laser Vision Correction ...121
Optical Goods - Retail .....135
Opticians .........................135
Optometrics, O.D. ............135
Physicians & Surgeons-
Medical & Osteopathic .....140
Safety Equipment
& Clothing ........................164
activities performed for the function. The lowest level in the hierarchy consists of the records that are created as a result of the activity (the transactions ). s
Figure A.7 shows partial detail of one node of a functional taxonomy developed for a state government regulatory agency. The agency organizational structure is based on regulatory programs. Within the program areas are similar (repeated) functions and activities (e.g., permitting, compliance, and enforcement, etc.). When the repeated functions and activities are universalized, the results are a “fl atter” taxonomy. This type of taxonomy is better suited to endure organizational shifts and changes. In addition, the process of universalizing the functions and activities inherently results in broader and
374 APPENDIX A
bapp01_01 374 March 10, 2014 10:12 PM
Figure A.6 County Government Business Unit Taxonomy
...
Assessor Building Commissioners Coroner District Attorney Finance Health and Environment Human Resources Human Services Motor Vehicle Clerk and Recorder Department • Election Divisions • Motor Vehicle • Recording – TD1000 Records – Warranty Deed
– Quitclaim Deed
– Subdivision Plat
Sheriff
Treasury
Accounting
Procurement
Contracts and Agreements
Licensing and Certification
Technical Assistance
Permitting
Compliance and Enforcement Function
• Inspections Activities
• Complaints
• Emergency Response
• Enforcement
– Notice of Violation Transactions
– Consent Decree
– Request for Response Actions
– Stipulation Agreement
Function 4. Permitting
5.5 Enforcement Actions
5.4 Monitoring Reporting
4.1 Registration
4.2 Application
4.3 Public Notice
4.4 Permit Development &
Issuance
4.5 Termination
5.1 Inspections
5.2 Complaints
5.3 Emergency Response &
Preparedness
5. Compliance and Enforcement
Activity
INFORMATION ORGANIZATION AND CLASSIFICATION: TAXONOMIES AND METADATA 375
bapp01_01 375 March 10, 2014 10:12 PM
more generic naming conventions. A functional taxonomy provides fl exibility when adding new record types (transactions) because there will be fewer changes to the hierarchy structure.
One disadvantage of a functional taxonomy is its inability to address case fi les (or project fi les). A case fi le is a collection of records that relate to a particular entity, person, or project. The records in the case fi le can be generated by multiple activities. For ex- ample, at the regulatory agency, enforcement fi les are maintained that contain records generated by enforcement activities (notice of violation, consent decree, etc.) and other ancillary but related activities, such as contracting, inspections, and permitting.
To address the case fi le issue at the regulatory agency, metadata cross-referencing was used to provide a virtual case fi le view of the records collection. (See Figure A.8 .)
A functional taxonomy is better suited to endure organizational changes.
Figure A.8 Metadata Cross-Referencing within a Taxonomy Source: Blackburn Consulting
5. Compliance and Enforcement 5.1. Inspections 5.2. Complaints 5.3. Emergency Response & Preparedness 5.4. Monitoring Reporting 5.5. Enforcement Actions 6. Program Development 6.1. Directives 6.2. Advisory Committees 6.3. Public Notice and Comments 6.4. Hearings 6.5. Rules 6.6. Legislation 7. Communication & Information 7.1. Publications & Fact Sheets 7.2. Graphics Design 7.3. Speeches and Presentations 7.4. Meetings Facilitation 7.5. Media Contact 7.6. Public Contact 7.7. News Releases 7.8. Clipping Service 8. Environmental Review 8.1. Pellion Order 8.2. Environmental Assessment Worksheet 8.3. Environment Impact Statement 8.4. Public Notice/Comment 8.5. Review/Decision 9. Process Improvement 9.1. Six Sigma 10. Approvals 11. Licensing and Certification 11.1. Application Processing 11.2. Fee Collection 11.3. Training and Testing 11.4. Registrant Tracking/List Maintenance 12. TMDL Studies 12.1. Source Identification Ranking 12.2. Implementation Planning 12.3. Data Collection 12.4. Study Results and Recommendations 13. TMDL Implementation 14. Program Management and Leadership 15. Budgeting 16. Accounting 16.1. Accounts Payable 16.2. Experise Reports 16.3 Accounts Receivable 16.4. Financial Reporting 16.5 Payroll 17. Procurement 17.1. Formal Competitive Bid 17.2. Master Contracts 17.3. Informal Bid Process 17.4. Commodities Purchasing 18. Grants-Incoming 18.1. Application/Amendment 18.2. Award or Rejection 18.3. Reporting 18.4. Grants Management Communication
18.5. Closeout
5. Compliance and Enforcement
5.2 Complaints
5.3 Emergency Response & Preparedness
5.1 Inspections
16. Accounting
16.2 Expense Reports
16.3 Account Receivable
16.1 Accounts Payable
5.4 Monitoring Reporting
5.5 Enforcement Actions
16.4 Financial Reporting
16.5 Payroll
21. Contracts and Agreements
21.2 Contracts and Agreements
21.3 Administration and Tracking
21.1 Review and Approval
Emergency
Response
Project File
Duty Officer Report
Purchase Order
Notice of Violation
Contract
Taxonomy
376 APPENDIX A
bapp01_01 376 March 10, 2014 10:12 PM
A hybrid taxonomy is usually the best approach. Certain business units usually do d not change over time. For example, accounting and human resources activities are fairly constant. Those portions of the taxonomy could be constructed in a business unit manner even when other areas within the organization use a functional structure. (See Figure A.9 .)
Faceted taxonomies allow for multiple organizing principles to be applied to information along various dimensions. Facets can contain subjects, departments, busi- ness units, processes, tasks, interests, security levels, and other attributes used to de- scribe information. With faceted taxonomies, there is never really one single taxonomy but rather collections of taxonomies that describe different aspects of information. In the e-commerce world, facets are used to describe brand, size, color, price, and other context-specifi c attributes. RM systems can also be developed with knowledge and process attributes related to the enterprise. 51
Figure A.9 Basic Accounting Business Unit Taxonomy Source: Blackburn Consulting
One disadvantage of a functional taxonomy is its inability to address case fi les (or project fi les).
INFORMATION ORGANIZATION AND CLASSIFICATION: TAXONOMIES AND METADATA 377
bapp01_01 377 March 10, 2014 10:12 PM
Business Process Analysis
To establish the taxonomy, business processes must be documented and analyzed. There are two basic process analysis methods: top down and bottom up. In the top-down method, a high-level analysis of business functions is performed to establish the higher tiers. Detailed analyses are performed on each business process to fi ll in the lower tiers. The detailed analyses usually are conducted in a phased approach, and the taxonomy is updated incrementally.
In order to use the bottom-up method, detailed analyses must be performed for all processes in one effort. Using this method ensures that there will be fewer modi- fi cations to the taxonomy. However, sometimes conducting a comprehensive analysis is not feasible for organizations with limited resources. A phased or incremental approach is usually more budget friendly and places fewer burdens on the organiza- tion’s resources.
Many diagramming formats and tools will provide the details needed for the analysis. The most basic diagramming can be accomplished with a standard tool such as Visio ® from Microsoft. More advanced modeling tools can be used to produce the diagrams that provide the functionality to statistically analyze process changes through simulation and provide information for architecture planning and other process initia- tives within the organization.
Any diagramming format will suffi ce as long as it depicts the fl ow of data through the processes showing process steps, inputs, and outputs (documents), decision steps, organizational boundaries, and interaction with information systems. The diagrams should depict document movement within as well as between the subject department and other departments or outside entities.
Figure A.10 uses a swim-lane type diagram. Each horizontal “lane” represents a participant or role. The fl ow of data and sequence of process steps is shown with lines (the arrows note the direction). Process steps are shown as boxes.
1.0
Complete Traval
Request From
A hybrid approach to taxonomy design is usually the best.
Business processes must be documented and analyzed to develop a taxonomy.
378 APPENDIX A
bapp01_01 378 March 10, 2014 10:12 PM
Decision steps are shown as diamonds.
3.0 Approve request?
Documents are depicted as a rectangle with a curved bottom line.
Travel Request From
The fi rst step is to review any existing business process documentation (e.g., busi- ness plans, procedures manuals, employee training manuals, etc.) in order to gain a better understanding of the functions and processes. This is done in advance of in- terviews in order to provide a base-level understanding to reduce the amount of time required of the interviewees.
Two different types of interviews (high level and detailed business process) are conducted with key personnel from each department. The initial (high-level) inter- views are conducted with a representative who will provide an overall high-level view of the department, including its mission, responsibilities, and identifi cation of the functional areas. This person will identify those staff members who will provide details of the specifi c processes in each of the functional areas identifi ed. For instance, if the department is human resources, functional areas of the department might include: applicant processing, classifi cation, training, and personnel fi le management. It is ex- pected that this fi rst interview/meeting will last approximately one hour.
The second interviews are detailed interviews that focus on daily processes performed in each functional area. For example, if the function is human resources
Figure A.10 Business Process Example—Travel Expense Process Source: Blackburn Consulting
Expense Check
A c c o u n ts
P a y a b le
C le
rk C
it y M
a n a g e r
S u p e rv
is o r
S ta
ff
(R e q u e s to
r)
1.0
Complete Travel Request Form
Receive Travel
Request
2.0
Approve travel request
4.0
Yes
6.0
Data enter approved travel
into accounting system
7.0
Generate expense check
8.0
Receive travel authorization
Approved Travel Request
Form
9.0
Perform travel
10.0
Complete Expense Report
Travel Receipts
Travel Receipts
Expense Report
11.0
Approve Expense Report
Travel
Receipts
Approved
Expense Report
Data enter
approved travel into accounting
system
12.0
3.0
Approve request?
Travel Request Form
Approved
Travel Request Form
Denied Travel Request Form
No
Yes
Approved
Travel Request Form
5.0
Approve request?
No
INFORMATION ORGANIZATION AND CLASSIFICATION: TAXONOMIES AND METADATA 379
bapp01_01 379 March 10, 2014 10:12 PM
classifi cation, the process may be the creation/management of position descriptions. It is only necessary to interview one person who represents a particular process—there is no need to interview multiple staff members performing the same function. These second interviews likely will last one to two hours each, depending on the complexity of the process.
When there are processes that “connect” (e.g., the output from one process is the input to another), it is useful to conduct group interviews with representatives for each process. This often results in a-ha moments when employees from one process fi nally understand why they are sending certain records to another process. It also brings to light business process improvement opportunities. When employees understand t the big-picture process, they can identify unnecessary process steps and redundant or obsolete documents that can be eliminated.
One purpose of process analysis is to develop taxonomy facets that can be used to bring to the surface information for particular steps in the process. In some cases, process steps can s directly inform the types of artifacts that are needed at a particular part of the process and therefore be used to develop content types in KM use cases. This is related to RM in that KM applications are simply another lens under which content can be viewed. Process analysis also can help determine the scope of metadata for content. For exam- ple, if developing an application to view invoices, if the process includes understanding line item detail, this will dictate a different metadata model than if the process sought only to determine whether invoices over a certain threshold were unpaid. Different processes, different use cases, different metadata.
Taxonomy Testing: A Necessary Step
Once a new taxonomy is developed, it must be tested and piloted to see if it meets user needs and expectations. To attempt the rollout of a new taxonomy without testing it fi rst is imprudent, and will end up costing more time and resources in the long run. So budget the time and money for it. 52 Taxonomy testing is where the rubber meets the road; it provides real data to see if the taxonomy design has met user expectations and actually helps them in their work.
User testing provides valuable feedback and allows the taxonomist or taxonomy team to fi ne-tune the work they have done to more closely align the taxonomy with user needs and business objectives. What may have seemed an obvious term or category may, in fact, be way off. This may result from the sheer focus and myopia of the taxonomy team. So getting user feedback is essential.
Many taxonomy testing tools can assist in the design effort. Once an initial de- sign is drafted, a low-tech approach is to hand-write classifi cation categories and document types on Post-it notes or index cards. Then bring in a sampling of users and ask them to place the notes or cards in the proper category. Track and calculate the results.
Software is available to conduct this card sorting in a more high-tech way, and more sophisticated software can assist in the development and testing effort and to help to update and maintain the taxonomy.
Regardless of the method used, the taxonomy team or even IG team or task force needs to be the designated arbiter when confl icting opinions arise.
380 APPENDIX A
bapp01_01 380 March 10, 2014 10:12 PM
Taxonomy testing is not a one-shot task; with feedback and changes, you progress in iterations closer and closer to meeting user requirements, which may take several rounds of testing and changes.
Taxonomies can be tested in multiple ways. User acceptance throughout the deri- vation process can be simple conference room pilots or validation, formal usability testing based on use cases, card sorting (open and closed), and tagging processes. Au- totagging of content with target taxonomies is also an area that requires testing. 53
Taxonomy Maintenance
After a taxonomy has been implemented, it will need to be updated over time to refl ect changes in document management processes as well to increase usability. Therefore, users should have the opportunity to suggest changes, addition, and deletions. There should be a formal process in place to manage requests for changes. A person or commit- tee should be assigned the responsibility to determine how and if each requests will be facilitated.
There must be guidelines to follow in making changes to the taxonomy. A U.S. state agency organization uses these guidelines in determining taxonomy changes:
■ The new term must have a defi nition, preferably provided by the proposer of the new term.
■ It should be a term someone would recognize even if they have no back- ground within our agency’s workings; use of industry standard terminology is preferred.
■ Terms should be mutually exclusive from other terms. ■ Terms that can be derived using a combination of other terms or facilitated
with metadata will not be added. ■ The value should not be a “temporary” term—it should have some expec-
tation to have a long life span. ■ We should expect that there would be a signifi cant volume of content that
could be assigned the value—otherwise, use of a more general document type and clarifi cation through the metadata on items is preferred: if enough
There should be a formal process in place to manage requests for taxonomy changes.
There is nothing better than getting quantitative feedback to see if you are hitting the mark with users.
INFORMATION ORGANIZATION AND CLASSIFICATION: TAXONOMIES AND METADATA 381
bapp01_01 381 March 10, 2014 10:12 PM
items are titled with the new term over time to warrant reconsideration, it will be reconsidered.
■ For higher-level values in the hierarchy, the relationship between parents and children (functions and activities) is always “is a kind of . . .” Other relationships are not supported.
■ Document type values should not refl ect the underlying technology used to capture the content and should not refl ect the format of the content directly.
Social Tagging and Folksonomies
Social tagging is a method that allows users to manage content with metadata they g apply themselves using keywords or metadata tags. Unlike traditional classifi cation, which uses a controlled vocabulary, social tagging keywords are freely chosen by each individual.
Folksonomy is the term used for this free-form, social approach to metadata y assignment.
Folksonomies are not an ordered classifi cation system; rather, they are a list of keywords input by users that are ranked by popularity. 54
Taxonomies and folksonomies both have their place. Folksonomies can be used in concert with taxonomies to nominate key terms for use in the taxonomy , which contributes toward the updating and maintenance of the taxonomy while making the user experi- ence better by utilizing users’ own preferred terms.
A combined taxonomy and folksonomy approach may provide for an op- tional free-text metadata field for social tags that might be titled “Subject” or “Comment.” Then users could search that free-form, uncontrolled field to nar- row document searches. The folksonomy fields will be of most use to a user or departmental area, but if the terms are used frequently enough, they may need to be added to the formal taxonomy’s controlled vocabulary to benefit the entire organization.
In sum, taxonomy development, testing, and maintenance is hard work—but it can yield significant and sustained benefits to the organization over the long haul by providing more complete and accurate information when knowledge workers make searches; better IG and control over the organization’s documents, records, and information; and a more agile compliance and litigation readiness posture.
A folksonomy uses free-form words to classify documents. A folksonomy ap- proach is useful for updating your taxonomy structure and improves the user search experience.
382 APPENDIX A
bapp01_01 382 March 10, 2014 10:12 PM
■ Knowledge workers spend 15 to 25 percent of an average workday searching for information, often due to poor taxonomy design.
■ Taxonomies are hierarchical classifi cation structures used to standardize the naming and organization of information using controlled vocabularies for terms.
■ Taxonomies speed up the process of retrieving records because end users can select from subject categories or topics.
■ Taxonomies need to be considered from two main perspectives: navigation and classifi cation.
■ Poor search results, inconsistent or confl icting fi le plans, and the inability to locate information on a timely basis are indications that taxonomy work is needed.
■ Metadata, which are the characteristics of a document expressed in data fi elds, must be leveraged in taxonomy design.
■ Best practices dictate that taxonomy development includes designing the taxonomy structure and heuristic principles to align with user needs.
■ There are three basic types of hierarchical taxonomies: subject, business unit, and functional.
■ A hybrid approach to taxonomy design is usually the best.d
■ An SME can be a valuable resource in taxonomy development. SMEs should not be relied on too heavily, though, or the taxonomy may end up fi lled with esoteric jargon.
■ A document inventory is conducted to gather detailed information regarding the documents managed.
■ Business processes must be documented and analyzed to develop a taxonomy.
■ User testing is essential, provides valuable feedback, and allows the taxono- mist or taxonomy team to fi ne-tune the work.
■ Begin by using low-cost, simple tools for taxonomy development, and mi- grate to more capable ones as your organization’s needs grow and mainte- nance is required.
■ A folksonomy uses free-form words to classify documents. A folksonomy ap- proach is useful for updating your taxonomy structure and improves the user search experience.
APPENDIX SUMMARY: KEY POINTS
INFORMATION ORGANIZATION AND CLASSIFICATION: TAXONOMIES AND METADATA 383
bapp01_01 383 March 10, 2014 10:12 PM
Notes
1. ARMA Metro Maryland Newsletter, Cadence Group, “Taxonomies: The Backbone of Enterprise Content Management,” December 2008—January 2009, www.arma-metromd.org/wp-content/ uploads/2012/11/2009-01NewImages.pdf.
2. Delphi Group White Paper, “Taxonomy and Content Classifi cation: Market Milestone Report,” 2002, www.delphigroup.com/whitepapers/pdf/WP_2002_TAXONOMY.PDF (accessed April 25, 2012).
3. Ibid. 4. Cadence Group, “Taxonomies.” 5. Daniela Barbosa, “The Taxonomy Folksonomy Cookbook,” www.slideshare.net/HeuvelMarketing/
taxonomy-folksonomy-cookbook (accessed October 12, 2012). 6. Ibid. 7. Montague Institute Review, “Your Taxonomy Is Your Future” (February 2000), www.montague.com/
abstracts/future.html. 8. Free Library, “Creating Order Out of Chaos with Taxonomies,” 2005, www.thefreelibrary.com/
Creating+order+out+of+chaos+with+taxonomies%3A+the+increasing+volume+of…-a0132679071 (accessed April 25, 2012).
9. Susan Cisco and Wanda Jackson, “Creating Order Out of Chaos with Taxonomies,” Information Management Journal (May/June 2005), www.arma.org/bookstore/fi les/Cisco.pdf. l
10. Marcia Morante, “Usability Guidelines for Taxonomy Development,” April 2003, www.montague.com/ abstracts/usability.html.
11. Seth Earley, e-mail to author, September 10, 2012. 12. Ibid. 13. Cadence Group, “Taxonomies,” p. 3. 14. DAM News Staff, “8 Things You Need to Know about How Taxonomy Can Improve Search,” May 17,
2010, http://damcoalition.com/index.php/metadata/story/8_things_you_need_to_know_about_how_ taxonomy_can_improve_search/.
15. Ibid. 16. Earley e-mail. 17. National Archives of Australia, “AGLS Metadata Standard, Part 2—Usage Guide,” Version 2.0, July 2010,
www.naa.gov.au/Images/AGLS%20Metadata%20Standard%20Part%202%20%20Usage%20Guide_ tcm16-47011.pdf.
18. Kate Cumming, “Metadata Matters,” in Julie McLeod and Catherine Hare, eds., Managing Electronic Records , p. 34 (London: Facet, 2005).s
19. Minnesota State Archives, “Electronic Records Management Guidelines: Metadata,” March 12, 2012, www.mnhs.org/preserve/records/electronicrecords/ermetadata.html.
20. Ibid. 21. Cumming, “Metadata Matters,” p. 35. 22. Ibid. 23. NISO, “Understanding Metadata,” 2004, www.niso.org/publications/press/UnderstandingMetadata.
pdf (accessed October 15, 2012). 24. This and the next section are based on Minnesota State Archives, “Electronic Records Management
Guidelines.” 25. National Archives, “Requirements for Electronic Records Management Systems: 2: Metadata Standard,”
2002, www.nationalarchives.gov.uk/documents/metadatafi nal.pdf (accessed June 21, 2012). 26. International Organization for Standardization, “ISO 23081-1:2006, Information and Documentation—
Records Management Processes—Metadata for Records—Part 1: Principles,” www.iso.org/iso/iso_ catalogue/catalogue_tc/catalogue_detail.htm?csnumber=40832 (accessed June 26, 2012).
27. Carl Weise, “ISO 23081-1: 2006, Metadata for Records, Part 1: Principles,” January 27, 2012, www .aiim.org/community/blogs/expert/ISO-23081-1-2006-Metadata-for-records-Part-1-principles.
28. Dublin Core Metadata Initiative, http://dublincore.org/metadata-basics/ (accessed June 26, 2012). 29. Diane Hillman, Dublin Core Metadata Initiative, “User Guide,” November 7, 2005, http://dublincore
.org/documents/usageguide/. 30. Dublin Core Metadata Initiative, “Dublin Core Metadata Element Set,” Version 1.1, June 14, 2012,
http://dublincore.org/documents/dces/. 31. International Standard Maintenance Agency, Z39.50, Library of Congress www.loc.gov/z3950/agency/
(accessed July 7, 2012).
384 APPENDIX A
bapp01_01 384 March 10, 2014 10:12 PM
32. National Information Standards Organization, “ANSI/NISO Z39.50-2003 (R2009) Information Retrieval: Application Service Defi nition & Protocol Specifi cation,” www.niso.org/apps/group_public/ project/details.php?project_id=49 (accessed July 7, 2012).
33. Jenn Riley, “Glossary of Metadata Standards,” 2009–2010, www.dlib.indiana.edu/~jenlrile/metadata- map/seeingstandards_glossary_pamphlet.pdf (accessed July 9, 2012).
34. Global Information Locator Service, “Initiatives—Includes Spatial Data Initiatives,” www.gils.net/ initiatives.html (accessed July 7, 2012).
35. Ibid. 36. Adventures in Records Management, “The Business Classifi cation Scheme,” October 15, 2006, http://
adventuresinrecordsmanagement.blogspot.com/2006/10/business-classifi cation-scheme.html. 37. Earley e-mail. 38. National Archives of Australia, www.naa.gov.au/Images/classifcation%20tools_tcm16-49550.pdf (ac-
cessed December 13, 2013). 39. Adventures in Records Management, “Business Classifi cation Scheme.” 40. Ibid. 41. Cisco and Jackson, “Creating Order Out of Chaos.” 42. Earley e-mail. 43. www.earley.com/blog/the-popularity-contest-taxonomy-development-in-the-petabyte-era (accessed
April 25, 2012). 44. Ibid. 45. Earley e-mail. 46. Hedden, “The Accidental Taxonomist,” 10. 47. Earley e-mail. 48. Hedden, “The Accidental Taxonomist,” 8. 49. NISO, “Project ISO 25964: Thesauri and Interoperability with Other Vocabularies,” www.niso.org/
workrooms/iso25964 (accessed April 25, 2012). 50. This section is adapted with permission from Barb Blackburn, “Taxonomy Design Types,” e-Doc Magazine
(May/June 2006): 14, 16, www.imergeconsult.com/img/114BB.pdf (accessed October 12, 2012). 51. Earley e-mail. 52. Details in this section are from Stephanie Lemieux, “The Pain and Gain of Taxonomy User Testing,”
July 8, 2008, www.earley.com/blog/the-pain-and-gain-of-taxonomy-user-testing. 53. Earley e-mail. 54. Tom Reamy, “Folksonomy Folktales,” KM World 18, no. 9 (October 2009), www.kmworld.com/Articles/d
Editorial/Feature/Folksonomy-folktales-56210.aspx.
385
bapp02 385 March 6, 2014 3:06 PM
A P P E N D I X B Laws and Major Regulations Related to Records Management
United States
Records management practices and standards are delineated in many federal regulations. Also, a number of state statutes have passed. In some cases they actually supersede federal regulations; therefore, it is crucial to understand compliance within the state or states where an organization operates.
On the federal level, public companies must be vigilant in verifying, protecting, and reporting fi nancial information to comply with requirements under Sarbanes— Oxley (SOX) and the Gramm–Leach–Bliley Acts. Health care concerns must meet the requirements of the Health Insurance Portability and Accountability Act (HIPAA), and investment fi rms must comply with a myriad of regulations by the Securities and Exchange Commission (SEC) and National Association of Securities Dealers (NASD).
This appendix presents a brief description of current rules, laws, regulators, and their records retention and corporate policy requirements . (Note: This is an overview, and fi rms should consult their own legal counsel for interpretation and applicability.)
Gramm–Leach–Bliley Act
The Financial Institution Privacy Protection Act of 2001 and Financial Institution Privacy Protection Act of 2003 (Gramm–Leach–Bliley Act) was amended in 2003 to improve and increase protection of nonpublic personal information. Through this act, fi nancial records must be properly secured, safeguarded, and eventually completely destroyed so that the information cannot be further accessed.
Health Insurance Portability and Accountability Act of 1996
HIPAA requires that security standards be adopted for:
■ Controlling who may access health information. ■ Providing audit trails for electronic record systems. ■ Isolating health data, making it inaccessible to unauthorized access. ■ Ensuring the confi dentiality and safeguarding of health information when it is
electronically transmitted to ensure it is physically, electronically, and admin- istratively secure.
■ Meeting the needs and capabilities of small and rural health care providers.
Information Governance: Concepts, Strategies and Best Practices By Robert F. Smallwood Copyright © 2014 by Robert F. Smallwood
386 APPENDIX B
bapp02 386 March 6, 2014 3:06 PM
USA-PATRIOT Act (Uniting and Strengthening America by Providing Appro- priate Tools Required to Intercept and Obstruct Terrorism Act of 2001)
The USA-PATRIOT Act does two things: It (1) requires that the identity of a person opening an account with any fi nancial institution is verifi ed by the fi nancial institu- tion, which must implement reasonable procedures to maintain identity information; and (2) provides law enforcement organizations broad investigatory rights, including warrantless searches.
Sarbanes–Oxley Act
The key provisions of SOX require that:
■ Public corporations implement extensive policies, procedures, and tools to pre- vent fraudulent activities.
■ Financial control and risk mitigation processes be documented and verifi ed by independent auditors.
■ Executives of publicly traded companies certify the validity of the company’s fi nancial statements.
■ Business records must be kept for not less than fi ve years.
SEC Rule 17A-4
SEC Rule 17A-4 requires that: (1) records that must be maintained and preserved must be available to be produced or reproduced using either micrographic media (such as microfi lm or microfi che) or electronic storage media (any digital storage medium or system); and (2) original copies of all communications, such as interoffi ce memoranda, be preserved for no less than three years, the fi rst two in an easily accessible location.
Code of Federal Regulations Title 21, Part 11—Pharmaceuticals
CFR Title 21, Part 11, requires that companies: (1) have controls in place to protect content stored on both open and closed systems to ensure the authenticity and integ- rity of electronic records; and (2) generate accurate and complete electronic copies of records so that the Food and Drug Administration may inspect them.
Code of Federal Regulations Title 47, Part 42—Telecommunications
CFR Title 47, Part 42, requires that telecommunications carriers keep original records or reproductions of original records, including memoranda, documents, papers, and correspondence that the carrier prepared or that were prepared on behalf of the carrier.
U.S. Federal Authority on Archives and Records: National Archives and Records Administration
The National Archives and Records Administration (NARA: go to nara.gov):
■ Oversees physical and electronic recordkeeping policies and procedures of government agencies, requiring adequate and proper documentation on the conducting of U.S. government business.
LAWS AND MAJOR REGULATIONS RELATED TO RECORDS MANAGEMENT 387
bapp02 387 March 6, 2014 3:06 PM
■ Defi nes “formal e-records” as machine-readable materials created or received by an agency of the U.S. federal government under federal law or in the course of the transaction of public business.
■ Requires that organized records series be established for electronic records (e-records) on a particular subject or function to facilitate the management of these e-records.
NARA regulations affecting federal agencies and their records management pro- grams are found in Subchapter B of 36 CFR Chapter XII. 1
■ Part 1220—Federal Records; General ■ Part 1222—Creation and Maintenance of Records ■ Part 1223—Managing Vital Records ■ Part 1224—Records Disposition Program ■ Part 1225—Scheduling Records ■ Part 1226—Implementing Disposition ■ Part 1227—General Records Schedule ■ Part 1228—Loan of Permanent and Unscheduled Records ■ Part 1229—Emergency Authorization to Destroy Records ■ Part 1230—Unlawful or Accidental Removal, Defacing, Alteration, or Destruc-
tion of Records ■ Part 1231—Transfer of Records from the Custody of One Executive Agency
to Another ■ Part 1232—Transfer of Records to Records Storage Facilities ■ Part 1233—Transfer, Use, and Disposition of Records in a NARA Federal Re-
cords Center ■ Part 1234—Facility Standards for Records Storage Facilities ■ Part 1235—Transfer of Records to the National Archives of the United States ■ Part 1236—Electronic Records Management ■ Part 1237—Audiovisual, Cartographic, and Related Records Management ■ Part 1238—Microform Records Management ■ Part 1239—Program Assistance and Inspections ■ Part 1240–1249 [Reserved]
U.S. Code of Federal Regulations
In the CFR, there are more than 5,000 references to retaining records. It can be found online at www.ecfr.gov/cgi-bin/ECFR?page=browse
Canada
By Ken Chasse, J.D., LL.M. The National Standards of Canada for electronic records management are: (1) Elec- tronic Records as Documentary Evidence, CAN/CGSB-72.34–2005 (72.34), pub- lished in December 2005; and (2) Microfi lm and Electronic Images as Documentary Evidence, CAN/CGSB-72.11–93, fi rst published in 1979 and updated to 2000 (72.11).2 72.34 incorporates all that 72.11 deals with and is therefore the more important of the two. Because of its age, 72.11 should not be relied on for its “legal” content. However,
388 APPENDIX B
bapp02 388 March 6, 2014 3:06 PM
72.11 has remained the industry standard for “imaging” procedures—converting orig- inal paper records to electronic storage. The Canada Revenue Agency has adopted these standards as applicable to records concerning taxation. 3
72.34 deals with nine topics:
1. Management authorization and accountability 2. Documentation of procedures used to manage records 3. “Reliability testing” of electronic records according to existing legal rules 4. The procedures manual and the chief records offi cer 5. Readiness to produce (the “prime directive”) 6. Records recorded and stored in accordance with “the usual and ordinary
course of business” and “system integrity,” key phrases from the Evidence Acts in Canada
7. Retention and disposal of electronic records 8. Backup and records system recovery 9. Security and protection
From these standards practitioners have derived many specifi c tests for auditing, estab- lishing, and revising electronic records management systems (ERMS). 4
The “prime directive” of these standards states: “An organization shall always be prepared to produce its records as evidence.” 5 The duty to establish the “prime directive” falls on senior management.6
Senior management, the organization’s own internal law-making authority, pro- claims throughout the organization the integrity of the organization’s records system (and, therefore, the integrity of its electronic records) by establishing and declaring:
1. The system’s role in the usual and ordinary course of business. 2. The circumstances under which its records are made. 3. Its prime directive for all records management system purposes, i.e., an or-
ganization shall always be prepared to produce its records as evidence. This dominant principle applies to all of the organization’s business records, in- cluding electronic, optical, original paper source records, microfi lm, and other records of equivalent form and content.
Being prepared to produce records (the “dominant principle” of an organization’s ERMS) means the duty to maintain compliance with the prime directive should fall on its senior management.
Because an electronic record is completely dependent on its ERM system for every- thing, compliance with these National Standards and their prime directive should be part of the determination of the “admissibility” (acceptability) of evidence and of electronic discovery in court proceedings (litigation) and in regulatory tribunal proceedings. 7
There are 14 legal jurisdictions in Canada: 10 provinces; 3 territories; and the federal jurisdiction of the Government of Canada. Each has an Evidence Act (the Civil Code in the province of Quebec 8 ), which applies to legal proceedings within its legislative jurisdic- tion. For example, criminal law and patents and copyrights are within federal legislative jurisdiction, and most civil litigation comes within provincial legislative jurisdiction.9
The admissibility of records as evidence is determined under the “business record” provi- sions of the Evidence Acts.10 These acts require proof that a record was made “in the
LAWS AND MAJOR REGULATIONS RELATED TO RECORDS MANAGEMENT 389
bapp02 389 March 6, 2014 3:06 PM
usual and ordinary course of business” and of “the circumstances of the making of the record.” In addition, to obtain admissibility for electronic records, most of the Evidence Acts contain electronic record provisions, which state that an electronic record is admissible as evidence on proof of the “integrity of the electronic record system in which the data was recorded or stored.”11 This is the “system integrity” test for the admissibility of electronic records. The word “integrity” has yet to be defi ned by the courts. 12
However, by way of sections such as the next one, the electronic record provi- sions of the Evidence Acts make reference to the use of standards such as the National Standards of Canada:
For the purpose of determining under any rule of law whether an electronic record is admissible, evidence may be presented in respect of any standard, procedure, usage or practice on how electronic records are to be recorded or stored, having regard to the type of business or endeavor that used, recorded, or stored the electronic record and the nature and purpose of the electronic record. 13
Six areas of law and records and information management (RIM) are applicable to paper and electronic records:
1. The laws of evidence applicable to electronic and paper records 14 2. The National Standards of Canada concerning electronic records 15 3. The records requirements of government agencies, such as the Canada
Revenue Agency 16 4. The electronic commerce legislation 17 5. The privacy laws 18 6. The guidelines for electronic discovery in legal proceedings19
These six areas are closely interrelated and are based on very similar concepts. They all make demands of records systems and of the chief records offi cer or others responsible for records. Therefore, a failure to satisfy the records management needs of any one of them will likely mean a failure to satisfy all of them. Agencies that manage these areas of law look to the decisions of the courts to determine the requirements for ac- ceptable records.
Each of these areas of law affects RIM, just as these areas are affected by the laws governing the use of records as evidence in legal proceedings—the laws of evidence. These relationships make mandatory compliance with the prime directive provided by the National Standards, which states: “an organization shall always be prepared to produce its records as evidence.” 20
United Kingdom
Regulations and Legislation Impacting Records Retention
The following Acts and Statutory Instruments of the U.K. and Scottish Parlia- ments contain provisions that are relevant to records retention and disposal:
390 APPENDIX B
bapp02 390 March 6, 2014 3:06 PM
Acts of the U.K. Parliament
■ 1957 c31 Occupiers Liability Act 1957 ■ 1969 c57 Employers’ Liability (Compulsory Insurance) Act 1969 ■ 1970 c41 Equal Pay Act 1970 ■ 1970 c9 Taxes Management Act 1970 ■ 1973 c52 Prescription and Limitations (Scotland) Act 1973 ■ 1974 c37 Health and Safety at Work (etc.) Act 1974 ■ 1975 c65 Sex Discrimination Act 1975 ■ 1976 c74 Race Relations Act 1976 ■ 1980 c58 Limitation Act 1980 ■ 1992 c4 Social Security Contributions and Benefi ts Act 1992 ■ 1994 c30 Education Act 1994 ■ 1994 c23 Value Added Tax Act 1994 ■ 1995 c50 Disability Discrimination Act 1995 ■ 1998 c29 Data Protection Act 1998
Acts of the Scottish Parliament
■ 2002 asp13 Freedom of Information (Scotland) Act 2002
Statutory Instruments of the U.K. Parliament
■ SI 1977/500 The Safety Representatives and Safety Committees Regula- tions 1977
■ SI 1981/917 The Health and Safety (First Aid) Regulations 1981 ■ SI 1982/894 The Statutory Sick Pay (General) Regulations 1982 ■ SI 1986/1960 The Statutory Maternity Pay (General) Regulations 1986 ■ SI 1989/1790 The Noise at Work Regulations 1989 ■ SI 1989/635 The Electricity at Work Regulations 1989 ■ SI 1989/682 The Health and Safety Information for Employees Regula-
tions 1989 ■ SI 1991/2680 The Public Works Contracts Regulations 1991 ■ SI 1992/2792 The Health and Safety (Display Screen Equipment) Regula-
tions 1992 ■ SI 1992/2793 The Manual Handling Operations Regulations 1992 ■ SI 1992/2932 The Provision and Use of Work Equipment Regulations
1992 ■ SI 1992/2966 The Personal Protective Equipment at Work Regulations 1992 ■ SI 1993/3228 The Public Services Contracts Regulations 1993 ■ SI 1993/744 The Income Tax (Employments) Regulations 1993 ■ SI 1995/201 The Public Supply Contracts Regulations 1995 ■ SI 1995/3163 The Reporting of Injuries, Diseases and Dangerous Occur-
rences Regulations 1995 ■ SI 1996/1513 The Health and Safety (Consultation with Employees) Reg-
ulations 1996 ■ SI 1996/341 The Health and Safety (Safety Signs and Signals) Regulations
1996
LAWS AND MAJOR REGULATIONS RELATED TO RECORDS MANAGEMENT 391
bapp02 391 March 6, 2014 3:06 PM
■ SI 1996/972 The Special Waste Regulations 1996 ■ SI 1997/1840 The Fire Precautions (Workplace) Regulations 1997 ■ SI 1998/1833 The Working Time Regulations 1998 ■ SI 1998/2306 The Provision and Use of Work Equipment Regulations 1998 ■ SI 1998/2307 The Lifting Operations and Lifting Equipment Regulations
1998 ■ SI 1998/2573 The Employers’ Liability (Compulsory Insurance) Regula-
tions 1998 ■ SI 1999/3242 The Management of Health and Safety at Work Regulations
1999 ■ SI 1999/3312 The Maternity and Parental Leave (etc.) Regulations 1999 ■ SI 1999/584 The National Minimum Wage Regulations 1998 ■ SI 2002/2675 The Control of Asbestos at Work Regulations 2002 ■ SI 2002/2676 The Control of Lead at Work Regulations 2002 ■ SI 2002/2677 The Control of Substances Hazardous to Health Regula-
tions 2002
Other Provisions
■ HMCE 700/21 HM Customs and Excise Notice 700/21: Keeping [VAT] records and accounts
■ IR CA30 Statutory Sick Pay Manual for Employers CA30 21
Australia*
Archives Act
The Archives Act 1983 empowers the Archives to preserve the archival resources of the Australian Government—those records designated “national archives.” Under the act, it is illegal to destroy Australian government records without permission from the Archives unless destruction is specifi ed in another piece of legislation or allowed under a normal administrative practice.
The act also establishes a right of public access to nonexempt commonwealth records in the “open access period” (transitioning from 30 years to 20 years over the period 2011 to 2021 under amendments to the act passed in 2010). Different open access periods exist for cabinet notebooks (transitioning from 50 years to 30 years over the period 2011 to 2021) and records containing census information (99 years).
Freedom of Information Act
The Freedom of Information (FOI) Act 1982 gives individuals the legal right to access documents held by Australian government ministers, departments, and most agencies, including Norfolk Island government agencies. From November 1, 2010, the FOI Act also applies to documents created or held by contractors or subcontractors who pro- vided services to the public or third parties on behalf of agencies.
*The information in this section is taken from www.naa.gov.au © Commonwealth of Australia (National Archives of Australia) 2013
392 APPENDIX B
bapp02 392 March 6, 2014 3:06 PM
The FOI Act applies to records that are not yet in the open access period un- der the Archives Act unless the document contains personal information (including personal information about a deceased person). The Archives Act regulates access to records in the open access period.
When a member of the public requests information, your agency must identify and preserve all relevant sources, including records, until a fi nal decision on the re- quest is made. The FOI Act also sets out how agencies may correct, annotate, or up- date records if a member of the public shows that any personal information relating to them is incomplete, incorrect, out of date, or misleading.
The FOI Act also establishes the Information Publication Scheme (IPS), which requires agencies subject to the FOI Act to take a proactive approach to publishing a broad range of information on their Web site. The IPS does not apply to a small num- ber of security and intelligence agencies that are exempt from the FOI Act.
Australian Information Commissioner Act
The Australian Information Commissioner Act 2010 established the Offi ce of the Aus- tralian Information Commissioner (OAIC). The OAIC has three sets of functions. These are:
1. Freedom of information functions —protecting the public’s right of access to doc-ss uments under the amended FOI Act and reviewing decisions made by agen- cies and ministers under that act.
2. Privacy functions —ensuring proper handling of personal information in accor-ss dance with the Privacy Act 1988.
3. Government and information policy functions , conferred on it by the Australian s Information Commissioner Act 2010—these include strategic functions re- lating to information management and ensuring maximum coordination, ef- fi ciency, and transparency in government information policy and practice.
As part of its government and information policy function, the OAIC is commit- ted to leading the development and implementation of a national information policy framework to promote secure and open government. It aims to achieve this by driv- ing public access to government information and encouraging agencies to proactively publish information.
Privacy Act
The Privacy Act 1988 regulates the handling of personal information by Australian government agencies, Australian Capital Territory (ACT) government agencies, ACT government agencies, Norfolk Island government agencies, and a range of private and not-for-profi t organizations. The Privacy Act regulates the way in which personal in- formation can be collected, its accuracy, how it is kept secure, and how it is used and disclosed. It also provides rights to individuals to access and correct the information that organizations and government agencies hold about them. Records in the open access period as defi ned in the Archives Act 1983 are not covered by the Privacy Act. The Privacy Act also sets out requirements that may apply when an agency enters into a contract under which services are provided to the agency.
LAWS AND MAJOR REGULATIONS RELATED TO RECORDS MANAGEMENT 393
bapp02 393 March 6, 2014 3:06 PM
Evidence Act
The Evidence Act 1995 defi nes what documents, including records, can be used as evidence in a commonwealth court. 22
All agencies need to take account of evidence legislation. A court may need to examine records as evidence of an organization’s decisions and actions. 23
Electronic Transactions Act
The Electronic Transactions Act 1999 encourages online business by ensuring that electronic evidence of transactions is not invalidated because of its format. This act does not authorize the destruction of any Australian government records, whether originals or copies. The obligations placed on agencies under the Archives Act 1983 for the preservation and disposal of commonwealth records continue to apply.
Financial Management and Accountability Act
The Financial Management and Accountability Act 1997 states that an Australian Public Service (APS) employee who misapplies, improperly disposes of, or improperly uses commonwealth records may be in breach of the Financial Management and Ac- countability Act ( s. 41). Regulation 12 of the act requires that the terms of approval for(( a proposal to spend money be recorded in writing as soon as practicable.
Australian government records fall within the meaning of “public property” as defi ned in this act.
Crimes Act
The Crimes Act 1914 outlines crimes against the commonwealth. Several parts of the act relate to records. For example, section 70 prohibits public servants (or anyone working for the Australian government, including contractors, and consultants) from publishing or communicating facts, documents, or information that they gain access to through their work unless they have permission to do so. This includes taking or selling records that should be destroyed.
This act also makes it an offense for people to intentionally destroy documents that they know may be required as evidence in a judicial proceeding.
Identifying Records Management Requirements in Other Legislation
Your agency [or business] needs to be aware of the legislation governing its own re- cords practices.
Some legislative requirements apply to many agencies [and businesses]. For exam- ple, occupational health and safety legislation requires an organization to keep certain types of records for prescribed periods of time. Requirements that apply to all agencies are included in the National Archives’ Administrative Functions Disposal Authority.
Other legislative requirements may apply only to the particular business of one or a number of agencies.
Record-keeping requirements may be stipulated in your agency’s enabling legisla- tion (legislation that established the agency) or in specifi c legislation that your agency is responsible for administering. 24
394 APPENDIX B
bapp02 394 March 6, 2014 3:06 PM
Notes
1. NARA Records Management Guidance and Regulations, www.archives.gov/records-mgmt/policy/ guidance-regulations.html (accessed October 17, 2012).
2. These standards were developed by the Canadian General Standards Board, which is a standards- writing agency within Public Works and Government Services Canada (a department of the federal government). It is accredited by the Standards Council of Canada as a standards development agency. The council must certify that standards have been developed by the required procedures before it will designate them as being National Standards of Canada. 72.34 incorporates by reference as “normative references”: (1) many of the standards of the International Organization for Standardization (ISO) in Geneva, Switzerland; and (2) several of the standards of the Canadian Standards Association. The “Normative references” section of 72.34 (p. 2) states that these “referenced documents are indispens- able for the application of this document.” 72.11 cites (p. 2, “Applicable Publications”) several standards of the American National Standards Institute/Association for Information and Image Management (ANSI/AIIM) as publications “applicable to this standard.” The process by which the National Stan- dards of Canada are created and maintained is described within the standards themselves (reverse side of the front cover), and on the CGSB’s Web site (see “Standards Development”), from which Web site these standards may be obtained; online: www.ongc-cgsb.gc.ca.
3. The Canada Revenue Agency informs the public of its policies and procedures by means, among others, of its Information Circulars and GST/HST Memoranda (GST: goods and services tax; HST: harmonized sales tax, i.e., the harmonization of federal and provincial sales taxes into one retail sales tax.) In particular, see: IC05-1, dated June 2010, entitled Electronic Record Keeping , paragraphs 24, g 26, and 28. Note that use of the National Standard cited in paragraph 26, Microfi lm and Electronic Images as Documentary Evidence , CAN/CGSB-72.11-93, is mandatory for “Imaging and microfi lm (including microfi che) reproductions of books of original entry and source documents.” Paragraph 24 recommends the use of the newer national standard, Electronic Records as Documentary Evidence , CAN/CGSB-72.34-2005, “To ensure the reliability, integrity and authenticity of electronic records.” However, if this newer standard is given the same treatment by CRA as the older standard, it will be made mandatory as well. And similar statements appear in the GST Memoranda Computerized Records 500-1-2, Books and Records 500-1. IC05-1. s Electronic Record Keeping , concludes with the note: “Most g Canada Revenue Agency publications are available on the CRA website, www.cra.gc.ca, under the heading ‘Forms and Publications.’”
4. More than 200 specifi c compliance tests can be applied to determine if the principles of 72.34 are being complied with. The analysts—a combined team of records management and legal expertise—analyze: (1) the nature of the business involved; (2) the uses and value of its records for its various functions; (3) the likelihood and risk of the various types of its records being the subject of legal proceedings, or of their being challenged by some regulating authority; and (4) the consequences of the unavailability of acceptable records—for example, the consequences of its records not being accepted in legal proceed- ings. Similarly, in regard to National Standard of Canada 72.11, a comparable series of more than 50 tests can be applied to determine the state of compliance with its principles.
5. Electronic Records as Documentary Evidence, CAN/CGSB-72.34-2005 (72.34), clause 5.4.3 c at p. 17; and Microfi lm and Electronic Images as Documentary Evidence , CAN/CGSB-72.11-93 (72.11).
6. 72.34, Clause 5.4.3, ibid. 7. “Admissibility” refers to the procedure by which a presiding judge determines if a record or other
proffered evidence is acceptable as evidence according the rules of evidence. “Electronic discovery” is the compulsory exchange of relevant records by the parties to legal proceedings prior to trial. As to the admissibility of records as evidence, see: Ken Chasse, “The Admissibility of Electronic Business Re- cords,” Canadian Journal of Law and Technology 8 (2010): 105; and Ken Chasse, “Electronic Records for Evidence and Disclosure and Discovery,” Criminal Law Quarterly 57 (2011): 284. For the electronic dis- covery of records, see: Ken Chasse, “Electronic Discovery—Sedona Canada Is Inadequate on Records Management—Here’s Sedona Canada in Amended Form,” Canadian Journal of Law and Technology 9 (2011): 135; and Ken Chasse, “Electronic Discovery in the Criminal Court System” Canadian Criminal Law Review 14 (2010): 111.
8. For the province of Quebec, comparable provisions are contained in Articles 2831–2842, 2859–2862, 2869–2874 of Book 7 “Evidence” of the Civil Code of Quebec, S.Q. 1991, c. C-64, to be read in con- junction with “An Act to Establish a Legal Framework for Information Technology,” R.S.Q. 2001, c. C-1.1, sections. 2, 5–8, and 68.
9. For the legislative jurisdiction of the federal and provincial governments in Canada, see the Constitu- tion Act, 1867 (U.K.) 30 and 31 Victoria, c. 3, section 91 (federal) and section 92 (provincial); at online: www.canlii.org/en/ca/laws/stat/30—31-vict-c-3/latest/30—31-vict-c-3.html.
LAWS AND MAJOR REGULATIONS RELATED TO RECORDS MANAGEMENT 395
bapp02 395 March 6, 2014 3:06 PM
10. The two provinces of Alberta, and Newfoundland and Labrador do not have business record provisions in their Evidence Acts. Therefore “admissibility” in those jurisdictions would be determined by way of the court decisions that defi ne the applicable common law rules; such decisions as Ares v. Venner , [1970]r S.C.R. 608, 14 D.L.R. (3d) 4 (S.C.C.) and decisions that have applied it.
11. See, for example, the Canada Evidence Act, R.S.C. 1985, c. C-5, sections 31.1–31.8; Alberta Evidence Act, R.S.A. 2000, c. A-18, sections 41.1–41.8; (Ontario) Evidence Act, R.S.O. 1990, c. E.23, s. 34.1; and the (Nova Scotia) Evidence Act, R.S.N.S. 1989, c. 154, sections 23A–23G. The Evidence Acts of the two provinces of British Columbia and Newfoundland and Labrador do not contain electronic record provisions. However, because an electronic record is no better than the quality of the record system in which it is recorded or stored, its “integrity” (reliability, credibility) will have to be determined under the other provincial laws that determine the admissibility of records as evidence.
12. The electronic record provisions have been in the Evidence Acts in Canada since 2000. They have been applied to admit electronic records into evidence, but they have not yet received any detailed analysis by the courts.
13. This is the wording used in, for example, section 41.6 of the Alberta Evidence Act, section 34.1(8) of the (Ontario) Evidence Act; and section 23F of the (Nova Scotia) Evidence Act, supra note 10. Section 31.5 of the Canada Evidence Act, supra note 58, uses the same wording; the only signifi cant difference is that the word “document” is used instead of “record.” For the province of Quebec, see sections 12 and 68 of An Act to Establish a Legal Framework for Information Technology , R.S.Q., chapter C-1.1.
14. Supra notes 54 to 59 and accompanying texts. 15. Supra notes 49 and 52 and accompanying texts. 16. Supra note 50 and accompanying text. 17. All 14 jurisdictions of Canada have electronic commerce legislation except for the Northwest Territo-
ries. See, for example, the Personal Information Protection and Electronic Documents Act, S.C. 2000, c. 5, Parts 2 and 3; Ontario’s Electronic Commerce Act, 2000, S.O. 2000, c. 17; and, British Columbia’s Electronic Transactions Act, R.B.C. 20001, c. 10. The concept of “system integrity” in the Evidence Acts ( supra( ( note 58 and accompanying text), is also found in the electronic commerce legislation. See, for example, section 8 of the Ontario Electronic Commerce Act, 2000, under the heading “Legal Re- quirement re Original Documents.”
18. For example, Part 1, “Personal Information Protection,” of the federal Personal Information Protection and Electronic Documents Act (PIPEDA), S.C. 2000, c. 5, which applies within provincial legislative jurisdiction as well as federal, until a province enacts its own personal information protection act (a PIPA), which displaces it in the provincial sphere. British Columbia, Alberta, and Quebec are the only provinces that have done so.
19. The dominant guideline for electronic discovery in Canada is The Sedona Canada Principles—Address- ing Electronic Discovery ; online: The Sedona Conference, Canada, January 2008: www.thesedonacon- ference.com/content/miscFiles/canada_pincpls_FINAL_108.pdf or www.thesedonaconference.org/ dltForm?did=canada_pincpls_FINAL_108.pdf; and E-Discovery Canada Web site, hosted by LexUM (at the University of Montreal), online: www. lexum.umontreal.ca/e-discovery. And see also the law journal articles concerning electronic discovery cited in note 54 supra .
20. Supra notes 52 and 53 and accompanying texts. 21. “Information Governance Record Retention Guidance,” www.rec-man.stir.ac.uk/rec-ret/legislation.
php (accessed October 17, 2012). 22. www.comlaw.gov.au/Details/C2012C00518, accessed Nov. 30, 2012. 23. General advice on the impact of the Evidence Act is given in the publication Commonwealth Records
in Evidence (pdf). www.comlaw.gov.au/Details/C2012C00518 (accessed Nov. 30, 2012). 24. National Archives of Australia, www.naa.gov.au/records-management/strategic-information/stan-
dards/recordslegislation.aspx (accessed October 17, 2012).
397
bapp03 397 February 28, 2014 2:02 PM
A P P E N D I X C Laws and Major Regulations Related to Privacy
United States
Note: This list is representative and not to be considered an exhaustive listing.1 State laws and industry regulations may apply to your organization. Consult your legal counsel for defi nitive research.
Americans with Disabilities Act (ADA) Cable Communications Policy Act of 1984 (Cable Act) California Senate Bill 1386 (SB 1386) Children’s Internet Protection Act of 2001 (CIPA) Children’s Online Privacy Protection Act of 1998 (COPPA) Communications Assistance for Law Enforcement Act of 1994 Computer Fraud and Abuse Act of 1986 (CFAA) Computer Security Act of 1987: superseded by the Federal Information Security
Management Act (FISMA) Consumer Credit Reporting Reform Act of 1996 (CCRRA): modifi es the Fair
Credit Reporting Act (FCRA) Controlling the Assault of Non-Solicited Pornography and Marketing (CAN-
SPAM) Act of 2003 Driver’s Privacy Protection Act of 1994 Electronic Communications Privacy Act of 1986 (ECPA) Electronic Freedom of Information Act of 1996 (E-FOIA) Electronic Funds Transfer Act (EFTA) Fair and Accurate Credit Transactions Act (FACTA) of 2003 Fair Credit Reporting Act of 1999 (FCRA) Family Education Rights and Privacy Act of 1974 (FERPA; aka the Buckley
Amendment) Federal Information Security Management Act (FISMA) Federal Trade Commission Act (FTCA) Gramm–Leach–Bliley Financial Services Modernization Act of 1999 (GLBA)
Information Governance: Concepts, Strategies and Best Practices By Robert F. Smallwood Copyright © 2014 by Robert F. Smallwood
398 APPENDIX C
bapp03 398 February 28, 2014 2:02 PM
Privacy Act of 1974: including U.S. Department of Justice Overview Privacy Protection Act of 1980 (PPA) Right to Financial Privacy Act of 1978 (RFPA) Telecommunications Act of 1996 Telephone Consumer Protection Act of 1991 (TCPA) Uniting and Strengthening America by Providing Appropriate Tools Required to
Intercept and Obstruct Terrorism Act of 2001 (USA-PATRIOT Act) Video Privacy Protection Act of 1988
Major Privacy Laws Worldwide, by Country
Note: This list is representative and not to be considered an exhaustive listing. 2 State or provincial laws and industry regulations may apply to your organization. Consult your legal counsel for defi nitive research.
Argentina. Personal Data Protection Act of 2000 (aka Habeas Data) Australia. Privacy Act of 1988 Austria. Data Protection Act 2000, Austrian Federal Law Gazette part I No.
165/1999 (Datenschutzgesetz 2000 or DSG 2000) Belgium. Belgium Data Protection Law Brazil. Privacy currently governed by Article 5 of the 1988 Constitution Bulgaria. Bulgarian Personal Data Protection Act Canada. Privacy Act—July 1983 Personal Information Protection and Electronic
Data Act (PIPEDA) of 2000 (Bill C-6) Chile. Act on the Protection of Personal Data, August 1998 Colombia. Law 1266 of 2008: (in Spanish) and Law 1273 of 2009 (in Spanish) Czech Republic. Act on Protection of Personal Data (April 2000) No. 101 Denmark. Act on Processing of Personal Data, Act No. 429, May 2000 Estonia. Personal Data Protection Act of 2003. (June 1996, Consolidated
July 2002) European Union. European Union Data Protection Directive of 1998; EU Internet
Privacy Law of 2002 (Directive 2002/58/EC) Finland. Act on the Amendment of the Personal Data Act (986) 2000 France. Data Protection Act of 1978 (revised in 2004) Germany. Federal Data Protection Act of 2001 Greece. Law No. 2472 on the Protection of Individuals with Regard to the Pro-
cessing of Personal Data, April 1997 Guernsey. Data Protection (Bailiwick of Guernsey) Law of 2001 Hong Kong. Personal Data Ordinance (the Ordinance)
LAWS AND MAJOR REGULATIONS RELATED TO PRIVACY 399
bapp03 399 February 28, 2014 2:02 PM
Hungary. Act LXIII of 1992 on the Protection of Personal Data and the Publicity of Data of Public Interests
Iceland. Act of Protection of Individual; Processing Personal Data, January 2000 Ireland. Data Protection (Amendment) Act, Number 6, of 2003 India. Information Technology Act of 2000 Italy. Processing of Personal Data Act, January 1997; Data Protection Code of
2003 Japan. Personal Information Protection Law (Act) Law for the Protection of
Computer Processed Data Held by Administrative Organs, December 1988 Korea. Act on Personal Information Protection of Public Agencies Act on Infor-
mation and Communication Network Usage Latvia. Personal Data Protection Law, March 2000 Lithuania. Law on Legal Protection of Personal Data, June 1996 Luxembourg. Law of August 2002 on the Protection of Persons with Regard to the
Processing of Personal Data Malaysia. Common Law Principle of Confi dentiality Personal Data Protection
Bill Banking and Financial Institutions Act of 1989 Privacy Provisions Malta. Data Protection Act (Act XXVI of 2001), amended March 22, 2002,
November 15, 2002 and July 15, 2003 Mexico. Federal Law for the Protection of Personal Data Possessed by Private
Persons (Spanish) Morocco. Data Protection Act Netherlands. Dutch Personal Data Protection Act 2000 as amended by Acts dated
April 5, 2001, Bulletin of Acts, Orders and Decrees 180, December 6, 2001 New Zealand. Privacy Act, May 1993; Privacy Amendment Act, 1993; Privacy
Amendment Act, 1994 Norway. Personal Data Act (April 2000)–Act of April 14, 2000 No. 31 Relating to
the Processing of Personal Data (Personal Data Act) Philippines. Data Privacy Act of 2011 (There is also a recognized right of privacy
in civil law and a model data protection code.) Romania. Law No. 677/2001 for the Protection of Persons Concerning the Pro-
cessing of Personal Data and the Free Circulation of Such Data Poland. Act of the Protection of Personal Data (August 1997) Portugal. Act on the Protection of Personal Data (Law 67/98 of 26 October) Singapore. E-commerce Code for the Protection of Personal Information and
Communications of Consumers of Internet Commerce Slovak Republic. Act No. 428 of July 3, 2002, on Personal Data Protection Slovenia. Personal Data Protection Act, RS No. 55/99 South Africa. Electronic Communications and Transactions Act, 2002 South Korea. Act on Promotion of Information and Communications Network
Utilization and Data Protection of 2000
400 APPENDIX C
bapp03 400 February 28, 2014 2:02 PM
Spain. Organic Law 15/1999 of December 13 on the Protection of Personal Data Switzerland. Federal Law on Data Protection of 1992 Sweden. Personal Data Protection Act (1998: 204), October 24, 1998 Taiwan. Computer Processed Personal Data Protection Law (public institution
applicability only) Thailand. Offi cial Information Act, B.E. 2540 (1997) (for state agencies) United Kingdom. UK Data Protection Act 1998; Privacy and Electronic Commu-
nications (EC Directive) Regulations 2003 Vietnam. Law on Electronic Transactions 2008
Notes
1. Information Shield, “United States Privacy Laws,” www.informationshield.com/usprivacylaws.html (accessed October 18, 2013).
2. Information Shield, “International Privacy Laws,” www.informationshield.com/intprivacylaws.html (accessed February 1, 2014).
401
bgloss 401 February 28, 2014 2:02 PM
GLOSSARY
access control list In systems such as electronic records management, electronic document and records management systems, or document management systems, a list of individuals authorized to access, view, amend, transfer, or delete documents, records, or fi les. Access rights are enforced through software controls.
application programming interface (API) A way of standardizing the connection between two software applications. It is essentially a standard hook that an appli- cation uses to connect to another software application.
archival information package (AIP) One of three types of information packages that can be submitted in the Open Archival Information System (OAIS) preserva- tion model.
archive Storing information and records for long-term or permanent preservation. With respect to e-mail, it is stored in a compressed and indexed format to reduce storage requirements and allow for rapid, complex searches. (This also can done for blogs, social media, or other applications.) Archiving of real-time applications like e-mail can be deemed reliable with record integrity only if it is performed immediately, in real time.
ARMA Association for Records Managers and Administrators, the United States- based nonprofi t organization for records managers with a network of interna- tional chapters.
authentication, authorization, and audit (or accounting) (AAA) A network man- agement and security framework that controls computer system logons and access to applications that enforces IG policies and audits usage.
authenticity of records Verifi ed content and author information as original for the purposes of electronic records management; in a legal context, proof that the e-document is what it purports to be when electronically stored information is submitted during the e-discovery process.
auto-classifi cation Setting predefi ned indices to classify documents and records and having the process performed automatically by using software rather than human intervention. A strong trend toward auto-classifi cation is emerging due to the impact of Big Data and rapidly increasing volumes of documents and records.
backup A complete spare copy of data for purposes of disaster recovery. Backups are nonindexed mass storage and cannot substitute for indexed, archived information that can be quickly searched and retrieved (as in archiving).
best practices Those methods, processes, or procedures that have been proven to be the most effective, based on real-world experience and measured results.
Big Data More data than can be processed by today’s database systems, or acutely high volume, velocity, and variety of information assets that demand IG to manage and leverage for decision-making insights and cost management.
Information Governance: Concepts, Strategies and Best Practices By Robert F. Smallwood Copyright © 2014 by Robert F. Smallwood
402 GLOSSARY
bgloss 402 February 28, 2014 2:02 PM
bidders’ conference A formal meeting where vendors bidding on a request for proposal (RFP) can ask questions and raise issues about the RFP, proposal require- ments, and procurement process.
business activities The tasks performed to accomplish a particular business func- tion. Several activities may be associated with each business function.
business case A written analysis of the fi nancial, productivity, auditability, and other factors to justify the investment in software and hardware systems, implementa- tion, and training.
business classifi cation scheme (BCS) The overall structure an organization uses for organizing, searching, retrieving, storing, and managing documents and re- cords in electronic records management. The BCS must be developed based on the business functions and activities. A fi le plan is a graphic representation of the BCS, usually a hierarchical structure consisting of headings and folders to indicate where and when records should be created during the conducting of the business of an offi ce. In other words, the fi le plan links the records to their business context. t
business driver A compelling business reason that motivates an organization to im- plement a solution to a problem. Business drivers can be based on fi nancial, legal, or operational gaps or needs.
business functions Basic business units, such as accounting, legal, human resources, and purchasing.
business process A coordinated set of collaborative and transactional work activi- ties carried out to complete work steps.
business process improvement (BPI) Analyzing and redesigning business pro- cesses to streamline them and gain effi ciencies, reduce cycle times, and improve auditability and worker productivity.
business process outsourcing (BPO) Contracting with a third party to perform specifi c business processes. One example could be using a customer service center taking inbound telephone calls from U.S. customers and handling customer re- quests and complaints from a service center located offshore, in locations such as India, where labor costs are lower.
business process management (BPM) Managing the work steps and business activities of an organization’s workers in an automated way.
business process management system (BPMS) A superset of workfl ow software, and more. BPMS software offers fi ve main capabilities:
1. Puts existing and new application software under the direct control of busi- ness managers
2. Makes it easier to improve existing business processes and create new ones 3. Enables the automation of processes across the entire organization and
beyond it 4. Gives managers real-time information on the performance of processes 5. Allows organizations to take full advantage of new computing services
GLOSSARY 403
bgloss 403 February 28, 2014 2:02 PM
capture Components that also often are called input components. There are several levels and technologies, from simple document scanning and capture to complex information preparation using automatic classifi cation.
case records Records that are characterized as having a beginning and an end but are added to over time. Case records generally have titles that include names, dates, numbers, or places.
change management Methods and best practices to assist an organization and its employees in implementing changes to business processes, culture, and systems.
classifi cation Systematic identifi cation and arrangement of business activities and/ or records into categories according to logically structured conventions, methods, and procedural rules represented in a classifi cation system. A coding of content items as members of a group for the purposes of cataloging them or associating them with a taxonomy.
cloud computing The provision of computational resources on demand via a network. Cloud computing can be compared to the supply of electricity and gas or the provi- sion of telephone, television, and postal services. All of these services are presented to users in a simple way that is easy to understand without users’ needing to know how the services are provided. This simplifi ed view is called an abstraction. Similarly, cloud computing offers computer application developers and users an abstract view of services, which simplifi es and ignores much of the details and inner workings. A provider’s offering of abstracted Internet services is often called the cloud.
CobiT (Control Objectives for Information and related Technology) A process- based information technology governance framework that represents a consensus of experts worldwide. It was codeveloped by the IT Governance Institute and ISACA.
Code of Federal Regulations (CFR) The annual edition of the CFR contains all the rules published in the Federal Register by the departments and agencies of the federal government. It is divided into 50 broad subject areas and contain at least one individual volumes, and is update annually, on a staggered basis.
cold site An empty computer facility or data center that is ready for operation with air-conditioning, raised fl oors, telecommunication lines, and electric power. Backup hardware and software will have to be purchased and shipped in quickly to resume operations. Arrangements can be made with suppliers for rapid delivery in the event of a disaster.
compliance monitoring Being regularly apprised and updated on pertinent regula- tions and laws and examining processes in the organization to ensure compliance with them. In a records management sense, this involves reviewing and inspecting the various facets of a records management program to ensure it is in compliance. Compliance monitoring can be carried out by an internal audit, external organiza- tion, or records management and must be done on a regular basis.
computer memory Solid state volatile (erasable) storage capability built into cen- tral processing units of computers. At times memory size can be increased by ex- panding it to the computer’s hard drive or external magnetic disks.
404 GLOSSARY
bgloss 404 February 28, 2014 2:02 PM
content In records, the actual information contained in the record; more broadly, content is information. For example, content is managed by enterprise content management systems and may be e-mail, e-documents, Web content, report con- tent, and so on.
controlled vocabulary Set, defi ned terms used in a taxonomy.
corporate compliance The set of activities and processes that result in meeting and adhering to all regulations and laws that apply to an organization.
data cleansing (or data scrubbing) The process of removing corrupt, redundant, and inaccurate data in the data governance process.
data governance Processes and controls at the data level; a newer, hybrid quality control discipline that includes elements of data quality, data management, information governance policy development, business process improvement, and compliance and risk management.
data loss prevention (DLP; or data leak prevention) A computer security term referring to systems that identify, monitor, and protect data in use (e.g., endpoint actions), data in motion (e.g., network actions), and data at rest (e.g., data storage) through deep content inspection, contextual security analysis of transaction (attributes of originator, data object, medium, timing, recipient/ destination, etc.) and with a centralized management framework. Systems are designed to detect and prevent unauthorized use and transmission of confi den- tial information.
declaration Assignment of metadata elements to associate the attributes of one or more record folder(s) to a record; for categories to be managed at the record level, providing the capability to associate a record category to a specifi c record.
de-duplication The process of identifying and eliminating redundant occurrences of data.
defensible deletion Disposing of unneeded data, e-documents, and reports based on set policy that can be defended in court. It reduces an organization’s informa- tion footprint.
Designing and Implementing Recordkeeping Systems (DIRKS) An Australian methodology consisting of eight steps developed by the Archives Authority of New South Wales, included in ISO 15489, the international standard for records management. Roughly analogous to the Generally Accepted Recordkeeping Prin- ciples ® developed by the Association for Records Managers and Administrators in the United States.
destruction The process of eliminating or deleting records, beyond any possible reconstruction.
destruction certifi cate A certifi cate issued once destruction of a record is complete. It verifi es that destruction has taken place, who authorized the destruction, and who carried it out. It also may include some metadata about the record.
destructive retention policy Permanently destroying documents or e-documents (such as e-mail) after retaining them for a specifi ed period of time.
GLOSSARY 405
bgloss 405 February 28, 2014 2:02 PM
disaster recovery (DR)/business continuity (BC) The planning, preparation, and testing set of activities used to help a business plan for and recover from any major business interruption and to resume normal business operations.
discovery The process of gathering and exchanging evidence in civil trials; or dis- covering information fl ows inside an organization using data loss prevention tools.
disposition The range of processes associated with implementing records retention, destruction, or transfer decisions, which are documented in disposition authorities or other instruments.
dissemination information package (DIP) One of three types of information packages that can be submitted in the Open Archival Information System (OAIS) preservation model.
document Recorded information or object that can be treated as a unit.
document analytics Detailed usage statistics on e-documents, such as time spent viewing, which pages were viewed and for how long, number of docu- ments printed, where printed, number of copies printed, and other granular information about how and where a document is accessed, viewed, edited, or printed.
document imaging Scanning and digitally capturing images of paper documents.
document life cycle The span of a document’s use, from creation, through active use, storage, and fi nal disposition, which may be destruction or preservation.
document life cycle security (DLS) Providing a secure and controlled environ- ment for e-documents. This can be accomplished by properly implementing technologies including information rights management and data loss prevention, along with complementary technologies like digital signatures.
document management Managing documents throughout their life cycle from creation to fi nal disposition, including managing revisions. Also called document life cycle management.
document type A term used by many software systems to refer to a grouping of related records.
e-document An electronic document (i.e., a document in digital form).
electronic Code of Federal Regulations (e-CFR) An unoffi cial, editorial com- pilation of CFR material and Federal Register amendments produced by the National Archives and Records Administration’s Offi ce of the Federal Register and the Government Printing Offi ce.
electronic document and records management system (EDRMS) Software that has the ability to manage documents and records.
electronic records management (ERM) The management of electronic and nonelectronic records by software, including maintaining disposition sched- ules for keeping records for specifi ed retention periods, archiving, or de- struction. (For enterprise rights management, see information rights management [IRM ].) MM
406 GLOSSARY
bgloss 406 February 28, 2014 2:02 PM
electronic record Information recorded in a form that requires a computer or oth- er machine to process and view it and that satisfi es the legal or business defi nition of a record.
electronic records repository A direct access device on which the electronic re- cords and associated metadata are stored.
electronically stored information (ESI) Any information stored by electronic means; this can include not just e-mail and e-documents but also audio and video recordings and any other type of information stored on electronic media. The term was created in 2006 when the U.S. Federal Rules of Civil Procedure were revised to include the governance of ESI in litigation.
e-mail and e-document encryption Encryption or scrambling (and often authen- tication) of e-mail messages, which can be done in order to protect the content from being read by unintended recipients.
enterprise content management (ECM) Software that manages unstructured information such as e-documents, document images, e-mail, word processing documents, spreadsheets, Web content, and other documents; most systems also include some records management capability.
enterprise process analytics Detailed statistics and analysis of business process cycle times and other data occurring throughout an enterprise. This business intelligence can help spot bottlenecks, optimize work fl ow, and improve worker productivity while improving input for decision making.
enterprise risk profi le An assessment of the threats and risks an enterprise faces and the likelihood of those risks occurring.
event-based disposition A disposition instruction in which a record is eligible for the specifi ed disposition (transfer or destroy) when or immediately after the speci- fi ed event occurs. No retention period is applied, and there is no fi xed waiting period, as with timed or combination timed-event dispositions. Example: Destroy when no longer needed for current operations.
faceted search Where document collections are classifi ed in multiple ways rather than in a single, rigid taxonomy.
faceted taxonomy Allow for multiple organizing principles to be applied to in- formation along various dimensions. Facets can contain subjects, departments, business units, processes, tasks, interests, security levels, and other attributes used to describe information. There is never really one single taxonomy but rather col- lections of taxonomies that describe different aspects of information.
Federal Rules of Civil Procedure (FRCP)—Amended 2006 In U.S. civil litiga- tion, the FRCP governs the discovery and exchange of electronically stored infor- mation, which includes not only e-mail but all forms of information that can be stored electronically.
fi le plan A graphic representation of the business classifi cation scheme, usually a hi- erarchical structure consisting of headings and folders to indicate where and when records should be created during the conduct of business of an offi ce. In other words, the fi le plan links the records to their business context.
GLOSSARY 407
bgloss 407 February 28, 2014 2:02 PM
fi le transfer protocol (FTP) A standard network protocol used to copy a fi le from one host to another over a TCP-based network, such as the Internet. FTP is built on a client-server architecture and utilizes separate control and data connections between the client and server. FTP users may authenticate themselves using a clear-text sign-in protocol but can connect anonymously if the server is confi g- ured to allow it.
folksonomy The term used for a free-form, social approach to metadata assignment. Folksonomies are not an ordered classifi cation system but are lists of keywords input by users that are ranked by popularity.
functional retention schedule A schedule that groups records series based on busi- ness functions, such as fi nancial, legal, product management, or sales. Each func- tion or grouping is also used for classifi cation. Rather than detail every sequence of records, these larger functional groups are less numerous and are easier for users to understand.
Generally Accepted Recordkeeping Principles ® (the Principles) A set of eight principles published in 2009 by U.S.-based ARMA International to foster aware- ness of good recordkeeping practices and to provide guidance for records manage- ment maturity in organizations. These principles and associated metrics provide an information governance framework that can support continuous improvement.
governance model A framework or model that can assist in guiding governance efforts. Examples include using a SharePoint governance model, the information governance reference model (IGRM), MIKE2.0, and others.
guiding principles The basic principles used to guide the development of a gov- ernance model (e.g., for a SharePoint deployment). They may include principles such accountability (who is accountable for managing the site, who is accountable for certain content), who has authorized access to which documents, and whether the governance model is required for use or is to be used optionally as a reference.
heat map A color-coded matrix generated by stakeholders voting on risk level by color (e.g., red being highest).
HIPAA The Healthcare Insurance Portability and Accountability Act enacted by the U.S. Congress in 1996. Title II of HIPAA, known as the administrative sim- plifi cation (AS) provision, requires the establishment of national standards for electronic health care transactions and national identifi ers for providers, health insurance plans, and employers.
hot site One that has identical or nearly identical hardware and operating system confi gurations and copies of application software, and receives live, real-time backup data from business operations. In the event of a business interruption, the information technology and electronic vital records operations can be switched over automatically, providing uninterrupted service.
information footprint The total size of the amount of information an organization manages.
information governance (IG) A subset of corporate governance. It is an all- encompassing term for how an organization manages the totality of its information. IG “encompasses the policies and leveraged technologies meant to dictate and
408 GLOSSARY
bgloss 408 February 28, 2014 2:02 PM
manage what corporate information is retained, where and for how long, and also how it is retained (e.g., protected, replicated, and secured). Information gover- nance spans retention, security, and life cycle management issues.” 1 IG is an ongo- ing program that helps organizations meet external compliance and legal demands and internal governance rules.
information governance reference model (IGRM) A graphically depicted practi- cal framework that includes risk and profi t considerations for the business, legal, informational technology, records and information management (RIM), and privacy and security functions of an organization. IGRM enables organizations to establish IG programs that more effectively deal with the rising volume and diversity of information and the risks, costs, and complications this presents. IGRM is most frequently used to facilitate dialogue and combine disparate infor- mation stakeholders and perspectives across legal, records, information technol- ogy, and business organizations.
information life cycle The span of the use of information, from creation, through active use, storage, and fi nal disposition, which may be destruction or preservation.
information map A graphic diagram that shows where information is created, where it resides, and the path it takes.
information rights management (IRM) Often referred to as enterprise rights man- agement (ERM) or enterprise digital rights management (E-DRM). IRM applies to a technology set that protects sensitive information, usually documents or e- mail messages, from unauthorized access. IRM is technology that allows for infor- mation (mostly in the form of documents) to be remote controlled. Information and its control can be separately created, viewed, edited, and distributed.
information technology (IT) Technology used to manage digital information.
IT governance Controls and process to improve the effectiveness of information technology; also, the primary way that stakeholders can ensure that investments in IT create business value and contribute toward meeting business objectives.
IT governance framework Constructs or frameworks that guide informational technology governance efforts, including CobiT® and ITIL.
ITIL (Information Technology Infrastructure Library) A set of process-oriented best practices and guidance originally developed in the United Kingdom to stan- dardize delivery of informational technology service management. ITIL is appli- cable to both the private and public sectors and, according to its Web site, is the “most widely accepted approach to IT service management in the world.”
inherited metadata Automatically assigning certain metadata to records based on rules that are established in advance and set up by a system administrator.
inventorying records A descriptive listing of each record series or system, together with an indication of location and other pertinent data. It is not a list of each docu- ment or each folder but rather of each series or system.
ISO International Organization for Standardization, a highly regarded and widely accepted global standards body.
GLOSSARY 409
bgloss 409 February 28, 2014 2:02 PM
jukebox (optical disk jukebox) Optical disc autochanger units for mass storage that use robotics to pick and mount optical disks and remove and replace them after use; dubbed a “jukebox” for its similarity in mechanics to jukebox units for playing vinyl records and later CDs.
knowledge management (KM) The accumulation, organization, and use of expe- rience and lessons learned, which can be leveraged to improve future decision- making efforts. KM often involves listing and indexing subject matter experts, project categories, reports, studies, proposals, and other intellectual property sources or outputs that are retained to build corporate memory. Good KM sys- tems help train new employees and reduce the impact of turnover and retirement of key employees.
legal hold or litigation hold Also known as a preservation order or hold order. A temporary suspension of the company’s document retention destruction poli- cies for the documents that may be relevant to a lawsuit or that are reasonably anticipated to be relevant. It is a stipulation requiring the company to preserve all data that may relate to a legal action involving the company. A litigation hold ensures that the documents relating to the litigation are not destroyed and are available for the discovery process prior to litigation. The legal hold process is a foundational element of information governance.
legal hold notifi cation (LHN) The process of identifying information that may be requested in legal proceeding and locking that (data or documents) down to prevent editing or deletion while notifying all parties within an organization who may be involved in processing that information that it is subject to a legal hold. LHN man- agement is arguably the absolute minimum an organization should be doing in order to meet the guidelines provided by court rules, common law, and case law precedent.
limitation period The length of time after which a legal action cannot be brought before the courts. Limitation periods determine the length of time records must be kept to support court actions, including subsequent appeal periods.
long-term digital preservation (LTDP) The managed activities, methods, stan- dards, and technologies used to provide long-term, error-free storage of digital information, with means for retrieval and interpretation, for the entire time span the information is required to be retained.
magnetic disk drives A common data storage device using erasable magnetic media. Magnetic disk drives are common peripherals and built-in storage devices in desk- top PCs, minicomputers, and mainframe computers.
master retention schedule A retention schedule that includes the retention and disposition requirements for records series that cross business unit boundaries. The master retention schedule contains all records series in the entire enterprise.
metadata Data about data, or detailed information describing context, content, and structure of records and their management through time. Examples include the author, department, document type, date created, and length, among others.
migration The act of moving records from one system to another while maintain- ing their authenticity, integrity, reliability, and usability.
410 GLOSSARY
bgloss 410 February 28, 2014 2:02 PM
negotiated procurement A way to acquire a new system or components when the buying organization wants to make a rapid decision and requirements are known (e.g., making a bulk purchase of additional workstations or tablet computers that will be added to an existing network). Often a trusted consulting fi rm is engaged to solicit bids, negotiate with vendors, and make a recommendation for procure- ment. This approach can be a better fi t than issuing a request for proposal when cost and time are leading issues.
NENR Nonerasable, nonrewritable media (e.g., optical, magnetic) that, once writ- ten, do not allow for erasure or overwriting of the original data.
OAIS (Open Archival Information System) Describes how to prepare and submit digital objects for long-term digital preservation and retrieval but does not specify technologies, techniques, or content types. The OAIS Reference Model defi nes an archival information system as an archive, consisting of an organization of peo- ple and systems that has accepted the responsibility to preserve information and make it available and understandable for a designated community (i.e., potential users or consumers), who should be able to understand the information. Thus, the context of an OAIS-compliant digital repository includes producers who origi- nate the information to be preserved in the repository, consumers who retrieve the information, and a management/organization that hosts and administers the digital assets being preserved. The OAIS Information Model employs three types of information packages: a Submission Information Package (SIP), an Archival Information Package (AIP), and a Dissemination Information Package (DIP). An OAIS-compliant digital repository preserves AIPs and any preservation descrip- tion information (PDI) associated with them. A SIP encompasses digital content that a producer has organized for submission to the OAIS. After the completion of quality assurance and normalization procedures, an AIP is created, which is the focus of preservation activity. Subsequently, a DIP is created that consists of an AIP or information extracted from an AIP that is customized to the requirements of the designated community of users and consumers.
optical character recognition (OCR) A visual recognition process that involves photo-scanning text character by character.
optical disk Round, platter-shape storage media written to using laser technologies. Optical disk drives use lasers to record and retrieve information, and optical me- dia has a much longer useful life (some purported to be 100 years or more) than magnetic.
phishing A way of attempting to acquire sensitive information, such as user names, passwords, and credit card details, by masquerading as a trustworthy entity in an electronic communication. Communications purporting to be from popu- lar social Web sites, auction sites, online payment processors, or information technology administrators are commonly used to lure the unsuspecting public. Phishing typically is carried out by e-mail or instant messaging, and it often di- rects users to enter details at a fake Web site that looks and feels almost identical to the legitimate one. Phishing is an example of social engineering techniques used to fool users, and it exploits the poor usability of current Web security technologies.
GLOSSARY 411
bgloss 411 February 28, 2014 2:02 PM
PII (personally identifi able information) Information about individuals that iden- tifi es them personally, such as Social Security number, address, credit card infor- mation, health information, and the like. PII is subject to privacy laws.
predictive coding A court-endorsed process utilized to perform document review during the early case assessment phase of e-discovery. It uses human expertise and information technology to facilitate analysis and sorting of documents. Predictive coding software leverages human analysis when experts review a subset of docu- ments to “teach” the software what to look for, so it can apply this logic to the full set of documents, making the sorting and culling process faster and more accurate than solely using human review or automated review.
preservation description information (PDI) In the long-term digital preserva- tion process adhering to the Open Archival Information System reference model, description information such as provenance, context, and fi xity.
process-enabled technologies Information technologies that automate and streamline business processes. Process-enabled technologies often are divided into two categories that have a great deal in common: work fl ow automation or busi- ness process management. It is fair to say that a good deal of the technology that underpins business process management concepts has its roots in the late 1980s and early 1990s and stems from the early efforts of the work fl ow community.
project charter A document that formally authorizes a project to move forward. Having such a document reduces project cancellation risk due to lack of sup- port or perceived value to the company. A charter documents the project’s overall objectives and helps manage expectations of those involved.
project management The process of managing required project activities and tasks in a formal manner to complete a project; performed primarily by the project manager.
project manager The person primarily responsible for managing a project to its successful completion.
project plan Includes the project charter and project schedule and a delineation of all project team members and their roles and responsibilities.
project schedule A listing of project tasks, subtasks, and estimated completion times.
policy A high-level overall plan, containing a set of principles that embrace the gen- eral goals of the organization and are used as a basis for decisions. A policy can include some specifi cs of processes allowed and not allowed.
preservation The processes and operations involved in ensuring the technical and intellectual survival of authentic records through time. Preservation involves recording information created, received, and maintained as evidence and informa- tion by an organization or person, in pursuit of legal obligations or in the transac- tion of business.
provenance In records management, information about who created a record and what it is used for.
412 GLOSSARY
bgloss 412 February 28, 2014 2:02 PM
records appraisal The process of assessing the value and risk of records to deter- mine their retention and disposition requirements. Legal research is outlined in appraisal reports. This may be accomplished as a part of the process of developing the records retention schedules as well as conducting a regular review to ensure that citations and requirements are current.
record category A description of a particular set of records within a fi le plan. Each category has retention and disposition data associated with it, applied to all record folders and records within the category.
records integrity Refers to the accuracy and consistency of records, and the assur- ance that they are genuine and unaltered.
records management (RM) or records and information management (RIM)) The fi eld of management responsible for the effi cient and systematic control of the creation, receipt, maintenance, use, and disposition of records, including pro- cesses for capturing and maintaining evidence of and information about business activities and transactions in the form of records. It is also the set of instructions allocated to a class or fi le to determine the length of time for which records should be retained by the organization for business purposes, and the eventual fate of the records on completion of this period of time.
records retention schedule Spells out how long different types of records are to be held and how they will be archived or disposed of at the end of their life cycle. Such a schedule considers legal, regulatory, operational, and historical requirements.
record series A group or unit of identical or related records that are normally used and fi led as a unit and that can be evaluated as a unit or business function for scheduling purposes.
refreshment The process of copying stored e-records to new copies of the same media, to extend the storage life of the record by using new media.
return on investment (ROI) A common investment return measure, where the fi nancial benefi t is divided by the cost rendering a percentage or ratio.
risk assessment An evaluation of the risks and possible bad outcomes an organiza- tion faces and the likelihood these may occur.
risk map A simple identifi cation and ranking of the 10 greatest risks an organization faces in relation to business objectives. The risk map is a visual tool that is easy to grasp, with a grid depicting a likelihood axis and an impact axis, usually rated on a scale of 1 to 5.
risk profi le A listing of risks an organization faces and their relative liklihood; used as a basic building block in enterprise risk management that assists executives in understanding the risks associated with stated business objectives, and allocating resources, within a structured evaluation approach or framework.
secure sockets layer (SSL)/transport layer security (TLS) Cryptographic pro- tocols that provide communications security over the Internet. SSL and TLS encrypt the segments of network connections above the transport layer, using
GLOSSARY 413
bgloss 413 February 28, 2014 2:02 PM
symmetric cryptography for privacy and a keyed message authentication code for message reliability.
senior records offi cer (SRO) The leading records manager in an organization; may also be titled chief records offi cer or similar.
service-level agreement (SLA) The service or maintenance contract that states the explicit levels of support, response time windows or ranges, escalation procedures in the event of a persistent problem, and possible penalties for nonconformance in the event the vendor does not meet its contractual obligations.
service-oriented architecture (SOA) An information technology architecture that separates infrastructure, applications, and data into layers.
Six Sigma A highly structured approach for eliminating defects in any process, whether from manufacturing or transactional processes. It can be applied to a product or a service-oriented process in any organization. Further, six sigma is a statistical term that measures how far a given process deviates from perfection. The goal of the Six Sigma is to systematically measure and eliminate defects in a process, aiming for a level of fewer than 3.4 defects per million instances, or “opportunities.”
social tagging A method that allows users to manage content with metadata they apply themselves using keywords or metadata tags. Unlike traditional classifi ca- tion, which uses a controlled vocabulary, social tagging keywords are freely chosen by each individual. This can help uncover new categories of documents that are emerging and helps users fi nd information using their terms they believe are relevant.
solid state disk drive Storage devices that can be built in or external that have no moving parts and are made of semiconductor materials. They are used more often in tablet computers as they are faster and more reliable than magnetic disk drives, although also more expensive. Memory sticks and removable USB thumb or fl ash drives are also solid state technology.
spoliation The loss of proven authenticity of a record. Spoliation can occur in the case of e-mail records if they are not captured in real time or if they have been edited in any way.
strategic planning A systematic process of envisioning a desired future and trans- lating this vision into broadly defi ned goals or objectives and a sequence of steps to achieve them.
structured data/records A collection of records or data that is stored in a com- puter; records maintained in a database or application.
subject matter expert (SME) A person with deep knowledge of a particular topical area. SMEs can be useful in the consultation phase of the taxonomy design process.
subject records (Also referred to as topic or function records.) Records containing information relating to specifi c or general topics. The records are arranged by in- formational content or by the function, activity, or transaction to which they pertain.
414 GLOSSARY
bgloss 414 February 28, 2014 2:02 PM
submission information package (SIP) One of three types of information pack- ages that can be submitted in the Open Archival Information System preservation model.
taxonomy A hierarchical structure of information components (e.g., a subject, busi- ness unit, or functional taxonomy), any part of which can be used to classify a content item in relation to other items in the structure.
technology-assisted review (TAR) (Also known as computer-assisted review). In- cludes aspects of the nonlinear review process, such as culling, clustering, and de-duplication, but TAR does not meet the requirements for comprehensive pre- dictive coding. According to Barry Murphy of eDJ Group, here are three main methods for using technology to make legal review faster, less costly, and generally smarter:
1. Rules driven . “I know what I am looking for and how to profi le it.” In this sce- nario, a case team creates a set of criteria, or rules, for document review and builds what is essentially a coding manual. The rules are fed into the tool for execution on the document set.
2. Facet driven . “I let the system show me the profi le groups fi rst.” In this sce- nario, a tool analyzes documents for potential items of interest or groups po- tentially similar items together so that reviewers can begin applying decisions.
3. Propagation based.d “I start making decisions and the system looks for similar- related items.” This type of TAR is about passing along, or propagating, what is known based on a sample set of documents to the rest of the documents in a corpus.
text mining Performing detailed full-text searches on the content of document.
thesaurus In taxonomies, a listing that contains all synonyms and defi nitions and is used to enforce naming conventions in a controlled vocabulary (e.g., invoice and bill could be terms that are used interchangeably).l
time- /date-based disposition A disposition instruction specifying when a record shall be cut off and when a fi xed retention period is applied. The retention period does not begin until after the records have been cut off, for example: Destroy after two years.
time, date, and event based A disposition instruction specifying that a record shall be disposed of after a fi xed period of disposition time after a predictable or speci- fi ed event. Once the specifi ed event has occurred, then the retention period is applied. Example: Destroy three years after close of case. In this example, the record does not start its retention period until after the case is closed. At that time, its folder is cut off and the retention period (three years) is applied.
total cost of ownership (TCO) All costs associated with owning a system over the life of the installation and implementation—usually considered over a range of three to fi ve years. TCO includes implementation price and change orders (and the change order approval process), which occur when changes to the project are made outside of the original proposal. Timing and pricing of the software support
GLOSSARY 415
bgloss 415 February 28, 2014 2:02 PM
fees are also critical TCO components and may include warranty periods, annual fees, planned and maximum increases, trade-in and upgrade costs, hardware main- tenance costs, and other charges that may not be immediately apparent to buyers.
transfer Moving records from one location to another, or change of custody, owner- ship, and/or responsibility for records.
unstructured records Records that are not expressed in numerical rows and col- umns but rather are objects, such as image fi les, e-mail fi les, Microsoft Offi ce fi les, and so forth. Structured records are maintained in databases.
usage (records) The purpose a record is used for (i.e., its primary use).
ValIT A newer value-oriented information technology governance framework that is compatible with and complementary to CobiT. Its principles and best practices focus is on leveraging IT investments to gain maximum value.
vital records Mission-critical records that are necessary for an organization to con- tinue to operate in the event of disruption or disaster and cannot be re-created from any other source. Typically, they make up about 3 to 5 percent of an organi- zation’s total records. They are the most important records to be protected, and a plan for disaster recovery/business continuity must be in place to safeguard these records.
warm site A computer facility location that has all (or almost all) of the hardware and operating systems as a hot site does, and software licenses for the same appli- cations, and needs only to have data loaded to resume normal operations. Internal information technology staff may have to retrieve magnetic tapes, optical disks, or other storage media containing the most recent backup data, and some data may be lost if the backup is not real time and continuous.
work fl ow, work fl ow automation, and work fl ow software Software that can route electronic folders through a series of work steps to speed processing and improve auditability. Not to be confused with business process management sys- tems, which have more robust capabilities.
WORM Write Once Read Many optical disk storage media that is nonerasable and can be written to only one time.
Notes
1. Kathleen Reidy, “The Rise of Information Governance,” Too Much Information: The 451 Take on In- formation Management (blog), August 5, 2009, http://blogs.the451group.com/information_manage-t ment/2009/08/05/the-rise-of-information-governance/
417
babout 417 February 28, 2014 1:53 PM
ABOUT THE AUTHOR
Robert F. Smallwood is a founding partner of IMERGE Consulting and heads up its E-Records Institute, a specialty consulting practice, as executive director. Mr. Smallwood has over 25 years of experience in the information technology industry and holds an MBA from Loyola University of New Orleans. He has been recognized as one of the industry’s “25 Most Infl uential People” and “Top 3 Independent Consultants” by KM World magazine. He consults with Fortune 500 companies and governmentsd to assist them in making technology decisions and implementations. Some of his past research and consulting clients include the World Bank, Johnson & Johnson, Apple, Miller-Coors, AT&T, the Supreme Court of Canada, Xerox, and IBM. Smallwood was an AIIM International chapter founder and president, and a member of the executive committee of the Board of Direcctors, and is active in ARMA International. He has published more than 100 articles and given more than 50 conference presentations on documents, content, and records management. He is the author of Managing Elec- tronic Records: Methods, Best Practices, and Technologies (Wiley, 2013); s Safeguarding Critical E-Documents (Wiley, 2012); s Managing Social Media Business Records (CreateSpace, s 2011) , Taming the Email Tiger (Bacchus Business Books, 2008) and several other r books, including a novel, a theatrical play, and the fi rst published personal account of Hurricane Katrina.
Information Governance: Concepts, Strategies and Best Practices By Robert F. Smallwood Copyright © 2014 by Robert F. Smallwood
419
both01 419 February 28, 2014 2:03 PM
Lori J. Ashley is a Wisconsin-based consultant, writer, and educator dedicated toy helping clients improve the performance of their record and information management practices and controls. An experienced business strategist and organizational devel- opment specialist, she has codeveloped four continuous improvement methodologies aimed at jump-starting collaboration among stakeholders who share accountability for effective and effi cient life cycle management of valued records and information assets.
Barbara Blackburn , CRM, is an electronic records management consultant who as- sists organizations in defi ning, researching, selecting, and implementing cost-effective solutions. She assists clients in preparing for technology deployment by providing strategic planning and developing record-keeping programs and taxonomies. Ms. Blackburn has expert taxonomy design skills and has taught AIIM’s Electronic Records Management and Electronic Content Management certifi cation classroom courses.
Barclay T. Blair is an advisor to Fortune 500 companies, software and hardware r vendors, and government institutions and is an author, speaker, and internationally recognized authority on information governance. He has led several high-profi le consulting engagements at the world’s leading institutions to help them globally transform the way they manage information. Mr. Blair is the president and founder of ViaLumina.
Charmaine Brooks, CRM, is a principal with IMERGE Consulting, Inc., and has more than 25 years of experience in records and information management and content management. Ms. Brooks is a certifi ed trainer and has taught AIIM classroom courses on ERM and provided many workshops for ARMA. Formerly a records manager for a leading worldwide provider of semiconductor memory solutions and a manager in a records management software development company, today Ms. Brooks provides clients, small and large, public and private, with guidance in developing records man- agement and information governance programs.
Monica Crocker, CRM, PMP, CIP, is the corporate records manager for Land r O’Lakes, Inc. Ms. Crocker has also been an information management consultant for 20 years, defi ning content and records management best practices for organizations across the United States. Her expertise includes SharePoint governance, cloud com- puting, enterprise strategies for content management, records management, electronic discovery, taxonomy design, project management, and business process redesign. Ms. Crocker is a recipient of AIIM’s Distinguished Service Award.
Charles M. Dollar is an internationally recognized archival educator, consultant, and r author who draws on more than three decades of knowledge and experience in work- ing with public and private sector organizations to optimize the use of information technologies to satisfy legal, regulatory, business, and cultural memory recordkeep- ing requirements for digital preservation. He is co-developer of a capability maturity
ABOUT THE MAJOR CONTRIBUTORS
Information Governance: Concepts, Strategies and Best Practices By Robert F. Smallwood Copyright © 2014 by Robert F. Smallwood
420 ABOUT THE MAJOR CONTRIBUTORS
both01 420 February 28, 2014 2:03 PM
model for long-term digital preservation that incorporates the specifi cations of ISO 15489, ISO 14721, ISO 18492, and ISO 16363.
Patricia Franks, Ph.D., is a certifi ed records manager and the coordinator for the Master of Archives and Records Administration degree program in the School of Library and Information Science at San José State University. She served as the team lead for both the ANSI/ARMA standard released in January of 2011, Implications of Web-based Collaborative Technologies in Records Management , and the 2012 technical re-t port, Using Social Media in Organizations . Her latest publication, s Records and Infor- mation Management (ALA Neal-Schuman, 2013), offers insight into a range of topicst affecting records and information management professionals.
Randolph Kahn, Esq., is the founder of Kahn Consulting, one the premier informa- tion governance advisory fi rms. The Kahn Consulting team has provided consulting services to major global organizations, including advising U.S. and foreign govern- ments, courts systems, and major multinational corporations on a wide variety of in- formation issues, including e-communications strategies, social media policy, records management programs implementation, and litigation response processes. Mr. Kahn is a highly sought after speaker and a two-time recipient of the Britt Literary Award. He has authored dozens of published works, including Chucking Daisies , his new book on s defensible disposition; Email Rules ; s Information Nation: Seven Keys to Information Man- agement Compliance ; Information Nation Warrior ; and r Privacy Nation . He is a cofounder of the Council for Information Auto-Classifi cation and has been expert witness and an advocate in many industry organizations. Mr. Kahn is an attorney who attained his J.D. degree from Washington University in St. Louis, Missouri, and he has taught at George Washington University.
Barry Murphy is a cofounder of eDJ Group, Inc. and a thought leader in informationy governance, e-discovery, records management, and content archiving. Previously, he was director of product marketing at Mimosa Systems, a leading content archiving and e-discovery software provider. He joined Mimosa after a highly successful stint as principal analyst for e-discovery, records management, and content archiving at Forrester Research. Mr. Murphy received a B.S. from the State University of New York at Binghamton and an M.B.A. from the University of Notre Dame. He is an ac- tive member of both AIIM and ARMA.
421
bindex 421 February 28, 2014 2:03 PM
Abatan, Peter, 228, 229 Aberdeen Group, 271 Accenture, 9 Accessibility of information:
costs associated with, 104 identity access management for,
212–213, 272 long-term digital preservation for,
26, 32, 322, 340–341, 343 principles of IG including, 26,
28, 32, 35, 37 records and information management
availability principle on, 28, 32, 35, 37, 151, 309
security balanced with, 26, 32, 151, 203, 212–213, 215–216, 224
Accountability: for data governance, 16, 192 for disposition, 133 for IG policy implementation, 88 for IT governance, 17 for maintenance of IG program,
349–350 principles of IG including, 27,
28, 30, 35, 36 for records and information
management, 28, 30, 35, 36, 53, 133, 309, 311–312
for SharePoint, 309, 311–312 for social media, 267 for strategic planning, 53–54
Adler, Steven, 192 Adobe, 85, 331, 332 AirWatch, 275 Aldus Corporation, 331–332 Alperovitch, Dmitri, 207 Amazon:
Elastic Compute Cloud service, 296
Web Services, 344 American National Standards Institute
(ANSI), 76, 87, 155, 371
Andrews, James, 259 AntiSec, 241–242 AOL Instant Messenger,
247, 249 Apple:
AppSense, 275 iOS, 271, 276, 279 iPhone, 271, 278 iTunes App Store, 278–279
Application programming interface (API), 293–294
ArchiveFacebook, 261 Archivematica, 344 Archiving information, 33, 34,
63–64, 85–86, 177, 244–247, 248–249, 261–262, 263, 321–323, 339. See also Long-term digital preservation
Association for Information and Image Management (AIIM), 176
Association of Records Managers and Administrators (ARMA), 6, 20, 28, 34, 62, 71, 72, 147, 155, 176
Auditing: database auditing tools for, 203 IG policies, 89–90 long-term digital preservation audit
and certifi cation standards, 325–327
principles of IG including, 26, 30, 32
records and information management including, 30, 32, 150, 183
risk mitigation plan, 51, 63 security functions including, 26, 203,
211, 213, 225, 291 strategic planning including, 63 technology-assisted review, 130
Australasian Digital Recordkeeping Initiative (ADRI), 80
INDEX
Information Governance: Concepts, Strategies and Best Practices By Robert F. Smallwood Copyright © 2014 by Robert F. Smallwood
422 INDEX
bindex 422 February 28, 2014 2:03 PM
Australia: AS 4390-1996 records and
information management standard in, 84
AS 5044-2010 metadata standard in, 85
AS 5090:2003 records and information management standard in, 85
AS 8015 IT governance standard in, 19–20, 79, 201
Archives Act in, 391, 392 Australian Government Locator
Service in, 85 Australian Government
Recordkeeping Metadata Standard Version 2.0 in, 84–85
Australian Information Commissioner Act 2010 in, 392
Crimes Act 1914 in, 393 Designing and Implementing
Recordkeeping Systems (DIRKS) used in, 62, 80, 155
Electronic Transactions Act 1999 in, 393
Evidence Act 1995 in, 393 Financial Management and
Accountability Act 1997 in, 393 Freedom of Information Amendment
[Reform] Act 2010 in, 169, 391–392
AS ISO 15489 records and information management standard in, 84, 85
National Archives of Australia in, 80, 393
Offi ce of the Australian Information Commissioner in, 392
Privacy Act 1988 in, 392, 398 records and information management
regulations and standards in, 84–85, 149, 150, 303, 391–393
Standards Australia in, 76, 84, 87 standards in, 19–20, 76, 79,
84–85, 201
Bearing Point, 62 Best Buy, 264
Best practices: for cloud computing, 64 of cross-functional IG
implementation team, 62 for disposition of information, 62,
63–64 of executive sponsorship, 63, 65 for IG policy development and
enforcement, 62, 75–76, 87–88 for instant messaging, 247–249 for international and national
guideline standards usage, 64 for IT functions for IG, 190, 202–203 for long-term digital preservation,
64–65 for maturity model usage, 62 for metadata and taxonomy usage, 64,
190 for mobile devices, 280–281 for ongoing program aspect of IG,
61–62 for privacy protection, 63 for records and information
management, 61, 62 for retention of information, 62–63,
64–65 for risk management, 62–63 of security functions, 62, 63, 202–203 for social media, 64, 262, 267–268 strategic planning consideration of,
61–65 Big Data, 3–5, 100–101,
106–107, 117, 355 Biometric authentication technologies,
272, 277 Blair, Barclay, 8 Blogs, 260, 265 Bloomberg Messaging, 247 Bollinger, Bryan, 108 Booz Allen Hamilton, 241–242 Box, 289 BoxTone, 275 British Standards Institute (BSI),
76, 371 Broddy, William, 216 Business considerations:
business classifi cation schemes as, 368–369
INDEX 423
bindex 423 February 28, 2014 2:03 PM
business conditions and economic environment survey, 59–60
business continuity management as, 86–87, 150, 153, 320, 321, 327, 350
business intelligence for, 191, 194 business process analysis as, 377–379 changing information environment
as, 97–99 cloud computing as, 285, 297 corporate culture impacts as, 107 cost sources impacting, 103–105 data governance impact as, 16 disposition issues related to, 103,
136–137 full cost accounting of, 101–102 IG as good business, 7–8, 110–111 IG-enabled organization positives as,
110–111 impact of successful IG program as,
20–21, 97–112 information-calorie intake
analysis as, 108 information cap-and-trade
model as, 109 information cost calculations as,
99–100 information value creation as,
105–107 IT functions impacted by, 190,
194, 196–197 legal issues related to, 99–100,
103, 110, 125, 136–137 opportunities and challenges of Big
Data as, 100–101, 106–107 professionalism as, 153 records and information management
issues related to, 110, 149–150, 153, 303–304, 307–309
security functions related to, 111 SharePoint business objectives as,
303–304, 307–309 strategic plan alignment with, 57–58 taxonomies addressing, 356–357,
368–369, 377–379 unstructured information
management as, 97–99, 101–111 BWF (broadcast wave format), 333
Canada: Canada Revenue Agency, 82, 92,
388, 394 Canadian General Standards Board
(CGSB), 92, 394 Canadian Standards Association
(CSA), 92 cyberattacks on government of, 207 Electronic Records as Documentary
Evidence CAN/CGSB-72.34- 2005, 82, 92, 387–388, 394
Evidence Acts in, 82–83, 93, 388–389, 394–395
Fraser Health Authority in, 10 Freedom of Information and
Protection of Privacy Act in, 169 Health Information Act in, 169 Library and Archives Canada, 330 Microfi lm and Electronic Images as
Documentary Evidence CAN/ CGSB-72.11-93, 82, 92, 387–388, 394
privacy laws in, 169, 398 records and information management
regulations and standards in, 82, 92, 150, 303, 387–389, 394–395
records retention citation services in, 44, 138, 139, 178–179
Standards Council of Canada in, 76, 92, 394
standards in, 76, 82–83, 92–93, 387–388, 394
Centrify, 275 China:
instant messaging in, 247 mobile devices in, 271 security issues of fi les sent to, 229
CIOZone.com, 273 Cisco Unifi ed Presence, 247 CIS Database Server Benchmarks, 202 Citibank, 278 Citrix, 275 Cloud computing:
application programming interface in, 293–294
benefi ts of, 298–299 best practices for, 64 business considerations for, 285, 297
424 INDEX
bindex 424 February 28, 2014 2:03 PM
Cloud computing (continued ) cloud-based mobile device
management, 276 cloud deployment models, 289–290 community, 289 defi nition and description of, 285–286 disposition and retention issues in,
297, 299–300 employee/insider threats in, 291–292 growth of, 288 guidelines for, 300 hacking and unauthorized access in,
292–293, 295–296 hybrid, 289–290 hypervisors in, 294–295 IG policies on, 76, 291, 293,
296, 297–298 information breaches in, 291 information loss in, 290 IT trend analysis of, 59 key characteristics of, 287–288 legal issues with, 297 meaning of, 288–289 multitenancy and technology sharing
issues in, 294–295 neighbors/other users of
infrastructure in, 296–297 overview of, 285–286 private, 289 public, 289 records and information management
for, 151, 160, 297, 299–300 security issues with, 213, 224,
285–286, 290–298 Cloud Security Alliance, 290 CobiT® (Control Objectives for
Information and related Technology), 18, 111, 197, 198–199, 200
Code of Federal Regulations (CFR), 44–45, 138–140, 178, 386, 387
Communication: of business and fi nancial cost
considerations, 108 of IG policies, 25, 35, 89, 242–243,
248, 282, 352 of instant messaging policies, 248 of inventory goals, 158
of metadata use, 364 of mobile device policies, 282 principles of IG including, 25 of records and information
management policies, 31, 158, 169, 313–314
of security functions, 233–234 of SharePoint policies, 313–314 of strategic plan, 55
Compliance, Governance and Oversight Counsel (CGOC), 4, 72, 73
Computer-assisted review, 128–130, 135 Computer Fraud and Abuse Act, 210 Computerworld, 106 Conniff, Richard, 109 Consultative Committee for Space Data
Systems, 321 Corporate culture:
business and fi nancial impacts of, 107 IT governance impacted by, 199 legal and e-discovery readiness
impacted by, 124 SharePoint usage necessitating
changes to, 304–305 strategic planning consideration of, 58
Corporate governance: data governance in, 15–17, 25, 110,
191–194, 299–300 information governance in, 5, 6,
7, 15, 20 (see also(( Information governance)
IT governance in, 17–20, 79, 111, 196–201
Costs. See Financial issues Council of Australasian Archives and
Records Authorities, 80 Council of Information Auto-
Classifi cation, “Information Explosion” survey, 131
CTIA (The Wireless Association), 271 Customs and Border Protection, U.S.,
223 CyberArk, 209
Data architecture, 195 Database activity monitoring
(DAM), 203 Database auditing tools, 203
INDEX 425
bindex 425 February 28, 2014 2:03 PM
Data governance, 15–17, 25, 110, 191– 194, 299–300
Data Governance Institute, 193 Data loss prevention (DLP) technology,
220–222, 227–228, 231, 291, 292 Data modeling, 195–196, 197 Data Protection Act, 156 Defense in depth, 212 Delivery platforms:
best practices using, 64, 247–249, 262, 267–268, 280–281
cloud computing as, 59, 64, 76, 151, 160, 213, 224, 276, 285–301
disposition of information from, 63– 64, 125–126, 244–247, 248–249, 261–262, 263, 297, 299–300
e-mail as (see(( E-mail) IG for various, 8, 9, 11, 241–251,
253–268, 271–283, 285–301, 303–314
IG policies applied to, 76, 242–243, 247–249, 257, 258, 259–260, 262–264, 267, 276, 281–282, 291, 293, 296, 297–298, 310–311
instant messaging as, 243, 247–250, 257
IT trend analysis of, 59 legal issues related to specifi c, 116,
119, 125–126, 243–244, 245, 259– 260, 264–267, 282, 297, 303, 307
mobile devices as, 9, 11, 59, 151, 160, 164, 213, 220, 225, 230, 271–283, 298, 303
records and information management on various, 151, 159, 160, 164, 232, 264–267, 297, 299–300, 303–314
removable media as, 159, 164, 223, 277
retention of information on, 64, 126, 175–178, 243–247, 248–249, 261–262, 263, 264–267, 297, 299–300
risk management issues with, 242–243, 257–260
security issues with, 213, 217–218, 220, 223–224, 225, 226–227, 230,
233–234, 241–251, 256–268, 271–283, 285–286, 290–298, 303–314
SharePoint as, 160, 232, 303–314 social media as, 59, 64, 76, 151, 213,
253–268 training in specifi c, 258, 268, 282, 313
Department of Defense, U.S. (DoD) standards, 76, 80, 81–82, 179
Design Criteria Standard for Electronic Records Management Software Applications, 81
Designing and Implementing Recordkeeping Systems (DIRKS), 62, 80, 155
Device control methods, 227 Digital signatures, 218–219, 220 Digital Systems Knowledge Transfer
Network, 271 DISA Security Technical
Implementation Guides (STIGs), 202
Disasters, business continuity after, 86– 87, 150, 153, 320, 321, 327, 350
Disposition of information: accountability for, 133 archiving as, 33, 34, 63–64, 85–86,
177, 244–247, 248–249, 261–262, 263, 321–323, 339 (see also(( Long- term digital preservation)
auto-classifi cation and analytics technologies assisting with, 134–135
best practices for, 62, 63–64 business considerations related to,
103, 136–137 cloud computing, specifi cally, 297,
299–300 costs associated with, 103 discarding as, 34 e-mail, specifi cally, 63–64, 125–126,
244–247 essential steps to defensible, 136 event-based, 179–181 fi nal disposition and closure criteria,
181–182 IG policies on, 75–76, 121–122 imaging as, 34
426 INDEX
bindex 426 February 28, 2014 2:03 PM
Disposition of information (continued ) implementation of, 182–183 importance of, 4–5 information control through, 26 information value increased through
appropriate, 106 instant messages, specifi cally, 248–249 legally defensible, 4–5, 6, 8, 62, 117,
121–122, 125–126, 130–137 methods of, 34, 170 proving record destruction in, 183 purging as, 34 records and information management
addressing, 28, 33–34, 35, 37, 130–137, 150, 151, 170, 177–178, 179–183, 297, 299–300
shredding as, 34 social media, specifi cally, 261–262,
263 strategic plan consideration of,
62, 63–64 technologies assisting with,
134–136, 179, 183 volume of information necessitating
improved, 131–132 DLM Forum, 84 Document analytics, 232–233 Document labeling, 26, 231–232 Document life cycle security (DLS)
technologies, 291, 292. See also Data loss prevention (DLP) technology; Information rights management (IRM) software
Dropbox, 289 Dublin Core Metadata Initiative
(DCMI), 85, 365–366
Economist Intelligence Unit, 8, 105 E-discovery:
costs associated with, 60, 99–100, 103, 123
disposition issues with, 117, 121–122, 125–126
e-discovery process, steps of, 120 Electronic Discovery Reference
Model, 62, 72, 119–122 e-mail as, 244 Federal Rules of Civil Procedure
impacting, 115–116, 117–118, 119, 150, 265, 303
guidelines for e-discovery planning, 121–122
IG impact on, 123 IG proactive management of, 8 legal hold process impacting, 26, 60,
62, 117, 122–126, 297, 303 predictive coding assistance with,
58, 127–128 retention issues with, 4, 100,
121–126 social media as, 260, 264–265 techniques of, 119 technologies assisting with,
58, 126–130 technology-assisted review assistance
with, 128–130 Zubulake v. UBS Warburg on, 119g
Eisenberg, Anne, 99 Electronic Code of Federal Regulations
(e-CFR), 45, 139–140, 178 Electronic Communications Privacy Act
(ECPA), 210 Electronic Discovery Reference Model
(EDRM), 62, 72, 119–122 Electronic records management.
See Records and information management
E-mail: archiving of, 244–247 as business records, 175–176, 241,
245–246 destructive retention of, 64, 126,
177–178, 246–247 disposition of, 63–64, 125–126,
244–247 encryption of, 217, 226 IG control of, 8, 241–247 IG policies on, 76, 242–243 information value creation through,
106 legal issues related to, 116, 119,
125–126, 243–244, 245 ownership of, 98 realistic policies on, 243 retention of, 64, 126, 175–178,
243–247
INDEX 427
bindex 427 February 28, 2014 2:03 PM
risk management issues with, 242–243 security issues with, 217–218,
223–224, 226–227, 233–234, 241–247
social media distinction from, 257 stream messaging vs., 217–218,
233–234, 236 technology-agnostic policies on, 243 unstructured information
management including, 97–99, 106
Employees/staff: accountability of, 16, 17, 27,
28, 30, 35, 36, 53–54, 88, 133, 192, 267, 309, 311–312, 349–350
communication with (see(( Communication)
corporate culture among, 58, 107, 124, 199, 304–305
e-mail ownership issues with, 98 executive sponsorship by senior,
16, 25, 28, 30, 53–55, 63, 65, 88, 157, 159, 169, 182, 192,
197, 306, 349–350, 352, 388 IG benefi ts for, 8 IG continuity plan involving, 350 IG policies for (see(( Information
governance policies) IG teams/governance bodies
including, 11, 35, 38, 55, 56–57, 62, 88, 124–125, 262–263, 281, 306–307, 350
information misuse by, 8–10, 26, 208– 210, 228, 229, 242–243, 258–259, 291–292, 320–321
inventory team including, 157, 160 risk profi le interviews with, 47–48 stakeholder consultation including,
26–27 training for (see(( Training)
Encryption, 26, 164, 203, 217, 219–220, 225, 226–227, 228, 276, 277, 281, 291, 294
Enterprise content management (ECM), 149
Environmental Protection Agency, U.S., 101, 153
ePolicy Institute, 233, 244 Etsy, Dan, 109 European Union. See also specifi c
countries European Broadcasting Union in, 333 mobile devices in, 271 privacy laws in, 398 records and information management
regulations in, 303 Executive sponsorship:
continuity of, 350 for data governance, 16, 192 for IG maintenance, 349–350, 352 for IG policy development and
implementation, 88 for inventory of records, 157, 159 for IT governance, 197 key purposes of, 54 as principle of IG, 25, 28, 30 for records and information
management, 28, 30, 157, 159, 169, 182, 306, 388
for SharePoint implementation, 306 for strategic planning, 53–55, 63, 65
Facebook, 254, 256, 257, 261, 265 Federal Bureau of Investigation, 9 Federal Deposit Insurance Corporation
(FDIC), 280 Federal Information Security
Management Act of 2002, 296 Federal Register, 45, 139, 178 Federal Reserve Bank of New York, 244 Federal Rules of Civil Procedure
(FRCP): e-discovery impacts of, 115–116,
117–118, 119, 150, 265, 303 FRCP 1, 117 FRCP 16, 118 FRCP 26, 118, 119, 265 FRCP 33, 118 FRCP 34, 118 FRCP 37, 118
Federal Wiretap Act, 210 FedEx, 259 FILELAW®WW , 44, 138, 139, 178–179 Financial Institution Privacy Protection
Act of 2001/2003, 385
428 INDEX
bindex 428 February 28, 2014 2:03 PM
Financial issues: accessibility costs as, 104 business considerations based on, 7–8,
16, 20–21, 59–60, 99–112, 125, 136–137
business process structuring costs as, 104–105
classifi cation and organization costs as, 103
cost-benefi t analysis of, 20–21, 152 digitization and automation costs as,
103–104 disposition costs as, 103 e-discovery costs as, 60, 99–100, 103,
123 full cost accounting of, 101–102 IG enabling or maturity impacting,
110–111 information cost calculations as,
99–100 information value creation as, 105–
107 knowledge transfer costs as, 105 long-term digital preservation costs
as, 321 migration to current system costs as,
104 mobile device costs as, 281–282 policy management and compliance
costs as, 104 records and information management
costs as, 151, 152 retention costs as, 4–5, 99, 104, 131 risk assessment calculating, 48 security breach costs as, 207, 220–221,
227, 271 sources of costs in, 103–105 standards-related costs as, 77 strategic planning of budgets as, 53,
54, 59–60 unstructured information ownership
costs as, 102–105 Flash drives. See Removable media Flickr, 261 Flynn, Nancy, 233, 244, 245 Folksonomies, 381 Food and Drug Administration, 386 Ford Motor Company, 9
Forrester Research, 227, 230, 355 France:
privacy laws in, 398 records and information management
regulations in, 149 Société Générale breach in, 212
FRCP. See Federal Rules of Civil Procedure
Freedom of Information Act, U.S., 45–46, 156, 169, 210
Friedman, Ted, 5 Frost & Sullivan, 275 Fulbright and Jaworski research, 126,
177
Gartner, Inc., 3, 5, 10, 27, 189, 194, 220, 271, 275, 288, 356
Geithner, Timothy, 244 General Accounting Offi ce (GAO), 173 Generally Accepted Recordkeeping
Principles®, 27–35, 36–37, 53, 71, 74, 155, 171
Germany: privacy laws in, 398 records and information management
regulations in, 149 Global Aerospace, Inc., et al. v. Landow
Aviation, LP, et al., 127–128 Global Information Locator Service
(GILS), 366–367 Good Technology, 275 Google:
Android Marketplace of, 278–279 Android OS of, 271, 272, 276, 279 security breach of, 229
Government Printing Offi ce, 45, 139, 178
GPS (Global Positioning System), 273 Gramm-Leach-Bliley Act, 385 Gruman, Galen, 287
Health Insurance Portability and Accountability Act, 223, 385
Heartland, 296 Homeland Security, U.S., 223 House of Representatives Oversight and
Government Reform Committee, U.S., 244
INDEX 429
bindex 429 February 28, 2014 2:03 PM
Huawei Technologies, 9 Hypervisors, virtualization, 294–295
Ibas, 208 IBM:
Endpoint Manager for Mobile Devices, 275
Lotus Sametime, 247 Identity access management,
212–213, 272 IG. See Information governance India:
cyberattacks on government of, 207 mobile devices in, 271 privacy laws in, 399 records and information management
regulations in, 149 security issues of fi les sent to, 229
Indonesia, security of fi les sent to, 229 Information governance (IG):
auditing in (see(( Auditing) Big Data age necessitating, 3–5,
100–101, 106–107, 117, 355 business considerations in (see((
Business considerations) communication related to (see((
Communication) continuity plan for, 350 continuous improvement to, 27,
34–35, 36–37, 351–352 corporate governance including, 5, 6,
7, 15, 20 data governance distinction from,
15–17 (see also(( Data governance) defi nition and description of, 5–7, 20 delivery platforms for (see(( Delivery
platforms) disposition of information in (see((
Disposition of information) employees working with (see((
Employees/staff) executive sponsorship of (see((
Executive sponsorship) failures in, 8–10 fi nancial issues in (see(( Financial issues) impact of successful, 20–21 imperative for, 3–5 information technology functions in
(see(( Information technology (IT) functions)
IT governance distinction from, 17–20 (see also(( IT governance)
key points related to, 12, 21–22, 38, 51, 68, 90–91, 111–112, 142–143, 184–186, 204, 234–236, 250–251, 268, 283, 301, 314, 345–346, 352–353, 382
laws and regulations impacting (see(( Laws and regulations)
legal issues for (see(( Legal issues) long-term program issues with (see((
Long-term program issues) maintenance of IG program, 349–353 metadata management in
(see(( Metadata) monitoring in (see(( Monitoring) policies for (see(( Information
governance policies) principles of, 25–38 privacy protection in (see(( Privacy
protection) records and information management
in (see(( Records and information management)
retention of information and (see(( Retention of information)
risk management in (see(( Risk management)
security functions in (see(( Security functions)
strategic planning and best practices for (see(( Strategic planning)
taxonomies in (see(( Taxonomy/common terminology)
training in (see(( Training) Information governance policies:
accountability for, 88 best practices for developing and
enforcing, 62, 75–76, 87–88 business continuity management
under, 86–87 cloud computing under, 76, 291, 293,
296, 297–298 communication of, 25, 35, 89, 242–
243, 248, 282, 352
430 INDEX
bindex 430 February 28, 2014 2:03 PM
Information governance (continued ) controls, monitoring, auditing and
enforcement of, 89–90 cost of development of and
compliance with, 104 development of, 10–11, 25, 62, 71–91 disposition under, 75–76, 121–122 e-mail under, 76, 242–243 Information Governance Reference
Model usage for, 62, 72–75 instant messaging under, 243,
247–249 international and national standards
impacting, 76–88, 92–93 legal issues impacting, 76–88 long-term digital preservation under,
85–86, 326, 327, 337, 338 mobile devices under, 276, 281–282 realistic, 243 records and information management
under, 71, 74, 79–86, 92–93, 150–151, 310–311
retention under, 46, 75–76, 85–86, 121–122
risk management under, 46, 62–63, 75, 77
roles and responsibilities for, 88 security function under, 72, 78–79,
213, 214, 221, 222, 224, 233–234, 291, 293, 297–298
SharePoint under, 310–311 social media under, 76, 257, 258,
259–260, 262–264, 267 strategic plan shaping, 53–68 teams/governance bodies
determining, 11, 35, 38, 88 technology-agnostic, 243
training in, 35, 89, 282 Information Governance Reference
Model, 62, 72–75 Information life cycle management
(ILM), 195. See also Disposition of information; Retention of information
Information management, 194–196, 197 Information rights management (IRM)
software, 9, 26, 62, 164, 210, 222–226, 227–228, 229, 291, 292
Information technology (IT) functions: best practices for, 190, 202–203 business considerations impacting,
190, 194, 196–197 customization of, 190 data architecture as, 195 data governance as, 15–17, 25, 110,
191–194, 299–300 data modeling as, 195–196, 197 delivery platforms for (see(( Delivery
platforms) IG enabling or maturity impacting,
110–111 information life cycle management
as, 195 (see also(( Disposition of information; Retention of information)
information management as, 194–196, 197
IT governance as, 17–20, 79, 111, 196–201
IT network diagram detailing, 160 IT strategic planning as, 58, 59 IT trend analysis as, 59 master data management as, 194 overview of, 189–190, 204 records and information management
relationship to, 151, 160, 164, 176 risk management through, 192, 193, 198 security functions as, 202–203
Information Technology Infrastructure Library (ITIL), 18, 19, 197, 198, 200–201
Inside Out, 342 Insider threats, 8–10, 26, 208–210, 228,
229, 242–243, 258–259, 291–292, 320–321
Instagram, 261 Instant messaging:
best practices for, 247–249 disposition and retention of, 248–249 IG policies on, 243, 247–249 monitoring of, 249 security issues with, 247–250 social media distinction from, 257 tips for safer use of, 249–250
Intellectual property, security of, 9, 208–210, 223, 228, 229, 260
INDEX 431
bindex 431 February 28, 2014 2:03 PM
Intel/McAfee, 207–208 Internal Revenue Agency, 296 International Council on Archives
(ICA), Principles and Functional Requirements for Records in Electronic Offi ce Environments (Req), 80
International Data Corporation (IDC), 131, 272
International Olympic Committee, 207 International Organization for
Standardization (ISO): best practices on referral to, 64 IG policies impacted by, 76,
77–81, 84 ISO 14721:2003, 321 ISO 14721:2012, 85–86, 318, 325,
333, 334, 335–336 ISO 15489-1:2001, 79–80, 141, 155,
324 ISO 15489-2:2001, 80, 141 ISO 15498:2004, 332 ISO 15836:2009, 365 ISO 15849, 364–365, 369 ISO 16175, 80, 84 ISO 16175-1:2010, 141 ISO 16363 (2012), 325–327,
333, 334, 335 ISO 16363:2012, 86 ISO 17799, 18, 198 ISO 19005, 331 ISO 19005-1:2005, 85 ISO 22301:2012, 86–87 ISO 23081-1:2006, 364–365 ISO 23950, 366 ISO 25964, 371 ISO 28500:2009, 333 ISO 30300:2011, 80–81 ISO 30301:2011, 80–81 ISO 31000:2009, 77 ISO/IEC 13818-3:2000, 333 ISO/IEC 15444:2000, 332–333 ISO/IEC 20000, 19, 200 ISO/IEC 27001:2005, 78 ISO/IEC 27002:2005, 78, 210 ISO/IEC 38500:2008, 19–20,
79, 111, 201 ISO TR 18492 (2005), 86, 324–325
IT governance standards, 19–20, 111, 198, 200–201
long-term digital preservation standards, 85–86, 318, 321, 324–327, 331, 332–333, 334, 335–336
metadata standards, 364–365 records management standards,
79–81, 84, 85–86, 141, 147, 155, 369
risk management standards, 46, 77 security standards, 78–79, 210 thesauri standards, 371
Inventory of records: challenges of, 155–156 conducting of, 157, 163–166 conductor of inventory determined
for, 157, 160 defi nition of, 154 executive sponsorship of, 157, 159 Generally Accepted Recordkeeping
Principles® for, 155 goals of, 157–158 information/elements to be collected
determination for, 157, 159–160 information location determination
for, 157, 163 interviews as method of conducting,
164, 165–166, 167 inventory forms for, 157, 160, 161–
163 IT security based on, 202 long-term digital preservation use of,
339 observation as method of conducting,
164 overview of, 154–155 purposes of, 156 records and information management
including, 154–168, 173, 202, 339 records value appraisal in, 167–168 results verifi cation and analysis for,
157, 166–168 retention schedule detailed in, 154,
173, 339 scope of, 157, 158–159 steps of creating, 157–168 surveys as method of conducting, 164
432 INDEX
bindex 432 February 28, 2014 2:03 PM
IRC Federal, 242 ISACA (formerly Information Systems
Audit and Control Association), 18, 198
ISO. See International Organization for Standardization
IT. See Information technology (IT) functions
IT governance, 17–20, 79, 111, 196–201 IT Governance Institute:
Board Briefi ng on IT Governance, 17 CobiT® development by, 18, 198
ITIL (Information Technology Infrastructure Library), 18, 19, 197, 198, 200–201
Jabber XCP, 247 Japan:
privacy laws in, 399 records and information management
regulations in, 149 Jaquith, Andrew, 230 Jolicloud, 261 JPEG 2000 (joint photographic
engineers group) standard, 332–333, 343
Key point summaries, 12, 21–22, 38, 51, 68, 90–91, 111–112, 142–143, 184–186, 204, 234–236, 250–251, 268, 283, 301, 314, 345–346, 352–353, 382
Knorr, Eric, 287 Kortchinksy, Kostya, 295
Labels, documents, 26, 231–232 LANDesk, 275
Laws and regulations. See also specifi c regulatory bodies; Standards
citation services summarizing, 44, 138, 139, 178–179
cloud computing impacted by, 297 Code of Federal Regulations, 44–45,
138–140, 178, 386, 387 e-mail under, 245 Federal Rules of Civil Procedure,
115–116, 117–118, 119, 150, 265, 303
freedom of information laws as, 45–46, 156, 169, 210, 391–392
IG policies impacted by, 76–88 privacy, 169, 210–211, 297, 385, 392,
397–400 records and information management
compliance with, 28, 32, 33, 35, 36–37, 130–142, 149–150, 151, 156, 169, 176–179, 303, 307, 385–395
risk management research and application of, 43–46, 62–63, 123
security functions impacted by, 223, 227, 296
social media impacted by, 265 strategic planning consideration of,
56–57, 60 Legal issues. See also Laws and
regulations Big Data effect on, 117 business considerations related to,
99–100, 103, 110, 125, 136–137 cloud computing-specifi c, 297 e-discovery as, 4, 8, 26, 58, 60, 62, 72,
99–100, 103, 115–130, 150, 244, 260, 264–265, 297, 303
e-mail-specifi c, 116, 119, 125–126, 243–244, 245
FRCP impacting, 115–116, 117–118, 119, 150, 265, 303
IG policies impacted by, 76–88 legal hold process as, 26, 60, 62, 117,
122–126, 297, 303 legally defensible disposition of
information as, 4–5, 6, 8, 62, 117, 121–122, 125–126, 130–137
mobile device-specifi c, 282 overview of, 115 privacy protection impacted by,
43–44, 63, 169, 210–211, 297, 385, 392, 397–400
records and information management legal compliance as, 28, 32, 33, 35, 36–37, 130–142, 149–150, 151, 156, 169, 176–179, 303, 307, 385–395
retention impacted by, 4, 26, 33, 43– 44, 62–63, 122–126, 137–142, 169, 177–179, 243–244
INDEX 433
bindex 433 February 28, 2014 2:03 PM
risk management research and application of, 43–46, 62–63, 123
security functions impacted by, 43–44, 223, 227, 296
SharePoint compliance with, 303, 307 social media-specifi c, 259–260,
264–267 strategic planning consideration of,
56–57, 60, 62–63, 123 taxonomies addressing, 357 technologies assisting with, 58, 126–
130, 134–136 Leslie, Phillip, 108 Library of Congress, U.S., 328, 330,
361, 366, 371–372 Lightweight directory access protocol
(LDAP), 226 LinkedIn, 254, 256, 259–260, 262 Logan, Debra, 10, 27, 189 Long-term digital preservation:
accessibility of information through, 26, 32, 322, 340–341, 343
archiving as, 177, 321–323, 339 audit and certifi cation standards for,
325–327 best practices for, 64–65 business continuity issues in, 320,
321, 327 costs of, 321 defi nition of, 317–318 digital object management in, 326–327 digital preservation infrastructure of,
337–338 digital preservation processes and
services of, 339–341 evolving marketplace for, 344 future of, 344 IG policies on, 85–86, 326, 327, 337,
338 integrity of information in, 340, 343 key factors in, 318–320 Long-Term Digital Preservation
Capability Maturity Model®, 334–341
media obsolescence and renewal in, 320, 339–340, 342–343
metadata in, 318, 328–329, 340, 343 OAIS Reference Model for, 321–323
open standard technology-neutral formats for, 321, 324, 329–333, 338, 342, 343
optimal to nominal stages of preservation in, 335–336
organizational infrastructure of, 325–326
performance metrics for, 341 preservation description information
for, 322–323 principles of IG including, 26, 32 producers and users of, 336–337, 344 records and information management
addressing, 177, 182, 317–346 requirements for, 333 risk management of, 327 security issues related to, 32, 320–321,
325, 327, 340, 343 standards on, 85–86, 318, 321–333,
334, 335–336 strategic planning including, 59,
64–65, 325, 337 strategies and techniques for,
341–344 technical infrastructure of, 327, 338 threats to, 320–321 trustworthy digital repository for, 339
Long-term program issues: IG as ongoing, long-term program, 7,
11, 27, 61–62 IG policies addressing, 85–86, 326,
327, 337, 338 long-term digital preservation as, 26,
32, 59, 64–65, 85–86, 177, 182, 317–346
principles of IG including, 26, 32 standards on, 85–86, 318, 321–333,
334, 335–336 strategic plan addressing, 59, 61–62,
64–65, 325, 337
Mah, Paul, 242 Maintenance of IG program, 349–353 Management support. See Executive
sponsorship Managing Electronic Records: Methods,
Best Practices and Technologies (Smallwood), 81
434 INDEX
bindex 434 February 28, 2014 2:03 PM
Man-in-the-middle attacks, 279, 280 Manning, Bradley, 258 Masking technology, 203 Master data management, 194 Master Data Management (MDM)
Institute, 189 McKinsey, 100, 105, 107 Metadata:
best practices for, 64 core issues with, 363–364 defi nition of, 357, 358, 361 digital signatures in, 220 Dublin Core Metadata Initiative on,
85, 365–366 Global Information Locator Service
on, 366–367 information organization and
classifi cation using, 26, 357, 358, 359–368, 370, 375, 381
long-term digital preservation of, 318, 328–329, 340, 343
records and information management use of, 265, 361–368, 370, 375, 381
security issues related to, 220 social media, 265 standards on, 82, 84–85, 328–329,
340, 360–362, 364–368 taxonomy relationship to, 357, 358,
359–360, 367–368, 370, 375, 381 (see also(( Taxonomy/common terminology)
text mining of, 367–368 training and communication in use of,
363–364 types of, 362–363
MI6, 10 Microsoft:
Active Direction, 226 instant messaging system, 247 Offi ce (Word, Excel, PowerPoint),
215, 216, 232, 261, 329 Offi ce Communications Server, 247 Outlook TwInbox, 261 SharePoint, 160, 232, 303–314 Visio®, 377 Wave audio format, 333 Windows OS, 272
MIKE2.0, 62 Mobile devices:
3G and 4G interoperability of, 273 anti-virus security measures for,
274, 278 authentication methods for, 277, 280 best practices for, 280–281 biometric authentication used with, 277 bring-your-own-device (BYOD)
approach to, 275, 281–282, 298, 303 cloud computing via, 298 confi dential information removal
from, 274–275 costs associated with, 281–282 e-commerce via, 277–280 encryption on, 276, 277, 281 GPS for, 273 hacking protection for, 276 IG for, 9, 11, 271–283 IG policies for, 276, 281–282 innovation vs. security for, 279–280 IT trend analysis of, 59 legal issues related to, 282 long-term evolution of, 273 mobile application security for,
277–280 mobile device management of, 273,
275–276 number of users, 271, 272 overview of, 271–273 password protection for, 276, 277 push-button applications for, 274 records and information management
for, 151, 160, 164 security issues with, 213, 220, 225,
230, 271–283 SharePoint supporting, 303 smartphone applications for, 273 software updates for, 276 solid state drives for, 274 supplemental broadband for, 274 timeout function for, 276, 277 training and communication related
to, 282 trends in mobile computing, 273–274 Virtual Private Network hardware and
software for, 273 WiMax networks for, 273
INDEX 435
bindex 435 February 28, 2014 2:03 PM
MobileIron, 275 Model Requirements for Management
of Electronic Records (MoReq2010), 80, 82–83
Monitoring: cloud computing, 295, 296 database activity monitoring
as, 203 data governance plan, 192 IG policies, 89–90 instant messaging, 249 maintenance of IG program
including, 349–350 principles of IG including, 26, 32 records and information management
including, 150, 169 security functions including, 202–203,
209, 249, 295, 296 Montague Institute, 357 Motorola, 9 MPEG-2 (motion picture expert group)
standard, 333 MSN instant messaging system, 249
National Archives and Records Administration, 45, 76, 81, 139–140, 141, 154, 172–173, 178, 254, 299, 321, 386–387
Offi ce of the Federal Register, 45, 139–140, 178
National Association of Securities Dealers (NASD), 223
National Institute of Standards and Technology (NIST), 76, 286–287, 296
National Labor Relations Board, 263 National Security Agency, U. S., 8–9,
208, 241–242, 291 Nerney, Chris, 258
Offi ce of Management and Budget, 296 Offi ce of the Federal Register, 45,
139–140, 178 Open archival information system
(OAIS), 85–86, 321–323 Organizational culture. See Corporate
culture Osterman Research, 126, 176, 177
Pace, Nicholas M., 99 PageFreezer, 261, 262 Passwords, computer, 215, 276,
277, 295 PATRIOT Act, 386 Payment Card Industry
Data Security Standard (PCI-DSS), 227
PDF995, 262 PDF/A format, 85, 331, 343 PDFCreate, 262 Peck, Andrew, 135 Pew Research Center, 101 Phishing, 202, 279, 293, 295 Picasa, 261 PNG (portable network graphics)
format, 332 Policies. See Information governance
policies Political environment, 60. See also
Laws and regulations; specifi c governments by country name
Ponemon Institute, 207, 220 Portable storage devices. See Removable
media Predictive coding, 58, 127–128 PREMIS preservation metadata
standard, 328–329, 340 PrimoPDF, 262 Principles of information governance:
accountability as, 27, 28, 30, 35, 36 continuous improvement as, 27,
34–35, 36–37 executive sponsorship
as, 25, 28, 30 Generally Accepted Recordkeeping
Principles® as, 27–35, 36–37 information accessibility as, 26,
28, 32, 35, 37 information control as, 26 information governance monitoring
and auditing as, 26, 30, 32 information integrity as, 25, 28, 31,
35, 36 information organization and
classifi cation as, 25–26 information policy development and
communication as, 25
436 INDEX
bindex 436 February 28, 2014 2:03 PM
Principles of information (continued ) information security as, 26, 28, 32,
35, 36 overview of, 25–27 stakeholder consultation as, 26–27 team/governance body for
implementing, 35, 38 Privacy protection:
best practices for, 63 failures of, 10 IG policies addressing, 72, 264 instant messaging policy on, 248 legal requirements for, 43–44,
63, 169, 210–211, 297, 385, 392, 397–400
perimeter security limitations impacting, 211
personally identifi able information (PII) in, 26, 43–44, 210, 297, 385
principles of IG including, 26 redaction as, 210–211 risk management consideration of,
43–44, 63 security function of, 9, 10, 26, 43–44,
63, 72, 169, 207, 210–211, 248, 264, 297, 385, 392, 397–400
social media, 264 strategic planning consideration of, 63
PRONON program, 330
Quest Software, 248
Records and information management: accountability for, 28, 30, 35, 36, 53,
133, 309, 311–312 adoption and compliance with,
168–169 assessment and improvement roadmap
for, 34–35, 36–37 audit process for, 30, 32, 150, 183 availability of records through, 28, 32,
35, 37, 151, 309 benefi ts of, 152–153 best practices for, 61, 62 business considerations related to,
110, 149–150, 153, 303–304, 307–309
challenges of, 150–151, 304–306
cloud computing issues with, 297, 299–300
communication related to, 31, 158, 169, 313–314
costs of, 151, 152 defi nition of, 147 delivery platforms impacting, 151,
159, 160, 164, 232, 264–267, 297, 299–300, 303–314
disposition requirements in, 28, 33–34, 35, 37, 130–137, 150, 151, 170, 177–178, 179–183, 297, 299–300 (see also(( Disposition of information)
enterprise content management relationship to, 149
executive sponsorship of, 28, 30, 157, 159, 169, 182, 306, 388
Federal Rules of Civil Procedure impacting, 150, 265, 303
Generally Accepted Recordkeeping Principles® for, 27–35, 36–37, 53, 71, 74, 155, 171
IG policy relationship to, 71, 74, 79– 86, 92–93, 150–151, 310–311
integrity of, 28, 31, 35, 36, 340, 343, 389
inventory of records in, 154–168, 173, 202, 339 (see also(( Inventory of records)
IT relationship to, 151, 160, 164, 176 legal and policy compliance through,
28, 32, 33, 35, 36–37, 130–142, 149–150, 150–151, 156, 169, 176–179, 303, 307, 385–395
long-term (see(( Long-term program issues)
maturity levels/model of, 29, 34, 36–37, 62, 334–341
metadata in, 265, 361–368, 370, 375, 381
monitoring of, 150, 169 overview of, 147–149 protection or security of records in,
28, 32, 35, 36, 151, 202, 215, 232, 297 (see also(( Security functions)
records groupings rationale in, 174, 368
INDEX 437
bindex 437 February 28, 2014 2:03 PM
records series identifi cation and classifi cation in, 174–175
retention requirements in, 28, 32–33, 35, 37, 85–86, 137–142, 150, 151, 154, 167–168, 169–183, 264–267, 297, 299–300, 368, 369 (see also(( Retention of information)
risk management through, 158 SharePoint for, 160, 232, 303–314 social media-specifi c, 151, 264–267 standards on, 79–86, 92–93, 141, 147,
155, 179, 364–365, 369, 387–389 taxonomies in, 134, 355–360, 367–381 training in, 31, 169, 313 transparency of, 28, 31, 35, 36 user assistance and compliance with,
151, 164–167, 307 Redaction, 210–211 Reference data management, 196 Regulations. See Laws and regulations Removable media, 159, 164, 223, 277 Research Library Group, 328 Retention of information:
auditing of, 183 best practices for, 62–63, 64–65 classifi cation of records for, 173–175 cloud computing, specifi cally, 297,
299–300 cost of, 4–5, 99, 104, 131 destructive, 64, 126, 177–178, 246–
247 disposition vs. (see(( Disposition of
information) e-mail, specifi cally, 64, 126, 175–178,
243–247 event-based impact on, 179–181 Generally Accepted Recordkeeping
Principles® for, 28, 32–33, 35, 37, 171
IG policies on, 46, 75–76, 85–86, 121–122
implementation of retention schedule, 182–183
information control through, 26 instant messages, specifi cally, 248–249 inventory of records detailing, 154,
173, 339 legal requirements for, 4, 26, 33, 43–
44, 62–63, 122–126, 137–142, 169, 177–179, 243–244
long-term digital preservation for, 26, 32, 59, 64–65, 85–86, 177, 182, 317–346
need for retention schedules, 171–173 ongoing maintenance of retention
schedule for, 183 principles of retention scheduling,
169–170 records and information management
addressing, 28, 32–33, 35, 37, 85–86, 137–142, 150, 151, 154, 167–168, 169–183, 264–267, 297, 299–300, 368, 369
records groupings rationale related to, 174, 368
records retention citation services on, 44, 138, 139, 178–179
records series identifi cation and classifi cation for, 174–175
records value appraisal for, 167–168 retention period/duration/schedule of,
33, 46, 63, 126, 137–138, 140–142, 154, 169–183, 266, 339, 368, 369
risk management consideration of, 43–44, 46, 63, 100
social media, specifi cally, 261–262, 263, 264–267
steps for retention schedule development, 171–173
strategic planning consideration of, 59, 62–63, 64–65
technologies assisting with, 183 transitory record retention as, 182
Reuters Messaging, 247 Risk management:
best practices for, 62–63 corporate culture on risk tolerance in,
58 data governance role in, 192, 193 delivery platform impacting, 242–243,
257–260 heat maps in, 47 IG policy relationship to, 46, 62–63,
75, 77 IG role in, 8, 43–51 inventory of records for, 158
438 INDEX
bindex 438 February 28, 2014 2:03 PM
Risk management (continued ) IT functions role in, 192, 193, 198 legal and policy research and
compliance in, 43–46, 62–63, 123 long-term digital preservation
consideration of, 327 metrics and results measurements in,
50, 63 privacy issues addressed through,
43–44, 63 retention of information addressed
through, 43–44, 46, 63, 100 risk analysis and assessment in, 48–49,
192 risk maps in, 47 risk mitigation plan auditing in, 51, 63 risk mitigation plan development in,
49, 63 risk mitigation plan execution in, 50 risk profi le creation in, 46–48, 63 security issues addressed through,
43–44, 213, 327 standards on, 46, 77 strategic planning consideration of,
58, 62–63 top-10 lists in, 47
Rutkowska, Joanna, 295
Safety Deposit Box, 344 SAP Afaria MDM, 275 Sarbanes-Oxley Act of 2002 (SOX), 149,
223, 245, 386 Securities and Exchange Commission,
Rule 17A-4, 386 Security functions:
accessibility balanced with, 26, 32, 151, 203, 212–213, 215–216, 224
anti-virus security measures as, 274, 278
application programming interface as, 293–294
auditing as, 26, 203, 211, 213, 225, 291
best practices of, 62, 63, 202–203 biometric authentication technologies
as, 272, 277 blueprint and CAD document
protection as, 228–229
business considerations related to, 111 challenges of, 213–215 costs of security breaches, 207, 220–
221, 227, 271 cyberattack proliferation
necessitating, 207–208 data loss prevention technology as,
220–222, 227–228, 231, 291, 292 defense in depth as, 212 deletion of fi les as, 215 delivery platforms impacting, 213,
217–218, 220, 223–224, 225, 226–227, 230, 233–234, 241–251, 256–268, 271–283, 285–286, 290– 298, 303–314
device control methods as, 227 digital signatures as, 218–219, 220 document analytics as, 232–233 document labeling as, 231–232 document life cycle security
technologies as, 291, 292 embedded protection as, 226–227, 231 employee information misuse
necessitating, 8–10, 26, 208–210, 228, 229, 242–243, 258–259, 291– 292, 320–321
encryption as, 26, 164, 203, 217, 219– 220, 225, 226–227, 228, 276, 277, 281, 291, 294
external access blockage as, 215–216 hybrid approach to, 227 identity access management as, 212–
213, 272 IG addressing, 8–10, 26, 207–236 IG enabling or maturity impacting,
111 IG policy relationship to, 72, 78–79,
213, 214, 221, 222, 224, 233–234, 291, 293, 297–298
information rights management software as, 9, 26, 62, 164, 210, 222–226, 227–228, 229, 291, 292
innovation balanced with, 279–280 internal price list protection as,
229–230 IT functions as, 202–203 legal requirements for, 43–44, 223,
227, 296
INDEX 439
bindex 439 February 28, 2014 2:03 PM
long-term digital preservation security issues, 32, 320–321, 325, 327, 340, 343
masking technology for, 203 monitoring as, 202–203, 209, 249,
295, 296 outside the organization security
approaches as, 230–231 password protection as, 215, 276, 277,
295 perimeter security limitations
impacting, 211, 214 persistent, 222–226, 228–229 (see also((
Information rights management (IRM) software)
principles of IG including, 26, 28, 32, 35, 36
print fi le security as, 216–217 privacy protection as, 9, 10, 26, 43–44,
63, 72, 169, 207, 210–211, 248, 264, 297, 385, 392, 397–400
protected data as, 231 protected process as, 230 records and information management
protection as, 28, 32, 35, 36, 151, 202, 215, 232, 297
redaction as, 210–211 repository-based approach to, 214–
215 risk management consideration of,
43–44, 213, 327 secure printing as, 216, 230 standards on, 78–79, 210 strategic plan consideration of, 62, 63 stream messaging as, 217–218, 233–
234, 236 technologies improving, 215–217 thin clients as, 227, 230 thin devices as, 230 timeout function as, 276, 277 trade secret protection as, 228, 260 training in, 209, 228, 233–234, 236 zero trust model of, 230–231
Security Technical Implementation Guides (STIGs), 202
SharePoint: accountability/responsibility for, 309,
311–312
business objectives of, 303–304, 307–309
challenges of implementing, 304–306 communication related to, 313–314 corporate culture changes necessitated
by, 304–305 guiding principles for, 308–309 IG policy relationship to, 310–311 legal and policy compliance through,
303, 307 overview of, 303–304 planning process for use of, 306–310 process established for use of, 312 records and information management
including, 160, 232, 303–314 scope of deployment of, 309–310 training in, 313
Signatures, digital, 218–219, 220 Singapore:
privacy laws in, 399 Standards Singapore in, 87
SkyDrive, 289 Snapchat, 255 Snowden, Edward, 9, 208, 241–242 SocialFolders, 261 Social media:
accountability for, 267 best practices for, 64, 262, 267–268 as business records, 260, 265–266 categories of, 254–256 content control models for, 267–268 disposition and retention of, 261–262,
263, 264–267 e-mail and instant messaging
distinction from, 257 employee misuse of, 258–259 enterprise use of, 256 IG policies on, 76, 257, 258, 259–260,
262–264, 267 IT trend analysis of, 59 legal issues related to, 259–260, 264–267 privacy expectations for, 264 records and information management
for, 151, 264–267 risk management issues with, 257–260 security issues with, 213, 256–268 training in, 258, 268 types of, 253–256
440 INDEX
bindex 440 February 28, 2014 2:03 PM
SocialSafe, 261, 262 Social tagging, 356, 381 Sorensen, Alan, 108 Space Data Information Transfer
System-Open Archival Information System (OAIS) Reference Model, 321–323
Spear phishing, 202 Sprint, 273, 274 SQL injections, 202 Staff. See Employees/staff Standards. See also Laws and regulations
American National Standards Institute (ANSI), 76, 87, 155, 371
benefi ts and risks of, 76–77 best practices for usage of, 64 British Standards Institute (BSI), 76,
371 on business continuity management,
86–87 de jure vs. de facto, 76 Dublin Core Metadata Initiative
standards, 85, 365–366 Global Information Locator Service
standard, 366–367 IG policies impacted by, 76–88, 92–93 International Organization for
Standardization (ISO), 18, 19–20, 46, 64, 76, 77–81, 84, 85–87, 111, 141, 147, 155, 198, 200–201, 210, 318, 321, 324–327, 331, 332–333, 334, 335–336, 364–366, 369, 371
on IT governance, 19–20, 79, 111, 198, 200–201
on long-term digital preservation, 85– 86, 318, 321–333, 334, 335–336
major national and regional, 81–87 (see also under specifi c countries)
on metadata, 82, 84–85, 328–329, 340, 360–362, 364–368
National Institute of Standards and Technology (NIST), 76, 286–287, 296
open standard technology-neutral, 321, 324, 329–333, 338, 342, 343
PREMIS preservation metadata standard, 328–329, 340
on records and information
management, 79–86, 92–93, 141, 147, 155, 179, 364–365, 369, 387–389
on risk management, 46, 77 on security functions, 78–79, 210 Space Data Information Transfer
System-Open Archival Information System (OAIS) Reference Model, 321–323
Standards Australia, 76, 84, 87 Standards Council of Canada, 76, 92,
394 Standards Singapore, 87 on thesauri, 371 U.S. Department of Defense, 76, 80,
81–82, 179 Storage of information. See Retention
of information Stored Communications and
Transactional Records Act (SCTRA), 210
Strategic planning: accountability for, 53–54 budgets/fi nancial considerations in,
53, 54, 59–60 business conditions and economic
environment survey in, 59–60 communication of, 55 corporate culture consideration in, 58 disposition consideration in, 62,
63–64 execution of, 67 executive sponsorship of, 53–55, 63, 65 external factors survey and evaluation
in, 58–65 IG team building and responsibilities
in, 55, 56–57, 62 industry best practices analysis in,
61–65 IT trend analysis in, 59 legal issues consideration in, 56–57,
60, 62–63, 123 long-term program issues in, 59,
61–62, 64–65, 325, 337 metadata and taxonomy consideration
in, 64 organizational and IG strategic plan
alignment, 57–58
INDEX 441
bindex 441 February 28, 2014 2:03 PM
overview of, 53–54 project manager role in, 54–55, 56 retention of information
consideration in, 59, 62–63, 64–65
risk management consideration in, 58, 62–63
security function consideration in, 62, 63
strategic plan formulation, 65–67 Stream messaging, 217–218,
233–234, 236 SVG (scalable vector graphics)
format, 332 Symantec Mobile Management
Suite, 275
Taxonomy/common terminology: auto-classifi cation for, 356 auto-generated, 370–371 best practices for, 64, 190 business classifi cation scheme or fi le
plan using, 368–369 business process analysis for
development of, 377–379 business-unit, 372, 374 defi nition of, 355 disposition of information use of, 134 faceted, 376 folksonomies as, 381 functional, 372–375 hybrid, 376 information organization and
classifi cation using, 26, 355–360, 367–381
maintenance of, 380–381 metadata relationship to, 357, 358,
359–360, 367–368, 370, 375, 381 (see also(( Metadata)
navigation using, 357 need for new, 358 prebuilt vs. custom, 370–371 records and information management
use of, 134, 355–360, 367–381 search results improvement through,
358–359, 367–368 security functions use of, 231 social tagging for, 356, 381
subject, 371–372, 373 successful IG program including, 21 testing of, 379–380 text mining for, 356, 367–368 thesaurus for, 360, 371, 372 types of, 371–376
Technology-assisted review (TAR), 128–130, 135
Tessella Technology & Consulting, 344 Texas Children’s Hospital, 10 Text mining, 356, 367–368 Thesauri, 360, 371, 372 Thin clients, 227, 230 Thin devices, 230 Thumb drives. See Removable media TIFF (tagged image fi le format), 331–
332 Trade secret protection, 228, 260. See
also Intellectual property, security of
Training: in business and fi nancial cost
considerations, 108 in data governance, 17, 192 in IG policies, 35, 89, 282 of IG team/governance body, 35 in inventorying records, 157 in metadata, 363 in mobile device policies, 282 in records and information
management, 31, 169, 313 in security related to IG, 209, 228,
233–234, 236 in SharePoint, 313 in social media, 258, 268
TweetTake, 261 TwInbox, 261 Twitter, 254, 255, 256, 257, 258, 259–
260, 261
United Kingdom: British Standards Institute (BSI) in,
76, 371 BS 8723 thesauri standard in, 371 BS 15000 IT governance standard in,
200 BS 25999-2 business continuity
standard in, 87
442 INDEX
bindex 442 February 28, 2014 2:03 PM
United Kingdom (continued ) Digital Systems Knowledge Transfer
Network in, 271 Freedom of Information Act 2000 in,
46, 169, 210 ITIL developed in, 19, 200 MI6 in, 10 Model Requirements for Management
of Electronic Records (MoReq2010) in, 80, 82–83
National Archives of, 330 National Health Service in, 10 privacy laws in, 210, 400 records and information management
regulations and standards in, 80, 82–83, 150, 303, 389–391
standards in, 76, 83–84, 87, 200, 371 United Nations, 207–208 United States:
Code of Federal Regulations of, 44– 45, 138–140, 178, 386, 387
Customs and Border Protection of, 223
cyberattacks on/by government of, 207, 208
Department of Defense of, 76, 80, 81–82, 179
Environmental Protection Agency of, 101, 153
Food and Drug Administration of, 386
General Accounting Offi ce of, 173 Government Printing Offi ce of, 45,
139, 178 Homeland Security of, 223 House of Representatives Oversight
and Government Reform Committee of, 244
information governance in (see(( Information governance)
Internal Revenue Agency of, 296 laws and regulations of (see(( Laws and
regulations) Library of Congress of, 328, 330, 361,
366, 371–372 National Archives and Records
Administration of, 45, 76, 81, 139–140, 141, 154, 172–173, 178, 254, 299, 321, 386–387
National Security Agency of, 8–9, 208, 241–242, 291
Offi ce of Management and Budget of, 296
Offi ce of the Federal Register of, 45, 139–140, 178
political environment in, 60 Securities and Exchange Commission
of, 386 U.S. Protection Profi le for
Authorization Server for Basic Robustness Environments in, 213
ValiT®, 18, 198, 199–200 Verizon, 274 ViaLumina, 105 Vine, 255–256 Virtual Private Network (VPN), 273,
286
W3C Internet Engineering Task Force, 332
Wayback Machine, 261, 262 Web 2.0, 253–254 WebARChive (WARC), 333 WikiLeaks, 214, 220, 258 WiMax (Worldwide Interoperability for
Microwave Access) networks, 273 World Economic Forum, 3
XML (extensible markup language), 329, 331
Yahoo! instant messaging system, 247, 249
Zakaras, Laura, 99 Zornes, Aaron, 189 Zubulake v. UBS Warburg, 119
Week4/Course2 -Information Governance (ITS-833-20)/Text Books/Information-Governance_-Concepts-Strategies-and-Best-Practices-1st-Edition-B00F2JFVOY.pdf
INFORMATION GOVERNANCE
Founded in 1807, John Wiley & Sons is the oldest independent publishing company in the United States. With offi ces in North America, Europe, Asia, and Australia, Wiley is globally committed to developing and marketing print and electronic products and services for our customers’ professional and personal knowledge and understanding.
The Wiley CIO series provides information, tools, and insights to IT executives and managers. The products in this series cover a wide range of topics that supply strategic and implementation guidance on the latest technology trends, leadership, and emerging best practices.
Titles in the Wiley CIO series include:
The Agile Architecture Revolution: How Cloud Computing, REST-Based SOA, and Mobile Computing Are Changing Enterprise IT by Jason BloombergT
Big Data, Big Analytics: Emerging Business Intelligence and Analytic Trends for Today’s Businesses by Michael Minelli, Michele Chambers, and Ambiga Dhiraj
The Chief Information Offi cer’s Body of Knowledge: People, Process, and Technology by Dean Lane
CIO Best Practices: Enabling Strategic Value with Information Technology (Second Edition) by Joe Stenzel, Randy Betancourt, Gary Cokins, Alyssa Farrell, Bill Flemming, Michael H. Hugos, Jonathan Hujsak, and Karl Schubert
The CIO Playbook: Strategies and Best Practices for IT Leaders to Deliver Value by Nicholas R. Colisto
Enterprise Performance Management Done Right: An Operating System for Your Organization by Ron Dimon
Executive’s Guide to Virtual Worlds: How Avatars Are Transforming Your Business and Your Brand by Lonnie Bensond
IT Leadership Manual: Roadmap to Becoming a Trusted Business Partner by Alan R. r Guibord
Managing Electronic Records: Methods, Best Practices, and Technologies by Robert F. s Smallwood
On Top of the Cloud: How CIOs Leverage New Technologies to Drive Change and Build Value Across the Enterprise by Hunter Muller
Straight to the Top: CIO Leadership in a Mobile, Social, and Cloud-based World (Second Edition) by Gregory S. Smith
Strategic IT: Best Practices for Managers and Executives by Arthur M. Langer ands Lyle Yorks
Transforming IT Culture: How to Use Social Intelligence, Human Factors, and Collaboration to Create an IT Department That Outperforms by Frank Wanders
Unleashing the Power of IT: Bringing People, Business, and Technology Together by Dan Roberts
The U.S. Technology Skills Gap: What Every Technology Executive Must Know to Save America’s Future by Gary J. Beach
Information Governance: Concepts, Strategies and Best Practices by Robert F. Smallwoods
Robert F. Smallwood
INFORMATION GOVERNANCE
CONCEPTS, STRATEGIES AND
BEST PRACTICES
Cover image: © iStockphoto / IgorZh Cover design: Wiley
Copyright © 2014 by Robert F. Smallwood. All rights reserved.
Chapter 7 © 2014 by Barclay Blair
Portions of Chapter 8 © 2014 by Randolph Kahn
Published by John Wiley & Sons, Inc., Hoboken, New Jersey. Published simultaneously in Canada.
No part of this publication may be reproduced, stored in a retrieval system, or transmitted in any form or by any means, electronic, mechanical, photocopying, recording, scanning, or otherwise, except as permitted under Section 107 or 108 of the 1976 United States Copyright Act, without either the prior written permission of the Publisher, or authorization through payment of the appropriate per-copy fee to the Copyright Clearance Center, Inc., 222 Rosewood Drive, Danvers, MA 01923, (978) 750-8400, fax (978) 646-8600, or on the Web at www.copyright.com. Requests to the Publisher for permission should be addressed to the Permissions Department, John Wiley & Sons, Inc., 111 River Street, Hoboken, NJ 07030, (201) 748-6011, fax (201) 748-6008, or online at http://www.wiley.com/go/permissions.
Limit of Liability/Disclaimer of Warranty: While the publisher and author have used their best efforts in preparing this book, they make no representations or warranties with respect to the accuracy or completeness of the contents of this book and specifi cally disclaim any implied warranties of merchantability or fi tness for a particular purpose. No warranty may be created or extended by sales representatives or written sales materials. The advice and strategies contained herein may not be suitable for your situation. You should consult with a professional where appropriate. Neither the publisher nor author shall be liable for any loss of profi t or any other commercial damages, including but not limited to special, incidental, consequential, or other damages.
For general information on our other products and services or for technical support, please contact our Customer Care Department within the United States at (800) 762-2974, outside the United States at (317) 572-3993 or fax (317) 572-4002.
Wiley publishes in a variety of print and electronic formats and by print-on-demand. Some material included with standard print versions of this book may not be included in e-books or in print-on-demand. If this book refers to media such as a CD or DVD that is not included in the version you purchased, you may download this material at http://booksupport.wiley.com. For more information about Wiley products, visit www.wiley.com.
Library of Congress Cataloging-in-Publication Data:
Smallwood, Robert F., 1959- Information governance : concepts, strategies, and best practices / Robert F. Smallwood. pages cm. — (Wiley CIO series)
ISBN 978-1-118-21830-3 (cloth); ISBN 978-1-118-41949-6 (ebk); ISBN 978-1-118-42101-7 (ebk) 1. Information technology—Management. 2. Management information systems. 3. Electronic
records—Management. I. Title. HD30.2.S617 2014 658.4’038—dc23
2013045072
Printed in the United States of America
10 9 8 7 6 5 4 3 2 1
For my sons
and the next generation of tech-savvy managers
vii
CONTENTS
PREFACE xv
ACKNOWLEDGMENTS xvii
PA RT O N E — Information Governance Concepts, Defi nitions, and Principles 1p
C H A P T E R 1 The Onslaught of Big Data and the Information Governance Imperative 3
Defi ning Information Governance 5
IG Is Not a Project, But an Ongoing Program 7
Why IG Is Good Business 7
Failures in Information Governance 8
Form IG Policies, Then Apply Technology for Enforcement 10
Notes 12
C H A P T E R 2 Information Governance, IT Governance, Data Governance: What’s the Difference? 15
Data Governance 15
IT Governance 17
Information Governance 20
Impact of a Successful IG Program 20
Summing Up the Differences 21
Notes 22
C H A P T E R 3 Information Governance Principles 25
Accountability Is Key 27
Generally Accepted Recordkeeping Principles® 27 Contributed by Charmaine Brooks, CRM
Assessment and Improvement Roadmap 34
Who Should Determine IG Policies? 35
Notes 38
PA RT T W O — Information Governance Risk Assessment and Strategic Planning 41g g
C H A P T E R 4 Information Risk Planning and Management 43
Step 1: Survey and Determine Legal and Regulatory Applicability and Requirements 43
viii CONTENTS
Step 2: Specify IG Requirements to Achieve Compliance 46
Step 3: Create a Risk Profi le 46
Step 4: Perform Risk Analysis and Assessment 48
Step 5: Develop an Information Risk Mitigation Plan 49
Step 6: Develop Metrics and Measure Results 50
Step 7: Execute Your Risk Mitigation Plan 50
Step 8: Audit the Information Risk Mitigation Program 51
Notes 51
C H A P T E R 5 Strategic Planning and Best Practices for Information Governance 53
Crucial Executive Sponsor Role 54
Evolving Role of the Executive Sponsor 55
Building Your IG Team 56
Assigning IG Team Roles and Responsibilities 56
Align Your IG Plan with Organizational Strategic Plans 57
Survey and Evaluate External Factors 58
Formulating the IG Strategic Plan 65
Notes 69
C H A P T E R 6 Information Governance Policy Development 71
A Brief Review of Generally Accepted Recordkeeping Principles® 71
IG Reference Model 72
Best Practices Considerations 75
Standards Considerations 76
Benefi ts and Risks of Standards 76
Key Standards Relevant to IG Efforts 77
Major National and Regional ERM Standards 81
Making Your Best Practices and Standards Selections to Inform Your IG Framework 87
Roles and Responsibilities 88
Program Communications and Training 89
Program Controls, Monitoring, Auditing and Enforcement 89
Notes 91
PA RT T H R E E — Information Governance Key Impact Areas Based on the IG Reference Model 95p
C H A P T E R 7 Business Considerations for a Successful IG Program 97
By Barclay T. Blair
Changing Information Environment 97
CONTENTS ix
Calculating Information Costs 99
Big Data Opportunities and Challenges 100
Full Cost Accounting for Information 101
Calculating the Cost of Owning Unstructured Information 102
The Path to Information Value 105
Challenging the Culture 107
New Information Models 107
Future State: What Will the IG-Enabled Organization Look Like? 110
Moving Forward 111
Notes 113
C H A P T E R 8 Information Governance and Legal Functions 115
By Robert Smallwood with Randy Kahn, Esq., and Barry Murphy
Introduction to e-Discovery: The Revised 2006 Federal Rules of Civil Procedure Changed Everything 115
Big Data Impact 117
More Details on the Revised FRCP Rules 117
Landmark E-Discovery Case: Zubulake v. UBS Warburg 119
E-Discovery Techniques 119
E-Discovery Reference Model 119
The Intersection of IG and E-Discovery 122 By Barry Murphy
Building on Legal Hold Programs to Launch Defensible Disposition 125 By Barry Murphy
Destructive Retention of E-Mail 126
Newer Technologies That Can Assist in E-Discovery 126
Defensible Disposal: The Only Real Way To Manage Terabytes and Petabytes 130 By Randy Kahn, Esq.
Retention Policies and Schedules 137 By Robert Smallwood, edited by Paula Lederman, MLS
Notes 144
C H A P T E R 9 Information Governance and Records and Information Management Functions 147
Records Management Business Rationale 149
Why Is Records Management So Challenging? 150
Benefi ts of Electronic Records Management 152
Additional Intangible Benefi ts 153
Inventorying E-Records 154
Generally Accepted Recordkeeping Principles® 155
E-Records Inventory Challenges 155
x CONTENTS
Records Inventory Purposes 156
Records Inventorying Steps 157
Ensuring Adoption and Compliance of RM Policy 168
General Principles of a Retention Scheduling 169
Developing a Records Retention Schedule 170
Why Are Retention Schedules Needed? 171
What Records Do You Have to Schedule? Inventory and Classifi cation 173
Rationale for Records Groupings 174
Records Series Identifi cation and Classifi cation 174
Retention of E-Mail Records 175
How Long Should You Keep Old E-Mails? 176
Destructive Retention of E-Mail 177
Legal Requirements and Compliance Research 178
Event-Based Retention Scheduling for Disposition of E-Records 179
Prerequisites for Event-Based Disposition 180
Final Disposition and Closure Criteria 181
Retaining Transitory Records 182
Implementation of the Retention Schedule and Disposal of Records 182
Ongoing Maintenance of the Retention Schedule 183
Audit to Manage Compliance with the Retention Schedule 183
Notes 186
C H A P T E R 10 Information Governance and Information Technology Functions 189
Data Governance 191
Steps to Governing Data Effectively 192
Data Governance Framework 193
Information Management 194
IT Governance 196
IG Best Practices for Database Security and Compliance 202
Tying It All Together 204
Notes 205
C H A P T E R 11 Information Governance and Privacy and Security Functions 207
Cyberattacks Proliferate 207
Insider Threat: Malicious or Not 208
Privacy Laws 210
Defense in Depth 212
Controlling Access Using Identity Access Management 212
Enforcing IG: Protect Files with Rules and Permissions 213
CONTENTS xi
Challenge of Securing Confi dential E-Documents 213
Apply Better Technology for Better Enforcement in the Extended Enterprise 215
E-Mail Encryption 217
Secure Communications Using Record-Free E-Mail 217
Digital Signatures 218
Document Encryption 219
Data Loss Prevention (DLP) Technology 220
Missing Piece: Information Rights Management (IRM) 222
Embedded Protection 226
Hybrid Approach: Combining DLP and IRM Technologies 227
Securing Trade Secrets after Layoffs and Terminations 228
Persistently Protecting Blueprints and CAD Documents 228
Securing Internal Price Lists 229
Approaches for Securing Data Once It Leaves the Organization 230
Document Labeling 231
Document Analytics 232
Confi dential Stream Messaging 233
Notes 236
PA RT F O U R — Information Governance for Delivery Platforms 239y
C H A P T E R 12 Information Governance for E-Mail and Instant Messaging 241
Employees Regularly Expose Organizations to E-Mail Risk 242
E-Mail Polices Should Be Realistic and Technology Agnostic 243
E-Record Retention: Fundamentally a Legal Issue 243
Preserve E-Mail Integrity and Admissibility with Automatic Archiving 244
Instant Messaging 247
Best Practices for Business IM Use 247
Technology to Monitor IM 249
Tips for Safer IM 249
Notes 251
C H A P T E R 13 Information Governance for Social Media 253
By Patricia Franks, Ph.D, CRM, and Robert Smallwood
Types of Social Media in Web 2.0 253
Additional Social Media Categories 255
Social Media in the Enterprise 256
Key Ways Social Media Is Different from E-Mail and Instant Messaging 257
Biggest Risks of Social Media 257
Legal Risks of Social Media Posts 259
xii CONTENTS
Tools to Archive Social Media 261
IG Considerations for Social Media 262
Key Social Media Policy Guidelines 263
Records Management and Litigation Considerations for Social Media 264
Emerging Best Practices for Managing Social Media Records 267
Notes 269
C H A P T E R 14 Information Governance for Mobile Devices 271
Current Trends in Mobile Computing 273
Security Risks of Mobile Computing 274
Securing Mobile Data 274
Mobile Device Management 275
IG for Mobile Computing 276
Building Security into Mobile Applications 277
Best Practices to Secure Mobile Applications 280
Developing Mobile Device Policies 281
Notes 283
C H A P T E R 15 Information Governance for Cloud Computing 285
By Monica Crocker CRM, PMP, CIP, and Robert Smallwood
Defi ning Cloud Computing 286
Key Characteristics of Cloud Computing 287
What Cloud Computing Really Means 288
Cloud Deployment Models 289
Security Threats with Cloud Computing 290
Benefi ts of the Cloud 298
Managing Documents and Records in the Cloud 299
IG Guidelines for Cloud Computing Solutions 300
Notes 301
C H A P T E R 16 SharePoint Information Governance 303
By Monica Crocker, CRM, PMP, CIP, edited by Robert Smallwood
Process Change, People Change 304
Where to Begin the Planning Process 306
Policy Considerations 310
Roles and Responsibilities 311
Establish Processes 312
Training Plan 313
Communication Plan 313
Note 314
CONTENTS xiii
PA RT F I V E — Long-Term Program Issues 315g g
C H A P T E R 17 Long-Term Digital Preservation 317
By Charles M. Dollar and Lori J. Ashley
Defi ning Long-Term Digital Preservation 317
Key Factors in Long-Term Digital Preservation 318
Threats to Preserving Records 320
Digital Preservation Standards 321
PREMIS Preservation Metadata Standard 328
Recommended Open Standard Technology-Neutral Formats 329
Digital Preservation Requirements 333
Long-Term Digital Preservation Capability Maturity Model® 334
Scope of the Capability Maturity Model 336
Digital Preservation Capability Performance Metrics 341
Digital Preservation Strategies and Techniques 341
Evolving Marketplace 344
Looking Forward 344
Notes 346
C H A P T E R 18 Maintaining an Information Governance Program and Culture of Compliance 349
Monitoring and Accountability 349
Staffi ng Continuity Plan 350
Continuous Process Improvement 351
Why Continuous Improvement Is Needed 351
Notes 353
A P P E N D I X A Information Organization and Classifi cation: Taxonomies and Metadata 355
By Barb Blackburn, CRM, with Robert Smallwood; edited by Seth Earley
Importance of Navigation and Classifi cation 357
When Is a New Taxonomy Needed? 358
Taxonomies Improve Search Results 358
Metadata and Taxonomy 359
Metadata Governance, Standards, and Strategies 360
Types of Metadata 362
Core Metadata Issues 363
International Metadata Standards and Guidance 364
Records Grouping Rationale 368
Business Classifi cation Scheme, File Plans, and Taxonomy 368
Classifi cation and Taxonomy 369
xiv CONTENTS
Prebuilt versus Custom Taxonomies 370
Thesaurus Use in Taxonomies 371
Taxonomy Types 371
Business Process Analysis 377
Taxonomy Testing: A Necessary Step 379
Taxonomy Maintenance 380
Social Tagging and Folksonomies 381
Notes 383
A P P E N D I X B Laws and Major Regulations Related to Records Management 385
United States 385
Canada 387 By Ken Chasse, J.D., LL.M.
United Kingdom 389
Australia 391
Notes 394
A P P E N D I X C Laws and Major Regulations Related to Privacy 397
United States 397
Major Privacy Laws Worldwide, by Country 398
Notes 400
GLOSSARY 401
ABOUT THE AUTHOR 417
ABOUT THE MAJOR CONTRIBUTORS 419
INDEX 421
xv
PREFACE
I nformation governance (IG) has emerged as a key concern for business executives and managers in today’s environment of Big Data, increasing information risks, co- lossal leaks, and greater compliance and legal demands. But few seem to have a clear
understanding of what IG is; that is, how you defi ne what it is and is not, and how to implement it. This book clarifi es and codifi es these defi nitions and provides key in- sights as to how to implement and gain value from IG programs. Based on exhaustive research, and with the contributions of a number of industry pioneers and experts, this book lays out IG as a complete discipline in and of itself for the fi rst time.
IG is a super-discipline that includes components of several key fi elds: law, records management, information technology (IT), risk management, privacy and security, and business operations. This unique blend calls for a new breed of information pro- fessional who is competent across these established and quite complex fi elds. Training and education are key to IG success, and this book provides the essential underpinning for organizations to train a new generation of IG professionals.
Those who are practicing professionals in the component fi elds of IG will fi nd the book useful in expanding their knowledge from traditional fi elds to the emerging tenets of IG. Attorneys, records and compliance managers, risk managers, IT manag- ers, and security and privacy professionals will fi nd this book a particularly valuable resource.
The book strives to offer clear IG concepts, actionable strategies, and proven best practices in an understandable and digestible way; a concerted effort was made to simplify language and to offer examples. There are summaries of key points through- out and at the end of each chapter to help the reader retain major points. The text is organized into fi ve parts: (1) Information Governance Concepts, Defi nitions, and Principles; (2) IG Risk Assessment and Strategic Planning; (3) IG Key Impact Areas; (4) IG for Delivery Platforms; and (5) Long-Term Program Issues. Also included are appendices with detailed information on taxonomy and metadata design and on re- cords management and privacy legislation.
One thing that is sure is that the complex fi eld of IG is evolving. It will continue to change and solidify. But help is here: No other book offers the kind of compre- hensive coverage of IG contained within these pages. Leveraging the critical advice provided here will smooth your path to understanding and implementing successful IG programs.
Robert F. Smallwood
xvii
ACKNOWLEDGMENTS
I would like to sincerely thank my colleagues for their support and generous contribu- tion of their expertise and time, which made this pioneering text possible.
Many thanks to Lori Ashley, Barb Blackburn, Barclay Blair, Charmaine Brooks, Ken Chasse, Monica Crocker, Charles M. Dollar, Seth Earley, Dr. Patricia Franks, Randy Kahn, Paula Lederman, and Barry Murphy.
I am truly honored to include their work and owe them a great debt of gratitude.
PA RT O N E Information Governance Concepts, Defi nitions, and Principles
3
The Onslaught of Big Data and the Information Governance Imperative
C H A P T E R 1
T he value of information in business is rising, and business leaders are more and more viewing the ability to govern, manage, and harvest information as critical to success. Raw data is now being increasingly viewed as an asset that can be
leveraged, just like fi nancial or human capital.1 Some have called this new age of “Big Data” the “industrial revolution of data.”
According to the research group Gartner, Inc., Big Data is defi ned as “high-volume, high-velocity and high-variety information assets that demand cost-effective, inno- vative forms of information processing for enhanced insight and decision making.” 2 A practical defi nition should also include the idea that the amount of data—both struc- tured (in databases) and unstructured (e.g., e-mail, scanned documents) is so mas- sive that it cannot be processed using today’s database tools and analytic software techniques. 3
In today’s information overload era of Big Data—characterized by massive growth in business data volumes and velocity—the ability to distill key insights from enor- mous amounts of data is a major business differentiator and source of sustainable com- petitive advantage. In fact, a recent report by the World Economic Forum stated that data is a new asset class and personal data is “the new oil.” 4 And we are generating more than we can manage effectively with current methods and tools.
The Big Data numbers are overwhelming: Estimates and projections vary, but it has been stated that 90 percent of the data existing worldwide today was created in the last two years 5 and that every two days more information is generated than was from the dawn of civilization until 2003. 6 This trend will continue: The global market for Big Data technology and services is projected to grow at a compound annual rate of 27 percent through 2017, about six times faster than the general information and com- munications technology (ICT) market. 7
Many more comparisons and statistics are available, and all demonstrate the incredible and continued growth of data.
Certainly, there are new and emerging opportunities arising from the accu- mulation and analysis of all that data we are busy generating and collecting. New enterprises are springing up to capitalize on data mining and business intelligence opportunities. The U.S. federal government joined in, announcing $200 million in Big Data research programs in 2012.8
4 INFORMATION GOVERNANCE
Big Data values massive accumulation of data, whereas in business, e-discovery realities and potential legal liabilities dictate that data be culled to only that which has clear business value.
But established organizations, especially larger ones, are being crushed by this onslaught of Big Data: It is just too expensive to keep all the information that is being generated, and unneeded information is a sort of irrelevant sludge for decision makers to wade through. They have diffi culty knowing which information is an accurate and meaningful “wheat” and which is simply irrelevant “chaff.” This means they do not have the precise information they need to base good business decisions upon.
And all that Big Data piling up has real costs: The burden of massive stores of information has increased storage management costs dramatically, caused overloaded systems to fail, and increased legal discovery costs. 9 Further, the longer that data is kept, the more likely that it will need to be migrated to newer computing platforms, driving up conversion costs; and legally, there is the risk that somewhere in that mountain of data an organization stores is a piece of information that represents a signifi cant legal liability.10
This is where the worlds of Big Data and business collide . For Big Data proponents, more data is always better, and there is no perceived downside to accumulation of mas- sive amounts of data. In the business world, though, the realities of legal e-discovery mean the opposite is true. 11 To reduce risk, liability, and costs, it is critical for unneeded information to be disposed of in a systematic, methodical, and “legally defensible” (jus- tifi able in legal proceedings) way, when it no longer has legal, regulatory, or business value. And there also is the high-value benefi t of basing decisions on better, cleaner data, which can come about only through rigid, enforced information governance (IG) policies that reduce information glut.
Organizations are struggling to reduce and right-size their information footprint by discarding superfl uous and redundant data, e-documents, and information. But the critical issue is devising policies, methods, and processes and then deploying information technol- ogy (IT) to sort through which information is valuable and which no longer has business value and can be discarded.
IT, IG, risk, compliance, and legal representatives in organizations have a clear sense that most of the information stored is unneeded, raises costs, and poses risks. According to a survey taken at a recent Compliance, Governance and Oversight Counsel summit, respondents estimated that approximately 25 percent of information stored in organizations has real business value, while 5 percent must be kept as busi- ness records and about 1 percent is retained due to a litigation hold. “This means that
The onslaught of Big Data necessitates that information governance (IG) be implemented to discard unneeded data in a legally defensible way.
THE ONSLAUGHT OF BIG DATA AND THE INFORMATION GOVERNANCE IMPERATIVE 5
[about] 69 percent of information in most companies has no business, legal, or regulatory value. Companies that are able to dispose of this data debris return more profi t to sharehold- ers, can leverage more of their IT budgets for strategic investments, and can avoid excess expense in legal and regulatory response” (emphasis added). 12
With a smaller information footprint , organizations can more easily fi nd what they tt need and derive business value from it.13 They must eliminate the data debris regularly and consistently, and to do this, processes and systems must be in place to cull valuable information and discard the data debris daily. An IG program sets the framework to accomplish this.
The business environment has also underscored the need for IG. According to Ted Friedman at Gartner, “The recent global fi nancial crisis has put information gov- ernance in the spotlight. . . . [It] is a priority of IT and business leaders as a result of various pressures, including regulatory compliance mandates and the urgent need for improved decision-making.” 14
And IG mastery is critical for executives: Gartner predicts that by 2016, one in fi ve chief information offi cers in regulated industries will be fi red from their jobs for failed IG initiatives. s 15
Defi ning Information Governance
IG is a sort of super discipline that has emerged as a result of new and tightened legislation governing businesses, external threats such as hacking and data breaches, and the recog- nition that multiple overlapping disciplines were needed to address today’s information management challenges in an increasingly regulated and litigated business environment.16
IG is a subset of corporate governance, and includes key concepts from re- cords management, content management, IT and data governance, information se- curity, data privacy, risk management, litigation readiness, regulatory compliance, long-term digital preservation , and even business intelligence. This also means that it includes related technology and discipline subcategories, such as document management, enterprise search, knowledge management, and business continuity/ disaster recovery.
Only about one quarter of information organizations are managing has real business value.
With a smaller information footprint, it is easier for organizations to fi nd the information they need and derive business value from it.
IG is a subset of corporate governance.
6 INFORMATION GOVERNANCE
IG is a sort of superdiscipline that encompasses a variety of key concepts from a variety of related disciplines.
Practicing good IG is the essential foundation for building legally defensible disposition practices to discard unneeded information and to secure confi dential in- formation, which may include trade secrets, strategic plans, price lists, blueprints, or personally identifi able information (PII) subject to privacy laws; it provides the basis for consistent, reliable methods for managing data, e-documents, and records.
Having trusted and reliable records, reports, data, and databases enables managers to make key decisions with confi dence.17 And accessing that information and business intelligence in a timely fashion can yield a long-term sustainable competitive advan- tage, creating more agile enterprises.
To do this, organizations must standardize and systematize their handling of in- formation. They must analyze and optimize how information is accessed, controlled, managed, shared, stored, preserved, and audited. They must have complete, current, and relevant policies, processes, and technologies to manage and control information, including who is able to access what information , and when, to meet external legal and regulatory demands and internal governance policy requirements. In short, IG is about information control and compliance.
IG is a subset of corporate governance, which has been around as long as corpora- tions have existed. IG is a rather new multidisciplinary fi eld that is still being defi ned, but has gained traction increasingly over the past decade. The focus on IG comes not only from compliance, legal, and records management functionaries but also from ex- ecutives who understand they are accountable for the governance of information and that theft or erosion of information assets has real costs and consequences.
“Information governance” is an all-encompassing term for how an organization manages the totality of its information.
According to the Association of Records Managers and Administrators (ARMA), IG is “a strategic framework composed of standards, processes, roles, and metrics that hold organizations and individuals accountable to create, organize, secure, maintain, use, and dispose of information in ways that align with and contribute to the organization’s goals.”18
IG includes the set of policies, processes, and controls to manage information in compliance with external regulatory requirements and internal governance frameworks . Specifi c policiess apply to specifi c data and document types, records series, and other business informa- tion, such as e-mail and reports.
Stated differently, IG is “a quality-control discipline for managing, using, improv- ing, and protecting information.” 19
Practicing good IG is the essential foundation for building legally defensible disposition practices to discard unneeded information.
THE ONSLAUGHT OF BIG DATA AND THE INFORMATION GOVERNANCE IMPERATIVE 7
IG is “a strategic framework composed of standards, processes, roles, and metrics, that hold organizations and individuals accountable to create, orga- nize, secure, maintain, use, and dispose of information in ways that align with and contribute to the organization’s goals.” 20
Fleshing out the defi nition further: “Information governance is policy-based man- agement of information designed to lower costs, reduce risk, and ensure compliance with legal, regulatory standards, and/or corporate governance.”21 IG necessarily in- corporates not just policies but information technologies to audit and enforce those policies. The IG team must be cognizant of information lifecycle issues and be able to apply the proper retention and disposition policies, including digital preservation where records need to be maintained for long periods.
IG Is Not a Project, But an Ongoing Program
IG is an ongoing program , not a one-time project. IG provides an umbrella to manage and control information output and communications. Since technologies change so quickly, it is necessary to have overarching policies that can manage the various IT platforms that an organization may use.
Compare it to a workplace safety program; every time a new location, team member, piece of equipment, or toxic substance is acquired by the organization, the workplace safety program should dictate how that is handled. If it does not, the workplace safety policies/procedures/training that are part of the workplace safety program need to be updated. Regular reviews are conducted to ensure the program is being followed and ad- justments are made based on the fi ndings. The effort never ends. s 22 The same is true for IG.
IG is not only a tactical program to meet regulatory, compliance, and litigation demands. It can be strategic , in that it is the necessary underpinning for developing a c management strategy that maximizes knowledge worker productivity while minimiz- ing risk and costs.
Why IG Is Good Business
IG is a tough sell. It can be diffi cult to make the business case for IG, unless there has been some major compliance sanction, fi ne, legal loss, or colossal data breach. In fact, the largest
IG is how an organization maintains security, complies with regulations, and meets ethical standards when managing information.
IG is a multidisciplinary program that requires an ongoing effort.
8 INFORMATION GOVERNANCE
impediment to IG adoption is simply identifying its benefi ts and costs, according to the Economist Intelligence Unit. Sure, the enterprise needs better control over its information, but how much better? At what cost? What is the payback period and the return on investment? 23
It is challenging to make the business case for IG, yet making that case is funda- mental to getting IG efforts off the ground.
Here are eight reasons why IG makes good business sense, from IG thought leader Barclay Blair:
1. We can’t keep everything forever. IG makes sense because it enables organiza- tions to get rid of unnecessary information in a defensible manner. Organi- zations need a sensible way to dispose of information in order to reduce the cost and complexity of the IT environment. Having unnecessary informa- tion around only makes it more diffi cult and expensive to harness informa- tion that has value.
2. We can’t throw everything away. IG makes sense because organizations can’t keep everything forever, nor can they throw everything away. We need information—the right information, in the right place, at the right time. Only IG provides the framework to make good decisions about what infor- mation to keep.
3. E-discovery. IG makes sense because it reduces the cost and pain of discov- ery. Proactively managing information reduces the volume of information exposed to e-discovery and simplifi es the task of fi nding and producing responsive information.
4. Your employees are screaming for it—just listen. IG makes sense because it helps knowledge workers separate “signal” from “noise” in their informa- tion fl ows. By helping organizations focus on the most valuable informa- tion, IG improves information delivery and improves productivity.
5. It ain’t gonna get any easier. IG makes sense because it is a proven way for organizations to respond to new laws and technologies that create new re- quirements and challenges. The problem of IG will not get easier over time, so organizations should get started now.
6. The courts will come looking for IG. IG makes sense because courts and regu- lators will closely examine your IG program. Falling short can lead to fi nes, sanctions, loss of cases, and other outcomes that have negative business and fi nancial consequences.
7. Manage risk: IG is a big one. Organizations need to do a better job of identi- fying and managing risk. The risk of information management failures is a critical risk that IG helps to mitigate.
8. E-mail: Reason enough. IG makes sense because it helps organizations take con- trol of e-mail. Solving e-mail should be a top priority for every organization. 24
Failures in Information Governance
The failure to implement and enforce IG can lead to vulnerabilities that can have dire consequences. The theft of confi dential U.S. National Security Agency documents
THE ONSLAUGHT OF BIG DATA AND THE INFORMATION GOVERNANCE IMPERATIVE 9
by Edward Snowden in 2013 could have been prevented by properly enforced IG. Also, Ford Motor Company is reported to have suffered a loss estimated at $50 to $100 million as a result of the theft of confi dential documents by one of its own em- ployees. A former product engineer who had access to thousands of trade secret docu- ments and designs sold them to a competing Chinese car manufacturer. A strong IG program would have controlled and tracked access and prevented the theft while pro- tecting valuable intellectual property. 25
Law enforcement agencies have also suffered from poor IG. In a rather frivolous case in 2013 that highlighted the lack of policy enforcement for the mobile environ- ment, it was reported that U.S. agents from the Federal Bureau of Investigation used government-issued mobile phones to send explicit text messages and nude photographs to coworkers. The incidents did not have a serious impact but did compromise the agency and its integrity, and “adversely affected the daily activities of several squads.” 26 Proper mobile communications policies were obviously not developed and enforced.
IG is also about information security and privacy, and serious thought must be given when creating policies to safeguard personal, classifi ed or confi dential informa- tion. Schemes to compromise or steal information can be quite deceptive and devious, masked by standard operating procedures—if proper IG controls and monitoring are not in place. To wit: Granting remote access to confi dential information assets for key personnel is common. Granting medical leave is also common. But a deceptive and dishonest employee could feign a medical leave while downloading volumes of confi dential information assets for a competitor—and that is exactly what happened at Accenture, a global consulting fi rm. During a fraudulent medical leave, an employee was allowed access to Accenture’s Knowledge Exchange (KX), a detailed knowledge base containing previous proposals, expert reports, cost-estimating guidelines, and case studies. This activity could have been prevented by monitoring and analytics that would have shown an inordinate amount of downloads—especially for an “ailing” em- ployee. The employee then went to work for a direct competitor and continued to download the confi dential information from Accenture, estimated to be as many as 1,000 critical documents. While the online access to KX was secure, the use of the electronic documents could have been restricted even after the documents were down-r loaded, if IG measures were in place and newer technologies (such as information rights management [IRM] software) were deployed to secure them directly and main- tain that security remotely. With IRM, software security protections can be employed to seal the e-documents and control their use—even after they leave the organization. More details on IRM technology and its capabilities is presented later in this book.
Other recent high-profi le data and document leakage cases revealing information security weaknesses that could have been prevented by a robust IG program include:
■ Huawei Technologies, the largest networking and mobile communications company in China, was sued by U.S.-based Motorola for allegedly conspiring to steal trade secrets through former Motorola employees.
Ford’s loss from stolen documents in a single case of intellectual property (IP) theft was estimated at $50 to $100 million.
10 INFORMATION GOVERNANCE
■ MI6, the U.K. equivalent of the U.S. Central Intelligence Agency, learned that one of its agents in military intelligence attempted to sell confi dential docu- ments to the intelligence services of the Netherlands for £2 million GBP ($3 million USD).
And breaches of personal information revealing failures in privacy protection abound; here are just a few:
■ Health information of 1,600 cardiology patients at Texas Children’s Hospital was compromised when a doctor’s laptop was stolen. The information includ- ed personal and demographic information about the patients, including their names, dates of birth, diagnoses, and treatment histories. 27
■ U.K. medics lost the personal records of nearly 12,000 National Health Service patients in just eight months. Also, a hospital worker was suspended after it was discovered he had sent a fi le containing pay-slip details for every member of staff to his home e-mail account. 28
■ Personal information about more than 600 patients of the Fraser Health Authority in British Columbia, Canada, was stored on a laptop stolen from Burnaby General Hospital.
■ In December 2013, Target stores in the U.S. reported that as many as 110 million customer records had been breached in a massive attack that lasted weeks.
The list of breaches and IG failures could go on and on, more than fi lling the pages of this book. It is clear that it is occurring and that it will continue. IG controls to safeguard confi dential information assets and protect privacy cannot rely solely on the trustwor- thiness of employees and basic security measures. Up-to-date IG policies and enforcement efforts and newer technology sets are needed, with active, consistent monitoring and program adjustments to continue to improve.
Executives and senior managers can no longer avoid the issue, as it is abundantly clear that the threat is real and the costs of taking such avoidable risks can be high. A single security breach is an IG failure and can cost the entire business. According to Debra Logan of Gartner, “When organizations suffer high-profi le data losses, espe- cially involving violations of the privacy of citizens or consumers, they suffer serious reputational damage and often incur fi nes or other sanctions. IT leaders will have to take at least part of the blame for these incidents.” 29
Form IG Policies, Then Apply Technology for Enforcement
Typically, some policies governing the use and control of information and records may have been established for fi nancial and compliance reports, and perhaps e-mail, but they are often incomplete and out-of-date and have not been adjusted for changes in the business environment, such as new technology platforms (e.g., Web 2.0, social
IG controls to safeguard confi dential information assets and protect privacy can- not rely solely on the trustworthiness of employees and basic security measures.
THE ONSLAUGHT OF BIG DATA AND THE INFORMATION GOVERNANCE IMPERATIVE 11
media), changing laws (e.g., U.S. Federal Rules of Civil Procedure 2006 changes), and additional regulations.
Further adding to the challenge is the rapid proliferation of mobile devices like tablets, phablets, and smartphones used in business—information can be more easily lost or stolen—so IG efforts must be made to preserve and protect the enterprise’s information assets.
Proper IG requires that policies are fl exible enough not to hinder the proper fl ow of information in the heat of the business battle yet strict enough to control and audit for misuse, policy violations, or security breaches. This is a continuous iterative policy- making process that must be monitored and fi ne-tuned. Even with the absolute best efforts, some policies will miss the mark and need to be reviewed and adjusted.
Getting started with IG awareness is the crucial fi rst step. It may have popped up on an executive’s radar at one point or another and an effort might have been made, but many organizations leave these policies on the shelf and do not revise them on a regular basis.
IG is the necessary underpinning for a legally defensible disposition program that discards data debris and helps narrow the search for meaningful information on which to base business decisions. IG is also necessary to protect and preserve critical infor- mation assets. An IG strategy should aim to minimize exposure to risk, at a reasonable cost level, while maximizing productivity and improving the quality of information delivered to knowledge users.
But a reactive, tactical project approach is not the way to go about it—haphazardly t swatting at technological, legal, and regulatory fl ies. A proactive, strategic program, with a clear, accountable sponsor, an ongoing plan, and regular review process, is the only way to continuously adjust IG policies to keep them current so that they best serve the organization’s needs.
Some organizations have created formal governance bodies to establish strat- egies, policies, and procedures surrounding the distribution of information inside and outside the enterprise. These governance bodies, steering committees, or teams should include members from many different functional areas, since proper IG ne- cessitates input from a variety of stakeholders. Representatives from IT, records man- agement, corporate or agency archiving, risk management, compliance, operations, human resources, security, legal, fi nance, and perhaps knowledge management are typically a part of IG teams. Often these efforts are jump-started and organized by an executive sponsor who utilizes third-party consulting resources that specialize in IG efforts, especially considering the newness of IG and its emerging best practices.
So in this era of ever-growing Big Data, leveraging IG policies to focus on re- taining the information that has real business value, while discarding the majority of information that has no value and carries associated increased costs and risks, is criti- cal to success for modern enterprises. This must be accomplished in a systematic, consistent, and legally defensible manner by implementing a formal IG program. Other crucial elements of an IG program are the steps taken to secure confi dential information by enforcing and monitoring policies using the appropriate information technologies.
Getting started with IG awareness is the crucial fi rst step.
12 INFORMATION GOVERNANCE
CHAPTER SUMMARY: KEY POINTS
■ The onslaught of Big Data necessitates that IG be implemented to discard unneeded data in a legally defensible way.
■ Big Data values massive accumulation of data, whereas in business, e-discovery realities and potential legal liabilities dictate that data be culled to only that which has clear business value.
■ Only about one quarter of the information organizations are managing has real business value.
■ With a smaller information footprint, it is easier for organizations to fi nd the information they need and derive business value from it.
■ IG is a subset of corporate governance and encompasses the policies and leveraged technologies meant to manage what corporate information is re- tained, where, and for how long, and also how it is retained.
■ IG is a sort of super discipline that encompasses a variety of key concepts from a variety of related and overlapping disciplines.
■ Practicing good IG is the essential foundation for building legally defensible disposition practices to discard unneeded information.
■ According to ARMA, IG is “a strategic framework composed of standards, processes, roles, and metrics that hold organizations and individuals account- able to create, organize, secure, maintain, use, and dispose of information in ways that align with and contribute to the organization’s goals.” 30
■ IG is how an organization maintains security, complies with regulations and laws, and meets ethical standards when managing information.
■ IG is a multidisciplinary program that requires an ongoing effort and active participation of a broad cross-section of functional groups and stakeholders.
■ IG controls to safeguard confi dential information assets and protect privacy cannot rely solely on the trustworthiness of employees and basic security measures.
■ Getting started with IG awareness is the crucial fi rst step.
Notes
1. The Economist, “Data, Data Everywhere,” February 25, 2010, www.economist.com/node/15557443 2. Gartner, Inc., “IT Glossary: Big Data,” www.gartner.com/it-glossary/big-data/ (accessed April 15, 2013). 3. Webopedia, “Big Data,” www.webopedia.com/TERM/B/big_data.html (accessed April 15, 2013).
THE ONSLAUGHT OF BIG DATA AND THE INFORMATION GOVERNANCE IMPERATIVE 13
4. World Economic Forum, “Personal Data:The Emergence of a New Asset Class”(January 2011), http:// www3.weforum.org/docs/WEF_ITTC_PersonalDataNewAsset_Report_2011.pdf
5. Deidra Paknad, “Defensible Disposal: You Can’t Keep All Your Data Forever,” July 17, 2012, www .forbes.com/sites/ciocentral/2012/07/17/defensible-disposal-you-cant-keep-all-your-data-forever/
6. Susan Karlin, “Earth’s Nervous System: Looking at Humanity Through Big Data,” www.fastcocreate .com/1681986/earth-s-nervous-system-looking-at-humanity-through-big-data#1(accessed March 5, 2013).
7. IDC Press Release, December 18, ,2013, http://www.idc.com/getdoc.jsp?containerId=prUS24542113 New IDC Worldwide Big Data Technology and Services Forecast Shows Market Expected to Grow to $32.4 Billion in 2017
8. Steve Lohr, “How Big Data Became So Big,” New York Times, August 11, 2012, www.nytimes. com/2012/08/12/business/how-big-data-became-so-big-unboxed.html?_r=2&smid=tw-share&
9. Kahn Consulting, “Information Governance Brief,” sponsored by IBM, www.delve.us/downloads/ Brief-Defensible-Disposal.pdf (accessed March 4, 2013).
10. Barclay T. Blair, “Girding for Battle,” Law Technology News, October 1, 2012, www.law.com/jsp/lawtech- nologynews/PubArticleLTN.jsp?id=1202572459732&thepage=1
11. Ibid. 12. Paknad, “Defensible Disposal.” 13. Randolph A. Kahn, https://twitter.com/InfoParkingLot/status/273791612172259329, November 28, 2012. 14. Gartner Press Release, “Gartner Says Master Data Management Is Critical to Achieving Effective
Information Governance,” www.gartner.com/newsroom/id/1898914, January 19, 2012 15. Ibid. 16. Monica Crocker, e-mail to author, June 21, 2012. 17. Economist Intelligence Unit, “The Future of Information Governance,” www.emc.com/leadership/
business-view/future-information-governance.htm (accessed November 14, 2013). 18. ARMA International, Glossary of Records and Information Management Terms , 4th ed., 2012, TR 22–2012.s 19. Arvind Krishna, “Three Steps to Trusting Your Data in 2011,” IT Business Edge , posted March 9, 2011,
www.itbusinessedge.com/guest-opinions/three-steps-trusting-your-data-2011 . (accessed November 14, 2013).
20. ARMA International, Glossary of Records and Information Management Terms , 4th ed., 2012, TR 22–2012.s 21. Laura DuBoisand Vivian Tero, “Practical Information Governance: Balancing Cost, Risk, and Pro-
ductivity,” IDC White Paper (August 2010), www.emc.com/collateral/analyst-reports/idc-practical- information-governance-ar.pdf
22. Monica Crocker, e-mail to author, June 21, 2012. 23. Barclay T. Blair, Making the Case for Information Governance: Ten Reasons IG Makes Sense , ViaLumina
Ltd, 2010. Online at http://barclaytblair.com/making-the-case-for-ig-ebook/ (accessed November 14, 2013).
24. Barclay T. Blair, “8 Reasons Why Information Governance (IG) Makes Sense,” June 29, 2009, www. digitallandfi ll.org/2009/06/8-reasons-why-information-governance-ig-makes-sense.html
25. Peter Abatan, “Corporate and Industrial Espionage to Rise in 2011,” Enterprise Digital Rights Man- agement, http://enterprisedrm.tumblr.com/post/2742811887/corporate-espionage-to-rise-in-2011 . (accessed November 14, 2013).
26. BBC News, “FBI Staff Disciplined for Sex Texts and Nude Pictures,” February 22, 2013, www.bbc. co.uk/news/world-us-canada-21546135
27. Todd Ackerman, “Laptop Theft Puts Texas Children’s Patient Info at Risk,” Houston Chronicle , July 30, 2009, e www.chron.com/news/houston-texas/article/Laptop-theft-puts-Texas-Children-s-patient-info-1589473. php . (accessed March 2, 2012).
28. Jonny Greatrex, “Bungling West Midlands Medics Lose 12,000 Private Patient Records,” Sunday Mer- cury, September 5, 2010, www.sundaymercury.net/news/sundaymercuryexclusives/2010/09/05/bun- gling-west-midlands-medics-lose-12–000-private-patient-records-66331–27203177/ (accessed March 2, 2012).
29. Gartner Press Release, “Gartner Says Master Data Management Is Critical to Achieving Effective Information Governance.”
30. ARMA International, Glossary of Records and Information Management Terms. s
15
Information Governance, IT Governance, Data Governance: What’s the Difference?
C H A P T E R 2
T here has been a great deal of confusion around the term information gover- nance (IG) and how it is distinct from other similar industry terms, such as information technology (IT) governance and data governance . They are all
a subset of corporate governance, and in the above sequence, become increasingly more granular in their approach. Data governance is a part of broader IT governance, which is also a part of even broader information governance. The few texts that exist have compounded the confusion by offering a limited defi nition of IG, or sometimes offering a defi nition of IG that is just plain incorrect , often confusing it with simple datat governance.
So in this chapter we spell out the differences and include examples in hopes of clarifying what the meaning of each term is and how they are related.
Data Governance
Data governance involves processes and controls to ensure that information at the data level—raw alphanumeric characters that the organization is gathering and inputting— is true and accurate, and unique (not redundant). It involves data cleansing ( or data scrubbing) to strip out corrupted, inaccurate, or extraneous data and gg de-duplication, to eliminate redundant occurrences of data.
Data governance focuses on information quality from the ground up at the lowest or root level, so that subsequent reports, analyses, and conclusions are based on clean, reliable, trusted data (or records) in database tables. Data governance is the most rudi- mentary level at which to implement information governance. Data governance efforts seek to ensure that formal management controls—systems, processes, and accountable employees who are stewards and custodians of the data—are implemented to govern critical data assets to improve data quality and to avoid negative downstream effects of poor data. The biggest negative consequence of poor or inaccurate data is poorly and inaccurately based decisions.
16 INFORMATION GOVERNANCE
Data governance is a newer, hybrid quality control discipline that includes elements of data quality, data management, IG policy development, business process improvement, and compliance and risk management.
Data Governance Strategy Tips
Everyone in an organization wants good-quality data to work with. But it is not so easy to implement a data governance program. First of all, data is at such a low level that executives and board members are typically unaware of the details of the “smoky back room” of data collection: cleansing, normalization, and input. So it is diffi cult to gain an executive sponsor and funding to initiate the effort. 1 And if a data governance program does move forward, there are challenges in getting business users to adhere to new policies. This is a crucial point, since much of the data is being generated by business units. But there are some general guidelines that can help improve a data governance program’s chances for success:
■ Identify a measureable impact. A data governance program must be able to dem- onstrate business value, or it will not get the executive sponsorship and funding it needs to move forward. A readiness assessment should capture the current state of data quality and whether an enterprise or business unit level effort is warranted. Other key issues include: Can the organization save hard costs by implementing data governance? Can it reach more customers or increase revenue generated from existing customers?2
■ Assign accountability for data quality to business units, not IT. Typically, IT has had responsibility for data quality, yet it is mostly not under that department’s con- trol, since most of the data is being generated in the business units. A pointed effort must be made to push responsibility and ownership for data to the busi- ness units that create and use the data.
■ Recognize the uniqueness of data as an asset. Unlike other assets, such as people, factories, equipment, and even cash, data is largely unseen, out of sight, and intangible. It changes daily. It spreads throughout business units. It is copied and deleted. Data growth can spiral out of control, obscuring the data that has true business value. So data has to be treated differently, and its unique qualities must be considered.
■ Forget the past; implement a going-forward strategy. It is a signifi cantly greater task to try to improve data governance across the enterprise for existing data. Remember, you may be trying to fi x decades of bad behavior, mismanagement, and lack of governance. Taking an incremental approach with an eye to the future provides for a clean starting point and can substantially reduce the pain required to implement. A proven best practice is to implement a from-this- point-on strategy where new data governance policies for handling data are implemented beginning on a certain date.
Data governance uses techniques like data cleansing and de-duplication to improve data quality and reduce redundancies.
INFORMATION GOVERNANCE, IT GOVERNANCE, DATA GOVERNANCE 17
Good data governance ensures that downstream negative effects of poor data are avoided and that subsequent reports, analyses, and conclusions are based on reliable, trusted data.
■ Manage the change. Educate, educate, educate. People must be trained to under- stand why the data governance program is being implemented and how it will benefi t the business. The new policies represent a cultural change, and people need supportive program messages and training in order to make the shift. 3
IT Governance
IT governance is the primary way that stakeholders can ensure that investments in IT create business value and contribute toward meeting business objectives.4 This strategic align- ment of IT with the business is challenging yet essential. IT governance programs go further and aim to “improve IT performance, deliver optimum business value and ensure regulatory compliance.” 5
Although the CIO typically has line responsibility for implementing IT gover- nance, the CEO and board of directors must receive reports and updates to discharge their responsibilities for IT governance and to see that the program is functioning well and providing business benefi ts.
Typically, in past decades, board members did not get involved in overseeing IT governance. But today it is a critical and unavoidable responsibility. According to the IT Governance Institute’s Board Briefi ng on IT Governance , “IT governance is the re- sponsibility of the board of directors and executive management. It is an integral part of enterprise governance and consists of the leadership and organizational structures and processes that ensure that the organization’s IT sustains and extends the organiza- tion’s strategies and objectives.” 6
The focus is on the actual software development and maintenance activities of the IT department or function, and IT governance efforts focus on making IT effi cient and effective. That means minimizing costs by following proven software develop- ment methodologies and best practices, principles of data governance and information quality, and project management best practices while aligning IT efforts with the busi- ness objectives of the organization.
IT Governance Frameworks
Several IT governance frameworks can be used as a guide to implementing an IT governance program. (They are introduced in this chapter in a cursory way; detailed discussions of them are best suited to books focused solely on IT governance.)
IT governance seeks to align business objectives with IT strategy to deliver business value.
18 INFORMATION GOVERNANCE
Although frameworks and guidance like CobiT® and ITIL have been widely adopted, there is no absolute standard IT governance framework; the combination that works best for an organization depends on business factors, corporate culture, IT maturity, and staffi ng capability. The level of implementation of these frameworks will also vary by organization.
CobiT® CobiT (Control Objectives for Information and related Technology) is a process-T based IT governance framework that represents a consensus of experts worldwide. Codeveloped by the IT Governance Institute and ISACA (previously known as the Information Systems Audit and Control Association), CobiT addresses business risks, control requirements, compliance, and technical issues. 7
CobiT offers IT controls that:
■ Cut IT risks while gaining business value from IT under an umbrella of a glob- ally accepted framework.
■ Assist in meeting regulatory compliance requirements. ■ Utilize a structured approach for improved reporting and management deci-
sion making. ■ Provide solutions to control assessments and project implementations to im-
prove IT and information asset control. 8
CobiT consists of detailed descriptions of processes required in IT and also tools to measure progress toward maturity of the IT governance program. It is industry agnostic and can be applied across all vertical industry sectors, and it continues to be revised and refi ned. 9
CobiT is broken out into three basic organizational levels and their responsibili- ties: (1) board of directors and executive management; (2) IT and business manage- ment; and (3) line-level governance, and security and control knowledge workers. 10
The CobiT model draws on the traditional “plan, build, run, monitor” paradigm of traditional IT management, only with variations in semantics. The CobiT framework is divided into four IT domains—(1) plan and organize, (2) acquire and implement, (3) deliver and support, and (4) monitor and evaluate—which contain 34 IT processes and 210 control objectives. Specifi c goals and metrics are assigned, and responsibilities and accountabilities are delineated.
The CobiT framework maps to the international information security standard, ISO 17799, and is also compatible with IT Infrastructure Library (ITIL) and other y “accepted practices” in IT development and operations.11
ValIT® ValIT is a newer value-oriented framework that is compatible with and complemen- tary to CobiT. Its principles and best practices focus is on leveraging IT investments to gain maximum value. Forty key ValIT essential management practices (analogous to CobiT’s control objectives) support three main processes: value governance, portfolio management, and investment management. ValIT and CobiT “provide a full frame- work and supporting tool set” to help managers develop policies to manage business risks and deliver business value while addressing technical issues and meeting control objectives in a structured, methodic way. 12
INFORMATION GOVERNANCE, IT GOVERNANCE, DATA GOVERNANCE 19
ITIL ITIL (Information Technology Infrastructure Library) is a set of process-oriented best practices and guidance originally developed in the United Kingdom to standard- ize delivery of IT service management. ITIL is applicable to both the private and public sectors and is the “most widely accepted approach to IT service management in the world.”13 As with other IT governance frameworks, ITIL provides essential guidance for delivering business value through IT, and it “provides guidance to or- ganizations on how to use IT as a tool to facilitate business change, transformation and growth.”14
ITIL best practices form the foundation for ISO/IEC 20000 (previously BS15000), the International Service Management Standard for organizational certifi cation and compliance. 15 ITIL 2011 is the latest revision (as of this printing), and it consists of fi ve core published volumes that map the IT service cycle in a systematic way:
1. ITIL Service Strategy 2. ITIL Service Design 3. ITIL Service Transition 4. ITIL Service Operation 5. ITIL Continual Service Improvement 16
ISO 38500 ISO/IEC 38500:2008 is an international standard that provides high-level principles and guidance for senior executives and directors, and those advising them, for the effective and effi cient use of IT. 17 Based primarily on AS 8015, the Australian IT gov- ernance standard, it “applies to the governance of management processes” that are performed at the IT service level, but the guidance assists executives in monitoring IT and ethically discharging their duties with respect to legal and regulatory compliance of IT activities.
The ISO 38500 standard comprises three main sections:
1. Scope, Application and Objectives 2. Framework for Good Corporate Governance of IT 3. Guidance for Corporate Governance of IT
CobiT is process-oriented and has been widely adopted as an IT governance framework. ValIT is value-oriented and compatible and complementary with CobiT, yet focuses on value delivery.
ITIL is the “most widely accepted approach to IT service management in the world.”
20 INFORMATION GOVERNANCE
It is largely derived from AS 8015, the guiding principles of which were:
■ Establish responsibilities ■ Plan to best support the organization ■ Acquire validly ■ Ensure performance when required ■ Ensure conformance with rules ■ Ensure respect for human factors
The standard also has relationships with other major ISO standards, and embraces the same methods and approaches. 18
Information Governance
Corporate governance is the highest level of governance in an organization, and a key aspect of it is IG. IG processes are higher level than the details of IT governance and much higher than data governance, but both data and IT governance can be (and should be) a part of an overall IG program. The IG approach to governance focuses not on detailed IT or data capture and quality processes but rather on controlling the information that is generated by IT and offi ce systems. d
IG efforts seek to manage and control information assets to lower risk, ensure com- pliance with regulations, and improve information quality and accessibility while imple- menting information security measures to protect and preserve information that has busi- ness value.19 (See Chapter 1 for more detailed defi nitions.)
Impact of a Successful IG Program
When making the business case for IG and articulating its benefi ts, it is useful to focus on its central impact. Putting cost-benefi t numbers to this may be diffi cult, unless you
ISO 38500 is an international standard that provides high-level principles and guidance for senior executives and directors responsible for IT governance.
IG is how an organization maintains security, complies with regulations and laws, and meets ethical standards when managing information.
INFORMATION GOVERNANCE, IT GOVERNANCE, DATA GOVERNANCE 21
also consider the worst-case scenario of loss or misuse of corporate or agency records. What is losing the next big lawsuit worth? How much are confi dential merger and acquisition documents worth? How much are customer records worth? Frequently, executives and managers do not understand the value of IG until it is a crisis, an ex- pensive legal battle is lost, heavy fi nes are imposed for noncompliance, or executives go to jail.
There are some key outputs from implementing an IG program. A successful IG program should enable organizations to:
■ Use common terms across the enterprise. This means that departments must agree on how they are going to classify document types, which requires a cross- functional effort. With common enterprise terms, searches for information are more productive and complete. This normalization process begins with developing a standardized corporate taxonomy, which defi nes the terms (and substitute terms in a custom corporate thesaurus), document types, and their relationships in a hierarchy.
■ Map information creation and usage. This effort can be buttressed with the use of technology tools such as data loss prevention , which can be used to discover the fl ow of information within and outside of the enterprise. You must fi rst determine who is accessing which information when and where it is going. Then you can monitor and analyze these information fl ows. The goal is to stop the erosion or misuse of information assets and to stem data breaches with moni- toring and security technology.
■ Obtain “information confi dence” —that is, the assurance that information has ” integrity, validity, accuracy, and quality; this means being able to prove that the information is reliable and that its access, use, and storage meet compliance and legal demands.
■ Harvest and leverage information. Using techniques and tools like data min- ing and business intelligence, new insights may be gained that provide an enterprise with a sustainable competitive advantage over the long term, since managers will have more and better information as a basis for busi- ness decisions.21
Summing Up the Differences
IG consists of the overarching polices and processes to optimize and leverage informa- tion while keeping it secure and meeting legal and privacy obligations in alignment with stated organizational business objectives.
IT governance consists of following established frameworks and best practices to gain the most leverage and benefi t out of IT investments and support accomplishment of business objectives.
Data governance consists of the processes, methods, and techniques to ensure that data is of high quality, reliable, and unique (not duplicated), so that downstream uses in reports and databases are more trusted and accurate.
22 INFORMATION GOVERNANCE
Notes
1. “New Trends and Best Practices for Data Governance Success,” SeachDataManagement.com eBook, http://viewer.media.bitpipe.com/1216309501_94/1288990195_946/Talend_sDM_SO_32247_EB- ook_1104.pdf, accessed March 11, 2013.
2. Ibid. 3. Ibid. 4. M.N. Kooper, R. Maes, and E.E.O. RoosLindgreen, “On the Governance of Information: Introducing
a New Concept of Governance to Support the Management of Information,” International Journal of Information Management 31 (2011): 195–120, http://dl.acm.org/citation.cfm?id=2297895 . (accessed t November 14, 2013).
5. Nick Robinson, “The Many Faces of IT Governance: Crafting an IT Governance Architecture,” ISACA Journal 1 (2007), www.isaca.org/Journal/Past-Issues/2007/Volume-1/Pages/The-Many-Faces-l of-IT-Governance-Crafting-an-IT-Governance-Architecture.aspx
6. Bryn Phillips, “IT Governance for CEOs and Members of the Board,” 2012, p.18. 7. Ibid., p.26. 8. IBM Global Business Services/Public Sector, “Control Objectives for Information and related Tech-
nology (CobiT®) Internationally Accepted Gold Standard for IT Controls & Governance,” http:// www-304.ibm.com/industries/publicsector/fi leserve?contentid=187551(accessed March 11, 2013).
CHAPTER SUMMARY: KEY POINTS
■ Data governance uses techniques like data cleansing and de-duplication to improve data quality and reduce redundancies.
■ Good data governance ensures that downstream negative effects of poor data are avoided and that subsequent reports, analyses, and conclusions are based on reliable, trusted data.
■ IT governance seeks to align business objectives with IT strategy to deliver business value.
■ CobiT is processoriented and has been widely adopted as an IT governance framework. ValIT is valueoriented and compatible and complementary with CobiT yet focuses on value delivery.
■ The CobiT framework maps to the international information security stan- dard ISO 17799 and is also compatible with ITIL (IT Infrastructure Library).
■ ITIL is the “most widely accepted approach to IT service management in the world.”
■ ISO 38500 is an international standard that provides high-level principles and guidance for senior executives and directors responsible for IT governance.
■ Information governance is how an organization maintains security, complies with regulations and laws, and meets ethical standards when managing information.
INFORMATION GOVERNANCE, IT GOVERNANCE, DATA GOVERNANCE 23
9. Phillips, “IT Governance for CEOs and Members of the Board.” 10. IBM Global Business Services/Public Sector, “Control Objectives for Information and related Tech-
nology (CobiT®) Internationally Accepted Gold Standard for IT Controls & Governance.” 11. Ibid. 12. Ibid. 13. www.itil-offi cialsite.com/ (accessed March 12, 2013). 14. ITIL, “What Is ITIL?” www.itil-offi cialsite.com/AboutITIL/WhatisITIL.aspx(accessed March 12, 2013). 15. Ibid. 16. Ibid. 17. “ISO/IEC 38500:2008 “Corporate Governance of Information Technology” www.iso.org/iso/
catalogue_detail?csnumber=51639(accessed November 14, 2013). 18. ISO 38500 www.38500.org/ (accessed March 12, 2013). 19. www.naa.gov.au/records-management/agency/digital/digital-continuity/principles/ (accessed November 14,
2013). 20. ARMA International, Glossary of Records and Information Management Terms , 4th ed. TR 22–2012 (from s
ARMA.org). 21. Arvind Krishna, “Three Steps to Trusting Your Data in 2011,” CTO Edge , March 9, 2011, www.ctoedge
.com/content/three-steps-trusting-your-data-2011
25
Information Governance Principles *
C H A P T E R 3
P rinciples of information governance (IG) are evolving and expanding. Successful IG programs are characterized by ten key principles, which are the basis for best practices and should be designed into the IG approach. They include:
1. Executive sponsorship. No IG effort will survive and be successful if it does not have an accountable, responsible executive sponsor. The sponsor must drive the effort, clear obstacles for the IG team or committee, communicate the goals and business objectives that the IG program addresses, and keep upper management informed on progress.
2. Information policy development and communication. Clear policies must be es- tablished for the access and use of information, and those policies must be communicated regularly and crisply to employees. Policies for the use of e- mail, instant messaging, social media, cloud computing, mobile computing, and posting to blogs and internal sites must be developed in consultation with stakeholders and communicated clearly. This includes letting employees know what the consequences of violating IG policies are, as well as its value.
3. Information integrity. This area considers the consistency of methods used to create, retain, preserve, distribute, and track information. Adhering to good IG practices include data governance techniques and technologies to ensure quality data. Information integrity means there is the assurance that informa- tion is accurate, correct, and authentic. IG efforts to improve data quality and information integrity include de-duplicating (removing redundant data) and maintaining only unique data to reduce risk, storage costs, and informa- tion technology (IT) labor costs while providing accurate, trusted information for decision makers. Supporting technologies must enforce policies to meet legal standards of admissibility and preserve the integrity of information to guard against claims that it has been altered, tampered with, or deleted (called “ spoliation ”). Audit trails must be kept and monitored to ensure compliance with IG policies to assure information integrity. 1
4. Information organization and classifi cation. This means standardizing formats, categorizing all information, and semantically linking it to related information. It also means creating a retention and disposition schedule that spells out how
* Portions of this chapter are adapted from Chapter 3 of Robert F. Smallwood, Managing Electronic Records: Methods, Best Practices, and Technologies , © John Wiley & Sons, Inc., 2013. Reproduced with permission of John Wiley & Sons, Inc. s
26 INFORMATION GOVERNANCE
long the information (e.g. e-mail, e-documents, spreadsheets, reports) and records should be retained and how they are to be disposed of or archived. Information, and particularly documents, should be classifi ed according to a global or corporate taxonomy that considers the business function and owner of the information, and semantically links related information. Information must be standardized in form and format. Tools such as document labeling can assist in identifying and classifying documents. Metadata associated with documents and records must be standardized and kept up-to-date. Good IG means good metadata management and utilizing metadata standards that are appropriate to the organization.
5. Information security. This means securing information in its three states: at rest, in motion, and in use. It means implementing measures to protect information from damage, theft, or alteration by malicious outsiders and insiders as well as nonmalicious (accidental) actions that may compromise information. For instance, an employee may lose a laptop with confi dential information, but if proper IG policies are enforced using security-related information tech- nologies, the information can be secured. This can be done by access control methods, data or document encryption, deploying information rights manage- ment software, using remote digital shredding capabilities, and implement- ing enhanced auditing procedures. Information privacy is closely related to information security and is critical when dealing with personally identifi able information (PII).n
6. Information accessibility. Accessibility is vital not only in the short term but also over time using long-term digital preservation (LTDP) techniques when appropriate (generally if information is needed for over fi ve years). Accessibil- ity must be balanced with information security concerns. Information acces- sibility includes making the information as simple as possible to locate and access, which involves not only the user interface but also enterprise search principles, technologies, and tools. It also includes basic access controls, such as password management, identity and access management , and delivering t information to a variety of hardware devices.
7. Information control. Document management and report management software must be deployed to control the access to, creation, updating, and printing of documents and reports. When documents or reports are declared records, they must be assigned to the proper retention and disposition schedule to be retained for as long as the records are needed to comply with legal retention periods and regulatory requirements. Also, information that may be needed or requested in legal proceedings is safeguarded through a legal hold process.
8. Information governance monitoring and auditing. To ensure that guidelines and policies are being followed and to measure employee compliance levels, in- formation access and use must be monitored. To guard against claims of spo- liation, use of e-mail, social media, cloud computing, and report generation should be logged in real time and maintained as an audit record. Technology tools such as document analytics can track how many documents or reports users access and print and how long they spend doing so.
9. Stakeholder consultation. Those who work most closely to information are the ones who best know why it is needed and how to manage it, so business units must be consulted in IG policy development. The IT department understands
INFORMATION GOVERNANCE PRINCIPLES 27
its capabilities and technology plans and can best speak to those points. Le- gal issues must always be deferred to the in-house council or legal team. A cross-functional collaboration is needed for IG policies to hit the mark and be effective. The result is not only more secure information but also better information to base decisions on and closer adherence to regulatory and legal demands. 2
10. Continuous improvement. IG programs are not one-time projects but rather ongoing programs that must be reviewed periodically and adjusted to account for gaps or shortcomings as well as changes in the business environment, tech- nology usage, or business strategy.
Accountability Is Key
According to Debra Logan at Gartner Group, none of the proffered defi nitions of IG in- cludes “any notion of coercion, but rather ties governance to accountability [emphasis added] that is designed to encourage the right behavior. . . . The word that matters most is accountability .” The root of many problems with managing information is the “fact that there is no accountability for information as such.” 3
Establishing policies, procedures, processes, and controls to ensure the quality, in- tegrity, accuracy, and security of business records are the fundamental steps needed to reduce the organization’s risk and cost structure for managing these records. Then it is essential that IG efforts are supported by IT. The auditing, testing, maintenance, and im- provement of IG is enhanced by using electronic records management (ERM) software along with other complementary technology sets, such as workfl ow and business process management suite (BPMS) software and digital signatures.
Generally Accepted Recordkeeping Principles ®
Contributed by Charmaine Brooks, CRM A major part of an IG program is managing formal business records. Although they account for only about 7 to 9 percent of the total information that an organization holds, they are the most critically important subset to manage, as there are serious compliance and legal ramifi cations to not doing so.
Principles of successful IG programs are emerging. They include executive sponsorship, information classifi cation, integrity, security, accessibility, control, monitoring, auditing, policy development, and continuous improvement.
Accountability is a key aspect of IG.
28 INFORMATION GOVERNANCE
Records and recordkeeping are inextricably linked with any organized business activity. Through the information that an organization uses and records, creates, or receives in the normal course of business, it knows what has been done and by whom. This allows the organization to effectively demonstrate compliance with applicable standards, laws, and regulations as well as plan what it will do in the future to meet its mission and strategic objectives.
Standards and principles of recordkeeping have been developed by records and information management (RIM) practitioners to establish benchmarks for how or-t ganizations of all types and sizes can build and sustain compliant, defensible records management (RM) programs. t
The Principles
In 2009 ARMA International published a set of eight Generally Accepted Recordkeep- ing Principles,® known as The Principles 4 (or sometimes GAR Principles), to foster awareness of good recordkeeping practices. These principles and associated metrics provide an IG framework that can support continuous improvement.
The eight Generally Accepted Recordkeeping Principles are:
1. Accountability. A senior executive (or person of comparable authority) oversees the recordkeeping program and delegates program responsibility to appro- priate individuals. The organization adopts policies and procedures to guide personnel, and ensure the program can be audited.
2. Transparency. The processes and activities of an organization’s recordkeeping program are documented in a manner that is open and verifi able and is avail- able to all personnel and appropriate interested parties.
3. Integrity. A recordkeeping program shall be constructed so the records and information generated or managed by or for the organization have a reason- able and suitable guarantee of authenticity and reliability.
4. Protection. A recordkeeping program shall be constructed to ensure a reason- able level of protection to records and information that are private, confi den- tial, privileged, secret, or essential to business continuity.
5. Compliance. The recordkeeping program shall be constructed to comply with ap- plicable laws and other binding authorities, as well as the organization’s policies.
6. Availability. An organization shall maintain records in a manner that ensures timely, effi cient, and accurate retrieval of needed information.
7. Retention. An organization shall maintain its records and information for an appropriate time, taking into account legal, regulatory, fi scal, operational, and historical requirements.
8. Disposition. An organization shall provide secure and appropriate disposition for records that are no longer required to be maintained by applicable laws and the organization’s policies. 5
The Generally Accepted Recordkeeping Principles consist of eight principles that provide an IG framework that can support continuous improvement.
INFORMATION GOVERNANCE PRINCIPLES 29
The Principles apply to all sizes of organizations, in all types of industries, in both the private and public sectors, and can be used to establish consistent practices across business units. The Principles are an IG maturity model, and it is used as a preliminary evaluation of recordkeeping programs and practices.
Interest in and the application of The Principles for assessing an organization’s recordkeeping practices have steadily increased since their establishment in 2009. The Principles form an accountability framework that includes the processes, roles, stan- dards, and metrics that ensure the effective and effi cient use of records and informa- tion in support of an organization’s goals and business objectives.
As shown in Table 3.1 , the Generally Accepted Recordkeeping Principles matu- rity model associates characteristics that are typical in fi ve levels of recordkeeping capabilities ranging from 1 (substandard) to 5 (transformational). The levels are both descriptive and color coded for ease of understanding. The eight principles and levels (metrics) are applied to the current state of an organization’s recordkeeping capabili- ties and can be cross-referenced to the policies and procedures. While it is not unusual for an organization to be at different levels of maturity in the eight principles, the question “How good is good enough?” must be raised and answered ; a rating of less than “transforma-d tional” may be acceptable, depending on the organization’s tolerance for risk and an analysis of the costs and benefi ts of moving up each level.
The maturity levels defi ne the characteristics of evolving and maturing RM programs. The assessment should refl ect the current RM environment and practices. The principles and maturity level defi nitions, along with improvement recommendations (roadmap), outline the tasks required to proactively approach addressing systematic RM practices and reach the next level of maturity for each principle. While the Generally Accepted
Table 3.1 Generally Accepted Recordkeeping Principles Levels
Level 1
Substandard
Characterized by an environment where recordkeeping concerns are either not addressed at all or are addressed in an ad hoc manner.
Level 2
In Development
Characterized by an environment where there is a developing recognition that recordkeeping has an impact on the organization, and the organization may benefi t from a more defi ned information governance program.
Level 3
Essential
Characterized by an environment where defi ned policies and procedures exist that address the minimum or essential legal and regulatory requirements, but more specifi c actions need to be taken to improve recordkeeping.
Level 4
Proactive
Characterized by an environment where information governance issues and considerations are integrated into business decisions on a routine basis, and the organization consistently meets its legal and regulatory obligations.
Level 5
Transformational
Characterized by an environment that has integrated information governance into its corporate infrastructure and business processes to such an extent that compliance with program requirements is routine.
Source: Used with permission from ARMA.
The Generally Accepted Recordkeeping Principles maturity model measures recordkeeping maturity in fi ve levels.
30 INFORMATION GOVERNANCE
Recordkeeping Principles are broad in focus, they illustrate the requirements of good RM practices. The Principles Assessment can also be a powerful communication tool to promote cross-functional dialogue and collaboration among business units and staff.
Accountability The principle of accountability covers the assigned responsibility for RM at a seniory level to ensure effective governance with the appropriate level of authority. A senior- level executive must be high enough in the organizational structure to have suffi cient authority to operate the RM program effectively. The primary role of the senior ex- ecutive is to develop and implement RM policies, procedures, and guidance and to provide advice on all recordkeeping issues. The direct responsibility for managing or operating facilities or services may be delegated.
The senior executive must possess an understanding of the business and legislative environment within which the organization operates, business functions and activities, and the required relationships with key external stakeholders to understand how RM contributes to achieving the corporate mission, aims, and objectives.
It is important for top-level executives to take ownership of the RM issues of the organization and to identify corrective actions required for mitigation or ensure resolution of problems and recordkeeping challenges. An executive sponsor should identify opportunities to raise awareness of the relevance and importance of RM and effectively communicate the benefi ts of good RM to staff and management.
The regulatory and legal framework for RM must be clearly identifi ed and understood. The senior executive must have a sound knowledge of the organization’s information and technological architecture and actively participate in strategic deci- sions for IT systems acquisition and implementation.
The senior executive is responsible for ensuring that the processes, procedures, governance structures, and related documentation are developed. The policies should identify the roles and responsibilities at all levels of the organization.
An audit process must be developed to cover all aspects of RM within the organization, including substantiating that suffi cient levels of accountability have been assigned and accountability defi ciencies are identifi ed and remedied. Audit processes should include compliance with the organization policies and procedures for all records, regardless of format or media. Accountability audit requirements for electronic records include employing appropriate technology to audit the information architecture and systems. Accountability structures must be updated and maintained as changes occur in the technology infrastructure.
The audit process must reinforce compliance and hold individuals accountable. The results should be constructive, encourage continuous improvement, but not be used as a means of punishment. The audit should contribute to records program improve- ments in risk mitigation, control, and governance issues and have the capacity to support sustainability.
An audit process must be developed to cover all aspects of RM in the organization.
INFORMATION GOVERNANCE PRINCIPLES 31
Transparency Policies are broad guidelines for the operation of the organization and provide a basic guide to action that prescribes the boundaries within which business activities are to take place. They state the course of action to be followed by the organization, business unit, department, and employees.
Transparency of recordkeeping practices includes documenting processes and y promoting an understanding of the roles and responsibilities of all stakeholders. To be effective, policies must be formalized and integrated into business processes. Business rules and recordkeeping requirements need to be communicated and installed at all levels of the organization.
Senior management must recognize that transparency is fundamental to IG and compliance. Documentation must be consistent, current, and complete. A review and approval process must be established to ensure that the introduction of new programs or changes can be implemented and integrated into business processes.
Employees must have ready access to RM policies and procedures. They must re- ceive guidance and training to ensure they understand their roles and requirements for RM. Recordkeeping systems and business processes must be designed and developed to clearly defi ne the records lifecycle.
In addition to policies and procedures, guidelines and operational instructions, diagrams and fl owcharts, system documentation, and user manuals must include clear guidance on how records are to be created, retained, stored, and dispositioned. The documentation must be readily available and incorporated in communications and training provided to staff.
Integrity Record generating systems and repositories must be assessed to determine record- keeping capabilities. A formalized process must be in place for acquiring or developing new systems, including requirements for capturing the metadata required for lifecycle management of records in the systems. In addition, the record must contain all the necessary elements of an offi cial record, including structure, content, and context. Records integrity, y reliability, and trustworthiness are confi rmed by ensuring that a record was created by a competent authority according to established processes.
Maintaining the integrity of records means that they are complete and protected from being altered. The authenticity of a record is ascertained from internal and exter- nal evidence, including the characteristics, structure, content, and context of the records, to verify they are genuine and not corrupted or altered. In order to trust that a record is authentic, organizations must ensure that recordkeeping systems that create, capture , and manage electronic records are capable of protecting re- cords from accidental or unauthorized alteration or deletion while the record has value.
To be effective, policies must be formalized and integrated into business processes.
32 INFORMATION GOVERNANCE
Protection Organizations must ensure the protection of records and ensure they are unaltered through loss, tampering, or corruption. This includes technological change or the failure of digital storage media and protecting records against damage or deterioration.
This principle applies equally to physical and electronic records, each of which has unique requirements and challenges.
Access and security controls need to be established, implemented, monitored, and reviewed to ensure business continuity and minimize business risk. Restrictions on access and disclosure include the methods for protecting personal privacy and propri- etary information. Access and security requirements must be integrated into the busi- ness systems and processes for the creation, use, and storage of records.
LTDP is a series of managed activities required to ensure continued access to digi- tal materials for as long as necessary. Electronic records requiring long-term retention may require conversion to a medium and format suitable to ensure long-term access and readability.
Compliance RM programs include the development and training of the fundamental components, including compliance monitoring to ensure sustainability of the program.g
Monitoring for compliance involves reviewing and inspecting the various facets of records management, including ensuring records are being properly created and captured, im- plementation of user permissions and security procedures, workfl ow processes through sampling to ensure adherence to policies and procedures, ensuring records are being retained following disposal authorization, and documentation of records destroyed or transferred to determine whether destruction/transfer was authorized in accordance with disposal instructions.
Compliance monitoring can be carried out by an internal audit, external organiza- tion, or RM and must be done on a regular basis.
Availability Organizations should evaluate how effectively and effi ciently records and information are stored and retrieved using present equipment, networks, and software . The evaluation should identify current and future requirements and recommend new systems as appropriate. Certain factors should be considered before upgrading or imple- menting new systems. These factors are practicality, cost, and effectiveness of new confi gurations.
A major challenge for organizations is ensuring timely and reliable access to and use of information and that records are accessible and usable for the entire length of the retention period. Rapid changes and enhancements to both hardware and software compound this challenge.
Retention Retention is the function of preserving and maintaining records for continuing use. The reten- tion schedule identifi es the actions needed to fulfi ll the requirements for the retention and disposal of records and provides the authority for employees and systems to retain, destroy, or transfer records. The records retention schedule documents the record- keeping requirements and procedures, identifying how records are to be organized
INFORMATION GOVERNANCE PRINCIPLES 33
and maintained, what needs to happen to records and when, who is responsible for doing what, and whom to contact with questions or guidance.
Organizations must identify the scope of their recordkeeping requirements for documenting business activities based on regulated activities and jurisdictions that im- pose control over records. This includes business activities regulated by the govern- ment for every location or jurisdiction in which the company does business. Other considerations for determining retention requirements include operational, legal, fi s- cal, and historical ones.
Records appraisal is the process of assessing the value and risk of records to determine their retention and disposition requirements. Legal research is outlined in appraisal reports. This appraisal process may be accomplished as a part of the process of developing the records retention schedules as well as conducting a regular review to ensure that citations and requirements are current.
The records retention period is the length of time that records should be retained and d the actions taken for them to be destroyed or preserved. The retention periods for different records should be based on legislative or regulatory requirements as well as on admin- istrative and operational requirements.
It is important to document the legal research conducted and used to determine whether the law or regulation has been reasonably applied to the recordkeeping prac- tices and provide evidence to regulatory offi cials or courts that due diligence has been conducted in good faith to comply with all applicable requirements.
Disposition Disposition is the last stage in the life cycle of records. When the retention requirements have been met and the records no longer serve a useful business purpose, records may be destroyed. Records requiring long-term or permanent retention should be trans- ferred to an archive for preservation. The timing of the transfer of physical or elec- tronic records should be determined through the records retention schedule process. Additional methods, including migration or conversion, are often required to preserve electronic records.
Records must be destroyed in a controlled and secure manner and in accordance with authorized disposal instructions. The destruction of records must be clearly doc- umented to provide evidence of destruction according to an agreed-on program.
Destruction of records must be undertaken by methods appropriate to the con- fi dentiality of the records and in accordance with disposal instructions in the records retention schedule. An audit trail documenting the destruction of records should be maintained, and certifi cates of destruction should be obtained for destruction under- taken by third parties. In the event disposal schedules are not in place, written autho- rization should be obtained prior to destruction. Procedures should specify who must supervise the destruction of records. Approved methods of destruction must be speci- fi ed for each media type to ensure that information cannot be reconstructed.
Disposition is the last stage in the life cycle of records. Disposition is not syn- onymous with destruction, although destruction may be one disposal option.
34 INFORMATION GOVERNANCE
Disposition is not synonymous with destruction, although destruction may be one disposal option. Destruction of records must be carried out under controlled, confi dential conditions by shredding or permanent disposition. This includes the destruction of confi dential microfi lm, microfi che, computer cassettes, and computer tapes as well as paper.
Methods of Disposition
■ Discard. The standard destruction method for nonconfi dential records. If pos- sible, all records should be shredded prior to recycling. Note that transitory records can also be shredded.
■ Shred. Confi dential and sensitive records should be processed under strict security. This may be accomplished internally or by secure on-site shredding by a third party vendor who provides certifi cates of secure destruction. The shredded material is then recycled.
■ Archive. This designation is for records requiring long-term or permanent preservation. Records of enduring legal, fi scal, administrative, or historical value are retained.
■ Imaging. Physical records converted to digital images, after which the original paper documents are destroyed.
■ Purge. This special designation is for data, documents, or records sets that need to be purged by removing material based on specifi ed criteria. This often ap- plies to structure records in databases and applications.
Assessment and Improvement Roadmap
The Generally Accepted Recordkeeping Principles® maturity model can be lever- aged to develop a current state assessment of an organization’s recordkeeping prac- tices and resources, identify gaps and assess risks, and develop priorities for desired improvements.
The Principles were developed by ARMA International to identify characteristics of an effective recordkeeping program. Each of the eight principles identifi es issues and practices that, when evaluated against the unique needs and circumstances of an organization, can be applied to improvements for a recordkeeping program that meets recordkeeping requirements. The Principles identify requirements and can be used to guide incremental improvement in creation, organization, security, maintenance, and other activities over a period of one to fi ve years. Fundamentally, RM and information governance are business disciplines that must be tightly integrated with operational policies, procedures, and infrastructure.
The Principles can be mapped to the four improvement areas in Table 3.2 . As an accepted industry guidance maturity model, the Principles provide a con-
venient and complete framework for assessing the current state of an organization’s recordkeeping and developing a roadmap to identify improvements that will bring the organization into compliance. An assessment/analysis of the current RM practices, procedures, and capabilities together with current and future state practices provides two ways of looking at the future requirements of a complete RM (see Table 3.3 ).
INFORMATION GOVERNANCE PRINCIPLES 35
Table 3.2 Improvement Areas for Generally Accepted Recordkeeping Principles
Improvement Area A cc
o u
n ta
b ili
ty
Tr an
sp ar
e n
cy
In te
g ri
ty
P ro
te ct
io n
C o
m p
lia n
ce
A va
ila b
ili ty
R e te
n ti
o n
D is
p o
si ti
o n
Roles and responsibilities ◊ ◊ ◊
Policies and procedures ◊ ◊ ◊ ◊ ◊ ◊ ◊ ◊
Communication and training ◊ ◊ ◊ ◊ ◊
Systems and automation ◊ ◊ ◊ ◊ ◊ ◊
Who Should Determine IG Policies?
When forming an IG steering committee or board, it is essential to include represen- tatives from cross-functional groups and at different levels of the organization. The committee must be driven by an executive sponsor and include active members from key business units as well as other departments, including IT, fi nance, risk, compli- ance, RM, and legal. Then corporate training/education and communications must be involved to keep employees trained and current on IG policies. This function may be performed by an outside consulting fi rm if there is no corporate education staff.
Knowledge workers who work with records and sensitive information in any ca- pacity best understand the nature and value of the records they work with as they perform their day-to-day functions. IG policies must be developed and communicated clearly and consistently. Policies are worthless if people do not know or understand them or how to comply with them . And training is a crucial element that will be examined in any compliance hearing or litigation that may arise. “Did senior management not only cre- ate the policies but provide adequate training on them on a consistent basis?” This will be a key question raised. So a training plan is a necessary piece of IG, and education should be heavily emphasized. 6
The need for IG is increasing due to increased and tightened regulations, in- creased litigation, and the increased incidence of theft and misuse of internal docu- ments and records. Organizations that do not have active IG programs should reevaluate IG policies and their internal processes following any major loss of records, the inability to
When forming an IG steering committee or board, it is essential to include representatives from cross-functional groups.
Knowledge workers who work with records in any capacity best understand the nature and value of the records they work with.
36
T ab
le 3
.3
A ss
es sm
en t
R ep
or t
an d
R oa
d M
ap .
P ri
n ci
p le
Le ve
l Fi
n d
in g
s R
e q
u ir
e m
e n
ts t
o M
o ve
t o
t h
e N
e xt
S te
p
A cc
o u n
ta b
ili ty
Le ve
l 1
Su b
st an
d ar
d
N o s
en io
r ex
ec u ti
ve (
o r
p er
so n
o f
co m
p ar
ab le
a u th
o ri
ty )
is r
es p
o n
si b
le f
o r
th e
R M
p ro
g ra
m .
T h
e re
co rd
s m
an ag
er r
o le
is la
rg el
y n
o n
ex is
te n
t o r
is a
n a
d m
in is
tr at
iv e
an d
/ o r
cl er
ic al
r o le
d is
tr ib
u te
d a
m o n
g g
en er
al s
ta ff
.
1 .
A ss
ig n
R M
r es
p o n
si b
ili ti
es t
o s
en io
r ex
ec u ti
ve .
2 .
H ir
e o r
p ro
m o te
r ec
o rd
s m
an ag
er .
Tr an
s p ar
en cy
Le ve
l 1
Su b
st an
d ar
d
It is
d iffi
c u lt
t o o
b ta
in in
fo rm
at io
n a
b o u t
th e
o rg
an iz
at io
n o
r it
s re
co rd
s in
a
ti m
el y
fa sh
io n
. N
o c
le ar
d o cu
m en
ta ti
o n
is r
ea d
ily a
va ila
b le
.
T h
er e
is n
o e
m p
h as
is o
n t
ra n
sp ar
en cy
.
P u b
lic r
e q u es
ts f
o r
in fo
rm at
io n
, d
is co
ve ry
f o r
lit ig
at io
n , re
g u la
to ry
r es
p o n
se s,
o r
o th
er r
eq u es
ts (
e. g
., f
ro m
p o te
n ti
al b
u si
n es
s p
ar tn
er s,
in ve
st o rs
, o r
b u ye
rs )
ca n
n o t
b e
re ad
ily a
cc o m
m o d
at ed
.
T h
e o rg
an iz
at io
n h
as n
o t
es ta
b lis
h ed
c o n
tr o ls
t o e
n su
re t
h e
co n
si st
en cy
o f
in fo
rm at
io n
d is
cl o su
re .
B u si
n es
s p
ro ce
ss es
a re
n o t
w el
l d efi
n ed
.
1 .
D ev
el o p
p o lic
ie s
an d
p ro
ce d
u re
s.
2 .
D ev
el o p
t ra
in in
g f
o r
al l l
ev el
s o f
st af
f.
3 .
Id en
ti fy
r eq
u ir
em en
ts f
o r
re co
rd s
fi n d
ab ili
ty
an d
a cc
es si
b ili
ty .
4 .
D efi
n e
b u si
n es
s p
ro ce
ss es
.
In te
g ri
ty Le
ve l 1
Su b
st an
d ar
d
T h
er e
ar e
n o s
ys te
m at
ic a
u d
it s
o r
d efi
n ed
p ro
ce ss
es f
o r
sh o w
in g
t h
e o ri
g in
an
d a
u th
en ti
ci ty
o f
a re
co rd
.
V ar
io u s
o rg
an iz
at io
n al
f u n
ct io
n s
u se
a d
h o c
m et
h o d
s to
d em
o n
st ra
te
au th
en ti
ci ty
a n
d c
h ai
n o
f cu
st o d
y, a
s ap
p ro
p ri
at e,
b u t
th ei
r tr
u st
w o rt
h in
es s
ca n
n o t
ea si
ly b
e g
u ar
an te
ed .
1 .
D ev
el o p
a u d
it p
ro ce
ss .
2 .
Id en
ti fy
b u si
n es
s ac
ti vi
ti es
f o r
cr ea
ti o n
a n
d
st o ra
g e
o f
re co
rd s.
P ro
te ct
io n
Le ve
l 1
Su b
st an
d ar
d
N o c
o n
si d
er at
io n
is g
iv en
t o r
ec o rd
p ri
va cy
.
R ec
o rd
s ar
e st
o re
d h
ap h
az ar
d ly
, w
it h
p ro
te ct
io n
t ak
en b
y va
ri o u s
g ro
u p
s an
d
d ep
ar tm
en ts
w it
h n
o c
en tr
al iz
ed a
cc es
s co
n tr
o ls
.
A cc
es s
co n
tr o ls
, if
an y,
a re
a ss
ig n
ed b
y th
e au
th o r.
1 .
A ss
es s
se cu
ri t y
a n
d a
cc es
s co
n tr
o ls
.
2 .
D ev
el o p
a cc
es s
an d
s ec
u ri
ty c
o n
tr o l s
ch em
e.
C o m
p lia
n ce
Le ve
l 3
Es se
n ti
al
T h
e o rg
an iz
at io
n h
as id
en ti
fi e d
a ll
re le
va n
t co
m p
lia n
ce la
w s
an d
r eg
u la
ti o n
s.
R ec
o rd
c re
at io
n a
n d
c ap
tu re
a re
s ys
te m
at ic
al ly
c ar
ri ed
o u t
in a
cc o rd
an ce
w it
h R
M p
ri n
ci p
le s.
T h
e o rg
an iz
at io
n h
as a
s tr
o n
g c
o d
e o f
b u si
n es
s co
n d
u ct
, w
h ic
h is
in te
g ra
te d
in
to it
s o ve
ra ll
IG s
tr u ct
u re
a n
d r
ec o rd
-k ee
p in
g p
o lic
ie s.
C o m
p lia
n ce
a n
d t
h e
re co
rd s
th at
d em
o n
st ra
te it
a re
h ig
h ly
v al
u ed
a n
d m
ea su
ra b
le .
1 .
Im p
le m
en t
sy st
em s
to c
ap tu
re a
n d
p ro
te ct
re co
rd s.
2 .
D ev
el o p
m et
ad at
a sc
h em
e.
3 .
D ev
el o p
r em
ed ia
ti o n
p la
n a
n d
im p
le m
en t
co rr
ec ti
ve a
ct io
n s.
37
T h
e h
o ld
p ro
ce ss
is in
te g
ra te
d in
to t
h e
o rg
an iz
at io
n ’s
in fo
rm at
io n
m an
ag em
en t
an d
d is
co ve
ry p
ro ce
ss es
f o r
th e
m o st
c ri
ti ca
l s ys
te m
s.
T h
e o rg
an iz
at io
n h
as d
efi n
ed s
p ec
ifi c
g o al
s re
la te
d t
o c
o m
p lia
n ce
.
A va
ila b
ili ty
Le ve
l 2
In D
ev el
o p
m en
t
R ec
o rd
r et
ri ev
al m
ec h
an is
m s
h av
e b
ee n
im p
le m
en te
d in
c er
ta in
a re
as o
f th
e o rg
an iz
at io
n .
In t
h o se
a re
as w
it h
r et
ri ev
al m
ec h
an is
m s,
it is
p o ss
ib le
t o d
is ti
n g
u is
h b
et w
ee n
o ffi c
ia l r
ec o rd
s, d
u p
lic at
es , an
d n
o n
re co
rd m
at er
ia ls
.
T h
er e
ar e
so m
e p
o lic
ie s
o n
w h
er e
an d
h o w
t o s
to re
o ffi c
ia l r
ec o rd
s, b
u t
a st
an d
ar d
is n
o t
im p
o se
d a
cr o ss
t h
e o rg
an iz
at io
n .
Le g
al d
is co
ve ry
is c
o m
p lic
at ed
a n
d c
o st
ly d
u e
to t
h e
in co
n si
st en
t tr
ea tm
en t
o f
in fo
rm at
io n
.
1 .
D ev
el o p
e n
te rp
ri se
c la
ss ifi
ca ti
o n
s ch
em e.
2 .
Id en
ti fy
u se
r se
ar ch
a n
d r
et ri
ev al
re
q u ir
em en
ts .
3 .
D ev
el o p
s ta
n d
ar d
s fo
r m
an ag
in g
t h
e re
co rd
s lif
ec yc
le .
R et
en ti
o n
Le ve
l 2
In D
ev el
o p
m en
t
A r
et en
ti o n
s ch
ed u le
is a
va ila
b le
b u t
d o es
n o t
en co
m p
as s
al l r
ec o rd
s, d
id
n o t
g o t
h ro
u g
h o
ffi c
ia l r
ev ie
w , an
d is
n o t
w el
l k n
o w
n t
h ro
u g
h o u t
th e
o rg
an iz
at io
n .
T h
e re
te n
ti o n
s ch
ed u le
is n
o t
re g
u la
rl y
u p
d at
ed o
r m
ai n
ta in
ed .
Ed u ca
ti o n
a n
d t
ra in
in g
a b
o u t
th e
re te
n ti
o n
p o lic
ie s
ar e
n o t
av ai
la b
le .
1 .
D ev
el o p
e n
te rp
ri se
-w id
e fu
n ct
io n
al r
et en
ti o n
sc
h ed
u le
.
2 .
M ap
r et
en ti
o n
s ch
ed u le
t o c
la ss
ifi ca
ti o n
sc h
em e.
3 .
Im p
le m
en t
an a
n n
u al
r ev
ie w
p ro
ce ss
f o r
re co
rd s
er ie
s an
d le
g al
r es
ea rc
h .
4 .
D ev
el o p
t ra
in in
g f
o r
cl as
si fi c
at io
n s
ch em
e an
d
re te
n ti
o n
s ch
ed u le
.
D is
p o si
ti o n
Le ve
l 2
In D
ev el
o p
m en
t
P re
lim in
ar y
g u id
el in
es f
o r
d is
p o si
ti o n
a re
e st
ab lis
h ed
.
T h
er e
is a
r ea
liz at
io n
o f
th e
im p
o rt
an ce
o f
su sp
en d
in g
d is
p o si
ti o n
in a
co
n si
st en
t m
an n
er , re
p ea
ta b
le b
y ce
rt ai
n le
g al
g ro
u p
in g
s.
T h
er e
m ay
o r
m ay
n o t
b e
en fo
rc em
en t
an d
a u d
it in
g o
f d
is p
o si
ti o n
.
1 .
D ev
el o p
p ro
ce d
u re
s fo
r re
co rd
s d
is p
o si
ti o n
.
2 .
Im p
le m
en t
d is
p o si
ti o n
p ro
ce ss
es .
3 .
D ev
el o p
a u d
it t
ra ils
f o r
re co
rd s
tr an
sf er
s an
d
d es
tr u ct
io n
.
O ve
ra ll
Le ve
l 1
Su b
st an
d ar
d
38 INFORMATION GOVERNANCE
CHAPTER SUMMARY: KEY POINTS
■ Principles of successful IG programs are emerging. They include executive sponsorship, information classifi cation, integrity, security, accessibility, control, monitoring, auditing, policy development, and continuous improvement.
■ Accountability is a key aspect of IG.
■ The Generally Accepted Recordkeeping Principles® (“The Principles”) consist of eight principles that provide an IG framework that can support continuous improvement.
■ An audit process must be developed to cover all aspects of RM in the organization.
■ To be effective, policies must be formalized and integrated into business processes.
■ Disposition is the last stage in the life cycle of records. Disposition is not synonymous with destruction, although destruction may be one disposal option.
■ Knowledge workers who work with records in any capacity best understand the nature and value of the records they work with.
■ When forming an information governance steering committee or board, it is essential to include representatives from cross-functional groups.
■ Organizations without active IG programs should reevaluate IG policies and their internal processes following any major loss of records, the inability to produce accurate records in a timely manner, or any document security breach or theft.
produce accurate records in a timely manner, or any document security breach or theft. If review boards include a broad section of critical players on the IG committee and leverage executive sponsorship, theywill better prepare the organization for legal and regulatory rigors.
Notes
1. Laura DuBois and Vivian Tero, “Practical Information Governance: Balancing Cost, Risk, and Produc- tivity,” IDC White Paper, August 2010, www.emc.com/collateral/analyst-reports/idc-practical-infor- mation-governance-ar.pdf
2. Ibid. 3. Debra Logan, “What Is Information Governance? And Why Is It So Hard?” January 11, 2010, http://
blogs.gartner.com/debra_logan/2010/01/11/what-is-information-governance-and-why-is-it-so-hard/ .
INFORMATION GOVERNANCE PRINCIPLES 39
4. ARMA International, “Generally Accepted Recordkeeping Principles,” www.arma.org/r2/generally- accepted-br-recordkeeping-principles/copyright (accessed November 14, 2013).
5. ARMA International,“Information Governance Maturity Model,” www.arma.org/r2/generally- accepted-br-recordkeeping-principles (accessed November 14, 2013).
6. “Governance Overview (SharePoint Server 2010),” http://technet.microsoft.com/en-us/library/ cc263356.aspx (accessed April 19, 2011).
PA RT T W O Information Governance Risk Assessment and Strategic Planning
43
C H A P T E R 4 Information Risk Planning and Management
I nformation risk planning involves a number of progressive steps: identifying poten- tial risks to information, weighing those risks, creating strategic plans to mitigate the risks, and developing those plans into specifi c policies. Then it moves to develop-
ing metrics to measure compliance levels and identifying those who are accountable for executing the new risk mitigating processes. These processes must be audited and tested periodically not only to ensure compliance, but also to fi ne tune and improve the processes.
Depending on the jurisdiction, information is required by specifi c laws and regu- lations to be retained for specifi ed periods, and to be produced in specifi ed situations. To determine which laws and regulations apply to your organization’s information, re- search into the legal and regulatory requirements for information in the jurisdictions in which your organization operates must be conducted.
Step 1: Survey and Determine Legal and Regulatory Applicability and Requirements
There are federal, provincial, state, and even municipal laws and regulations that may apply to the retention of information (data, documents, and records). Organizations operating in multiple jurisdictions must maintain compliance with laws and regula- tions that may cross national, state, or provincial boundaries. Legally required pri- vacy requirements and retention periods must be researched for each jurisdiction (e.g. county, state, country) in which the business operates, so that it complies with all ap- plicable laws.
IG, compliance, and records managers must conduct their own legislative research to apprise themselves of mandatory information retention requirements, as well as privacy considerations and requirements, especially in regard to personally identifi - able information (PII). This information must be analyzed and structured and pre- sented to legal staff for discussion. Then further legal and regulatory research must be conducted, and fi rm legal opinions must be rendered by legal counsel regarding information retention, privacy, and security requirements in accordance with laws and regulations. This is an absolute requirement. In order to arrive at a consensus on records that have legal value to the organization and to construct an appropriate retention
44 INFORMATION GOVERNANCE
schedule, your legal staff or outside legal counsel should explain the legal hold process, provide opinions and interpretations of law that apply to your organization, and ex- plain the value of formal records.
Legal requirements trump all others. The retention period for a particular type of document or PII data or records series must meet minimum retention, privacy, and security requirements as mandated by law. Business needs and other considerations are secondary. So, legal research is required before determining and implementing reten- tion periods, privacy policies, and security measures.
In order to locate the regulations and citations relating to retention of records, there are two basic approaches. The fi rst approach is to use a records retention citation service, which publishes in electronic form all of the retention-related citations. These services usually are purchased on a subscription basis, as the cita- tions are updated on an annual or more frequent basis as legislation and regula- tions change.
Figure 4.1 is an excerpt from a Canadian records retention database product called FILELAW®. 1 In this case, the act, citation, and retention periods are clearly identifi ed.
Another approach is to search the laws and regulations directly using online or print resources. Records retention requirements for corporations operating in the United States may be found in the Code of Federal Regulations (CFR).
In identifying information requirements and risks, legal requirements trump all others.
Figure 4.1 Excerpt from Canadian Records Retention Database Source: Ontario, Electricity Act, FILELAW database, Thomson Publishers, May 2012.
INFORMATION RISK PLANNING AND MANAGEMENT 45
The Code of Federal Regulations (CFR) annual edition is the codifi cation of the general and permanent rules published in the Federal Register by the de- partments and agencies of the federal government. It is divided into 50 titles that represent broad areas subject to federal regulation. The 50 subject matter titles contain one or more individual volumes, which are updated once each calendar year, on a staggered basis. The annual update cycle is as follows: titles 1 to 16 are revised as of January 1; titles 17 to 27 are revised as of April 1; titles 28 to 41 are revised as of July 1; and titles 42 to 50 are revised as of October 1. Each title is divided into chapters, which usually bear the name of the issu- ing agency. Each chapter is further subdivided into parts that cover specifi c regulatory areas. Large parts may be subdivided into subparts. All parts are organized in sections, and most citations to the CFR refer to material at the section level. 2
There is an up-to-date version that is not yet a part of the offi cial CFR but is updated daily, the Electronic Code of Federal Regulations (e-CFR) . “It is not an offi cial legal edition of the CFR. The e-CFR is an editorial compilation of CFR ma- terial and Federal Register amendments produced by the National Archives and Re- cords Administration’s Offi ce of the Federal Register . . . and the Government Printing Offi ce.”3 According to the gpoaccess.gov Web site:
The Administrative Committee of the Federal Register (ACFR) has autho- rized the National Archives and Records Administration’s (NARA) Offi ce of the Federal Register (OFR) and the Government Printing Offi ce (GPO) to develop and maintain the e-CFR as an informational resource pending ACFR action to grant the e-CFR offi cial legal status. The OFR/GPO partnership is committed to presenting accurate and reliable regulatory information in the e-CFR editorial compilation with the objective of establishing it as an ACFR sanctioned publication in the future. While every effort has been made to en- sure that the e-CFR on GPO Access is accurate, those relying on it for legal research should verify their results against the offi cial editions of the CFR, Federal Register and List of CFR Sections Affected (LSA), all available online at www.gpoaccess.gov . Until the ACFR grants it offi cial status, the e-CFR editorial compilation does not provide legal notice to the public or judicial notice to the courts.
The OFR updates the material in the e-CFR on a daily basis. Generally, the e-CFR is current within two business days. The current update status is displayed at the top of all e-CFR web pages.
For governmental agencies, a key consideration is complying with requests for information as a result of freedom of information laws like the U.S. Freedom of
In the United States the Code of Federal Regulations lists retention require- ments for businesses, divided into 50 subject matter areas.
46 INFORMATION GOVERNANCE
Information Act, Freedom of Information Act 2000 (in the United Kingdom), and similar legislation in other countries. So the process of governing information is criti- cal to meeting these requests by the public for governmental records.
Step 2: Specify IG Requirements to Achieve Compliance
Once the legal research has been conducted and a process for keeping updated on laws and regulations has been established, specifi c external compliance requirements can be listed and those data, document, and record sets that apply to those external compliance requirements can be mapped back to applicable holdings of data sets, document col- lections, and records series. The crucial task is keeping your legal and records manage- ment staff apprised of changes and updating the policies and processes appropriately.
Internal IG retention policies may be different from the legally mandated minimums. For instance, an organization that is not operating in a highly regulated industry that wants to balance defensible disposition with a need to retain corporate memory and develop knowledge management (KM) content or “knowledge bases” may have the optiont to dispose of e-mail that is not declared a record or cited for legal hold after 90 days, but may choose, based on corporate culture and other business factors, to retain e-mail messages for a year. Similarly, the organization may make legally defensible disposition decisions that reduce the total amount of information it must manage by using a “last ac- cessed” rationale, whereby information that has not been accessed for over one year (or whatever the specifi ed period is) may be destroyed and discarded, as a matter of policy.
Step 3: Create a Risk Profi le
Creating a risk profi le is a basic building block in enterprise risk management (yet t another ERM acronym), which assists executives in understanding the risks associatedr with stated business objectives and allocating resources, within a structured evaluation approach or framework. There are multiple ways to create a risk profi le, and how often it is done, the external sources consulted, and stakeholders who have input will vary from organization to organization. 4 A key tenet to bear in mind is that simpler is better and that sophisticated tools and techniques should not make the process overly complex. According to the ISO, risk is defi ned as “the effect of uncertainty on objectives,” and a risk profi le is “a description of a set of risks.”5 Creating a risk profi le involves identifying, docu- menting, assessing, and prioritizing risks that an organization may face in pursuing its business objectives. It can be a simple table chart. Those associated risks can then be evaluated and delineated within a risk or IG framework.
The corporate risk profi le should be an informative tool for executive manage- ment, the CEO, and the board of directors, so it should refl ect that tone. In other
The risk profi le is a high-level, executive decision input tool.
INFORMATION RISK PLANNING AND MANAGEMENT 47
words, it should be clear, succinct, and simplifi ed. A risk profi le may also serve to in- form the head of a division or subsidiary, in which case it may contain more detail. The process can also be applied to public and nonprofi t entities.
The time horizon for a risk profi le varies, but looking out three to fi ve years is a good rule of thumb . 6 The risk profi le typically will be created annually, although semiannually would serve the organization better and account for changes in the business and legal environment. But if an organization is competing in a market sector with rapid busi- ness cycles or volatility, the risk profi le should be generated more frequently, perhaps quarterly.
There are different types of risk profi le methodologies; common methodologies are a top-10 list, a risk map , and a heat map . The top-10 list is a simple identifi cation and ranking of the 10 greatest risks in relation to business objectives. The risk map is a visual tool that is easy to grasp, with a grid depicting a likelihood axis and an impact axis, usually rated on a scale of 1 to 5. In a risk assessment meeting, stakeholders can weigh in on risks using voting technology to generate a consensus. A heat map is a color-coded matrix generated by stakeholders voting on risk level by color (e.g., red being highest).
Information gathering is a fundamental activity in building the risk profi le. Surveys are good for gathering basic information, but for more detail, a good method to employ is direct, person-to-person interviews, beginning with executives and risk professionals.7 Select a representative cross section of functional groups to gain a broad view. Depend- ing on the size of the organization, you may need to conduct 20 to 40 interviews, with one person asking the questions and probing while another team member takes notes and asks occasionally for clarifi cation or elaboration. Conduct the interviews in a com- pressed timeframe—knock them out within one to three weeks and do not drag the process out, as business conditions and personnel can change over the course of months.
Here are three helpful considerations to conducting successful interviews.
1. Prepare some questions for interviewees in advance and provide them to in- terviewees so they may prepare and do some of their own research.
2. Schedule the interview close to their offi ces, and at their convenience. 3. Keep the time as short as possible but long enough to get the answers you will
need: approximately 20 to 45 minutes. Be sure to leave some open time be- tween interviews to collect your thoughts and prepare for the next interview. And follow up with interviewees after analyzing and distilling your notes to confi rm you have gained the correct insights.
The information you will be harvesting will vary depending on the interviewee’s level and function. You will need to look for any hard data or reports that show performance and trends related to information risk. There may be benchmarking data
A common risk profi le method is to create a prioritized or ranked top-10 list of greatest risks to information.
48 INFORMATION GOVERNANCE
available as well. Delve into information access and security policies, policy devel- opment, policy adherence, and the like. Ask questions about retention of e-mail and legal hold processes. Ask about records retention and disposition policies. Ask about long-term preservation of digital records. Ask about data deletion policies. Ask for documentation regarding IG-related training and communications. Dig into policies for access to confi dential data and securing vital records. Try to get a real sense of the way things are run, what is standard operating procedure, and also how workers might get around overly restrictive policies, or operate without clear policies. Learn enough so that you can grasp the management style and corporate culture, and then distill that information into your fi ndings.
Key events and developments must also be included in the risk profi le. For in- stance, a major data breach, the loss or potential loss of a major lawsuit, pending regu- latory changes that could impact your IG policies, or a change in business ownership or structure must all be accounted for and factored into the information risk profi le. Even changes in governmental leadership should be considered, if they might impact IG policies. These types of developments should be tracked on a regular basis and should continue to feed into the risk equation. 8 Key events should be monitored and incorporated in developing and subsequently updating the risk profi le.
At this point, it should be possible to generate a list of specifi c potential risks. It may be useful to group or categorize the potential risks into clusters, such as natural disaster, regulatory, safety, competitive, and so forth . Armed with this list of risks, you should solicit input from stakeholders as to the likelihood and timing of the threats or risks. As the organization matures in its risk identifi cation and handling capabilities, a good practice is to look at the risks and their ratings from previous years to attempt to gain insights into change and trends—both external and internal—that affected the risks.
Step 4: Perform Risk Analysis and Assessment
Once you have created a risk profi le and identifi ed key risks, you must conduct an as- sessment of the likelihood that these risks hold and their resultant impact.
There are fi ve basic steps in conducting a risk assessment: 9
1. Identify the risks. This should be an output of creating a risk profi le, but if con- ducting an information risk assessment, fi rst identify the major information- related risks.
2. Determine potential impact. If a calculation of a range of economic impact is possible (e.g., lose $5 to $10 million in legal damages), then include it. If not, be as specifi c as possible as to how a negative event related to an identifi ed risk can impact business objectives.
Once a list of risks is developed, grouping them into basic categories helps stakeholders grasp them more easily and consider their likelihood and impact.
INFORMATION RISK PLANNING AND MANAGEMENT 49
3. Evaluate risk levels and probabilities and recommend action. This may be in the form of recommending new procedures or processes, new investments in in- formation technology (IT), or other actions to mitigate identifi ed risks.
4. Create a report with recommendations and implement. You may want to include a risk assessment table (see Table 4.1 ) as well as written recommendations, then implement.
5. Review periodically. Review annually or semiannually, as appropriate for your organization.
A helpful exercise and visual tool is to draw up a table of top risks, their potential impacts, actions that have been taken to mitigate the risks, and suggested new risk countermeasures, as in Table 4.1 .
Step 5: Develop an Information Risk Mitigation Plan
After setting out the risks, their potential impacts, and suggested countermeasures for mitigation, you must create the information risk mitigation plan , which means developing options and tasks to reduce the specifi ed risks and improve the odds of achieving business objectives. 10 Basically, you are putting in writing the information you have collected and analyzed in creating the risk profi le and risk assessment, and as- signing specifi cs. The information risk mitigation plan should include a timetable and milestones for implementation of the recommended risk mitigation measures, includ- ing IT acquisition and implementation and assigning roles and responsibilities, such as executive sponsor, project manager (PM), and project team.
Table 4.1 Risk Assessment
What Are the Risks?
How Might They Impact Business Objectives?
Actions and Processes Currently in Place
Additional Resources Needed to Manage This Risk
Action by Whom?
Action by When? Done
Breach of confi dential documents
Compromise confi dential information
Compromise competitive position
Compromise business negotiations
Utilizing ITIL and CobiT IT frameworks
Published security policies
Semiannual security audits
Implement newer technologies including information rights management
Implement quarterly audits
IT staff, security offi cer
01/10/2016 01/10/2016
The risk mitigation plan develops risk reduction options and tasks to reduce specifi ed risks and improve the odds for achieving business objectives.
50 INFORMATION GOVERNANCE
Step 6: Develop Metrics and Measure Results
How do you know how well you are doing? Have you made progress in reducing your organization’s exposure to information risk? To measure conformance and per- formance of your IG program, you must have an objective way to measure how you are doing, which means numbers and metrics. Assigning some quantitative measures that are meaningful and do, in fact, measure progress may take some serious effort and consultation with stakeholders. Determining relevant ways of measuring progress will allow executives to see progress, as, realistically, reducing risk is not something anyone can see or feel—the painful realizations are made only when the risk comes home to roost. Also, valid metrics help to justify investment in the IG program.
Although the proper metrics will vary from organization to organization, some specifi c metrics include:
■ Reduce the data lost on stolen or misplaced laptops by 50 percent over the previous fi scal year.
■ Reduce the number of hacker intrusion events by 75 percent over the previous fi scal year.
■ Reduce e-discovery costs by 25 percent over the previous fi scal year. ■ Reduce the number of adverse fi ndings in the risk and compliance audit by 50
percent over the previous fi scal year. ■ Provide information risk training to 100 percent of the knowledge-level work-
force this fi scal year. ■ Roll out the implementation of information rights management software to
protect confi dential e-documents to 50 users this fi scal year. ■ Provide confi dential messaging services for the organization’s 20 top executives
this fi scal year.
Your organization’s metrics should be tailored to address the primary goals of your IG program and should tie directly to stated business objectives.
Step 7: Execute Your Risk Mitigation Plan
Now that you have the risk mitigation plan, it must be executed. To do so, you must set up regular project/program team meetings, develop key reports on your information risk mitigation metrics, and manage the process. This is done using proven project and pro- gram management tools and techniques, which you may want to supplement with collab- oration software tools, knowledge management software, or even internal social media.
But most important, execution of the risk mitigation plan involves communicating clearly and regularly with the IG team on the progress and status of the IG effort to reduce information risk.
Metrics are required to measure progress in the risk mitigation plan.
INFORMATION RISK PLANNING AND MANAGEMENT 51
Step 8: Audit the Information Risk Mitigation Program
The metrics you have developed to measure risk mitigation effectiveness must also be used for audit purposes. Put a process in place to separately and independently audit compliance to risk mitigation measures, to see that they are being implemented. The result of the audit should be a useful input in improving and fi ne-tuning the program. It should not be viewed as an opportunity to cite shortfalls and implement punitive actions. It should be a periodic and regular feedback loop into the IG program.
Notes
1. Ontario, Electricity Act, FILELAW database, Thomson Publishers, May 2012. 2. U.S. Government Printing Offi ce (GPO), “Code of Federal Regulations,” www.gpo.gov/help/index
.html#about_code_of_federal_regulations.htm (accessed April 22, 2012). 3. National Archives and Records Administration, “Electronic Code of Federal Regulations,” http://ecfr
.gpoaccess.gov/cgi/t/text/text-idx?c=ecfr&tpl=%2Findex.tpl (accessed October 2, 2012). 4. John Fraser and Betty Simkins, eds., Enterprise Risk Management: Today’s Leading Research and Best
Practices for Tomorrow’s Executives (Hoboken, NJ: John Wiley & Sons, 2010), p. 171. s 5. “ISO 31000 2009 Plain English, Risk Management Dictionary,” www.praxiom.com/iso-31000-terms
.htm (accessed March 25, 2013). 6. Fraser and Simkins, p. 172. 7. Ibid. 8. Ibid., p. 179. 9. Health and Safety Executive, “Five Steps to Risk Assessment,” www.hse.gov.uk/risk/fi vesteps.htm
(accessed March 25, 2013). 10. Project Management Institute, A Guide to the Project Management Body of Knowledge ( PMBOK Guide ),
4th ed. (Project Management Institute, 2008), ANSI/PMI 99-001-2008, pp. 273–312.
CHAPTER SUMMARY: KEY POINTS
■ In identifying information requirements and risks, legal requirements trump all others.
■ In the United States, the Code of Federal Regulations lists information reten- tion requirements for businesses, divided into 50 subject matter areas.
■ The risk profi le is a high-level, executive decision input tool.
■ A common risk profi le method is to create a prioritized or ranked top-10 list of greatest risks to information.
■ Once a list of risks is developed, grouping them into basic categories helps stake- holders to grasp them more easily and consider their likelihood and impact.
■ The risk mitigation plan develops risk reduction options and tasks to reduce specifi ed risks and improve the odds for achieving business objectives.
■ Metrics are required to measure progress in the risk mitigation plan.
■ The risk mitigation plan must be reviewed and audited regularly and proper adjustments made.
53
C H A P T E R 5 Strategic Planning and Best Practices for Information Governance
Securing a sponsor at the executive management level is always crucial to projectsand programs, and this is especially true of any strategic planning effort. An gexecutive must be on board and supporting the effort in order to garner the re- sources needed to develop and execute the strategic plan, and that executive must be held accountable for the development and execution of the plan. These axioms apply to the development of an information governance (IG) strategic plan.
Also, resources are needed—time, human capital, and budget money. The fi rst is a critical element: It is not possible to require managers to take time out of their other duties to participate in a project if there is no executive edict and consistent follow up, support, and communication. Executive sponsorship is a best practice and supports the key principle of accountability of the Generally Accepted Recordkeeping Principles ® (The Principles)1 (see Chapter 3 for more detail). And, of course, without an allocated budget, no program can proceed.
The higher your executive sponsor is in the organization, the better. 2 The imple- mentation of an IG program may be driven by the chief compliance offi cer, chief information offi cer (CIO), or, ideally, the chief executive offi cer (CEO). With CEO sponsorship come many of the key elements needed to complete a successful project, including allocated management time, budget money, and management focus.
It is important to bear in mind that this IG effort is truly a change management effort, in that it aims to change the structure, guidelines, and rules within which em- ployees operate. The change must occur at the very core of the organization’s culture. It must be embedded permanently, and for it to be, the message must be constantly and consistently reinforced. Achieving this kind of change requires commitment from the very highest levels of the organization.
Executive sponsorship is critical to project success. There is no substitute. Without it, a project is at risk of failure.
54 INFORMATION GOVERNANCE
If the CEO is not the sponsor, then another high-level executive must lead the ef- fort and be accountable for meeting milestones as the program progresses. Programs with no executive sponsor can lose momentum and focus, especially as competing projects and programs are evaluated and implemented. Program failure is a great risk without an executive sponsor. Such a program likely will fade or fi zzle out or be relegated to the back burner. Without strong high-level leadership, when things go awry, fi nger pointing and political games may take over, impeding progress and cooperation.
The executive sponsor must be actively involved, tracking program objectives and milestones on a regular, scheduled basis and ensuring they are aligned with business objectives. He or she must be aware of any obstacles or disputes that arise, take an ac- tive role in resolving them, and push the program forward.
Crucial Executive Sponsor Role
The role of an executive sponsor is high level, requiring periodic and regular atten- tion to the status of the program, particularly with budget issues, staff resources, and milestone progress. The role of a program or project manager (PM) is more detailed and day to day, tracking specifi c tasks that must be executed to make progress toward milestones. Both roles are essential. The savvy PM brings in the executive sponsor to push things along when more authority is needed but reserves such project capital for those issues that absolutely cannot be resolved without executive intervention. It is best for the PM to keep the executive sponsor fully informed but to ask for assistance only when absolutely needed.
At the same time, the PM must manage the relationship with the executive spon- sor, perhaps with some gentle reminders, coaxing, or prodding, to ensure that the role and tasks of executive sponsorship are being fulfi lled. “[T]he successful Project Manager knows that if those duties are not being fulfi lled, it’s time to call a timeout and have a serious conversation with the Executive Sponsor about the viability of the project.” 3
The executive sponsor serves six key purposes on a project:
1. Budget. The executive sponsor ensures an adequate fi nancial commitment is made to see the project through and lobbies for additional expenditures when change orders are made or cost overruns occur.
2. Planning and control. The executive sponsor sets direction and tracks accom- plishment of specifi c, measureable business objectives.
3. Decision making. The executive sponsor makes or approves crucial decisions and resolves issues that are escalated for resolution.
4. Expectation Management. The executive sponsor must manage expectation, since success is quite often a stakeholder perception.
5. Anticipation. Every project that is competing for resources can run into un- foreseen blockages and objections. Executive sponsors run interference and provide political might for the PM to lead the project to completion, through a series of milestones.
6. Approval. The executive sponsor signs off when all milestones and objectives have been met.
STRATEGIC PLANNING AND BEST PRACTICES FOR INFORMATION GOVERNANCE 55
An eager and effective executive sponsor makes all the difference to a project—if the role is properly managed by the PM. It is a tricky relationship, since the PM is always below the executive sponsor in the organization’s hierarchy, yet the PM must coax the superior into tackling certain high-level tasks. Sometimes a third-party con- sultant who is an expert in the specifi c project can instigate and support requests made of the sponsor and provide a solid business rationale.
Evolving Role of the Executive Sponsor
The role of the executive sponsor necessarily evolves and changes over the life of the initial IG program launch, during the implementation phases, and on through the continued IG program.
To get the program off the ground, the executive sponsor must make the business case and get adequate budgetary funding. But an effort such as this takes more than money; it takes time— not just time to develop new policies and implement new tech-— nologies, but the time of the designated PM, program leaders, and needed program team members.
In order to get this time set aside, the IG program must be made a top prior- ity of the organization. It must be recognized, formalized, and aligned with orga- nizational objectives. All this up-front work is the responsibility of the executive sponsor.
Once the IG program team is formed, team members must clearly understand why the new program is important and how it will help the organization meet its busi- ness objectives. This message must be regularly reinforced by the executive sponsor; he or she must not only paint the vision of the future state of the organization but articulate the steps in the path to get there.
When the formal program effort commences, the executive sponsor must remain visible and accessible. He or she cannot disappear into everyday duties and expect the program team to carry the effort through. The executive sponsor must be there to help the team confront and overcome business obstacles as they arise and must praise the successes along the way. This requires active involvement and a willingness to spend the time to keep the program on track and focused.
The executive sponsor must be the lighthouse that shows the way even through cloudy skies and rough waters. This person is the captain who must steer the ship, even if the fi rst mate (PM) is seasick and the deckhands (program team) are drenched and tired.
After the program is implemented, the executive sponsor is responsible for main- taining its effectiveness and relevance. This is done through periodic compliance au- dits, testing and sampling, and scheduled meetings with the ongoing PM.
While the executive sponsor role is high level, the PM’s role and tasks are more detailed and involve day-to-day management.
56 INFORMATION GOVERNANCE
Building Your IG Team
Who should make up the IG team? Although there are no set requirements or for- mulas, the complex nature of IG and the fact that it touches upon a number of spe- cialized disciplines and functional areas dictates that a cross-functional approach be taken. So you will need representatives from several departments. There are some absolutes: you must have a representative from your legal staff or outside counsel, your information technology (IT) department, a senior records offi cer (SRO) or the equivalent, a risk management specialist or manager, an executive sponsor, and the IG program manager. In addition, there may be a need for input from managers of hu- man resources, company communications, and certain business units. Depending on the scope of the effort, other possible IG team members might include an IT security expert, the corporate or agency archivist, business analysts, chief knowledge offi cer or knowledge management (KM) professional, litigation support head, fi nancial analyst, business process specialist, project management professional, and other professionals in functions related to these areas.
Assigning IG Team Roles and Responsibilities
The executive sponsor will need to designate an IG PM. Depending on the focus of the IG effort, that person could come from several areas, including legal, compliance, risk management, records management, or IT.
In terms of breaking down the roles and responsibilities of the remainder of the IG team, the easy decision is to have IG team representatives take responsibility for the functional areas of their expertise. But there will be overlap, and it is best to have some pairs or small work groups teamed up to gain the broadest amount of input and optimum results. This will also facilitate cross training. For instance, inside legal counsel may be responsible for rendering the fi nal legal opinions, but because they are not expert in records, document management, or risk management, they could benefi t from input of others in specialized functional areas, which will inform them and help narrow and focus their legal research. Basic research into which regulations and laws apply to the
The role of the executive sponsor changes during the inception, planning, and execution of the IG program.
The risk mitigation plan develops risk reduction options and tasks to reduce specifi ed risks and improve the odds for achieving business objectives.
STRATEGIC PLANNING AND BEST PRACTICES FOR INFORMATION GOVERNANCE 57
organization regarding security, retention, and preservation of e-mail, e-records, and personally identifi able information (PII) could be conducted by the SRO or records management head, in consultation with the corporate archivist and CIO, with the results of their fi ndings and recommendations drafted and sent to the legal counsel. The draft report may offer up several alternative approaches that need legal input and decisions. Then the legal team lead can conduct its own, focused research and make fi nal recom- mendations regarding the organization’s legal strategy, business objectives, fi nancial po- sition, and applicable laws and regulations.
The result of the research, consultation, and collaboration of the IG team should result in a fi nal draft of the IG strategic plan. It will still need more input and devel- opment to align the plan with business objectives, an analysis of internal and external drivers, applicable best practices, competitive analysis, applicable IT trends, an analysis and inclusion of the organization’s culture, and other factors.
Align Your IG Plan with Organizational Strategic Plans
The IG plan must support the achievement of the organization’s business objectives and there-s fore must be melded into the organization’s overall strategic plan. Integration with the strategic plan means that the business objectives in the IG plan are consistent with, and in support of, the enterprise strategic plan.
So, for example, if the corporate strategy includes plans for acquiring smaller com- petitors and folding them into the organization’s structure as operating divisions, then the IG plan must assist and contribute to this effort. Plans for standardizing operating policies and procedures must include a consistent, systematized approach to the com- ponents of IG, including stakeholder consultation, user training and communications, and compliance audits. The IG plan should bring a standard approach across the spec- trum of information use and management within the organization and it must be forged to accommodate the new technology acquisitions. This means that e-mail policies, e-discovery policies, mobile device policies, social media policies, cloud collaboration and storage use, and even nitty-gritty details like report formats, data structures, document taxonomies, and metadata must be consistent and aligned with the overall strategic plan. In other words, the goal is to get all employees on the same page and working to support the business objectives of the strategic plan in everyday small steps within the IG plan.
The IG team must include a cross-functional group of stakeholders from various departments, including legal, records management, IT, and risk management.
The IG strategic plan must be aligned and synchronized with the organiza- tion’s overall strategic plans, goals, and business objectives.
58 INFORMATION GOVERNANCE
The organization will also have an IT plan that must be aligned with the strategic plan to support overall business objectives. The IT strategy may be to convert new acquisitions to the internal fi nancial and accounting systems of the organization and to train new employees to use the existing software applications under the umbrella of the IG plan. Again, the IG plan needs to be integrated with the IT strategy and must consider the organization’s approach to IT.
The result of the process of aligning the IG effort with the IT strategy and the organization’s overall strategic plan will mean, ideally, that employee efforts are more effi cient and productive since they are consistently moving toward the achievement of the organization’s overall strategic goals. The organization will be healthier and will have less dissent and confusion with clear IG policies that leverage the IT strategy and help employees pursue overall business objectives.
Further considerations must be folded into the IG plan. As every corporate cul- ture is different and has a real impact on decision-making and operational approaches, corporate culture must be included in the plan. Corporate culture includes the organi- zation’s appetite for risk, its use of IT (e.g., forward-thinking fi rst adopter), its capital investment strategies, and other management actions.
So, if the organization is conservative and risk averse, it may want to hold off on implementing some emerging e-discovery technologies that can cut costs but also induce greater risk. Or if it is an aggressive, progressive, risk-taking organi- zation, it may opt to test and adopt newer e-discovery technologies under the IT strategy and umbrella of IG policies. An example may be the use of predictive coding technology in early case assessment (ECA). Predictive coding uses text auto-classifi cation technology and neural technology with the assistance of human input to “learn” which e-documents might be relevant in a particular legal matter and which may not be. Through a series of steps of testing and checking subsets of the documents, humans can provide input to improve the document sorting and selection process. The software uses machine learning (artifi cial intelligence whereby the software can change and improve on a particular task, as its decision engine is shaped and “trained” by input ) to improve its ability to cull through and sort documents.
Predictive coding can reduce e-discovery costs, yet there are risks that the ap- proach can be challenged in court and could, in fact, affect the case adversely. Thus, a decision on a technology like predictive coding can involve and include elements of the IG plan, IT strategy, and overall organizational strategic plan.
And there are resource issues to consider: How much management time, or band- width, is available to pursue the IG plan development and execution? Is there a budget item to allow for software acquisitions and training and communications to support the execution of the IG plan? Obviously, without the allocated management time and budget money, the IG plan cannot be executed.
Survey and Evaluate External Factors
The IG plan is now harmonized and aligned with your organization’s strategic plan and IT strategy, but you are not fi nished yet, because the plan cannot survive in a vacuum: Organizations must analyze and consider the external business, legal, and technological environment and fold their analysis into their plans.
STRATEGIC PLANNING AND BEST PRACTICES FOR INFORMATION GOVERNANCE 59
Analyze IT Trends
IG requires IT to support and monitor implementation of polices, so it matters what is s developing and trending in the IT space. What new technologies are coming online? Why are they being developed and becoming popular? How do these changes in the business environment that created opportunities for new technologies to be developed affect your organization and its ability execute its IG plan? How can new technologies assist? Which ones are immature and too risky? These are some of the questions that must be addressed in regard to the changing IT landscape.
Some changes in information and communications technology (ICT) are rathery obvious, such as the trends toward mobile computing, tablet and smartphone devices, cloud storage, and social media use. Each one of these major trends that may affect or assist in implementing IG needs to be considered within the framework of the organiza- tion’s strategic plan and IT strategy. If the corporate culture is progressive and supportive of remote work and telecommuting, and if the organizational strategy aims to lower fi xed costs by reducing the amount of offi ce space for employees and moving to a more mobile workforce, then trends in tablet and smartphone computing that are relevant to your or- ganization must be analyzed and considered. Is the organization going to provide mobile devices or support a bring-your-own-device (BYOD) environment? Which equipment will you support? Will you support iOS, Android, or both? What is your policy going to be on phone jacking? What is the IG policy regarding confi dential documents on mobile devices? Will you use encryption? If so, which software? Is your enterprise moving to the cloud computing model? Utilizing social media? What about Big Data and analytics ? Are you going to consider deploying auto-classifi cation and predictive coding technolo- gies? What are the trends that might affect your organization?
Many, many questions must be addressed, but the evaluation must be narrowed down to those technology trends that specifi cally might impact the execution of your IG plan and rollout of new technology.
On a more granular level, you must evaluate even supported fi le and document formats. It gets that detailed, when you are crafting IG policy. For instance, PDF/A is the standard format for archiving electronic documents. So your plans must include long-term digital preservation (LTDP) standards and best practices.
Survey Business Conditions and the Economic Environment
If the economy is on a down cycle, and particularly if your business sector has been nega- tively affected, resources may be scarcer than in better times. Hence, it may be more dif- fi cult to get budget approval for necessary program expenses, such as new technologies, staff, training materials, communications, and so forth. This means your IG plan may need to be scaled back or its scope reduced. Implementing the plan in a key division rath- er than attempting an enterprise rollout may be the best tactic in tough economic times.
The IG strategic plan must be informed with an assessment of relevant tech- nology trends.
60 INFORMATION GOVERNANCE
But if things are booming and the business is growing fast, budget money for in- vestments in the IG program may be easier to secure, and the goals may be expanded.
IG should be an ongoing program, but it takes time to implement, and it takes resources to execute, audit, and continue to refi ne. So an executive looking for a quick and calculable payback on the investment may want to focus on narrower areas. For instance, the initial focus may be entirely on the legal hold and e-discovery process, with business objectives that include reducing pretrial costs and attorney fees by a cer- tain percentage or amount. It is much easier to see concrete results when focusing on e-discovery, since legal costs are real, and always will be there. The business case may be more diffi cult to make if the IG effort is broader and improves the ability to or- ganize and search for information faster and to execute more complete searches to improve the basis for management decision making. Improved management decision making will improve the organization’s competitiveness long-term, but it may be dif- fi cult to cite specifi c examples where costs were saved or revenues were increased as a result of the “better decisions” that should come about through better IG.
Analyze Relevant Legal, Regulatory, and Political Factors
In consultation with your legal team or lead, the laws and regulations that affect your industry should be identifi ed. Narrowing the scope of your analysis, those that specifi - cally could impact your governance of information should be considered and analyzed. What absolute requirements do they impose? Where there is room for interpretation, where, legally, does your organization want to position itself? How much legal risk is acceptable? These are the types of questions you will have to look to your legal and risk management professionals to make. Again, legal requirements trump all others.
Your decision process must include considerations for the future and anticipated fu- ture changes. Changes in the legal and regulatory environment happen based on the po- litical leaders who are in place and any pending legislation. So you must go further and analyze the current political environment and make some judgments based on the best information you can gather, the organization’s culture and appetite for risk, management style, available resources, and other factors. Generally, a more conservative environment means less regulation, and this analysis must also be folded into your IG strategic plan.
Trends and conditions in the internal and external business environment must be included in the IG strategic plan.
Laws and regulations relevant to your organization’s management and distri- bution of information in all jurisdictions must be considered and included in the IG strategic plan. Legal requirements trump all others.
STRATEGIC PLANNING AND BEST PRACTICES FOR INFORMATION GOVERNANCE 61
Survey and Determine Industry Best Practices
IG is a developing hybrid discipline. In a sense, it is a superset of records management and a subset of governance, risk management, and compliance (GRC), that emerged to help manage the explosion in the amount of records, documents, and data that must be managed in today’s increasingly high-volume and velocity business environment and highly regulated compliance and litigation environment. As such, best practices are still being formed and added to. This process of testing, proving, and sharing best practices will continue for some time as the practices are expanded, revised, and refi ned.
The most relevant study of IG best practices is one that is conducted for your organization and surveys your industry and what some of your more progressive com- petitors are doing in regard to IG. Often the best way to accomplish such a study is by engaging a third-party consultant, who can more easily contact, study, and interview your competitors in regard to their practices. Business peer groups and trade associa- tions also can provide some consensus as to emerging best practices.
Twenty-fi ve IG best practices covering a number of areas in which IG has an im- pact or should be a major consideration are listed next.
1. IG is a key underpinning for a successful RM program. Practicing good IG is the essential foundation for building a legally defensible RM program; it pro- vides the basis for consistent, reliable methods for managing documents and records. Having trusted and reliable records, reports, and databases allows managers to make key decisions with confi dence.4 And accessing that infor- mation and business intelligence in a timely fashion can yield a long-term sustainable competitive advantage, creating more agile enterprises.
To implement a successful IG program, enterprises must standardize and systematize their handling of information, in particular their formal busi- ness records. They must analyze and optimize how information is accessed, controlled, managed, shared, stored, preserved, and audited. They must have complete, current, and relevant policies, processes, and technologies to man- age and control information, including who is able to access what information ,t and when , to meet external legal and regulatory demands and internal gover- nance requirements. This, in short, is IG.
2. IG is not a project but rather an ongoing program that provides an umbrella of rules and policies, monitored and enforced with the support of IT to manage and control information output and communications. Since technologies change so quickly, it is necessary to have overarching technology-agnostic policies that can manage the various IT platforms that an organization may use.
Compare the IG program to a workplace safety program; every time a new location, team member, piece of equipment, or toxic substance is acquired by the organization, the workplace safety program should dictate how that is
Include a best practices review in your IG strategic plan. The most relevant best practices in IG are those in your industry proven by peers and competitors.
62 INFORMATION GOVERNANCE
handled. If it does not, the workplace safety policies/procedures/training that are part of the workplace safety program need to be updated. Regular reviews are conducted to ensure the program is being followed, and adjustments are made based on the fi ndings. The effort never ends.5
3. Using an IG framework or maturity model is helpful in assessing and guiding IG programs. Various models are offered, such as The Principles from ARMA International; the Information Governance Reference Model, which grew out of the Electronic Discovery Reference Model (found at EDRM.net); 6 or MIKE2.0, which was developed by the consulting fi rm Bearing Point and released to the public domain. Another tool that is particularly used in the Australian market for records management projects is Designing and Imple- menting Recordkeeping Systems (DIRKS).
4. Defensible deletion of data debris and information that no longer has value is critical in the era of Big Data. You must have IG polices in place and be able to prove that you follow them consistently and systematically in order to justify, to the courts and regulators, deletion of information. With a smaller information footprint, organizations can more easily fi nd what they need and derive busi- ness value from it. 7 Data debris must be eliminated regularly and consistently, and to do this, processes and systems must be in place to cull out valuable information and discard the data debris. An IG program sets the framework to accomplish this.
5. IG policies must be developed before enabling technologies are deployed to assist in enforcement. After the policy-making effort, seek out the proper technology tools to assist in monitoring, auditing, and enforcement.
6. To provide comprehensive e-document security throughout a document’s life cycle, documents must be secured upon creation using highly sophisticated technologies, such as information rights management (IRM) technology. IRM acts as a sort of “secu- rity wrapper” that denies access without proper credentials. Document access and use by individuals having proper and current credentials is also tightly monitored IRM software controls the access, copying, editing, forwarding, and printing of documents using a policy engine that manages the rights to view and work on an e-document. Access rights are set by levels or “roles” that employees are responsible for within an organization.
7. A records retention schedule and legal hold notifi cation (LHN) process are the two primary elements of a fundamental IG program. These are the basics. Implemen- tation will require records inventorying, taxonomy development, metadata normalization and standardization, and a survey of LHN best practices.
8. A cross-functional team is required to implement IG. Since IG contains and requires elements of a number of established disciplines, representatives from the key areas must be included in the planning and implantation effort. At a minimum, you will need team leaders from legal, IT, records manage- ment, compliance and risk management, human resources, and executive management. Members from corporate communications, knowledge man- agement, systems security, fi nance and accounting, and other functional areas also may be needed. Depending on the circumstances, you may need repre- sentatives from major business units within the organization.
9. The fi rst step in information risk planning is to consider the applicable laws and regulations that apply to your organization in the jurisdictions in which it conducts
STRATEGIC PLANNING AND BEST PRACTICES FOR INFORMATION GOVERNANCE 63
business . Federal, provincial, state, and even municipal laws and regulationss may apply to the retention of data, documents, and records. Organizations operating in multiple jurisdictions must be compliant with laws and regula- tions that may cross national, state, or provincial boundaries. Legally required privacy requirements and retention periods must be researched for each ju- risdiction (state, country) in which the business operates, so that all applicable laws are complied with.
10. Developing a risk profi le is a basic building block in enterprise risk management, which assists executives in understanding the risks associated with stated business objectives and in allocating resources within a structured evaluation approach or framework . There are multiple ways to create a risk profi le, and the frequency with which it is created, the external sources consulted, and stakeholders who have input will vary from organization to organization. 8 A key tenet to bear in mind is that simpler is better and that sophisticated tools and techniques should not make the process overly complex.
11. An information risk mitigation plan is a critical part of the IG planning process. An information risk mitigation plan helps in developing risk mitigation options and tasks to reduce the specifi ed risks and improve the odds of achieving busi- ness objectives. 9
12. Proper metrics are required to measure the conformance and performance of your IG program. You must have an objective way to measure how you are doing, which means numbers and metrics. Assigning some quantitative measures that are meaningful before rolling out the IG program is essential.
13. IG programs must be audited for effectiveness. Periodic audits will tell you how your organization is doing and where to fi ne-tune your efforts. To keep an IG program healthy, relevant, and effective, changes and fi ne-tuning will always be required.
14. An enterprise wide retention schedule is preferable because it eliminates the possibility that different business units will have confl icting records retention periods. For exam- ple, if one business unit discards a group of records after 5 years, it would not make sense for another business unit to keep the same records for 10 years. Where enterprise-wide retention schedules are not possible, smaller business units, such as divisions or regions, should operate under a consistent retention schedule.
15. Senior management must set the tone and lead sponsorship for vital records program governance and compliance. Although e-records are easier to protect and back- up, most vital records today are e-records. These are an organization’s most essential records. Without them, an organization cannot continue operations.
16. Business processes must be redesigned to improve and optimize the management and security of information and especially the most critical of information, electronic re- cords, before implementing enabling technologies. For instance, using electronic records management (ERM) software fundamentally changes the way people work, and greater effi ciencies can be gained with business process redesign (versus simply using ERM systems as electronic fi ling cabinets to speed up poor processes).
17. E-mail messages, both inbound and outbound, should be archived automatically and (preferably) in real time. This ensures that spoliation (i.e., the loss of proven authenticity of an e-mail) does not occur. Archiving preserves legal validity
64 INFORMATION GOVERNANCE
and forensic compliance. By policy, most messages will be deleted in a short timeframe. Additionally, e-mail should be indexed to facilitate the searching process, and all messages should be secured in a single location (with backups). With these measures, the authenticity and reliability of e-mail records can be ensured.
18. Personal archiving of e-mail messages should be disallowed. Although users will want to save certain e-mail messages for their own reasons, control and man- agement of e-mail archiving must be at the organization level or as high of a level as is practical, such as division or region.
19. Destructive retention of e-mail helps to reduce storage costs and legal risk while im- proving “fi ndability” of critical records. It makes good business sense to have a policy to, say, destroy all e-mail messages after 90 or 120 days that are not fl agged as potential records (which, e.g., help document a transaction or a situ- ation that may come into dispute in the future) or those that have a legal hold.
20. Take a practical approach and limit cloud use to documents that do not have long retention periods and carry a low litigation risk. Doing this will reduce the risk of compromising or losing critical documents and e-records. Some duplicate copies of vital records may be stored securely in the cloud to help the organi- zation recover in the event of a disaster.
21. Manage social media content by IG policies and monitor it with controls that ensure protection of critical information assets and preservation of business records. Your organization must state clearly what content and tone is acceptable in social media use, and it must retain records of that use, which should be captured in real time.
22. International and national standards provide effective guidance for implementing IG. Although there are no absolutes, researching and referencing International Organization for Standardization (ISO) and other standards must be a part of any IG effort.
23. Creating standardized metadata terms should be part of an IG effort that enables faster, more complete, and more accurate searches and retrieval of records. This is important not only in everyday business operations but also when delv- ing through potentially millions of records during the discovery phase of litigation. Good metadata management also assists in the maintenance of corporate memory and in improving accountability in business operations. 10 Using a standardized format and controlled vocabulary provides a “precise and comprehensible description of content, location, and value.”11 Using a controlled vocabulary means your organization has standardized a set of terms used for metadata elements that describe records. This ensures consistency across a collection and helps with optimizing search and retrieval functions and records research as well as with meeting e-discovery requests, compliance demands, and other legal and regulatory requirements.
24. Some digital information assets must be preserved permanently as part of an orga- nization’s documentary heritage.12 It is critical to identify records that must be kept long term as early in the process as possible; ideally, these records should be identifi ed prior to or upon creation. LTDP applies to content that is born digital as well as content that is converted to digital form. Digital preservation is defi ned as long-term, error-free storage of digital information, with means for retrieval and interpretation, for the entire time span that the information
STRATEGIC PLANNING AND BEST PRACTICES FOR INFORMATION GOVERNANCE 65
is required to be retained. Dedicated repositories for historical and cultural memory, such as libraries, archives, and museums, need to move forward to put in place trustworthy digital repositories that can match the secu- rity, environmental controls, and wealth of descriptive metadata that these institutions have created for analog assets (such as books and paper records). Digital challenges associated with records management affect all sectors of society—academic, government, private, and not-for-profi t enterprises—and ultimately citizens of all developed nations.
25. Executive sponsorship is crucial. Securing an executive sponsor at the senior management level is key to successful IG programs. It is not possible to require managers to take time out of their other duties to participate in a project if there is no executive edict. It is a best practice across industry sec- tors and technology sets and supports the Accountability principle of The Principles.13
Formulating the IG Strategic Plan
Now comes the time to make sense of all the data and input your IG team has gathered and hammer it into a workable IG strategic plan. Doing this will involve some give-and-take among IG team members, each having their own perspective and priorities. Everyone will be lobbying for the view of their functional groups. It is the job of the executive sponsor to set the tone and to emphasize organizational business objectives so that the effort does not drag out or turn into a competition but is a well-informed consensus development process that results in a clear, workable IG strategic plan.
Synthesize Gathered Information and Fuse It into IG Strategy
Your IG team will have gathered a great deal of information, which needs to be ana- lyzed and distilled into actionable strategies. This process will depend on the expertise and input of the specialized knowledge your team brings to the table within your organizational culture. Team members must be able to make decisions and establish priorities that refl ect organizational business objectives and consider a number of in- fl uencing factors.
Do not prolong the strategy development process. The longer it lasts, the more key factors infl uencing it can change. You want to develop a strategic plan that is durable enough to withstand changes in technology, legislation, and other key infl uencing factors, but it should be relevant to that snapshot of information that was collected early on. When all the parts and pieces start changing and require reconsideration, a dated IG plan does not serve the organization well.
Develop IG strategies for each of the critical areas, including the legal hold pro- cess, e-discovery action plans, e-mail policy, mobile computing policy, IT acquisition strategy, confi dential document handling, vital records and disaster planning, social media policy, and other areas that are important to your organization. To maintain focus, do this fi rst without regard to the prioritization of these areas.
66 INFORMATION GOVERNANCE
Then you must go through the hard process of prioritizing your strategies and aligning them to your organizational goal and objectives . This may not be diffi cult in the beginning—fors instance, your IG strategies for legal holds and e-discovery readiness are likely going to take higher priority than your social media policy, and protecting vital records is paramount to any organization. As the process progresses, it will become more chal- lenging to make trade-offs and establish priorities. Then you must tie these strategies to overall organizational goals and business objectives.
A good technique to keep goals and objectives in mind may be to post them prom- inently in the meeting room where these strategy sessions take place. This will help to keep the IG team focused.
Develop Actionable Plans to Support Organizational Goals and Objectives
Plans and policies to support your IG efforts must be developed that identify specifi c tasks and steps and defi ne roles and responsibilities for those who will be held ac- countable for their implementation. This is where the rubber meets the road. But you cannot simply create the plan and marching orders: You must build in periodic checks and audits to test that new IG policies are being followed and that they have hit their mark. Invariably, there will be adjustments made continually to craft the policies for maximum effectiveness and continued relevance in the face of changes in external factors, such as legislation and business competition, and internal changes in manage- ment style and structure.
Create New IG Driving Programs to Support Business Goals and Objectives
You have to get things moving and get employees motivated, and launching new sub- programs within the overall IG program is a good way to start. For instance, a new “e-discovery readiness” initiative can show almost immediate results if implemented properly, with the support of key legal and records management team members, driven by the executive sponsor. You may want to revamp the legal hold process to make it more complete and verifi able, assigning specifi c employees accountabil- ity for specifi c tasks. Part of that effort may be evaluating and implementing new technology-assisted review (TAR) processes and predictive coding technology. So you will need to bring in the IG team members responsible for IT and perhaps busi- ness analysis. Working cooperatively on smaller parts of the overall IG program is a way to show real results within defi ned time frames. Piecing together a series of pro- gram components is the best way to get started, and it breaks the overall IG program
Fuse the fi ndings of all your analyses of external and internal factors into your IG strategic plan. Develop strategies and then prioritize them.
STRATEGIC PLANNING AND BEST PRACTICES FOR INFORMATION GOVERNANCE 67
down into digestible, doable chunks. A small win early on is crucial to maintain mo- mentum and executive sponsorship. And e-discovery has real costs: yet progress can be measured objectively in terms of reducing the cost of activities such as early case assessment (ECA). Benefi ts can be measured in terms of reduced attorney review hours, reduced costs, and reduced time to accomplish pretrial tasks.
To be clear, you will need to negotiate and agree on the success metrics the pro- gram will be measured on in advance.
There are other examples of supporting IG subprograms, such as e-mail manage- ment and archiving, where storage costs, search times, and information breaches can be measured in objective terms. Or you may choose to roll out new policies for the use of mobile devices within your organization, where adherence to policy can be mea- sured by scanning mobile devices and monitoring their use.
Draft the IG Strategic Plan and Gain Input from a Broader Group of Stakeholders
Once you have the pieces of the plan drafted and the IG team is in agreement that it has been harmonized and aligned with overall organizational goals and objectives, you must test the waters to see if you have hit the mark. It is a good practice to expose a broader group of stakeholders to the plan to gain their input. Perhaps your IG team has become myopic or has passed over some points that are important to the broader stakeholder audience. Solicit and discuss their input, and to the degree that there is a consensus, refi ne the IG strategic plan one last time before fi nalizing it. But remember, it is a living document, a work in progress, which will require revisiting and updating to ensure it is in step with changing external and internal factors. Periodic auditing and review of the plan will reveal areas that need to be adjusted and revised to keep it relevant and effective.
Get Buy-in and Sign-off and Execute the Plan
Take the fi nalized plan to executive management, preferably including the CEO, and present the plan and its intended benefi ts to them. Field their questions and address any concerns to gain their buy-in and the appropriate signatures. You may have to make some minor adjustments if there are signifi cant objections, but, if you have ex- ecuted the stakeholder consultation process properly, you should be very close to the mark. Then begin the process of implementing your IG strategic plan, including regu- lar status meetings and updates, steady communication and reassurance of your execu- tive sponsor, and planned audits of activities.
Create supporting subprograms to jump-start your IG program effort. Smaller programs should be able to measure real results based on metrics that are agreed on in advance.
68 INFORMATION GOVERNANCE
CHAPTER SUMMARY: KEY POINTS
■ Engaged and vested executive sponsors are necessary for IG program success. It is not possible to require managers to take time out of their other duties to participate in a project if there is no executive edict or allocated budget.
■ The executive sponsor must be: (1) directly tied to the success of the pro- gram, (2) fully engaged in and aware of the program, and (3) actively elimi- nating barriers and resolving issues.
■ The role of the executive sponsor evolves over the life of the IG program and IG program effort. Initially, the focus is on garnering the necessary resources, but as the program commences, the emphasis is more on supporting the IG program team and clearing obstacles. Once the program is implement- ed, the responsibilities shift to maintaining the effectiveness of the program through testing and audits.
■ While the executive sponsor role is high level, the project manager’s role and tasks involve more detailed and day-to-day management.
■ The risk mitigation plan develops risk reduction options and tasks to reduce specifi ed risks and improve the odds for achieving business objectives.
■ The IG team must include a cross-functional group of stakeholders from various departments, including legal, records management, IT, and risk management.
■ The IG strategic plan must be aligned and synchronized with the organiza- tion’s overall strategic plans, goals, and business objectives.
■ The IG strategic plan must include an assessment of relevant technology trends.
■ Trends and conditions in the internal and external business environment must be included in the IG strategic plan.
■ Laws and regulations relevant to your organization’s management and distri- bution of information in all jurisdictions must be considered and included in the IG strategic plan. Legal requirements trump all others.
■ Include a best practices review in your IG strategic plan. The most relevant best practices in IG are those in your industry proven by peers and competitors. (Twenty-fi ve IG best practices are listed in this chapter for the fi rst time in print.)
■ Fuse the fi ndings of all your analysis of external and internal factors into your IG strategic plan. Develop strategies and then prioritize them.
■ Creating supporting subprograms to jump-start your IG program effort. Smaller programs should be able to measure real results based on metrics that are agreed on in advance.
■ Make sure to get executive sign-off on your IG strategic plan before moving to execute it.
STRATEGIC PLANNING AND BEST PRACTICES FOR INFORMATION GOVERNANCE 69
Notes
1. ARMA International, “How to Cite GARP,” www.arma.org/garp/copyright.cfm (accessed October 9, 2013).
2. Roger Kastner, “Why Projects Succeed—Executive Sponsorship,” February 15, 2011, http://blog .slalom.com/2011/02/15/why-projects-succeed-%E2%80%93-executive-sponsorship/
3. Ibid. 4. Economist Intelligence Unit, “The Future of Information Governance,” www.emc.com/leadership
/business-view/future-information-governance.htm (accessed October 9, 2013). 5. Monica Crocker, e-mail to author, June 21, 2012. 6. EDRM, “Information Governance Reference Model (IGRM) Guide,” www.edrm.net/resources
/guides/igrm (accessed November 30, 2012). 7. Randolph A. Kahn, https://twitter.com/InfoParkingLot/status/273791612172259329, Nov. 28, 2012. 8. John Fraser and Betty Simkins, eds., Enterprise Risk Management: Today’s Leading Research and Best Prac-
tices for Tomorrow’s Executives (Hoboken, NJ: John Wiley & Sons, 2010), p. 171. s 9. Project Management Institute, A Guide to the Project Management Body of Knowledge (PMBOK Guide ),
4th ed. (Newtown Square, PA Project Management Institute, 2008), ANSI/PMI 99–001–2008, pp. 273–312.
10. Kate Cumming, “Metadata Matters,” in Julie McLeod and Catherine Hare, eds., Managing Electronic Records , p. 34 (London: Facet, 2005).s
11. Minnesota State Archives, Electronic Records Management Guidelines, “Metadata,” March 12, 2012, www.mnhs.org/preserve/records/electronicrecords/ermetadata.html .
12. Charles Dollar and Lori Ashley, e-mail to author, August 10, 2012. 13. ARMA International, “How to Cite GARP.”
71
Information Governance Policy Development
C H A P T E R 6
To develop an information governance (IG) policy, you must inform and frame the policy with internal and external frameworks, models, best practices, and standards—those that apply to your organization and the scope of its planned IG program. In this chapter, we fi rst present and discuss major IG frameworks and models and then identify key standards for consideration.
A Brief Review of Generally Accepted Recordkeeping Principles®
In Chapter 3 we introduced and discussed ARMA International’s eight Generally Accepted Recordkeeping Principles ® , known as The Principles 1 (or sometimes GAR Principles). These Principles and associated metrics provide an IG framework that can support continuous improvement.
To review, the eight Principles are:
1. Accountability 2. Transparency 3. Integrity 4. Protection 5. Compliance 6. Availability 7. Retention 8. Disposition2
The Principles establish benchmarks for how organizations of all types and sizes can build and sustain compliant, legally defensible records management (RM)t programs. Using the maturity model (also presented in Chapter 3 ), organizations can assess where they are in terms of IG, identify gaps, and take steps to improve across the eight areas The Principles cover.
72 INFORMATION GOVERNANCE
IG Reference Model
In late 2012, with the support and collaboration of ARMA International and the Com- pliance, Governance and Oversight Council (CGOC), the Electronic Discovery Ref- erence Model (EDRM) Project released version 3.0 of its Information Governance Reference Model (IGRM), which added information privacy and security “as pri-y mary functions and stakeholders in the effective governance of information.” 3 The model is depicted in Figure 6.1 .
The IGRM is aimed at fostering IG adoption by facilitating communication and collaboration between disparate (but overlapping) IG stakeholder functions, includ- ing information technology (IT), legal, RM, risk management, and business unit
Figure 6.1 Information Governance Reference Model Source: EDRM.net
Linking duty + value to information asset = efficient, effective management
Duty: Legal obligation
for specific information
Value: Utility or business
purpose of specific information
Asset: Specific container of information
VALUE
Create, Use
DUTY ASSET
Dispose
Hold, Discover
Store, Secure
Retain Archive
UN IFIED G
OVERNANCE
BUSINESS Profit
IT Efficiency
LEGAL Risk
RIM Risk
PRIVACY AND
SECURITY Risk
PROCESS TRAN SP
AR EN
C
Y
POL ICY INTEGRATION
Information Governance Reference Model / © 2012 / v3.0 / edrm.net
INFORMATION GOVERNANCE POLICY DEVELOPMENT 73
stakeholders. 4 It also aims to provide a common, practical framework for IG that will foster adoption of IG in the face of new Big Data challenges and increased legal and regulatory demands. It is a clear snapshot of where IG touches and shows critical in- terrelationships and unifi ed governance.5 It can help organizations forge policy in an orchestrated way and embed critical elements of IG policy across functional groups. Ultimately, implementation of IG helps organizations leverage information value, re- duce risk, and address legal demands.
The growing CGOC community (2,000+ members and rising) has widely adopted the IGRM and developed a process maturity model that accompanies and leverages IGRM v3.0. 6
Interpreting the IGRM Diagram *
Outer Ring Starting from the outside of the diagram, successful information management is about conceiving a complex set of interoperable processes and implementing the procedures and structural elements to put them into practice. It requires:
■ An understanding of the business imperatives of the enterprise, ■ Knowledge of the appropriate tools and infrastructure for managing informa-
tion, and ■ Sensitivity to the legal and regulatory obligations with which the enterprise
must comply.
For any piece of information you hope to manage, the primary stakeholder is the business user of that information [emphasis added]. We use the term “business” broadly; the same ideas apply to end users of information in organizations whose ultimate goal might not be to generate a profi t.
Once the business value is established, you must also understand the legal duty at- tached to a piece of information. The term “legal” should also be read broadly to refer to a wide range of legal and regulatory constraints and obligations, from e-discovery and government regulation to contractual obligations such as payment card industry requirements.
Finally, IT organizations must manage the information accordingly, ensuring pri- vacy and security as well as appropriate retention as dictated by both business and legal or regulatory requirements.
* This section is adapted with permission by EDRM.net, http://www.edrm.net/resources/guides/igrm (accessed January 24, 2014).
You must inform and frame IG policy with internal and external frameworks, models, best practices, and standards.
74 INFORMATION GOVERNANCE
Center
In the center of the diagram is a work-fl ow or life-cycle diagram. We include this com- ponent in the diagram to illustrate the fact that information management is important at all stages of the information life cycle—from its creation through its ultimate disposition. This part of the diagram, once further developed, along with other secondary-level diagrams, will outline concrete, actionable steps that organizations can take in imple- menting information management programs.
Even the most primitive business creates information in the course of daily operations, and IT departments spring up to manage the logistics; indeed, one of the biggest challeng- es in modern organizations is trying to stop individuals from excess storing and securing of information. Legal stakeholders can usually mandate the preservation of what is most critical, though often at great cost. However, it takes the coordinated effort of all three groups to defensibly dispose of a piece of information that has outlived its usefulness and retain what is useful in a way that enables accessibility and usability for the business user. s
How the IGRM Complements the Generally Accepted Recordkeeping Principles *
The IGRM supports ARMA International’s “Principles” by identifying the cross- functional groups of key information governance stakeholders and by depicting their intersecting objectives for the organization. This illustration of the relation- ship among duty, value, and the information asset demonstrates cooperation among stakeholder groups to achieve the desired level of maturity of effective information governance.
Effective IG requires a continuous and comprehensive focus. The IGRM will be used by proactive organizations as an introspective lens to facilitate visualization and discussion about how best to apply The Principles. The IGRM puts into sharp focus The Principles and provides essential context for the maturity model.
* This section is adapted with permission by EDRM.net, http://www.edrm.net/resources/guides/igrm (accessed January 24, 2014).
The business user is the primary stakeholder of managed information.
Information management is important at all stages of the life cycle.
Legal stakeholders can usually mandate the preservation of what is most criti- cal, though often at great cost.
INFORMATION GOVERNANCE POLICY DEVELOPMENT 75
Best Practices Considerations
IG best practices should also be considered in policy formulation . Best practices in IG are evolv- ing and expanding, and those that apply to organizational scenarios may vary. A best practices review should be conducted, customized for each particular organization.
In Chapter 5 , we provided a list of 25 IG best practices, with some detail. The IG world is maturing, and more best practices will evolve. The 25 best practices, summa- rized next, are fairly generic and widely applicable.
1. IG is a key underpinning for a successful ERM program. 2. IG is not a project but rather an ongoing program. 3. Using an IG framework or maturity model is helpful in assessing and guiding
IG programs. 4. Defensible deletion of data debris and information that no longer has value is
critical in the era of Big Data. 5. IG policies must be developed before enabling technologies are added to as-
sist in enforcement. 6. To provide comprehensive e-document security throughout a document’s life
cycle, documents must be secured upon creation using highly sophisticated technologies, such as information rights management (IRM) technology.
7. A records retention schedule and legal hold notifi cation process (LHN) are the two primary elements of a fundamental IG program.
8. A cross-functional team is required to implement IG. 9. The fi rst step in information risk planning is to consider the applicable laws
and regulations that apply to your organization in the jurisdictions in which it conducts business.
10. A risk profi le is a basic building block in enterprise risk management, assisting executives in understanding the risks associated with stated business objec- tives and in allocating resources within a structured evaluation approach or framework.
11. An information risk mitigation plan is a critical part of the IG planning process. An information risk mitigation plan involves developing risk mitiga- tion options and tasks to reduce the specifi ed risks and improve the odds of achieving business objectives. 7
12. Proper metrics are required to measure the conformance and performance of your IG program.
13. IG programs must be audited for effectiveness. 14. An enterprise-wide retention schedule is preferable because it eliminates the
possibility that different business units will have different records retention periods.
The IGRM was developed by the EDRM Project to foster communication among stakeholders and adoption of IG. It complements ARMA’s Generally Accepted Recordkeeping Principles.
76 INFORMATION GOVERNANCE
15. Senior management must set the tone and lead sponsorship for vital records program governance and compliance.
16. Business processes must be redesigned to improve the management of electron- ic records or implement an electronic records management (ERM) system. t
17. E-mail messages, both inbound and outbound, should be archived automati- cally and (preferably) in real time.
18. Personal archiving of e-mail messages should be disallowed. 19. Destructive retention of e-mail helps to reduce storage costs and legal risk
while improving “fi ndability” of critical records. 20. Take a practical approach and limit cloud use to documents that do not have
long retention periods and carry a low litigation risk. 21. Manage social media content by IG policies and monitor it with controls that en-
sure protection of critical information assets and preservation of business records. 22. International and national standards provide effective guidance for imple-
menting IG. 23. Creating standardized metadata terms should be part of an IG effort that
enables faster, more complete, and more accurate searches and retrieval of records. 8
24. Some digital information assets must be preserved permanently as part of an organization’s documentary heritage.
25. Executive sponsorship is crucial.
Standards Considerations
Standards must also be considered in policy development. There are two general types of standards: de jure and de facto. De jure (“the law”) standards are those published by recognized standards-setting bodies, such as the International Organization for Stan- dardization (ISO), American National Standards Institute (ANSI), National Institute of Standards and Technology (NIST—this is how most people refer to it, as they do not know what the acronym stands for), British Standards Institute (BSI), Standards Council of Canada, and Standards Australia. Standards promulgated by authorities such as these have the formal status of standards.
De facto (“the fact”) standards are not formal standards but are regarded by many as if they were. They may arise though popular use (e.g., Windows at the busi- ness desktop in the 2001–2010 decade) or may be published by other bodies, such as the U.S. National Archives and Records Administration (NARA) or Department of Defense (DoD) for the U.S. military sector. They may also be published by formal standards-setting bodies without having the formal status of a “standard” (such as some technical reports published by ISO). 9
Benefi ts and Risks of Standards
Some benefi ts of developing and promoting standards are:
■ Quality assurance support. If a product meets a standard, you can be confi dent of a certain level of quality.
INFORMATION GOVERNANCE POLICY DEVELOPMENT 77
■ Interoperability support. Some standards are detailed and mature enough to allow for system interoperability between different vendor platforms.
■ Implementation frameworks and certifi cation checklists. These help to provide guides for projects and programs to ensure all necessary steps are taken.
■ Cost reduction , due to supporting uniformity of systems. Users have lower main- tenance requirements and training and support costs when systems are more uniform.
■ International consensus. Standards can represent “best practice” recommenda- tions based on global experiences. 10
Some downside considerations are:
■ Possible decreased fl exibility in development or implementation. Standards can, at times, act as a constraint when they are tied to older technologies or methods, which can reduce innovation.
■ “Standards confusion” from competing and overlapping standards. For instance, ” an ISO standard may be theory-based and use different terminology, whereas regional or national standards are more specifi c, applicable, and understandable than broad international ones.
■ Real-world shortcomings due to theoretical basis. Standards often are guides based on theory rather than practice.
■ Changing and updating requires cost and maintenance. There are costs to develop- ing, maintaining, and publishing standards. 11
Key Standards Relevant to IG Efforts
Below we introduce and discuss some established standards that should be researched and considered as a foundation for developing IG policy.
Risk Management
ISO 31000:2009 is a broad, industry-agnostic (not specifi c to vertical markets) risk management standard. It states “principles and generic guidelines” of risk manage- ment that can be applied to not only IG but also to a wide range of organizational ac- tivities and processes throughout the life of an organization.12 It provides a structured framework within which to develop and implement risk management strategies and programs.
ISO 31000 defi nes a risk management framework as a set of two basic compo-k nents that “support and sustain risk management throughout an organization.” 13 The stated components are: foundations, which are high level and include risk management policy, objectives, and executive edicts; and organizational arrangements, which are more specifi c and actionable, including strategic plans, roles and responsibilities, al- located budget, and business processes that are directed toward managing an organiza- tion’s risk.
Additional risk management standards may be relevant to your organization’s IG policy development efforts, depending on your focus, scope, corporate culture, and demands of your IG program executive sponsor.
78 INFORMATION GOVERNANCE
Information Security and Governance
ISO/IEC 27001:2005 is an information security management system (ISMS) stan- dard that provides guidance in the development of security controls to safeguard information assets. Like ISO 31000, the standard is applicable to all types of organiza- tions, irrespective of vertical industry. 14 It “specifi es the requirements for establishing, implementing, operating, monitoring, reviewing, maintaining and improving a docu- mented information security management system within the context of the organiza- tion’s overall business risks.”
ISO/IEC 27001 is fl exible enough to be applied to a variety of activities and pro- cesses when evaluating and managing information security risks, requirements, and objectives, and compliance with applicable legal and regulatory requirements. This includes use of the standards guidance by internal and external auditors as well as internal and external stakeholders (including customers and potential customers).
ISO/IEC 27002:2005, “Information Technology—Security Techniques—Code of Practice for Information Security,” 15
establishes guidelines and general principles for initiating, implementing, maintaining, and improving information security management in an orga- nization and is identical to the previous published standard, ISO 17799. The objectives outlined provide general guidance on the commonly accepted goals of information security management. ISO/IEC 27002:2005 contains best practices of control objectives and controls in the following areas of informa- tion security management:
■ security policy; ■ organization of information security; ■ asset management; ■ human resources security; ■ physical and environmental security; ■ communications and operations management; ■ access control; ■ information systems acquisition, development, and maintenance; ■ information security incident management; ■ business continuity management; and ■ compliance.
The control objectives and controls in ISO/IEC 27002:2005 are intended to be implemented to meet the requirements identifi ed by a risk assessment. ISO/ IEC 27002:2005 is intended as a common basis and practical guideline for de- veloping organizational security standards and effective security management practices, and to help build confi dence in inter-organizational activities.
ISO 31000 is a broad risk management standard that applies to all types of businesses.
INFORMATION GOVERNANCE POLICY DEVELOPMENT 79
ISO/IEC 38500:2008 is an international standard that provides high-level prin- ciples and guidance for senior executives and directors, and those advising them, for the effective and effi cient use of IT.16 Based primarily on AS 8015, the Australian IT governance standard, it “applies to the governance of management processes” that are performed at the IT service level, but the guidance assists executives in monitoring IT and ethically discharging their duties with respect to legal and regulatory compliance of IT activities.
The ISO 38500 standard comprises three main sections:
1. Scope, Application and Objectives 2. Framework for Good Corporate Governance of IT 3. Guidance for Corporate Governance of IT
It is largely derived from AS 8015, the guiding principles of which were:
■ Establish responsibilities ■ Plan to best support the organization ■ Acquire validly ■ Ensure performance when required ■ Ensure conformance with rules ■ Ensure respect for human factors
The standard also has relationships with other major ISO standards, and em- braces the same methods and approaches. It is certain to have a major impact upon the IT governance landscape. 17
Records and E-Records Management
ISO 15489–1:2001 is the international standard for RM. It identifi es the elements of RM and provides a framework and high-level overview of RM core principles. RM is defi ned as the “fi eld of management responsible for the effi cient and systematic control of the creation, receipt, maintenance, use and disposition of records, including the processes for capturing and maintaining evidence of and information about busi- ness activities and transactions in the form of records.”18
ISO/IEC 27001 and ISO/IEC 27002 are information security management systems standards that provide guidance in the development of security controls.
ISO 38500 is an international standard that provides high-level principles and guidance for senior executives and directors responsible for IT governance.
80 INFORMATION GOVERNANCE
The second part of the standard, ISO 15489–2:2001, contains the technical specifi cations and a methodology for implementing the standard, originally based on early standards work in Australia ( Design and Implementation of Recordkeeping Systems—DIRKS ). Note: Although still actively used in Australian states, the National Archives of Australia has not recommended use of DIRKS by Australian national agencies since 2007 and has removed DIRKS from its Web site.)19
The ISO 15489 standard makes little mention of electronic records, as it is written to ad- dress all kinds of records; nonetheless it was widely viewed as the defi nitive framework of what RM means.
In 2008, the International Council on Archives (ICA) formed a multination- al team of experts to develop “Principles and Functional Requirements for Records in Electronic Offi ce Environments,” commonly referred to as ICA-Req. q 20 The project was cosponsored by the Australasian Digital Recordkeeping Initiative (ADRI), which was undertaken by the Council of Australasian Archives and Records Authorities, which “com- prises the heads of the government archives authorities of the Commonwealth of Australia, New Zealand, and each of the Australian States and Territories.” 21 The National Archives of Australia presented a training and guidance manual to assist in implementing the prin- ciples at the 2012 International Congress on Archives Congress in Brisbane, Australia.
In Module 1 of ICA-Req, principles are presented in a high-level overview; Mod- ule 2 contains specifi cations for electronic document and records management sys- tems (EDRMS) that are “globally harmonized”; and Module 3 contains a require- ments set and “implementation advice for managing records in business systems.”22 Module 3 recognizes that digital recordkeeping does not have to be limited to the EDRMS paradigm—the insight that has now been picked up by “Modular Require- ments for Records Systems” (MoReq2010, the European standard released in 2011).23
Parts 1 to 3 of ISO 16175 were fully adopted in 2010–2011 based on the ICA-Req standard. The standard may be purchased at www.ISO.org, and additional information on the Australian initiative may be found at www.adri.gov.au.
ISO 16175 is guidance, not a standard that can be tested and certifi ed against. This is the criticism by advocates of testable, certifi able standards like U.S. DoD 5015.2 and the European standard, MoReq2010.
In November 2011, ISO issued new standards for ERM, the fi rst two in the ISO 30300 series, which are based on a managerial point of view and targeted at a manage-l ment-level audience rather than at records managers or technical staff:
■ ISO 30300:2011 , “Information and Documentation—Management Systems for Records—Fundamentals and Vocabulary”
■ ISO 30301:2011 , “Information and Documentation—Management Systems for Records—Requirements”
ISO 15489 is the international RM standard.
The ICA-Req standard was adopted as ISO 16175. It does not contain a testing regime for certifi cation.
INFORMATION GOVERNANCE POLICY DEVELOPMENT 81
The standards apply to “management systems for records ” (MSR), a term that, as of this printing, is not typically used to refer to ERM or RM application [RMA] software in the United States or Europe and is not commonly found in ERM research or literature.
The ISO 30300 series is a systematic approach to the creation and management of records that is “ aligned with organizational objectives and strategies. ” [italics added] 24
“ISO 30300 MSR ‘Fundamentals and Vocabulary’ explains the rationale behind the creation of an MSR and the guiding principles for its successful implementation. and it provides the terminology that ensures that it is compatible with other manage- ment systems standards.
ISO 30301 MSR ‘Requirements’ specifi es the requirements necessary to develop a records policy. It also sets objectives and targets for an organization to implement systemic improvements. This is achieved through designing records processes and systems; estimating the appropriate allocation of resources; and establishing bench- marks to monitor, measure, and evaluate outcomes. These steps help to ensure that corrective action can be taken and continuous improvements are built into the sys- tem in order to support an organization in achieving its mandate, mission, strategy, and goals.”25
Major National and Regional ERM Standards
For great detail on national and regional standards related to ERM, see the book l Managing Electronic Records: Methods, Best Practices, and Technologies (Wiley 2013) by s Robert F. Smallwood. Below is a short summary:
United States E-Records Standard
The U.S. Department of Defense 5015.2 Design Criteria Standard for Electronic Records Management Software Applications , standard was established in 1997 and is endorsed by s the leading archival authority, the U.S. National Archives and Records Administration (NARA). There is a testing regime that certifi es software vendors that is adminis- tered by JITC. JITC “builds test case procedures, writes detailed and summary fi nal reports on 5015.2-certifi ed products, and performs on-site inspection of software.” 26 The DoD standard was built for the defense sector, and logically “refl ects its govern- ment and archives roots.”
Since its endorsement by NARA, the standard has been the key requirement for ERM system vendors to meet, not only in U.S. public sector bids, but also in the com- mercial sector.
The 5015.2 standard has since been updated and expanded, in 2002 and 2007, to include requirements for metadata, e-signatures and Privacy and Freedom of Information Act requirements, and, as previously stated, was scheduled for update by 2013.
The U.S. DoD 5015.2-STD has been the most infl uential worldwide since it was fi rst introduced in 1997. It best suits military applications.
82 INFORMATION GOVERNANCE
Canadian Standards and Legal Considerations for Electronic Records Management *
The National Standards of Canada for electronic records management are: (1) Electronic Records as Documentary Evidence CAN/CGSB-72.34–2005 (“72.34”), published in December 2005; and, (2) Microfi lm and Electronic Images as Documen- tary Evidence CAN/CGSB-72.11–93, fi rst published in 1979 and updated to 2000 (“72.11”).27 72.34 incorporates all that 72.11 deals with and is therefore the more important of the two. Because of its age, 72.11 should not be relied upon for its “legal” content. However, 72.11 has remained the industry standard for “imaging” procedures—converting original paper records to electronic storage. The Canada Revenue Agency has adopted these standards as applicable to records concerning taxation.28
72.34 deals with these topics: (1) management authorization and accountability; (2) documentation of procedures used to manage records; (3) “reliability testing” of electronic records according to existing legal rules; (4) the procedures manual and the chief records offi cer; (5) readiness to produce (the “prime directive”); (6) records recorded and stored in accordance with “the usual and ordinary course of business” and “system integrity,” being key phrases from the Evidence Acts in Canada; (7) re- tention and disposal of electronic records; (8) backup and records system recovery; and, (9) security and protection. From these standards practitioners have derived many specifi c tests for auditing, establishing, and revising electronic records man- agement systems. 29
The “prime directive” of these standards states: “An organization shall always be prepared to produce its records as evidence.”30 The duty to establish the “prime directive” falls upon senior management:31
5.4.3 Senior management, the organization’s own internal law-making author- ity, proclaims throughout the organization the integrity of the organization’s records system (and, therefore, the integrity of its electronic records) by establishing and de- claring:
a. the system’s role in the usual and ordinary course of business; b. the circumstances under which its records are made; and c. its prime directive for all RMS [records management system] purposes, i.e.,
an organization shall always be prepared to produce its records as evidence. This dominant principle applies to all of the organization’s business records, including electronic, optical, original paper source records, microfi lm, and other records of equivalent form and content.
* This section was contributed by Ken Chasse J.D., LL.M., a records management attorney and consultant, and mem- ber of the Law Society of Upper Canada (Ontario) and of the Law Society of British Columbia, Canada.
The 5015.2 standard has been updated to include specifi cations such as those for e-signatures and FOI requirements.
INFORMATION GOVERNANCE POLICY DEVELOPMENT 83
Being the “dominant principle” of an organization’s electronic records manage- ment system, the duty to maintain compliance with the “prime directive” should fall upon its senior management.
Legal Considerations Because an electronic record is completely dependent upon its ERM system for every- thing, compliance with these National Standards and their “prime directive” should be part of the determination of the “admissibility” (acceptability) of evidence and of electronic discovery in court proceedings (litigation) and in regulatory tribunal proceedings. 32
There are 14 legal jurisdictions in Canada: 10 provinces, 3 territories, and the federal jurisdiction of the Government of Canada. Each has an Evidence Act (the Civil Code in the province of Quebec 33 ), which applies to legal proceedings within its leg- islative jurisdiction. For example, criminal law and patents and copyrights are within federal legislative jurisdiction, and most civil litigation comes within provincial legisla- tive jurisdiction. 34
The admissibility of records as evidence is determined under the “business record” provi- sions of the Evidence Acts.35 They require proof that a record was made “in the usual and ordinary course of business,” and of “the circumstances of the making of the record.” In addition, to obtain admissibility for electronic records, most of the Evidence Acts contain electronic record provisions, which state that an electronic record is admis- sible as evidence on proof of the “integrity of the electronic record system in which the data was recorded or stored.” 36 This is the “system integrity” test for the admissibility of electronic records. The word “integrity” has yet to be defi ned by the courts. 37
However, by way of sections such as the following, the electronic record provi- sions of the Evidence Acts make reference to the use of standards such as the National Standards of Canada:
For the purpose of determining under any rule of law whether an electronic record is admissible, evidence may be presented in respect of any standard, procedure, usage or practice on how electronic records are to be recorded or stored, having regard to the type of business or endeavor that used, recorded, or stored the electronic record and the nature and purpose of the electronic record. 38
U.K. and European Standards
In the United Kingdom, The National Archives (TNA) (formerly the Public Record Offi ce, or PRO) “has published two sets of functional requirements to promote the development of the electronic records management software market (1999 and 2002).” It ran a program to evaluate products against the 2002 requirements.39 Initially these requirements were established in collaboration with the central government, and they later were utilized by the public sector in general, and also in other nations. The Na- tional Archives 2002 requirements remain somewhat relevant, although no additional development has been underway for years. It is clear that the second version of Model Requirements for Management of Electronic Records, MoReq2, largely supplanted the UK standard, and subsequently the newer MoReq2010 may further supplant the UK standard.
84 INFORMATION GOVERNANCE
MoReq2010 “unbundles” some of the core requirements in MoReq2, and sets out functional requirements in modules. The approach seeks to permit the later creation of e-records software standards in various vertical industries such as defense, health care, fi nancial services, and legal services.
MoReq2010 is available free—all 525 pages of it (by comparison, the U.S. DoD 5015.2 standard is less than 120 pages long). For more information on MoReq2010, visit www.moreq2010.eu. The entire specifi cation may be downloaded at: http:// moreq2010.eu/pdf/moreq2010_vol1_v1_1_en.pdf.
MoReq2010 In November 2010, the DLM Forum, a European Commission–supported body, announced the availability of the fi nal draft of the MoReq2010 specifi cation for electronic records manage- ment systems (ERMS), following extensive public consultation. The fi nal specifi cation was published in mid-2011. 40
The DLM Forum explains that “With the growing demand for [electronic] re- cords management, across a broad spectrum of commercial, not-for-profi t, and gov- ernment organizations, MoReq2010 provides the fi rst practical specifi cation against which all organizations can take control of their corporate information. IT software and services vendors are also able to have their products tested and certifi ed that they meet the MoReq2010 specifi cation.” 41
MoReq2010 supersedes its predecessor MoReq2 and has the continued support and backing of the European Commission.
Australian ERM and Records Management Standards
Australia has adopted all three parts of ISO 16175 as its e-records management standard. 42 (For more detail on this standard go to ISO.org.)
Australia has long led the introduction of highly automated electronic document management systems and records management standards. Following the approval and release of the AS 4390 standard in 1996, the international records management com- munity began work on the development of an International standard. This work used AS 4390–1996 Records Management as its starting point.
Development of Australian Records Standards In 2002 Standards Australia published a new Australian Standard on records manage- ment, AS ISO 15489, based on the ISO 15489 international records management stan- dard. It differs only in its preface verbiage. 43 AS ISO 15489 carries through all these main components of AS 4390, but internationalizes the concepts and brings them up to date. The standards thereby codify Australian best practice but are also progressive in their recommendations.
Additional Relevant Australian Standards The Australian Government Recordkeeping Metadata Standard Version 2.0 pro- vides guidance on metadata elements and subelements for records management. It is a baseline tool that “describes information about records and the context in which they are captured and used in Australian Government agencies.” This standard is intended to help Australian agencies “meet business, accountability and archival requirements
INFORMATION GOVERNANCE POLICY DEVELOPMENT 85
in a systematic and consistent way by maintaining reliable, meaningful and accessible records.” The standard is written in two parts, the fi rst describing its purpose and features and the second outlining the specifi c metadata elements and subelements.44
The Australian Government Locator Service , AGLS, is published as AS 5044– 2010, the metadata standard to help fi nd and exchange information online. It updates the 2002 version, and includes changes made by the Dublin Core Metadata Initiative (DCMI).
Another standard, AS 5090:2003, “Work Process Analysis for Recordkeep- ing ,” complements AS ISO 15489 and provides guidance on understanding business g processes and workfl ow so that recordkeeping requirements may be determined. 45
Long-Term Digital Preservation
Although many organizations shuffl e dealing with digital preservation issues to the back burner, long-term digital preservation (LTDP) is a key area in which IG policy should be applied. LTDP methods, best practices, and standards should be applied to preserve an organization’s historical and vital records ( those without which it cannot operate or restart operations) and to maintain its corporate or organizational memory. The key standards that apply to LTDP are listed next.
The offi cial standard format for preserving electronic documents is PDF/A-1, based on PDF 1.4 originally developed by Adobe. ISO 19005–1:2005, “Document Manage- ment—Electronic Document File Format for Long-Term Preservation—Part 1: Use of PDF 1.4 (PDF/A-1),” is the published specifi cation for using PDF 1.4 for LTDP, which is applicable to e-documents that may contain not only text characters but also graphics (either raster or vector). 46
ISO 14721:2012 , “Space Data and Information Transfer Systems—Open Archival Information Systems—Reference Model (OAIS),” is applicable to LTDP. 47 ISO 14271 “specifi es a reference model for an open archival information system (OAIS). The pur- pose of ISO 14721 is to establish a system for archiving information, both digitalized and physical, with an organizational scheme composed of people who accept the re- sponsibility to preserve information and make it available to a designated commu- nity.” 48 The fragility of digital storage media combined with ongoing and sometimes rapid changes in computer software and hardware poses a fundamental challenge to ensuring access to trustworthy and reliable digital content over time. Eventually, ev- ery digital repository committed to long-term preservation of digital content must have a strategy to mitigate computer technology obsolescence. Toward this end, the
The ISO 30300 series of e-records standards are written for a managerial audi- ence and encourage ERM that is aligned to organizational objectives.
LTDP is a key area to which IG policy should be applied.
86 INFORMATION GOVERNANCE
Consultative Committee for Space Data Systems developed the OAIS reference model to support formal standards for the long-term preservation of space science data and information assets. OAIS was not designed as an implementation model.
OAIS is the lingua franca of digital preservation, as the international digital pres- ervation community has embraced it as the framework for viable and technologically sustainable digital preservation repositories. An LTDP strategy that is OAIS compliant offers the best means available today for preserving the digital heritage of all organizations, private and public. (See Chapter 17 .)
ISO TR 18492 (2005) , “ Long-Term Preservation of Electronic Document Based Information,” provides practical methodological guidance for the long-term preser- vation and retrieval of authentic electronic document-based information, when the retention period exceeds the expected life of the technology (hardware and software) used to create and maintain the information assets. ISO 18492 takes note of the role of ISO 15489 but does not cover processes for the capture, classifi cation, and disposition of authentic electronic document-based information.
ISO 16363:2012 , “ Space Data and Information Transfer Systems—Audit and Certifi cation of Trustworthy Digital Repositories,” “defi nes a recommended prac- tice for assessing the trustworthiness of digital repositories. It is applicable to the entire range of digital repositories.”49 It is an audit and certifi cation standard orga- nized into three broad categories: Organization Infrastructure, Digital Object Man- agement, and Technical Infrastructure and Security Risk Management. ISO 16363 represents the gold standard of audit and certifi cation for trustworthy digital repositories. (See Chapter 17 .)
Business Continuity Management
ISO 22301:2012, “Societal Security—Business Continuity Management Systems— Requirements,” spells out the requirements for creating and implementing a stan- dardized approach to business continuity management (BCM, also known as di- saster recovery [DR]), in the event an organization is hit with a disaster or major business interruption. 50 The guidelines can be applied to any organization regard- less of vertical industry or size. The specifi cation includes the “requirements to plan, establish, implement, operate, monitor, review, maintain and continually im- prove a documented management system to protect against, reduce the likelihood
An LTDP strategy that is OAIS compliant (based on ISO 14721) offers the best means available today for preserving the digital heritage of all organizations.
ISO 16363 represents the gold standard of audit and certifi cation for trustwor- thy digital repositories.
INFORMATION GOVERNANCE POLICY DEVELOPMENT 87
of occurrence, prepare for, respond to, and recover from disruptive incidents when they arise.”
The UK business continuity standard, BS25999-2, which heavily infl uenced the newer ISO standard, was withdrawn when ISO 22301 was released. 51 The business rationale is that, with the increasing globalization of business, ISO 22301 will allow and support more consistency worldwide not only in business continuity planning and practices but also will promote common terms and help to embed various ISO management systems standards within organizations. U.S.-based ANSI, Standards Australia, Standards Singapore, and other standards bodies also contributed to the development of ISO 22301.
Benefi ts of ISO 22301
■ Threat identifi cation and assessment. Discover, name, and evaluate potential seri- ous threats to the viability of the business.
■ Threat and recovery planning. so the impact and resultant downtime and recov- ery from real threats that do become incidents is minimized
■ Mission-critical process protection. Identifying key processes and taking steps to ensure they continue to operate even during a business interruption.
■ Stakeholder confi dence. Shows prudent management planning and business re- silience to internal and external stakeholders, including employees, business units, customers, and suppliers. 52
Making Your Best Practices and Standards Selections to Inform Your IG Framework
You must take into account your organization’s corporate culture, management style, and organizational goals when determining which best practices and standards should receive priority in your IG framework. However, you must step through your business rationale in discussions with your cross-functional IG team and fully document the reasons for your approach. Then you must present this approach and your draft IG
ISO 22301 spells out requirements for creating and implementing a standard- ized approach to business continuity management.
You must take into account your organization’s corporate culture, manage- ment style, and organizational goals when determining which best practice and standards should be selected for your IG framework.
88 INFORMATION GOVERNANCE
framework to your key stakeholders and be able to defend your determinations while allowing for input and adjustments. Perhaps you have overlooked some key factors that your larger stakeholder group uncovers, and their input should be folded into a fi nal draft of your IG framework.
Next, you are ready to begin developing IG policies that apply to various aspects of information use and management, in specifi c terms. You must detail the policies you expect employees to follow when handling information on various information deliv- ery platforms (e.g., e-mail, blogs, social media, mobile computing, cloud computing). It is helpful at this stage to collect and review all your current policies that apply and to gather some examples of published IG policies, particularly from peer organiza- tions and competitors (where possible). Of note: You should not just adopt another organization’s polices and believe that you are done with policy making. Rather, you must enter into a deliberative process, using your IG framework for guiding principles and considering the views and needs of your cross-functional IG team. Of paramount importance is to be sure to incorporate the alignment of your organizational goals and business objectives when crafting policy.
With each policy area, be sure that you have considered the input of your stake- holders, so that they will be more willing to buy into and comply with the new policies and so that the policies do not run counter to their business needs and required busi- ness processes. Otherwise, stakeholders will skirt, avoid, or halfheartedly follow the new IG policies, and the IG program risks failure.
Once you have fi nalized your policies, be sure to obtain necessary approvals from your executive sponsor and key senior managers.
Roles and Responsibilities
Policies will do nothing without people to advocate, support, and enforce them. So clear lines of authority and accountability must be drawn , and responsibilities must be assigned.
Overall IG program responsibility resides at the executive sponsor level, but beneath that, an IG program manager should drive team members toward mile- stones and business objectives and should shoulder the responsibility for day-to-day program activities, including implementing and monitoring key IG policy tasks. These tasks should be approved by executive stakeholders and assigned as appropri- ate to an employee’s functional area of expertise. For instance, the IG team member from legal may be assigned the responsibility for researching and determining legal requirements for retention of business records, perhaps working in conjunction with the IG team member from RM, who can provide additional input based on interviews with representatives from business units and additional RM research into best practices.
Lines of authority, accountability, and responsibility must be clearly drawn for the IG program to succeed.
INFORMATION GOVERNANCE POLICY DEVELOPMENT 89
Program Communications and Training
Your IG program must contain a communications and training component, as a stan- dard function. Your stakeholder audience must be made aware of the new policies and practices that are to be followed and how this new approach contributes toward the organization’s goals and business objectives.
The fi rst step in your communications plan is to identify and segment your stake- holder audiences and to customize or modify your message to the degree that is neces- sary to be effective. Communications to your IT team can have a more technical slant, and communications to your legal team can have some legal jargon and emphasize le- gal issues. The more forethought you put into crafting your communications strategy, the more effective it will be.
That is not to say that all messages must have several versions: Some core concepts l and goals should be emphasized in communications to all employees.
How should you communicate? The more ways you can get your IG message to your core stakeholder audiences, the more effective and lasting the message will be. So posters, newsletters, e-mail, text messages, internal blog or intranet posts, and company meetings should all be a part of the communications mix. Remember, the IG program requires not only training but re training, and the aim should be to create a compliance culture that is so prominent and expected that employees adopt the new practices and policies and integrate them into their daily activities. Ideally, employees will provide valuable input to help fi ne-tune and improve the IG program.
Training should take multiple avenues as well. Some can be classroom instruc- tion, some online learning, and you may want to create a series of training videos. But the training effort must be consistent and ongoing to maintain high levels of IG effectiveness. Certainly, this means you will need to add to your new hire training pro- gram for employees joining or transferring to your organization.
Program Controls, Monitoring, Auditing, and Enforcement
How do you know how well you are doing? You will need to develop metrics to de- termine the level of employee compliance, its impact on key operational areas, and progress made toward established business objectives.
Testing and auditing the program provides an opportunity to give feedback to employees on how well they are doing and to recommend changes they may make. But having objective feedback on key metrics also will allow for your executive sponsor to see where progress has been made and where improvements need to focus.
Communications regarding your IG program should be consistent and clear and somewhat customized for various stakeholder groups.
90 INFORMATION GOVERNANCE
CHAPTER SUMMARY: KEY POINTS
■ You must inform and frame IG policy with internal and external frameworks, models, best practices, and standards
■ The business user is the primary stakeholder of managed information.
■ Information management is important at all stages of the life cycle.
■ Legal stakeholders usually can mandate the preservation of what is most criti- cal, though often at great cost.
■ The IGRM was developed by the EDRM Project to foster communication among stakeholders and adoption of IG. It complements ARMA’s The Principles.
■ ISO 31000 is a broad risk management standard that applies to all types of businesses.
■ ISO/IEC 27001 and ISO/IEC 27002 are ISMS standards that provide guidance in the development of security controls.
■ ISO 15489 is the international RM standard.
■ The ICA-Req standard was adopted as ISO 16175. It does not contain a test- ing regime for certifi cation.
■ The ISO 30300 series of e-records standards are written for a managerial au- dience and encourage ERM that is aligned to organizational objectives.
■ DoD 5015.2 is the U.S. ERM standard; the European ERM standard is MoReq2010. Australia has adopted all three parts of ISO 16175 as its e-records management standard.
■ LTDP is a key area to which IG policy should be applied.
■ An LTDP strategy that is OAIS compliant (based on ISO 14721) offers the best means available today for preserving the digital heritage of all organizations.
■ ISO 16363 represents the gold standard of audit and certifi cation for trust- worthy digital repositories.
■ ISO 38500 is an international standard that provides high-level principles and guidance for senior executives and directors responsible for IT governance.
■ ISO 22301 spells out requirements for creating and implementing a standardized approach to business continuity management.
Clear penalties for policy violations must be communicated to employees so they know the seriousness of the IG program and how important it is in helping the orga- nization pursue its business goals and accomplish stated business objectives.
INFORMATION GOVERNANCE POLICY DEVELOPMENT 91
Notes
1. ARMA International, “Generally Accepted Recordkeeping Principles,” www.arma.org/r2/generally- accepted-br-recordkeeping-principles/copyright (accessed November 25, 2013).
2. ARMA International, “Information Governance Maturity Model,” www.arma.org/r2/generally- accepted-br-recordkeeping-principles/metrics (accessed November 25, 2013).
3. Electronic Discovery, “IGRM v3.0 Update: Privacy & Security Offi cers As Stakeholders – Electronic Discovery,” http://electronicdiscovery.info/igrm-v3-0-update-privacy-security-offi cers-as-stakehold- ers-electronic-discovery/ (accessed April 24, 2013).
4. EDRM, “Information Governance Reference Model (IGRM),” www.edrm.net/projects/igrm (accessed October 9, 2013).
5. Ibid. 6. Ibid. 7. Project Management Institute, A Guide to the Project Management Body of Knowledge (PMBOK Guide ),
4th ed. (Newtown Square, PA, Project Management Institute, 2008), ANSI/PMI 99-001-2008, pp. 273–312.
8. Kate Cumming, “Metadata Matters,” in Julie McLeod and Catherine Hare, eds., Managing Electronic Records , p. 34 (London: Facet, 2005).s
9. Marc Fresko, e-mail to author, May 13, 2012. 10. Hofman, “The Use of Standards and Models,” in Julie McLeod and Catherine Hare, eds., Managing
Electronic Records , p. 34 (London: Facet, 2005) pp. 20–21. s 11. Ibid. 12. International Organization for Standardization, “ISO 31000:2009 Risk Management—Principles and
Guidelines,” www.iso.org/iso/home/store/catalogue_tc/catalogue_detail.htm?csnumber=43170 (accessed April 22, 2013).
13. Ibid. 14. International Organization for Standardization, ISO/IEC 27001:2005, “Information Technology—
Security Techniques—Information Security Management Systems—Requirements,” www.iso.org/iso/ catalogue_detail?csnumber=42103 (accessed April 22, 2013).
15. International Organization for Standardization, ISO/IEC 27002:2005, “Information Technology— Security Techniques—Code of Practice for Information Security Management,” www.iso.org/iso/cata- logue_detail?csnumber=50297 (accessed July 23, 2012).
16. International Organization for Standardization, ISO/IEC 38500:2008, www.iso.org/iso/catalogue_ detail?csnumber=51639 (accessed March 12, 2013).
17. ISO 38500 IT Governance Standard, www.38500.org/ (accessed March 12, 2013). 18. International Organization for Standardization, ISO 15489-1: 2001 Information and Documentation—
Records Management. Part 1: General (Geneva: ISO, 2001), section 3.16. l
■ You must take into account your organization’s corporate culture, manage- ment style, and organizational goals when determining which best practices and standards should be selected for your IG framework.
■ Lines of authority, accountability, and responsibility must be clearly drawn for the IG program to succeed.
■ Communications regarding your IG program should be consistent and clear and somewhat customized for various stakeholder groups.
■ IG program audits are an opportunity to improve training and compliance, not to punish employees.
CHAPTER SUMMARY: KEY POINTS (Continued )
92 INFORMATION GOVERNANCE
19. National Archives of Australia, www.naa.gov.au/records-management/publications/DIRKS-manual .aspx (accessed October 15, 2012).
20. International Council on Archives, “ICA-Req: Principles and Functional Requirements for Records in Electronic Offi ce Environments: Guidelines and Training Material,” November 29, 2011, www .ica.org/11696/activities-and-projects/icareq-principles-and-functional-requirements-for-records-in- electronic-offi ce-environments-guidelines-and-training-material.html.
21. Council of Australasian Archives and Records Authorities, www.caara.org.au/ (accessed May 3, 2012). 22. Adrian Cunningham, blog post comment, May 11, 2011. http://thinkingrecords.co.uk/2011/05/06/
how-moreq-2010-differs-from-previous-electronic-records-management-erm-system-specifi cations/. 23. Ibid. 24. “Relationship between the ISO 30300 Series of Standards and Other Products of ISO/TC 46/SC
11: Records Processes and Controls,” White Paper, ISO TC46/SC11- Archives/Records Management (March 2012), www.iso30300.es/wp-content/uploads/2012/03/ISOTC46SC11_White_paper_rela- tionship_30300_technical_standards12032012v6.pdf
25. Ibid. 26. Julie Gable, Information Management Journal, November 1, 2002, www.thefreelibrary.com/Everything-
+you+wanted+to+know+about+DoD+5015.2:+the+standard+is+not+a…-a095630076. 27. These standards were developed by the CGSB (Canadian General Standards Board), which is a stan-
dards-writing agency within Public Works and Government Services Canada (a department of the federal government). It is accredited by the Standards Council of Canada as a standards development agency. The Council must certify that standards have been developed by the required procedures be- fore it will designate them as being National Standards of Canada. 72.34 incorporates by reference as “normative references”: (1) many of the standards of the International Organization for Standardiza- tion (ISO) in Geneva, Switzerland. (“ISO,” derived from the Greek word isos (equal) so as to provide s a common acronym for all languages); and (2) several of the standards of the Canadian Standards Association (CSA). The “Normative references” section of 72.34 (p. 2) states that these “referenced documents are indispensable for the application of this document.” 72.11 cites (p. 2, “Applicable Pub- lications”) several standards of the American National Standards Institute/Association for Information and Image Management (ANSI/AIIM) as publications “applicable to this standard.” The process by which the National Standards of Canada are created and maintained is described within the standards themselves (reverse side of the front cover), and on the CGSB’s Web site (see, “Standards Develop- ment”), from which Web site these standards may be obtained; http://www.ongc-cgsb.gc.ca.
28. The Canada Revenue Agency (CRA) informs the public of its policies and procedures by means, among others, of its Information Circulars (IC’s), and s GST/HST Memoranda . (GST: goods and services tax; HST: harmonized sales tax, i.e. , the harmonization of federal and provincial sales taxes into one retail sales tax.) In particular, see: IC05-1 , dated June 2010, entitled, Electronic Record Keeping , paragraphs 24, 26 and 28.g Note that use of the National Standard cited in paragraph 26, Microfi lm and Electronic Images as Documen- tary Evidence CAN/CGSB-72.11-93 is mandatory for, “Imaging and microfi lm (including microfi che) reproductions of books of original entry and source documents . . .” Paragraph 24 recommends the use of the newer national standard, Electronic Records as Documentary Evidence CAN/CGSB-72.34-2005, “To ensure the reliability, integrity and authenticity of electronic records.” However, if this newer standard is given the same treatment by CRA as the older standard, it will be made mandatory as well. And similar statements appear in the GST Memoranda, Computerized Records 500-1-2, s Books and Records 500-1. IC05-s 1. Electronic Record Keeping , concludes with the note, “Most Canada Revenue Agency publications areg available on the CRA Web site www.cra.gc.ca under the heading ‘Forms and Publications.’”
29. There are more than 200 specifi c compliance tests that can be applied to determine if the principles of 72.34 are being complied with. The analysts—a combined team of records management and legal expertise—analyze: (1) the nature of the business involved; (2) the uses and value of its records for its various functions; (3) the likelihood and risk of the various types of its records being the subject of legal proceedings, or of their being challenged by some regulating authority; and (4) the consequences of the unavailability of acceptable records—for example, the consequences of its records not being accepted in legal proceedings. Similarly, in regard to the older National Standard of Canada, 72.11, there is a comparable series of more than 50 tests that can be applied to determine the state of compliance with its principles.
30. Electronic Records as Documentary Evidence CAN/CGSB-72.34-2005 (“72.34”), clause 5.4.3 c) at p. 17; and Microfi lm and Electronic Images as Documentary Evidence CAN/CGSB-72.11-93 (“72.11”), paragraph 4.1.2 at p. 2, supra note 49.
31. 72.34, Clause 5.4.3, ibid. 32. “Admissibility” refers to the procedure by which a presiding judge determines if a record or other
proffered evidence is acceptable as evidence according the rules of evidence. “Electronic discovery”
INFORMATION GOVERNANCE POLICY DEVELOPMENT 93
is the compulsory exchange of relevant records by the parties to legal proceedings prior to trial.” As to the admissibility of records as evidence see: Ken Chasse, “The Admissibility of Electronic Business Records” (2010), 8 Canadian Journal of Law and Technology 105; and Ken Chasse, “Electronic Re- cords for Evidence and Disclosure and Discovery” (2011) 57 The Criminal Law Quarterly 284. For the electronic discovery of records see: Ken Chasse, “Electronic Discovery— Sedona Canada is Inadequate on Records Management—Here’s Sedona Canada in Amended Form,” Canadian Journal of Law and Tech- nology 9 (2011): 135; and Ken Chasse, “Electronic Discovery in the Criminal Court System,” Canadian Criminal Law Review 14 (2010): 111. See also note 18 infra , and accompanying text.
33. For the province of Quebec, comparable provisions are contained in Articles 2831-2842, 2859-2862, 2869-2874 of Book 7 “Evidence” of the Civil Code of Quebec, S.Q. 1991, c. C-64, to be read in con- junction with, An Act to Establish a Legal Framework for Information Technology, R.S.Q. 2001, c. C-1.1, ss. 2, 5-8, and 68.
34. For the legislative jurisdiction of the federal and provincial governments in Canada, see The Constitu- tion Act, 1867 (U.K.) 30 & 31 Victoria, c. 3, s. 91 (federal), and s. 92 (provincial), www.canlii.org/en/ca/ laws/stat/30—31-vict-c-3/latest/30—31-vict-c-3.html.
35. The two provinces of Alberta and Newfoundland and Labrador do not have business record provisions in their Evidence Acts. Therefore “admissibility” would be determined in those jurisdictions by way of the court decisions that defi ne the applicable common law rules; such decisions as, Ares v. Venner [1970]r S.C.R. 608, 14 D.L.R. (3d) 4 (S.C.C.), and decisions that have applied it.
36. See for example, the Canada Evidence Act, R.S.C. 1985, c. C-5, ss. 31.1-31.8; Alberta Evidence Act, R.S.A. 2000, c. A-18, ss. 41.1-41.8; (Ontario) Evidence Act, R.S.O. 1990, c. E.23, s. 34.1; and the (Nova Scotia) Evidence Act, R.S.N.S. 1989, c. 154, ss. 23A-23G. The Evidence Acts of the two provinces of British Columbia and Newfoundland and Labrador do not contain electronic record provisions. However, because an electronic record is no better than the quality of the record system in which it is recorded or stored, its “integrity” (reliability, credibility) will have to be determined under the other provincial laws that determine the admissibility of records as evidence.
37. The electronic record provisions have been in the Evidence Acts in Canada since 2000. They have been applied to admit electronic records into evidence, but they have not yet received any detailed analysis by the courts.
38. This is the wording used in, for example, s. 41.6 of the Alberta Evidence Act, s. 34.1(8) of the (Ontario) Evidence Act; and s. 23F of the (Nova Scotia) Evidence Act, supra note 10. Section 31.5 of the Canada Evidence Act, supra note 58, uses the same wording, the only signifi cant difference being that the word “document” is used instead of “record.” For the province of Quebec, see sections 12 and 68 of, An Act to Establish a Legal Framework for Information Technology, R.S.Q., chapter C-1.1.
39. “Giving Value: Funding Priorities for UK Archives 2005–2010, a key new report launched by the Na- tional Council on Archives (NCA) in November 2005,” www.nationalarchives.gov.uk/documents/stan- dards_guidance.pdf (accessed October 15, 2012).
40. DLM Forum Foundation, MoReq2010 ® : Modular Requirements for Records Systems—Volume 1: Core Ser- vices & Plug-in Modules, 2011, http://moreq2010.eu/ (accessed May 7, 2012, published in paper form ass ISBN 978-92-79-18519-9 by the Publications Offi ce of the European Communities, Luxembourg.
41. DLM Forum, Information Governance across Europe, www.dlmforum.eu/ (accessed December 14, 2010).
42. National Archives of Australia, “Australian and International Standards,” 2012, www.naa.gov.au /records-management/strategic-information/standards/ASISOstandards.aspx (accessed July 16, 2012).
43. E-mail to author from Marc Fresko, May 13, 2012. 44. National Archives of Australia, “Australian Government Recordkeeping Metadata Standard,” 2012,
www.naa.gov.au/records-management/publications/agrk-metadata-standard.aspx (accessed July 16, 2012).
45. National Archives of Australia, “Australian and International Standards,” 2012, www.naa.gov.au /records-management/strategic-information/standards/ASISOstandards.aspx (accessed July 16, 2012).
46. International Organization for Standardization, ISO 19005-1:2005, “Document Management— Electronic Document File Format for Long-Term Preservation—Part 1: Use of PDF 1.4 (PDF/A-1),” www.iso.org/iso/catalogue_detail?csnumber=38920 (accessed July 23, 2012).
47. International Organization for Standardization, ISO 14721:2012, “Space Data and Information Trans- fer Systems Open Archival Information System—Reference Model,” www.iso.org/iso/iso_catalogue/ catalogue_ics/catalogue_detail_ics.htm?csnumber=57284 (accessed November 25, 2013).
48. Ibid. 49. International Organization for Standardization, ISO 16363:2012, “Space Data and Information
Transfer Systems—Audit and Certifi cation of Trustworthy Digital Repositories,” www.iso.org/iso/ iso_catalogue/catalogue_tc/catalogue_detail.htm?csnumber=56510 (accessed July 23, 2012).
94 INFORMATION GOVERNANCE
50. International Organization for Standardization, ISO 22301:2012 “Societal Security—Business Conti- nuity Management Systems—Requirements,” www.iso.org/iso/catalogue_detail?csnumber=50038 (ac- cessed April 21, 2013).
51. International Organization for Standardization, “ISO Business Continuity Standard 22301 to Replace BS 25999-2,” www.continuityforum.org/content/news/165318/iso-business-continuity-standard-22301- replace-bs-25999-2 (accessed April 21, 2013).
52. BSI, “ISO 22301 Business Continuity Management,” www.bsigroup.com/en-GB/iso-22301-business- continuity (accessed April 21, 2013).
PA RT T H R E E Information Governance Key Impact Areas Based on the IG Reference Model
97
Business Considerations for a Successful IG Program
C H A P T E R 7
By Barclay T. Blair
T he business case for information governance (IG) programs has historically been diffi cult to justify. It is hard to apply a strict, short-term return on invest- ment (ROI) calculation. A lot of time, effort, and expense is involved before true
economic benefi ts can be realized. So a commitment to the long view and an un- derstanding of the many areas where an organization will improve as a result of a successful IG program are needed. But the bottom line is that reducing exposure to business risk, improving the quality and security of data and e-documents, cutting out unneeded stored information, and streamlining information technology (IT) develop- ment while focusing on business results add up to better organizational health and viability and, ultimately, an improved bottom line.
Let us take a step back and examine the major issues affecting information costing and calculating the real cost of holding information, consider Big Data and e-discov- ery ramifi cations, and introduce some new concepts that may help frame information costing issues differently for business managers. Getting a good handle on the true cost of information is essential to governing it properly, shifting resources to higher- value information, and discarding information that has no discernible business value and carries inherent, avoidable risks.
Changing Information Environment
The information environment is changing. Data volumes are growing, but unstructured information (such as e-mail, word processing documents, social media posts) is grow- ing faster than our ability to manage it. Some unstructured information has more structure than others containing some identifi able metadata (e.g., e-mail messages all have a header, subject line, time/date stamp, and message body). This is often termed as semistructured information, but for purposes of this book, we use the term “unstruc-d tured information” to include semistructured information as well.
The volume of unstructured information is growing dramatically. Analysts estimate that, over the next decade, the amount of data worldwide will grow by 44 times (from .8 zettabytes to 35 zettabytes: 1 zettabyte = 1 trillion gigabytes). 1 However, the volume
98 INFORMATION GOVERNANCE
of unstructured information will actually grow 50 percent faster than structured data. Analysts also estimate that fully 90 percent of unstructured information will require formal governance and management by 2020. In other words, the problem of unstruc- tured IG is growing faster than the problem of data volume itself.
What makes unstructured information so challenging? There are several factors, including
■ Horizontal versus vertical. Unstructured information is typically not clearly at- tached to a department or a business function. Unlike the vertical focus of an enterprise resource planning (ERP) database, for example, an e-mail system serves multiple business functions—from employee communication to fi ling with regulators—for all parts of the business. Unstructured information is much more horizontal, making it diffi cult to develop and apply business rules.
■ Formality. The tools and applications used to create unstructured information often engender informality and the sharing of opinions that can be problematic in litigation, investigations, and audits—as has been repeatedly demonstrated in front-page stories over the past decade. This problem is not likely to get any easier as social media technologies and mobile devices become more common in the enterprise.
■ Management location. Unstructured information does not have a single, obvious home. Although e-mail systems rely on central messaging servers, e-mail is just as likely to be found on a fi le share, mobile device, or laptop hard drive. This makes the application of management rules more diffi cult than the application of the same rules in structured systems, where there is a close marriage between the application and the database.
■ “Ownership” issues. Employees do not think that they “own” data in an accounts receivable system like they “own” their e-mail or documents stored on their hard drive. Although such information generally has a single owner (i.e., the organization itself), this non-ownership mind-set can make the imposition of management rules for unstructured information more challenging than for structured data.
■ Classifi cation. The business purpose of a database is generally determined prior to its design. Unlike structured information, the business purpose of unstruc- tured information is diffi cult to infer from the application that created or stores the information. A word processing fi le stored in a collaboration environment could be a multimillion-dollar contract or a lunch menu. As such, classifi ca- tion of unstructured content is more complex and expensive than structured information.
Taken together, these factors reveal a simple truth: Managing unstructured infor- mation is a separate and distinct discipline from managing databases. It requires different
The problem of unstructured IG is growing faster than the problem of data volume itself.
BUSINESS CONSIDERATIONS FOR A SUCCESSFUL IG PROGRAM 99
methods and tools. Moreover, determining the costs and benefi ts of owning and man- aging unstructured information is a unique—but critical—challenge.
The governance of unstructured information creates enormous complexity and risk for business managers to consider while making it diffi cult for organizations to generate real value from all this information. Despite the looming crisis, most organi- zations have limited ability to quantify the real cost of owning and managing unstruc- tured information. Determining the total cost of owning unstructured information is an essential precursor to managing and monetizing that information while cutting information costs—key steps in driving profi t for the enterprise.
Storing things is cheap . . . I’ve tended to take the attitude, “Don’t throw elec- tronic things away.”
—Data scientist quoted in Anne Eisenberg, “What 23 Years of E-Mail May Say About You,” New York Times, ” April 7, 2012
The company spent $900,000 to produce an amount of data that would con- sume less than one-quarter of the available capacity of an ordinary DVD.
— Nicholas M. Pace and Laura Zakaras, “Where the Money Goes: Understanding Litigant Expenditures for Producing Electronic
Discovery,” RAND Institute for Civil Justice, 2012
Calculating Information Costs
We are not very good at fi guring out what information costs— truly costs. Many orga- nizations act as if storage is an infi nitely renewable resource and the only cost of in- formation. But, somehow, enterprise storage spending rises each year and IT support costs rise, even as the root commodity (disk drives) grows ever cheaper and denser. Obviously, they are not considering labor and overhead costs incurred with managing information, and the additional knowledge worker time wasted sifting through moun- tains of information to fi nd what they need.
Some of this myopic focus on disk storage cost is simple ignorance. The executive who concludes that a terabyte costs less than a nice meal at a restaurant after browsing storage drives on the shelves of a favorite big-box retailer on the weekend is of little help.
Rising information storage costs cannot be dismissed. Each year the billions that or- ganizations worldwide spend on storage grows, even though the cost of a hard drive is less than 1 percent of what it was about a decade ago. We have treated storage as a resource that has no cost to the organization outside of the initial capital outlay and basic operational costs. This is shortsighted and outdated.
Some of the reason that managers and executives have diffi culty comprehending the true cost of information is old-fashioned miscommunication. IT departments do not see (or pay for) the full cost of e-discovery and litigation. Even when IT “part- ners” with litigators, what IT learn rarely drives strategic IT decisions. Conversely, law departments (and outside fi rms) rarely own and pay for the IT consequences of their litigation strategies. It is as if when the litigation fi re needs to be put out, nobody calculates the cost of gasoline and water for the fi re trucks.
100 INFORMATION GOVERNANCE
But calculating the cost of information—especially information that does not sit neatly in the rows and columns of enterprise database “systems of record”—is complex. It is more art than science. And it is more politics than art. There is no Aristotelian Golden Mean for information.
The true cost of mismanaging information is much more profound than simply calculating storage unit costs. It is the cost of opportunity lost—the lost benefi t of in- formation that is disorganized, created and then forgotten, cast aside and left to rot. It is the cost of information that cannot be brought to market. Organizations that realize this, and invest in managing and leveraging their unstructured information, will be the winners of the next decade.
Most organizations own vast pools of information that is effectively “dark”: They do not know what it is, where it is, who is responsible for managing it, or whether it is an asset or a liability. It is not classifi ed, indexed, or managed according to the or- ganization’s own policies. It sits in shared drives, mobile devices, abandoned content systems, single-purpose cloud repositories, legacy systems, and outdated archives.
And when the light is fi nally fl icked on for the fi rst time by an intensive hunt for information during e-discovery, this dark information can turn out to be a liability. An e-mail message about “paying off fat people who are a little afraid of some silly lung problem” might seem innocent—until it is placed in front of a jury as evidence that a drug company did not care that its diet drug was allegedly killing people. 2
The importance of understanding the total cost of owning unstructured informa- tion is growing. We are at the beginning of a “seismic economic shift” in the informa- tion landscape, one that promises to not only “reinvent society,” (according to an MIT data scientist) but also to create “the new oil . . . a new asset class touching all aspects of society.” 3
Big Data Opportunities and Challenges
We are entering the epoch of Big Data—an era of Internet-scale enterprise infrastruc- ture, powerful analytical tools, and massive data sets from which we can potentially wring profound new insights about business, society, and ourselves. It is an epoch that, according to the consulting fi rm McKinsey, promises to save the European Union public sector billions of euros, increase retailer margins by 60 percent, and reduce U.S. national health care spending by 8 percent, while creating hundreds of thousands of jobs. 4 Sounds great, right?
However, the early days of this epoch are unfolding in almost total ignorance of the true cost of information. In the near nirvana contemplated by some Big Data
Smart leaders across industries will see using big data for what it is: a manage- ment revolution.
—Andrew McAfee and Erik Brynjolfsson, “Big Data: The Management Revolution,” Harvard Business Review ” (October 2012)
BUSINESS CONSIDERATIONS FOR A SUCCESSFUL IG PROGRAM 101
proponents, all data is good, and more data is better . Yet it would be an exaggeration to r say that there is no awareness of potential Big Data downsides. A recent study by the Pew Research Center was positive overall but did note concerns about privacy, social control, misinformation, civil rights abuses, and the possibility of simply being over- whelmed by the deluge of information. 5
But the real-world burdens of managing, protecting, searching, classifying, retain- ing, producing, and migrating unstructured information are foreign to many Big Data cheerleaders. This may be because the Big Data hype cycle 6 is not yet in the “trough of disillusionment” where the reality of corporate culture and complex legal require- ments sets in. But set in it will, and when it does, the demand for intelligent analysis of costs and benefi ts will be high.
IG professionals must be ready for these new challenges and opportunities—ready with new models for thinking about unstructured information. Models that calculate the risks of keeping too much of the wrong information as well as the s benefi ts of clean,s reliable, and accessible pools of the right information. Models that drive desirable behavior in the enterprise, and position organizations to succeed on the “next frontier for innovation, competition, and productivity.”7
Full Cost Accounting for Information
It is diffi cult for organizations to make educated decisions about unstructured infor- mation without knowing its full cost. Models like total cost of ownership (TCO) and ROI are designed for this purpose and have much in common with full cost account- ing (FCA) models. FCA seeks to create a complete picture of costs that includes past, g future, direct, and indirect costs rather than direct cash outlays alone.
FCA has been used for many purposes, including the decidedly earthbound task of determining what it costs to take out the garbage and the loftier task of calculating how much the International Space Station really costs. A closely related concept, often called triple bottom line, has gained traction in the world of environmental account- ing, positing that organizations must take into account societal and environmental costs as well as monetary costs.
The U.S. Environmental Protection Agency promotes the use of FCA for mu- nicipal waste management, and several states have adopted laws requiring its use. It is fascinating—and no accident—that this accounting model has been widely used to calculate the full cost of managing an unwanted by-product of modern life. The anal- ogy to outdated, duplicate, and unmanaged unstructured information is clear.
Applying the principles of FCA to information can increase cost transparency and drive better management decisions. In municipal garbage systems where citizens do not see a separate bill for taking out the garbage, it is more diffi cult to get new
IG professionals must be ready with new models that calculate the risks of stor- ing too much of the wrong information and also the benefi ts of clean, reliable, accessible information.
102 INFORMATION GOVERNANCE
spending on waste management approved. 8 Without visibility into the true cost, how can citizens—or CEOs—make informed decisions?
Responsible, innovative managers and executives should investigate FCA models for calculating the total cost of owning unstructured information. Consider costs such as:
■ General and administrative costs, such as cost of IT operations and personnel, facilities, and technical support.
■ Productivity gains or losses related to the information. s ■ Legal and e-discovery costs associated with the information and information systems. y ■ Indirect costs, such as the accounting, billing, clerical support, contract manage-
ment, insurance, payroll, purchasing, and so on. ■ Up-front costs, such as the acquisition of the system, integration and confi gura-
tion, and training. This should include the depreciation of capital outlays. ■ Future costs, such as maintenance, migration, and decommissioning of informa-
tion systems. Future outlays should be amortized.
Calculating the Cost of Owning Unstructured Information
Any system designed to calculate the cost or benefi t of a business strategy is inher- ently political. That is, it is an argument designed to convince an t audience. Well-known models like TCO and ROI are primarily decision tools designed to help organizations predict the economic consequences of a decision. While there are certainly objective truths about the information environment, human decision making is a complex and imperfect process. There are plenty of excellent guides on how to create a standard TCO or ROI. That is not our purpose here. Rather, we want to inspire creative think- ing about how to calculate the cost of owning unstructured information and help or- ganizations minimize the risk—and maximize the value—of unstructured information.
Any economic model for calculating the cost of unstructured information depends on reliable facts. But facts can be hard to come by. A client recently went in search of an accurate number for the annual cost per terabyte of Tier 1 storage in her company. The company’s storage environment was completely outsourced, leading her to believe that the number would be transparent and easy to fi nd. However, after days spent poring over the massive contract, she was no closer to the truth. Although there was a line item for storage costs, the true costs were buried in “complexity fees” and other opaque terms.
Organizations need tools that help them establish facts about their unstructured information environment. The business case for better management depends on these facts. Look for tools that can help you:
■ Find unstructured information wherever it resides across the enterprise, including s e-mail systems, shared network drives, legacy content management systems, and archives.
Organizations can learn from accounting models used by cities to calculate the total cost of managing municipal waste and apply them to the IG problem.
BUSINESS CONSIDERATIONS FOR A SUCCESSFUL IG PROGRAM 103
■ Enable fast and intuitive access to basic metrics , such as size, date of last access,s and fi le type.
■ Provide sophisticated analysis of the nature of the content itself to drive classifi ca-s tion and information life cycle decisions.
■ Deliver visibility into the environment through dashboards that are easy to fors nonspecialists to confi gure and use.
Sources of Cost
Unstructured information is ubiquitous. It is typically not the product of a single-pur- pose business application. It often has no clearly defi ned owner. It is endlessly duplicat- ed and transmitted across the organization. Determining where and how unstructured information generates cost is diffi cult.
However, doing so is possible. Our research shows that at least 10 key factors that s drive the total cost of owning unstructured information. These 10 factors identify where organizations typically spend money throughout the life cycle of managing un- structured information. These factors are listed in Figure 7.1 , along with examples of elements that typically increase cost (“Cost Drivers,” on the left side) and elements that typically reduce costs (“Cost Reducers,” on the right side).
1. E-discovery: fi nding, processing, and producing information to support law- suits, investigations, and audits. Unstructured information is typically the most common target in e-discovery, and a poorly managed information environment can add millions of dollars in cost to large lawsuits. Simply reviewing a gigabyte of information for litigation can cost $14,000 or more. 9
2. Disposition: getting rid of information that no longer has value because it is duplicate, out of date, or has no value to the business. In poorly man- aged information environments, separating the wheat from the chaff can cost large organizations millions of dollars. For enterprises with frequent litigation, the risk of throwing away the wrong piece of information only increases risk and cost. Better management and smart IG tools drive costs down.
3. Classifi cation and organization: keeping unstructured information organized so that employees can use it. It also is necessary so management rules supporting privacy, privilege, confi dentiality, retention, and other requirements can be applied.
4. Digitization and automation. Many business processes continue to be a combi- nation of digital, automated steps and paper-based, manual steps. Automating
Identifying and building consensus on the sources of cost for unstructured information is critical to any TCO or ROI calculation. It is critical that all stake- holders agree on these sources, or they will not incorporate the output of the calculation in their strategy and planning.
104 INFORMATION GOVERNANCE
and digitizing these processes requires investment but also can drive signifi - cant returns. For example, studies have shown that automating accounts pay- able “can reduce invoice processing costs by 90 percent.”10
5. Storage and network infrastructure: the cost of the devices, networks, software, and labor required to store unstructured information. Although the cost of the baseline commodity (i.e., a gigabyte of storage space) continues to fall, for most organizations overall volume growth and complexity means that storage budgets go up each year. For example, between 2000 and 2010, organization more than doubled the amount they spent on storage-related software even though the cost of raw hard drive space dropped by almost 100 times. 11
6. Information search, access, and collaboration: the cost of hardware, software, and services designed to ensure that information is available to those who need it, when they need it. This typically includes enterprise content management systems, enterprise search, case management, and the infrastructure necessary to support employee access and use of these systems.
7. Migration: the cost of moving unstructured information from outdated sys- tems to current systems. In poorly managed information environments, the cost of migration can be very high—so high that some organizations maintain legacy systems long after they are no longer supported by the vendor just to avoid (more likely, simply to defer ) the migration cost and complexity.rr
8. Policy management and compliance: the cost of developing, implementing, enforcing, and maintaining IG policies on unstructured information. Good policies, consistently enforced, will drive down the total cost of owning un- structured information.
9. Discovering and structuring business processes: the cost of identifying, improv- ing, and systematizing or “routinizing” business processes that are currently ad hoc and disorganized. Typical examples include contract management and
Cost Drivers: Examples
Outdoted, unenforced policies
Poorly defined information ownership and governance
Open loop, reactive e-discovery processes
Uncontrolled information respositiories
Modernist, paper-focused information rules
Ad hoc, unstructured business processes
Disconnected governance programs
Formal, communicated, and enforced policies
Automated classification and organization
Defensible deletion and selective content migration
Data maps
Proactive, repeatable e-discovery procedures
Clear corporate governance
Managed and structured repositories
Cost Reducers: Examples
1
2
3
4
5
6
7
8
9
10
E-Discovery
Disposition
Classification and Organization
Digitization and Automation
Storage and Network Infrastructure
Information Search, Access, Collaboration
Migration
Policy Management and Compliance
Discovering and Structuring Business Processes
Knowledge Capture and Transfer
Figure 7.1 Key Factors Driving Cost Source: Barclay T. Blair
BUSINESS CONSIDERATIONS FOR A SUCCESSFUL IG PROGRAM 105
accounts receivable as well as revenue-related activities, such as sales and cus- tomer support. Moving from informal e-mail and document-based processes to fi xed work fl ows drives down cost.
10. Knowledge capture and transfer: the cost of capturing critical business knowl- edge held at the department and employee level and putting that information in a form that enables other employees and parts of the organization to ben- efi t from it. Examples include intranets and their more contemporary cousins such as wikis, blogs, and enterprise social media platforms.
The Path to Information Value
At its peak during World War II, the Brooklyn Navy Yard had 70,000 people coming to work every day. The site was once America’s premier shipbuilding facility, build- ing the steam-powered Ohio in 1820 and the aircraft carrier USS Independence in the 1950s. But the site fell apart after it was decommissioned in the 1960s. Today, an “Admiral’s Row” of Second Empire–style mansions once occupied by naval offi cers are an extraordinary sight, with gnarled oak trees pushing through the rotting mansard roofs. 12
Seventy percent of managers and executives say data are “extremely impor- tant” for creating competitive advantage. “The key, of course, is knowing which data matter, who within a company needs them, and fi nding ways to get that data into users’ hands.”
— The Economist Intelligence Unit, “Levelling the Playing Field: How Companies Use Data to Create Advantage” (January 2011)
However, after decades of decay, the Navy Yard is being reborn as the home of YY hundreds of businesses—from major movie studios to artisanal whisky makers—taking advantage of abundant space and a desirable location. There were three phases in the yard’s rebirth:
1. Clean. Survey the site to determine what had value and what did not. Dispose of toxic waste and rotting buildings, and modernize the infrastructure.
2. Build and maintain. Implement a plan to continuously improve, upgrade, and maintain the facility.
3. Monetize. Lease the space.
Most organizations face a similar problem. However, our Navy Yards are the vast YY piles of unstructured information that were created with little thought to how and when the pile might go away. They are records management programs built for a dif- ferent era—like an automobile with a metal dashboard, six ashtrays, and no seat belts. Our Navy Yards are information environments no longer fi t for purpose in the Big YY Data era, overwhelmed by volume and complexity.
We are doing a bad job at managing information. McKinsey estimates that in some circumstances, companies are using up to 80 percent of their infrastructure to store duplicate data.13 Nearly half of respondents in a survey ViaLumina recently conducted
106 INFORMATION GOVERNANCE
said that at least 50 percent of the information in their organization is duplicate, out- dated, or unnecessary. 14 We can do better.
1. Clean
We should put the Navy Yard’s blueprint to work, fi rst by identifying our piles of rot-YY ting unstructured information. Duplicate information. Information that has not been accessed in years. Information that no longer supports a business process and has little value. Information that we have no legal obligation to keep. The economics of such “defensible deletion” projects can be compelling simply on the basis of recovering the storage space and thus reallocating capital that would have been spent on the annual storage purchase.
2. Build and Maintain
Cleaning up the Navy Yard is only the fi rst step. We cannot repeat the past mistakes.YY We avoid this by building and maintaining an IG program that establishes our infor- mation constitution (why), laws (what), and regulations (how). We need a corporate governance, compliance, and audit plan that gives the program teeth, and a technology infrastructure that makes it real. It must be a defensible program to ensure we comply with the law and manage regulatory risk.
3. Monetize
IG is a means to an end, and that end is value creation. IG also mitigates risk and drives down cost. But extracting value is the key. Although monetization and value creation often are associated with structured data, new tools and techniques create exciting new opportunities for value creation from unstructured information.
For example, what if an organization could use sophisticated analytics on the e- mail account of their top salesperson (the more years of e-mail the better), look for markers of success, then train and hire salespeople based on that template? What is the pattern of a salesperson’s communications with customers and prospects in her territory? What is the substance of the communications? What is the tone? When do successful salespeople communicate? How are the patterns different between suc- cessful deals and failed deals? What knowledge and insight resides in the thousands of messages and gigabytes of content? The tools and techniques of Big Data applied to e-mail can bring powerful business insights. However, we have to know what questions to ask. According to Computerworld , “the hardest part of using big data is trying to get business people to sit down and defi ne what they want out of the huge amount of unstructured and semi-structured data that is available to enterprises these days.”15
Key steps in driving information value are: (1) clean; (2) build and maintain; and (3) monetize.
BUSINESS CONSIDERATIONS FOR A SUCCESSFUL IG PROGRAM 107
The analytics challenges of Big Data create opportunities. For example, McKinsey pre- dicts that demand for “deep analytical talent in the United States could be 50 to 60 percent greater than its projected supply by 2018.” A chief reason for this gap is that “this type of talent is diffi cult to produce, taking years of training in the case of some- one with intrinsic mathematical abilities.” However, the more profound opportunity is for the “1.5 million extra additional managers and analysts in the United States who can ask the right questions and consume the results of the analysis of big data effectively.” 16
Some companies are using analytics to set prices. For example, the largest dis- tributor of heating oil in the United States sets prices on the fl y, based on commodity prices and customer retention risks. 17 In a case that caught the attention of morning news shows, with breathless headlines like “Are Mac Users Paying More?” an online travel company revealed that “Mac users are 40 percent more likely to book four or fi ve-star hotels . . . compared to PC users.”18 Despite the headlines, the company was not charging Mac users more. Rather, computer brand was a variable used to deter- mine which products were highlighted.
The path to information value is not necessarily linear. Different parts of your business may achieve maturity at different rates, driven by the unique risks and op- portunities of the information they possess.
Challenging the Culture
The best models for calculating the total cost of owning unstructured are those that information professionals can use to challenge and change organizational culture. Much of the unstructured information that represents the greatest cost and risk to organizations is created, communicated, and managed directly by employees—that is, by human beings. As such, better IG relies in part on improving the way those human beings use and manage information.
New Information Models
The “information calorie” and “information cap-and-trade,” explored next, are two new models designed to help with the challenge of governing information.
Table 7.1 Key Steps in the IG Process
1. Clean 2. Build and Maintain 3. Monetize
Information inventory IG policies and procedures Create value through information, e.g., drive sales and improve customer satisfaction
Defensible deletion Corporate governance, compliance and audit
Business insights
Records retention and legal hold Technology Increase margins
Source: Barclay T. Blair
108 INFORMATION GOVERNANCE
Information Calorie
The Western world is suffering from an embarrassment of riches when it comes to calories. The calorie has been weaponized in the form of tasty, cheap, and fast food loaded with sugar and fat. Even a cup of “coffee” can contain as much as 800 calories.19 We have gotten very, very good at maximizing available calories, at a staggering cost: $190 billion per year in additional medical spending as a result of obesity in the United States, greater than the cost of smoking. 20
Governments are taking action. A new national health care law in the United States requires restaurant chains to disclose calorie counts for the food they sell by 2013, building on similar state laws.21 Calories are not inherently bad. We would liter- ally die without them. But too many calories make us sick.
The analogy to information is clear. Information is the “lifeblood” of our organi- zations and is central to our survival. But too much unmanaged unstructured informa- tion leaves us fat, slow, and coughing and wheezing at the back of the pack.
In 2012, New York City initially passed a controversial law limiting the size of soft drinks that can be sold at movie theaters and convenience stores (later chal- lenged in court). The “Bloomberg soda ban” was based on the premise that humans need help making good choices. There is some basis for this approach, with studies showing that, for example, the size of the candy scoop determines how much free candy we eat.22 Under the new law, it was still possible in New York to buy two smaller cups of soda, but it was hoped that inconvenience (and cost) will reduce overconsumption.
A new study . . . examined consumer behavior before and after calorie counts were posted, and determined that when restaurants post calories on menu boards, there is a reduction in calories per transaction.
—Bryan Bollinger, Phillip Leslie, Alan Sorensen, “Calorie Posting in Chain Restaurants,” Stanford University, January 2010
Thinking about information as calories at your organization can improve aware- ness of its costs and drive change. The goal is not to add friction to desirable behaviors, like collaboration and mobile work, but rather to make it more diffi cult to create and consume empty information calories.
Here are some tips to get started:
■ Educate executives and employees about the cost of information mismanagement s through anecdotes, case studies, and facts.
■ Show employees their information footprint by regularly exposing them to the t amount of data storage they are using in e-mail, shared drives, content man- agement systems, and other environments they work with. With a little creative programming, you can post “information calories” on your menus.
■ Design systems to minimize information calories. Examples include: preventing employees from exporting e-mail to .pst fi les; turning off the ability to store documents on desktop hard drives to encourage the use of managed collabo- ration environment; and requiring employees to send links to shared content rather than creating yet another e-mail attachment. Clever technology and social engineering, like the soda ban, can drive healthy information behavior.
BUSINESS CONSIDERATIONS FOR A SUCCESSFUL IG PROGRAM 109
Information Cap-and-Trade
Originally designed as a regulatory approach for fi ghting acid rain in the 1980s, cap-and-trade has gained new attention as a method of curbing carbon emissions. Cap-and-trade systems differ from command-and-control regulatory approaches that mandate, rather than economically encourage, a course of action. In other words, rather than forcing companies to install scrubbers on power plant exhausts (command and control), cap-and-trade provides companies with an emissions quota, which they can hit as they see fi t, and even profi t from. Companies with unused room on their quota can sell those “credits” on specialized markets.
Consider a cap-and-trade system for information. Do not limit the creation and storage of useful information—that defeats the purpose of investing in IT in the fi rst l place. Rather, design a cap-and-trade system that controls the amount of information pollution and rewards innovation and management discipline.
While there is no objective “right amount” of information for every organization or department, we can certainly do better than “as much as you want, junk or not.” After all, “nearly all sectors in the US economy had at least an average of 200 terabytes of stored data . . . and many sectors had more than 1 petabyte in mean stored data per company.” 23 Moreover, up to 50 percent of that information is easily identifi able as data pollution. 24 So, we have a reasonable starting point.
Here are some tips for creating an information cap-and-trade system:
■ Baseline the desired amount of information per system, department, and/or type t of user. How much information do you currently have? How much has value? How much should you have? These are not easy questions to answer, but even rough calculations can make a big difference.
■ Create information volume targets or quotas, and allocate them by business unit, system, or user. This is the “cap” part of the system.
■ Calculate the fully loaded cost of a unit of information , and adopt it as a baseline metric for the “trade” part of the system. Consider whether annual e-discovery costs can be allocated to this unit in a reasonable way.
■ Create an internal accounting system for tracking and trading information units, s or credits within the organization. Innovative departments will be rewarded, laggards will be motivated.
■ Get creative in what the credits can purchase. New revenue-generating software? Headcount?
“There’s not a person in a business anywhere who gets up in the morning and says, ‘Gee, I want to race into the offi ce to follow some regulation.’ On the other hand, if you say, ‘There’s an upside potential here, you’re going to make money,’ people do get up early and do drive hard around the possibility of fi nding themselves winners on this.”
—Dan Etsy, environmental policy professor at Yale University, quoted in Richard Conniff, “The Political History of Cap and Trade,”
Smithsonian Magazine (August 2009)
110 INFORMATION GOVERNANCE
Future State: What Will the IG-Enabled Organization Look Like?
When an organization is IG enabled, or “IG mature”—meaning IG is infused into op- erations throughout the enterprise and coordinated on an organization-wide level—it will look signifi cantly different from most organizations today. Not only will the or- ganization have a solid handle on the total cost of information; not only will it have shifted resources to capitalize on the opportunities of Big Data; not only will it be managing the deluge in a systematic, business-oriented way by cutting out data debris and leveraging information value; it will also look signifi cantly different in key opera- tional areas including legal, records and information management (RIM), and IT.
In legal matters, the mature IG-enabled organization will be better suited to ad- dress litigation in a more effi cient way through a standardized legal hold notifi cation (LHN) process. Legal risk is reduced through improved IG, which will manage infor- mation privacy in accordance with applicable laws and regulations. During litigation, your legal team will be able to sort through information more rapidly and effi ciently, improving your legal posture, cutting e-discovery costs, and allowing for attorney time to be focused on strategy and to zero in on key issues. This means attorneys should have the technology tools to be more effective. Adherence to retention schedules means that records and documents can be discarded at the earliest possible time, which reduces the chances that some information could pose a legal risk. Hard costs can be saved by eliminating that approximately 69 percent of stored information that no lon- ger has business value. That cost savings may be the primary rationale for the initial IG program effort. By leveraging advanced technologies such as predictive coding, the organization can reduce the costs of e-discovery and better utilize attorney time.
Your RIM functions will operate with more effi ciency and in compliance with laws and regulations. Appropriate retention periods will be applied and enforced, and authentic, original copies of business records will be easily identifi able, so that manag- ers are using current and accurate information on which to base their decisions. Over the long term, valuable information from projects, product development, marketing programs, and strategic initiatives will be retained in corporate memory, reducing the impact of turnover and providing distilled information and knowledge to contribute to a knowledge management (KM) program. KM programs can facilitate innovation int organizations, as a knowledge base is built, retained, expanded, and leveraged.
In your IT operations, a focus on how IT can contribute to business objectives will bring about a new perspective. Using more of a business lens to view IT projects will help IT to contribute toward the achievement of business objectives. IT will be work- ing more closely with legal, RIM, risk, and other business units, which should help these groups to have their needs and issues better addressed by IT solutions. Having a standardized data governance program in place means cleaning up corrupted or dupli- cated data and providing users with clean, accurate data as a basis for line-of-business software applications and for decision support analytics in business intelligence (BI) applications. Better data is the basis for improved insights, which can be gained by leveraging BI and will improve management decision-making capabilities and help to provide better customer service, which can impact customer retention. It costs a lot more to gain a new customer than to retain an existing one, and with better data quality, the opportunities to cross-sell and upsell customers are improved. This can provide a sustainable competitive advantage. Standardizing the use of business terms will facilitate improved communications between IT and other business units, which
BUSINESS CONSIDERATIONS FOR A SUCCESSFUL IG PROGRAM 111
should lead to improved software applications that address user needs. Adhering to information life cycle management principles will help the organization to apply the proper level of IT resources to its high-value information while decreasing costs by managing information of declining value appropriately. IT effectiveness and effi ciency will be improved by using IT frameworks and standards, such as CobiT 5 and ISO/ IEC 38500:2008, the international standard that provides high-level principles and guidance for senior executives and directors, and those advising them, for the effec- tive and effi cient governance of IT. 25 Implementing a master data management pro- gram will help larger organizations with complex IT operations to ensure that they are working with consistent data from a single source. Improved database security through data masking, database activity monitoring, database auditing, and other tools will help guard the organization’s critical databases against the risk of rogue attacks by hackers. Deploying document life cycle security tools such as data loss prevention and informa- tion rights management will help secure your confi dential information assets and keep them from prying eyes. This helps to secure the organization’s competitive position and protect its valuable intellectual property.
By securing your electronic documents and data, not only within the organization but also for mobile use, and by monitoring and complying with applicable privacy laws, your confi dential information assets will be safeguarded, your brand will be bet- ter protected, and your employees will be able to be productive without sacrifi cing the security of your information assets.
Moving Forward
We are not very good at fi guring out what unstructured information costs. The Big Data deluge is upon us. If we hope to manage—and, more important, to monetize— this deluge, we must form cross-functional teams and challenge the way our organi- zations think about unstructured information. The fi rst and most important step is developing the ability to convincingly calculate what unstructured information really costs and then to discover ways we can recue those costs and drive value. These are foundational skills for information professionals in the new era of Big Data. In this era, information is currency—but a currency that has value only when IG professionals drive innovation and management rigor in the unstructured information environment.
CHAPTER SUMMARY: KEY POINTS
■ The business case for IG programs has historically been diffi cult to justify.
■ It takes a commitment to the long view to develop a successful IG program.
■ The problem of unstructured IG is growing faster than the problem of data volume itself.
■ IG professionals must be ready with new models that calculate the risks of storing too much of the wrong information and also the benefi ts of clean, reliable, accessible information.
(continued)dd
112 INFORMATION GOVERNANCE
■ Key steps in driving information value are: (1) clean; (2) build and maintain; and (3) monetize.
■ The information calorie approach and information cap-and-trade are two new models for assisting in IG.
■ Legal risk is reduced through improved IG, and legal costs are reduced.
■ Leveraging newer technologies like predictive coding can improve the ef- fi ciency of legal teams.
■ Adherence to retention schedules means that records and documents can be discarded at the earliest possible time, which reduces costs by eliminating unneeded information that no longer has business value.
■ RIM functions will operate with more effi ciency and in compliance with laws and regulations under a successful IG program.
■ A compliant RIM program helps to build the organization’s corporate memo- ry of essential “lessons learned,” which can foster a KM program.
■ KM programs can facilitate innovation in organizations.
■ Focusing on business impact and customizing your IG approach to meet business objectives are key best practices for IG in the IT department.
■ Effective data governance can yield bottom-line benefi ts derived from new insights, especially with the use of business intelligence software.
■ IT governance seeks to align business objectives with IT strategy to deliver business value.
■ Using IT frameworks like CobiT 5 can improve the ability of senior manage- ment to monitor IT value and processes.
■ Identifying sensitive information in your databases and implementing data- base security best practices help reduce organizational risk and the cost of compliance.
■ By securing your electronic documents and data, your information assets will be safeguarded and your organization can more easily comply with privacy laws and regulations.
■ We are not very good at fi guring out what unstructured information costs. To thrive in the era of Big Data requires challenging the way we think about the cost of managing unstructured information.
CHAPTER SUMMARY: KEY POINTS (Continued )
BUSINESS CONSIDERATIONS FOR A SUCCESSFUL IG PROGRAM 113
Notes
1. International Data Corporation, “The 2011 Digital Universe Study,” June 2011. www.emc.com/ leadership/programs/digital-universe.htm (accessed November 25, 2013).
2. Richard B. Schmidt, “The Cyber Suit: How Computers Aided Lawyers In Diet-Pill Case,” Wall Street Journal , October 8, 1999. http://webreprints.djreprints.com/00000000000000000012559001.htmll
3. Nick Bilton, “At Davos, Discussions of a Global Data Deluge,” New York Times , January 25, 2012,s http://bits.blogs.nytimes.com/2012/01/25/at-davos-discussions-of-a-global-data-deluge/; Alex Pent- land, quoted by Edge.org in “Reinventing Society in the Wake of Big Data,” August 8, 2012, www .edge.org/conversation/reinventing-society-in-the-wake-of-big-data; World Economic Forum, “Per- sonal Data: The Emergence of a New Asset Class” (January 2011), http://www3.weforum.org/docs/ WEF_ITTC_PersonalDataNewAsset_Report_2011.pdf
4. James Manyika et al., “Big Data: The Next Frontier for Innovation, Competitions, and Productivity,” McKinsey Global Institute, May 2011, www.mckinsey.com/insights/business_technology/big_data_ the_next_frontier_for_innovation
5. Janna Quitney Anderson and Lee Ranie, “Future of the Internet: Big Data,” Pew Internet and American Life Project, July 20, 2012, http://pewinternet.org/~/media//Files/Reports/2012/PIP_Future_of_ Internet_2012_Big_Data.pdf
6. Louis Columbus, “Roundup of Big Data Forecasts and Market Estimates, 2012,” Forbes , August 16, s 2012, www.forbes.com/sites/louiscolumbus/2012/08/16/roundup-of-big-data-forecasts-and-market- estimates-2012/
7. McKinsey Global Institute, “Big Data: The Next Frontier for Innovation, Competitions, and produc- tivity,” May 2011.
8. U.S. EPA, “Making Solid Waste Decisions with Full Cost Accounting,” n.d., www.epa.gov/osw/ conserve/tools/fca/docs/primer.pdf (accessed November 25, 2013).
9. Nicholas M. Pace and Laura Zakaras, “Where the Money Goes: Understanding Litigant Expenditures for Producing Electronic Discovery,” RAND Institute for Civil Justice, 2012. www.rand.org/content/ dam/rand/pubs/monographs/2012/RAND_MG1208.pdf (accessed November 25, 2013).
10. Accounts Payable Network, “A Detailed Guide to Imaging and Workfl ow ROI,” 2010. 11. Various sources. See, for example: Barclay T. Blair, “Today’s PowerPoint Slide: The Origins of Informa-
tion Governance by the Numbers,” October 28, 2010. http://barclaytblair.com/origins-of-information- governance-powerpoint/ (accessed November 25, 2013).
12. Brooklyn Navy Yard Development Corporation, “The History of Brooklyn Navy Yard,” www .brooklynnavyyard.org/history.html (accessed November 25, 2013).
13. James Manyika et al., “Big Data.” 14. Barclay Blair and Barry Murphy, “Defi ning Information Governance: Theory or Action? Results of the
2011 Information Governance Survey,” ViaLumina, eDiscovery Journal (September 2011).l 15. Jaikumar Vijayan, “Finding the Business Value in Big Data Is a Big Problem,” Computerworld , Septemberd
12, 2012, www.computerworld.com/s/article/9231224/Finding_the_business_value_in_big_data_is_a_ big_problem
16. James Manyika et al., “Big Data.” 17. Economist Intelligence Unit, “Leveling the Playing Field: How Companies Use Data to Create
Advantage” (January 2011), http://blogs.sap.com/wp-content/blogs.dir/15/fi les/2012/02/EIU_ Levelling_The_Playing_Field_1.pdf
18. Genevieve Shaw Brown, “Mac Users My See Pricier Options on Orbitz,” ABC Good Morn- ing America , June 25, 2012, http://abcnews.go.com/Travel/mac-users-higher-hotel-prices-orbitz/ story?id=16650014#.UDlkVBqe7oV
19. “Health Care Bill Requires Calories on Menus at Chain Restaurants,” USA Today , March 23, 2010, http://usatoday30.usatoday.com/news/health/weightloss/2010-03-23-calories-menus_N.htm
20. Sharon Beley, “As America’s Waistline Expands, Cost Soar,” Reuters, April 30, 2012, www.reuters .com/article/2012/04/30/us-obesity-idUSBRE83T0C820120430
21. Stephanie Rosenbloom, “Calorie Data to Be Posted at Most Chains,” New York Times , March 23, 2010,s www.nytimes.com/2010/03/24/business/24menu.html
22. James Surowiecki, “Downsizing Supersize,” New Yorker , August 13, 2012, www.newyorker.com/talk/r fi nancial/2012/08/13/120813ta_talk_surowiecki
23. Manyika et al., “Big Data.” 24. Blair and Murphy, “Defi ning Information Governance.” 25. International Organization for Standardization, ISO/IEC 38500:2008, Corporate governance of infor-
mation technology. www.iso.org/iso/catalogue_detail?csnumber=51639 (accessed November 25, 2013).
115
By Robert Smallwood with Randy Kahn, Esq. , and Barry Murphy
Information Governance and Legal Functions
C H A P T E R 8
P erhaps the key functional area that information governance (IG) impacts most is legal functions, since legal requirements are paramount. Failure to meet them can literally put an organization out of business or land executives in prison. Privacy,
security, records management, information technology (IT), and business manage- ment functions are important—very important—but the most signifi cant aspect of all of these functions relates to legality and regulatory compliance.
Key legal processes include electronic discovery (e-discovery) readiness and as- sociated business processes, information and record retention policies, the legal hold notifi cation (LHN) process, and legally defensible disposition practices.
Some newer technologies have become viable to assist organizations in imple- menting their IG efforts, namely, predictive coding and g technology-assisted review (TAR; also known as computer-assisted review ). In this chapter we explore the need ww for leveraging IT in IG efforts aimed at defensible disposition, the intersection be- tween IG processes and legal functions, policy implications, and some key enabling technologies.
Introduction to e-Discovery: The Revised 2006 Federal Rules of Civil Procedure Changed Everything
Since 1938, the Federal Rules of Civil Procedure (FRCP) “have governed the discovery of evidence in lawsuits and other civil cases.” 1 In law, discovery is an early y phase of civil litigation where plaintiffs and defendants investigate and exchange evidence and testimony to better understand the facts of a case and to make early determinations of the strength of arguments on either side. Each side must produce evidence requested by the opposition or show the court why it is unreasonable to pro- duce the information.
The FRCP apply to U.S. district courts, which are the trial courts of the fed- eral court system. The district courts have jurisdiction (within limits set by Congress and the Constitution) to hear nearly all categories of federal cases, including civil and criminal matters. 2
116 INFORMATION GOVERNANCE
The FRCP were amended in 2006, and some of the revisions apply specifi cally to the preservation and discovery of electronic records in the litigation process. 3 These changes were a long time coming, refl ecting the lag between the state of technology and the courts’ ability to catch up to the realities of electronically generated and stored information.
After years of applying traditional paper-based discovery rules to e-discovery, amendments to the FRCP were made to accommodate the modern practice of discov- ery of electronically stored information (ESI). ESI is any information that is created or stored in electronic format. The goal of the 2006 FRCP amendments was to recog- nize the importance of ESI and to respond to the increasingly prohibitive costs of document review and protection of privileged documents. These amendments rein- forced the importance of IG policies, processes, and controls in the handling of ESI. 4 Organizations must produce requested ESI reasonably quickly, and failure to do so, or failure to do so within the prescribed time frame, can result in sanctions. This require- ment dictates that organizations put in place IG policies and procedures to be able to produce ESI accurately and in a timely fashion. 5
All types of litigation are covered under the FRCP, and all types of e-documents— most especially e-mail—are included, which can be created, accessed, or stored in a wide variety of methods, and on a wide variety of devices beyond hard drives. The FRCP apply to ESI held on all types of storage and communications devices: thumb drives, CDs/DVDs, smartphones, tablets, personal digital assistants (PDAs), personal computers, servers, zip drives, fl oppy disks, backup tapes, and other storage media. ESI content can include information from e-mail, reports, blogs, social media posts (e.g., Twitter posts), voicemails, wikis, websites (internal and external), word processing documents, and spreadsheets, and includes the metadata associated with the content itself, which provides descriptive information. 6
Under the FRCP amendments, corporations must proactively manage the e-discovery process to avoid sanctions, unfavorable rulings, and a loss of public trust. Corporations must be prepared for early discussions on e-discovery with all depart- ments. Topics should include the form of production of ESI and the methods for pres- ervation of information. Records management and IT departments must have made available all relevant ESI for attorney review. 7
This new era of ESI preservation and production demands the need for cross- functional collaboration: records management, IT, and legal teams particularly need to work closely together. Legal teams, with assistance and input of records management staff, must identify relevant ESI, and IT teams must be mindful of preserving and pro- tecting the ESI to maintain its legal integrity and prove its authenticity.
Legal functions are the most important area of IG impact.
ESI is any information that is created or stored in electronic format.
INFORMATION GOVERNANCE AND LEGAL FUNCTIONS 117
Big Data Impact
Now throw in the Big Data effect: The average employee creates roughly one giga- byte of data annually (and growing), and data volumes are expected to increase over the next decade not 10-fold, or even 20-fold, but as much as 40 to 50 times what it is today! 8 This underscores the fact that organizations must meet legal requirements while paring down the mountain of data debris they are holding to reduce costs and potential liabilities hidden in that monstrous amount of information. There are also costs associated with dark data— unknown or useless data, such as old log fi les, that takes up space and continues to grow and needs to be cleaned up.
Some data is important and relevant, but distinctions must be made by IG policy to classify, prioritize, and schedule data for disposition and to dispose of the majority of it in a systematic, legally defensible way. If organizations do not accomplish these critical IG tasks they will be overburdened with storage and data handling costs and will be unable to meet legal obligations.
According to a recent survey, approximately 25 percent of information stored in organizations has real business value, while 5 percent must be kept as business records and about 1 percent is retained due to a litigation hold. 9 “This means that [about] 69 per- cent of information in most companies has no business, legal, or regulatory value. Companies that are able to [identify and] dispose of this debris return more profi t to sharehold- ers, can use more of their IT budgets for strategic investments, and can avoid excess expense in legal and regulatory response” (emphasis added).
If organizations are not able to draw clear distinctions between that roughly 30 percent of “high-value” business data, records, and that which is on legal hold, their IT department are tasked with the impossible job of managing all data as if it is high value. This “overmanaging” of information is a signifi cant waste of IT resources. 10
More Details on the Revised FRCP Rules
Here we present a synopsis of the key points in FRCP rules that apply to e-discovery.
FRCP 1—Scope and Purpose. This rule is simple and clear; its aim is to “secure the just, speedy, and inexpensive determination of every action.”11 Your discovery effort and responses must be executed in a timely manner.
The amended FRCP reinforce the importance of IG. Only about 25 percent of business information has real value, and 5 percent are business records.
The goal of the FRCP amendments is to recognize the importance of ESI and to respond to the increasingly prohibitive costs of document review and pro- tection of privileged documents.
118 INFORMATION GOVERNANCE
FRCP 16—Pretrial Conferences; Scheduling; Management . This rule provides guide-t lines for preparing for and managing the e-discovery process; the court expects IT and network literacy on both sides, so that pretrial conferences regarding discoverable evidence are productive.
FRCP 26—Duty to Disclose; General Provisions Governing Discovery. This rule pro- tects litigants from costly and burdensome discovery requests, given certain guidelines.
FRCP 26(a)(1)(C): Requires that you make initial disclosures no later than 14 days after the Rule 26(f) meet and confer, unless an objection or another time is set by stipulation or court order. If you have an objection, now is the time to voice it.
Rule 26(b)(2)(B): Introduced the concept of not reasonably accessible ESI. The concept of not reasonably accessible paper had not existed. This rule pro-r vides procedures for shifting the cost of accessing not reasonably accessible ESI to the requesting party.
FRCP 26(b)(5)(B): Gives courts a clear procedure for settling claims when you hand over ESI to the requesting party that you shouldn’t have.
Rule 26(f): This is the meet and confer rule. This rule requires all par- ties to meet within 99 days of the lawsuit’s fi ling and at least 21 days before a scheduled conference.
Rule 26(g): Requires an attorney to sign every e-discovery request, re- sponse, or objection.
FRCP 33—Interrogatories to Parties . This rule provides a defi nition of business e-s records that are discoverable and the right of opposing parties to request and access them.
FRCP 34—Producing Documents, Electronically Stored Information, and Tangible Things, or Entering onto Land, for Inspection and Other Purposes . In disputes overs document production, this rule outlines ways to resolve and move forward. Specifi cally, FRCP 34(b) addresses the format for requests and requires that e-records be accessible without undue diffi culty (i.e., the records must be orga- nized and identifi ed). The requesting party chooses the preferred format, which are usually native fi les (which also should contain metadata). The key point is that electronic fi les must be accessible, readable, and in a standard format.
FRCP 37—Sanctions . Rule 37(e) is known as the safe harbor rule. In principle, it s keeps the court from imposing sanctions when ESI is damaged or lost through routine, “good faith” operations, although this has proven to be a high standard to meet. This rule underscores the need for a legally defensible document man- agement program under the umbrella of clear IG policies.
The Big Data trend underscores the need for defensible deletion of data debris.
INFORMATION GOVERNANCE AND LEGAL FUNCTIONS 119
Landmark E-Discovery Case: Zubulake v. UBS Warburg
A landmark case in e-discovery arose from the opinions rendered in Zubulake v. U.B.S. Warburg , an employment discrimination case where the plaintiff, Laura Zubulake, g sought access to e-mail messages involving or naming her. Although UBS produced over 100 pages of evidence, it was shown that employees intentionally deleted some relevant e-mail messages. 12 The plaintiffs requested copies of e-mail from backup tapes, and the defendants refused to provide them, claiming it would be too expensive and burdensome to do so.
The judge ruled that U.B.S. had not taken proper care in preserving the e-mail evidence, and the judge ordered an adverse inference (assumption that the evidence was damaging) instruction against U.B.S. Ultimately, the jury awarded Zubulake over $29 million in total compensatory and punitive damages. “The court looked at the proportionality test of Rule 26(b)(2) of the Federal Rules of Civil Procedure and applied it to the electronic communication at issue. Any electronic data that is as ac- cessible as other documentation should have traditional discovery rules applied.” 13 Although Zubulake’s award was later overturned on appeal, it is clear the stakes are huge in e-discovery and preservation of ESI.
E-Discovery Techniques
Current e-discovery techniques include online review, e-mail message archive review, and cyberforensics. Any and all other methods of seeking or searching for ESI may be employed in e-discovery. Expect capabilities for searching, retrieving, and translating ESI to improve, expanding the types of ESI that are discoverable. Consider this potential when evaluating and developing ESI management practices and policies.14
E-Discovery Reference Model
The E-Discovery Reference Model is a visual planning tool created by EDRM.net to assist in identifying and clarifying the stages of the e-discovery process. Figure 8.1 is the graphic depiction with accompanying detail on the process steps.
Information Management. Getting your electronic house in order to miti- gate risk and expenses should e-discovery become an issue, from initial cre- ation of electronically stored information through its fi nal disposition
Identifi cation. Locating potential sources of ESI and determining their scope, breadth, and depth
In the landmark case Zubulake v. U.B.S. Warburg , the defendants were severelyg punished by an adverse inference for deleting key e-mails and not producing copies on backup tapes.
120 INFORMATION GOVERNANCE
Preservation. Ensuring that ESI is protected against inappropriate altera- tion or destruction
Collection. Gathering ESI for further use in the e-discovery process (pro- cessing, review, etc.)
Processing. Reducing the volume of ESI and converting it, if necessary, to forms more suitable for review and analysis
Review. Evaluating ESI for relevance and privilege Analysis. Evaluating ESI for content and context, including key patterns,
topics, people, and discussion Production. Delivering ESI to others in appropriate forms, and using ap-
propriate delivery mechanisms
SEVEN STEPS OF THE E-DISCOVERY PROCESS
In the e-discovery process, you must perform certain functions for identifying and preserving electronically stored (ESI), and meet requirements regarding conditions such as relevancy and privilege. Typically, you follow this e-disco- very process:
1. Create and retain ESI according to an enforceable electronic records reten- tion policy and electronic records management (ERM) program. Enforce the policy, and monitor compliance with it and the ERM program.
2. Identify the relevant ESI, preserve any so it cannot be altered or destroyed, and collect all ESI for further review.
3. Process and fi lter the ESI to remove the excess and duplicates. You reduce costs by reducing the volume of ESI that moves to the next stage in the e-discovery process.
4. Review and analyze the fi ltered ESI for privilege because privileged ESI is not discoverable, unless some exception kicks in.
5. Produce the remaining ESI, after fi ltering out what’s irrelevant, duplicated, or privileged. Producing ESI in native format is common.
6. Clawback the ESI that you disclosed to the opposing party that you should have fi ltered out, but did not. Clawback is not unusual, but you have to work at getting clawback approved, and the court may deny it.
7. Present at trial if your case hasn’t settled. Judges have little to no patience with lawyers who appear before them not understanding e-discovery and the ESI of their clients or the opposing side.
Source: Linda Volonino and Ian Redpath, e -Discovery for Dummies (Hoboken, NJ: John Wiley s & Sons, 2010), http://www.dummies.com/how-to/content/ediscovery-for-dummies-cheat- sheet.html (accessed May 22, 2013). Used with permission.
INFORMATION GOVERNANCE AND LEGAL FUNCTIONS 121
Presentation. Displaying ESI before audiences (at depositions, hearings, trials, etc.), especially in native and near-native forms, to elicit further infor- mation, validate existing facts or positions, or persuade an audience15
The Electronic Discovery Reference Model can assist organizations in focusing and segmenting their efforts when planning e-discovery initiatives.
Guidelines for E-Discovery Planning 1. Implement an IG program. The highest impact area to focus are your legal
processes, particularly e-discovery. From risk assessment to processes, com- munications, training, controls, and auditing, fully implement IG to improve and measure compliance capabilities.
2. Inventory your ESI. File scanning and e-mail archiving software can assist you. You also will want to observe fi les and data fl ows by doing a walk-through beginning with centralized servers in the computer room and moving out into business areas. Then, using a prepared inventory form, you should interview users to fi nd out more detail. Be sure to inventory ESI based on computer systems or applications, and diagram it out.
3. Create and implement a comprehensive records retention policy, and also include an e-mail retention policy and retention schedules for major ESI areas. This is required since all things are potentially discoverable. You must devise a comprehensive retention and disposition policy that is legally defensible.
Figure 8.1 Electronic Discovery Reference Model Source: EDRM (edrm.net)
Information
Management
VOLUME RELEVANCE
Identification
Preservation
Processing
Review Production Presentation
Analysis
Electronic Discovery Reference Model/©2009/v2.0/edrm.net
Collection
The E-Discovery Reference Model is in a planning tool that presents key e-discovery process steps.
122 INFORMATION GOVERNANCE
So, for instance, if your policy is to destroy all e-mail messages that do not have a legal hold (or are expected to) after 90 days and you apply that policy uniformly, you will be able to defend the practice in court. Also, implementing the retention policy reduces your storage burden and costs while cutting the risk of liability that might be buried in obscure e-mail messages.
4. As an extension of your retention policy, implement a legal hold policy that is enforceable, auditable, and legally defensible. Be sure to include all potentially discoverable ESI XE “litigation:e-discovery”. We discuss legal holds in more depth later in this chapter, but be sure to cast a wide net when developing retention policies so that you include all relevant electronic records, such as e-mail, e-documents and scanned documents, storage discs, and backup tapes.
5. Leverage technology. Bolster your e-discovery planning and execution efforts by deploying enabling technologies, such as e-mail archiving, advanced enter- prise search, TAR, and predictive coding.
6. Develop and execute your e-discovery plan. You may want to begin from this point forward with new cases, and bear in mind that starting small and piloting is usually the best course of action.
The Intersection of IG and E-Discovery
By Barry Murphy
Effective IG programs can alleviate e-discovery headaches by reducing the amount of information to process and review, allowing legal teams to get to the facts of a case quickly and effi ciently, and can even result in better case outcomes. Table 8.1 shows the impact of IG on e-discovery, by function.
Legal Hold Process
The legal hold process is a foundational element of IG.16 The way the legal hold process is supposed to work is that a formal system of polices, processes, and controls is put in place to notify key employees of a civil lawsuit (or impending one) and the set of documents that must put on legal hold. These documents, e-mail messages, and other relevant ESI must be preserved in place and no longer edited or altered so that they may be reviewed by attorneys during the discovery phase of the litigation. But, in prac- tice, this is not always what takes place. In fact, the opposite can take place —employees can quickly edit or even delete relevant e-documents that may raise questions or even
Implementing IG, inventorying ESI, and leveraging technology to implement records retention and LHN policies are key steps in e-discovery planning.
INFORMATION GOVERNANCE AND LEGAL FUNCTIONS 123
implicate them. This is possible only if proper IG controls are not in place, monitored, enforced, and audited.
Many organizations start with Legal Hold Notifi cation (LHN) management as a very discrete IG project. LHN management is arguably the absolute minimum an orga- nization should be doing in order to meet the guidelines provided by court rules, com-g mon law, and case law precedent. It is worth noting, though, that the expectation is that organizations should connect the notifi cation process to the actual collection and preservation of information in the long term.
Table 8.1 IG Impact on E-Discovery
Impact Function
Cost reduction Reduce downstream costs of processing and review by defensibly disposing of data according to corporate retention policies
Reduce cost of collection by centralizing collection interface to save time
Keep review costs down by prioritizing documents and assigning to the right level associates (better resource utilization)
Reduce cost of review by culling information with advanced analytics
Risk management Reduce risk of sanctions by managing the process of LHN and the collection and preservation of potentially responsive information
Better litigation win rates Optimize decision making (e.g., settling cases that can’t be won) quickly with advanced analytics that prioritize hot documents
Quickly fi nd the necessary information to win cases with advanced searches and prioritized review
Strategic planning for matters based on merit
Determine the merits of a matter quickly and decide if it is a winnable case
Quickly route prioritized documents to the right reviewers via advanced analytics (e.g., clustering)
Strategic planning for matters based on cost
Quickly determine how much litigation will cost via early access to amount of potentially responsive information and prioritized review to make decisions based on the economics of the matter (e.g., settle for less than the cost of litigation)
Litigation budget optimization Minimize litigation budget by only pursuing winnable cases
Minimize litigation budget by utilizing the lowest cost resources possible while putting high-cost resource on only the necessary documents
Source: Barry Murphy, eDiscovery Journal http://ediscoveryjournal.com/l
LHN management is the absolute minimum an organization should imple- ment to meet the guidelines, rules, and precedents.
124 INFORMATION GOVERNANCE
How to Kick-Start Legal Hold Notifi cation
Implementing an LHN program attacks some of the lower-hanging fruit within an or- ganization’s overall IG position. This part of the e-discovery life cycle must not be outsourced. d Retained counsel provides input, but the mechanics of LHN are managed and owned by internal corporate resources.
In preparing for a LHN implementation project, it is important to fi rst lose the perception that LHN tools are expensive and diffi cult to deploy. It is true that some of these tools cost considerably more than others and can be complex to deploy; however, that is because the tools in question go far beyond simple LHN and reach into enter- prise systems and also handle data mapping, collection, and workfl ow processes. Other options include Web-based hosted solutions, custom-developed solutions, or process- es using tools already in the toolbox (e.g., e-mail, spreadsheets, word processing).
The most effective approach involves three basic steps:
1. Defi ne requirements. 2. Defi ne the ideal process. 3. Select the technology.
Defi ning both LHN requirements and processes should include input from key stakeholders—at a minimum—in legal, records management, and IT. Be sure to take into consideration the organization’s litigation profi le, corporate culture, and available resources as part of the requirements and process defi ning exercise. Managing steps 1 and 2 thoroughly makes tool selection easier because defi ning requirements and processes creates the confi dence of knowing exactly what the tool must accomplish.
IG and E-Discovery Readiness
Having a solid IG underpinning means that your organization will be better prepared to respond and execute key tasks when litigation and the e-discovery process proceed. Your policies will have supporting business processes, and clear lines of responsibility and accountability are drawn. The policies must be reviewed and fi ne-tuned periodically, and business processes must be streamlined and continue to aim for improvement over time.
In order for legal hold or defensible deletion (discussed in detail in the next section—disposing of unneeded data, e-documents, and reports based on set policy) projects to deliver the promised benefi t to e-discovery, it is important to avoid the very real roadblocks that exist in most organization. To get the light to turn green at the intersection of e-discovery and IG, it is critical to:
■ Establish a culture that both values information and recognizes the risks inherent in it. Every organization must evolve its culture from one of keeping everything to one of information compliance. This kind of change requires high-level ex- ecutive support. It also requires constant training of employees about how to create, classify, and store information. While this advice may seem trite, many managers in leading organizations say that without this kind of culture change, IG projects tend to be dead on arrival.
■ Create a truly cross-functional IG team. Culture change is not easy, but it can be even harder if the organization does not bring all stakeholders together when setting requirements for IG. Stakeholders include: legal; security and ethics; IT;
INFORMATION GOVERNANCE AND LEGAL FUNCTIONS 125
records management; internal audit; corporate governance; human resources; compliance; and business units and employees. That is a lot of stakeholders. In organizations that are successfully launching and executing IG projects, many have dedicated IG teams. Some of those IG teams are the next generation of records management departments, while others are newly formed. The stake- holders can be categorized into three areas: legal/risk, IT, and the business. The IG team can bring those areas together to ensure that any projects meet requirements of all stakeholders.
■ Use e-discovery as an IG proof of concept . Targeted programs like e-discovery,t compliance, and archiving have a history of return on investment (ROI) and an ability to get budget. These projects are also challenging, but more straightforward to implement and can address sub-sets of information in ear- ly phases (e.g., only those information assets that are reasonable to account for). The lessons learned from these targeted projects can then be applied to other IG initiatives.
■ Measure ROI on more than just cost savings . Yes, one of the primary benefi ts of ad-s dressing e-discovery via IG is cost reduction, but it is wise to begin measuring all e-discovery initiatives on how they impact the life cycle of legal matters. The effi ciencies gained in collecting information, for example, have benefi ts that go way beyond reduced cost; the IT time not wasted on reactive collection is more time available for innovative projects that drive revenue for companies. And a better litigation win rate will make any legal team happier.
Building on Legal Hold Programs to Launch Defensible Disposition
By Barry Murphy
Defensible deletion programs can build on legal hold programs, because legal hold management is a necessary fi rst step before defensibly deleting anything. The standard is “reasonable effort” rather than “perfection.” Third-party consultants or auditors can support the diligence and reasonableness of these efforts.
Next, prioritize what information to delete and what information the organiza- tion is capably able to delete in a defensible manner. Very few organizations are deleting information across all systems. It can be overly daunting to try to apply deletion to all en- terprise information. Choosing the most important information sources—e-mail, for example—and attacking those fi rst may make for a reasonable and tenable approach. For most organizations, e-mail is the most common information source to begin deleting. Why e-mail? It is fairly easy for companies to put systematic rules on e-mail because the technology is already available to manage e-mail in a sophisticated manner. Because e-mail is such a critical data system, e-mail providers and e-mail archiving providers early on provided for systematic deletion or application of retention rules. However, in
IG serves as the underpinning for effi cient e-discovery processes.
126 INFORMATION GOVERNANCE
non–e-mail systems, the retention and deletion features are less sophisticated; there- fore, organizations do not systematically delete across all systems.
Once e-mail is under control, the organization can begin to apply lessons learned to other information sources and eventually have better IG policies and processes that treat information consistently based on content rather than on the repository.
Destructive Retention of E-mail
A destructive retention program is an approach to e-mail archiving where e-mail messages are retained for a limited time (say, 90 days), followed by the permanent manual or automatic deletion of the messages from the organization network, so long as there is no litigation hold or the e-mail has not been declared a record.
E-mail retention periods can vary from 90 days to as long as seven years:
■ Osterman Research reports that “nearly one-quarter of companies delete e- mail after 90 days.” 17
■ Heavily regulated industries, including energy, technology, communications, and real estate, favor archiving for one year or more, according to Fulbright and Jaworski research.
■ The most common e-mail retention period traditionally has been seven years; however, some organizations are taking a hard-line approach and stating that e-mails will be kept for only 90 days or six months, unless it is declared as a record, classifi ed, and identifi ed with a classifi cation/retention category and tagged or moved to a repository where the integrity of the record is protected (i.e., the record cannot be altered and an audit trail on the history of the re- cord’s usage is maintained).
Newer Technologies That Can Assist in E-Discovery
Few newer technologies are viable for speeding the document review process and im- proving the ability to be responsive to court-mandated requests. Here we introduce pre- dictive coding and technology-assisted review (also known as computer-assisted review), the most signifi cant of new technology developments that can assist in e-discovery.
For most organizations, e-mail is the most common information source to begin deleting according to established retention policies.
Destructive retention of e-mail is a method whereby e-mail messages are re- tained for a limited period and then destroyed.
INFORMATION GOVERNANCE AND LEGAL FUNCTIONS 127
Predictive Coding
During the early case assessment (ECA) phase of e-discovery, t predictive coding is ag “court-endorsed process” 18 utilized to perform document review. It uses human exper- tise and IT to facilitate analysis and sorting of documents. Predictive coding software leverages human analysis when experts review a subset of documents to “teach” the software what to look for, so it can apply this logic to the full set of documents, 19 mak- ing the sorting and culling process faster and more accurate than solely using human review or automated review.
Predictive coding uses a blend of several technologies that work in concert:20 soft- ware that performs machine learning (a type of g artifi cial intelligence software that “learns” and improves its accuracy, fostered by guidance from human input and pro- gressive ingestion of data sets—in this case documents); 21 workfl ow software, which w routes the documents through a series of work steps to be processed; and text analyt- ics software, used to perform functions such as searching for keywords (e.g., “asbestos” in a case involving asbestos exposure). Then using keyword search capabilities, or con- cepts using s pattern search or meaning-based search, and sifting through and sorting documents into basic groups using fi ltering technologies, based on document content,g and sampling a portion of documents to fi nd patterns and to review the accuracy of g fi ltering and keyword search functions.
The goal of using predictive coding technology is to reduce the total group of documents a legal team needs to review manually (viewing and analyzing them one by one) by fi nding that gross set of documents that is most likely to be relevant or responsive (in legalese) to the case at hand. It does this by automating, speeding up, and improving the accuracy of the document review process to locate and “digitally categorize” documents that are responsive to a discovery request. 22 Predictive coding, when deployed properly, also reduces billable attorney and paralegal time and there- fore the costs of ECA. Faster and more accurate completion of ECA can provide valu- able time for legal teams to develop insights and strategies, improving their odds for success. Skeptics claim that the technology is not yet mature enough to render more accurate results than human review.
The fi rst state court ruling allowing the use of predictive coding technology in- stead of human review to cull through approximately 2 million documents to “execute a fi rst-pass review” was made in April 2012 by a Virginia state judge.23 This was the fi rst time a judge was asked to grant permission without the two opposing sides fi rst coming to an agreement. The case, Global Aerospace, Inc., et al. v. Landow Aviation, LP, et al., stemmed from an accident at Dulles Jet Center.
In an exhaustive 156-page memorandum, which included dozens of pages of legal analysis, the defendants made their case for the reliability, cost- effectiveness, and legal merits of predictive coding. At the core of the memo
Predictive coding software leverages human analysis when experts review a subset of documents to “teach” the software what to look for, so it can apply this logic to the full set of documents.
128 INFORMATION GOVERNANCE
was the argument that predictive coding “is capable of locating upwards of seventy-fi ve percent of the potentially relevant documents and can be effec- tively implemented at a fraction of the cost and in a fraction of the time of linear review and keyword searching.”24
This was the fi rst big legal win for predictive coding use in e-discovery.
Basic Components of Predictive Coding Here is a summary of the main foundational components of predictive coding.
■ Human review. Human review is used to determine which types of document content will be legally responsive based on a case expert’s review of a sampling of documents. These sample documents are fed into the system to provide a seed set of examples. 25
■ Text analytics. This involves the ability to apply “keyword-agnostic” (through a thesaurus capability based on contextual meaning, not just keywords) to locate responsive documents and build create seed document sets.
■ Workfl ow. Software to route e-documents through the processing steps auto- matically to improve statistical reliability and streamlined processing.
■ Machine learning. The software “learns” what it is looking for and improves its capabilities along the way through multiple, iterative passes.
■ Sampling. Sampling is best applied if it is integrated so that testing for accuracy is an ongoing process. This improves statistical reliability and therefore defen- sibility of the process in court.
Predictive Coding Is the Engine; Humans Are the Fuel Predictive coding sounds wonderful, but it does not replace the expertise of an attorney; it merely helps leverage that knowledge and speed the review process. It “takes all the documents related to an issue, ranks and tags them so that a human reviewer can look over the documents to confi rm relevance.” So it cannot work without human input to let the software know what documents to keep and which ones to discard, but it is an emerging technology tool that will play an increasingly important role in e-discovery.26
Technology-Assisted Review
TAR, also known as computer-assisted review, is not predictive coding. TAR includest aspects of the nonlinear review process, such as culling, clustering and de-duplication, but it does not meet the requirements for comprehensive predictive coding.
Many technologies can help in making incremental reductions in e-discovery costs. Only fully integrated predictive coding, however, can completely transform the economics of e-discovery .
Mechanisms of Technology-Assisted Review There are three main mechanisms, or methods, for using technology to make legal review faster, less costly, and generally smarter. 27
1. Rules driven. “I know what I am looking for and how to profi le it.” In this sce- nario, a case team creates a set of criteria, or rules, for document review and
INFORMATION GOVERNANCE AND LEGAL FUNCTIONS 129
builds what is essentially a coding manual. The rules are fed into the tool for execution on the document set. For example, one rule might be to “redact for privilege any time XYZ term appears and add the term ‘redacted’ where the data was removed.” This rule-driven approach requires iteration to truly be effective. The case team will likely have rules changes and improvements as the case goes on and more is learned about strategy and merit. This approach assumes that the case team knows the document set well and can apply very specifi c rules to the corpus in a reasonable fashion.
2. Facet driven. “I let the system show me the profi le groups fi rst.” In this sce- nario, a tool analyzes documents for potential items of interest or groups potentially similar items together so that reviewers can begin applying decisions. Reviewers typically utilize visual analytics that guide them through the process and take them to prioritized documents. This mechanism can also be called present and direct.
3. Propagation based. “I start making decisions and the system looks for similar- related items.” This type of TAR is about passing along, or propagating, what is known based on a sample set of documents to the rest of the documents in a corpus. In the market, this is often referred to as predictive coding because the system predicts whether documents will be responsive or privileged based on how other documents were coded by the review team. Propagation-based TAR comes in different fl avors, but all involve an element of machine learning. In some scenarios, a review team will have access to a seed set of documents that the team codes and then feeds into the system. The system then mimics the action of the review team as it codes the remainder of the corpus. In other scenarios, there is not a seed set; rather, the systems give reviewers random documents for coding and then create a model for relevance and nonrelevance. It is important to note that propagation-based TAR goes beyond simple mimicry; it is about creating a linguistic mathematical model for what relevance looks like.
These TAR mechanisms are not mutually exclusive. In fact, combining the mecha- nisms can help overcome the limitations of individual approaches. For example, if a doc- ument corpus is not rich (e.g., does not have a high enough percentage of relevant documents), it can be hard to create a seed set that will be a good training set for the propagation-based system. However, it is possible to use facet-based TAR—for example, concept searching—to more quickly fi nd the documents that are relevant so as to create a model for relevance that the propagation-based system can leverage. 28
It is important to be aware that these approaches require more than just technology. It is critical to have the right people in place to support the technology and the work- fl ow required to conduct TAR. Organizations looking to exercise these mechanisms of TAR will need:
■ Experts in the right tools and information retrieval. Software is an important part of TAR. The team executing TAR will need someone that can program the tool set with the rules necessary for the system to intelligently mark documents. Furthermore, information retrieval is a science unto itself, blending linguistics, statistics, and computer science. Anyone practicing TAR will need the right team of experts to ensure a defensible and measurable process.
130 INFORMATION GOVERNANCE
■ Legal review team . While much of the chatter around TAR centers on its ability to cut lawyers out of the review process, the reality is that the legal review team will become more important than ever. The quality and consistency of the deci- sions this team makes will determine the effectiveness that any tool can have in applying those decisions to a document set.
■ Auditor. Much of the defensibility and acceptability of TAR mechanisms will rely on the statistics behind how certain the organization can be that the out- put of the TAR system matches the input specifi cation. Accurate measures of performance are important not only at the end of the TAR process, but also throughout the process in order to understand where efforts need to be focused in the next cycle or iteration. Anyone involved in setting or performing mea- surements should be trained in statistics.
For an organization to use a propagated approach, in addition to people it may need a “seed” set of known documents. Some systems use random samples to create seed sets while others enable users to supply small sets from the early case investigations. These documents are reviewed by the legal review team and marked as relevant, privi- leged, and the like. Then, the solution can learn from the seed set and apply what it learns to a larger collection of documents. Often this seed set is not available, or the seed set does not have enough positive data to be statistically useful.
Professionals using TAR state that the practice has value, but it requires a sophisticated team of users (with expertise in information retrieval, statistics, and law) who understand the potential limitations and danger of false confi dence that can arise from improper use. For example, using a propagation-based approach with a seed set of documents can have issues when less than 10 percent of the seed set documents are positive for relevance. In contrast, rules driven and other systems can result in false negative decisions when based on narrow custodian example sets.
However TAR approaches and tools are used, they will only be effective if usage is anchored in a thought out, methodically sound process. This requires a defi nition of what to look for, searching for items that meet that defi nition, measuring results, and then refi ning those results on the basis of the measured results. Such an end-to-end plan will help to decide what methods and tools should be used in a given case. 29
Defensible Disposal: The Only Real Way To Manage Terabytes TT and Petabytes
By Randy Kahn, Esq. Records and information management (RIM) is not working. At least, it is not working well. Information growth and management complexity has meant that the old records l retention rules and the ways businesses apply them are no longer able to address the lifecycle of information. So the mountains of information grow and grow and grow, often unfettered.
Too much data has outlived its usefulness, and no one seems to know how or is willing to get rid of it. While most organizations need to right-size their information footprint by cleaning out the digital data debris, they are stymied by the complexity and enormity of the challenge.
INFORMATION GOVERNANCE AND LEGAL FUNCTIONS 131
Growth of Information
According to International Data Corporation (IDC), from now until 2020, the digital universe is expected by expand to more than 14 times its current size. 30 One exabyte is the data equivalent of about 50,000 years of DVD movies running continuously. With about 1,800 exabytes of new data created in 2011, 2840 exabytes in 2012, and a predicted 6,120 exabytes in 2014, the volumes are truly staggering. While the data footprint grows signifi cantly each year, that says nothing of what has already been cre- ated and stored.
Contrary to what many say (especially hardware salespeople) storage is not cheap.t In fact, it is really becomes quite expensive when you add up not only the hard- ware costs but also maintenance, air conditioning and space overhead, and the highly skilled labor needed to keep it running. Many large companies spend tens if not hun- dreds of millions of dollars per year just to store data. This is money that could go straight to the bottom line if the unneeded data could be discarded. When you con- sider that most organizations’ information footprints are growing at between 20 and 50 percent per year and the cost of storage is declining by a few percentage points per year, in real terms they are spending way more this year than last to simply house information.
Volumes Now Impact Effectiveness
The law of diminishing returns applies to information growth. Assuming information is an asset, at some point when there is so much data, its value starts to decline. That is not because the intrinsic value goes down (although many would argue there is a lot of idle chatter in the various communications technologies). Rather the decline is related to the inability to expeditiously fi nd or have access to needed business information. According the Council of Information Auto-Classifi cation “Information Explosion” Survey, there is now so much information that nearly 50 percent of companies need to re-create business records to run their business and protect their legal interests because they cannot fi nd the original retained record.31 It is a poor business practice to spend resources to retain information and then, when it cannot be found, to spend more to reconstitute it.
There is increasing regulatory pressure, enforcement, and public scrutiny on all of an organization’s data storage activities. Record sanctions and fi nes, new regula- tions, and stunning court decisions have converged to mandate heightened controls and accountability from government regulators, industry and standards groups as well as the public. When combined with the volume of data, information privacy, security, protection of trade secrets, and records compliance become complex and critical, high- risk business issues that only executive management can truly fi x. However, executives typical view records and information management (RIM) as a low-importance cost center activity, which means that the real problem does not get solved.
In most companies, there is no clear path to classify electronic records, to for- mally manage offi cial records, or to ensure the ultimate destruction of these records. Vast stores of legacy data are unclassifi ed, and most data is never touched again shortly after creation. Further, traditional records retention rules are too voluminous, too complex, and too granular and do not work well with the technology needed to manage records.
132 INFORMATION GOVERNANCE
Finally, it is clear that employees can no longer be expected to pull the oars to cut through the information ocean, let alone boil it down into meaningful chunks of good information. Increasingly, technology has to play a more central role in manag- ing information. Better use of technology will create business value by reducing risk, driving improvements in productivity, and facilitating the exploitation and protection of ungoverned corporate knowledge.
How Did This Happen?
Over the past several years, organizations have come to realize that the exposure posed by uncontrolled data growth requires emergency, reactive action, as seemingly no oth- er viable approach exists. Faced with massive amounts of unknown unstructured data, many organizations have chosen to adopt a risk-averse save-everything policy. This approach has brought with it immediate repercussions:
■ Inability to quickly locate needed business content buried in ill-managed fi le systems.
■ Sharply increased storage costs, with some companies refusing to allocate any more storage to the business. The users’ reaction, out of necessity, is to store data wherever they can fi nd a place for it. (Do not buy the argument that stor-t age is cheap—everyone is spending more on storing unnecessary data, even if the per-gigabyte media cost has gone down).
■ Soaring litigation and discovery costs, as organizations have lost track of what is where, who owns it, and how to collect, sort, and process it.
■ Buried intellectual property, trade secrets, personally identifi able information, and regulated content, which are subject to leakage and unauthorized deletion, and are a clear target for opposing counsel—or anyone who can access them.
■ Lack of centralized policies and systems for the storage of records, which re- sults in hard-to-manage record sites spread throughout the organization.
■ The lack of a clear strategy for managing records that have long-term, rather than short-term, business, legal, and research value.
Information Glut in Organizations ■ 71 percent of organizations surveyed have no idea of the content in their stored
data. ■ 58 percent of organizations are keeping information indefi nitely. ■ 79 percent of organizations say too much time and effort is spent manually
searching and disposing information. ■ 58 percent of organizations still rely on employees to decide how to apply cor-
porate policies. 32
What Is Defensible Disposition, and How Will It Help?
A solution to the unmitigated data sprawl is to defensibly dispose of the business con- tent that no longer has business or legal value to the organization. In the old days of records management, it was clear that courts and regulators alike understood that records came into being and eventually were destroyed in the ordinary course of business. It is good business practice to destroy unneeded content, provided that the
INFORMATION GOVERNANCE AND LEGAL FUNCTIONS 133
rules on which those decisions are made consider legal requirements and business needs. Today, however, the good business practice of cleaning house of old records has somehow become taboo for some businesses. Now it needs to start again.
An understanding of how technology can help defensibly dispose and how meth- odology and process help an organization achieve a thinner information footprint is critical for all companies overrun with outdated records that do not know where to start to address the issue. While no single approach is right for every organization, re- cords and legal teams need to take an informed approach, looking at corporate culture, risk tolerance, and litigation profi le.
A defensible disposition framework is an ecosystem of technology, policies, proce- dures, and management controls designed to ensure that records are created, managed, and disposed at the end of their life cycle.
New Technologies—New Information Custodians
Responsibility for records management and IG have changed dramatically over time. In the past, the responsibility rested primarily with the records manager. However, the nature of electronic information is such that its governance today requires the partici- pation of IT, which frequently has custody, control, or access to such data, along with guidance from the legal department. As a result, IT personnel with no real connection or ownership of the data may be responsible for the accuracy and completeness of the business-critical information being managed. See the problem?
For many organizations, advances in technology mixed with an explosive growth of data forced a reevaluation of core records management processes. Many organi- zations have deployed archiving, litigation, and e-discovery point solutions with the intent of providing record retention compliance and responsiveness to litigation. Such systems may be tactically useful but fail to strategically address the heart of the matter: too much information, poorly managed over years and years—if not decades.
A better approach is for organizations to move away from a reactive keep- everything strategy to a proactive strategy that allows the reasonable and reliable identifi cation and deletion of records when retention requirements are reached, absent a preservation obligation. Companies develop retention schedules and processes pre- cisely for this reason; it is not misguided to apply them.
Why Users Cannot, Will Not—and Should Not—Make the Hard Choices
Employees usually are not suffi ciently trained on records management principles and methods and have little incentive (or downside) to properly manage or dispose of records. Further, many companies today see that requiring users to properly declare or man- age records places an undue burden on them. The employees not only do not provide a
A defensible disposition framework is an ecosystem of technology, policies, procedures, and management controls designed to ensure that records are created, managed, and disposed at the end of their life cycle.
134 INFORMATION GOVERNANCE
reasonable solution to the huge data pile (which for some companies may be petabytes of data) but contribute to its growth by using more unsanctioned technologies and parking company information in unsanctioned locations. So the digital landfi ll continues to grow.
Most organizations have programs that address paper records, but these same organizations commonly fail to develop similar programs for electronic records and other digital content.
Technology Is Essential to Manage Digital Records Properly
Having it all—but not being able to fi nd it—is like not having it at all. t While the content of a paper document is obvious, viewing the content of an electron-
ic document depends on software and hardware. Further, the content of electronic storage media cannot be easily accessed without some clue as to its structure and format. Conse- quently, the proper indexing of digital content is fundamental to its utility. Without an index, retrieving electronic content is expensive and time consuming, if it can be retrieved at all.
Search tools have become more robust, but they do not provide a panacea for fi nding electronic records when needed because there is too much information spread out across way too many information parking lots. Without taxonomies and common business terminology, accessing the one needed business record may be akin to fi nding the needle in a stadium-size haystack.
Technological advances can help solve the challenges corporations face and ad- dress the issues and burdens for legal, compliance, and information governance. When faced with hundreds of terabytes to petabytes of information, no amount of user inter- vention will begin to make sense of the information tsunami.
Auto-Classifi cation and Analytics Technologies
Increasingly companies are turning to new analytics and classifi cation technologies that can analyze information faster, better, and cheaper. These technologies should be considered essential for helping with defensible disposition, but do not make the mistake of underestimating their expense or complexity.
As discussed in the previous section by Barry Murphy, machine learning tech- nologies mean that software can “learn” and improve at the tasks of clustering fi les and assigning information (e.g., records, documents) to different preselected topical categories based on a statistical analysis of the data characteristics. In essence, classifi cation technology evaluates a set of data with known classifi cation mappings and attempts to map newly encountered data within the existing classifi cations. This type of technology should be on the list of considerations when approaching defen- sible disposition in large, uncontrolled data environments.
Can Technology Classify Information?
What is clear is that IT is better and faster than people in classifying information. Period.
A better approach is for organizations to move away from a reactive keep- everything strategy to a proactive strategy of defensible deletion.
INFORMATION GOVERNANCE AND LEGAL FUNCTIONS 135
Increasingly studies and court decisions make clear that, when appropriate, com- panies should not fear using enabling technologies to help manage information.
For example, in the recent Da Silva Moore v. Publicis Groupe case, Judge Andrew Peck stated:
Computer-assisted review appears to be better than the available alternatives, and thus should be used in appropriate cases. While this Court recognizes that computer-assisted review is not perfect, the Federal Rules of Civil Procedure do not require perfection. . . . Counsel no longer have to worry about being the “fi rst” or “guinea pig” for judicial acceptance of computer assisted review.
This work presents evidence supporting the contrary position: that a technology-assisted process, in which only a small fraction of the document collection is ever examined by humans, can yield higher recall and/or preci- sion than an exhaustive manual review process, in which the entire document collection is examined and coded by humans. 33
Moving Ahead by Cleaning Up the Past
Organizations can improve disposition and IG programs with a systemized, repeatable, and defensible approach that enables them to retain and dispose of all data types in compliance with the business and statutory rules governing the business’s operations.
Generally, an organization is under no legal obligation to retain every piece of in- formation it generates in the course of its business. Its records management process is there to clean up the information junk in a consistent, reasonable way. That said, what should companies do if they have not been following disposal rules, so information has piled up and continues unabated? They need to clean up old data. But how?
Manual intervention (by employees) will likely not work, due to the sheer volumes of data involved. Executives will not and should not have employees abdicate their regular jobs in favor of classifying and disposing of hundreds of millions of old stored fi les. (Many companies have billions of old fi les.) This buildup necessitates leveraging tech- nology, specifi cally, technologies that can discern the meaning of stored unstructured content, in a variety of formats, regardless of where it is stored.
Here is a starting point: Most likely, fi le shares, legacy e-mail systems, and other large repositories will prove the most target-rich environments, while better-managed document management, records management, or archival systems will be in less need of remediation. A good time to undertake a cleanup exercise is when litigation will not prevent action or when migrating to a new IT platform. (Trying to conduct a compre- hensive, document-level inventory and disposition is neither reasonable nor practical. In most cases, it will create limited results and even further frustration.)
Technology choices should be able to withstand legal challenges in court. Sophisticated technologies available today should also look beyond mere keyword searches (as their defensibility may be called into question) and should look to
Organizations can improve disposition and IG programs with a systemized, repeatable, and defensible approach.
136 INFORMATION GOVERNANCE
advanced techniques such as automatic text classifi cation (auto-classifi cation), concept search, contextual analysis, and automated clustering. While technology is imperfect, it is better than what employees can do and will never be able to accomplish—to man- age terabytes of stored information and clean up big piles of dead data.
Defensibility Is the Desired End State; Perfection Is Not
Defensible disposition is a way to take on huge piles of information without personally cracking each one open and evaluating it. Perhaps it is, in essence, operationalizing a retention schedule that is no longer viable in the electronic age. Defensible disposition is a must because most big companies have hundreds of millions or billions of fi les, which makes their individualized management all but impossible.
As the list of eight steps to defensible disposition makes clear, different chunks of data will require different diligence and analysis levels. If you have 100,000 backup tapes from 20 years ago, minimal or cursory review may be required before the whole lot of tapes can be comfortably discarded. If, however, you have an active shared drive with records and information that is needed for ongoing litigation, there will need to be deeper analysis with analytics and/or classifi cation technologies that have become much more powerful and useful. In other words, the facts surrounding the information will help inform if the information can be properly disposed with minimal analysis or if it requires deep diligence.
Kahn’s Eight Essential Steps to Defensible Disposition 1. Defi ne a reasonable diligence process to assess the business needs and legal
requirements for continued information retention and/or preservation, based on the information at issue.
2. Select a practical information assessment and/or classifi cation approach, given information volumes, available resources, and risk profi le.
3. Develop and document the essential aspects of the disposition program to ensure quality, effi cacy, repeatability, auditability, and integrity.
4. Develop a mechanism to modify, alter, or terminate components of the dispo- sition process when required for business or legal reasons.
5. Assess content for eligibility for disposition, based on business need, record retention requirements, and/or legal preservation obligations.
6. Test, validate, and refi ne as necessary the effi cacy of content assessment and disposition capability methods with actual data until desired results have been attained.
7. Apply disposition methodology to content as necessary, understanding that some content can be disposed with suffi cient diligence without classifi cation.
8. On an ongoing basis, verify and document the effi cacy and results of the dis- position program and modify and/or augment the process as necessary.
Source: “Chucking Daises: Ten Rules for Taking Control of Your Organization’s Digital Debris,” Randy Kahn, Esq., and Galena Datskovsky Ph.D., CRM (ARMA International, 2013), Overland Park, KS.
Business Case around Defensible Disposition
What is clear is that defensible disposition can have signifi cant ROI impact to a com- pany’s fi nancial picture. This author has clients for whom we have built the defensible
INFORMATION GOVERNANCE AND LEGAL FUNCTIONS 137
disposition business case, which saves them tens of millions of dollars on a net basis but also makes them a more effi cient business, reduces litigation cost and risks, mitigates the information security and privacy risk profi les, and makes their work force more productive, and so on.
However, remember auto-classifi cation technology is neither simple nor inexpen- sive, so be realistic and conservative when building the business case. Often it is easiest to simply use only hardware storage cost savings to make the case because it is a hard number and provides a conservative approach to justifying the activities. Then you can add on the additional benefi ts, which are more diffi cult to calculate, and also the intangible benefi ts of giving your employees a cleaner information stack to search and base decisions on.
Defensible Disposition Summary
Defensible disposition is a way to bring your records management program into to- day’s business reality—information growth makes management at the record level all but impossible. Defensible disposition should be about taking simplifi ed retention rules and applying them to both structured and unstructured content with the least amount of human involvement possible. While it can be a daunting challenge, it is also an opportunity to establish and promote operational excellence through better IG and to signifi cantly enhance an organization’s business performance and competitive advantage.
Retention Policies and Schedules
By Robert Smallwood, edited by Paula Lederman, MLS
With limited resources, today’s legal counsel, compliance managers, and records man- ager are faced with an onslaught of increasingly pressing and complex compliance and legal demands. At the core of these demands is the ability of the organization to demonstrate that it has legally defensible records management practices that can hold up in court.
Organizations can legally destroy records—but will have a greater legal defensi- bility if:
■ The authority to destroy the records is identifi ed on a retention schedule. ■ The retention requirements have been met. ■ The records are slated for destruction in the normal course of business. ■ There are no existing legal or fi nancial holds. ■ Al records of the same type are treated consistently and systematically.
The foundation of legally defensible records management practices is a solid IG underpinning, where policies and processes, supported and enforced by IT, help the organization meet its externally mandated legal requirements and internally mandated IG requirements for handling and controlling information.
A complete, current, and documented records retention program reduces stor- age and handling costs and improves searchability for records by making records
138 INFORMATION GOVERNANCE
easier and faster to fi nd. This reduced search time and more complete search capability improves knowledge worker productivity. It also reduces legal risk by improving the ability to meet compliance demands while also reducing e-discovery costs and improving the ability to more effi ciently respond to discovery requests during litigation.
Most large organizations maintain records retention schedules by business unit, department, or functional area. Some organizations, particularly smaller ones, may establish organization-wide IG programs that call for the developing, updating, and improvement of an enterprise or master retention schedule. This is a tall order and is almost never accomplished—but it is possible with a determined, sustained effort. Developing enterprise-wide records retention schedules requires consultation with stakeholder groups that have valuable input to contribute to the overall development of the IG effort and to specifi c schedules for retaining record collections and their planned disposition. Consultation by the records manage- ment department, senior records offi cer , or records team must take place with representatives from the business units that create and own the records as well as with legal, compliance, risk management, IT, and other relevant stakeholder groups.
Meeting Legal Limitation Periods
A key consideration in developing retention schedules is researching and determin- ing the minimum time required to keep records that may be demanded in legal actions. “A limitation period is the length of time after which a legal action cannot be brought before the courts. Limitation periods are important because they de- termine the length of time records must be kept to support court action [including subsequent appeal periods]. It is important to be familiar with the purpose, prin- ciples, and special circumstances that affect limitation periods and therefore records retention.”34
Legal Requirements and Compliance Research
As stated at the beginning of this chapter, legal requirements trump all others. The reten- tion period for a particular records series must meet minimum retention requirements as mandated by law. Business needs and other considerations are secondary. So, legal research is required before determining retention periods. Legally required retention periods must be researched for each jurisdiction (state, country) in which the business operates, so that it complies with all applicable laws.
A limitation period is the length of time after which a legal action cannot be brought before the courts. Such a period must be factored into retention policies.
INFORMATION GOVERNANCE AND LEGAL FUNCTIONS 139
In order to locate the regulations and citations relating to retention of records, there are two basic approaches. The fi rst approach is to use a records retention citation service, which publishes in electronic form all of the retention-related citations. These services usually are bought on a subscription basis, as citations are updated on an an- nual or more frequent basis as legislation and regulations change.
Another approach is to search the laws and regulations directly using online or print resources. Records retention requirements for corporations operating in the United States may be found in the Code of Federal Regulations (CFR), the annual edition of which:
is the codifi cation of the general and permanent rules published in the Fed- eral Register by the departments and agencies of the federal government. It is divided into 50 titles that represent broad areas subject to federal regulation. The 50 subject matter titles contain one or more individual volumes, which are updated once each calendar year, on a staggered basis. The annual update cycle is as follows: titles 1 to 16 are revised as of January 1; titles 17 to 27 are revised as of April 1; titles 28 to 41 are revised as of July 1, and titles 42 to 50 are revised as of October 1. Each title is divided into chapters, which usually bear the name of the issuing agency. Each chapter is further subdivided into parts that cover specifi c regulatory areas. Large parts may be subdivided into subparts. All parts are organized in sections, and most citations to the CFR refer to material at the section level. 35
There is an up-to-date version that is not yet a part of the offi cial CFR but is updated daily, the Electronic Code of Federal Regulations (e-CFR) . “It is not an offi cial legal edition of the CFR. The e-CFR is an editorial compilation of CFR mate- rial and Federal Register amendments produced by the National Archives and Records Administration’s Offi ce of the Federal Register (OFR) and the Government Printing Offi ce.”36 According to the gpoaccess.gov Web site:
The Administrative Committee of the Federal Register (ACFR) has authorized the National Archives and Records Administration’s (NARA) Offi ce of the Fed- eral Register (OFR) and the Government Printing Offi ce (GPO) to develop and maintain the e-CFR as an informational resource pending ACFR action to grant the e-CFR offi cial legal status. The OFR/GPO partnership is committed to presenting accurate and reliable regulatory information in the e-CFR edito- rial compilation with the objective of establishing it as an ACFR sanctioned publication in the future. While every effort has been made to ensure that the e-CFR on GPO Access is accurate, those relying on it for legal research should verify their results against the offi cial editions of the CFR, Federal Register and List of CFR Sections Affected (LSA), all available online at www.gpoaccess.gov. Until the ACFR grants it offi cial status, the e-CFR editorial compilation does not provide legal notice to the public or judicial notice to the courts.
The OFR updates the material in the e-CFR on a daily basis. Generally, the e-CFR is current within two business days. The current update status is displayed at the top of all e-CFR web pages.
140 INFORMATION GOVERNANCE
What Is a Records Retention Schedule?
A records retention schedule delineates how long a (business) record series is to be retained, and its disposition after its life cycle is complete (e.g., destruc- tion, transfer, archiving); the schedule also contains “lists of records by name or type that authorize the disposition of records.”37 Retention schedules apply to all records regardless of their format or media (e.g., physical or electronic). Retention schedules are developed for records not individually but rather by records series, categories, functions, or systems. Ideally, they include all of the record series in an organization, although they may be broken down into smaller subset schedules, such as by busi- ness unit.
Retention schedules may be maintained separately for electronic records, or they may be included in a combined schedule that includes both e-records and paper or other physical records.
Corporate records retention schedules are increasingly being maintained online, where users and also IT, legal, risk, and records management personnel can view and reference them. Electronic data and documents can easily reference these schedules and initiate a process based on a trigger event so that the life cycle of the electronic document can be automated and managed in a consistent manner. Retention schedules are basic tools that allow an organization to prove that it has a legally defensible basis on which to dispose records.
Retention schedules in large organizations typically are broken down and by business function. A functional retention schedule groups record series based on business functions, such as fi nancial, legal, product management, or sales. Each func- tion or grouping also is used for classifi cation. Rather than detail every sequence of records, these larger functional groups are less numerous and are easier for users to understand.
Some organizations are able to reach the ultimate retention goal: to keep an enterprise-wide master retention schedule, which includes the retention and
Retention schedules are developed by records series, category, function, or system—not for individual records.
Retention schedules are basic tools that allow an organization to prove that it has a legally defensible basis on which to dispose records.
A complete, current, and documented records retention program reduces storage and handling costs and improves searchability for records by making records easier and faster to fi nd.
INFORMATION GOVERNANCE AND LEGAL FUNCTIONS 141
disposition requirements for records series that cross business unit boundaries. The master retention schedule contains all records series in the entire enterprise. An enterprise-wide retention schedule is preferable because it eliminates the possibility that different business units will follow confl icting records retention periods. For example, if one business unit is discarding a group of records after 5 years, it would not make sense for another business unit to keep the same records for 10 years.
Benefi ts of a Retention Schedule
According to the U.S. National Archives and Records Administration, developing and maintaining a records retention schedule provides the following benefi ts. The reten- tion schedule: 38
1. Reduces legal risk and legal liability exposure. 2. Supports a legally defensible records management program. 3. Improves IG by enforcing uniformity and standardization. 4. Improves search quality and reduces search time. 5. Provides higher-quality records information to improve decision support for
knowledge workers. 6. Prevents inadvertent, malicious, or premature destruction of records. 7. Improves accountability for life cycle management of records on an enter-
prise-wide basis. 8. Improves security for confi dential records assets. 39 9. Reduces and minimizes costs for maintaining records. 10. Determines which records have historic value. 11. Saves hardware, utility, and labor costs by deleting records after their life
span. 12. Optimizes use of online storage and access resources.
A formal approach to records management has been around since the mid-1900s, so a great deal of guidance is available before embarking on developing or updating your records retention program. Models and guides can be used to assist in the devel- opment of records retention schedules for your organization, including the interna- tional standard for records management, ISO 15489—Part 1 and 2:2001, “Information and Documentation—Records Management”; the ISO 15489 standard was written to address all kinds of records. Additional guidance may be obtained by referencing national standards, such as those in Canada, Europe, Australia, and other countries. 40 Often, in the public sector, retention guidelines are published by an authority such as the offi ce of the national, state, or provincial archivist. Some additional insights may be gleaned from ISO 16175–1:2010, “Information and Documentation—Principles and Functional Requirements for Records in Electronic Offi ce Environments—Part 1: Overview and Statement of Principles,” which establishes fundamental principles and functional requirements for software used to create and manage digital records in offi ce environments. 41
A records retention schedule is an essential part of an overall IG program. Due to the fact that a concerted IG program standardizes and enforces uniformity and
142 INFORMATION GOVERNANCE
control, the entire organization benefi ts in terms of productivity, reduced risk, and improved compliance and e-discovery processes. These overarching goals and benefi ts should be championed by senior management in words and deeds. This means making the IG effort visible and providing the proper budgetary resources in terms of money and employee time to achieve its aims.
More detail on retention schedules can be found in Chapter 9 on IG and RIM functions.
The master retention schedule contains all records series in the entire enterprise.
CHAPTER SUMMARY: KEY POINTS
■ Legal functions are the most important area of IG impact.
■ IG serves as the underpinning for effi cient e-discovery processes.
■ ESI is any information that is created or stored in electronic format.
■ The goal of the FRCP amendments is to recognize the importance of ESI and to respond to the increasingly prohibitive costs of document review and pro- tection of privileged documents.
■ The amended FRCP reinforce the importance of IG. Only about 25 percent of business information has real value and 5 percent are business records.
■ The Big Data trend underscores the need for defensible deletion of data debris.
■ In the landmark case Zubulake v. U.B.S. Warburg, the defendants were se-g verely punished by an adverse inference for deleting key e-mails and not producing copies on backup tapes.
■ The E-Discovery Reference Model is a planning tool that depicts key e-discovery process steps.
■ Implementing IG, inventorying ESI, and leveraging technology to implement records retention and LHN policies are key steps in e-discovery planning.
■ LHN management is the absolute minimum an organization should imple- ment to meet the guidelines, rules, and precedents.
■ Predictive coding software leverages human analysis when experts review a subset of documents to “teach” the software what to look for, so it can apply this logic to the full set of documents.
INFORMATION GOVERNANCE AND LEGAL FUNCTIONS 143
■ Many technologies assist in making incremental reductions in e-discovery costs, but only fully integrated predictive coding is able to completely trans- form the economics of e-discovery.
■ TAR, also known as computer-assisted review, speeds the review process by leveraging IT tools.
■ In TAR, there are three main ways to use technology to make legal review faster, less costly, and generally smarter: rules driven, facet driven, and propa- gation based.
■ It is important to have the right people in place to support the technology and the work fl ow required to conduct TAR.
■ A defensible disposition framework is an ecosystem of technology, policies, procedures, and management controls designed to ensure that records are created, managed, and disposed of at the end of their life cycle.
■ A better approach is for organizations to move away from a reactive “keep- everything” strategy to a proactive strategy of defensible deletion.y
■ Organizations can improve disposition and IG programs with a systemized, repeatable, and defensible approach.
■ A limitation period—the length of time after which a legal action cannot be brought before the courts—must be factored into retention policies.
■ A complete, current, and documented records retention program reduces storage and handling costs and improves searchability for records by making records easier and faster to fi nd.
■ Retention schedules are developed by records series, not for individual records.
■ Retention schedules are basic tools that allow an organization to prove that it has a legally defensible basis on which to dispose of records.
■ The master retention schedule contains all records series in the entire enterprise.
■ “Records retention” defi nes the length of time that records are to be kept and considers legal, regulatory, operational, and historical requirements.
■ Disposition means not just destruction but can also mean archiving and a change in ownership and responsibility for the records.
■ For most organizations, e-mail is the most common information source to begin deleting according to established retention policies.
CHAPTER SUMMARY: KEY POINTS (Continued )
144 INFORMATION GOVERNANCE
Notes
1. Linda Volonino and Ian Redpath, e-Discovery for Dummies (Hoboken, NJ: John Wiley & Sons, 2010),s p. 9. This material is reproduced with permission from John Wiley & Sons, Inc.
2. “New Fed. Rules to Civil Procedure,” www.uscourts.gov/FederalCourts/UnderstandingtheFederalCourts/ DistrictCourts.aspx; (accessed November 26, 2013).
3. Ibid. 4. Ibid. 5. Volonino and Redpath, e-Discovery for Dummies, p. 13.s 6. Ibid., p. 11. 7. “New Fed. Rules to Civil Procedure.” www.uscourts.gov/FederalCourts/UnderstandingtheFederalCourts/
DistrictCourts.aspx; (accessed November 26, 2013). 8. “The Digital Universe Decade—Are You Ready?” IDC iView (May 2010). 9. Deidra Paknad, “Defensible Disposal: You Can’t Keep All Your Data Forever,” July 17, 2012, www.forbes
.com/sites/ciocentral/2012/07/17/defensible-disposal-you-cant-keep-all-your-data-forever/ 10. Sunil Soares, Selling Information Governance to the Business (MC Press Online, Ketchum, ID, 2011), p. 229. s 11. All quotations from the FRCP are from Volonino and Redpath, e-Discovery for Dummies , www.dummiess
.com/how-to/content/ediscovery-for-dummies-cheat-sheet.html (accessed May 22, 2013). 12. Linda Volonino and Ian Redpath, e-Discovery for Dummies (Hoboken, NJ: John Wiley & Sons, 2010), p. 13. s 13. Case Briefs, LLC, “Zubulake v. UBS Warburg LLC,” www.casebriefs.com/blog/law/civil-procedure/
civil-procedure-keyed-to-friedenthal/pretrial-devices-of-obtaining-information-depositions-and-dis- covery-civil-procedure-keyed-to-friedenthal-civil-procedure-law/zubulake-v-ubs-warburg-llc/2/ (ac- cessed May 21, 2013).
14. Amy Girst, “E-discovery for Lawyers,” IMERGE Consulting Report, 2008. 15. ECM2, “15-Minute Guide to eDiscovery and Early Case Assessment,” www.emc.com/collateral/
15-min-guide/h9781-15-min-guide-ediscovery-eca-gde.pdf (accessed May 21, 2013 16. Barry Murphy, telephone interview with author, April 12, 2013. 17. Email to author August 16, 2012. 18. Recommind, “What Is Predictive Coding?” www.recommind.com/predictive-coding (accessed
May 7, 2013). 19. Michael LoPresti, “What Is Predictive Coding?: Including eDiscovery Applications,” KMWorld,
January 14, 2013, www.kmworld.com/Articles/Editorial/What-Is-…/What-is-Predictive-Coding-Including- eDiscovery-Applications-87108.aspx
20. “Predictive Coding,” TechTarget.com, http://searchcompliance.techtarget.com/defi nition/predictive- coding, August 31, 2012 (accessed May 7, 2013).
21. “Machine Learning,” TechTarget.com http://whatis.techtarget.com/defi nition/machine-learning, accessed May 7, 2013.
22. “Predictive Coding.” 23. LoPresti, “What Is Predictive Coding?” 24. Ibid. 25. “What Does Predictive Coding Require?” Recommind Corp., www.recommind.com/predictive-coding
(accessed May 24, 2013). 26. Ibid. 27. Barry Murphy, e-mail to author, May 10, 2013. 28. Ibid. 29. Ibid. 30. “The digital universe in 2020: Big Data, Bigger Digital Shadows, and Biggest Grow in the Far East,”
www.emc.com/collateral/analyst-reports/idc-the-digital-universe-in-2020.pdf (accessed November 26, 2013).
31. Council of Information Auto-Classifi cation, “Information Explosion” survey, http://infoautoclassifi cation .org/survey.php (accessed November 26, 2013).
32. Ibid. 33. Maura R. Grossman and Gordon V. Cormack, “Technology-Assisted Review in E-Discovery Can Be
More Effective and More Effi cient Than Exhaustive Manual Review.” http://delve.us/downloads/Tech- nology-Assisted-Review-In-Ediscovery.pdf (accesssed November 26, 2013).
34. Government of Alberta, “Developing Retention and Disposition Schedules,” July 2004, p. 122, www .rimp.gov.ab.ca/publications/pdf/SchedulingGuide.pdf
35. U.S. Government Printing Offi ce (GPO), “Code of Federal Regulations,” www.gpo.gov/help/index .html#about_code_of_federal_regulations.htm (accessed April 22, 2012).
INFORMATION GOVERNANCE AND LEGAL FUNCTIONS 145
36. National Archives and Records Administration, “Electronic Code of Federal Regulations,” October 2, 2012 http://ecfr.gpoaccess.gov/cgi/t/text/text-idx?c=ecfr&tpl=%2Findex.tpl
37. U.S. Department of Energy, Records Retention Schedule Defi nition, https://commons.lbl.gov/display/ aro/Records+Retention+Schedule+Defi nition (accessed July 30, 2012).
38. National Archives, “Frequently Asked Questions about Records Scheduling and Disposition,” updated June 6, 2005, www.archives.gov/records-mgmt/faqs/scheduling.html#whysched
39. Government of Alberta, “Developing Retention and Disposition Schedules.” 40. National Archives, “Frequently Asked Questions about Records Scheduling and Disposition.” 41. International Organization for Standardization, ISO 16175-1:2010, “Information and Documentation—
Principles and Functional Requirements for Records in Electronic Offi ce Environments—Part 1: Overview and Statement of Principles,” www.iso.org/iso/catalogue_detail.htm?csnumber=55790 (accessed July 30, 2012).
147
R ecords management (RM) is a key impact area of t information governance (IG)—so much so that in the RM space, IG is often thought of as synonymous with or a simple superset of RM. But IG is much more than that. We delve into
the details of RM here—a sort of crash course on how to identify and inventory re- cords, conduct the necessary legal research, develop retention and disposition sched- ules, and more. Also, we identify the relationship and impact of IG on the RM function in an organization in this chapter.
The International Organization for Standardization (ISO) defi nes (business) records as “information created, received, and maintained as evidence and informa- tion by an organization or person, in pursuance of legal obligations or in the transac- tion of business.” 1 It further defi nes RM as “[the] fi eld of management responsible for the effi cient and systematic control of the creation, receipt, maintenance, use, and disposition of records, including the processes for capturing and maintaining evidence of and information about business activities and transactions in the form of records.” 2
The U.S.-based Association of Records Managers and Administrators (ARMA) defi nes records as “evidence of what an organization does. They capture its business activities and transactions, such as contract negotiations, business correspondence, personnel fi les, and fi nancial statements.” 3
Records and information management (RIM) extends beyond RM (although t the terms are often used interchangeably) to include information—that is, information such as data, electronic documents, and reports. For this reason, RIM professionals must expand their reach and responsibilities to include policies for retention and dis- position of all legally discoverable forms of information, such as e-mail, social media posts, mobile data and documents held on portable devices, cloud storage and applica- tions, and other enterprise data and information.
Electronic records management (ERM) has moved to the forefront of busi-t ness issues with the increasing automation of business processes and the vast growth in the volume of electronic documents and records that organizations create. These
Portions of this chapter are adapted from Chapters 1 , 5 , and 7 of Robert F. Smallwood, Managing Electronic Records: Methods, Best Practices, and Technologies , © John Wiley & Sons, Inc., 2013. Reproduced with permission of John Wiley s & Sons, Inc.
C H A P T E R 9 Information Governance and Records and Information Management Functions
148 INFORMATION GOVERNANCE
factors, coupled with expanded and tightened reporting laws and compliance regula- tions, have made ERM essential for most enterprises—especially highly regulated and public ones.
ERM follows generally the same principles as traditional paper-based records management: There are classifi cation and taxonomy needs to group and organize y the records, and there are retention and disposition schedules to govern the length of time a record is kept and its ultimate disposition (destruction, transfer, or long-term archiving) destruction or long-term archiving. Yet e-records must be handled differ- ently, and they contain more detailed data about their contents and characteristics, known as metadata. (For more detail on these topics see Appendix A. )
E-records are also subject to changes in information technology (IT) that may y make them diffi cult to retrieve and view and therefore render them obsolete. These is- sues can be addressed through a sound ERM program that includes long-term digital preservation (LTDP) methods and technologies.
ERM is primarily the organization, management, control, monitoring, and auditing of formal business records that exist in electronic form. But automated ERM systems also track paper-based and other physical records. So ERM goes beyond simply managing elec- tronic records; it is the management of electronic records and the electronic management of non- electronic records (e.g., paper, CD/DVDs, magnetic tape, audio-visual, and other physical records).
Most electronic records, or e-records, originally had an equivalent in paper form, such as memos (now e-mail), accounting documents (e.g., purchase orders, invoices), personnel documents (e.g., job applications, resumes, tax documents), contractual documents, line-of-business documents (e.g., loan applications, insurance claim forms, health records), and required regulatory documents (e.g., material safety data sheets). Before e-document and e-record software began to mature in the 1990s, many of these documents were fi rst archived to microfi lm or microform/microfi che.
Not all documents rise to the level of being declared a formal business record that needs to be retained; that defi nition depends on the specifi c regulatory and legal re- quirements imposed on the organization and the internal defi nitions and requirements the organization imposes on itself, through internal IG measures and business policies. IG is the policies, processes, and technologies used to manage and control information through- out the enterprise to meet internal business requirements and external legal and compliance demands.
E-records management has become much more critical to enterprises with in- creased compliance legislation and massively increasing volumes of electronic information.
ERM follows the same basic principles as paper-based records management.
INFORMATION GOVERNANCE AND RECORDS 149
ERM is a component of enterprise content management (ECM), just as document management, Web content management, digital asset management, enterprise report management, and several other technology sets are components. ECM encompasses all an organization’s unstructured digital content, which means it excludes structured l data (i.e., databases). ECM includes the vast majority—over 90 percent—of an organi- zation’s overall information that must be governed and managed.
ERM extends ECM to provide control and to manage records through their life cycle—from creation to destruction. ERM is used to complete the life cycle manage- ment of information, documents, and records.
ERM adds the functionality to complete the management of information and records by applying business rules to manage the maintenance, preservation, and disposition of records. Both ERM and ECM systems aid in locating and managing the records and infor- mation needed to conduct business effi ciently, to comply with legal and regulatory requirements, and to effectively destroy (paper) and delete (digital) records that have met their retention policy time frame requirement, freeing up valuable physical and digital space and eliminating records that could be a liability if kept.
Records Management Business Rationale
Historically, highly regulated industries, such as banking, energy, and pharmaceuticals, have had the greatest need to implement RM programs, due to their compliance and reporting requirements. 4 However, over the past decade or so, increased regulation and changes to legal statutes and rules have made RM a business necessity for nearly every enterprise (beyond very small businesses).
Notable industry drivers include:
■ Increased government oversight and industry regulation. Government regulations that require enhanced reporting and accountability were early business drivers that fueled the implementation of formal RM programs. This is true at the federal and state or provincial level. In the United States, the Sarbanes–Oxley Act of 2002 (SOX) created and enhanced standards of fi nancial reporting and transparency for the boards and executive management of public corporations and accounting fi rms. It also addressed auditor independence and corporate governance concerns. SOX imposes fi nes or imprisonment penalties for non- compliance and requires that senior offi cers sign off on the veracity of fi nancial statements. It states clearly that pertinent business records cannot be destroyed during litigation or compliance investigations. Since SOX was enacted, Japan, Australia, Germany, France, and India also have adopted stricter “SOX-like” governance and fi nancial reporting standards.
ERM includes the management of electronic and nonelectronic records, such as paper and other physical records.
150 INFORMATION GOVERNANCE
■ Changes in legal procedures and requirements during civil litigation. In 2006, the need to amend the U.S. Federal Rules of Civil Procedure (FRCP) to contain specifi c rules for handling electronically generated evidence was addressed. The changes included processes and requirements for legal discovery of elec- tronically stored information (ESI) during civil litigation. Today, e-mail is the leading form of evidence requested in civil trials. The changes to the U.S. FRCP had a pervasive impact on American enterprises and required them to gain control over their ESI and implement formal RM and electronic discovery (e-discovery) programs to meet new requirements. Although they have been ahead of the United States in their development and maturity of RM practic- es, Canadian, British, and Australian law is closely tracking that of the United States in legal discovery. The United States is a more litigious society, so this is not unexpected.
■ IG awareness. IG, in short, is the set of rules, policies, and business process- es used to manage and control the totality of an organization’s information. Monitoring technologies are required to enforce and audit IG compliance. Beginning with SOX in 2002 and continuing with the massive U.S. FRCP changes in 2006, enterprises have become more IG aware and have ramped up efforts to control, manage, and secure their information. A signifi cant component of any IG program is implementing an RM program that specifi es the retention periods and disposition (e.g., destruction, transfer, archive) of formal business records. This program, for instance, allows enterprises to destroy records once their required retention period (based on external regulations, legal requirements, and inter- nal IG policies) has been met and allows them to legally destroy records with no negative impact or lingering liability.
■ Business continuity concerns. In the face of real disasters, such as the 9/11 terror- ist attacks, Hurricane Katrina, and Superstorm Sandy, executives now realize that disaster recovery and business resumption must be planned and prepared for. Disasters really happen, and businesses that are not well prepared really go under. The focus is on vital records that are necessary to resume operations in the event of a disaster, and managing those records is part of an overall RM program.
Why Is Records Management So Challenging?
With these changes in the business environment and in regulatory, legal, and IG infl u- ences comes increased attention to RM as a driver for corporate compliance. For most organizations, a lack of defi ned policies and the enormous and growing volumes
A number of factors provide the business rationale for ERM, including facilitating compliance, supporting IG, and providing backup capabilities in the event of a disaster.
INFORMATION GOVERNANCE AND RECORDS 151
of documents (e.g., e-mail messages) make implementing a formal RM program chal- lenging and costly. Some reasons for this include:
■ Changing and increasing regulations. Just when records and compliance managers have sorted through the compliance requirements of federal regulations, new ones at the state or provincial level are created or tightened down.
■ Maturing IG requirements within the organization. As senior managers become increasingly aware of IG—the rules, policies, and processes that control and manage information—they promulgate more reporting and auditing require- ments for the management of formal business records.
■ Managing multiple retention and disposition schedules. Depending on the type of record, retention requirements vary, and they may vary for the same type of record based on state and federal regulations. Further, internal information governance policies may extend retention periods and may fl uctuate with management changes.5
■ Compliance costs and requirements with limited staff. RM and compliance depart- ments are notoriously understaffed, since they do not generate revenue. De- partments responsible for executing and proving compliance with new and increasing regulatory requirements must do so expediently, often with only skeletal staffs. This leads to expensive outsourcing solutions or staff increases. The cost of compliance must be balanced with the risk of maintaining a mini- mum level of compliance.
■ Changing information delivery platforms. With cloud computing, mobile com- puting, Web 2.0, social media, and other changes to information delivery and storage platforms, records and compliance managers must stay apprised of the latest IT trends and provide records on multiple platforms all while maintain- ing the security and integrity of organizational records.
■ Security concerns. Protecting and preserving corporate records is of paramount importance, yet users must have reasonable access to offi cial records to conduct everyday business. “Organizations are struggling to balance the need to provide accessibility to critical corporate information with the need to protect the in- tegrity of corporate records.” 6
■ Dependence on the IT department or provider. Since tracking and auditing use of formal business records requires IT, and records and compliance departments typically are understaffed, those departments must rely on assistance from the IT department or outsourced IT provider—which often does not have the same perspective and priorities as the departments they serve.
■ User assistance and compliance. Users often go their own way with regard to records, ignoring directives from records managers to stop storing shadow fi les of records on their desktop (for their own convenience) and inconsistently following directives to classify records as they are created. Getting users across a range of departments in the enterprise to adhere uniformly with records and compliance requirements is a daunting and unending task that requires constant attention and reinforcement. 7
Implementing ERM is challenging because it requires user support and com- pliance, adherence to changing laws, and support for new information deliv- ery platforms, such as mobile and cloud computing.
152 INFORMATION GOVERNANCE
Benefi ts of Electronic Records Management
A number of business drivers and benefi ts combine to create a strong case for imple- menting an enterprise ERM program. Most are tactical, such as cost savings, time savings, and building space savings. But some drivers can be thought of as strategic , in that c they proactively give the enterprise an advantage. One example may be the advantages gained in litigation by having more control and ready access to complete business records, which yields more accurate results and more time for corporate attorneys to develop strategies while the opposition is wading through reams of information, never knowing if it has found the complete set of records it needs. Another example is more complete and better information for managers to base decisions on.
Implementing ERM represents a signifi cant investment. An investment in ERM is an investment in business process automation and yields document control, document integrity, and security benefi ts. The volume of records in organizations often exceeds employees’ ability to manage them. ERM systems do for the information age what the assembly line did for the industrial age. The cost/benefi t justifi cation for ERM is sometimes diffi cult to determine, although there are real labor and cost savings. Also, many of the benefi ts are intangible or diffi cult to calculate but help to justify the capital investment. There are many ways in which an organization can gain signifi cant business benefi ts with ERM.
More detail on business benefi ts is provided in Chapter 7 , but hard, calculable benefi ts (when compared to storing paper fi les) include offi ce space savings, offi ce supplies savings, cutting wasted search time, and reduced offi ce automation costs (e.g., fewer printers, copiers, cutting automated fi ling cabinets).
In addition, implementing ERM will provide the organization with:
■ Improved capabilities for enforcing IG over business documents and records ■ Improved, more complete, and more accurate searches ■ Improved knowledge worker productivity ■ Reduced risk of compliance actions or legal consequences ■ Improved records security ■ Improved ability to demonstrate legally defensible RM practices ■ Increased working confi dence in making searches, which should improve deci-
sion making
An investment in ERM is an investment in business process automation and yields document control, document integrity, and security benefi ts.
ERM benefi ts are both tangible and intangible or diffi cult to calculate.
INFORMATION GOVERNANCE AND RECORDS 153
Additional Intangible Benefi ts
The U.S. Environmental Protection Agency (EPA), a pioneer and leader in e-records im- plementation in the federal sector, lists some additional benefi ts of implementing ERM:
1. To control the creation and growth of records. Despite decades of using vari- ous nonpaper storage media, the amount of paper in our offi ces continues to escalate. An effective records management program addresses both cre- ation control (limits the generation of records or copies not required to operate the business) and records retention (a system for destroying useless records or retiring inactive records), thus stabilizing the growth of records in all formats.
2. To assimilate new records management technologies. A good records manage- ment program provides an organization with the capability to assimilate new technologies and take advantage of their many benefi ts. Investments in new computer systems don’t solve fi ling problems unless current manual record-keeping systems are analyzed (and occasionally, overhauled) before automation is applied.
3. To safeguard vital information. Every organization, public or private, needs a comprehensive program for protecting its vital records and information from catastrophe or disaster, because every organization is vulnerable to loss. Operated as part of the overall records management program, vital records programs preserve the integrity and confi dentiality of the most important records and safeguard the vital information assets according to a “plan” to protect the records.
4. To preserve the corporate memory. An organization’s fi les contain its institu- tional memory, an irreplaceable asset that is often overlooked. Every busi- ness day, you create the records that could become background data for future management decisions and planning. These records document the activities of the agency that future scholars may use to research the work- ings of the Environmental Protection Agency.
5. To foster professionalism in running the business. A business offi ce with fi les askew, stacked on top of fi le cabinets and in boxes everywhere, creates a poor working environment. The perceptions of customers and the public, and “image” and “morale” of the staff, though hard to quantify in cost-benefi t terms, may be among the best reasons to establish a good records management program.8
Thus, there are a variety of tangible and intangible benefi ts derived from ERM programs, and the business rationale that fi ts for your organization depends on its specifi c needs and business objectives.
Improved professionalism, preserving corporate memory, and support for bet- ter decision making are key intangible benefi ts of ERM.
154 INFORMATION GOVERNANCE
Inventorying E-Records
According to the U.S. National Archives and Records Administration (NARA), “In records management, an t inventory is a descriptive listing of each record series ory system, together with an indication of location and other pertinent data. It is not a list of each document or each folder but rather of each series or system ”9 (emphasis added).
Conducting an inventory of electronic records is more challenging than perform- ing a physical records inventory, but the purposes are the same: to ferret out RM problems and to use the inventory as the basis for developing the retention schedule. Some of the RM problems that may be uncovered
include inadequate documentation of offi cial actions, improper applications of record-keeping technology, defi cient fi ling systems and maintenance prac- tices, poor management of nonrecord materials, insuffi cient identifi cation of vital records, and inadequate records security practices. When completed, the inventory should include all offi ces, all records, and all nonrecord materials. An inventory that is incomplete or haphazard can only result in an inadequate schedule and loss of control over records. 10
The fi rst step in gaining control over an organization’s records and imple- menting IG measures to control and manage them is to complete an inventory of all groupings of business records, including electronic records, 11 at the system or fi le series level.
The focus of this book is on IG and more granually e-records, and when it comes to e-records, NARA has a specifi c recommendation: Inventory at the computer systems level. This differs from advice given by experts in the past.
The records inventory is the basis for developing a records retention schedule that spells out how long different types of records are to be held and how they will be archived or disposed of at the end of their life cycle. But fi rst you must determine where business records reside, how they are stored, how many exist, and how they are used in the normal course of business.
There are a few things to keep in mind when approaching the e-records invento- rying process:
■ Those who create and work with the records themselves are the best source of information about how the records are used. They are your most critical resource in the inventorying process.
■ RM is something that everyone wants done but no one wants to do (although everyone will have an opinion on how to do it).
■ The people working in business units are touchy about their records. It will take some work to get them to trust a new RM approach. 12
NARA recommends that electronic records are inventoried by information sys- tem, not by record series.
INFORMATION GOVERNANCE AND RECORDS 155
These knowledge workers are your best resource and can be your greatest allies or worst enemies when it comes to gathering accurate inventory data; developing a workable fi le plan; and keeping the records declaration, retention, and disposition process operating effi ciently. A sound RM program will keep the records inventory accurate and up to date.
Generally Accepted Recordkeeping Principles®
See Chapter 3 for more detail on applicable principles in IG. To summarize: It may be useful to use a model or framework to guide your records inventorying efforts. Such frameworks could be the D.I.R.K.S. (Designing and Implementing Recordkeeping Systems) used in Australia or the Generally Accepted Recordkeeping Principles® (or “the Principles”) that originated in the United States at ARMA International. The Principles are a “framework for managing records in a way that supports an organization’s immediate and future regulatory, legal, risk mitigation, environmental, and operational requirements. ” 13
Special attention should be given to creating an accountable, open inventorying process that can demonstrate integrity. The result of the inventory should help the or- ganization adhere to records retention, disposition, availability, protection, and com- pliance aspects of The Principles.
The Generally Accepted Recordkeeping Principles were created with the as- sistance of ARMA International and legal and IT professionals who reviewed and distilled global best practice resources. These included the international records management standard ISO15489–1 from the American National Standards Institute and court case law. The principles were vetted through a public call-for-comment process involving the professional records informa- tion management . . . community. 14
E-Records Inventory Challenges
If your organization has received a legal summons for e-records, and you do not have an accurate inventory, the organization is already in a compromising position: You do not know where the requested records might be, how many copies there might be, or the process and cost of producing them. Inventorying must be done sooner rather than later and proactively rather than reactively.
E-records present challenges beyond those of paper of microfi lmed records due to their (elec- tronic) nature :
1. You cannot see or touch them without searching online, as opposed to simply thumbing through a fi ling cabinet or scrolling through a roll of microfi lm.
What are The Principles? They are guidelines for information management and governance of record creation, organization, security, maintenance, and other activities used to effectively support the recordkeeping of an organization.
156 INFORMATION GOVERNANCE
2. They are not sitting in a central fi le room but rather may be scattered about on servers, shared network drives, or on storage attached to mainframe or minicomputers.
3. They have metadata attached to them that may distinguish very similar- looking records.
4. Additional “shadow” copies of the e-records may exist, and it is diffi cult to determine the true or original copy.15
Records Inventory Purposes
The completed records inventory contributes toward the pursuit of an organization’s IG ob- jectives in a number of ways : It supports the ownership, management, and control of s records; helps to organize and prepare for the discovery process in litigation; reduces exposure to business risk; and provides the foundation for a disaster recovery/business continuity plan.
Completing the records inventory offers at least eight additional benefi ts:
1. It identifi es records ownership and sharing relationships, both internal and external.
2. It determines which records are physical, electronic, or a combination of both. 3. It provides the basis for retention and disposition schedule development. 4. It improves compliance capabilities. 5. It supports training objectives for those handling records. 6. It identifi es vital and sensitive records needing added security and backup
measures. 7. It assesses the state of records storage, its quality and appropriateness. 8. It supports the release of information for Freedom of Information Act (FOIA),
Data Protection Act, and other mandated information release requirements for governmental agencies. 16
With respect to e-records, the purpose of the records inventory should include the following objectives:
■ Provide a survey of the existing electronic records situation. ■ Locate and describe the organization’s electronic record holdings. ■ Identify obsolete electronic records. ■ Determine storage needs for active and inactive electronic records. ■ Identify vital and archival electronic records, indicating need for their on-
going care. ■ Raise awareness within the organization of the importance of electronic
records management. ■ Lead to electronic record keeping improvements that increase effi ciency. ■ Lead to the development of a needs assessment for future actions. ■ Provide the foundation of a written records management plan with a de-
termination of priorities and stages of actions, ensuring the continuing im- provement of records management practices. 17
INFORMATION GOVERNANCE AND RECORDS 157
Records Inventorying Steps
NARA’s guidance on how to approach a records inventory applies to both physical and e-records.
The steps in the records inventory process are:
1. Defi ne the inventory’s goals. While the main goal is gathering information for scheduling purposes, other goals may include preparing for conversion to other media, or identifying particular records management problems.
2. Defi ne the scope of the inventory; it should include all records and other materials.
3. Obtain top management’s support , preferably in the form of a directive, and t keep management and staff informed at every stage of the inventory.
4. Decide on the information to be collected (the elements of the inventory). Ma-d terials should be located, described, and evaluated in terms of use.
5. Prepare an inventory form , or use an existing one. 6. Decide who will conduct the inventory, and train them properly. 7. Learn where the agency’s [or business’s] s fi les are located , both physically and d
organizationally. 8. Conduct the inventory. 9. Verify and analyze the results. s 18
Goals of the Inventory Project
The goals of the inventorying project must be set and conveyed to all stakeholders. At a basic level, the primary goal can be simply to generate a complete inventory for compli- ance and reporting purposes. It may focus on a certain business area or functional group or on the enterprise as a whole. An enterprise approach requires segmenting the effort into smaller, logically sequenced work efforts, such as by business unit. Perhaps the organization has a handle on its paper and microfi lmed records but e-records have been growing exponentially and spiraling out of control, without good policy guidelines or IG controls. So a complete inventory of records and e-records by system is needed, which may include e-records generated by application systems, residing in e-mail, created in offi ce documents and spreadsheets, or other potential business records. This is a tactical approach that is limited in scope.
The goal of the inventorying process may be more ambitious: to lay the ground- work for the acquisition and implementation of an ERM system that will manage the retention, disposition, search, and retrieval of records. It requires more business
The completed records inventory contributes toward the pursuit of an organi- zation’s IG objectives in a number of ways.
158 INFORMATION GOVERNANCE
process analysis and redesign, some rethinking of business classifi cation schemes or fi le plans, and development of an enterprise-wide taxonomy. This redesign will allow for more sharing of information and records; faster, easier, and more complete retrievals; and a common language and approach for knowledge professionals across the enter- prise to declare, capture, and retrieve business records.
The plan may be still much greater in scope and involve more challenging goals: That is, the inventorying of records may be the fi rst step in the process of implementing an orga- nization-wide IG program to manage and control information by rolling out ERM and IG systems and new processes; to improve litigation readiness and stand ready for e-discovery requests; and to demonstrate compliance adherence with business agility and confi dence. Doing this involves an entire cultural shift in the organization and a long-term approach.
Whatever the business goals for the inventorying effort, they must be conveyed to all stake- holders, and that message must be reinforced periodically and consistently, and through multiple means. It must be clearly spelled out in communications and presented in meetings as the overarching goal that will help the organization meet its business objectives. The scope of the inventory must be appropriate for the business goals and objectives it targets.
Scoping the Inventory
“With senior-level support, the records manager must decide on the scope of the re- cords inventory. A single inventory could not describe every electronic record in an organization; an appropriate scope might enumerate the records of a single program or divi- sion, several functional series across divisions, or records that fall within a certain time frame. ” [emphasis added.] 19 Most organizations have not deployed an enterprise-wide records management system, which makes the e-records inventorying process arduous and time-consuming. It is not easy to fi nd where all the electronic records reside—they are scattered all over the place, and on different media. But impending (and inevitable) litigation and compliance demands require that it be done. And, again, sooner has been proven to be better than later. Since courts have ruled that if lawsuits have been fi led against your competitors over a certain (industry-specifi c) issue, your organiza- tion should anticipate and prepare for litigation—which means conducting records inventories and placing a litigation hold on documents that might be relevant. Simply doing nothing and waiting on a subpoena is an avoidable business risk.
Whatever the business goals for the inventorying effort are, they must be con- veyed to all stakeholders, and that message must be reinforced periodically and consistently, and through multiple means.
An appropriate scope might enumerate the records of a single program or division, several functional series across divisions, or records that fall within a certain time frame.
INFORMATION GOVERNANCE AND RECORDS 159
A methodical, step-by-step approach must be taken—it is the only way to ac- complish the task. A plan that divides up the inventorying tasks into smaller, ac- complishable pieces is the only one that will work. It has been said, “How do you eat an elephant?” And the answer is “One bite at a time.” So scope the inventorying process into segments, such as a business unit, division, or information system/ application.
Management Support: Executive Sponsor
It is crucial to have management support to drive the inventory process to completion. There is no substitute for an executive sponsor. Asking employees to take time out for yet another survey or administrative task without having an executive sponsor will likely not work. Employees are more time-pressed than ever, and they will need a clear directive from above, along with an understanding of what role the inventorying pro- cess plays in achieving a business goal for the enterprise, if they are to take the time to properly participate and contribute meaningfully to the effort.
Information/Elements for Collection
During the inventory you should collect the following information at a minimum:
■ What kind of record it is—contracts, fi nancial reports, memoranda, etc. ■ What department owns it ■ What departments access it ■ What application created the record (e-mail, MS Word, Acrobat PDF) ■ Where it is stored, both physically (tape, server) and logically (network
share, folder) ■ Date created ■ Date last changed ■ Whether it is a vital record (mission-critical to the organization) ■ Whether there are other forms of the record (for example, a document
stored as a Word document, a PDF, and a paper copy) and which of them is considered the offi cial record
Removable media should have a unique identifi er and the inventory r should include a list of records on the particular volume as well as the characteristics of the volume, e.g., the brand, the recording format, the capacity and volume used, and the date of manufacture and date of last update.20 (Emphasis added.)
Additional information not included in inventories of physical records must be collected in any inventory of e-records.
160 INFORMATION GOVERNANCE
IT Network Diagram Laying out the overall topology of the IT infrastructure in the form of a network diagram is an exercise that is helpful in understanding where to target efforts and to map information fl ows. Creating this map of the IT infrastructure is a crucial step in inventorying e-records. It graphically depicts how and where computers are connected to each other and the software operating environments of various applications that are in use. This high-level diagram does not need to include every device; rather, it should indicate each type of device and how it is used.
The IT staff usually has a network diagram that can be used as a reference; per- haps after some simplifi cation it can be put into use as the underpinning for inventory- ing e-records. It does not need great detail, such as where network bridges and routers are located, but it should show which applications are utilizing the cloud or hosted applications to store and/or process documents and records.
In diagramming the IT infrastructure for purposes of the inventory, it is easiest to start in the central computer room where any mainframe or other centralized servers are located and then follow the connections out into the departments and business unit areas, where there may be multiple shared servers and drives supported a network of desktop personal computers or workstations.
Microsoft’s SharePoint® is a prevalent document and RM portal platform, and many organizations have SharePoint servers to house and process e-documents and records. Some utilities and tools may be available to assist in the inventorying process on SharePoint systems.
Mobile devices (e.g., tablets, smartphones, and other portable devices) that are processing documents and records should also be represented. And any e-records re- siding in cloud storage should also be included.
Creating a Records Inventory Survey Form
The record inventory survey form must suit its purpose. Do not collect data that is ir- relevant, but, in conducting the survey, be sure to collect all the needed data elements. You can use a standard form, but some customization is recommended. The sample records survey form in Figure 9.1 is wide ranging yet succinct and has been used suc- cessfully in practice.
If conducting the e-records portion of the inventory, the sample form may be somewhat modifi ed, as shown in Figure 9.2 .
Who Should Conduct the Inventory?
Typically, a RM project team is formed to conduct the survey, often assisted by re- sources outside of the business units. These may be RM and IT staff members, business analysts, members of the legal staff, outside specialized consultants, or a combination of these groups. The greater the cross-section from the organization, the better, and the more expertise brought to bear on the project, the more likely it will be completed thoroughly and on time.
Critical to the effort is that those conducting the inventory are trained in the survey methods and analysis, so that when challenging issues arise, they will have the resources and know-how to continue the effort and get the job done.
INFORMATION GOVERNANCE AND RECORDS 161
Department Information
1. What is the reporting structure of the department?
2. Who is the department liaison for the records inventory?
3. Who is the IT or business analyst liaison?
Record Requirements
4. Are there any external agencies that impose guidelines, standards or other requirements?
5. Are there specifi c legislative requirements for creating or maintaining records? Please provide a copy.
6. Is there a departmental records retention schedule?
7. What are the business considerations that drive recordkeeping? Regulatory requirements? Legal requirements?
8. Does the department have an existing records management policy? Guidelines? Procedures? Please provide a copy.
9. Does the department provide guidance to employees on what records are to be created?
10. How are policies, procedures and guidance disseminated to the employees?
11. What is the current level of employees’ awareness of their responsibilities for records management?
12. How are nonrecords managed?
13. What is the process for ensuring compliance with policies, procedures, and guidelines?
When an employee changes jobs/roles or is terminated?
14. Does the department have a classifi cation or fi le plans?
15. Are any records in the department confi dential or sensitive?
16. What information security controls does the department have for confi dential or sensitive records?
17. Does the department have records in sizes other than letter (8½×11)?
18. What is the cutoff date for the records?
Fiscal Year Calendar Year Other
19. Have department vital records been identifi ed?
20. Is there an existing business or disaster recovery policy?
21. Is the department subject to audits? Internal? External? Who conducts the audits?
22. Where and how are records stored?
Online? Near Line? Offl ine? On-site? Off-site? One location? Multiple locations?
23. How does the department ensure that records will remain accessible, readable, and useable throughout their scheduled retention period?
Technology and Tools
24. Are any tools used to track active records? Spreadsheets, word documents, databases, and so forth?
25. Are any tools used to track inactive records? Spreadsheets, word documents, databases, and so forth?
26. Does the department use imaging, document management, and so forth?
Disposition
27. Are there guidelines for destroying obsolete records?
Figure 9.1 Records Inventory Survey Form
(continued )
162 INFORMATION GOVERNANCE
Identifying Information
1. Name of system.
2. Program or legal authority for system.
3. System identifi cation or control number.
4. Person responsible for administering the system. Include e-mail, offi ce address, and phone contact info.
5. Date system put in service.
6. Business unit or agency supported by system.
7. Description of system (what does the application software do?).
8. Purpose of system.
System Inputs/Outputs
9. Primary sources of data inputs.
10. Major outputs of system (e.g., specifi c reports).
11. Informational content (all applicable): Description of data; applicability of data (people, places, things); geographic information; time span; update cycle; applications the system supports; how data are manipulated; key unit analysis for each fi le; public use or not?
12. Hardware confi guration.
13. Software environment, including revision levels, operating system, database, and so forth.
14. Indices or any classifi cation scheme/fi le plan that is in place?
15. Duplicate records? Location and volume of any other records containing the same information.
Record Requirements
16. Are there any external agencies that impose guidelines, standards, or other requirements?
17. Are their specifi c legislative requirements for creating or maintaining records? Please provide a copy.
18. Is there a departmental records retention schedule?
19. What are the business considerations that drive recordkeeping? Regulatory requirements? Legal requirements?
20. Does the department have an existing records management policy? Guidelines? Procedures? If so, please provide a copy.
28. What disposition methods are authorized or required?
29. How does disposition occur? Paper? Electronic? Other?
30. What extent does the department rely on each individual to destroy records? Paper? Electronic? Other?
Records Holds
31. What principles govern decisions for determining the scope of records that must be held or frozen for an audit or investigations?
32. How is the hold or freeze communicated to employees?
33. How are records placed on hold protected?
Figure 9.2 Electronic Records Inventory Survey Form
Figure 9.1 (continued )
Source: Charmain Brooks, IMERGE Consulting, e-mail to author, March 20, 2012.
INFORMATION GOVERNANCE AND RECORDS 163
Determine Where Records Are Located
The inventory process is, in fact, a surveying process, and it involves going physically out into the units where the records are created, used, and stored. Mapping out where the records are geographically is a basic necessity. Which buildings are they located in? Which offi ce locations? Computer rooms?
Also, the inventory team must look organizationally at where the records reside (i.e., de-y termine which departments and business units to target and prioritize in the survey process).
Conduct the Inventory
Several approaches can be taken to conduct the inventory, including three basic methods:
1. Distributing and collecting surveys 2. Conducting in-person interviews 3. Direct observation
21. How are nonrecords managed?
22. Are any records in the department confi dential or sensitive? How are they indicated or set apart?
23. What information security controls does the department have for confi dential or sensitive records?
24. What is the cutoff date for the records?
Fiscal Year Calendar Year Other
25. Have department vital records been identifi ed?
26. Is there an existing business or disaster recovery policy?
27. Is the department subject to audits? Internal? External? Who conducts the audits?
28. Where and how are records stored?
Online? Near line? Offl ine? On-site? Off-site? One location? Multiple locations?
29. How does the department ensure that records will remain accessible, readable, and useable throughout their scheduled retention period?
Disposition
30. Are there guidelines for destroying obsolete records?
31. What disposition methods are authorized or required?
32. How does disposition occur? Are electronic deletions verifi ed?
33. What extent does the department rely on each individual to destroy e-records?
Records Holds
34. What principles govern decisions for determining the scope of records that must be held or frozen for an audit or investigations?
35. How is the hold or freeze communicated to employees?
36. How are records placed on hold protected?
Figure 9.2 (continued )
Source: Adapted from: www.archives.gov/records-mgmt/faqs/inventories.html and Charmaine Brooks, IMERGE Consulting.
164 INFORMATION GOVERNANCE
Creating and distributing a survey form is traditional and proven way to collect e-records inventory data. This is a relatively fast and inexpensive way to gather the inventory data. The challenge is getting the surveys completed in a consistent fashion. This is where a strong executive sponsor can assist. The sponsor can make the survey a priority and tie it to business objectives, making the survey completion compulsory. The survey is a good tool, and it can be used to cover more ground in the data collection pro- cess. If following up with interviews, the survey form is a good starting point; responses can be verifi ed and clarifi ed, and more detail can be gathered.
Some issues may not be entirely clear initially, so following up with scheduled in- person interviews can dig deeper into the business processes where formal records are create and used. A good approach is to have users walk you through their typical day and how they access, use, and create records—but be sure to interview managers too, as managers and users have differing needs and uses for records. 21
You will need some direction to conduct formal observation, likely from IT staff or business analysts familiar with the recordkeeping systems and associated business processes. They will need to show you where business documents and records are created and stored. If there is an existing ERM system or other automated search and retrieval tools available, you may use them to speed the inventorying process.
When observing and inventorying e-records, starting in the server room and working outward toward the end user is a logical approach. Begin by enumerating the e-records created by enterprise software applications (such as accounting, enterprise resource planning, or customer relationship management systems), and work your way to the departmental or business unit applications, on to shared network servers, then fi nally out to individual desktop and laptop PCs and other mobile devices. With to- day’s smartphones, this can be a tricky area, due to the variety of platforms, operating systems, and capabilities. In a bring-your-own-device environment, records should not be stored on personal devices, but if they must be, they should be protected with tech- nologies like encryption or information rights management.
There are always going to be thorny areas when attempting to inventory e-records to determine what fi les series exist in the organization. Mobile devices and removable media may contain business records. These must be identifi ed and isolated, and any records on these media must be recorded for the inventory. Particularly troublesome are thumb or fl ash drives, which are compact yet can store 20 gigabytes of data or more. If your IG measures call for excluding these types of media, the ports they use can be blocked on PCs, tablets, smartphones, and other mobile computing devices. A sound IG program will con- sider the proper use of removable media and the potential impact on your RM program.22
The best approach for conducting the inventory is to combine the available inventorying methods, where possible. Begin by observing, distribute surveys, collect and analyze them, and then target key personnel for follow-up interviews and walk-throughs. Utilize whatever automated tools are available along the way. This approach is the most com- plete. Bear in mind that the focus is not on individual electronic fi les but rather, the fi le series level for physical records and the fi le series or system level for e-records (preferably the latter).
There are three ways to conduct the inventory: surveys, interviews, and observation. Combining these methods yields the best results.
INFORMATION GOVERNANCE AND RECORDS 165
Interviewing Programs/Service Staff Interviews are a very good source of records inventory information. Talking with actual users will help the records lead or inventory team to better understand how documents and records are created and used in everyday operations. Users can also report why they are needed—an exercise that can uncover some obsolete or unnecessary processes and practices. This is helpful in determining where e-records reside and how they are grouped in records series or by system and ultimately, the proper length of their retention period and whether they should be archived or destroyed at the end of their useful life. 23
Since interviewing is a time-intensive task, it is crucial that some time is spent in determining the key people to interview: Interviews not only take your time but oth- ers’ as well, and the surest way to lose momentum on an inventorying project is to have stakeholders believe you are wasting their time.
You need to interview representatives from all functional areas and levels of the program or service, including:
■ managers ■ supervisors ■ professional/technical staff ■ clerical/support staff
The people who work with the records can best describe to you their use. They will likely know where the records came from, whether copies exist, who needs the records, any computer systems that are used, how long the records are needed and other important information that you need to know to schedule the records.
Selecting Interviewees As stated earlier, it is wise to include a cross-section of staff, managers and frontline employees to get a rounded view of how records are created and used. Managers have a different perspective and may not know how workers utilize electronic records in their everyday operations.
A good lens to use is to focus on those who make decisions based on informa- tion contained in the electronic records and to follow those decision-based processes through to completion, observing and interviewing at each level.
For example, an application is received (mail room logs date and time), checked (clerk checks the application for completeness and enters into a computer sys- tem), verifi ed (clerk verifi es that the information on the application is correct), and approved (supervisor makes the decision to accept the application). These staff members may only be looking at specifi c pieces of the record and making decisions on those pieces.
Interview Scheduling and Tips One rule to consider is this: Be considerate of other people’s work time. Since they are probably not getting compensated for participating in the records inventory, the time you take to interview them is time taken away from compensated tasks they are
166 INFORMATION GOVERNANCE
evaluated on. So, once the interviewees are identifi ed, provide as much advance notice as possible, follow up to confi rm appointments, and stay within the scheduled time. Interviews should be kept to 20 to 60 minutes. Most of all—never be late!
Before starting any interviews, be sure to restate the goals and objectives of the inventorying process and how the resulting output will benefi t people in their jobs.
In some cases, it may be advisable to conduct interviews in small groups, not only to save time but to generate a discussion of how records are created, used, and stored. Some new insights may be gained.
Try to schedule interviews that are as convenient as possible for participants. That means providing participants with questions in advance and holding the interviews as close to their work area as possible. Do not schedule interviews back to back with no time for a break between. You will need time to consolidate your thoughts and notes, and, at times, interviews may exceed their planned time if a particularly enlightening line of questioning takes place.
If you have some analysis from the initial collection of surveys, share that with the interviewees so they can validate or help clarify the preliminary results. Provide it in advance, so they have some time to think about it and discuss it with their peers.
Sample Interview Questionnaire You’ll need a guide to structure the interview process. A good starting point is the sample questions presented in the questionnaire shown in Figure 9.3 . It is a useful tool that has been used successfully in actual records inventory projects.
Analyze and Verify the Results
Once collected, some follow-up will be required to verify and clarify responses. Often this can be done over the telephone. For particularly complex and important areas, a follow-up in person visit can clarify the responses and gather insights.
Once the inventory draft is completed, a good practice is to go out into the business units and/or system areas and verify what the fi ndings of the survey are. Once presented with fi ndings in black and white, key stakeholders may have ad- ditional insights that are relevant to consider before fi nalizing the report. Do not miss out on the opportunity to allow power users and other key parties to provide valuable input.
Be sure to tie the fi ndings in the fi nal report of the records inventory to the business goals that launched the effort. This helps to underscore the purpose and importance of the effort, and will help in getting that fi nal signoff from the executive sponsor that states the project is complete and there is no more work to do.
Depending on the magnitude of the project, it may (and should ) turn into a dd formal IG program that methodically manages records in a consistent fashion in accordance with internal governance guidelines and external compliance and legal demands.
Be sure to tie the fi ndings in the fi nal report of the records inventory to the business goals that launched the effort.
INFORMATION GOVERNANCE AND RECORDS 167
What is the mandate of the offi ce?
What is the reporting structure of the department?
Who is the department liaison for the records inventory?
Are there any external agencies that impose guidelines, standards, or other requirements?
Is there a departmental records retention schedule?
Are there specifi c legislative requirements for creating or maintaining records? Please provide a copy.
What are the business considerations that drives record keeping? Regulatory requirements? Legal requirements?
Does the department have an existing records management policy? Guidelines? Procedures?
Please provide a copy.
Does the department provide guidance to employees on what records are to be created?
What is the current level of awareness of employees their responsibilities for records management?
How are nonrecords managed?
Does the department have a classifi cation or fi le plans?
What are the business drivers for creating and maintaining records?
Where are records stored? Onsite? Offsite? One location? Multiple locations?
Does the department have records in sizes other than letter (8 ½×11)?
What is the cutoff date for the records?
Fiscal Year Calendar Year Other
Are any tools used to track active records? Excel, Access, and so forth?
Does the department use imaging, document management, and so forth?
Is the department subject to audits? Internal? External? Who conducts the audits?
Are any records in the department confi dential or sensitive?
Are their guidelines for destroying obsolete records?
What disposition methods are authorized or required?
How does disposition occur? Paper? Electronic? Other?
What extent does the department rely on each individual to destroy records?
Paper Electronic Other
What principles govern decisions for determining the scope of records that must be held or frozen for an audit or investigations?
How is the hold or freeze communicated to employees?
Figure 9.3 Sample Interview Questionnaire
Appraising the Value of Records Part of the process of determining the retention and disposition schedule of records is to appraise their value. Records can have value in different ways, which affects retention decisions.
Records appraisal is an analysis of all records within an agency [or business] to determine their administrative, fi scal, historical, legal, or other archival value. The purpose of this process is to determine for how long, in what format, and
Source: Charmaine Brooks, IMERGE Consulting, e-mail to author, March 20, 2012.
168 INFORMATION GOVERNANCE
under what conditions a record series ought to be preserved. Records appraisal is based upon the information contained in the records inventory. Records series shall be either preserved permanently or disposed of when no longer required for the current operations of an agency or department, depending upon:
■ Historical value or the usefulness of the records for historical research, in- cluding records that show an agency [or business] origin, administrative development, and present organizational structure.
■ Administrative value or the usefulness of the records for carrying on [a busi- ness or] an agency’s current and future work, and to document the develop- ment and operation of that agency over time.
■ Regulatory and statutory [value to meet] requirements. ■ Legal value or the usefulness of the records to document and defi ne legally
enforceable rights or obligations of [business owners, shareholders, or a] government and/or citizens.
■ Fiscal value or the usefulness of the records to the administration of [a busi- ness or] an agency’s current fi nancial obligations, and to document the de- velopment and operation of that agency over time
■ Other archival value as determined by the State [or corporate] Archivist. 24 (Emphasis added.)
Ensuring Adoption and Compliance of RM Policy
The inventorying process in not a one-shot deal: It is useful only if the records inven- tory is kept up to date, so it should be reviewed, at least annually. A process should be put in place so that business unit or agency heads notify the RM head/lead if a new fi le series or system has been put in place and new records collections are created. 25
[Five] tips can help ensure that a records management program achieves its goals:
1. Records management is everyone’s role. The volume and diversity of business records, from e-mails to reports to tweets, means that the person who cre- ates or receives a record is in the best [position] to classify it. Everyone in the organization needs to adopt the records management program.
2. Don’t micro-classify. Having hundreds, or possibly thousands, of records clas- sifi cation categories may seem like a logical way to organize the multitude of different records in a company. However, the average information worker, whose available resources are already under pressure, does not want to spend any more time than necessary classifying records. Having a few broad classifi cations makes the decision process simpler and faster.
Records appraisal is based on the information contained in the records inventory.
INFORMATION GOVERNANCE AND RECORDS 169
3. Talk the talk from the top on down. A culture of compliance starts at the top. Businesses should establish a senior-level steering committee comprised of executives from legal, compliance, and information technology (IT). A committee like this signals the company’s commitment to compliant re- cords management and ensures enterprise adoption.
4. Walk the walk, consistently. For compliance to become second nature, it needs to be clearly communicated to everyone in the organization, and policies and procedures must be accessible. Training should be rigorous and easily available, and organizations may consider rewarding compliance through fi nancial incentives, promotions and corporate-wide recognition.
5. Measure the measurable. The ability to measure adherence to policy and adoption of procedures should be included in core business operations and audits. Conduct a compliance assessment, including a gap analysis, at least once a year, and prepare an action plan to close any identifi ed holes.
The growth of data challenges a company’s ability to use and store its records in a compliant and cost-effective manner. Contrary to current practices, the solution is not to hire more vendors or to adopt multiple technologies. The key to compliance is consistency, with a unifi ed enterprise-wide approach for managing all records, regardless of their format or location. 26
So a steady and consistent IG approach that includes controls, audits, and clear communication is key to maintaining an accurate and current records inventory.
General Principles of a Retention Scheduling
We discussed records retention briefl y in Chapter 8 , mostly as it relates to legal research and determining retention and limitation periods. In this section we go more in depth.
A series of principles is common to all retention schedules: 27
■ The retention schedule must include all records. ■ Records scheduling includes all records, regardless of media or location.28 ■ All legal and regulatory requirements for records must be refl ected in the records
scheduling process. For public entities, retention scheduling fosters and enables the agency to comply with information requests (e.g., FOIA in the United States, Freedom of Information Act 2000 in the United Kingdom, Freedom of Informa- tion and Protection of Privacy Act and the Health Information Act in Canada, and Freedom of Information Amendment [Reform] Act 2010 in Australia).
■ Records scheduling is a “proactive” planning process, where schedules are set in place and standardized in advance.
■ Periodic review of the retention schedule must take place when signifi cant leg- islation, technology acquisitions, or other changes are being considered; but in any case this should be at least annually or biannually.
■ Records scheduling is a continuous process that needs updating and amending, based on legal, technology, or business changes over time.
■ Classifi cation and records scheduling are inextricably linked.
170 INFORMATION GOVERNANCE
Records retention defi nes the length of time that records are to be kept and considers legal, regulatory, operational, and historical requirements. 31
■ File series with similar characteristics or value should be assigned consistent and appropriate retention periods.
■ Records of historical value must be preserved. ■ Records retention periods should refl ect the business needs of users, the value
of the records, and any legal or compliance requirements. The best way to make these determinations is with a team that includes cross-functional rep- resentatives from RM, legal, risk, compliance, IT and business unit representa- tives, headed by an executive sponsor.
■ RM resource use is optimized, and costs are minimized by keeping records a minimum amount of time under a planned and controlled set of processes.
■ Records must be retained in a repository (fi le room or software system) where the record is protected (e.g., made read-only and monitored with an audit trail) so that the integrity of the record is maintained in a manner that meets all evidence and legal admissibility standards if or when litigation is encountered.
■ Senior management must approve of and sign off on the retention schedule and will be legally accountable for compliance with the schedule.
■ Senior management must be able to readily review retention schedules, policy documentation, and audit information to ensure users are in compliance with the retention schedule.
■ Complete documentation of scheduling requirements and activities must take place so that future users and archivists can view and track changes to the reten- tion schedule. 29
Developing a Records Retention Schedule
A records retention schedule defi nes the length of time that records are to be kept and considers legal, regulatory, operational, and historical requirements. 30 The retention schedule also includes direction as to how the length of time is calculated (i.e., the event or trigger that starts the clock [e.g., two years from completion of contract]). Legal re- search and opinions are required, along with consultation with owners and users of the records. Users typically overestimate the time they need to keep records, as they confuse the legal requirements with their own personal wishes. Some hard question- ing has to take place, since having these records or copies of records lying around the organization on hard drives, thumb drives, or in fi le cabinets may create liabilities for the organization.
Disposition means not just destruction but also can mean archiving and trans- fer and a change in ownership and responsibility for the records. The processes of archiving and preserving are an example where records may be handed over to a his- torical recordkeeping unit. At this time, the records may be sampled and only selective parts of the group of records may be retained.
INFORMATION GOVERNANCE AND RECORDS 171
A retention schedule allows for uniformity in the retention and disposition process, regardless of the media or location of the records.
Disposition means not just destruction but can also mean archiving and a change in ownership and responsibility for the records.
Why Are Retention Schedules Needed?
A retention schedule allows for uniformity in the retention and disposition process, regardless of the media or location of the records. Further, it tracks, enforces, and audits the retention and disposition of records while optimizing the amount of records kept to legal minimums, which saves on capital and labor costs, and reduces liability (by discarding unneeded re- cords that carry legal risk). 32 The Generally Accepted Recordkeeping Principles® state the critical importance of having a retention schedule (see the section “Generally Accepted Recordkeeping Principles” in Chapter 3 for more details) and provide guidelines for open collaboration in developing one. In the public sector, holding records that have passed their legally required retention period also can have negative ramifi cations and liabilities in meeting information service requests made during litigation, compliance actions, or, for example, under the U.S. FOIA, or similar acts in other countries.
Information Included on Retention Schedules
A retention schedule consists of these components:
■ Title of the record series ■ Descriptions of the records seriess ■ Offi ce responsible for the retention of the record (default is usually the offi ce of origin)e ■ Disposal decision —destroy, transfer to the archives, or, in exceptional circum-
stances, reconsider at a later (specifi ed) date ■ Timing of disposal —a minimum period for which the records should be retainedll
in the offi ce or in an off-site store before disposal action is undertaken ■ Event that triggers the disposal actions ■ Dates on which the schedule was agreed , signed, or modifi ed d ■ Legal citations or a link to a citation that reference the retention requirements of
that group of records
A sample of a simple records retention schedule is shown in Figure 9.4 .
Steps in Developing a Records Retention Schedule
If you already have existing retention schedules but are revising and updating them, there may be useful information in those schedules that can serve as a good reference
172 INFORMATION GOVERNANCE
point—but be wary, as they may be out of date and may not consider current legal requirements and business needs.
According to the U.S. National Archives, some key steps are involved in develop- ing retention schedules:
1. Review the functions and recordkeeping requirements for the [business unit or] agency or the organizational component of the agency whose records will be included on the schedule
2. Inventory the records. 3. Determine the period of time the records are needed for conducting [business
or] agency operations and meeting legal obligations 4. Draft disposition instructions including:
■ File cutoffs or fi le breaks (convenient points within a fi ling plan/system (end of a letter of the alphabet, end of year or month, etc.) at which fi les are separated for purposes of storage and/or disposition)
■ Retention periods for temporary records ■ Instructions for transferring permanent records to the National Archives
of the United States [or corporate archive for businesses] ■ Instructions for sending inactive records to off-site storage ■ Organize the schedule and clear it internally ■ Obtain approval from [your corporate archivist or] NARA [for federal
agencies], as well as from GAO if required by Title 8 of the GAO, “Policy and Procedures Manual for the Guidance of Federal Agencies.” 33
Records Retention Schedule ENVIRONMENTAL HEALTH AND SAFETY
December 10, 2015
Record Type Responsible Department
Event Retention Period
Accident/Injury Reports
Employee Medical Files
Includes: Accidents Diagnosis (Accident or Injury) First aid reports Injuries Medical reviews Occupational Health Incident Treatment and Progress (Accident or Injury) Work related accidents Workers health information Workers Compensation Claims
Includes: Audiology Lung Function Return to Work Authorization Related to: Employee Files (Active)
Health and Safety Programs Includes: Health and Safety Committee Health and Safety Reports
HR Date of Incident E+30
HR Termination E+30
Health and
Safety
CY+10
Figure 9.4 Sample Records Retention Schedule Source: IMERGE Consulting, Inc.
INFORMATION GOVERNANCE AND RECORDS 173
What Records Do You Have to Schedule? Inventory and Classifi cation
Inventory and classifi cation are prerequisites for compiling a retention schedule. Be- fore starting work, develop an information map that shows where information is cre- ated, where it resides, and the path it takes. What records are created, who uses them, and how is their disposition handled? Questions like these will provide key insights in the development of the retention schedule. 34 Confi rm that the information map covers all the uses of the records by all parts of the organization, including use for account- ability, audit, and reference purposes.
In the absence of a formal information map, at a minimum you must compile a list of all the different types of records in each business area. This list should include information about who created them and what they are used for (or record provenance ), which parts of the organization have used them subsequently and for what purpose (its us- age), and the actual content.t
In the absence of any existing documentation or records inventory, you will need to conduct a records inventory or survey to fi nd out what records the business unit (or organization) holds. Tools are available to scan e-records folders to expedite the inventory process. A retention schedule developed in this way will have a shorter serviceable life than one based on an information map because it will be based on existing structures rather than functions and will remain usable only as long as the organizational structure remains unchanged.
Once a records inventory or survey is complete, building a records retention schedule begins with classifi cation of records. 35
This basic classifi cation can be grouped into three areas:
1. Business functions and activities 2. Records series 3. Document types
Business functions are basic business units such as accounting, legal, human re- sources, and purchasing. (See Appendix A, Information Organization and Classifi cation: Taxonomies and Metadata, for details on the process of developing classifi cations.) It basically answers this question: What were you doing when you created the record?
Tools are available to scan e-records folders to expedite the inventory process.
An information map is a critical fi rst step in developing a records retention schedule. It shows where information is created, where it resides, and who uses it.
174 INFORMATION GOVERNANCE
Business activities are the tasks performed to accomplish the business function. d Several activities may be associated with each function.
A records series is a group or unit of identical or related records that are normally used and fi led as a unit and that can be evaluated as a unit or business function for scheduling t purposes. 36
A document type is a term used by many software systems to refer to a group- ing of related records. When the records are all created by similar processes, then the document type is equivalent to the business functions or activities mentioned previously. However, “document type” often refers to the format of the record (e.g., presentation, meeting minutes). In this case, there is not enough information to determine a retention period because it is ambiguous regarding what type of work was being done when that document was created. Retention schedules require that record series be defi ned by business function and activity, not by record format or display type.
Rationale for Records Groupings
Records are grouped together for fundamental reasons to improve information orga- nization and access. These reasons include:
■ Grouping by “similar theme” for improved completeness ■ Improving information search speed and completeness ■ Increasing organizational knowledge and memory by providing the “context”
within which individual documents were grouped ■ Clearly identifying who the record owner or creator is and assigning and track-
ing responsibility for a group of records ■ Grouping records with the same retention requirements for consistent applica-
tion of disposition processes to records
Records Series Identifi cation and Classifi cation
After completing a records inventory including characterizing, descriptive informa- tion about the records such as their contents, use, fi le size, and projected growth vol- umes, you will need to interview staff in those target areas you are working with to determine more information about the specifi c organizational structure, its business functions, services, programs, and plans. 37
In the course of business, there are several different types of records series. There are case records , for example, which are characterized as having a beginning and
After completing an inventory, developing a retention schedule begins with records classifi cation.
INFORMATION GOVERNANCE AND RECORDS 175
an end but are added to over time. Case records generally have titles that include names, dates, numbers, or places. These titles do not provide insight into the nature of the function of the record series. Examples of case records include personnel fi les, mortgage loan folders, contract and amendment/addendum records, accident reports, insurance claims, and other records that accumulate and expand over time. Although the contents of case fi les may be similar, you should break out each type of case record under a unique title.
Subject records (also referred to as topic or function records ) “contain infor- mation relating to specifi c or general topics and that are arranged according to their informational content or by the function/activity/transaction they pertain to.”38 These types of records accumulate information on a particular topic or function to be added to the organization’s memory and make it easier for knowledge workers to fi nd infor- mation based on subject matter, topics, or business functions. Records such as those on the progression of relevant laws and statutes, policies, standard operating procedures, education and training have long-term reference value and should be kept until they are no longer relevant or are displaced by more current and relevant records. In a record retention schedule, the trigger event often is defi ned as “superseded or obsolete.” Records of this type that relate to “routine operations of a [project], program or ser- vice” do not have as much enduring value and should be scheduled to be kept for a shorter period.
Retention of E-Mail Records
Are e-mail messages records? This question has been debated for years. The short an- swer is no, not all e-mail messages constitute a record. But how do you determine whether certain messages are a business record or not? The general answer is that a record documents a transaction or business-related event that may have legal ramifi cations or historic value. Most important are business activities that may relate to compliance requirements or those that could possibly come into dispute in litigation. Particular consideration should be given to fi nancial transactions of any type.
Certainly evidence that required governance oversight or compliance activities have been completed needs to be documented and becomes a business record. Also, business transactions, where there is an exchange of money or the equivalent in goods or services is documented are also business records. Today, these transactions are often documented by a quick e-mail. And, of course, any contracts (and any pro- gressively developed or edited versions) that are exchanged through e-mail become business records.
The form or format of a potential record is irrelevant in determining whether it should be classifi ed as a business record. For instance, if a meeting of the board of directors is recorded by a digital video recorder and saved to DVD, it constitutes a
Not all e-mail messages are records; those that document a business transac- tion or progress toward it are clearly records and require retention.
176 INFORMATION GOVERNANCE
record. If photographs are taken of a ground-breaking ceremony for a new manufac- turing plant, the photos are records too. If the company’s founders tape-recorded a message to future generations of management on reel-to-reel tape, it is a record also, since it has historical value. But most records are going to be in the form of paper, microfi lm, or an electronic document.
Here are three guidelines for determining whether an e-mail message should be considered a business record:
1. The e-mail documents a transaction or the progress toward an ultimate transaction where anything of value is exchanged between two or more parties. All parts or char- acteristics of the transaction, including who (the parties to it), what, when, how much, and the composition of its components are parts of the transaction. Often seemingly minor parts of a transaction are found buried within an e-mail mes- sage. One example would be a last-minute discount offered by a supplier based on an order being placed or delivery being made within a specifi ed time frame.
2. The e-mail documents or provides support of a business activity occurring that pertains to internal corporate governance policies or compliance to externally mandated regulations.
3. The e-mail message documents other business activities that may possibly be disputed in the future, whether it ultimately involves litigation or not. (Most business disputes actually are resolved without litigation, provided that proof of your organization’s position can be shown.) For instance, your supplier may dispute the discount you take that was offered in an e-mail message and, once you forward the e-mail thread to the supplier, it acquiesces.
Managing e-mail business records is challenging, even for technology professionals. According to an AIIM and ARMA survey, fully two-thirds of records managers doubt that their IT departments really understand the concept of electronic records life cycle management. That is despite the fact that 70 percent of companies rely on IT professionals alone to manage their electronic records.
Although the signifi cance of e-mail in civil litigation cannot be overstated (it is the leading piece of evidence requested at civil trials today), one-third of IT managers state that they would be incapable of locating and retrieving e-mails that are more than one year old, d according to Osterman Research. 39
How Long Should You Keep Old E-Mails?
There are different schools of thought on e-mail retention periods and retention schedules. The retention and deletion of your electronic business records may be governed by laws or regulations. Unless your organization’s e-mail and ESI records are governed by law or regulations,
E-mail messages that document business activities, especially those that may be disputed in the future, should be retained as records.
INFORMATION GOVERNANCE AND RECORDS 177
your organization is free to determine the retention periods and deletion schedules that are most appropriate for your organization.40 If your organization’s e-mail retention periods are not specifi ed by law or regulation, consider keeping them for at least as long as you retain paper records. Many software providers provide automated software that allows e-mail messages to be moved to controlled repositories as they are declared to be records.
Destructive Retention of E-Mail
(We repeat this short section from Chapter 8 for those who are more focused on RIM than on legal functions.)
A destructive retention program is an approach to e-mail archiving where e-mail messages are retained for a limited time (say, 90 days), followed by the permanent manual or automatic deletion of the messages from the organization network, so long as there is no litigation hold or the e-mail has not been declared a record.
E-mail retention periods can vary from 90 days to as long as seven years:
■ Osterman Research reports that “nearly one-quarter of companies delete e- mail after 90 days.” 41
■ Heavily regulated industries, including energy, technology, communications, and real estate, favor archiving for one year or more, according to Fulbright and Jaworski research. 42
■ The most common e-mail retention period traditionally has been seven years; how- ever, some organizations are taking a hard-line approach and stating that e-mails will be kept for only 90 days or six months, unless it is declared as a record, classi- fi ed, and identifi ed with a classifi cation/retention category and tagged or moved to a repository where the integrity of the record is protected (i.e., the record cannot be altered and an audit trail on the history of the record’s usage is maintained)
Long-Term Archival Records
Inactive records that are have historical value or are essential for maintaining corporate memory must be kept the longest. Although they are not needed for present operations, they still have some value to the organization and must be preserved. When it comes to preserving electronic records, this process can be complex and technical. (See Chapter 17 for details.) If you have a corporate or agency archivist, his or her input is critical.43
Meeting Legal Limitation Periods
(This short section is repeated from Chapter 8 for those who are more focused on RIM than on legal functions.)
Destructive retention of e-mail is a method whereby e-mail messages are re- tained for a limited period and then destroyed.
178 INFORMATION GOVERNANCE
A key consideration in developing retention schedules is researching and deter- mining the minimum time required to keep records that may be demanded in legal actions. “A limitation period is the length of time after which a legal action cannot be brought before the courts. Limitation periods are important because they determine the length of time records must be kept to support court action [including subsequent appeal periods]. It is important to be familiar with the purpose, principles, and special circumstances that affect limitation periods and therefore records retention.” 44
Legal Requirements and Compliance Research
(Note: This section also appears in Chapter 8 but is included here for completeness.) Legal requirements trump all others. The retention period for a particular records
series must meet minimum retention requirements as mandated by law. Business needs and other considerations are secondary. So, legal research is required before determin- ing retention periods. Legally required retention periods must be researched for each jurisdiction (state, country) in which the business operates, so that it complies with all applicable laws.
In order to locate the regulations and citations relating to retention of records, there are two basic approaches. The fi rst approach is to use a records retention citation service, which publishes in electronic form all of the retention-related citations. These services usually are bought on a subscription basis, as citations are updated on an an- nual or more frequent basis as legislation and regulations change.
Figure 9.5 is an excerpt from a Canadian records retention database product called FILELAW®. In this case, the act, citation, and retention periods are clearly identifi ed.
Another approach is to search the laws and regulations directly using online or print resources. Records retention requirements for corporations operating in the United States may be found in the Code of Federal Regulations (CFR), the annual RR edition of which
is the codifi cation of the general and permanent rules published in the Fed- eral Register by the departments and agencies of the federal government. It is divided into 50 titles that represent broad areas subject to federal regulation. The 50 subject matter titles contain one or more individual volumes, which are updated once each calendar year, on a staggered basis. The annual update cycle is as follows: titles 1 to 16 are revised as of January 1; titles 17 to 27 are revised as of April 1; titles 28 to 41 are revised as of July 1, and titles 42 to 50 are revised as of October 1. Each title is divided into chapters, which usually bear the name of the issuing agency. Each chapter is further subdivided into parts that cover specifi c regulatory areas. Large parts may be subdivided into subparts. All parts are organized in sections, and most citations to the CFR refer to material at the section level. 45
There is an up-to-date version that is not yet a part of the offi cial CFR but is up- dated daily, the Electronic Code of Federal Regulations (e-CFR) . “It is not an offi cial legal edition of the CFR. The e-CFR is an editorial compilation of CFR material and Federal Register amendments produced by the National Archives and Records Admin- istration’s Offi ce of the Federal Register (OFR) and the Government Printing Offi ce.” 46
INFORMATION GOVERNANCE AND RECORDS 179
Event-Based Retention Scheduling for Disposition of E-Records
Event-based disposition is kicked off with the passage of an event, such as hiring or fi ring an employee, the end of a project, or the initiation of a lawsuit.
Event-based disposition can have an associated retention schedule, and the clock starts running once the event occurs. The required retention period begins only af- ter the triggering event occurs. The length of the retention period may be regulated by law, or it may be determined by IG guidelines set internally by the organization. So, when an employee is terminated, and personnel fi les are destroyed after (say) fi ve years, the retention schedule entry would be “Termination + 5 years.”
One other defi nition of event-based disposition comes from the U.S. e-records standard, Department of Defense 5015.2, which states that a disposition instruction in which a record is eligible for the specifi ed disposition (transfer or destroy) upon or immediately after the specifi ed event occurs. No retention period is applied and there is no fi xed waiting period, as with “timed” or combination “timed-event” dispositions. Example: “Destroy when no longer needed for current operations.” 47
Some hardware vendors, such as IBM and EMC, provide solutions that assist in executing event-based disposition with assistance from fi rmware (fi xed instructions on a microchip). The fi rmware-assisted solution should be considered if your RM or IG team aims to perform a complete and thorough retention solution analysis. These hardware-based solutions can potentially streamline the event-based disposi- tion process. 48
Event-based disposition begins with the passage of a triggering event.
Figure 9.5 Excerpt from Canadian Records Retention Database Source: Ontario, Electricity Act, FILELAW database, Thomson Publishers, May 2012.
180 INFORMATION GOVERNANCE
Triggering events may be record-related, “such as supersession or obsolescence.” This is common to a policy statement. For example, if a group of policies are to be destroyed fi ve years after superseded or obsolete, the old policy would be held for fi ve years after the new policy has been created.
Sounds simple. But in an attempt to meet retention requirements, organizations handle event-based triggers in different ways, ways that often are problematic. For in- stance, the trigger events often are not captured electronically and fed directly into the retention scheduling software or records repository to start the clock running, or the event itself is not well documented in the retention schedule so it is not consistently being applied and tracked. In other cases, the organization simply does not have the ERM functionality it needs to manage event-based triggers.
This causes many organizations to simply over-retain and keep the records indefi - nitely, or until disk storage is full, which means that those records are retained for an incorrect—and indefensible—time. The period is either too long or possibly too short, but it always is always inconsistent. s And inconsistent means legally indefensible.
The only prudent and defensible approach is to implement the proper IG policies to manage and control the implementation of event-based disposition.
Prerequisites for Event-Based Disposition
Three key prerequisite tasks must be completed before event-based disposition can be implemented:
1. Clarify trigger events. Not all of the events that can trigger the beginning of a retention period are as clear as the date an employee is terminated. For instance, “contract completion date” could be the day a vendor fi nishes work, when a fi nal invoice is rendered, when the invoice is paid, or some other period, such as 30 days following the payment of the fi nal invoice. These defi nitions, depending on the record series in question, may be regulated by law or governed by IG policies.
What is needed is an agreement as to what the defi nition is, so that the re- tention period will be uniform among the record series in question, providing a defensible policy.
To gain this agreement on these blurry areas, the RM lead/manager or team will need to work with the relevant business unit representatives, IT, compli- ance, risk management, and any other stakeholders.
The event triggers must be clear and agreed on so that they may kick off a retention period and disposition process.
In a number of cases, the answer to these questions will rely on trigger points, such as one year after completion or four months after the board of di- rectors’ meeting. It is important to choose a trigger point that you can implement. For example, there is no point in saying that records should be kept until an individual dies, if you have no reliable way of knowing the person is alive. Instead, choose a trigger point based on the information you have about the individual; in this case, the 100th birthday might be a suitable trigger point.
2. Automated capture of agreed-on trigger events must be performed and sent to the ERM. It is easy to know an employee’s termination date—most human re- sources management systems or payroll systems can supply it—but other
INFORMATION GOVERNANCE AND RECORDS 181
types of events are not so easily captured and may require some customiza- tion in order that this information is fed into an ERM. The metadata about the event must be seamlessly entered into the ERM so that it may launch the beginning of the retention period. If systems external to the ERM need to be interfaced, a common locator (e.g., contract number) can link the two.
3. The ERM systems must have complete retention and disposition capabilities. In order for the retention to start properly and run to fi nal disposition, this tracking ca- pability must be an inherent feature of the software. (In some cases, organiza- tions may use specialized retention and disposition software that can perform this task minimally without complete ERM functionality, but it falls short of the type of richness that a robust ERM system provides. What is needed is the ability to include the details or retention rules beyond simple date calculations (i.e., to store descriptive data or scope notes, and records series code in addi- tion to retention requirements, which are automatically associated with the retention rule, and to have a records hold and release capability). If destruc- tion is the fi nal disposition, then the system must be able to perform a deletion of the record (so long as there is no preservation or legal hold) with no traces that can allow reconstruction of it, and this process must be verifi able.
To accomplish clarity and agreement on event-based triggers requires close consultation and collaboration among RM staff, business units, IT, legal, com- pliance, risk management, and other stakeholders, as relevant.
Final Disposition and Closure Criteria
After completing the records values analysis and legislative and legal research, you must determine the closure criteria and fi nal disposition (e.g., destroy, transfer, archive) for each records series. To minimize costs and litigation risk, retention periods should be kept as short as possible while meeting all applicable regulatory, legal, and business requirements.49
Retention Periods: Online versus Offl ine
For e-records, retention periods may be segmented into active and inactive, or online and offl ine. Offl ine may be segmented further into on-site and off-site or archival storage.
Going back and combing through records retrieval requests and usage logs may provide helpful insights as to the needs of records users—but bear in mind that these logs may be misleading as users may have (in the past, before a formal IG program was implemented) kept shadow copies of fi les on their local hard drives or backed up to fl ash drives or other storage devices.
Closure Dates
A clear closure start date is required to kick off a retention period for any record, whether the retention is scheduled for on- or off-site. Calendar or fi scal year-ends are typical and practical closure dates for subject or topical records. The date used to indi- cate the start year is usually the date the fi le closed or the date of last use or update. In a university setting, school year-end may be more logical. Still, a reasoned analysis is re- quired to determine the best closure start date for subject records in your organization.
182 INFORMATION GOVERNANCE
Case records are different; logically, their closure date is set when a case record is completed (e.g., the date when an employee resigns, retires, or is terminated).
Future dates may be used, such as an employee promotion date, student gradua- tion, or project completion. After consulting those who create and handle the records series you are analyzing, apply good business judgment and common sense when de- termining closure dates. 50
Retaining Records Indefi nitely
There may be some vital, historical, or other critical records that, in the best interests of the organization, need to be retained permanently. This is rare, and storing records long term must be scrutinized heavily. If certain electronic records are to be retained indefi nitely or permanently, then LTDP policies and techniques must be used. (See Chapter 17 for more details.)
Retaining Transitory Records
Transitory documents usually do not rise to the level of becoming a record; they are temporary and are useful only in the short term, such as direct mail or e-mail adver- tising (brochures, price lists, etc.), draft documents (although not all are transitory, and some may need longer retention periods, such as draft contracts) and work in progress, duplicates, external publications (e.g., magazines, journals, newspapers, etc.), and temporary notices (e.g., company picnic, holiday party, or football pool). You must consider transitory records in your master records retention schedule.
Implementation of the Retention Schedule and Disposal of Records
Automated programs that interpret these retention periods are the best way to ensure that records are disposed of at the correct time and that an audit trail of the disposition is maintained.
Getting Acceptance and Formal Sign-off of the Retention Schedule
Upon completion of the records retention schedule, project management best prac- tices dictate that it be signed off by an executive or project sponsor, to indicate it has been completed and there is no more work to be done on that phase of the project. In addition, you may want to gain the sign-off and acceptance by other key stakehold- ers, such as senior representatives from legal, IT, the board of directors or executive committee, and perhaps audit and information governance. The schedule should be updated when new record types are introduced and, in any case, at least annually.
Disposition Timing: Records Disposal
It is much easier to time or schedule the disposal of e-records than of paper or physical records, but true and complete destruction of all traces of a record cannot be done
INFORMATION GOVERNANCE AND RECORDS 183
by hitting a simple “delete” key. There must be a process in place to verify the total destruction of all copies of the record. (See Chapter 17 for more details.) Records destruction can occur daily, routinely, or be scheduled at intervals (i.e., monthly or quarterly).
Automating Retention/Disposal Actions
ERM systems typically are capable of automatically executing a record deletion when a record has reached the end of its life cycle. Often these systems have a safety fea- ture that allows an operator who has the authority to review deletions before they are performed.
Disposal Date Changes
To make a retention schedule change, such as extending the life of a record series, IG controls must be in place. So, usually, ERM systems require that a person of higher authority than the system operator make these approvals. Every subsequent delay in destroying the records often requires an escalation in approval period to extend the time that records are kept past the destruction date.
Proving Record Destruction
In some environments, especially in the public sector, a certifi cate of destruction or other documentation is required to prove that a record and all its copies have been completely deleted (including its metadata—although at times it is benefi cial to retain metadata longer than the record itself; see Appendix A, “Information Organization and Classifi cation,” for more details). ERM systems can be confi gured to keep an audit trail and prove that destruction has occurred.
Ongoing Maintenance of the Retention Schedule
Records series are not static; they change, are added to, and are amended. New record functions emerge, based on changes in business, acquisitions, and divestitures. So it is necessary for organizations to review and update—at least annually—their records retention schedule.
In addition, retention requirements change as legislation changes, lawsuits are fi led, and the organization refi nes and improves its IG policies. Development of a re- cords retention schedule is not a one-time project; it requires attention, maintenance, and updating on a regular schedule, and using a controlled change process.
Audit to Manage Compliance with the Retention Schedule
Once your organization establishes records retention schedules for business units, or a master retention schedule, there must be IG policies in place to audit and ensure that policies are being followed. This is a key requirement of maintaining a legally defensible retention schedule that will hold up to legal challenges.
184 INFORMATION GOVERNANCE
CHAPTER SUMMARY: KEY POINTS
■ According to ISO, a record is “information created, received, and maintained as evidence and information by an organization or person, in pursuance of legal obligations or in the transaction of business.”
■ RM is “[the] fi eld of management responsible for the effi cient and system- atic control of the creation, receipt, maintenance, use, and disposition of records, including the processes for capturing and maintaining evidence of and information about business activities and transactions in the form of records.”
■ ERM includes the management of electronic and nonelectronic records, such as paper and other physical records.
■ ERM has become much more critical to enterprises with increased compli- ance legislation and massively increasing volumes of electronic information.
■ ERM follows the same basic principles as paper-based records management.
■ A number of factors provide the business rationale for ERM, including facilitat- ing compliance, supporting IG, and providing backup capabilities in the event of a disaster.
■ Implementing ERM is challenging since it requires user support and compli- ance, adherence to changing laws, and support for new information delivery platforms like mobile and cloud computing.
■ ERM benefi ts are both tangible and intangible or diffi cult to calculate.
■ Improved professionalism, preserving corporate memory, support for better decision making, and safeguarding vital records are key intangible benefi ts of ERM.
■ NARA recommends that e-records are inventoried by information system rather than fi le series, which is the traditional approach for physical records.
■ Generally Accepted Recordkeeping Principles® are “information management and governance of record creation, organization, security, maintenance and other activities used to effectively support recordkeeping of an organization.”
■ It may be helpful to use a record-keeping methodology such as the Principles or D.I.R.K.S. to guide inventorying efforts.
■ Perhaps the organization has a handle on their paper and microfi lmed records, but e-records have been growing exponentially and spiraling out of control.
■ Whatever the business goals for the inventorying effort are, they must be con- veyed to all stakeholders, and that message must be reinforced periodically and consistently, and through multiple means.
INFORMATION GOVERNANCE AND RECORDS 185
■ An appropriate scope might enumerate the records of a single program or division, several functional series across divisions, or records that fall within a certain time frame versus an entire enterprise.
■ The completed records inventory contributes toward the pursuit of an orga- nization’s IG objectives in a number of ways.
■ There are basic three ways to conduct the inventory: surveys, interviews, and observation. Combining these methods yields the best results.
■ Additional information not included in inventories of physical records must be collected in any inventory of e-records.
■ Be sure to tie the fi ndings in the fi nal report of the records inventory to the business goals that launched the effort.
■ Records appraisal is based on the information contained in the records inventory.
■ Records can have different types of value to organizations: historical, ad- ministrative, regulatory and statutory, legal, fi scal, or other archival value as determined by an archivist.
■ Consistency in managing records across an enterprise, regardless of media, format, or location, is the key to compliance.
■ A complete, current, and documented records retention program reduces storage and handling costs and improves searchability for records by making records easier and faster to fi nd.
■ Retention schedules are developed by records series—not for individual records.
■ Retention schedules are basic tools that allow an organization to prove that it has a legally defensible basis on which to dispose records.
■ The master retention schedule contains all records series in the entire enterprise.
■ Records retention defi nes the length of time that records are to be kept and considers legal, regulatory, operational, and historical requirements.
■ “Disposition” means not just destruction but can also mean archiving and a change in ownership and responsibility for the records.
■ An information map is a critical fi rst step in developing a records retention sched- ule. It shows where information is created, where it resides, and who uses it.
■ After inventorying, developing a retention schedule begins with records classifi cation.
■ All e-mail messages are not records; those that document a business transac- tion, or progress toward it, are clearly records and require retention.
■ E-mail messages that document business activities, especially those that may be disputed in the future, should be retained as records.
CHAPTER SUMMARY: KEY POINTS (Continued )
(continued)dd
186 INFORMATION GOVERNANCE
■ Destructive retention of e-mail is a method whereby e-mail messages are retained for a limited period and then destroyed.
■ Tools are available to scan e-records folders to expedite the inventorying process.
■ Assessing the relative value of records is key to determining their retention periods and disposition path.
■ Records have different types of value, such as fi nancial, legal, technical, and administrative/operational.
■ Event-based disposition begins with a triggering event.
■ Retention schedules, once established, must be maintained and updated to add new records series, as appropriate, and to comply with new or changed legislation and regulatory requirements.
■ Auditing to ensure compliance with established retention policies is key to maintaining a legally defensible records retention program.
CHAPTER SUMMARY: KEY POINTS (Continued )
Notes
1. International Organization for Standardization, ISO 15489-1: 2001 Information and Documentation— Records Management. Part 1: General (Geneva: ISO, 2001), section 3.15. l
2. Ibid., section 3.16 3. ARMA.org, “What Is Records Management?” 2009, www.arma.org/pdf/WhatIsRIM.pdf. (accessed
December 2, 2013). 4. Microsoft White Paper, “Records Management with Offi ce SharePoint Server,” 2007, www.microsoft
.com/en-us/download/details.aspx?id=15932, Used with permission from Microsoft. (accessed December 2, 2013).
5. Ibid. 6. Ibid. 7. Ibid. 8. U.S. Environmental Protection Agency, “Why Records Management? Ten Business Reasons,” updated
March 8, 2012, www.epa.gov/records/what/quest1.htm. 9. U.S. National Archives and Records Administration ,Disposition of Federal Records: A Records Management
Handbook , 2000, Web edition, www.archives.gov/records-mgmt/publications/disposition-of-federal- records/chapter-3.html.
10. Ibid. 11. State and Consumer Services Agency Department of General Services, Electronic Records Management
Handbook , State of California Records Management Program (February 2002), www.documents.dgs .ca.gov/osp/recs/ermhbkall.pdf .
12. U.S. Environmental Protection Agency, “Six Steps to Better Files,” updated March 8, 2012, www.epa .gov/records/tools/toolkits/6step/6step-02.htm .
13. Margaret Rouse, “Generally Accepted Recordkeeping Principles,” updated March 2011, http:// searchcompliance.techtarget.com/defi nition/Generally-Accepted-Recordkeeping-Principles-GARP (accessed March 19, 2012).
INFORMATION GOVERNANCE AND RECORDS 187
14. Ibid. 15. Ibid. 16. Public Record Offi ce, “ Guidance for an Inventory of Electronic Record Collections: A Toolkit,”
September 2000, www.humanrightsinitiative.org/programs/ai/rti/implementation/general/guidance_ for_inventory_elect_rec_collection.pdf, pp. 5–6.
17. Ibid. (accessed December 2, 2013). 18. National Archives, “Frequently Asked Questions about Records Inventories,” updated October 27, 2000,
www.archives.gov/records-mgmt/faqs/inventories.html . 19. William Saffady, “Managing Electronic Records, 4th ed.,” Journal of the Medical Library Association , 2009,
www.ncbi.nlm.nih.gov/pmc/articles/PMC2947138/ . 20. Jesse Wilkins, “The First Step: Inventory Your Electronic Records,” http://pr1vacy.blogspot
.mx/2005/11/fi rst-step-inventory-your-electronic.html (accessed October 11, 2012). 21. Ibid. 22. Ibid. 23. Quotes in this section are from Government of Alberta, Records and Information Management, www
.im.gov.ab.ca/index.cfm?page=imtopics/Records.html. (accessed December 2, 2013). 24. Maryland State Archives, “Retention Schedule Preparation,” June 1, 2012, www.msa.md.gov/msa/
intromsa/html/record_mgmt/retention_schedule.html . 25. National Health Service, “Connecting for Health,” www.connectingforhealth.nhs.uk/ (accessed
April 10, 2012). 26. Wortzman Nickle Professional Corporation, “Effective Records Management—Part 4—Ensuring
Adoption and Compliance of RM Policy,” 2009, www.wortzmannickle.com/ediscovery-blog/2011/12/14/ rmpart4/ (accessed April 12, 2012).
27. Government of Alberta, “Developing Retention and Disposition Schedules.” 28. National Archives, “Disposition of Federal Records.” 29. Government of Alberta, “Developing Retention and Disposition Schedules.” 30. National Archives, “Frequently Asked Questions about Records Scheduling and Disposition.” 31. Ibid. 32. University of Edinburgh, Records Management Section, July 5, 2012, www.recordsmanagement.ed.ac
.uk/InfoStaff/RMstaff/Retention/Retention.htm. 33. National Archives, “Frequently Asked Questions about Records Scheduling and Disposition.” http://
www.archives.gov/records-mgmt/faqs/scheduling.html#steps accessed December 2, 2013. 34. University of Edinburgh, Records Management Section. 35. National Archives, “Frequently Asked Questions about Records Scheduling and Disposition.” 36. University of Toronto Archives, “Glossary,” www.library.utoronto.ca/utarms/info/glossary.html
(accessed September 10, 2012). 37. Government of Alberta, “Developing Retention and Disposition Schedules.” 38. Ibid. 39. Marty Foltyn, “Getting Up to Speed on FRCP,” June 29, 2007, www.enterprisestorageforum.com/
continuity/features/article.php/3686491/Getting-Up-To-Speed-On-FRCP.htm. 40. Nancy Flynn, The E-Policy Handbook (New York: AMACOM, 2009), pp. 24–25. 41. ArcMail Blog http://arcmail.com/blog/archiving-rules-the-dangers-of-destructive-retention/ (accessed
Dec. 2, 2013). 42. Mary Flood, “Survey: They see a more litigious future,” October 18, 2010, http://blog.chron.com/
houstonlegal/2010/10/survey-they-see-a-more-litigious-future/ (accessed Dec. 2, 2013). 43. Ibid., pp. 127. 44. Government of Alberta, “Developing Retention and Disposition Schedules,” p. 122. 45. U.S. Government Printing Offi ce, Code of Federal Regulations , www.gpo.gov/help/index.html#about_s
code_of_federal_regulations.htm (accessed April 22, 2012). 46. U.S. National Archives and Records Administration, “Electronic Code of Federal Regulations,”
October 2, 2012, http://ecfr.gpoaccess.gov/cgi/t/text/text-idx?c=ecfr&tpl=%2Findex.tpl. 47. Department of Defense, “Design Criteria Standard for Electronic Records Management Software
Applications,” July 19, 2002, http://jitc.fhu.disa.mil/cgi/rma/downloads/p50152s2.doc. 48. Craig Rhinehart, IBM, e-mail to author, July 30, 2012. 49. Government of Alberta, “Records and Information Management.” 50. Ibid., p. 125.
189
C H A P T E R 10 Information Governance and Information Technology Functions
I nformation technology (IT) is a core function impacted by information gover-y nance (IG) efforts. IT departments typically have been charged with keeping the “plumbing” of IT intact—the network, servers, applications, and data—but although
the output of IT is in their custody, they have not been held to account for it; that is, the information, reports, and databases they generate have long been held to be owned by users in business units. This has left a gap of responsibility for governing the information that is being generated and managing it in accordance with legal and regulatory requirements, standards, and best practices.
Certainly, on the IT side, shared responsibility for IG means the IT department itself must take a closer look at IT processes and activities with an eye to IG. A focus on improving IT effi ciency, software development processes, and data quality will help contribute to the overall IG program effort. IT is an integral piece of the program.
Debra Logan, vice president and distinguished analyst at Gartner, states:
Information governance is the only way to comply with regulations, both cur- rent and future, and responsibility for it lies with the CIO and the chief legal offi cer. When organizations suffer high-profi le data losses, especially involv- ing violations of the privacy of citizens or consumers, they suffer serious repu- tational damage and often incur fi nes or other sanctions. IT leaders will have to take at least part of the blame for these incidents. 1
Gartner predicts that the need to implement IG is so critical that, by 2016, fully one in fi ve chief information offi cers (CIOs) will be terminated for their inability to implement IG successfully.
Aaron Zornes, chief research offi cer at the MDM (Master Data Management) Institute, stated: “While most organizations’ information governance efforts have fo- cused on IT metrics and mechanics such as duplicate merge/purge rates, they tend to ignore the industry- and business-metrics orientation that is required to ensure the economic success of their programs.” 2
190 INFORMATION GOVERNANCE
Four IG best practices in this area can help CIOs and IT leaders to be successful in delivering business value as a result of IG efforts:
1. Don’t focus on technology, focus on business impact Technology often enthralls those in IT—to the point of obfuscating the
reason that technologies are leveraged in the fi rst place: to deliver business benefi t. So IT needs to reorient its language, its vernacular, its very focus when implementing IG programs. IT needs to become more business savvy, more businesslike, more focused on delivering business benefi ts that can help the organization to meet its business goals and achieve its business objectives. “Business leaders want to know why they should invest in an information gov- ernance program based on the potential resulting business outcomes, which manifest as increased revenues, lower costs and reduced risk.” 3
2. Customize your IG approach for your specifi c business, folding in any industry-specifi c best practices possible.
You cannot simply take a boilerplate IG plan, implement it in your orga- nization, and expect it to be successful. Sure, there are components that are common to all industries, but tailoring your approach to your organization is the only way to deliver real business value and results. That means embarking on an earnest effort to develop and sharpen your business goals, establish- ing business objectives that consider your current state and capabilities and external business environment and legal factors unique to your organization. It also means developing a communications and training plan that fi ts with your corporate culture. And it means developing meaningful metrics to mea- sure your progress and the impact of the IG program, to allow for continued refi nement and improvement.
3. Make the business case for IG by tying it to business objectives To garner the resources and time needed to implement an IG program, you
must develop a business case in real, measureable terms. The business case must be presented in order to gain executive sponsorship, which is an essential component of any IG effort. Without executive sponsorship, the IG effort will fail. Making the business case and having metrics to measure progress and success toward meeting business objectives are absolute musts.
4. Standardize use of business terms IG requires a cross-functional effort, so you must be speaking the same
language, which means the business terms you use in your organization must be standardized. This is the very minimum to get the conversation started. But IG efforts will delve much more deeply into information organization and seek to standardize the taxonomy for organizing documents and records and even the metadata fi elds that describe in detail those document and records across the enterprise.
Overall, being able to articulate the business benefi ts of your planned IG program will help you recruit an executive sponsor, help the program gain traction and support, and help you implement the program successfully. 4
Several key foundational programs should support your IG effort in IT, includ- ing data governance, master data management (MDM), and implementing accepted IT standards and best practices. We will now delve into these concepts in more detail.
INFORMATION GOVERNANCE AND INFORMATION TECHNOLOGY FUNCTIONS 191
Data Governance
We touched on data governance in Chapter 2 . Data is big, data is growing, data is valu- able, and the insights that can be gained by analyzing clean, reliable data with the latest analytic tools are a sort of new currency. There are nuggets of gold in those mountains of data. And leveraging those discoveries can provide a sustainable competitive advan- tage in areas such as customer acquisition, customer retention, and customer service.
The challenge is largely in garnering control over data and in cleaning, secur- ing and protecting it; doing so requires effective data governance strategies. But data governance is not only about cleaning and securing data; it is also about delivering it to the right people at the right time (sometimes this means in realtime) to provide strategic insights and opportunities. If a data governance program is successful, it can add profi ts directly to the bottom line. 5
Data governance involves processes and controls to ensure that information at the data level—raw data that the organization is gathering and inputting—is true and accurate, and unique (not redundant). It involves data cleansing ( or data scrubbing) gg to strip out corrupted, inaccurate, or extraneous data and de-duplication to eliminate redundant occurrences of data.
Data governance focuses on information quality from the ground up (at the low-y est or root level), so that subsequent reports, analyses and conclusions are based on clean, reliable, trusted data (or records) in database tables. Data governance is the most fundamental level at which to implement IG. Data governance efforts seek to ensure that formal management controls—systems, processes, and accountable employees who are stewards and custodians of the data—are implemented to govern critical data assets to improve data quality and to avoid negative downstream effects of poor data.
Data governance is a newer, hybrid quality control discipline that includes elements of data quality, data management, IG policy development, business process improve- ment, and compliance and risk management.
Good data governance programs should extend beyond the enterprise to include external stakeholders (suppliers, customers) so an organization has its fi nger on the pulse of its extended operations. In other words, enforcing data governance at the ear- liest possible point of entry—even external to the organization—can yield signifi cant effi ciencies and business benefi ts downstream. And combining data governance with real-time analytics and business intelligence (BI) software not only can yield insights into signifi cant and emerging trends but also can provide solid information for deci- sion makers to use in times of crisis—or opportunity.
Focusing on business impact and customizing your IG approach to meet business objectives are key best practices for IG in the IT department.
Effective data governance can yield bottom-line benefi ts derived from new insights.
192 INFORMATION GOVERNANCE
Steps to Governing Data Effectively
Nine key steps you can take to govern data effectively are listed next. The fi rst fi ve are based on recommendations by Steven Adler in CIO Magazine:
1. Recruit a strong executive sponsor. As in broader IG efforts, data governance re- quires cross-functional collaboration with a variety of stakeholders. To drive and facilitate this sometimes contentious conversation, a strong executive sponsor is required. This is not an easy task since executives generally do not want to deal with the minutia at the data level. You must focus on the realiz- able business benefi ts of improved data governance (i.e., specifi c applications that can assist in customer retention, revenue generation, and cost cutting).
2. Assess your current state. Survey the organization to see where the data reposi- tories or silos of data are, what problems related to data exist, and where some opportunities to improve lie. Document where your data governance program stands today and then map out your road to improvement in fundamental steps.
3. Set the ideal state vision and strategy. Create a realistic vision of where your organization wants to go in its data governance efforts, and clearly articulate the business benefi ts of getting there. Articulate a measureable impact. Track your progress with metrics and milestones.
4. Compute the value of your data. Try to put some hard numbers to it. Calculate some internal numbers on how much value data—good data—can add to specifi c business units. Data is unlike other assets that you can see or touch (cash, buildings, equipment, etc.), and it changes daily, but it has real value.
5. Assess risks. What is the likelihood and potential cost of a data breach? A major breach? What factors come into play and how might you combat these potential threats? Perform a risk assessment to rank and prioritize threats and assign probabilities to those threats so you may fashion appropriate strategies to counter them.
6. Implement a going-forward strategy. It is a signifi cantly greater task to try to improve data governance across the enterprise for existing data, versus a smaller business unit. 6 Remember, you may be trying to fi x years if not decades of bad behavior, mismanagement, and lack of governance. Taking an “incre- mental approach with an eye to the future” provides for a clean starting point and can substantially reduce the pain required to implement. A strategy where new data governance policies for handling data are implemented beginning on a certain future date is a proven best practice.
7. Assign accountability for data quality to business units, not IT. Typically, IT has had responsibility for data quality, yet the data generation is mostly not under that department’s control, since most is created out in the business units. A pointed effort must be made to push responsibility and ownership for data to the business units that create and use the data.
8. Manage the change. Educate, educate, educate. People must be trained to understand why the data governance program is being implemented and how it will benefi t the business. The new policies represent a cultural change, and supportive program messages and training are required to make the shift.
9. Monitor your data governance program. See where shortfalls might be, and con- tinue to fi ne-tune the program. 7
INFORMATION GOVERNANCE AND INFORMATION TECHNOLOGY FUNCTIONS 193
From a risk management perspective, data governance is a critical activity that supports decision makers and can mean the difference between retaining a customer and losing one. Protecting your data is protecting the lifeblood of your business, and improving the quality of the data will improve decision making, foster compliance efforts, and yield competitive advantages.
Data Governance Framework
The Data Governance Institute has created a data governance framework, a visualk model to help guide planning efforts and a “logical structure for classifying, organiz- ing, and communicating complex activities involved in making decisions about and taking action on enterprise data.” 8 (See Figure 10.1 .) The framework applies more to
Good data governance ensures that downstream negative effects of poor data are avoided and that subsequent reports, analyses, and conclusions are based on reliable, trusted data.
Figure 10.1 DGI Data Governance Framework™ Source: The Data Governance Institute (datagovernance.com).
194 INFORMATION GOVERNANCE
larger organizations, which have greater complexity, greater internal requirements, and greater, more complex regulatory demands. It allows for a conceptual look at data governance processes, rules, and people requirements.
Information Management
Information management is a principal function of IT. It is complex and spans a t number of subdisciplines but can be defi ned as the “application of management tech- niques to collect information, communicate it within and outside the organization, and process it to enable managers to make quicker and better decisions.” 9 It is about managing information, which is more than just collecting and processing data from varying sources and distributing it to various user audiences. It includes a number of subcomponent tasks, including these four:
1. Master data management (MDM) is a key process for IG success in the IT de-t partment, which extends to involved business units. An emerging discipline, MDM came into prominence around 2010 to 2012, coinciding with the Big Data trend. The goal of MDM is to ensure that reliable, accurate data from a single source is leveraged across business units. That is, a key aim is to establish a “single version of the truth”10 and eliminate multiple, inconsistent versions of data sets, which are more common than most might think, especially in larger organizations with physically distributed operations and large numbers of servers and databases. 11 MDM gets to the core of data integrity issues, es-y sentially asking “Is this data true and accurate? Is this the best and only, fi nal version?” MDM grew from the need to create a standardized, “discrete disci- pline” to ensure there was a single version to base BI analyses on and to base decisions on. 12 According to Gartner, MDM is a technology-enabled disci- pline in which business and IT work together to ensure the uniformity, accu- racy, stewardship, semantic consistency and accountability of the enterprise’s offi cial shared master data assets. Master data is the consistent and uniform set of identifi ers and extended attributes that describes the core entities of the en- terprise, including customers, prospects, citizens, suppliers, sites, hierarchies and chart of accounts. 13
What is the business impact? How are operations enhanced and how does that contribute to business goals? One set of reliable, clean data is critical to delivering quality customer service, reducing redundant efforts and therefore operational costs, improving decision making, and even po- tentially lowering product and marketing costs. “A unifi ed view of custom- ers, products, or other data elements is critical to turning these business goals into reality.” 14
Again, the larger the organization, the greater the need for MDM.
Master data management is a key IG process in IT.
INFORMATION GOVERNANCE AND INFORMATION TECHNOLOGY FUNCTIONS 195
2. Information lifecycle management (ILM) is managing information appropriately t and optimally at different stages of its useful life, from creation through distribution and use, including meeting legal and regulatory requirements, and through its fi nal disposition, which can be destruction, archiving, or transfer to another entity. Organizations historically over-retain informa- tion; however, studies show that information quickly loses its value and that once data has aged 10 to 15 days, the likelihood it will be used again is around 1 percent. 15 Based on its use characteristics, differing storage management strategies are appropriate. It defi es business logic to manage information that has little value with as much IT resource as information that is high value. Doing so is a misuse of resources . To execute ILM properly, the value of s certain data sets and records must be appraised and policies must be formed to manage it, recognizing that information value changes over the life cycle, which requires varying strategies and resource levels.16 ILM conceptually includes and can begin with MDM and is linked to compliance require- ments and capabilities.
3. Data architecture refers to the “design of structured and unstructured infor- mation systems” 17 in an effort to optimize data fl ow between applications and systems so that they are able to process data effi ciently. Further, data architecture uses data modeling, standards, IG policies, and rules for gov- erning data and how it populates databases and how those databases and applications are structured.18 Some key issues to uncover when researching data architecture and design include data structure, or schema , which da- tabases are used (e.g., Oracle Database 11g, DB2, SQL Server), methods of query and access (e.g., SQL), the operating systems the databases operate on, and even their hardware (which can affect data architecture features and capabilities).
4. Data modeling can be complex, yet it is an important step in overall IG for g the IT department. It “illustrates the relationships between data.” Data modeling is an application software design process whereby data processes and fl ows between applications are diagrammed graphically in a type of fl owchart that formally depicts where data is stored, which applications share it, where it moves, and the interactions regarding data movement between applications. “Data modeling techniques and tools capture and translate complex system designs into easily understood representations of the data fl ows and processes, creating a blueprint for construction and/ or re-engineering.” 19 Good data models allow for troubleshooting before applications are written and implemented.
The importance of data modeling as a foundation for the application devel- opment process is depicted in Figure 10.2 .
Once the data model is developed, business rules and logic can be applied through application development. A user interface is constructed for the appli- cation, followed by movement of data or e-documents through work steps us- ing work fl ow capabilities, and then integration with existing applications (e.g., enterprise resource planning or customer relationship management systems). Typically this is accomplished through an application programming inter- face, a sort of connector that allows interaction with other applications and databases.
196 INFORMATION GOVERNANCE
There are six approaches to data modeling:
1. Conceptual. The conceptual approach merely diagrams data relationships at the “highest level” 20 showing the storage, warehousing, and movement of data between applications.
2. Enterprise. The enterprise approach is a more business-oriented version of conceptual data modeling that includes specifi c requirements for an enter- prise or business unit.
3. Logical. Pertinent to the design and architecture of physical storage, logical data modeling “illustrates the specifi c entities, attributes and relationships in- volved in a business function.”
4. Physical. The physical approach depicts the “implementation of a logical data model” relative to a specifi c application and database system.
5. Data integration. This approach is just what it says; it involves merging data from two or more sources, processing the data, and moving it into a database. “This category includes Extract, Transform, and Load (ETL) capabilities.” 21
6. Reference data management. This approach often is confused with MDM, although they do have interdependencies. Reference data is a way to refer to data in categories (e.g., having lookup tables— standard industry classifi cation or SIC codes) to insert values, 22 and is used only to “categorize other data found in a database, or solely for relating data in a database to information beyond the boundaries of the enterprise.” 23 So reference data is not your actual data itself but a reference to categorize data.
Figure 10.3 shows different categories of data.
IT Governance
As introduced in Chapter 2 , IT governance is about effi ciency and value creation. IT governance is the primary way that stakeholders can ensure that investments in IT create
Figure 10.2 Key Steps from Data Modeling to Integration Source: Reproduced from Orangescape.com ( www.orangescape.com/wp-content/uploads/2010/10/ Application-Development-Lifecycle-OrangeScape.png ).
Data Model Business Logic
User Interface
Work Flows Integration
INFORMATION GOVERNANCE AND INFORMATION TECHNOLOGY FUNCTIONS 197
business value and contribute toward meeting business objectives.24 This strategic align- ment of IT with the business is challenging yet essential. IT governance programs go further and aim to “improve IT performance, deliver optimum business value and ensure regulatory compliance.” 25
Although the CIO typically has line responsibility for implementing IT gover- nance, the chief executive offi cer and board of directors must receive reports and up- dates to discharge their responsibilities for IT governance and to see that the program is functioning well and providing business benefi ts.
The focus of governance in IT is on the actual software development and mainte- nance activities of the IT department or function, and IT governance efforts focus on making IT effi cient and effective. That means minimizing costs by following proven software development methodologies and best practices, principles of data governance and information quality, and project management best practices while aligning IT efforts with the business objectives of the organization.
IT Governance Frameworks
Several IT governance frameworks can be used as a guide to implementing an IT governance program.
Although frameworks and guidance like CobiT® and T ITIL have been widely adopted, there is no absolute standard IT governance framework; the combination that works best for your organization depends on business factors, corporate culture, IT maturity, and staffi ng capability. The level of implementation of these frameworks will also vary by organization.
Figure 10.3 Categories of Data Source: http://www.information-management.com/issues/20060401/1051002-1.html?zkPrintable =1&nopagination=1
Increasing: DATABASE
Semantic content Metadata Most relevant
to design
Most relevant to outside world
Most relevant to business
Most relevant to technology
Reference Data
Master Data
Enterprise Structure Data
Transaction Activity Data
Transaction Audit Data
Data quality importance
Volume of data
Rates of update
Population later in time
Shorter life span
IT governance seeks to align business objectives with IT strategy to deliver business value.
198 INFORMATION GOVERNANCE
CobiT®
CobiT (Control Objectives for Information and related Technology) is a process-T based IT governance framework that represents a consensus of experts worldwide. It was codeveloped by the IT Governance Institute and ISACA. CobiT addresses busi- ness risks, control requirements, compliance, and technical issues.26
CobiT offers IT controls that:
■ Cut IT risks while gaining business value from IT under an umbrella of a glob- ally accepted framework.
■ Assist in meeting regulatory compliance requirements. ■ Utilize a structured approach for improved reporting and management deci-
sion making. ■ Provide solutions to control assessments and project implementations to
improve IT and information asset control. 27
CobiT consists of detailed descriptions of processes required in IT and tools to measure progress toward maturity of the IT governance program. It is industry agnos- tic and can be applied across all vertical industry sectors, and it continues to be revised and refi ned. 28
CobiT is broken into three basic organizational levels and their responsibilities: (1) board of directors and executive management; (2) IT and business management; and (3) line-level governance, security, and control knowledge workers.29
The CobiT model draws on the traditional “plan, build, run, monitor” paradigm of traditional IT management, only with variations in semantics. There are four IT domains in the COBIT framework, which contain 34 IT processes and 210 control objectives that map to the four specifi c IT processes of:
1. Plan and organize. 2. Acquire and implement. 3. Deliver and support. 4. Monitor and evaluate.
Specifi c goals and metrics are assigned, and responsibilities and accountabilities are delineated.
The CobiT framework maps to ISO 17799 of the International Organization for Standardization and is compatible with Information Technology Infrastructure Library (ITIL) and other accepted practices in IT development and operations. 30
COBIT 5
Released in 2012, CobiT 5 is the latest version of the business framework for the gov- ernance of IT from ISACA. CobiT 5
builds and expands on COBIT 4.1 by integrating other major frameworks, standards and resources, including ISACA’s Val IT and Risk IT, Information Technology Infrastructure Library (ITIL®) and related standards from the International Organization for Standardization (ISO). 31
INFORMATION GOVERNANCE AND INFORMATION TECHNOLOGY FUNCTIONS 199
Key Principles and Enablers “CobiT 5 is based on fi ve key principles for governance and management of enterprise IT:
■ Principle 1: Meeting Stakeholder Needs ■ Principle 2: Covering the Enterprise End-to- End ■ Principle 3: Applying a Single, Integrated Framework ■ Principle 4: Enabling a Holistic Approach ■ Principle 5: Separating Governance From Management
The CobiT 5 framework describes seven categories of enablers:
■ Principles, policies and frameworks are the vehicle to translate the desired behavior into practical guidance for day-to-day management.
■ Processes describe an organized set of practices and activities to achieve cer- tain objectives and produce a set of outputs in support of achieving overall IT-related goals.
■ Organizational structures are the key decision-making entities in an enterprise.
■ Culture, ethics and behavior of individuals and of the enterprise are very oftenr underestimated as a success factor in governance and management activities.
■ Information is required for keeping the organization running and well gov- erned, but at the operational level, information is very often the key product of the enterprise itself.
■ Services, infrastructure and applications include the infrastructure, technol- ogy and applications that provide the enterprise with information technology processing and services.
People, skills and competencies are required for successful completion of all activi- ties, and for making correct decisions and taking corrective actions.” 32
ValIT®
ValIT is a newer value-oriented framework that is compatible with and complemen- tary to CobiT. Its principles and best practices focus is on leveraging IT investments to gain maximum value. Forty key ValIT essential management practices (analogous to CobiT’s control objectives) support three main processes: value governance, port- folio management, and investment management. ValIT and CobiT “provide a full framework and supporting tool set to help managers develop policies to manage
CobiT 5 is the latest version of the business framework for the governance of IT. It has just fi ve principles and seven enablers.
200 INFORMATION GOVERNANCE
business risks and deliver business value while addressing technical issues and meeting control objectives in a structured, methodic way.” 33
ValIT Integrated with CobiT 5
The ValIT framework has been folded into the CobiT 5 framework. 34 For more de- tails, you may download free or acquire publications and operational tools on this and related topics at isaca.org.
Key functions of ValIT include:
■ Defi ne the relationship between IT and the business and those functions in the organization with governance responsibilities;
■ Manage an organization’s portfolio of IT-enabled business investments; ■ Maximize the quality of business cases for IT-enabled business investments
with particular emphasis on the defi nition of key fi nancial indicators, the quantifi cation of “soft” benefi ts and the comprehensive appraisal of the downside risk.
Val IT addresses assumptions, costs, risks and outcomes related to a balanced portfolio of IT-enabled business investments. It also provides benchmarking capability and allows enterprises to exchange experiences on best practices for value management. 35
ITIL
ITIL is a set of process-oriented best practices and guidance originally developed in the United Kingdom to standardize delivery of IT service management. ITIL is applicable to both the private and public sectors and is the “most widely accepted ap- proach to IT service management in the world.” 36 As with other IT governance frame- works, ITIL provides essential guidance for delivering business value through IT, and it “provides guidance to organizations on how to use IT as a tool to facilitate business change, transformation and growth.” 37
ITIL best practices form the foundation for ISO/IEC 20000 (previously BS 15000), the International Service Management Standard for organizational certifi cation and compliance. 38 ITIL 2011 is the latest revision (as of this writing).
CobiT is process-oriented and has been widely adopted as an IT governance framework. ValIT is value-oriented and compatible and complementary with CobiT yet focuses on value delivery.
The Val IT framework has been folded into the COBIT 5 framework.
INFORMATION GOVERNANCE AND INFORMATION TECHNOLOGY FUNCTIONS 201
It consists of fi ve core published volumes that map the IT service cycle in a systematic way:
1. ITIL Service Strategy 2. ITIL Service Design 3. ITIL Service Transition 4. ITIL Service Operation 5. ITIL Continual Service Improvement
ISO 38500
ISO/IEC 38500:2008 is an international standard that provides high-level principles and guidance for senior executives and directors, and those advising them, for the effec- tive and effi cient use of IT. 39 Based primarily on AS 8015, the Australian IT governance standard, it “applies to the governance of management processes” performed at the IT service level, but the guidance assists executives in monitoring IT and ethically discharg- ing their duties with respect to legal and regulatory compliance of IT activities.
The ISO 38500 standard comprises three main sections:
1. Scope, Application and Objectives 2. Framework for Good Corporate Governance of IT 3. Guidance for Corporate Governance of IT
It is largely derived from AS 8015, the guiding principles of which were:
■ Establish responsibilities ■ Plan to best support the organization ■ Acquire validly ■ Ensure performance when required ■ Ensure conformance with rules ■ Ensure respect for human factors
The standard also has relationships with other major ISO standards, and em- braces the same methods and approaches.40
CobiT is process oriented and has been widely adopted as an IT governance framework. ValIT is value oriented and compatible and complementary with CobiT yet focuses on value delivery.
ITIL is the “most widely accepted approach to IT service management in the world.”
202 INFORMATION GOVERNANCE
IG Best Practices for Database Security and Compliance
Although security is a topic primarily for Chapter 11 , it is a technical topic that we address here as well. Best practices have been developed over the past few years and can prevent leakage of structured data from databases and Web services due to SQL injections (where hackers attack SQL databases) and other types of attacks.
An organization and its data needs to be connected to its stakeholders—employees, customers, suppliers, and strategic partners. In this interconnected world that keeps ex- panding (e.g., cloud, mobile devices) proprietary data is exposed to a variety of threats. It is critical to protect the sensitive information assets that reside in your databases. 41
Perimeter security often is easily penetrated. Web apps are vulnerable to attacks such as SQL injection (a favorite among malicious approaches). Hackers also can gain access by spear phishing (very specifi c phishing attacks that include personal informa- tion) to glean employee login credentials in order to get access to databases.
Streamlining your approach to database security by implementing a uniform set of policies and processes helps in compliance efforts and reduces costs. Here are some proven database security best practices:
■ Inventory and document. You must fi rst identify where your sensitive data and databases reside in order to secure them. So a discovery and mapping process must take place. You can begin with staff interviews but also use tools such as data loss prevention to map out data fl ows. Include all locations, includ- ing legacy applications, and intellectual property such as price lists, marketing and strategic plans, product designs, and the like. This inventorying/discovery process must be done on a regular basis with the assistance of automated tools, since the location of data can migrate and change.
■ Assess exposure/weaknesses. Look for security holes, missing updates and patches, and any irregularities on a regular basis, using
standard checklists such as the CIS Database Server Benchmarks and the DISA Security Technical Implementation Guides (STIGs). Do not forget to check OS-level parameters such as fi le privileges for database confi guration fi les and database confi guration options such as roles and permissions, or how many failed logins result in a locked account (these types of database-specifi c checks are typically not performed by network vulnerability assessment scanners).
■ Shore up the database. Based on your evaluation of potential vulnerabilities, take proper steps and also be sure to that used database functions are disabled.
■ Monitor. On a regular basis, monitor and document any confi guration changes, and make sure the “gold” confi guration is stable and unchanged. “Use change auditing tools that compare confi guration snapshots and immediately alert whenever a change is made that affects your security posture.” 42
ISO 38500 is an international standard that provides high-level principles and guidance for senior executives and directors responsible for IT governance.
INFORMATION GOVERNANCE AND INFORMATION TECHNOLOGY FUNCTIONS 203
■ Deploy monitoring/auditing tools . Deploy these tools to immediately detect intrusions or suspicious activity, use your database’s database activity monitoring (DAM) and database auditing tools continuously and in real time. Note any anomalies, such as usually large numbers of records being downloaded even by authorized users—this could indicate, for instance, a rogue employee gathering information. But also higher-level “privileged users—such as database administrators (DBAs), developers and outsourced personnel” must be monitored to comply with certain regulations. Watch for attackers who have gained access through authorized credentials. DAM creates an audit trail generated in real time that can be the forensic smoking gun in investigations after attacks have occurred. Also, monitor the applica- tion layer, as
well-designed DAM solutions associate specifi c database transactions performed by the application with specifi c end-user IDs, in order to deterministically identify individuals violating corporate policies. In ad- dition, combining database auditing information with OS [operating system] and network logs via a security information and event manage- ment . . . system to see everything that a user has done can also provide critical information for forensic investigations.
■ Verify privileged access . In your audit process, periodically review the list of privi-s leged users and entitlement reports to ensure that superusers and those with access to sensitive information are still authorized.
■ Protect sensitive data . Known sensitive data should be encrypted, so that even if attackers gain access, it is unreadable. “File-level encryption at the OS lay- er, combined with granular real-time monitoring and access control at the database layer, is typically accepted as a practical alternative to column-level encryption and a compensating control for Requirement 3.3 of PCI-DSS.” 43
■ Deploy masking. Hide your live production data by masking test data. “Masking is a key database security technology that de-identifi es live production data, replacing it with realistic but fi ctional data that can then be used for testing, training and development purposes, because it is contextually appropriate to the production data it has replaced.”
■ Integrate and automate standardized security processes. To pass compliance audits, you need to show that processes and system are in place to reduce risks and detect potential intrusions, attacks, and unauthorized use. Standardizing and automating these tasks as much as possible helps minimize compliance costs while protecting the organization’s data.
Implementing these best practices will help keep sensitive data in your databases secure.
Identifying sensitive information in your databases and implementing database security best practices help reduce organizational risk and the cost of compliance.
204 INFORMATION GOVERNANCE
Tying It All Together
Multiple frameworks and standards can be applied to the IT process to more effectively govern it and focus the processes on business impact. Beginning with a robust data governance program, organizations can ensure, at the more fundamental level, that the information they are using to base decisions on is clean, reliable, and accurate. Implementing an MDM program will help larger organizations with complex IT operations ensure that they are working with consistent data from a single source. Implementing the CobiT 5 business framework for delivering IT results will help support a more effi cient IT operation and include other major frameworks, standards, and best practices. Leveraging the use of the ISO 38500 standard will help senior executives to better manage and govern IT operations, and employing database security best practices will help guard against outside threats.
■ Focusing on business impact and customizing your IG approach to meet business objectives are key best practices for IG in the IT department.
■ Effective data governance can yield bottom-line benefi ts derived from new insights.
■ Good data governance ensures that downstream negative effects of poor data are avoided and that subsequent reports, analyses, and conclusions are based on reliable, trusted data.
■ Master data management is a key IG process in IT.
■ IT governance seeks to align business objectives with IT strategy to deliver business value.
■ CobiT 5 is the latest version of the business framework for the governance of IT. It has just fi ve principles and seven enablers.
■ CobiT is process oriented and has been widely adopted as an IT governance framework. ValIT is value oriented and compatible and complementary with CobiT yet focuses on value delivery.
■ ValIT is a framework that focuses on delivering IT vale. It is folded into CobiT 5.
■ ITIL is the “most widely accepted approach to IT service management in the world.”
■ ISO 38500 is an international standard that provides high-level principles and guidance for senior executives and directors responsible for IT governance
■ Identifying sensitive information in your databases and implementing data- base security best practices help reduce organizational risk and the cost of compliance.
CHAPTER SUMMARY: KEY POINTS
INFORMATION GOVERNANCE AND INFORMATION TECHNOLOGY FUNCTIONS 205
Notes
1. Ibid. Gartner Says Master Data Management Is Critical to Achieving Effective Information Gover- nance, www.gartner.com/newsroom/id/1898914 (accessed on January 19, 2012).
2. IBM, “Selling Information Governance to Business Leaders,” www.information-management.com/ newsletters/governance-ROI-BI-business-rules-GRC-10021663-1.html (accessed June 3, 2013).
3. Ibid. 4. Ibid. 5. Steven Adler, “Six Steps to Data Governance Success,” May 31, 2007, www.cio.com/article/114750/Six_
Steps_to_Data_Governance_Success . 6. “New Trends and Best Practices for Data Governance Success,” SeachDataManagement.com e-book,
http://viewer.media.bitpipe.com/1216309501_94/1288990195_946/Talend_sDM_SO_32247_EB- ook_1104.pdf (accessed March 11, 2013).
7. Ibid. 8. “The DGI Data Governance Framework,” DataGovernance.com, www.datagovernance.com/fw_the_
DGI_data_governance_framework.html (accessed June 4, 2013). 9. “Information Management,” BusinessDictionary.com, www.businessdictionary.com/definition/
information-management.html (accessed June 4, 2013). 10. Sunil Soares, Selling Information Governance to the Business (Ketcham, ID: MC Press, 2011), p. 4. s 11. Daniel Teachey, “The Year of Master Data Management,” May 1, 2012, http://tdwi.org/articles/2012/05/01/
lesson-2012-the-year-of-master-data-management.aspx . 12. Andrew White, “We Are Only Half Pregnant with MDM,” April 17, 2013, http://blogs.gartner.com/
andrew_white/2013/04/17/we-are-only-half-pregnant-with-master-data-management/ 13. Gartner IT Glossary, “Master Data Management,” www.gartner.com/it-glossary/master-data-management-
mdm/ (accessed June 11, 2013). 14. Teachey, “Year of Master Data Management.” 15. Bill Tolson, “Information Governance 101,” May 21, 2013, http://informationgovernance101.
com/2013/05/21/the-lifecycle-of-information/. 16. Gartner IT Glossary, “Information Lifecycle Management,” www.gartner.com/it-glossary/information-
life-cycle-management-ilm (accessed June 11, 2013). 17. Soares, Selling Information Governance to the Business. s 18. “Data Architecture,” BusinessDictionary.com, www.businessdictionary.com/defi nition/data-architecture
.html (accessed June 11, 2013). 19. “Data Modeling,” TechTarget, http://searchdatamanagement.techtarget.com/defi nition/data-model-
ing (accessed June 11, 2013).Ibid. 20. Ibid . 21. Soares, Selling Information Governance to the Business. s 22. Ibid. 23. Malcolm Chisholm, “Master Data Versus Reference Data,” Information Management , April 1, 2006, t
www.information-management.com/issues/20060401/1051002-1.html . 24. M. N. Kooper, R. Maes, and E.E.O. Roos Lindgreen, “On the Governance of Information: Introducing a
New Concept of Governance to Support the Management of Information,” International Journal of Information Management 31 (2011): 195–20, www.sciencedirect.com/science/article/pii/S0268401210000708 .t
25. Nick Robinson, “The Many Faces of IT Governance: Crafting an IT Governance Architecture,” ISACA Journal 1 (2007), www.isaca.org/Journal/Past-Issues/2007/Volume-1/Pages/The-Many-Faces-l of-IT-Governance-Crafting-an-IT-Governance-Architecture.aspx.
26. Bryn Phillips, “IT Governance for CEOs and Members of the Board,” 2012, p. 26. 27. IBM Global Business Services—Public Sector, “Control Objectives for Information and related Technol-
ogy (CobiT®) Internationally Accepted Gold Standard for IT Controls and Governance,” 2008, http:// www-304.ibm.com/industries/publicsector/fi leserve?contentid=187551 (accessed March 11, 2013).
28. Phillips, “IT Governance for CEOs and Members of the Board.” 29. IBM Global Business Services—Public Sector, “CobiT®.” 30. Ibid. 31. “COBIT 5: A Business Framework for the Governance and Management of Enterprise IT,” www.isaca
.org/COBIT/Pages/default.aspx (accessed December 8, 2013). 32. Ibid. 33. IBM Global Business Services—Public Sector, “CobiT®.” 34. IASCA, “Val IT Framework for Business Technology Management,” www.isaca.org/Knowledge-Center/
Val-IT-IT-Value-Delivery-/Pages/Val-IT1.aspx?utm_source=multiple&utm_medium=multiple&utm_ content=friendly&utm_campaign=valit (accessed June 12, 2013).
206 INFORMATION GOVERNANCE
35. Ibid. 36. ITIL, “Welcome to the Official ITIL® Website,” www.itil-officialsite.com/ (accessed
March 12, 2013). 37. ITIL, “What Is ITIL?” www.itil-offi cialsite.com/AboutITIL/WhatisITIL.aspx (accessed March 12,
2013). 38. Ibid. 39. ISO, “ISO/IEC 38500:2008: Corporate Governance of Information Technology,” www.iso.org/iso/
catalogue_detail?csnumber=51639 (accessed March 12, 2013). 40. “ISO 38500 IT Governance Standard” (2008), www.38500.org/ (accessed March 12, 2013). 41. The following discussion and quotes are from Phil Neray, “Beating the Breach: 10 Best Practices
for Database Security and Compliance,” November 3, 2011, http://datasafestorage.wordpress .com/2011/11/15/beating-the-breach-10-best-practices-for-database-security-and-compliance/.
42. Ibid 43. Ibid
207
P rivacy and security go hand in hand. Privacy cannot be protected without imple- menting proper security controls and technologies. Organization must make not only reasonable efforts to protect privacy of data, but they must go much further
as privacy breaches are damaging to its customers, reputation, and potentially, could put the company out of business.
Breaches are increasingly being carried out by malicious attacks, but also a sig- nifi cant source of breaches is internal mistakes caused by poor information gover- nance (IG) practices, software bugs, and carelessness. The average cost of a data breach in 2013 was over $5 million dollars, according to the Ponemon Institute, 1 but some spectacular breaches have occurred, such as the $45 million in fraudulent automated teller machine cash withdrawals in New York City within hours in early 2013, and the 110 million customer records breached at giant retailer Target in late 2013. Millions of breaches occur each year: There were an estimated 354 million privacy breaches between 2005 and 2010 in the United States alone.
Cyberattacks Proliferate
Online attacks and snooping continue at an increasing rate. Organizations must be vigilant about securing their internal, confi dential documents and e-mail messages. In 2011, security experts at Intel/McAfee “discovered an unprecedented series of cyber attacks on the networks of 72 organizations globally, including the United Nations, governments and corporations, over a fi ve-year period.” 2 Dmitri Alperovitch of McAfee described the incident as “ the biggest transfer of wealth in terms of intellectual“ property in history.”3 The level of intrusion is ominous.
The targeted victims included governments, including the United States, Canada, India, and others; corporations, including high-tech companies and defense contrac- tors; the International Olympic Committee; and the United Nations. “In the case of the United Nations, the hackers broke into the computer system of its secretariat in
Information Governance and Privacy and Security Functions
C H A P T E R 11
Portions of this chapter are adapted from Chapters 11 and 12, Robert F. Smallwood, Safeguarding Critical E-Documents: Implementing a Program for Securing Confi dential Information Assets , © John Wiley & Sons, Inc., 2012. Reproduced with s permission of John Wiley & Sons, Inc.
208 INFORMATION GOVERNANCE
Geneva in 2008, hid there for nearly two years, and quietly combed through reams of secret data, according to McAfee.” 4 Attacks can be occurring in organizations for years before they are uncovered—if they are discovered at all. This means that an organization may be covertly monitored by criminals or competitors for extended periods of time.
And they are not the only ones spying—look no further than the U.S. National Security Agency (NSA) scandal of 2013. With Edward Snowden’s revelations, it is clear that governments are accessing, monitoring, and storing massive amounts of private data.
Where this stolen information is going and how it will be used is yet to be determined. But it is clear that possessing this competitive intelligence could give a government or company a huge advantage economically, competitively, diplomatically, and militarily.
The information assets of companies and government agencies are at risk globally. Some are invaded and eroded daily, without detection. The victims are losing economic advantage and national secrets to unscrupulous rivals, so it is imperative that IG policies are formed, followed, enforced, tested, and audited. It is also imperative to use the best available technology to counter or avoid such attacks. 5
Insider Threat: Malicious or Not
Ibas, a global supplier of data recovery and computer forensics, conducted a survey of 400 business professionals about their attitudes toward intellectual property (IP) theft:
■ Nearly 70 percent of employees have engaged in IP theft, taking corporate property upon (voluntary or involuntary) termination.
■ Almost one-third have taken valuable customer contact information, databases, or other client data.
■ Most employees send e-documents to their personal e-mail accounts when pil- fering the information.
■ Almost 60 percent of surveyed employees believe such actions are acceptable. ■ Those who steal IP often feel that they are entitled to partial ownership rights,
especially if they had a hand in creating the fi les. 6
These survey statistics are alarming, and by all accounts the trend continuing to worsen today. Clearly, organizations have serious cultural challenges to combat prevailing attitudes toward IP theft. A strong and continuous program of IG aimed at secur- ing confi dential information assets can educate employees, raise their IP security
Attacks can continue in organizations for years before they are uncovered—if they are discovered at all.
The average cost of a data breach in 2013 was over $5 million.
INFORMATION GOVERNANCE AND PRIVACY AND SECURITY FUNCTIONS 209
awareness, and train them on techniques to help secure valuable IP. And the change needs to be driven from the top: from the CEO and boardroom. However, the mag- nitude of the problem in any organization cannot be accurately known or measured. Without the necessary IG monitoring and enforcement tools, executives cannot know the extent of the erosion of information assets and the real cost in cash and intangible terms over the long term.
Countering the Insider Threat
Frequently ignored, the insider has increasingly become the main threat—more than the external threats outside of the perimeter. Insider threat breaches can be more costly than outsider breaches. Most of the insider incidents go unnoticed or unreported.7
Companies have been spending a lot of time and effort protecting their perimeters from outside attacks. In recent years, most companies have realized that the insider threat is something that needs to be taken more seriously.
Malicious Insider
Malicious insiders and saboteurs comprise a very small minority of employees. A dis- gruntled employee or sometimes an outright spy can cause a lot of damage. Malicious insiders have many methods at their disposal to harm the organization by destroying equipment, gaining unsanctioned access to IP, or removing sensitive information by USB drive, e-mail, or other methods.
Nonmalicious Insider
Fifty-eight percent of Wall Street workers say they would take data from their company if they were terminated, and believed they could get away with it, according to a recent survey by security fi rm CyberArk.8 Frequently, they do this without malice. The majority of users indicated having sent out documents accidentally via e-mail. So, clearly it is easy to leak documents without meaning to do any harm, and that is the cause of most leaks.
Solution
Trust and regulation are not enough. In the case of a nonmalicious user, companies should invest in security, risk education, and IG training. A solid IG program can reduce IP leaks through education, training, monitoring, and enforcement.
Security professionals state that insider threat breaches are often more costly than outsider ones.
Information assets are invaded and eroded daily, often without detection. This compromises competitive position and has real fi nancial impact.
210 INFORMATION GOVERNANCE
In the case of the malicious user, companies need to take a hard look and see whether they have any effective IG enforcement and document life cycle security (DLS) technology such as information rights management (IRM) in place. Most often, the answer is no. 9
Privacy Laws
The protection of personally identifi able information (PII) is a core focus of IG efforts. PII is any information that can identify an individual, such as name, Social Security number, medical record number, credit card number, and so on. Various privacy laws have been enacted in an effort to protect privacy. You must consult your legal counsel to determine which laws and regulation apply to your organization and its data and documents.
In the United States, the Federal Wiretap Act “prohibits the unauthorized inter- ception and disclosure of wire, oral, or electronic communications.” The Electronic Communications Privacy Act (ECPA) of 1986 amended the Federal Wiretap Act sig- nifi cantly and included specifi c on e-mail privacy. 10 The Stored Communications and Transactional Records Act (SCTRA) was created as a part of ECPA and is “sometimes useful for protecting the privacy of e-mail and other Internet communications when discovery is sought.” The Computer Fraud and Abuse Act makes it a crime to in- tentionally breach a “protected computer” (one used by a fi nancial institution or for interstate commerce).
Also relevant for public entities is the Freedom of Information Act, which allows U.S. citizens to request government documents that have not previously been released, although sometime sensitive information is redacted (blacked out), and specifi es the steps for disclosure as well as the exemptions. In the United Kingdom, the Freedom of Information Act 2000 provides for similar disclosure requirements and mandatory steps.
In the United Kingdom, privacy laws and regulations include these:
■ Data Protection Act 1998 ■ Freedom of Information Act 2000 ■ Public Records Act 1958 ■ Common law duty of confi dentiality ■ Confi dentiality National Health Service (NHS) Code of Practice ■ NHS Care Record Guarantee for England ■ Social Care Record Guarantee for England ■ Information Security NHS Code of Practice ■ Records Management NHS Code of Practice
Also, the international information security standard ISO/IEC 27002: 2005 comes into play when implementing security.
Redaction
Redaction is the process of blocking out sensitive fi elds of information. In a paper environment, this was done with a black marking pen; however, privacy software can redact certain fi elds in digital documents, making them unreadable. Redaction is used
INFORMATION GOVERNANCE AND PRIVACY AND SECURITY FUNCTIONS 211
for confi dential patient information in medical records as well as other confi dential document types, such as birth certifi cates, fi nancial documents, property deeds, and other unstructured information that is managed.
A complete audit trail should be enabled that shows when specifi c users accessed or printed specifi c confi dential information.
Limitations of Perimeter Security
Traditionally, central computer system security has been primarily perimeter security—securing the fi rewalls and perimeters within which e-documents are stored and attempting to keep intruders out—rather than securing e-documents directly upon their creation. The basic access security mechanisms implemented, such as passwords, two-factor authentication, and identity verifi cation, are rendered totally ineffective once the confi dential e-documents or records are legitimately accessed by an authorized employee. The documents are usually bare and unsecured. This poses tremendous challenges if the employee is suddenly terminated, if the person is a rogue intent on doing harm, or if outside hackers are able to penetrate the secured perimeter. And, of course, it is com- mon knowledge that they do it all the time. The focus should be on securing the documents themselves, directly.
Restricting access is the goal of conventional perimeter security, but it does not directly protect the information inside. Perimeter security protects information the same way a safe protects valuables; if safecrackers get in, the contents are theirs. There are no protections once the safe is opened. Similarly, if hackers penetrate the perimeter security, they have complete access to the information inside, which they can steal, alter, or misuse. 11 The perimeter security approach has four fundamental limitations:
1. Limited effectiveness. Perimeter protection stops dead at the fi rewall, even though sensitive information is sent past it and circulates around the Web, unsecured. Today’s extended computing model and the trend toward global business means that business enterprises and government agencies frequently share sensitive information externally with other stakeholders, including busi- ness partners, customers, suppliers, and constituents.
2. Haphazard protections. In the normal course of business, knowledge workers send, work on, and store copies of the same information outside the organi- zation’s established perimeter. Even if the information’s new digital environ- ment is secured by other perimeters, each one utilizes different access controls or sometimes no access control at all (e.g., copying a price list from a sales folder to a marketing folder; an attorney copying a case brief or litigation strategy document from a paralegal’s case folder).
3. Too complex. With this multi-perimeter scenario, there are simply too many pe- rimeters to manage, and often they are out of the organization’s direct control.
4. No direct protections. Attempts to create boundaries or portals protected by pe- rimeter security within which stakeholders (partners, suppliers, shareholders, or customers) can share information causes more complexity and administra- tive overhead while it fails to protect the e-documents and data directly. 12
Despite the current investment in e-document security, it is astounding that once information is shared today, it is largely unknown who will be accessing it tomorrow.
212 INFORMATION GOVERNANCE
Defense in Depth
Defense in depth is an approach that uses multiple layers of security mechanisms to protect information assets and reduce the likelihood that rogue attacks can succeed.13 The idea is based on military principles that an enemy is stymied by complex layers and approaches compared to a single line. That is, hackers may be able to penetrate one or two of the defense layers, but multiple security layers increase the chances of catching the attack before it gets too far. Defense in depth includes a fi rewall as a fi rst line of defense and also antivirus and anti-spyware software, identity and access management (IAM), hierarchical passwords, intrusion detection, and biometric t verifi cation. Also, as a part of an overall IG program, physical security measures are deployed, such as smartcard or even biometric access to facilities and intensive IG training and auditing.
Controlling Access Using Identity Access Management
IAM software can provide an important piece of the security solution. It aims to pre- vent unauthorized people from accessing a system and to ensure that only authorized individuals engage with information, including confi dential e-documents.
Today’s business environment operates in a more extended and mobile model, often including stakeholders outside of the organization. With this more complex and fl uctuating group of users accessing information management applications, the idea of identity management has gained increased importance.
The response to the growing number of software applications using inconsistent or incompatible security models is strong identity management enforcement software. These scattered applications offer opportunities not only for identity theft but also for identity drag , where the maintenance of identities does not keep up with changing g identities, especially in organizations with a large workforce. This can result in theft of confi dential information assets by unauthorized or out-of-date access and even failure to meet regulatory compliance, which can result in fi nes and imprisonment.14
IAM—along with sharp IG policies—“manages and governs user access to infor- mation through an automated, continuous process.” 15 Implemented properly, good IAM does keep access limited to authorized users while increasing security, reducing IT complexity, and increasing operating effi ciencies.
Critically, “IAM addresses ‘access creep’ where employees move to a different department of business unit and their rights to access information fail to get updated” (emphasis added).” 16
In France in 2007, a rogue stock trader at Société Générale had in-depth knowl- edge of the bank’s access control procedures from his job at the home offi ce. 17 He used that information to defraud the bank and its clients out of over €7 billion (over $10 billion). If the bank had implemented an IAM solution, the crime might not have been possible.
“IAM addresses ‘access creep’ where employees move to a different depart- ment of business unit and their rights to access information fail to get updated.”
INFORMATION GOVERNANCE AND PRIVACY AND SECURITY FUNCTIONS 213
A robust and effective IAM solution provides for:
■ Auditing . Detailed audit trails of g who attempted to access which information , and when . Stolen identities can be uncovered if, for instance, an authorized user attempts to log in from more than one computer at a time.
■ Constant updating. Regular reviews of access rights assigned to individuals, in- cluding review and certifi cation for user access, an automated recertifi cation process ( attestation ), and enforcement of IG access policies that govern the way users access information in respect to segregation of duties.
■ Evolving roles. Role life cycle management should be maintained on a continuous basis, to mine and manage roles and their associated access rights and policies.
■ Risk reduction. Remediation regarding access to critical documents and information.
Enforcing IG: Protect Files with Rules and Permissions
One of the fi rst tasks often needed when developing an IG program that secures confi - dential information assets is to defi ne roles and responsibilities for those charged with implementing, maintaining, and enforcing IG policies. Corollaries that spring from that effort get down to the nitty-gritty of controlling information access by rules and permissions.
Rules and permissions specify who (by roles) is allowed access to which documents and information, and even contextually from where (offi ce, home, travel) and at what times (work hours, or extended hours). Using the old policy of the s need-to-know basis is a good rule of thumb to apply when setting up these access policies (i.e., only those who are at a certain level of the organization or are directly involved in certain projects are allowed access to confi dential and sensitive information). The roles are relatively easy to defi ne in a traditional hierarchical structure, but today’s fl atter and more col- laborative enterprises present challenges.
To effectively wall off and secure information by management level, many compa- nies and governments have put in place an information security framework—a model that delineates which levels of the organization have access to specifi c documents and databases as a part of implemented IG policy. This framework shows a hierarchy of the company’s management distributed across a range of defi ned levels of information access. The U.S. Government Protection Profi le for Authorization Server for Basic Robustness Environments is an example of such a framework.
Challenge of Securing Confi dential E-Documents
Today’s various document and content management systems were not initially designed to allow for secure document sharing and collaboration while also preventing docu- ment leakage. These software applications were mostly designed before the invention and adoption of newer business technologies that have extended the computing environment. The introduction of cloud computing, mobile PC devices, smartphones, social media, and online collaboration tools all came after most of today’s document and content management systems were developed and brought to market.
214 INFORMATION GOVERNANCE
Thus, vulnerabilities have arisen that need to be addressed with other, comple- mentary technologies. We need to look no further than the WikiLeaks incident and the myriad of other major security breaches resulting in document and data leakage to see that there are serious information security issues in both the public and private sectors.
Technology is the tool, but without proper IG policies and a culture of compli- ance that supports the knowledge workers following IG policies, any effort to secure confi dential information assets will fail. An old IT adage is that even perfect technology will fail without user commitment.
Protecting Confi dential E-Documents: Limitations of Repository-Based Approaches
Organizations invest billions of dollars in IT solutions that manage e-documents and records in terms of security, auditing, search, records retention and disposition, version control, and so on. These information management solutions are predominantly re- pository-based, including enterprise content management (ECM) systems and collab- orative workspaces (for unstructured information, such as e-documents). With content or document repositories, the focus has always been on perimeter security—keeping intruders out of the network. But that provides only partial protection. Once intrud- ers are in, they are in and have full access to confi dential e-documents. For those who are authorized to access the content, there are no protections, so they may freely copy, forward, print, or even edit and alter the information. 18
The glaring vulnerability in the security architecture of ECM systems is that few protec- tions exist once the information is legitimately accessed.
These confi dential information assets, which may include military plans, price lists, patented designs, blueprints, drawings, and fi nancial reports, often can be printed, e-mailed, or faxed to unauthorized parties without any security attached. 19
Also, in the course of their normal work processes, knowledge workers tend to keep an extra copy of the electronic documents they are working on stored at their desktop, or they download and copy them to a tablet or laptop to work at home or while traveling. This creates a situation where multiple copies of these e-documents are scat- tered about on various devices and media, which creates a security problem, since they are out- side of the repository and no longer secured, managed, controlled, or audited.
The glaring vulnerability in the security architecture of ECM systems is that few protections exist once the information is legitimately accessed.
Technologies like fi rewalls, access controls, and gateway fi lters can grant or deny access but cannot provide granular enforcement of acceptable use policies that defi ne what users can and cannot do with confi dential data and documents.
INFORMATION GOVERNANCE AND PRIVACY AND SECURITY FUNCTIONS 215
It also creates records management issues in terms of the various versions that might be out there and determining which one is the offi cial business record.
Apply Better Technology for Better Enforcement in the Extended Enterprise
Protecting E-Documents in the Extended Enterprise
Sharing e-documents and collaborating are essential in today’s increasingly mobile and global world. Businesses are operating in a more distributed model than ever be- fore, and they are increasingly sharing and collaborating not only with coworkers but also with suppliers, customers, and even at times competitors (e.g., in pharmaceutical research). This reality presents a challenge to organizations dealing in sensitive and confi dential information.20
Basic Security for the Microsoft Windows Offi ce Desktop
The fi rst level of protection for e-documents begins with basic protections at the desktop level. Microsoft Offi ce provides ways to password-protect Microsoft Offi ce fi les, such as those created in Word and Excel, quickly and easily. Many corporations and government agencies around the world use these basic protections. A key fl aw or caveat is that passwords used in protecting documents cannot be retrieved if they are forgotten or lost.
Where Do Deleted Files Go?
When you delete a fi le it is gone, right? Actually, it is not (with the possible exception of solid state hard drives). For example, after a fi le is deleted in Windows, a simple undelete DOS command can bring back the fi le, if it has not been overwritten. That is because when fi les are deleted, they are not really deleted; rather, the space where they reside is marked for reuse and can be overwritten. If it is not yet overwritten, the fi le is still there. The same process occurs as drafts of documents are created and temp (for temporary ) fi les are stored. The portions of a hard drive where deleted or temp fi les are stored can be overwritten. This is called unallocated space. Most users are unaware that deleted fi les and fragments of documents and drafts are stored temporarily on their computer’s unallocated space. So it must be wiped clean and completely erased to ensure that any confi dential documents or drafts are completely removed from the hard drive.
IG programs include the highest security measures, which means that an organi- zation must have a policy that includes deleting sensitive materials from a computer’s unallocated space and tests that verify such deletion actions are successful periodically.
Lock Down: Stop All External Access to Confi dential E-Documents
Organizations are taking other approaches to stop document and data leakage: physi- cally restricting access to a computer by disconnecting it from any network con- nections and forbidding or even blocking use of any ports. Although cumbersome, these methods are effective in highly classifi ed or restricted areas where confi dential
216 INFORMATION GOVERNANCE
e-documents are held. Access is controlled by utilizing multiple advanced identity ver- ifi cation methods, such as biometric means.
Secure Printing
Organizations normally expend a good amount of effort making sure that computers, documents, and private information are protected and secure. However, if your com- puter is hooked up to a network printer (shared by multiple knowledge workers), all of that effort might have been wasted. 21
Some basic measures can be taken to protect confi dential documents from being compromised as they are printed. You simply invoke some standard Microsoft Offi ce protections, which allow you to print the documents once you arrive in the copy room or at the networked printer. This process varies slightly, depending on the printer’s manufacturer. (Refer to the documentation for the printer for details.)
In Microsoft Offi ce, there is an option in the Print Dialog Box for delayed print- ing of documents (when you physically arrive at the printer).
Serious Security Issues with Large Print Files of Confi dential Data
According to Canadian output and print technology expert William Broddy, in a company’s data center, a print fi le of, for instance, investment account statements or bank statements contains all the rich information that a hacker or malicious insider needs. It is information distilled to the most important core data about customers, and has been referred to as data syrup since it has been boiled down and contains no mountains of extraneous data, only the culled, cleaned, essential data that gives criminals exactly what they need.d 22
What most managers are not aware of is that entire print fi les and sometimes remnants of them stay on the hard drives of high-speed printers and are vulnerable to security breaches. Data center security personnel closely monitor calls to their data- base. To extract as much data as is contained in print fi les, a hacker requires hundreds or even thousands of calls to the database, which sets off alerts by system monitor- ing tools. But retrieving a print fi le takes only one intrusion, and it may go entirely unnoticed. The fi les are sitting there; a rogue service technician or fi eld engineer can retrieve them on a routine service call.
To help secure print fi les, specialized hardware devices designed to sit between the print server and the network and cloak server print fi les are visible only to those who have a cloaking device on the other end.
Organizations must practice good IG and have specifi c procedures to erase sensitive print fi les once they have been utilized. For instance, in the example of preparing statements to mail to clients, fi les are exposed to possible intrusions in at least six points in the process (starting with print fi le preparation and ending with the actual mailing). These points must be tightly monitored and controlled. Typically, an
A print fi le contains all the distilled customer information a hacker might want. Retrieving a print fi le takes only one intrusion and may go entirely unnoticed.
INFORMATION GOVERNANCE AND PRIVACY AND SECURITY FUNCTIONS 217
organization retains a print fi le for about 14 days, though some keep fi les long enough for customers to receive statements in the mail and review them. Organizations must make sure that print fi les or their remnants are secured and then completely erased when the printing job is fi nished.
E-Mail Encryption
Encrypting (scrambling using advanced algorithms) sensitive e-mail messages is an effective step to securing confi dential information assets while in transit. Encryption can also be applied to desktop folders and fi les and even entire disk drives (full disk en- cryption, or FDE). All confi dential or sensitive data and e-documents that are exposed to third parties or transferred over public networks should be secured with fi le-level encryption, at a minimum. 23
Secure Communications Using Record-Free E-Mail
What types of tools can you use to encourage the free fl ow of ideas in collaborative efforts without compromising your confi dential information assets or risking litigation or compliance sanctions?
Stream messaging is an innovation that became commercially viable around 2006. It is similar in impact to IRM software, which limits the recipients’ ability to forward, print, or alter data in an e-mail message (or reports, spreadsheets, etc.) but goes further by leaving no record on any computer or server.r
Stream messaging is a simple, safe, secure electronic communications system ideal for ensuring that sensitive internal information is kept confi dential and not publicly released. Stream messaging is not intended to be a replacement for enterprise e-mail but is a complement to it. If you need an electronic record, e-mail it; if not, use stream messaging. 24
What makes stream messaging unique is its recordlessness. Streamed messages cannot be forwarded, edited, or saved. A copy cannot be printed as is possible with e-mail. That is because stream messaging separates the sender’s and receiver’s names and the date from the body of the message, never allowing them to be seen together. Even if the sender or receiver were to attempt to make a copy using the print-screen function, these ele- ments are never captured together.25
Files are exposed to possible intrusions in at least six points between print fi le preparation and fi nal hard-copy mailing.
With stream messaging, no record or trace of communication is left.
218 INFORMATION GOVERNANCE
The instant a stream message is sent, it is placed in a temporary storage buffer space. When the recipient logs in to read the message, it is removed from the buffer space. By the time the recipient opens it, the complete stream message no longer exists on the server or any other computer.
This communications approach is Web based, meaning that no hardware or soft- ware purchases are required. It also works with existing e-mail systems and e-mail addresses and is completely immune to spam and viruses. Other solutions (both past and present) have been offered, but these have taken the approach of encrypting e-mail or generating e-mail that disappears after a preset time. Neither of these approaches is truly recordless.
Stream messaging is unique because its technology effectively eliminates the ability to print, cut, paste, forward, or save a message. It may be the only electronic commu- nications system that separates the header information—date, name of sender, name of recipient—from the body of the message. This eliminates a traceable record of the communication. Soon many other renditions of secure messaging will be developed.
In addition, stream messaging offers the added protection of being an indiscrimi- nate Web-based service, meaning that the messages and headers are never hosted on the subscribing companies’ networks. This eliminates the risk that employers, com- petitors, or hackers could intercept stream messages, which is a great security benefi t for end users. 26
Digital Signatures
Digital signatures are more than just digitized autographs—they carry detailed audit information used to “detect unauthorized modifi cations” to e-documents and to “authenticate the identity of the signatory.” 27
Online transactions can be conducted with full trust that they are legal, proper, and binding. They prove that the person whose signature is on the e-document did, in fact, authorize it. A digital signature provides evidence in demonstrating to a third party that the signature was genuine, true, and authentic, which is known as nonrepudiation . To repudiate is to dispute, and with digital signatures, a signatory is unable to claim that the signature is forged.
Digital signatures can be implemented a variety of ways—not just through soft- ware but also through fi rmware (programmed microchips), computer hardware, or a combination of the three. Generally, hardware- and fi rmware-based implementations are more diffi cult to hack, since their instructions are hardwired.
Here is a key point: For those who are unfamiliar with the technology, there is a big difference between electronic signatures and digital signatures. 28
An “electronic signature is likely to be a bit-map image, either from a scanned image, a fax copy or a picture of someone’s signature, or may even be a typed acknowledgement or acceptance.” A digital signature contains “extra data appended to
There is a big difference between digital and electronic signatures. Digital signatures contain additional authenticating information.
INFORMATION GOVERNANCE AND PRIVACY AND SECURITY FUNCTIONS 219
a message which identifi es and authenticates the sender and message data using public-key encryption.”29”
So digital signatures are the only ones that offer any real security advantages. Digital signatures are verifi ed by the combination of applying a signatory’s private
signing key and the public key that comes from the signatory’s personal ID certifi - cate. After that, only the public key ID certifi cate is required for future verifi cations. “In addition, a checksum mechanism confi rms that there have been no modifi cations to the content .” t 30
A formal, trusted certifi cate authority (CA) issues the certifi cate associated with the public-private key. It is possible to generate self-certifi ed public keys, but these do not verify and authenticate the recipient’s identity and are therefore fl awed from a security standpoint. The interchange of verifi ed signatures is possible on a global scale, as “digital signature standards are mature and converging internationally.” 31
After more than 30 years of predictions, the paperless offi ce is almost here. Business process cycles have been reduced, and great effi ciencies have been gained since the majority of documents today are created digitally and spend most of their life cycle in digital form, and they can be routed through work steps using business process management (BPM) and work fl ow software. However, the requirement for a physical signature frequently disrupts and holds up these business processes . Documents have to bes printed out, physically routed, and physically signed—and often they are scanned back into a document or records management (or contract management) system, which defeats the effi ciencies sought.
Often multiple signatures are required in an approval process, and some organiza- tions require each page to be initialed, which makes the process slow and cumbersome when it is executed without the benefi t of digital signatures. Also, multiple copies are generated—as many as 20—so digital signature capability injected into a business pro- cess can account for signifi cant time and cost savings. 32
Document Encryption
There is some overlap and sometimes confusion between digital signatures and document encryption. Suffi ce it to say that they work differently, in that document encryption secures a document for those who share a secret key, and digital signatures prove that the document has not been altered and the signature is authentic.
There are e-records management implications of employing document encryption:
Unless it is absolutely essential, full document encryption is often advised against for use within electronic records management systems as it prevents full-text indexing, and requires that the decryption keys (and application) are available for any future access. Furthermore, if the decryption key is lost or
Requiring a physical signature can disrupt and slow business processes. Digital signatures speed that up and add a layer of security.
220 INFORMATION GOVERNANCE
an employee leaves without passing it on, encrypted documents and records will in effect be electronically shredded as no one will be able to read them.
Correctly certifi ed digital signatures do not prevent unauthorized per- sons reading a document nor are they intended to. They do confi rm that the person who signed it is who they say they are, and that the document has not been altered since they signed it. Within a records management system a digi- tal signature is often considered to be an important part of the metadata of a document, confi rming both its heritage and its integrity.33
Data Loss Prevention (DLP) Technology
The aforementioned document security challenges have given rise to an emerging but critical set of capabilities by a new breed of IT companies that provide data loss prevention (DLP) (also called data leak prevention). DLP providers create software and hardware appliances that thoroughly inspect all e-documents and e-mail messages before they leave the organization’s perimeter and attempt to stop sensitive data from exiting the fi rewall.
This fi ltering is based on several factors, but mostly using specifi ed critical content keywords that are fl agged by the implementing organization. DLP can also stop the exit of information assets by document types, origin, time of day, and other factors.
DLP systems are designed to detect and prevent unauthorized use and transmission of confi dential information.34 In more detail, DLP is a computer security term referring to systems that identify, monitor, and protect data/documents in all three states: (1) in use (endpoint actions), (2) in motion (network actions), and (3) at rest (data/document stor-t age). DLP accomplishes this by deep content inspection and contextual security analysis of transaction data (e.g., attributes of the originator, the data object, medium, timing, recipient/destination, etc.) with a centralized management framework.
Promise of DLP
Gartner reports that the DLP market reached an estimated $670 million in 2013, up from $425 million in 2011, and “with adoption of DLP technologies moving quickly down to the small to medium enterprise, DLP is no longer an unknown quantity.” 35 Although the DLP market has matured, it suffers from confusion about how DLP best fi ts into the new mix of security approaches, how it is best utilized (endpoint or gateway), and even the defi nition of DLP itself. 36
Data loss is very much on managers’ and executives’ minds today. The series of WikiLeaks incidents exposed hundreds of thousands of sensitive government and mili- tary documents. According to the Ponemon Institute (as reported by DLP Experts), data leaks continue to increase annually. Billions of dollars are lost every year as a result of data leaks, with the cost of each breach ranging from an average of $700,000 to $31 million. Some interesting statistics from the study include:
■ Almost half of breaches happen while an enterprise’s data was in the hands of a third party.
■ Over one-third of breaches involved lost or stolen mobile devices.
INFORMATION GOVERNANCE AND PRIVACY AND SECURITY FUNCTIONS 221
■ The cost per stolen record is approximately $200 to $225. ■ One-quarter of breaches were conducted by criminals or with malicious intent. ■ More than 80 percent of breaches compromised over 1,000 records. 37
What DLP Does Well (and Not So Well)
DLP has been deployed successfully as a tool used to map the fl ow of data inside and exiting the organization to determine the paths that content takes, so that more sophisticated information mapping, monitoring, and content security can take place.
This use as a traffi c monitor for analysis purposes has been much more successful than relying on DLP as the sole enforcement tool for compliance and to secure information assets. s Today’s technology is simply not fast enough to catch everything. It catches many e-mail messages and documents that users are authorized to send, which slows the network and the business down. This also adds unnecessary overhead, as someone has to go back and release each and every one of the e-mails or documents that were wrongly stopped.
Another downside: Since DLP relies on content inspection, it cannot detect and monitor encrypted e-mail or documents.
Basic DLP Methods
DLP solutions typically apply one of three methods:
1. Scanning traffi c for keywords or regular expressions, such as customer credit card or Social Security numbers.
2. Classifying documents and content based on a predefi ned set to determine what is likely to be confi dential and what is not.
3. Tainting (in the case of agent-based solutions), whereby documents are tagged and then monitored to determine how to classify derivative documents. For example, if someone copies a portion of a sensitive document into a different document, this document receives the same security clearance as the original document. 38
All these methods involve the network administrator setting up a policy clearly defi ning what is allowed to be sent out and what should be kept in confi dence. This policy creating effort is extremely diffi cult: Defi ning a policy that is too broad means ac-d cidentally letting sensitive information get out, and defi ning a policy that is too narrow means getting a signifi cant amount of false positives and stopping the fl ow of normal business communications.
Although network security management is well established, defi ning these types of IG policies is extremely diffi cult for a network administrator. Leaving this job to network administrators means there will be no collaboration with business units, no standardization, and no real forethought. As a result, many installations are plagued with false positives that are fl agged and stopped, which can stifl e and frustrate knowl- edge workers. The majority of DLP deployments simply use DLP for monitoring and audit- ing purposes.
Examining the issue of the dissolving perimeter more closely, a deeper problem is revealed: DLP is binary; it is black or white. Either a certain e-document or e-mail can
222 INFORMATION GOVERNANCE
leave the organization’s boundaries or it cannot. This process has been referred to as outbound content compliance.
But this is not how the real world works today. Now there is an increasing need for collaboration and for information to be shared or reside outside the organization on mobile devices or in the cloud.
Most of today’s DLP technology cannot address these complex issues on its own. Often additional technology layers are needed.
Data Loss Prevention: Limitations
DLP has been hyped in the past few years, and major security players have made sev- eral large acquisitions—especially those in the IRM market. Much like fi rewalls, DLP started in the form of network gateways that searched e-mail, Web traffi c, and other forms of information traveling out of the organization for data that was defi ned as internal. When it found such data, the DLP blocked transmission or monitored its use.
Soon agent-based solutions were introduced, performing the same actions locally on users’ computers. The next step brought a consolidation of many agent- and net- work-based solutions to offer a comprehensive solution.
IG policy issues are key. What is the policy? All these methods depend on manage- ment setting up a policy that clearly defi nes what is acceptable to send out and what should be kept in confi dence.
With DLP, a certain document can either leave the organization’s boundaries or it can’t. But this is not how the real world works. In today’s world there is an increasing need for information to be shared or reside outside the organization on mobile devices or in the cloud. Simply put, DLP is not capable of addressing this issue on its own, but it is a helpful piece of the overall technology solution.
Missing Piece: Information Rights Management (IRM)
Another technology tool for securing information assets is information rights manage- ment (IRM) software (also referred to as enterprise rights management [ERM] and previously as enterprise digital rights management [e-DRM].) For purposes of this book, we use the term “IRM” when referring to this technology set, so as not to be confused with elec- tronic records management. Major software companies also use the term “IRM.”
IRM technology provides a sort of security wrapper around documents and pro- tects sensitive information assets from unauthorized access. 39 We know that DLP can search for key terms and stop the exit of sensitive data from the organization by in- specting its content. But it can also prevent confi dential data from being copied to external media or sent by e-mail if the person is not authorized to do so. If IRM is deployed, fi les and documents are protected wherever they may be, with persistent security. The ability to apply security to an e-document in any state (in use, in motion, and at rest), across media types, inside or outside of the organization, is called persistent security .
The ability to secure data at any time, in any state, is called persistent protection.
INFORMATION GOVERNANCE AND PRIVACY AND SECURITY FUNCTIONS 223
This is a key characteristic of IRM technology, and it is all done transparently without user intervention. 40
IRM has the ability to protect e-documents and data wherever they may reside, however they may be used, and in all three data states (at rest, in use, and in transit). 41
IRM allows for e-documents to be remote controlled , meaning that security protectionsd can be enforced even if the document leaves the perimeter of the organization. This means that e-documents (and their control mechanisms) can be separately created, viewed, edited, and distributed.
IRM provides persistent, ever-present security and manages access to sensitive e-documents and data. IRM provides embedded fi le-level protections that travel with the document or data, regardless of media type.42 These protections and prevent un- authorized viewing, editing, printing, copying, forwarding, or faxing. So, even if fi les are somehow copied to a thumb drive and taken out of the organization, e-document protections and usage are still controlled.
The major applications for IRM services include cross-protection of e-mails and attachments, dynamic content protection on Web portals, secure Web-based training, secure Web publishing, and secure content storage and e-mail repositories all while meeting compliance requirements of Sarbanes–Oxley, the Health Insurance Portabil- ity and Accountability Act, and others. Organizations can comply with regulations for securing and maintaining the integrity of digital records, and IRM will restrict and track access to spreadsheets and other fi nancial data too.
In investment banking, research communications must be monitored, according to National Association of Securities Dealers rule (NASD) 2711, and IRM can help support compliance efforts. In consumer fi nance, personal fi nancial information col- lected on paper forms and transmitted by fax (e.g., auto dealers faxing credit applica- tions) or other low-security media can be secured using IRM, directly from a scanner or copier. Importers and exporters can use IRM to ensure data security and prevent the loss of cargo from theft or even terrorist activities, and they also can comply with U.S. Customs and trade regulations by deploying IRM software. Public sector data security needs are numerous, including intelligence gathering and distribution, espionage, and Homeland Security initiatives. Firms that generate intellectual property IP, such as re- search and consulting groups, can control and protect access to IP with it. In the highly collaborative pharmaceutical industry, IRM can secure research and testing data.
IRM protections can be added to nearly all e-document types including e-mail, word processing fi les, spreadsheets, graphic presentations, computer-aided design (CAD) plans, and blueprints. This security can be enforced globally on all documents or granularly down to the smallest level, protecting sensitive fi elds of information from prying eyes. This is true even if there are multiple copies of the e-documents scattered about on servers in varying geographic locations. Also, the protections can be applied permanently or within controlled time frames. For instance, a person may be granted access to a secure e-document for a day, a week, or a year.
Key IRM Characteristics
Three requirements are recommended to ensure effective IRM:
1. Security is foremost; documents, communications, and licenses should be en- crypted, and documents should require authorization before being altered.
224 INFORMATION GOVERNANCE
2. The system can’t be any harder to use than working with unprotected documents. 3. It must be easy to deploy and manage , scale to enterprise proportions, and work
with a variety of common desktop applications. 43
IRM software enforces and manages document access policies and use rights (view, edit, print, copy, e-mail forward) of electronic documents and data. Controlled information can be text documents, spreadsheets, fi nancial statements, e-mail messages, policy and pro- cedure manuals, research, customer and project data, personnel fi les, medical records, intranet pages, and other sensitive information. IRM provides persistent enforcement of IG and access policies to allow an organization to control access to information that needs to be secured for privacy, competitive, or compliance reasons. Persistent content security is a necessary part of an end-to-end enterprise security architecture.
Well, it sounds like fabulous technology, but is IRM really so new? No, it has been has been around for a decade or more, and continues to mature and improve. It has es- sentially entered the mainstream around 2004/2005 (when this author began tracking its development and publishing researched articles on the topic).
IRM software currently is used for persistent fi le protection by thousands of or- ganizations throughout the world. Its success depends on the quality and consistency of the deployment, which includes detailed policy-making efforts. Diffi culties in policy maintenance and lack of real support for external sharing and mobile devices have kept fi rst- wave IRM deployments from becoming widespread, but this aspect is being addressed by a second wave of new IRM technology companies.
Other Key Characteristics of IRM
Policy Creation and Management IRM allows for the creation and enforcement of policies governing access and use of sensitive or confi dential e-documents. The organization’s IG team sets the policies for access based on role and organizational level, determining what employees can and cannot do with the secured e-documents. 44 The IG policy defi ned for a document type includes these following controls:
1. Viewing 2. Editing 3. Copy/Paste (including screen capture) 4. Printing 5. Forwarding e-mail containing secured e-documents
Access to sensitive e-documents may be revoked at any time, no matter where they are located or what media they are on, since each time a user tries to access a document, access rights are verifi ed with a server or cloud IRM application. This can be done remotely—that is, when an attempt is made to open the document, an authorization must take place. In cloud-based implementations, it is a matter of simply denying access.
Decentralized Administration One of the key challenges of e-document security traditionally is that a system administrator had access to documents and reports that were meant only for
INFORMATION GOVERNANCE AND PRIVACY AND SECURITY FUNCTIONS 225
executives and senior managers. With IRM, the e-document owner administers the security of the data, which considerably reduces the risk of a document theft, alteration, or misuse.
Auditing Auditing provides the smoking-gun evidence in the event of a true security breach. Good IRM software provides an audit trail of how all documents secured by it are used. Some go further, providing more detailed document analytics of usage.
Integration To be viable, IRM must integrate with other enterprise-wide systems, such as ECM, customer relationship management, product life cycle management, enter- prise resource planning, e-mail management, message archiving, e-discovery, and a myriad of cloud-based systems. This is a characteristic of today’s newer wave of IRM software.
This ability to integrate with enterprise-based systems does not mean that IRM has to be deployed at an enterprise level. The best approach is to target one critical depart- ment or area with a strong business need and to keep the scope of the project narrow to gain an early success before expanding the implementation into other departments.
IRM embeds protection into the data (using encryption technology), allowing fi les to pro- tect themselves. IRM may be the best available security technology for the new mobile computing world of the permeable perimeter. 45
With IRM technology, a document owner can selectively prevent others from viewing, editing, copying, or printing it. Despite its promise, most enterprises do not use IRM, and if they do, they do not use it on an enterprisewide basis. This is due to the high complexity, rigidity, and cost of legacy IRM solutions.
It is clearly more diffi cult to use documents protected with IRM—especially when policy making and maintenance is not designed by role but rather by individual. Some early implementations of IRM by fi rst-to-market software development fi rms had as many as 200,000 different policies to maintain (for 200,000 employees). These have since been replaced by newer, second-wave IRM vendors, who have reduced that num- ber to a mere 200 policies, which is much more manageable. Older IRM installations require intrusive plug-in installation; they are limited in the platforms they support, and they largely prevent the use of newer platforms, such as smartphones, iPads, and other tablets. This is a real problem in a world where almost all executives carry a smartphone and use of tablets (especially the iPad) is growing.
Moreover, due to their basic design, fi rst-wave or legacy IRM is not a good fi t for organiza- tions aiming to protect documents shared outside company boundaries. These outdated IRM solutions were designed and developed in a world where organizations were more concerned with keeping information inside the perimeter than protecting information beyond the perimeter.
IRM technology protects e-documents and data directly rather than relying on perimeter security.
226 INFORMATION GOVERNANCE
Most initial providers of IRM focused on internal sharing and are heavily depen- dent on Microsoft Active Directory (AD) and lightweight directory access protocol (LDAP) for authentication. Also, the delivery model of older IRM solutions involves the deployment and management of multiple servers, SQL databases, AD/LDAP integration, and a great deal of confi guration. This makes them expensive and cum- bersome to implement and maintain. Furthermore, these older IRM solutions do not take advantage of or operate well in a cloud computing environment.
Although encryption and legacy IRM solutions have certain benefi ts, they are extremely unwieldy and complex and offer limited benefi ts in today’s technical and business environment. Newer IRM solutions are needed to provide more complete DLS.
Embedded Protection
IRM embeds protection into the data (using encryption technology), allowing fi les to protect themselves. IRM may be the best available security technology for the new mobile com- puting world of the permeable perimeter. 46
Is Encryption Enough?
Many of the early solutions for locking down data involved encryption in one form or another:
■ E-mail encryption ■ File encryption ■ Full Disk Encryption (FDE) ■ Enterprisewide encryption
These encryption solutions can be divided into two categories: encryption in transit (e.g., e-mail encryption) and encryption t at rest (e.g., FDE).t
The various encryption solutions mitigate some risks. In the case of data in transit, these risks could include an eavesdropper attempting to discern e-mail or network traffi c. In the case of at-rest data, risks include loss of a laptop or unauthorized access to an employee’s machine. The most advanced solutions are capable of applying a policy across the organization and encrypting fi les, e-mails, and even databases. However, encryption has its caveats.
Most simple encryption techniques necessarily involve the decryption of documents so they can be viewed or edited. At these points, the fi les are essentially exposed. Malware (e.g., Trojan horses, keystroke loggers) installed on a computer may use the opportunity to send out the plain-text fi le to unauthorized parties. Alternatively, an employee may copy the contents of these fi les and remove them from the enterprise.
Device Control Methods
Another method that is related to DLP is device control . Many vendors offer software or hardware that prevents users from copying data via the USB port to
INFORMATION GOVERNANCE AND PRIVACY AND SECURITY FUNCTIONS 227
portable drives and removing them from the organization in this manner. These solutions are typically as simple as blocking the ports; however, some DLP so- lutions, when installed on the client side, can selectively prevent the copying of certain documents. 47
Thin Clients
One last method worth mentioning is the use of thin clients to prevent data leaks. These provide a so-called walled garden containing only the applications users require to do their work, via a diskless terminal. This prevents users from copying any data onto portable media; however, if they have e-mail or Web access applications, they still can send information out via e-mail, blogs, or social networks.
Note about Database Security
Database security and monitoring is addressed in Chapter 10 , “IG for IT.”
Compliance Aspect
Compliance has been key in driving companies to invest in improving their security measures, such as fi rewalls, antivirus software, and DLP systems. More than 400 regulations exist worldwide mandating a plethora of information and data secu- rity requirements. One example is the Payment Card Industry Data Security Stan- dard (PCI-DSS), which is one of the strictest regulations for credit card processors. Companies that fail to comply with these regulations are subject to penalties of up to $500,000 per month for lost fi nancial data or credit card information. It is estimated that the per-record cost of a breach is $90 to $305.” 48 But do compliance activities always result in adequate protection of your sensitive data? In many cases the answer is no. It is important to keep in mind that being formally compliant does not mean the organization is actually secure. In fact, compliance is sometimes used as a fi g leaf, covering a lack of real document security. One needs to look no further than to the recent series of major document leakage incidents to understand this. Those all came from highly secure and regulated entities, such as banks, hospitals, and the military.
Hybrid Approach: Combining DLP and IRM Technologies
An idea being promoted recently is to make IRM an enforcement mechanism for platforms like DLP. Together, DLP and IRM accomplish what they independently cannot. Enterprises may be able to use their DLP tools to discover data fl ows, map them out, and detect transmissions of sensitive information. They can then apply their IRM or encryption protection to enforce their confi dentiality and information integrity goals. 49
Several vendors in the fi elds of DLP, encryption, and IRM have already announced in- tegrated products . However, at this point in time, most IRM solutions are by no meanss ready for prime time when it comes to this use. Only a select few second-wave IRM
228 INFORMATION GOVERNANCE
software providers can offer comprehensive, streamlined, persistent security across many platforms.
As the enterprise perimeter dissolves, document and data security should become the focus of the Internet security fi eld. However, most legacy solutions, such as encryp- tion and legacy IRM, are complex and expensive and provide only a partial solution to the key problems. Combining several methods offers effective countermeasures, but an ultimate solution has not yet arrived.
Securing Trade Secrets after Layoffs and Terminations
In today’s global economy—which has shifted labor demands—huge layoffs are not uncommon in the corporate and public sectors. The act of terminating an employee creates document security and IP challenges while raising the question: How does the organization retrieve and retain its IP and confi dential data? An IG program to secure information assets must also deal with everyday resignations of employees who are in possession of sensitive documents and information. 50
According to Peter Abatan, author of the Enterprise Digital Rights Management blog, “As a general rule all organizations should classify all their documents with the aim of identifying the ones that need persistent protection” (emphasis added). That is to say, docu-” ments should be protected at all times, regardless of where they travel and who is using them, while the organization still retains control of usage rights. There are two basic technological approaches to this protection:
1. The fi rst, as discussed earlier in this chapter, is combining IRM with DLP ; P DLP is used to conduct deep content inspection and identify all documents that may contain sensitive information, then the DLP agent “notifi es the en- terprise [information] rights management engine that sensitive information is about to be copied to external media or outside the fi rewall and therefore needs to be encrypted.”
2. The second is using a form of context-sensitive IRM “in which all documents M that contain sensitive data defi ned in the [global] data dictionary [are] auto- matically encrypted.”
These two technological approaches must be fostered by an IG program. They can have signifi cant positive impact in protecting sensitive information, no matter where it is located, and can help document owners withdraw access to its sensitive documents at any time.
Organizations must educate their employees to increase awareness of the fi nancial and competitive impact of breaches and to clarify that sensitive documents are the property of the organization. If those handling sensitive documents are informed of the benefi ts of IRM and related technologies, they will be more vigilant in their efforts to keep information assets secure.
Persistently Protecting Blueprints and CAD Documents
Certain IRM software providers have focused on securing large-format engineer- ing and design documents, and they have made great strides in the protection of
INFORMATION GOVERNANCE AND PRIVACY AND SECURITY FUNCTIONS 229
computer-aided design fi les. As much as 95 percent of CAD fi les are proprietary designs and represent valuable, proprietary IP of businesses worldwide. And CAD fi les are just as vulnerable as any other e-document in that, when unprotected, they “can be emailed or transferred to another party without the knowledge of the owner of the content.”51
In today’s global economy, it is common to conduct manufacturing operations in markets where labor is inexpensive and regulations are lax. Many designs are sent to China, Indonesia, and India for manufacturing. Although they usually are accompa- nied by binding confi dential disclosure contracts, but these agreements are often dif- fi cult to enforce, especially given the disparity in cultures and laws. And what happens if a rogue employee in possession of designs and trade secrets absconds with them and sells them to a competitor? Or starts a competing business? There are a number of examples of this happening.
Owners of valuable proprietary IP must vigilantly protect it; the very survival of the business may depend on it. Monitoring and securing IP wherever it might travel is now a business imperative.
Theft of IP and confi dential information represents a clear and present danger to all types of businesses, especially global brands dependent on proprietary designs for a competitive advantage. Immediate IG action by executive management is required to identify possible leaks and plug the holes. Not safeguarding IP and confi dential or sensitive documents puts the organization’s competitive position, strategic plans, rev- enue stream, and very future at risk.
Securing Internal Price Lists
In 2010, it was reported that confi dential information about the advertising expen- ditures of some of Google’s major accounts was leaked to the public. 52 This may not seem like a signifi cant breach, but, in fact, with this information, Google’s custom- ers can determine if they are getting a preferred price schedule, and competitors can easily undercut Google’s pricing for major customers. According to Peter Abatan, “[It is clear] why this information is so critical to Google that this information is tight- ly secured.”
Is your company’s price list secured at all times? Price lists are confi dential infor- mation assets, and if they are revealed publicly, major customers could demand steeper discounts and business relationships could suffer irreparable damage, especially if cus- tomers fi nd out they are paying more for a product or service than their competitors.
A company’s price list is critical to an organization because it impacts all aspects of the business, from the ability to generate revenue to private dealings with customers and suppliers. IRM should be used to protect price lists, and printing of these valuable
As much as 95 percent of CAD fi les are proprietary designs and represent valuable IP.
230 INFORMATION GOVERNANCE
lists must be monitored and controlled using secure printing methods and document analytics.
Confi dential information should be persistently protected throughout their docu- ment life cycle in all three states (at rest, in motion, and in use) so that if they are com- promised or stolen, they are still protected and controlled by the owning organization.
Approaches for Securing Data Once It Leaves the Organization
It is obvious with today’s trends that, as Andrew Jaquith of SilverSky (formerly with Forrester Research) states, “The enterprise security perimeter is quickly dissolving.” A lot of valuable information is routed outside the owning organization through unse- cured e-mail. A breach can compromise competitive position, especially in cases deal- ing with personnel fi les and marketing plans or merger details. Consider for a moment that even proprietary software and company fi nancial statements are sent out. Expo- sure of this data can have real fi nancial impact. Without additional protections, such as IRM and e-mail encryption, these valuable information assets are often out of the control of the IT department of the owning organization. 53
Third-party possession or control of enterprise data is a critical point of vulner- ability, and many organizations realize that securing data outside the organizational perimeter is a high priority. But a new concept has cropped up of late that bucks un- conventional wisdom: “ Control does not require ownership.”
Instead of focusing on securing devices where confi dential data is accessed, the new thinking focuses on securing the data and documents directly. With this new mind-set, security can be planned under the assumption that the enterprise owns its data but none of the devices that access it. As Forrester’s report states, “Don’t trust the endpoints. Treat them as hostile”. This is referred to as the zero-trust model of infor- mation security. The report states: “...trust but verify applies here. Enterprises must put teeth into their contractual language and audit their partners.” 54
Forrester has developed a new network architecture that builds security into the DNA of a network, using a mixture of fi ve data security design patterns:
1. Thin client. Access information online only, with no local operations, using a diskless terminal that cannot store data, documents, or programs so confi den- tial information stays stored and secured centrally. For additional security, “IT can restrict host copy-and-paste operations, limit data transfers, and require strong or two-factor authentication using SecurID or other tokens.”
2. Thin device. Devices such as smartphones, which have limited computing resources, Web surfi ng, e-mail, and basic Web apps that locally conduct no real information processing, are categorized as thin devices. In practice, these devices do not hold original documents but merely copies, so the offi cial busi- ness record or master copy cannot be altered or deleted. A nice feature of many smartphones is the ability to erase or wipe data remotely, in the event the device is lost. According to the Forrester report, “For insurance, thin de- vices can be remotely wiped—making them truly ‘disposable,’ unlike PCs.” 55
3. Protected process. This approach allows local processing with a PC where confi - dential e-documents and data are stored and processed in a partition that is highly secure and controlled. This processing can occur even if the PC is not
INFORMATION GOVERNANCE AND PRIVACY AND SECURITY FUNCTIONS 231
owned and controlled by the organization. “The protected process pattern has many advantages: local execution, offl ine operation, central manage- ment, and a high degree of granular security control, including remote wipe [erase].” A mitigating factor to consider here is most business PCs today are Windows based, and the world is rapidly moving to other, more nimble platforms.
4. Protected data. Deploying IRM and embedding security into the documents (or data) provides complete DLS. The newer wave of more sophisticated, easier-to-use IRM vendors have role-based policy implementation and such features as “contextual” enforcement, where document rights are dependent on the context —that is, tt where and when a user attempts access. For instance, allow access to documents on workers’ desktops but not on their laptops; or provide access to printing confi dential documents at the facility during offi ce hours but not after. “ Of all the patterns in the Zero Trust data security strategy, protected data is the most fi ne-grained and effective because it focuses on the informa- tion, not its containers.”
5. Eye in the sky. This design pattern uses technologies such as DLP to scan network traffi c content and halt confi dential documents or sensitive data at the perimeter. Deployed properly, DLP is “ideal for understanding the veloc- ity and direction of information fl ow and for detecting potential breaches, outliers, or anomalous transmissions.” It should be noted that DLP does not provide complete protection. To do so would mean that many legitimate and sanctioned e-mails and documents would be held up for inspection, thus slow- ing the business process. As stated earlier, DLP is best for discovering infor- mation fl ows and monitoring network traffi c. Another negative is that you cannot always require partner organizations and suppliers to install DLP on their computers. So this is a complementary technology, not a complete solu- tion to securing confi dential information assets.
By discarding the “age-old confl ation of ownership and control, enterprises will be able to build data protection programs that encompass all possible ownership sce- narios, including Tech Populism, offshoring, and outsourcing.”
Document Labeling
Document labeling is “an easy way to g increase user awareness about the sensitivity of information in a document”(emphasis added).56 What is it? It is the process of attach- ing a label to classify a document. For instance, who would not know that a document labeled “confi dential” is indeed confi dential? If the label appears prominently at the top of a document, it is diffi cult for persons accessing it to claim they did not know it was sensitive.
The challenge is to standardize and formalize the process of s getting the label onto the document— tt enterprisewide. This issue would be addressed in an IG effort focused on se- curing confi dential e-documents, or may also be a part of a classifi cation and taxonomy design effort. It cannot simply be left up to users to type in labels themselves, or it will not be suffi ciently executed and will end up leaving a mishmash of labeled documents without any formal classifi cation.
232 INFORMATION GOVERNANCE
Another great challenge are legacy or archived documents, which are the lion’s share of an organization’s information assets. How do you go back and label those? One by one? Nope. Not practical.
Some content repositories or portals, such as Microsoft SharePoint®, provide some functionality toward addressing the document labeling challenge. SharePoint is the most popular platform for sharing documents today.
SharePoint has an information management policy tool called Labels, which can be used to add document labels, such as Confi dential , to the top of documents:l
There are several options available for administrators to customize the labels, including the ability to:
1. Prompt users to add the label when they save or print, rather than relying on the user to click the Label button in the ribbon;
2. Specify labels containing static text and/or variables such as Project Name; 3. Control the appearance of the labels, such as font, size, and justifi cation. 57
The labels are easily added from within Microsoft Offi ce Word, PowerPoint, and Excel. One method that can be used is for the user to click the Label button on the Insert ribbon group; another method is to add the label through a prompt that appears when a user saves or prints a document (if the administrator has confi gured this option).
The labeling capabilities in document and content management systems such as Microsoft’s SharePoint are a good start for increasing user awareness and improving the handling of sensitive documents. However, the document labeling capabilities of Share- Point are basic and limited . These basic capabilities may provide a partial or temporary d solution, although organizations aiming for a high level of security and confi dentiality for their documents will need to search for supplemental technologies from third- party software providers. For instance, fi nding the capabilities to label documents in bulk rather than one by one, add watermarks, or force users to save or print documents with a standard document label that cannot be altered may require looking at alterna- tives. Some are software vendors have enhanced the SharePoint document labeling capability and may provide the complete solution.
Document Analytics
Some software providers also provide document analytics capabilities that monitor the access, use, and printing of documents and create real-time graphical reports of docu- ment use activities. These capabilities are very valuable.
Document analytics allows a compliance offi cer or system administrator to view exactly how many documents a user accesses in a day and how many documents the user accesses on average. Using this information, analytics monitors can look for spikes or anomalies in use. It is also possible to establish baselines and compare usage with that of an employee’s peers, as well as with his or her past document usage. If, for instance, a user normally accesses an average of 25 documents a day and that sud- denly spikes to 200, the system sends an alert, and perhaps it is time to pay a visit to that person’s offi ce. Or, if an employee normally prints 50 pages per day, then one day prints 250 pages, a fl ag is raised. Document analytics capabilities can go so far as to
INFORMATION GOVERNANCE AND PRIVACY AND SECURITY FUNCTIONS 233
calculate the average time a user spends reading a document; signifi cant time fl uctua- tions can be fl agged as potentially suspicious activity.
Confi dential Stream Messaging
E-mail is dangerous. It contains much of an organization’s confi dential information, and 99 percent of the time it is sent out unsecured. It has been estimated that as many as 20 percent of e-mail messages transmitted pose a legal, fi nancial, or regulatory threat to the organization. Specifi cally, “34 of employers investigated a leak of confi dential busi- ness information via email, and an additional 26% of organizations suffered the expo- sure of embarrassing or sensitive information during the course of a year,” according to Nancy Flynn, Executive Director of the ePolicy Institute. These numbers are rising, giv- ing managers and business owners cause to look for confi dential messaging solutions. 58
Since stream messaging separates the header and identifying information from the message, sends them separately, and leaves no record or trace, it is a good option for executives and managers, particularly when engaged in sensitive negotiations, litigation, or other highly confi dential activities. Whereas e-mail leaves behind an indelible fi n- gerprint that lives forever on multiple servers and systems, stream messaging does not.
Business records, IP and trade secrets, and confi dential executive communications can be protected by implementing stream messaging. It can be implemented alongside and in concert with a regular e-mail system, but clear rules on the use of stream mes- saging must be established, and access to it must be tightly restricted to a small circle of key executives and managers.
The ePolicy Institute offers seven steps to controlling stream messaging:
1. Work with your legal counsel to defi ne “business record” for your organization on a companywide basis. Establish written records retention policies, dispo- sition and destruction schedules. And litigation hold rules. Support the email retention policy with a bona fi de email archiving solution to facilitate the in- dexing, preservation and production of legally authentic records. Implement a formal electronic records management system to manage all records.
2. Work with your legal counsel to determine when, how, why, and with whom confi dential stream messaging is the most appropriate, effective— and legally compliant—way to hold recordless, confi dential business dis- cussions when permanent records are not required.
3. In order to preserve attorney-client privilege, a phone call or confi dential electronic messaging may be preferable to email. Have corporate counsel spell out the manner in which executives and employees should communi- cate with lawyers when discussing business, seeking legal advice, or asking questions related to specifi c litigation.
4. Defi ne key terms for employees. Don’t assume employees understand what management means when using terms like “confi dential,” “proprietary,” or “private” or “intellectual property,” etc. Employees must clearly understand defi nitions If they are to comply with confi dentiality rules.
5. Implement written rules and policies governing the use of email and con- fi dential stream messaging. E-policies should be written clearly and should
234 INFORMATION GOVERNANCE
be easy for employees to access, and understand. Make them [as] “short and sweet” as possible. Do not leave anything up to interpretation.
6. Distribute a hard copy of the new confi dential messaging policy, email pol- icy and other electronic communications (e.g., social media, blogs). Insist that each and every employee signs and dates the policy, acknowledging that they understand and accept it and that disciplinary action including termi- nation may result from violation of the organization’s established policies.
7. Educate, educate, educate. Ensure that all employees who need to know the difference between email which leaves a potential business record and stream messaging which does not, and is confi dential. 59
Securing personal, classifi ed, or confi dential information effectively requires an eclectic, multifaceted approach. It takes clear and enforced IG policies, a collection of technologies, and regular testing and audits, both internally and by a trusted third party.
CHAPTER SUMMARY: KEY POINTS
■ The average cost of a data breach in 2013 was over $5 million.
■ Attacks on organizations’ networks and theft of their IP continue to increase. There were an estimated 354 million privacy breaches between 2005 and 2010 in the United States alone.
■ Attacks can continue in organizations for years before they are uncovered—if they are discovered at all.
■ All organizations should classify all their documents with the aim of identify- ing the ones that need persistent security protection.
■ Today’s ECM and document management solutions rely mostly on perimeter security and were not designed to allow for secure document sharing and collaboration.
■ Businesses are operating in a more distributed model than ever before, and they are increasingly sharing and collaborating—exposing confi dential documents.
■ Secure document printing reduces the chance that fi les can be compro- mised during or after printing. There are various methods to secure the print stream, depending on the print manufacturer. Copies or remnants of large print fi les often exist unsecured on the hard drives of high-speed printers. These fi les must be completely wiped to ensure security.
■ Identity and access management (IAM) software governs user access to in- formation through an automated, continuous process that addresses access creep, whereby employees move to a different business unit and their access rights are not updated.
INFORMATION GOVERNANCE AND PRIVACY AND SECURITY FUNCTIONS 235
■ Data governance software is another tool that looks at who is accessing which documents and creates a matrix of roles and access along behavioral lines.
■ Encrypting sensitive e-mail messages is an effective step to securing con- fi dential information assets while in transit. Encryption can be applied to desktop folders and fi les.
■ For e-mail communication with no trace or record, stream messaging is a solution.
■ Digital signatures authenticate the identity of the signatory and prove that the signature was, in fact, generated by the claimed signatory. This is known as nonrepudiation.
■ Data loss prevention technology performs a “deep content inspection” of all e-documents and e-mails before they leave the organization’s perimeter to stop sensitive data from exiting the fi rewall.
■ DLP can be used to discover the fl ow of information within an organization. Additional security tools can then be applied. This may be the best use for DLP.
■ Information rights management software enforces and manages use rights of electronic documents. IRM provides a sort of security wrapper around docu- ments and protects sensitive information assets from unauthorized use or copying. IRM is also known as enterprise rights management.
■ Persistent security tools like IRM should be enforced on price lists, proprietary blueprints, and CAD designs. Printing these documents should be highly restricted.
■ Most legacy or fi rst-to-market providers of IRM focused on internal sharing and are heavily dependent on Microsoft Active Directory and lightweight di- rectory access protocol (LDAP) for authentication. These early solutions were not built for cloud use or the distributed enterprises of today, where mobile devices are proliferating.
■ DLP started in the form of network gateways (much like fi rewalls) that searched e-mails, Web traffi c, and other forms of information for data that was defi ned as internal. When it detected such data, it blocked it from leav- ing the perimeter or monitored its use.
■ Soon agent-based DLP technologies were introduced, performing the same action locally on users’ computers. The next step brought a consolidation of many agent- and network-based technologies to offer a more comprehen- sive solution.
CHAPTER SUMMARY: KEY POINTS (Continued )
(( dcontinued ) )dd
236 INFORMATION GOVERNANCE
Notes
1. Ponemon Institute Research Report, “2013 Cost of Data Breach Study: United States,” May 2013, www .symantec.com/content/en/us/about/media/pdfs/b-cost-of-a-data-breach-us-report-2013.en-us.pdf
2. Jim Finkle, “‘State Actor’ behind Slew of Cyber Attacks,” Reuters, August 3, 2011, www.reuters.com/ article/2011/08/03/us-cyberattacks-idUSTRE7720HU20110803 (accessed August 18, 2011).
3. Ibid. 4. Ibid. 5. Ibid. 6. Peter Abatan, “Persistently Protecting Your Computer Aided Designs,” Enterprise Digital Rights Man-
agement, http://enterprisedrm.tumblr.com/post/1423979379/persistently-protecting-your-computer- aided-designs (accessed August 18, 2011).
7. Ari Ruppin, March 20, 2011 via e-mail. 8. Sam Narisi, “IT’s role in secure staff cuts,” March 2, 2009. www.fi nancetechnews.com/its-role-in-
secure-staff-cuts/ 9. Ibid. 10. Shira Scheindlin and Daniel Capra, The Sedona Conference, Electronic Discovery and Digital Evidence ,
Thomson Reuters, 2009, p. 204, www.amazon.com/Scheindlin-Conferences-Electronic-Discovery-Evidence- ebook/dp/B00AUE0LRI
11. Oracle White Paper, “Oracle Information Rights Management 11g—Managing Information Every- where It Is Stored and Used,” March 2010 p. 4, www.oracle.com/technetwork/middleware/webcenter/ content/irm-technical-whitepaper-134345.pdf (accessed December 23, 2011).
12. Ibid. 13. Open Web Application Security Project, “Defense in Depth,” https://www.owasp.org/index.php/
Defense_in_depth (accessed June 24, 2013). 14. HCL, “Identity and Access Management Services,” www.hclisd.com/identity-and-access-management
.aspx (accessed September 2, 2011). 15. Ibid. 16. Ibid. 17. Nicola Clark and David Jolly, “Fraud Costs Bank 7.1 Billion,” New York Times , January 25, 2008, wwws
.nytimes.com/2008/01/25/business/worldbusiness/25bank-web.html?hp (accessed September 2, 2011).
■ Combining IRM and DLP technologies is the best available approach to securing e-documents and data. Other encryption methods should also be utilized, such as e-mail encryption and FDE).
■ The use of thin-client and thin-device architecture can reduce security threats to confi dential information assets.
■ Document analytics monitor the access, use, and printing of documents and create real-time graphical reports of document use activities.
■ Document labeling is an easy way to increase user awareness about the sen- sitivity of information in a document.
■ Stream messaging is a way to conduct sensitive business negotiations and activities without leaving a business record. Legal counsel must be consulted, and clear policies for regular e-mail versus stream messaging must be estab- lished and enforced.
CHAPTER SUMMARY: KEY POINTS (Continued )
INFORMATION GOVERNANCE AND PRIVACY AND SECURITY FUNCTIONS 237
18. Oracle White Paper, “Oracle Information Rights Management 11g.” 19. Robert Smallwood, “E-DRM Plugs ECM Security Gap,” KM World, April 1, 2008, www.kmworld.com/
Articles/News/News-Analysis/E-DRM-plugs-ECM-security-gap-41333.aspx (accessed March 30, 2012). 20. Adi Ruppin, March 20, 2011, via e-mail to author. 21. Annik Stahl, “Secure Printing: No More Mad Dashes to the Copy Room,” http://offi ce.microsoft.com/
en-us/help/secure-printing-no-more-mad-dashes-to-the-copy-room-HA001227631.aspx (accessed August 22, 2011).
22. Telephone interview of William Broddy by author, August 7, 2011. 23. Bill Blake, “WikiLeaks, the Pearl Harbor of the 21st Century,” eDocument Sciences LLC, December 6,
2010, http://edocumentsciences.com/wikileaks-the-pearl-harbor-of-the-21st-century. 24. VaporStream, www.vaporstream.com (accessed December 9, 2013). 25. Ibid. 26. Ibid. 27. NIST, “Federal Information Processing Standards Publication,” FIPS PUB 186-3, issued June 2009, http://
csrc.nist.gov/publications/fi ps/fi ps186-3/fi ps_186-3.pdf (accessed August 15, 2011). FIPS Publication 186-3 (dated June 2009), was superseded on July 19, 2013 and is provided here only for historical purposes. For the most current revision of this publication, see: http://csrc.nist.gov/publications/PubsFIPS.html
28. Doug Miles, AIIM White Paper, “Digital Signatures – Making the Business Case,” http://www.arx .com/fi les/DOCUMENTS/Digital-Signatures-for-Document-Workfl ow-and-SharePoint-Survey.pdf (accessed December 9, 2013).
29. Computer Desktop Encyclopedia, www.computerlanguage.com, retrieved March 30, 2012. 30. Doug Miles, AIIM White Paper, “Digital Signatures – Making the Business Case.” 31. Ibid. 32. Ibid. 33. Ibid. 34. Ari Ruppin, March 20, 2011, via e-mail. 35. Fred Donovan, “Gartner: Enterprise Content-Aware Data Loss Prevention Market to Reach $670 Million
This Year,” February 7, 2013, www.fi erceenterprisecommunications.com/story/gartner-enterprise-content- aware-data-loss-prevention-market-reach-670-mill/2013-02-07
36. Data Loss Prevention Experts, “DLP Product Guide for RSA Conference Expo 2011,” January 17, 2011, www.dlpexperts.com/dlpxblog/2011/1/17/dlp-product-guide-for-rsa-conference-expo-2011 .html (accessed August 22, 2011).
37. Ibid. 38. Ibid. 39. Ibid. 40. Peter Abatan, “Who Should Be Blamed for a Data Breach?” Enterprise Digital Rights Management,
http://enterprisedrm.tumblr.com/post/1087100940/who-should-be-blamed-for-a-data-breach (accessed December 9, 2013).
41. Peter Abatan, “Understanding Enterprise Rights Management,” Enterprise Digital Rights Manage- ment, www.enterprisedrm.info/page/2 (accessed August 3, 2011).
42. Robert Smallwood, “Securing Documents in the WikiLeaks Era,” May 28, 2011, www.kmworld.com/ Articles/Editorial/Feature/Securing-documents-in-the-WikiLeaks-era-75642.aspx (accessed August 1, 2011).
43. Oracle, IRM Technical White Paper , Oracle.com, February 2008 (accessed December 9, 2013). r 44. Abatan, “Understanding Enterprise Rights Management,” http://enterprisedrm.tumblr.com/page/3
(accessed December 9, 2013). 45. Ibid. 46. Ibid. 47. Ibid. 48. “http://www.bankersonline.com/bankrobbery/2007/04/if-you-remember-old-tv-commercials-for
.html?” 49. Abatan, “Understanding Enterprise Rights Management,” http://enterprisedrm.tumblr.com/page/3
(accessed December 9, 2013). 50. This discussion and quotes are from Peter Abatan, “Preparing for Staff Layoffs/Resignations where
Confi dential Information Is Concerned,” Enterprise Digital Rights Management, http://enterprisedrm .tumblr.com /post/1230356519/preparing-for-staff-layoffs-resignations (accessed December 9, 2013).
51. Ibid. 52. This discussion and quotes are from Peter Abatan, “Is Your Price List under Lock and Key?” Enter-
prise Digital Rights Management, http://enterprisedrm.tumblr.com/post/1120104758/is-your-price- list-under-lock-and-key (accessed August 18, 2011).
238 INFORMATION GOVERNANCE
53. This discussion and quotes are from “Own Nothing. Control Everything”, Forrester Research, Inc., January 22, 2010.
54. “Own Nothing. Control Everything”, Forrester Research, Inc., January 22, 2010. 55. “Own Nothing. Control Everything”, Forrester Research, Inc., January 22, 2010. 56. This discussion and quotes are from Charlie Pulfer, “Document Labeling in SharePoint,” September 13,
2009, www.contentmanagementconnection.com/Home/21196/ (accessed January 28, 2014. 57. Ibid. 58. Nancy Flynn, The E-Policy Handbook: Rules and Best Practices to Safely Manage Your Company’s E-Mail, Blogs,
Social Networking, and Other Electronic Communication Tools , 2nd ed. (New York: AMACOM, 2009), p. 57. s 59. Ibid., pp. 68–70.
PA RT F O U R Information Governance for Delivery Platforms
241
E -mail is a major area of focus for information governance (IG) efforts: It is the most common business software application and the backbone of business com- munications today, and e-mail is the leading piece of evidence requested during
the discovery phase of civil trials, so it is critically important to implement IG mea- sures for e-mail communications.
Employees utilize e-mail all day, including during their personal time, some- times mixing business and personal use of e-mail. Social media use has skyrocketed in recent years and actually has surpassed e-mail for personal use, but the fact remains that in business, knowledge workers rely on e-mail for almost all communications, including those of a sensitive nature. A 2013 survey of 2,400 corporate e-mail users worldwide found that nearly two-thirds stated that e-mail was their favorite form of business communication, surpassing not only social media but also telephone and in-person contact.1
These e-mail communications may contain discoverable information in litigation, and a percentage of them will be declared formal business records. E-mail often contains records, such as fi nancial spreadsheets and reports, product price lists, marketing plans, com- petitive analyses, safety data, recruitment and salary details, progressing contract ne- gotiations, and other information that may be considered as constituting a business record.
E-mail systems can be hacked, monitored, and compromised and cause far-reaching damage to a victimized organization. The damage may occur slowly and go undetected while information assets—and business value—are eroded.
In mid-2011, the “hacktivist” group AntiSec claimed responsibility for hacking a U.S. government contractor, Booz Allen Hamilton, and publicly exposing 90,000 military e-mail addresses and passwords from the contractor by posting them online. It was the second attack on a government defense contractor in a single week. 2
Booz Allen employees “maintain high government security clearances” while working with the defense sector (yet in 2013 another Booz Allen employee, Edward Snowden, gained access to secret communications monitoring programs that the U.S.
Information Governance for E-Mail and Instant Messaging*
C H A P T E R 12
* Portions of this chapter are adapted from Chapter 11 , Robert F. Smallwood, Managing Electronic Records: Methods, Best Practices, and Technologies , © John Wiley & Sons, Inc., 2013. Reproduced with permission of John Wiley & Sons, Inc.s
242 INFORMATION GOVERNANCE
National Security Agency operated to capture metadata and other information from the private e-mail and telephone conversations of American citizens on a broad scale). AntiSec penetrated the communications systems with relative ease and noted there were “basically had no security measures in place.” 3 AntiSec was able to go even fur- ther, by running its own rogue application to steal software source code and to search and fi nd access credentials to steal data from other servers, which the group said would help it to infi ltrate other federal contractors and agencies. It even stated it might pass the security information on to other hackers.
The attack did not stop there. Later that week, another federal defense and FBI contractor, IRC Federal, was hacked, databases were invaded, the Web site was modi- fi ed, and information from internal e-mail messages was posted online. 4
Employees Regularly Expose Organizations to E-Mail Risk
A 2011 global e-mail survey, commissioned by a leading hosted e-mail services pro- vider, found that nearly 80 percent of all employees send work e-mail to and from their personal accounts, and 20 percent do so regularly, which means that critical informa- tion assets are exposed to uncontrolled security risks. 5
“Awareness of the security risks this behavior poses does not act as a deterrent” (emphasis” added). Over 70 percent of people questioned recognize that there is an additional risk in sending work documents outside the corporate e-mail environment, but almost half of “these same respondents feel it is acceptable to send work emails and documents to personal email accounts anyway.” According to the survey, the reasons for using personal e-mail accounts for work purposes range from working on documents remotely (71 percent), to sending fi les that are too big for the company mailbox (21 percent), to taking documents with them when they leave a company (18 percent), to simply not wanting to carry a laptop home (9 percent). The top two frustrations users had with work e-mail were restrictions on mailbox size, which has a negative impact on e-mail management, and the inability to send large attachments. This second issue often forces workers to use a personal account to send and receive necessary fi les. If size limits are imposed on mailboxes and attachments, companies must provide a secure alternative for fi le storage and transfer. Otherwise, employees are pushed into risking corporate information assets via personal e-mail. This scenario not only complicates things for e-mail administrators but has serious legal and regulatory implications. Clearly, as stated by Paul Mah in his “Email Admin” blog, “email retention and archival becomes an impossible task when emails are routed in a haphazard manner via personal accounts.”6
This means that security, privacy, and records management issues must be ad- dressed by fi rst creating IG policies to control and manage the use of e-mail. These policies can utilize the e-mail system’s included security features and also employ ad- ditional monitoring and security technologies where needed.
The e-mail survey also found an overall lack of clear e-mail policies and weak communication of existing guidelines. This means a lack of IG. Nearly half of the respondents stated either that their company had no e-mail policy or that they were unaware of one. Among those aware of a corporate e-mail policy, 4 in 10 think it could be communicated better. Among companies that have a policy, most (88 percent) deal with the appropriate use of e-mail as a business tool, but less than one-third (30 percent) address e-mail retention from a security standpoint.
INFORMATION GOVERNANCE FOR E-MAIL AND INSTANT MESSAGING 243
Generally, employees are aware that sending work documents outside of their corporate network is unsafe, yet they continue to do so. It is abundantly clear that e-mail policies have to be updated and upgraded to accommodate and manage the increasingly sophisticated and computer-savvy generation of users who are able to fi nd ways to work around corporate e-mail restrictions. (These users have been dubbed Generation Gmail. ) In addition, new e-mail monitoring and security technologies need to be deployed to counter this risky practice, which exposes information assets to prying eyes or malicious attacks.
E-Mail Polices Should Be Realistic and Technology Agnostic
E-mail policies as part of your IG program must not be too restrictive. It may be tempting to include catchall policies that attempt to tamp down user behavior, but such efforts cannot succeed. 7 An important step is consulting with stakeholders to understand their usage patterns and needs and then going through a series of drafts of the policy, allowing for input. It may be determined that some exceptions and changes in technologies need to be factored in and that some additional technology is needed to accommodate users while keeping information assets safer and meeting compliance and legal demands. Specifi cs of these policies and tools should be progressively tight- ened on a regular basis as the process moves forward.
These new IG guidelines and policies need to refer to technology in a generic sense—a “technology-neutral” sense—rather than specifying proprietary software programs or features. 8 That is to say, they should be written so that they are not in t need of revision as soon as new technologies are deployed.
Developing organization-wide IG policies is time consuming and expensive; they are a defensive measure that does not produce revenue, so managers, pressed for performance, often relegate policy making to the low-priority list. Certainly, it is a tedious, diffi cult task, so organizations should aim to develop policies that are fl exible enough to stand the test of time. But it is also necessary to establish a review process to periodically revise policies to accommodate changes in the business environment, the law, and technology.
Here is an example of a technology-agnostic policy directive:
All confi dential information must be encrypted before being transmitted over the Internet.
This statement does not specify the technology to be used, or the mode of trans- mission. The policy is neutral enough to cover not only e-mail and instant messaging (IM) but also social media, cloud computing, mobile computing, and other means of communication. The policy also does not specify the method or brand of the encryp- tion technology, so the organization can select the best method and technology avail- able in the future without adapting the policy.9
E-Record Retention: Fundamentally a Legal Issue
Considering the massive volume of e-mail exchanged in business today, most e-mail messages do not rise to the level of being formal business records. But many of them do and are subject to IG, regulatory compliance, and legal requirements for maintain- ing and producing business records.
244 INFORMATION GOVERNANCE
Although often lumped in with other information technology (IT) concerns, the retention of e-mail and other e-records is ultimately a legal issue. Other departments, including records management and business units, should certainly have input and should work to assist the legal team to record retention challenges and archiving solutions. But e-mail and e-record retention is “fundamentally a legal issue,”l particularly for public or highly regulated companies. According to Nancy Flynn of the ePolicy Institute, “It is essential for the organization’s legal department to take the lead in determining precisely which types of email messages will be preserved, exactly how and where data will be stored, and specifi cally when —if ever—electronically stored information [ESI] will be deleted” 10 (emphasis added).
Since they are often shot out in the heat of battle, many times e-mail messages are evidence of a smoking gun in lawsuits and investigations. In fact, they are the most requested type of evidence in civil litigation today. The content and timing of e-mail messages can provide exonerating information too.
In January 2010, a U.S. House of Representatives committee probing bailout deals subpoenaed the Federal Reserve Bank of New York for e-mail and other correspon- dence from Treasury Secretary Timothy Geithner (former president of the New York Federal Reserve Bank) and other offi cials. The House Oversight and Government Reform Committee was in the process of examining New York Fed decisions that fun- neled billions of dollars to big banks, including Goldman Sachs Group and Morgan Stanley.11
This is just one example of how crucial e-mail messages can be in legal investiga- tions and how they play an important role in reconstructing events and motives for legal purposes.
Preserve E-Mail Integrity and Admissibility with Automatic Archiving
Most users are not aware that e-mail contents and characteristics can be changed— “and rendered legally invalid”—by anyone with malicious motives, including those who are essentially “covering their tracks.” Not only can the content be edited, but metadata that includes such information as the time, date, and total number of charac- ters in the message can also be changed retroactively. 12
To offset this risk and ensure that spoliation (i.e., the loss of proven authenticity of an e-mail) does not occur, all messages, both inbound and outbound, should be captured and archived automatically and in real time. This preserves legal validity and forensic compliance. Additionally, e-mail should be indexed to facilitate the searching process, and all messages should be secured in a single location. With these measures, e-mail records can be assured to be authentic and reliable.
Managing e-records is primarily a legal issue, especially for public and heavily regulated companies.
INFORMATION GOVERNANCE FOR E-MAIL AND INSTANT MESSAGING 245
E-Mail Archiving Rationale: Compliance, Legal, and Business Reasons
There are good reasons to archive e-mail and retain it according to a specifi c retention schedule that follows your organization’s IG policies. Having a handle on managing voluminous e-mail archives translates to being able to effectively and rapidly search and retrieve exactly the right messages, which can provide a signifi cant legal advantage. It gives your legal team more and better information and more time to fi gure out how to leverage it in legal strategy sessions. This means the odds are tipped in your organization’s favor in the inevitable litigation arena. Your legal opponent may be driven to settle a weak claim when confronted with indisputable e-mail evidence, and, in fact, “email often produces supportive evidence that may help ‘save the day’ by providing valuable legal proof” of innocence.13 This evidence may stop frivolous lawsuits in their tracks. Further, reliable e-mail evidence also can curtail lengthy and expensive lawsuits, and prevail. And if your company is public, Sarbanes–Oxley regulations require the archiving of e-mail.
Don’t Confuse E-Mail Archiving with Backup
All backups are not created equal. There is a big difference between traditional system back- ups and specialized e-mail archiving software.
Backups are huge dumps to mass storage, where the data is stored sequentially and not compressed or indexed. 14 It is impossible to search backups except by date, and even doing that would mean combing through troves of raw, non-indexed data.
The chief executive may not be aware of it, but without true e-mail archiving, system administrators could spend long nights loading old tapes and churning out volumes of data, and legal teams will bill hourly for manual searches through troves of data. This compromises your enterprise’s legal position and not only increases raw costs but also leads to less capable and informed legal representation. According to one study, fully one-third of IT managers state they would have diffi culty producing an e-mail that is more than one year old. “A backup system is no substitute for automatic archiving technology”15 (emphasis added).
No Personal Archiving in the Workplace
Employees are naturally going to want to back up their most important fi les, just as they probably do at home. But for an overall IG information-security program to be effective, personal archiving at work must be prohibited. This underground archiving results in hidden shadow fi les and is time consuming and risky. According to Flynn, “Self-managed email can result in the deletion of electronic records, alteration of email evidence, time-consuming searches for back-up tapes, and failure to comply with legal discovery demands” (emphasis added). Also, users may compromise formal electronic records, or they may work from unoffi cial records, which therefore by defi nition might be inaccurate or out-of-date, posing compliance and legal ramifi cations. 16
Are All E-Mails Records?
Are e-mail messages records? This question has been debated for years. The short answer is no, not all e-mail messages constitute a record. But how do you determine
246 INFORMATION GOVERNANCE
whether certain messages are a business record or not? The general answer is that a record documents a transaction or business-related event that may have legal rami- fi cations or historic value. Most important are business activities that may relate to compliance requirements or those that could possibly come into dispute in litigation. Particular consideration should be given to fi nancial transactions of any type.
Certainly evidence that required governance oversight or compliance activities have been completed needs to be documented and becomes a business record. Also, business transactions, in which there is an exchange of money or the equivalent in goods or services, are also business records. Today, these transactions are often documented by a quick e-mail. And, of course, any contracts (and any progressively developed or edited versions) that are exchanged through e-mail become business records.
The form or format of a potential record is irrelevant in determining whether it should be classifi ed as a business record. For instance, if a meeting of the board of directors is recorded by a digital video recorder and saved to DVD, it constitutes a record. If photographs are taken of a ground-breaking ceremony for a new manufac- turing plant, the photos are records too. If the company’s founders tape-recorded a message to future generations of management on reel-to-reel tape, it is a record also, since it has historical value. But most records are going to be in the form of paper, microfi lm, or an electronic document.
Here are three guidelines for determining whether an e-mail message should be considered a business record:
1. The e-mail documents a transaction or the progress toward an ultimate trans- action where anything of value is exchanged between two or more parties. All parts or characteristics of the transaction, including who (the parties to it), what, when, how much, and the composition of its components, are parts of the transaction. Often seemingly minor parts of a transaction are found bur- ied within an e-mail message. One example would be a last-minute discount offered by a supplier based on an order being placed or delivery being made within a specifi ed time frame.
2. The e-mail documents or provides support of a business activity occurring that pertains to internal corporate governance policies or compliance to externally mandated regulations.
3. The e-mail message documents other business activities that may possibly be disputed in the future, whether it ultimately involves litigation or not. (Most business disputes actually are resolved without litigation, provided that proof of your organization’s position can be shown.) For instance, your supplier may dispute the discount you take that was offered in an e-mail message and, once you forward the e-mail thread to the supplier, it acquiesces. 17
Destructive Retention of E-Mail
Destructive retention is an approach to e-mail archiving where e-mail messages are retained for a limited time (say, 90 days or six months), followed by their permanent manual or automatic deletion of messages from the company’s network, so long as there is no litigation hold or the e-mail has not been declared a record in accordance with IG and records management policies. Implementing this as a policy may shield
INFORMATION GOVERNANCE FOR E-MAIL AND INSTANT MESSAGING 247
the enterprise from retaining potentially libelous or litigious e-mail that is not a formal business record (e.g., off-color jokes or other personnel violations).
For heavily regulated industries, such as health care, energy, and fi nancial services, organizations may need to archive e-mail for longer periods of time.
Instant Messaging
Instant messaging (IM) use in enterprises has proliferated—despite the fact that fre- quently proper policies, controls, and security measures are not in place to prevent e-document and data loss. There are a variety of threats to IM use that enterprises must defend against to keep their information assets secure.
The fi rst basic IM systems, which came into use in the mid-1960s, had real-time text capabilities for routing messages to users logged on to the same mainframe com- puter. Early chat systems, such as AOL Instant Messenger, have been in use since the late 1980s, but true IM systems that included buddy list features appeared on the scene in the mid-1990s, followed by the release of Yahoo! and Microsoft IM systems. The use of these personal IM products in the workplace has created new security risks. 18
More secure enterprise instant messaging (EIM) products can be deployed. Leading EIM installed systems include IBM Lotus Sametime, Microsoft Offi ce Com- munications Server, Cisco Unifi ed Presence, and Jabber XCP. In the fi nancial sector, Bloomberg Messaging and Reuters Messaging are leading platforms.
By the year 2000, it was estimated that nearly 250 million people worldwide were making use of IM, and today estimates are that more than 2 billion people use IM, with the addition of hundreds of millions of users in China.
As with many technologies, IM became popular fi rst for personal use, then crept into the workplace—and exploded. IM is seen as a quicker and more effi cient way to communicate short messages than engaging in a telephone conversation or going through rounds of sending and receiving endless e-mail messages. The problem with IM is that many organizations are blind to the fact that their employees are going to use it one way or another , sometimes for short personal conversations outside the organization.r If unchecked, such messaging exposes the organization to a myriad of risks and gives hackers another way to compromise confi dential information assets.
Best Practices for Business IM Use
Employing best practices for enterprise IM use can help mitigate its security risks while helping to capitalize on the business agility and velocity benefi ts IM can provide. Best practices must be built in to IG policies governing the use of IM, although “the specifi cs of these best practices must be tailored for each organization’s unique needs.”
A methodology for forming IM-specifi c IG policies and implementing more secure use of IM must begin with surveying and documenting the proliferation of IM use in the organization. It should also discover how and why users are relying on IM—perhaps there is a shortcoming with their available IT tools and IM is a work-around.
Typically, executives will deny there is much use of IM and that if it is being used, its impact is not worth worrying about. Also, getting users to come clean about
248 INFORMATION GOVERNANCE
their IM use may be diffi cult, since this may involve personal conversations and vio- lations of corporate policy. A survey is a good place to start, but more sophisticated network monitoring tools need to be used to factually discover what IM systems are actually in use.
Once this discovery process has concluded and the use of IM is mapped out, the IG team or steering committee must create or update policies to: decide which IM systems it will allow to be used, how, when, and by whom; decide what restrictions or safeguards must be imposed; and create guidelines as to appropriate use and content. As a part of an overall IG effort, Quest Software determined that a successful IM policy will:
■ Clearly and explicitly explain the organization’s instant messaging objectives. Users should know why the organization permits IM and how it is expected to be used.
■ Defi ne expectations of privacy. Users should be made aware that the organiza- tion has the right to monitor and log all IM sessions for corporate compli- ance, safety, and security reasons.
■ Detail acceptable and unacceptable uses. An exhaustive list of permitted and forbidden activities may not be necessary, but specifi c examples are helpful in establishing a framework of IM behaviors for users.
■ Detail content and contact restrictions (if any). Most organizations will want to limit the amount of idle IM chat that may occur with family, friends, and other nonbusiness-related contacts. There may also be additional issues related to information confi dentiality and privacy. Some businesses may choose to block the distribution of certain types of information via live IM chat session or fi le transfer.
■ Defi ne consequences for violations of the policy. Users should be advised of the consequences of policy violations. Generally these should be aligned with the company’s personnel and acceptable use policies.
The use of a standard disclaimer, to be inserted into all users’ IM sessions, can remind employees of appropriate IM use and that all chat sessions are being moni- tored and archived, and can be used in court or compliance hearings.
The next major step is to work with the IT staff to fi nd the best and most appropriate security and network monitoring tools, given the computing environ- ment. Alternatives must be researched, selected, and deployed. In this research and selection process, it is best to start with at least an informal survey of enterprises within the same industry to attempt to learn what has worked best for them.
The key to any compliance effort or legal action will be ensuring that IM records are true and authentic, so the exact, unaltered archiving of IM messages along with associated metadata should be implemented in real time. This is the only way to
Documenting IM use in the organization is the fi rst step in building IG policies to govern its use. Those policies must be tailored to the organization and its IM use.
INFORMATION GOVERNANCE FOR E-MAIL AND INSTANT MESSAGING 249
preserve business records that may be needed in the future. But in addition, a policy for deleting IM messages after a period of time, so long as they are not declared busi- ness records, must be formulated.
IG requires that these policies and practices not be static; rather, they must be reg- ularly revisited and updated to refl ect changes in technology and legal requirements and to address any shortcoming or failure of the IG policies or technologies deployed.
Technology to Monitor IM
Today, it has been estimated that as much as 80 percent of all IM used by corporate employees comes from free IM providers like Yahoo!, MSN, or AOL. These programs are also the least secure. Messages using these IM platforms can fl y around the Inter- net unprotected. Any monitoring technology implemented must have the capability to apply and enforce established IM use policies by constantly monitoring Internet traffi c to discover IM conversations. Traffi c containing certain keywords can be monitored or blocked, and chat sessions between forbidden users (e.g., those who are party to a lawsuit) can be stopped before they start. But this all necessarily starts with IG and policy formulation.
Tips for Safer IM
Organizations should assume that IM is being used, whether they have sanctioned it or not. And that may not be a bad thing—employees may have found a reasonable business use for which IM is expedient and effective. So management should not rush to ban its use in a knee-jerk reaction. Here are some tips for safer use of corporate IM:
■ Just as e-mail attachments and embedded links are suspect and can contain ma- licious executable fi les, beware of IM attachments too. The same rules governing s e-mail use apply to IM, in that employees should never open attachments from people they do not know. Even if they do know them, with phishing and social engineering scams, these attachments should fi rst be scanned for malware using antivirus tools.
■ Do not divulge any more personal information than is necessary. This comes into play even when creating screen names—so the naming convention for IM screen names must be standardized for the enterprise. Microsoft advises, “Your screen name should not provide or allude to personal information. For example, use a nickname such as SoccerFan instead of BaltimoreJenny.” 19
■ Keep IM screen names private ; treat them as another information asset that needs to be protected to reduce unwanted IM requests, phishing, or spam (actually spim , in IM parlance).
Records of IM use must be captured in real time and preserved to ensure they are reliable and accurate.
250 INFORMATION GOVERNANCE
■ Prohibit transmission of confi dential corporate information. It is fi ne to set up a meeting with auditors, but do not attach and route the latest fi nancial report through unsecured IM.
■ Restrict IM contacts to known business colleagues. If personal contacts are allowed for emergencies, limit personal use for everyday communication. In other words, do not get into a long personal IM conversation with a spouse or teen- ager while at work. Remember, these conversations are going to be monitored and archived.
■ Use caution when displaying default messages when you are unavailable or away. Details such as where an employee is going to have lunch or where their child is being picked up from school may expose the organization to liability if a hacker takes the information and uses it for criminal purposes. Employees may be un- knowingly putting themselves in harm’s way by giving out too much personal information.
■ Ensure that IM policies are being enforced by utilizing IM monitoring and fi ltering tools and by archiving messages in real time for a future verifi able record, should it be needed.
■ Conduct an IM usage policy review at least annually ; more often in the early stages of policy development.
CHAPTER SUMMARY: KEY POINTS
■ E-mail is a critical area for IG implementation, as it is a ubiquitous business communication tool and the leading piece of evidence requested at civil trials.
■ Nearly 80 percent of all employees send work e-mail messages to and from their personal e-mail accounts, which exposes critical information assets to uncontrolled security risks.
■ Meeting e-mail retention and archival requirements becomes an impossible task when e-mail messages are routed in a haphazard manner via personal accounts.
■ In developing e-mail policies, an important step is consulting with stakeholders.
■ E-mail policies must not be too restrictive or tied to a specifi c technology. They should be fl exible enough to accommodate changes in technology and should be reviewed and updated regularly.
■ Not all e-mail messages constitute a business record.
■ Not all e-mail rises to the level of admissible legal evidence. Certain condi- tions must be met.
■ Automatic archiving protects the integrity of e-mail for legal purposes.
INFORMATION GOVERNANCE FOR E-MAIL AND INSTANT MESSAGING 251
Notes
1. “Research Finds that Restrictive Email Policies are Creating Hidden Security Risks for Businesses,” BusinessWire , March 9, 2011, www.businesswire.com/news/home/20110309005960/en/Research- Finds-Restrictive-Email-Policies-Creating-Hidden .
2. Elizabeth Montalbano , “AntiSec Hacks Booz Allen, Posts Confi dential Military Email,” Information- Week , July 12, 2011, www.informationweek.com/news/security/attacks/231001418?cid=nl_IW_dai- ly_2011-07-12_html .
3. Ibid. 4. Mathew J. Schwartz, “AntiSec Hacks FBI Contractor,” InformationWeek , July 11, 2011, www.informa-
tionweek.com/news/security/attacks/231001326 . 5. Quotes from this survey are from “Research Finds That Restrictive Email Policies Are Creating Hid-
den Security Risks for Businesses.” 6. Paul Mah, “How to Reduce the Email Security Risks to Your Business,” EmailAdmin , March 10, 2011,
www.theemailadmin.com/2011/03/how-to-reduce-the-email-security-risks-to-your-business/ . 7. Blair Kahn, Information Nation: Seven Keys to Information Management Compliance (Silver Spring, MD:
AIIM International, 2004), pp. 98–99. 8. Ibid, pp. 95–96. 9. Ibid. 10. Nancy Flynn, The E-Policy Handbook: Rules and Best Practices to Safely Manage Your Company’s E-Mail, Blogs,
Social Networking, and Other Electronic Communication Tools , 2nd ed. (New York: AMACOM, 2009), 20.s 11. Hugh Son and Andrew Frye, “Geithner’s E-mails, Phone Logs Subpoenaed by House (update3),”
January 13, 2010, www.bloomberg.com/apps/news?pid=newsarchive&sid=aGzbhrSxFlXw ,. 12. Flynn, E-Policy Handbook , p. 37. 13. Flynn , E-Policy Handbook , pp. 40–41. 14. Nancy Flynn and Randolph Kahn, Email Rules, A Business Guide to Managing Policies, Security, and Legal
Issues for E-Mail and Digital Communication (New York: AMACOM, 2003), pp. 81–82.
■ Instant messaging use in business and the public sector has become wide- spread, despite the fact that often few controls or security measures are in place.
■ Typically as much as 80 percent of all IM use in corporations today is over free public networks, which heightens security concerns.
■ IM monitoring and management technology provides the crucial compo- nents that enable the organization to fully implement best practices for business IM.
■ Enterprise IM systems provide a greater level of security than IM from free services.
■ Regular analysis and modifi cation (if necessary) of business IM policies and practices will help organizations leverage the maximum benefi t from the technology.
■ Records of IM use must be captured in real time and preserved to ensure they are reliable and accurate.
CHAPTER SUMMARY: KEY POINTS (Continued )
252 INFORMATION GOVERNANCE
15. Flynn, The E-Policy Handbook , p. 41. 16. Ibid., p. 43. 17. Robert F. Smallwood, Taming the Email Tiger: Email Management for Compliance, Governance, & Litiga-
tion Readiness (New Orleans, LA: Bacchus Business Books, 2008). s 18. This discussion is based on Quest Software White Paper, “Best Practices in Instant Messaging
Management” (October 2008), http://media.govtech.net/Digital_Communities/Quest%20Software/ Best_Practices_in_Instant_Messaging_Management.pdf , p. 5.
19. M. Adeel Ansari, “10 Tips for Safer IM Instant Messaging,” July 6, 2008, http://adeelansari.wordpress. com/tag/safer-im-instant-messaging/ .
253
By Dr. Patricia Franks and Robert Smallwood
Information Governance for Social Media*
C H A P T E R 13
I nformation is the lifeblood of every organization, and an increasing volume of infor- mation today is created and exchanged through the use of social networks and Web 2.0 tools like blogs, microblogs, and wikis.
Corporations use public social media technology to create a visible brand, strengthen relations with current customers while attracting new connections and cli- ents, highlight their products and services, and gather intelligence that can be used in decision making.
Governments use public social media technologies to consult with and engage citi- zens, provide services, and keep pace with fast-moving events (e.g., natural disasters).
Both types of enterprises also benefi t from the use of internal social media solu- tions that facilitate communication and collaboration, improve employee engagement, and boost productivity and effi ciency.
Content created through or posted to these new social media platforms must be managed, monitored, and, quite often, archived. Content that meets the organization’s defi nition of a record (i.e., documents business activities) must be retained in accor- dance with the organization’s records retention and disposition policy.
Too often, social media content is not managed by information governance (IG) policies or monitored with controls that ensure protection of the brand and critical information assets and preservation of business records.
Types of Social Media in Web 2.0
The term “Web 2.0” was coined to characterize the move from static Web sites that passively provided information to consumers to more participative, interactive, col- laborative, and user-oriented Web sites and Web applications that allow for input, discussion, and sharing. Users can add content, increasing the value of the Web site or service. Examples include blogs and Web pages containing podcasts (digital me- dia, usually audio) where readers can post comments or pose questions; wikis that
* Portions of this chapter are adapted from Chapter 13 , Robert F. Smallwood, Managing Electronic Records: Methods, Best Practices, and Technologies , © John Wiley & Sons, Inc., 2013. Reproduced with permission of John Wiley & Sons, Inc.s
254 INFORMATION GOVERNANCE
hyperlink to related information to create a knowledge base that shows interrelation- ships and allow users to add content; and RSS (really simple syndication) feeds that provide a stream of fresh content to the user or consumer.
Web 2.0 is the term used to describe the second generation of the World Wide Web, which is comprised of a combination of technologies that allow consumers of Web content to participate, collaborate, and share information online. The improved functionality refl ects consumer needs and preferences that surfaced as a result of in- creased use of the Web for daily information and communications.
Social media sites like LinkedIn, Twitter, and Facebook encourage social interac- tions by allowing users to create their own close network of business associates or friends—essentially a hand-picked audience—and to post their own content in the form of comments, links, photos, videos, and so forth. Others in their social network may view, forward, share, organize, and comment on this content.1
Web 2.0 and social media platforms began as outward-facing, public Web services that could link users from around the world. Subsequently, businesses discovered that social media technology could also be leveraged for internal use in various ways, such as by creating a directory and network of subject matter experts that users can search when working on special projects or by sending out microblog messages to keep their workforce informed. These internal social networks may be extended to include external stakeholders, such as suppliers and customers, in a controlled environment. A number of platform and software options exist for enterprise social media develop- ment and use.
According to the U.S. National Archives and Records Administration:
Social media platforms can be grouped into the categories below. Some spe- cifi c platforms may fi t into more than one category depending on how the platform is used.
■ Web Publishing . Platforms used to create, publish, and reuse content. g ■ Microblogging (Twitter, Plurk) ■ Blogs (WordPress, Blogger) ■ Wikis (Wikispaces, PBWiki) ■ Mashups (Google Maps, popurls)
■ Social networking. Platforms used to provide interactions and collaboration among users.
■ Social networking tools (Facebook, LinkedIn) ■ Social bookmarks (Delicious, Digg) ■ Virtual worlds (Second Life, OpenSim) ■ Crowdsourcing/Social voting (IdeaScale, Chaordix)
■ File sharing/storage. Platforms used to share fi les and host content storage. ■ Photo libraries (Flickr, Picasa) ■ Video sharing (YouTube, Vimeo) ■ Storage (Google Drive, Dropbox) ■ Content management (SharePoint, Drupal)
Agencies [and businesses] use a variety of software tools and platforms. The examples given above are not meant to be an exhaustive list. 2
INFORMATION GOVERNANCE FOR SOCIAL MEDIA 255
Additional Social Media Categories
Breaking out the categories of social media further, we can see in Table 13.1 examples of the wide range of social media applications that exist in the marketplace today. These categories will increase and fl uctuate as the market matures and the companies providing the social media technologies and services expand, merge, are acquired, or die off.
There are certainly additional categories, and the categories will continue to grow. In addition, social media companies do not always fi t neatly into one category. Applica- tions (apps) for smartphones and tablets offer instant gratifi cation and combine several functions. For example, Snapchat allows the sender to share an experience by snapping an image or video, adding a caption, and sending it to a friend.3 The image, unless saved by the recipient, is visible only for the number of seconds set by the sender. The goal is to share a moment in time by sending a fl eeting message. Another app, Vine, introduced by Twitter in early 2013, allows anyone to capture and share short looping videos. 4 Popular for personal use, a number of fi rms (e.g., GE, Urban Outfi tters, and
Table 13.1 Social Media by Application Type
Category Examples
Content curation Buzzfeed, Flipboard, Skygrid, Storify, Summify
Content sharing Yelp, Scribd, Slideshare, Digg, Topix
Photo sharing Flickr, Picasa, SmugMug, Photobucket
Social ad networks Lifestreet, AdKnowledge, Media6degrees, BurstMedia
Social analytics Awe.sm, Bluefi n Labs, Mixpanel, Webtrends
Social bookmarking BibSonomy, Delicious, Diigo, Folkd
Social business software Lithium, Jive, Pluck, Mzinga, Telligent, Ingage, Leverage Software, Huddle, Cubetree, Yammer (Microsoft), Socialcast, Igloo, Socialtext, Watchtoo, Acquia*
Social brand engagement Socialvibe, Mylikes, Adly, Sharethrough
Social commerce platforms Ecwid, Moontoast, Shop Tab, Dotbox, Storenvy, VendorShop
Social community platforms Ning, Mixxt, Grou.ps, Groupsite
Social data GNIP, DataSift, Rapleaf, RavenPack
Social intelligence software SDL, Netbase, Postrank, Google Analytics, Trendrr, Trackur, Visible
Social marketing management Shoutlet, Syncapse, Objective Marketer, Immobi, MediaFunnel
Social promotion platforms Offerpop, Seesmic, Strutta, Votigo, Fanzila, Zuberance, Extole, Social AppsHQ, Social Amp
Social publishing platforms Hootsuite, Spredfast, Hearsaysocial, MutualMind, SproutSocial, Flowtown, Socialware
Social referral 500Friends, Curebit, Tip or Skip, Turnto
Social search and browsing StumbleUpon, Topsy, Wink, Kurrently, SocialMention
Social scoring Klout, EmpireAvenue, PeerIndex
Source: Luma Partners and Terry Kawaja, http://static5.businessinsider.com/image/4fb5077becad04 5f47000003-960/buddy-media-social-marketing.jpg (accessed May 21, 2012).
256 INFORMATION GOVERNANCE
20th Century Fox) have begun to integrate Vine into their marketing/branding strat- egy, including major brands.
Social Media in the Enterprise
Public-facing social media integrates Internet-based applications, technology, social interaction, and content creation to enable communication, collaboration, and content sharing within and across subnetworks of millions of public users. Implementing tight security on these types of mass networks would likely slow response time and inhibit the user experience, and it may not provide a suffi cient level of security to warrant the investment on the part of the social media provider.
While popular consumer-based technologies (Facebook, Twitter, and LinkedIn) top the list of social media technologies used in enterprises today, 5 these services were not designed with the business in mind. Enterprises that need tight security but wish to take advantage of the many benefi ts of social media use are increasingly implementing enter- prisewide social media solutions in addition to or in place of public-facing social media.
In the business world, Facebook-like social networking software is offered for pri- vate, closed networks with a fi nite number of users. In this computing environment, implementing security is more manageable and practical. Some services are cloud based; others operate internally behind the enterprise fi rewall; and some operate ei- ther way or in conjunction as hybrid architecture. Usage statistics that refl ect trends, adoption rates, and areas of content interest can be provided to help feed the metrics needed to chart the progress and effectiveness of the enterprise social network. 6
Enterprise social networking is being adopted by business and public-sector entities at a rapid rate. With the entry of Generation Gmail into the workforce, many of these l initiatives took on an experimental, “cool” image. However, it is crucial to establish so- cial media business objectives, to defi ne time-limited metrics, and to measure progress. There does need to be some leeway, as calculating return on investment (ROI) for en- terprise social networks is very new, and all the benefi ts (and pitfalls) have not yet been discovered or defi ned. Certainly the network load and required bandwidth for e-mail and attachments will decrease; instead of sending a 25MB PowerPoint fi le back and forth among 10 coworkers, the fi le can sit in a common workspace for collaboration.
Another intangible benefi t is the competitive value in being a market leader or industry innovator. But to keep that edge, companies need to continually scan the horizon for new technologies and services. Engaging in online conversations with cus- tomers and other stakeholders is the norm rather than the exception. One sign of a progressive-thinking organization is its ability to leverage social media technology to refi ne operations, improve customer services, and make employees’ lives easier. An organization with a strong social media reputation likely will be better able to attract, recruit, and retain qualifi ed, high-achieving employees.
Implementing security is more manageable and practical with enterprise so- cial networking software.
INFORMATION GOVERNANCE FOR SOCIAL MEDIA 257
Key Ways Social Media Is Different from E-Mail and Instant Messaging
Social media offers some of the same functionality as other communication and col- laboration systems like e-mail and instant messaging (IM), yet its architecture and underlying assumptions are quite different.
When implementing enterprise versions of social media applications, a company may exert more control over the computing and networking environment through in-house implementation rather than outsourcing. Consumer-oriented social media applications, such as Facebook and Twitter, reside on application servers outside the enterprise controlled by third-party providers. This creates IG and records manage- ment (RM) challenges and poses legal risks. 7
Obviously, social media is an emerging technology, so standards, design, and archi- tecture are in fl ux, whereas e-mail has been stable and established for 15 to 20 years. E-mail is a mature technology set, meaning it is unlikely to change much. There are standard e-mail communications protocols, and the technology’s use is pervasive and constant. So when e-mail IG policies are formed, less updating and fi ne-tuning are required over time. With social media, new features are being added, standards are non- existent, privacy settings change overnight, and the legalese in terms of service agree- ments is continually modifi ed to include new features and settings, which means that your social media policy must be more closely monitored and frequently fi ne-tuned.
E-mail, IM, and social media are all communication tools used to share content and collaborate, but social media also offers user interaction features, such as “Like” on Facebook or “retweet” (copying and posting a 140-character tweet) on Twitter, that bring attention to the content in the user’s network and can be construed as an endorsement or rejection of content based on user opinions expressed and associated with the content. 8
Further confounding the organization’s ability to control the social media envi- ronment is the fact that the social media sites are dynamic and ever changing, with comments and opinions being published in real time. This is not true with e-mail and IM systems, which are more structured, stable, and technologically mature.
Biggest Risks of Social Media
Social media is the Wild West of collaboration and communication. Vulnerabilities still are being exposed, and rules still are being established. Users often are unsure of exactly who can see what they have posted. They may believe that they have posted a comment only for the eyes of a friend or colleague, not realizing it may have been posted publicly. “One of the biggest risks that social networking poses to organizations
Social media differs greatly from e-mail use. E-mail is mature and stable. Social media is not. These distinctions have important ramifi cations for IG policy development.
258 INFORMATION GOVERNANCE
is that employees may be exposing information that’s not meant for public consumption , es- pecially in highly regulated environments like banking and healthcare, in industries that rely heavily on proprietary research and development, or even in the military”9 (emphasis added).
Organizations that believe they can ban social media in order to avoid risks are mistaken. Prohibition of social media can result in social media use being driven underground. Employees accustomed to the ease of communicating and collaborating through social networks may turn to the use of personal devices and accounts outside the control of the organization. Even strict adherence to a nonuse policy can harm the organization’s reputation, fi nances, ability to gather information that can be used to improve operations, and ability to remain competitive.
Once an organization decides it will engage in social media initiatives, it must identify different types of risks to initiate its IG effort in this area. According to Chris Nerney of Network World , two of the greatest social media security threats are:d
1. Lack of a social media policy. Many organizations are just now discovering the extent to which social media has popped up in various pockets of their organization. They may believe that their e-mail and communications policy will pretty much cover social media use and that it is not worth the time and expense to update IG policies to include social media.
This invites complexities, vagaries, and potential disaster. A simple Twitter comment could invite litigation: “Our new project is almost ready, but I’m not sure about the widget assembly.” It’s out there. There is a record of it. Instant potential liability in 140 characters or less. s
Social media can add value to an organization’s efforts to reach out to cus- tomers and other stakeholders, but this must be weighed carefully against the accompanying risks.
The objectives of a social media initiative must be spelled out, and metrics must be in place to measure progress. But more than that, who can utilize social media on behalf of the company and what they can state needs to be established with clarity in the IG policy. If not, employees are essentially fl ying blindly without controls, and they are more likely to put the enterprise at risk. 10
More than policy development is needed. If your organization is going to embark on a social media program, it needs an executive sponsor to champion and drive the program, communicating policy to key leaders. You will also need to conduct training—on a consistent basis. Training is key, since social me- dia is a moving target.
2. Employees—the accidental and intentional insider threat. This may be in part due to lack of social media policy or due to lack of monitoring and enforcement. Sometimes an employee harms an organization intentionally. Remember Pri- vate Bradley Manning’s release of hundreds of thousands of classifi ed gov- ernment documents to WikiLeaks?11 But most times employees do not realizes the negative impact of their behavior in posting to social media sites. People might use social media to vent about a bad day at work, but the underlying message can damage the company’s reputation and alienate coworkers and clients. Other times a post that is seemingly unrelated to work can backfi re and take a toll on business. We’re all human and sometimes emotion gets the better of us, before we have rationally thought out the consequences. And that
INFORMATION GOVERNANCE FOR SOCIAL MEDIA 259
is especially true in the new world of social media, where it may be unclear exactly who can see a comment.
The dangers of social media are quite different from those posed by an iso- lated, off-color, or offensive verbal comment made in the workplace, or even one errant e-mail. With social media it is possible that the whole world will be able to see a comment meant only for a limited and controlled audience. For example, consider Ketchum public relations vice president James Andrews, who in 2009 “fi red off an infamous tweet trashing the city of Memphis, home- town of a little Ketchum client called FedEx, the day before he was to make a presentation to more than 150 FedEx employees (on digital media, no less!).” FedEx employees complained to Ketchum and their own executives, point- ing out that while they suffered salary reductions, money was being spent on Ketchum, which had been clearly disrespectful of FedEx. Andrews was forced to make a “very public and humiliating apology.” 12
This story shows that high-level executives must be just as careful as lower- level employees. Andrews was not only a corporate vice president, but also a public relations, communications, and social media expert, well versed in the fi rm’s policies and mission. He also had no ill intent. Knowing this, consider what a rogue employee intent on damaging the company might do. Such im- pact could be much worse. For instance, what if a chief executive’s assistant were to release details of strategic plans, litigation, or ethics investigations to the public? Or embarrassing details of the CEO’s private life? The impact could be quite costly.
Legal Risks of Social Media Posts
With over 554 million active registered users and an estimated average of 58 million tweets per day in 2013 to the microblogging site Twitter, 13 a number that continues to increase, surely some employees in your organization are tweeting. As of the fi rst quarter of 2013, more than 225 million professionals in over 200 countries and ter- ritories were members of the LinkedIn network, and the network continues to expand, with students and recent college graduates being the fastest-growing segment. Ap- proximately 33 percent of members are in the United States.14
The casual use of public comments can easily create liability for a company. With no IG policy, guidelines, monitoring, or governance, legal risks of using social media increase signifi cantly. This is an avoidable risk.
Many people are posting birthday wishes and pictures of what they had for dinner, but others may be venting about specifi c companies and individuals within those companies. There’s a difference between “I can’t stand Wall Street,” and “Goldman is run by Satan, and his name is John Smith. We’re going to sue his butt off.” Instant liability .
Two of the biggest threats of social media use for organizations come from the lack of a social media policy and threats presented by employee use.
260 INFORMATION GOVERNANCE
The specifi cs of where and how an employee posted or tweeted a message may mean whether a lawsuit against your company is successful or not. If a personal LinkedIn or Twitter account is used, and it was posted after hours using a PC from home, the company may be off the hook. But if it was done using a company computer or network, or from a company-authorized account, a defense will be diffi cult. Opposing counsel likely will ask questions about the policy for posting fi rst. One thing is true: “Much of this remains unsettled ground.”15
Just when compliance and records managers thought they had nailed down IG for e-mail, IM, and electronic records, social media came on the scene creating new, dynamic challenges!
Even though not all social media content will rise to the level of a record, accord- ing to the defi nition in use, the organization still may be responsible for managing the nonrecord content. For example, an organization may consider a social networking profi le a record but consider comments nonrecords. That decision will have an impact on what must be retained according to the records retentions schedule. It does not, however, absolve the organization from monitoring and evaluating the comments. 16
“Tweets are no different from letters, e-mail, or text messages—they can be dam- aging and discoverable, which is especially problematic for companies that are required to preserve electronic records, such as the securities industry and federal contractors. Yet another compliance headache is born.”
Blogs are simply Web logs, a sort of online journal that is focused on a particular topic. Blog readers can become followers and receive notices when new content is posted as well as add their own comments, which may be moderated or restricted. It seems confounding, but with the explosion in the use of blogs, there have been actual incidents where employees have “disclosed trade secrets and insider trading informa- tion on their blogs. Blogs have also led to wrongful termination and harassment suits.”
So the liability and potential for leakage or erosion of information assets is not theoretical; it is real.
To safeguard the enterprise that sanctions and supports blog use, IG policies must be clear, and real-time capture and management of blog posts should be implemented. Re- member, these can be business records that are subject to legal holds, and authenticity and accuracy are crucial in supporting a legal case. So a true and original copy must be retained. This may, in fact, be a legal or regulatory requirement, depending on the industry.
If content-posting guidelines are not clear, then the informal nature of social me- dia posts potentially can be damaging to an organization. The usual fact checking and vetting that is done for traditional press releases and advertising may not be con- ducted, so social media posts can be unscreened and unfi ltered, which poses problems when IG policies are not clear and fully enforced. 17 Beyond that, the consequences of violating policy should be severe and clearly stated in policies, as should the penalties imposed, a message that should be reinforced consistently over time.
With no IG policy, guidelines, monitoring, or governance, legal risks of using social media increase signifi cantly. This is an avoidable risk.
INFORMATION GOVERNANCE FOR SOCIAL MEDIA 261
Tools to Archive Social Media
New approaches to capture, manage, and archive social media are emerging. Some are free or inexpensive and appropriate for personal and small business use. Others require a more substantial investment of resources but better meet the needs of midsize and large organizations.
Public Social Media Solutions
Launched as a personal cloud organizing service in March 2012, Jolicloud took a fi le system approach to social media so Facebook, Flickr, Instagram, Picasa, and Twitter content that was previously interacted with or shared could be sorted and searched. 18 The service “slurps” (extracts) content from social media sites and makes it available for viewing through any mainstream Internet browser, tablet, or smartphone. As users perform social media functions like sharing, “liking,” and “favoriting” content on their various social media services, the content is automatically saved to their Jolicloud ac- count, which can later be sorted and searched.
Jolicloud has similarities with other “personal social Web memory” products, such as Facebook Timeline and TimeHop. In 2013, Jolicloud added the ability to view and edit fi les and rebranded its unifi ed cloud platform Jolidrive.19
If you prefer to maintain copies of all fi les on your own computer, an alternative to Jolicloud is a product called SocialFolders. This app lives on your computer and con- nects directly to your favorite social media sites so you can manage, backup, and sync your photos, videos, and documents in a centralized location. 20
Since Facebook and Twitter initially did not provide archiving tools, some third- party applications have popped up to perform the task.
TwInbox is a free MS Outlook plug-in that archives Twitter postings and allows us- ers to install a (Twitter) menu option to send tweets directly from Outlook; these tweets are archived into a standard Outlook folder. The folder can be confi gured to capture tweets that a user sends outside of Outlook, so that everything is stored in one folder.
TweetTake is a free utility that archives followers and tweet posts. It does not require a software download, and the archive can be stored as a zip fi le and then im- ported into a spreadsheet (e.g., Excel) for further analysis. By the time this book goes to press, there will be even more options, and the existing ones will have changed and (it is hoped) improved.
If your organization uses Twitter and social media archiving is required by law, regulations, or internal IG policies, a good place to start your research is with software like TwInbox (if you operate in a Microsoft Offi ce environment) and TweetTake as well as other new entrants to the market or other options your organization may have. 21
For archiving Facebook posts, there are several options. Facebook users can down- load and archive their Facebook data from their account settings page. Also, there are free plug-ins for Mozilla’s Firefox browser. One comes directly from Mozilla, which archives everything but fan pages into a zip fi le. Another is a Firefox add-on called ArchiveFacebook, which allows you to save Facebook content directly to your hard drive and view the content exactly as it looks on Facebook. Other tools, including So- cialSafe, PageFreezer, and Wayback Machine, charge a small fee. All of these options and new ones need to be evaluated when selecting an archiving solution for Facebook that meets your organization’s requirements.
262 INFORMATION GOVERNANCE
For archiving LinkedIn posts and information, SocialSafe, PageFreezer, and Way- back Machine can be used, and other tools will surface.
To convert records to a standard format for use outside of the social media application, there are also options to create PDF documents out of social media posts using products like PDF995 and PrimoPDF.22 Nuance Software also provides PDFCreate.
Additional archiving tools are being developed as the social media market matures. Bear in mind that tools developed by third parties always carry some risk that tools directly from the software or service provider do not.
These tools may not provide a legally defensible audit trail in court. Choosing among the tools requires a critical analysis and may require additional technology layers. Other alternatives, such as real-time content archiving tools and even in-house developed customizations, also have to be considered.
Government and Industry Solutions
Most of the products and methods that could be of use for personal or small business archiving of social media content involves manual intervention, which can be time consuming. All organizations must focus on their core business and would benefi t from tools and services that streamline and automate the archiving process as much as possible—however, there is a cost. Midsize and large organizations, often using both public and enterprise social media technologies, may fi nd the investment in com- mercial products and services worth the additional cost, especially those products that integrate and manage social media content with other enterprise content. Capture and management of social media content is an area that must be addressed as part of an overall IG strategy. Some of the solutions available at this time are described in Table 13.2 ; however, because of the recent increased focus on archiving solutions for public and enterprise social media content, the landscape will continue to become more effi cient, effective, and possibly unifi ed.d
In addition to providing archiving functions, unifi ed and integrated solutions provide business intelligence applications and tools to enable the enterprise to better achieve its organizational goals, processes, and performance requirements.
IG Considerations for Social Media
The report “How Federal Agencies Can Effectively Manage Records Created Us- ing Social Media Tools” addresses building an IG framework for social media. An IG model provides the overarching policies, guidelines, and boundaries for social media initiatives. 23
An IG framework for social media should incorporate social media policy, controls, and operational guidelines as well as spell out consequences for violations. Best practices for social media still are being established, and those that have been established are evolving. In addition to establishing policies to govern the use of social media across the organiza- tion, best practices should include industry-specifi c, vertical market considerations. A cross-section of functional groups within the enterprise should provide input into the policy-making process. At the very minimum, internal audit, marketing, fi nance, infor- mation technology (IT), legal, human resources, and RM must be consulted, and all
INFORMATION GOVERNANCE FOR SOCIAL MEDIA 263
Table 13.2 Social Media Archiving and Management Software
Type of Solution Description Examples
Archiving solution Services that capture, protect, and retain social media for compliance, e-discovery, digital preservation, and records management
Archives Social; Smarsh; RegEd by Arkovi
Unifi ed solutions Services and software that facilitate the management of various fi le types across the enterprise (e.g., social media, legacy data, word fi les, SharePoint fi les) for storage, optimization, e-discovery, compliance, and records management
Unifi ed Archive® by ZL Technologies; Symantec Enterprise Vault; HP Autonomy
Integrated solutions Services that integrate various types of systems (e.g., customer relationship management in the cloud with social media tools, enterprise content management [ECM], and/or records management) to manage records and information for business operations and compliance.
Microsoft SharePoint 2013 and Yammer (contains social and collaboration features as well as RM and compliance features); Salesforce and Chatter (integrates social collaboration technology and potential to integrate with ECM content repository and ECM Documentum Records Manager).
business units should be represented. Clear roles and responsibilities must be spelled out, and controls must be established to govern acceptable use—essentially what is al- lowed and what is not. Even writing style, logo format, branding, and other marketing considerations should be weighed. The enterprise’s image and brand are at risk, and prudent steps must be taken to protect this valuable, intangible asset. And most im- portant, all legal and regulatory considerations must be folded into the new IG policy governing the use of social media.
Key Social Media Policy Guidelines
Your social media policy development process can begin by examining the published policies of major organizations in your industry or closely related industries. It should also be based on changes in the workplace as well as established standards, such as guidance developed as the result of a January 2013 ruling by the National Labor Rela- tions Board. More important, social media policies must be hand-crafted and customized for each organization.
An IG framework for social media should incorporate social media policy, con- trols, and operational guidelines, and spell out consequences for violations.
264 INFORMATION GOVERNANCE
A prudent and properly crafted social media policy:
■ Specifi es who is authorized to create social media accounts for the organization. ■ Authorizes specifi cally who can speak on the organization’s behalf and who
cannot (by role/responsibility). ■ Outlines the types of negative impact on the company’s brand and reputation
that unscreened, poorly considered posts may have. 24 ■ Draws clear distinctions between business and personal use of social media and
specifi es whether personal access is allowed during work hours. ■ Underscores the fact that employees should not have any expectation of privacy
when using social media for corporate purposes, just as in using other forms of communications such as e-mail, IM, and voicemail, which may be monitored.
■ Clearly states what is proper and allowed on the organization’s behalf and what is forbidden in social media posts or using organization resources.
■ Instructs employees to always avoid engaging in company-confi dential or even controversial discussions.
■ Encourages/requires employees to include a standard disclaimer when pub- lishing content that makes clear the views shared are representative of the em- ployee and not the organization.
■ Strictly forbids the use of profanity and uses a professional business tone, albeit more informal than in other corporate communications.
■ Strictly forbids any statements that could be construed as defamatory, discrimi- native, or infl ammatory.
■ Outlines clear punishments and negative actions that will occur to enforce so- cial media policy.
■ Draws clear rules on the use of the company name and logo.25
The policy need not be long but should be clear. Best Buy’s social media policy, for example, uses the slogan, “Be smart. Be respectful. Be human.”26 It then breaks the guid- ance into two major sections: what you should do and what you should never disclose. A word of caution contained in the Best Buy Social Media Policy explains the rationale for the employee to abide by the social media policy: Protect the brand, protect yourself.
To ensure compliance with the organization’s IG strategy, it is also necessary to include a reference to the organization’s related policies, including the records and information management policy.
Records Management and Litigation Considerations for Social Media
Legal requirements and demands trump all others when making decisions about captur- ing and preserving social media records. Social media is no different from other forms of electronically stored information (ESI) in that it is potentially discoverable during n litigation.27 Not all ESI residing in social media are records, but all are discoverable. If an organization employs social media and makes a conscious decision not to archive t all or some portion of that data, it is taking risks. A legally defensible records retention schedule must be in place, and it must be based on specifi c laws that identify the records that must be retained and to a records retention policy that explains the process for iden- tifying, categorizing, and managing information and records.
INFORMATION GOVERNANCE FOR SOCIAL MEDIA 265
From an RM perspective, it is critical to consider that social media posts are more than the posts themselves; for legal or compliance purposes, they include metadata and hyperlinks to external content—and that external content in its native format— that must also be preserved, preferably in real time. That external content may be a PDF document, a PowerPoint presentation, Web site content, or even a video on YouTube, which would require that video archiving, along with associated metadata, is in place.
To truly capture the necessary content required by law, records and compli- ance managers must understand how software programs communicate with each other in order to recommend possible solutions to the IT department. One way to preserve the Web-based data of social media applications is to use the application programming interfaces (APIs) that social media providers offer. APIs offer standard “hooks” into an application. Another way, perhaps preferable, is to enlist a service that can capture and archive information from multiple social networks. Further innovations in tools and services that will make capturing these records easier are being developed.
Content found in social media networks can be static or dynamic. Profi les in Face- book and blog posts are examples of static content. They can be captured before being posted to the Web. Blog comments and endorsements through “liking” or “favoriting” a post are examples of dynamic content. The ideal method from a RM standpoint is to capture all dynamic social media content in real time in order to be able to prove authenticity and fi ght claims of records spoliation (corruption or adulteration of evi- dence) in the event of a discovery request.
Regardless of method of capture, social media content that meets record status criteria should be moved to a repository in an electronic records management
U.S. corporations must archive social media records under Rule 34 of the FRCP.
U.S. corporations that utilize social media are compelled to preserve those records, including metadata and associated linked content , according to Rule 34 of the t Federal Rules of Civil Procedure (FRCP), which states that opposing parties in litigation may request “any designated documents or ESI—including writings, drawings, graphs, charts, photographs, sound recordings, images, and other data or data compilations—stored in any medium from which information can be obtained either directly or, if necessary, after translation by the responding party into a usable form.”28 This echoes a key principle of the Sedona Confer- ence ®, a leading RM and legal retention think tank. Also, Rule 26 of the FRCPe requires that any and all information that might be discoverable or “potentially responsive” must be preserved and produced if requested by the opposing party. So it is clear that there is a legal duty to preserve social media records.
266 INFORMATION GOVERNANCE
(ERM) system application. Then business rules for retention should be applied to those records. Typical functions of an ERM system include these:
■ Marking an electronic document as a read-only electronic record ■ Protecting the record against modifi cation or tampering ■ Filing a record against an organizational fi le plan or taxonomy for categorization ■ Marking records as vital records ■ Assigning disposal (archival or destruction rules) to records ■ Freezing and unfreezing disposal rules ■ Applying access and security controls (Security rules may differ from the source
elec tronic document in an electronic document management system or enter- prise content management [ ECM] software.)
■ Executing disposal processing (usually an administrative function) ■ Maintaining organizational/historical metadata that preserves the business
context of the record in the case of organizational change ■ Providing a history/audit trail 29
Robust search capabilities are perhaps the most crucial component of a social media ERM or archiving solution. It is fi ne to preserve the records and their associated metadata perfectly, but if you cannot easily fi nd and produce the information, compliance and e- discovery efforts will fall short and may cost the organization dearly.
Social media policy will be unique to each particular organization. It is fi ne to start with a social media policy example or template, but it must be tailored to the needs of the organization for it to be effective and legally defensible. 30
Records Retention Guidelines
Here are some basic records retention guidelines:
■ Make records threshold determinations. Examine the content to see if it in fact constitutes a record by your own organization’s defi nition of a record , which should d be contained in your IG policies. This records determination process likely also will require consultation with your legal counsel. If the social media site has not been kept operating, or it was used for a specifi c project that has been completed (and all pertinent records for that project have been retained), then its content may not require retention of records. 31
■ Use existing retention schedules if they apply. If your organization already has reten- tion policies for, say, e-mail, then any e-mail sent by social media should adhere to that same scheduling guideline, unless there is some legal reason to change it.
■ Apply basic content management principles. Focus on capturing all related content for social media posts, including conversation threads, and associated metadata that may be required in legal discovery to provide context and maintain the completeness, authenticity, and integrity of the records.
Social media policy must be unique to each particular organization.
INFORMATION GOVERNANCE FOR SOCIAL MEDIA 267
■ Risk avoidance in content creation. Instruct and reinforce the message to employ- ees participating in corporate social media that content on the Web stays there indefi nitely and that it carries potential legal risks. In addition, once something is posted on the Web, completely erasing and destroying the content at the end of its retention period is nearly impossible.
Content Control Models
There are several basic ways to manage social media content, ranging from tightly con- trolling it through one single, accountable person, to delegating control to the busi- ness unit level, all the way to letting the social media participants post their thoughts, unmoderated and unfettered, to encourage spontaneity and enthusiastic use of the tool. The approach your organization takes will depend on the specifi ed business ob- jectives you have for utilizing social media and your organization’s appetite for risk.
Emerging Best Practices for Managing Social Media Records
Best practices for managing social media business records are still evolving, and will continue to develop as records and information practitioners gain more experience with social media records. Here are some emerging best practices:
■ Identify records during the social media planning stage. Both a social media policy and the records and information policy should refer to a form to be completed by the person or unit proposing a new social media initiative. The person com- pleting the form should indicate if records will be created and, if so, how they will be managed.
■ Promote cross-functional communications. A social media team of representatives from various departments, such as IT, social media, legal, compliance, records management, and other stakeholders, is formed, and communication and col- laboration is encouraged and supported.
■ Require consultation in policy development. Extending beyond the social media team, input and advice from multiple stakeholder groups is essential for creat- ing IG policies that cover social media records management.
■ Establish clear roles and responsibilities. The cross-functional social media team must lay out clear expectations and responsibilities and draw lines of account- ability so that stakeholders understand what is expected of them.
■ Utilize content management principles. Management of social media content should fall under an ECM software implementation, which can capture and track content, including associated metadata and external content, and manage that social media content through its life cycle.
■ Implement RM functionality. Management by an ERM system that offers fea- tures that enable records retention and disposition, implementation of legal holds, and lifting of legal holds is essential.
■ Control the content. Clear guidelines and monitoring mechanisms must be in place to control and manage content before it gets published on the Web, when possible (e.g., static content on blogs and profi les in social networks) if there is any potential legal risk at all.
268 INFORMATION GOVERNANCE
■ Capture content in real time. By implementing a real-time content capture solu- tion for content posted directly to social media (e.g., comments on blogs and posting of someone else’s content or retweets), organizations will begin their control and management of the content at soonest point and can more easily prove it is authentic and reliable from a legal perspective.
■ Champion search capabilities. After capture and preservation of records and as- sociated metadata, search capabilities are the single most important feature that the technology must provide.
■ Train, train, train. Social media is a new and emerging technology that changes rapidly. Users must be trained, and that training must be updated and rein- forced on a regular basis so that employees have clear guidelines, understand the technology, and understand the business objectives for its use.
CHAPTER SUMMARY: KEY POINTS
■ Organizations are increasingly using social media and Web 2.0 platforms to connect people to companies and government.
■ Social media use presents unique challenges because of key differences with other electronic communications systems, such as e-mail and IM.
■ Two of the biggest risks that social networking poses to organizations are (1) not having a social media policy; and (2) employees may be—intentionally or not—exposing information that is not meant for public consumption.
■ Enterprise social networking software has many of the features of consumer social applications such as Facebook, but with more oversight and control, and they come with analytics features to measure adoption and use.
■ Various software tools have become available in recent years for archiving social media posts and followers for RM purposes.
■ An IG framework provides the overarching policies, guidelines, and bound- aries for social media initiatives, so that they may be controlled, monitored, and archived.
■ Social media posts are more than the post itself; they include metadata and also include hyperlinks to external content—and that external content must be preserved in its native format to meet legal standards.
■ Robust search capabilities are the most crucial component of a social media ERM or archiving solution.
■ Social media policy will be unique to each particular organization.
■ Best practices for managing social media business records are still evolving but include forming cross-functional social media teams with clear responsibilities, encouraging communication, and capturing complete content in real time.
INFORMATION GOVERNANCE FOR SOCIAL MEDIA 269
Notes
1. U.S. National Archives and Records Administration, NARA Bulletin 2011-02, “Guidance on Manag- ing Records in Web 2.0/Social Media Platforms,” October 20, 2010, www.archives.gov/records-mgmt/ bulletins/2011/2011-02.html .
2. Ibid. 3. See www.snapchat.com/ (accessed June 3, 2013). 4. See http://vine.com/ (accessed June 3, 2013). 5. Nancy Gohring , “Facebook and Twitter Rule the Enterprise, Too,” May 20, 2013, www.citeworld.com/
social/21893/facebook-twitter-rule-enterprise (accessed June 4, 2013). 6. Andrew Conry-Murray, “Can Enterprise Social Networking Pay Off?” Internet Evolution, March 21, 2009,
www.internetevolution.com/document.asp?doc_id=173854 . 7. Patricia C. Franks, “How Federal Agencies Can Effectively Manage Records Created Using New
Social Media Tools,” IBM Center for the Business of Government, San Jose State University, 2010, www.businessofgovernment.org/sites/default/files/How%20Federal%20Agencies%20Can%20 Effectively%20Manage%20Records%20Created%20Using%20New%20Social%20Media%20Tools. pdf , pp. 20–21 (accessed March 30, 2012).
8. Ibid. 9. Paul McDougall, “Social Networking Here to Stay Despite Security Risks,” Information Week , May 12,
2011, www.informationweek.com/news/security/privacy/229500138 . 10. Chris Nerney, “5 Top Social Media Security Threats,” Network World , May 31, 2011, www.network-d
world.com/news/2011/053111-social-media-security.html . 11. C. Savage, “Soldier Admits Providing Files to WikiLeaks,” New York Times , February 23, 2013, wwws
.nytimes.com/2013/03/01/us/bradley-manning-admits-giving-trove-of-military-data-to-wikileaks
.html?ref=bradleyemanning&_r=0 (accessed May 19, 2013). 12. Ibid. 13. Twitter Statistics, Statistic Brain, www.statisticbrain.com/twitter-statistics/ (accessed May 18, 2013). 14. LinkedIn, “About Us,” www.linkedin.com/about-us (accessed May 18, 2013). 15. Sharon Nelson, John Simek, and Jason Foltin, “Capturing Quicksilver: Records Management for
Blogs, Twittering and Social Networks,” Sensei Enterprises, 2009, www.senseient.com/storage/articles/ Capturing_Quicksilver.pdf (accessed December 10, 2013).
16. This discussion and the next quotes in this section are from Patricia C. Franks, Records and Information Management (Chicago: American Library Association Neal-Schuman, 2013), p. 179.t
17. Sharon Nelson and John Simek, “Mitigating Legal Risks of Using Social Media,” Information Manage- ment 45, no. 5 (September/October 2011), ARMA International.t
18. Liz Gannes, “Saving the Social Web for Later Use: Jolicloud Organizes Everything You’ve Shared, Liked, and Favorited,” March 19, 2012, http://allthingsd.com/20120319/saving-the-social-web-for- later-use-jolicloud-organizes-everything-youve-shared-liked-and-favorited/ .
19. Nick Summers, “Jolicloud Rebrands Its Unifi ed Cloud Platform as Jolidrive, Adds the Ability to View and Edit Files,” TNW , March 6, 2013, http://thenextweb.com/insider/2013/03/06/jolicloud-rebrands-its-WW unifi ed-cloud-service-as-jolidrive-adding-the-ability-to-edit-and-view-fi les/ (accessed May 18, 2013).
20. Social Folders, “About Us,” http://socialfolders.me/about-us/ (accessed May 18, 2013). 21. Andy Opsahl, “Backing Up Twitter and Facebook Posts Challenges Governments,” Government
Technology , January 20, 2010, www.govtech.com/policy-management/Backing-Up-Twitter-and-Face- book-Posts.html?utm_source=related&utm_medium=direct&utm_campaign=Backing-Up-Twitter- and-Facebook-Posts .
22. Ibid. 23. The next discussion is based on Franks, “How Federal Agencies Can Effectively Manage Records.” 24. Nelson and Simek, “Mitigating Legal Risks of Using Social Media.” 25. Ibid. 26. Best Buy Social Media Policy, http://forums.bestbuy.com/t5/Welcome-News/Best-Buy-Social-Media-
Policy/td-p/20492 (accessed December 10, 2013). 27. The next discussion is based on Rakesh Madhava, “10 Things to Know about Preserving Social Media,”
Information Management (September/October 2011): 34–35, 37. ARMA International.t 28. Federal Rules of Civil Procedure, http://www.uscourts.gov/uscourts/rulesandpolicies/rules/cv2009.pdf
(accessed 2/20/14). 29. Franks, Records and Information Management , p. 151. t 30. Ibid., pp. 36–37. 31. Guidelines here and in the next section are from New York State Archives, “Records Advisory: Preliminary
Guidance on Social Media,” May 24, 2010, www.archives.nysed.gov/a/records/mr_social_media.shtml .
271
Information Governance for Mobile Devices*
C H A P T E R 14
* Portions of this chapter are adapted from Chapter 7 , Robert F. Smallwood, Safeguarding Critical E-Documents: Imple- menting a Program for Securing Confi dential Information Assets , © John Wiley & Sons, Inc., 2012. Reproduced withs permission of John Wiley & Sons, Inc.
T he use of mobile devices is ubiquitous in today’s society. According to CTIA (the Wireless Association), over 326 million mobile devices were in use within the United States as of December 2012. 1 This is a more than 100 percent penetra-
tion rate, since many users have more than one mobile device, and usage continues to grow. Citizens of China, India, and the European Union (EU) have even greater mobile phone usage than those in the United States.
Mobile computing has vastly accelerated in popularity over the last decade. Sev- eral factors have contributed to this: Improved network coverage, physically smaller devices, improved processing power, better price points, a move to next-generation operating systems (OSs) such as Google’s Android and Apple’s iOS, and a more mobile workforce have fueled the proliferation of mobile devices.
Mobile devices include laptops, netbooks, tablet PCs, personal digital assistants (PDAs) such as BlackBerries, and smartphones such as Apple’s iPhone and those based on Google’s Android platform. What used to be simple cell phones are now small com- puters with nearly complete functionality and some unique communications capabilities. These devices all link to an entire spectrum of public and private networks.
Gartner has estimated that “by 2016, 40 percent of the global workforce will be mobile , with 67 percent of workers using smartphones” 2 (emphasis added).
With these new types of devices and operating environments come new demands for information governance (IG) policies and unknown security risks. 3 The Digital Systems Knowledge Transfer Network, a UK think tank, found: “The plethora of mo- bile computing devices fl ooding into the market will be one of the biggest ongoing security challenges [moving forward].” “With mobile devices connecting to Wi-Fi and Bluetooth networks, there are suddenly many more opportunities [for hackers] to get in and steal personal information.”4
Due to this rapid shift toward mobile computing, companies with mobile person- nel, such as salespeople and service technicians, need to be aware of and vigilant toward these impending security threats, which can compromise confi dential information.
Securing mobile devices is critical: A survey by Aberdeen Group, an IT research and analysis fi rm, estimates that that data leakage or loss can cost an organization anywhere from $10,600 to over $400,000 . 5
272 INFORMATION GOVERNANCE
The reality is that most mobile devices are not designed with security in mind ; in fact, d some compromises have been made to enable new smartphone operating systems to run on a variety of hardware, such as the Android OS from Google. This is analogous to the trade-offs Microsoft made when developing the Windows OS to run across a variety of hardware designs from many PC manufacturers.
Smartphone virus infections are particularly diffi cult to detect and thorny to remove. Users may be unaware that all their data is being monitored and captured and that a hacker is waiting for just the right time to use it. Businesses can suffer economic and other damage, such as erosion of information assets or even negative goodwill from a damaged image.
The smartphone market is rapidly expanding with new developments almost daily, each providing criminals with a new opportunity. An International Data Corporation report indicated that “ smartphone sales outpaced PC sales for the fi rst time ever in the fourth quarter of 2010 , with 100.9 million smartphones shipped versus 92.1 million PCs” (em- phasis added). 6 The growth in smartphone sales and new services from banks—such as making deposits remotely by snapping a picture of a check—means that there are new and growing opportunities for fraud and identity theft.
Awareness and education are key. The fi rst line of defense is for users to better under- stand cybercriminal techniques and to become savvier in their use of information and commu- nications technologies. s
A large part of the battle will be won when biometric authentication technolo- gies (those that use retina, voice, and fi ngerprint recognition) are mature enough to positively identify a user to ensure the correct person is accessing fi nancial or confi dential accounts. Application suppliers are fi rst concerned about functionality and widespread adoption; security is not their top priority. Users must be aware and vigilant to protect themselves from theft and fraud. On a corporate level, organi- zations must step up their training efforts in addition to adding layers of security technology to safeguard critical electronic documents and data and to protect infor- mation assets.
Social engineering —using various ways of fooling the user into providing privategg data—is the most common approach criminal hackers use , and it is on the rise. Machines do their job, and software performs exactly as it is programmed to do, but human beings are the weakest link in the security chain. As usage trends in the direction of a more mobile and remote workforce, people need to be trained as to what threats exist and constantly updated on new criminal schemes and approaches. This training is all part of an overall IG effort, controlling who has access to what information, t when, and from where.
With more and more sensitive business information being pushed out to mo- bile devices (e.g., fi nancial spreadsheets, business contracts, strategic plans, etc.) and advancing and evolving threats to mobile the mobile realm, IG becomes an imperative; and the most important part of IG is that it is done on an ongoing basis, con- sistently and regularly . Policies must be reviewed when a new mobile device starts to be utilized, when new threats are uncovered, as employees use unsecured public Wi-Fi networks more and more, and as business operations change to include more and more mobile strategies. Information technology (IT) divisions must ensure their mobile devices are protected from the latest security risks, and users must regularly be apprised of changing security threats and new criminal approaches by hackers.
INFORMATION GOVERNANCE FOR MOBILE DEVICES 273
Mobile device management (MDM) is critical to secure confi dential informa-t tion assets and managing mobile devices. Some available technologies can wipe devices free of confi dential documents and data remotely, even after they are lost or stolen. These types of utilities need to be deployed to protect an enterprise’s information assets.
Current Trends in Mobile Computing
With the rapid pace of change in mobile computing, it is crucial to convey an under- standing of trends, to better know what developments to anticipate and how to plan for them. When a new mobile device or operating system is released, the best thing may be to wait to see what security threats pop up. It is important to understand the direction mobile computing usage and deployment are taking in order to plan and develop IG policies to protect information assets.
From CIOZone.com, here are the top trends in mobile computing:
1. Long Term Evolution (LTE). The so-called fourth generation of mobile computing (4G) is expected to be rolled out across North America over the next several years [2013–2015], making it possible for corporate users to run business applications on their devices simultaneously with Voice over IP (VoIP) capabilities.
2. WiMax [Worldwide Interoperability for Microwave Access]. As LTE andx WiMax networks are deployed in the U.S. through [2013 and beyond], expect to see more netbooks and laptops equipped with built-in radio fre- quency identifi cation (RFID) and wireless support. [WiMax is protocol for communications that provides up to 40 megabits/second speeds (much faster than Wi-Fi) for fi xed and mobile Internet access. The next IEEE 802.16m update will push the speed to up to 1 gigabyte bit/second fi xed speeds.]
3. 3G and 4G interoperability. Sprint has developed a dual mode card which will enable mobile device users to work on both 3G and 4G networks. Other carriers are expected to follow suit.
4. Smartphone applications. Third-party software vendors will increasingly make enterprise applications available for smartphones, including inven- tory management, electronic medical records management, warehousing, distribution and even architectural and building inspection data for the construction industry.
5. GPS. Global Positioning Systems (GPS) will increasingly be used to iden- tify end users by their whereabouts and also to analyze route optimization for delivery workers and service technicians.
6. Security. As new and different types of mobile devices are introduced, cor- porate IT departments will fi nd it increasingly challenging to identify and authenticate individual end users. As such, expect to see a combination of improvements in both Virtual Private Network (VPN) software and hard- ware-based VPNs to support multiple device types.
274 INFORMATION GOVERNANCE
7. Antivirus. As more third-party business applications are made available on smartphones and other mobile devices, CIOs [chief information offi cers] will also have to be cognizant about the potential for viruses and worms.
8. Push-button applications. Let’s say a waste disposal truck arrives at an indus- trial site and is unable to empty a Dumpster because a vehicle is blocking its path. Smartphones will increasingly have applications built into them that would make it possible for the disposal truck driver to photograph the impeding object and route the picture to a dispatcher to document and time-stamp the obstruction.
9. Supplemental broadband. As carriers implement LTE and WiMax networks, companies such as Sprint and Verizon are looking at potentially extending wireless broadband capabilities to small businesses which don’t have fi ber optic or copper connections on the ground. Under this scenario, a small packaging company in New Jersey could potentially be able to receive T-1 level (high-speed) broadband capabilities in regions of the U.S. where it has offi ces but doesn’t have wireline broadband connections.
10. Solid State Drives (SSDs). Corporate customers should expect to see contin- ued improvements in the controllers and fi rmware built into SSDs in order to improve the longevity of the write cycles in notebooks. 7
Security Risks of Mobile Computing
Considering their small size, mobile computing devices store a tremendous amount of data, and storage capacities are increasing with the continued shrinking of circuits and advancement in SSD technologies. Add to that the fact that they are highly portable and often unsecured and you have a vulnerable mix that criminals can target. Consid- ering how often people lose or misplace their mobile devices daily, and what valuable targets they are for physical theft (this author had a laptop stolen in the Barcelona air- port, right from under his nose), and it is clear that the use of mobile devices represents an inherent security risk.
But they do not have to be lost or stolen to be compromised, according to Stan- ford University’s guidelines, which are intended to help mobile computing device us- ers protect the information the devices contain. “ Intruders can sometimes gain all the access they need if the device is left alone and unprotected, or if data is ‘sniffed out of the air’ during wireless communications” s 8 (emphasis added). The devices can be compromised with the use of keystroke loggers that capture every single entry a user makes. This can be done without the user having any knowledge of it. That means company passwords, confi dential databases, and fi nancial data (including personal and corporate credit card numbers) are all at risk.
Securing Mobile Data
The fi rst and best way to protect confi dential information assets is to remove confi dential, un- necessary, or unneeded data from the mobile device. Confi dential data should not be stored on the device unless explicit permission is given by the IT department, business unit
INFORMATION GOVERNANCE FOR MOBILE DEVICES 275
head, or the IG board to do so. This includes price lists, strategic plans, competi- tive information, photo images of corporate buildings or coworkers, and fi nancial data such as tax identifi cation numbers, company credit card or banking details, and other confi dential information.
If it is necessary for sensitive data to be stored on mobile devices, there are options to secure the data more tightly, using USB drives, fl ash drives, and hard drives that have integrated digital identity and cryptographic (encryption) capabilities.
Mobile Device Management
MDM software helps organizations to remotely monitor, secure, and manage devices such as smartphones and tablet PCs. 9 MDM improves security and streamlines enterprise management of mobile devices by providing ways to contact the remote devices individually or en masse to add, upgrade, or delete software, change confi guration settings, and “wipe,” or erase, data, and make other security-related changes and updates. More sophisticated MDM offerings can manage not only homogenous company-owned mobile devices but also those that employees use in the workplace in a bring-your-own-device (BYOD) environment.
The ability to control confi guration settings and secure data remotely allows or- ganizations to better manage and control mobile devices, which reduces the risk of data leakage and reduces support costs by providing more uniformity and the ability to monitor enforce company-dictated IG policy for mobile devices.
Key vendors in the MDM marketplace include AirWatch, Apple (Profi le Man- ager) AppSense, BoxTone, Centrify, Citrix, Good Technology, IBM (Endpoint Man- ager for Mobile Devices), LANDesk, MobileIron, SAP (Afaria MDM), and Symantec (Mobile Management Suite).
Rapid growth is expected in the MDM marketplace, with Gartner projecting that nearly two-thirds of organizations will deploy MDM software by 2018. 10 And Frost & Sullivan projects that “the market for enterprise MDM will grow from $178.6 million in 2011 to $712.4 million by 2018.” 11
Trends in MDM
Six key trends in the MDM marketplace are discussed next.
1. MDM software expansion and maturity. Many experts believe that MDM will develop and reach beyond just mobile endpoints to include deep integration with mobile infrastructure and applications (apps). 12 What is important is securing and authenticating data. To ensure that, MDM must expand beyond remote device locking, tracking, and wiping. A more comprehensive life cycle management approach will emerge beginning with the acquisition or introduction of the device into the enterprise network until its retirement or destruction. In addition, monitoring and controlling costs through integrated expense management will likely occur.
2. Consolidation of MDM major players. Acquisitions by Citrix, Good Technology, TT and others signal that fewer but stronger market leaders are likely to emerge.
276 INFORMATION GOVERNANCE
3. Cloud-based MDM. This will become the norm, not the exception, and it will happen quite rapidly.
4. Emphasis on mobile device policy. Technology can do only so much—an orga- nization must have its IG policies, processes, and audit practices formalized, tested, and monitored. The IT department must have clear direction on which data and devices to monitor and secure, and employee rights and responsibili- ties must be clearly delineated and communicated.
5. Diversifying and expanding mobile monitoring and security. This means that MDM may go beyond today’s mobile devices and include remote instruments and machines that are churning out data in applications, such as process man- agement, transportation management, and enterprise resource management.
6. Infrastructure consolidation. The currently disparate pieces, including social computing, mobile computing, and cloud computing, may consolidate and become the new construct for the infrastructure paradigm. This means that tools will emerge to manage all these pieces in a centralized and holistic way.
IG for Mobile Computing
Stanford University’s guidelines are a helpful foundation for IG of mobile devices. They are “relatively easy to implement and use and can protect your privacy” and safeguard data “in the event that the device becomes compromised, lost or stolen.” 13
Smartphones and Tablets ■ Encrypt communications. For phones that support encrypted communication
(secure sockets layer [SSL], virtual private network [VPN], hypertext transfer protocol secure [https]), always confi gure defaults to use encryption.
■ Encrypt storage. Phones approved to access confi dential information assets must encrypt their bulk storage with hardware encryption.
■ Password protect. Confi gure a password to gain access and or use the device. Passwords for devices that access confi dential information assets should be at least seven characters in length and use upper- and lowercase letters as well as some numerical characters. Passcodes should be changed every 30 days.
■ Timeout. Set the device so that it is locked after a period of idleness or timeout, perhaps as short as a few minutes.
■ Update. Keep all system and application patches up to date, including mobile OSs and installed applications. This allows for the latest security measures and patches to be installed to counter ongoing threats.
■ Protect from hacking. Phones approved to access confi dential and restricted data must not be jailbroken (hacked to gain privileged access on a smartphone us- ing the Apple iOS) or rooted (typically refers to jailbreaking on a smartphone running the Android OS). The process of rooting varies widely by device. It usually includes exploiting a security weakness in the fi rmware shipped from the factory. “‘Jailbreaking’ and ‘rooting’ removes the manufacturer’s protection against malware.”
■ Manage. Phones approved to gain access to confi dential information assets must be operating in a managed environment to maintain the most current security and privacy settings, and monitor use for possible attacks.
INFORMATION GOVERNANCE FOR MOBILE DEVICES 277
Portable Storage Devices These include thumb drives or memory sticks, removable hard drives, and even devices like iPods that are essentially mobile disc storage units with extra bells and whistles.
■ Create a user name and password to protect the device from unauthorized ac-d cess—especially if lost or stolen.
■ Utilize encryption to protect data on devices used to store and/or transport con- fi dential information assets.
■ Use additional levels of authentication and management for accessing the device,t where possible.
■ Use biometric identifi cation to authenticate users, where possible.
Laptops, Netbooks, Tablets, and Portable Computers ■ Password protect. This is the most basic protection, yet it is often not used. Cre-
ate a user name and password to protect the device from unauthorized access; require that they are entered each time the computer is used.
■ Timeout. Require that the password is reentered after a timeout period for the screensaver.
■ Encrypt. Laptops, notebooks, or tablets used to access confi dential information assets should be required to be encrypted with whole disk encryption.
■ Secure physically. Physical locks should be used “ whenever the system is in a station- ary location for extended periods of times.” s
Building Security into Mobile Applications
While it is a relatively new channel, mobile electronic commerce (e-commerce) is growing rapidly, and new software apps are emerging for consumers as well as business and public sector enterprises. These apps are reducing business process cycle times and making the organizations more agile, more effi cient, and more productive. Some key strategies can be used to build secure apps.
As is the case with any new online delivery channel, security is at the forefront for organizations as they rush to deploy or enhance mobile business apps in the fast- growing smartphone market. Their priorities are different from those of the software developers churning out apps.
In the banking sector, initially many mobile apps limited customers to a walled-off set of basic functions—checking account balances and transaction histories, fi nding a branch or automated teller machine location, and initiating transfers—but “a new wave of apps is bringing person-to-person payments, remote deposit capture and bill pay to the mobile channel. Simply, the apps are getting smarter and more capable. But with those capabilities comes the potential for greater threats”s 14 (emphasis added).
Security experts state that the majority of the challenges that could result from mobile fraud have not been seen before. Mobile e-commerce is relatively new and has not been heavily targeted—yet. But industrial espionage and the theft of trade secrets by targeting mobile devices is going to be on the rise and the focus of rogue competitive intelligence-gathering organizations. User organizations have to be even
278 INFORMATION GOVERNANCE
more proactive, systematic, and diligent in designing and deploying mobile apps than they did with Web-based apps.
Software developers of mobile apps necessarily seek the widest audience possible, so they often deploy them across multiple platforms, which forces some security trade- offs: Enterprises have to build apps for the “strengths and weaknesses intrinsic to every device, which adds to the security challenges”15 (emphasis added).
A side effect of mobile app development efforts from the user perspective is that it can reshape the way users interact with core information management (IM) applica- tions within the enterprise.
The back-offi ce IM systems, such as accounting, customer relationship manage- ment, human resources, and other enterprise apps that are driving online and mobile, are the same as before, but the big difference comes in how stakeholders (employees, customers, and suppliers) are interacting with the enterprise. In the past, when deploy- ing basic online applications for browser access, there was much more control over the operating environment; with newer mobile applications running on smartphones and tablets, that functionality has been pushed out to end user devices.
Real Threats Are Poorly Understood
The list of threats to mobile apps is growing, and existing threats are poorly under- stood, in general. They are just too new, because mobile commerce by downloadable app is a relatively new phenomenon—the Apple iTunes App Store and the Android Marketplace debuted in the second half of 2008. “But that doesn’t mean the threat isn’t real—even if the app itself is not the problem.” 16 The problem could be the unsecure network users are on or a device infection of some sort.
For mobile apps, antivirus protection is not the focus as it is in the PC world; the security effort mostly focuses on keeping malware off the device itself by addressing software development methods and network vulnerabilities. Surely, new types of at- tacks on mobile devices will continue to be introduced. That is the one thing that can be counted on.
There already have been some high-profi le examples of mobile devices being compromised. For example, in 2010:
New York–based Citibank’s iPhone app was found to be storing customers’ [private] data on their phones, with obvious privacy implications [and expos- ing it to theft and fraud]. Meanwhile, Google (New York) has had to pull a number of apps from the Android Marketplace built by an anonymous [crim- inal] developer who was creating fake bank apps [with realistic and usable features] that attempted to exploit information on users’ devices to commit banking and [credit] card fraud.
There are many more examples, but the cited incidents make it imperative to understand the mobile app marketplace itself in order that effective IG policies and controls may be developed, deployed, and enforced. Simply knowing how Google has approached soliciting app development is key to developing an IG strategy for Android devices. Google’s relatively open-door approach initially meant that almost anyone could develop and deploy an app for Google Android. Although the policy has evolved somewhat to protect Android users, it is still quite easy for any app developer—well
INFORMATION GOVERNANCE FOR MOBILE DEVICES 279
intentioned or malicious—to release an app to the Android Marketplace. This in itself can pose a risk to end users, who sometimes cannot tell the difference between a real app released by a bank and a banking app built by a third party, which may be fraudulent. Apple has taken a more prudent and measured approach by enforcing a quality-controlled approval process for all apps released to its iTunes App Store. Sure, it slows development, but it also means apps will be more thoroughly tested and secure.
Both approaches have their positives and negatives the companies and for the de- vice users. But clearly, Apple’s curated and quality-controlled approach is better from a security risk standpoint.
Understanding the inherent strengths and, perhaps more important, weaknesses of specifi c mobile hardware devices and OS—and their interaction with each other— is key when entering the software design phase for mobile apps.
The development environment is altogether different. Windows programmers will experience a learning curve. Mobile apps under Android or Apple OS operate in a more restricted and less transparent fi le management environment.
Bearing that in mind—regardless of the mobile OS—fi rst ensure that data is secured, — and then check the security of the application itself. That is, practice good IT governance to ensure that the software source code is also secure. Malicious code can be inserted into the program; once it is deployed, hackers will have an easy time stealing confi dential data or documents.
Innovation versus Security: Choices and Trade-offs
As organizations deploy mobile apps, they must make choices, given the limited or confi ned software development environment and the need to make agile, intuitive apps that run fast so users will adopt them. To ensure that a mobile offering is secure, many businesses are limiting their apps’ functionality. So stakeholder users get mobile access that they didn’t have before and a new interface with new functionality, but it is not possible to offer as much functionality as in Web apps. And more security means some sacrifi ces and choices will need to be made versus speed and innovative new features.
Some of the lessons learned in the deployment of online Web apps still apply to mobile apps. Hackers are going to try social engineering like phishing (duping users into providing access or private information) and assuming the identity of an account holder, bank, or business. They will also attempt man-in-the-middle attacks. (More on that topic soon).
With mobile applications, typically the app is operated directly on a mobile de- vice, such as a smartphone. This is a key difference between apps and traditional PC-based interfaces that rely on browser access or using basic mobile phone text messaging. Connect- ing to a business via app can be more secure than relying on a browser or texting platform, which require an additional layer of software (e.g., the browser, texting platform, or Wi-Fi connection) to execute sensitive tasks. These security vulnerabili- ties can compromise the safety of information transmitted to a secure site. Thank- fully, if the app is developed in a secure environment, it can be entirely self-contained, and the opportunity to keep mobile data secure is greatest when using the app as opposed to a browser-based platform.
This is because a mobile app provides a direct connection between the user’s de- vice and the business, governmental agency, or e-commerce provider. Some security experts believe that mobile apps potentially could be more secure than browser-based
280 INFORMATION GOVERNANCE
access from the desktop because they can communicate on an app-to-app (or comput- er-to-computer) level.
In fact, “a customer using a bank app on a mobile network might just be safer than a customer accessing online banking on a PC using an open Wi-Fi connection” that anyone can monitor.
How do you combat this browser-based vulnerability if it is required to access an online interface? The most effective and simplest way to counter security threats in the PC- based browser environment and to eliminate man-in-the-browser or man-in-the-middle r attacks is to use two different devices rather than communicate over a standard Internet s connection. This approach can be built into IG guidelines.
Consider this: Mobile apps actually can bring about greater security. For exam- ple, do you receive alerts from your bank when hitting a low-balance threshold? Or a courtesy e-mail when a transaction is posted? Just by utilizing these types of alerts—and they can be applied to any type of software application beyond bank- ing—tech-savvy users themselves can serve as an added layer of protection. If they receive an alert of account activity regularly, they may be able to identify fraudulent activity immediately and take action to counter it and stop it in its tracks, limiting the damage and potential exposure of additional private data or confi dential infor- mation assets.
Best Practices to Secure Mobile Applications
Mobile computing is not going away; it is only going to increase in the future. Most businesses and governments are going to be forced to deploy mobile apps to compete and provide services customers will require. There is the potential for exposure of confi dential data and e-documents, but this does not mean that organizations must shy away from deploying mobile apps. 17 Some proven best practice approaches can help to ensure that mobile apps are secure.
Some steps can be taken to improve security—although there can never be any guarantees— and some of these should be folded into IG guidelines in the policy de- velopment process. BankTech magazine identifi ed six best practices that can shape an organization’s app development process:
1. Make sure your organization or outside development fi rm uses seasoned application developers who have had secure-coding training and use a se- cure software development life cycle (SDLC).
2. [Developed for banking apps, this approach can be applied to other vertical apps too.] Follow the guidance suggested by the Federal Deposit Insur- ance Corp. (FDIC FIL-103-2005) regarding authentication in an Inter- net banking environment. The guidance describes enhanced authentication methods, such as multifactor authentication, that regulators expect banks to use when authenticating the identity of customers using the bank’s online products and services.
3. Make sure that the customer (or employee) is required to re-enter his or her credentials after a certain time period to prevent someone other than the mo-d bile device’s owner from obtaining access to private account information.
INFORMATION GOVERNANCE FOR MOBILE DEVICES 281
4. Hire an information security expert to assess the security around your mobile t application servers. Unfortunately, an organization’s servers are often over- looked during a risk assessment, as they require a specialized skill set to test d them.
5. Encrypt sensitive data that is stored on a mobile device and account data that travels from the handset across the Internet. Ensure that the encryption is implemented properly.
6. Hire a security expert to test the security of a mobile application before you implement it across your customer base. 18 (Emphasis added throughout.)
Developing Mobile Device Policies
Where do you start? Developing a comprehensive mobile strategy is key before you craft your mobile device policies. You will need input from a variety of stakeholders, and you will need to understand where mobile devices fi t in your overall technology infrastructure and strategy. Here are some best practices for developing your mobile device policies.
1. Form a cross-functional mobility strategy team. You will need the input of primary stakeholder groups, including IT, fi eld business units, and human resourc- es (for policy creation and distribution). Your strategy development process should also tap into the expertise of your risk management, compliance, re- cords management, and legal departments. The aim will be to balance risks and benefi ts to improve employee productivity and guard against risk while focusing on the goals and business objectives of the organization. 19
2. Clarify goals for your mobile strategy. Start your discussion with the big picture, the “30,000 foot view” of the business drivers, challenges, threats, and op- portunities that mobile computing provides in today’s technology context and your business context. Draw a direct line from your mobile business needs to your planned mobile support strategy and infrastructure. Keep your business goals in mind and link them to the discussion.
3. Drill down into policy requirement details. You may want to survey other exist- ing mobile device policies to inform your mobility strategy team. Those from peer organizations and competitors will be most relevant. Then start with the basics: which types of devices and OS make sense for your organization to support, what changes and trends are occurring in the technology market- place, which sensitive e-documents and data you must protect (or disallow) on mobile devices, and what available security technologies (e.g. MDM, mobile VPNs, encryption, information rights management) you might deploy. It may be helpful to segment your mobile users into broad categories, and break out a list of their specifi c business needs related to mobile computing. Your strategy and policies for executives will be somewhat different than those for users in fi eld business units. And you will need BYOD policies if your organization opts to go this route.
4. Budgeting and expense control. Is the organization going buy devices and pay all mobile expenses through direct billing each month? What cost controls need
282 INFORMATION GOVERNANCE
to be in place? Or will mobile device use expenses be reimbursed by a fl at rate or by processing expense reports? What about BYOD? Roaming charge limits? Decisions on the fi nancial and cost control aspects of mobile comput- ing use must be made by your mobility policy team, under the guidance of an executive sponsor.
5. Consider legal aspects and liability issues. Consult your legal counsel on this. What key laws and regulations apply to mobile use? Where could users run afoul? What privacy and security issues are most prominent to consider? What about the private data that users may hold on their own (BYOD) devices? An overarching consideration is to maintain security for private information and to have a policy in place for data leaks and lost or stolen devices. That includes your policy on remote “wipes” of sensitive data or perhaps all data.l
6. Weigh device and data security issues. Since most mobile devices—especially smartphones—were not designed with security as a foremost consideration, you must take steps to protect your sensitive data and to secure the devices themselves without impeding business or making operation too diffi cult for the end user. The world of mobile computing presents new challenges that were not present when IT had full control of endpoint devices and internal networks. Clear mobile security policies and controls must be in place.
7. Develop your communications and training plan. Users must be apprised and re- minded of your mobile device policy if they are going to adhere to it. They also need to know the consequences of violating your policies. Your commu- nications and training plan should be creative—from wall posters to text and e-mail messages, from corporate newsletters to group training sessions. You may want to fi rst pilot your new policy with a small group of users. But com- munication and training are key: A perfect mobile device policy will not work if it is not communicated properly and users are not trained properly.
8. Update and fi ne-tune. There will be some misses, some places where after your deploy your mobile policy you fi nd room for improvement. You will receive user feedback, which should be considered too. And there will be changes in the technology marketplace and user trends. A program must be in place to periodically (every six months, perhaps) review your mobile device policy and any audit information to make improvements in the policy.
If your organization sanctions the use of mobile devices, you must have a clear, updated IG policy for their use, and you must be able to monitor, test, and audit com- pliance with the policy. Bear in mind that mobile devices are inherently unsecured and have many vulnerabilities, and you will have to consider possible security threats. If your organization plans to utilize a BYOD approach, your support for mobile de- vices will be more challenging and complex. Critical to success in leveraging mobile devices is training employees on your IG policy and policy updates and consistently reinforcing the message of cautiousness with confi dential company data. If you are us- ing mobile devices to conduct business, there will be business records that are created that must be captured and archived with their integrity and authenticity intact. All information on an employee’s smartphone or tablet is potentially discoverable in legal proceedings, so you must include your legal team in policy development and periodic updates. Mobile device use can allow for great productivity gains, but the gains come with associated risks.
INFORMATION GOVERNANCE FOR MOBILE DEVICES 283
Notes
1. CTIA, “Wireless Quick Facts,” www.ctia.org/advocacy/research/index.cfm/aid/10323 (accessed May 13, 2013).
2. Alan Joch, “How to Create an Effective Mobile Device Policy,” Biztech , www.biztechmagazine.com/ article/2013/03/how-create-effective-mobile-device-policy , March 26, 2013.
3. “Current Mobile Computing Calls for Security as Powerful as Titanium,” http://techreview.blogpool .co.uk/2011/02/10/modern-day-mobile-computing-calls-for-security-as-powerful-as-titanium (accessed March 30, 2012).
CHAPTER SUMMARY: KEY POINTS
■ The plethora of mobile computing devices fl ooding into the market will be one of the biggest ongoing security challenges moving forward.
■ An IDC report indicated that smartphone sales outpaced PC sales for the fi rst time ever in the fourth quarter of 2010.
■ As businesses work to deploy mobile apps, they walk a fi ne line between in- novation and risk. To ensure that a mobile offering is secure, many businesses are limiting their apps’ functionality.
■ Human beings remain the weakest link in security, particularly with the in- creasing use of mobile devices. IG policies must be established and employ- ees must be trained to be aware of security and privacy risks.
■ Connecting to a business directly via an app can be more secure than rely- ing on a browser or texting platform, which require an additional layer of software.
■ Over the next several years North America will be upgrading to 4G networks, faster WiMax will be deployed, and there will be 3G and 4G interoperability.
■ MDM software helps organizations to remotely monitor, secure, and manage devices such as smartphones and tablet PCs.
■ There will be new enhanced security and antivirus products developed to combat the increasing threat of cyberattacks.
■ Mobile computing security challenges require that organizations follow best practices when developing and deploying apps. Some keys are: encrypting sensitive data, using the secure software development life cycle (SDLC) meth- odology and enhanced authentication methods, and hiring a security expert to test new apps.
■ Develop a comprehensive mobile strategy before you craft your mobile de- vice policies. You will need input from a variety of stakeholders, and you will need to understand where mobile devices fi t in your overall technology infrastructure and strategy.
284 INFORMATION GOVERNANCE
4. Warwick Ashford, “Mobility among the Top IT Security Threats in 2011, Says UK Think Tank,” Computer Weekly , January 7, 2011, www.computerweekly.com/Articles/2011/01/07/244797/Mobility- among-the-top-IT-security-threats-in-2011-says-UK-think.htm (accessed March 30, 2012).
5. Ann All, “Mobile Device Management: 6 Trends to Watch,” eSecurity Planet , www.esecurityplanet.com/t mobile-security/mobile-device-management-6-trends-to-watch.html (accessed February 8, 2013).
6. Matt Gunn, “How to Build a Secure Mobile App,” Bank Systems and Technology , July 6, 2011, www .banktech.com/risk-management/231001058?itc=edit_stub (accessed December 19, 2011).
7. “Top Ten Trends in Mobile Computing,” CIO Zone , www.ciozone.com/index.php/Editorial-Research/ Top-Ten-Trends-in-Mobile-Computing/2.html (accessed December 19, 2011).
8. Stanford University, “Guidelines for Securing Mobile Computing Devices,” www.stanford.edu/group/ security/securecomputing/mobile_devices.html (accessed December 19, 2011).
9. Symantec, “Business Challenge: Mobile Device Management,” www.symantec.com/mobile-device- management (accessed May 14, 2013).
10. All, “Mobile Device Management: 6 Trends to Watch.” 11. Vikrant Gandhi, “U.S. Mobile Device Management (MDM) Market,” October 4, 2012, www.frost
.com/sublib/display-report.do?ctxixpLink=FcmCtx1&searchQuery=mdm&bdata=aHR0cDovL3d3d y5mcm9zdC5jb20vc3JjaC9jYXRhbG9nLXNlYXJjaC5kbz9xdWVyeVRleHQ9bWRtQH5AU2Vhc- mNoIFJlc3VsdHNAfkAxMzYwMzI5NTg4NTc5&ctxixpLabel=FcmCtx2&id=NB29-01-00-00-00
12. All, “Mobile Device Management: 6 Trends to Watch.” 13. Quotes in this section are from Stanford University, “Guidelines for Securing Mobile Computing
Devices.” www.stanford.edu/group/security/securecomputing/mobile_devices.html 14. Quotations in this section are from Matt Gunn, “How to Build a Secure Mobile App,” Bank Systems
and Technology , July 6, 2011, www.banktech.com/risk-management/231001058?itc=edit_stub (accessed March 30, 2012).
15. Ibid. 16. Ibid. 17. Beau Woods, “6 Ways to Secure Mobile Apps,” Bank Systems and Technology , May 26, 2011, www
.banktech.com/architecture-infrastructure/229700033 (accessed March 30, 2012). 18. Ibid. 19. Joch, “How to Create an Effective Mobile Device Policy.”
285
Information Governance for Cloud Computing*
C H A P T E R 15
By Monica Crocker CRM, PMP, CIP, and Robert Smallwood
* Portions of this chapter are adapted from Chapter 12 , Robert F. Smallwood, Managing Electronic Records: Methods, Best Practices, and Technologies , © John Wiley & Sons, Inc., 2013. Reproduced with permission of John Wiley & Sons, Inc.s
C loud computing represents one of the most signifi cant paradigm shifts in infor- mation technology (IT) history. It may have evolved as an extension of sharing an application-hosting provider, which has been around for a half century and
was common in highly regulated vertical industries, such as banks and health care institutions. But cloud computing is a very different computing resource, utilizing advances in IT architecture, system software, improved hardware speeds, and lower storage costs.
The impetus behind cloud computing is that it provides economies of scale by spreading costs across many client organizations and pooling computing resources while matching client computing needs to consumption in a fl exible, (nearly) real- time way. Cloud computing can be treated as a utility that is vastly scalable and can be readily modulated, just as the temperature control on your furnace regulates your energy consumption. This approach has great potential, promising on-demand computing power, off-site backups, strong security, and “innovations we cannot yet imagine.”1
When executives hear of the potential cost savings and elimination of capital outlays associated with cloud computing, their ears perk up. Cloud deployments can give users some autonomy and independence from their IT department, and IT departments are enthused to have instant resources at their disposal and to shed some of the responsibilities for infrastructure so they can focus on business applica- tions. Most of all, they are excited by the agility offered by the on-demand provision- ing of computing and the ability to align IT with business strategies more nimbly and readily.
But for all the hoopla and excitement, there are also grave concerns about security risks and loss of direct IT control , which call for strict information governance (IG) policies andl processes. Managers and IT leaders who are customers of cloud computing services are ultimately responsible for IT performance. A number of critical IG challenges as- sociated with cloud computing must be addressed. These include privacy and security issues, records management (RM) issues, and compliance issues, such as the ability to
286 INFORMATION GOVERNANCE
respond to legal discovery orders. In addition, there are metadata management and custody challenges to consider. An investigation and analysis of how the cloud services provider(s) will deliver RM capability is crucial to supporting IG functions, such as archiving and e-discovery, and meeting IG policy requirements.
Organizations need to understand the security risks of cloud computing, and they must have IG policies and controls in place for leveraging cloud technology to manage electronic information before moving forward with a cloud computing strategy.
Defi ning Cloud Computing
The defi nition of cloud computing is, rather, well, g cloudy , if you will. The fl urry of developments in cloud computing makes it diffi cult for managers and policy makers to defi ne it clearly and succinctly, and to evaluate available options. Many misconceptions and vagaries surround cloud computing. Some misconceptions and questions include:
■ “That hosting thing is like SaaS” ■ “Cloud, SaaS, all the same, we don’t own anything” ■ “OnDemand is Cloud Computing” ■ “ASP, Hosting, SaaS seems all the same” ■ “It all costs the same so what does it matter to me?” ■ “Why should I care if it’s multi-tenant or not?” ■ “What’s this private cloud versus public cloud?” 2
Cloud computing is a shared resource that provides dynamic access to computing services that may range from raw computing power, to basic infrastructure, to fully operational and supported applications.
It is a set of newer information technologies that provides for on-demand, modu- lated, shared use of computing services remotely. This is accomplished by telecom- munications via the Internet or a virtual private network (which may provide more security). It eliminates the need to purchase server hardware and deploy IT infrastruc- ture to support computing resources and gives users access to applications, data, and storage within their own business unit environments or networks. 3 Perhaps the best feature of all is that services can be turned on or off, increased or decreased, depending on user needs.
There are a range of interpretations and defi nitions of cloud computing, some of which are not completely accurate. Some merely defi ne it as renting storage space or applications on a host organization’s servers; others center defi nitions around Web- based applications like social media and hosted application services.
Someone has to be the offi cial referee, especially in the public sector. The Na- tional Institute of Standards and Technology (NIST) is the offi cial federal arbiter of
“Cloud computing encompasses any subscription-based or pay-per-use service that, in (near) real time over the Internet, extends IT’s existing capabilities.”
INFORMATION GOVERNANCE FOR CLOUD COMPUTING 287
defi nitions, standards, and guidelines for cloud computing. NIST defi nes cloud com- puting as:
a model for enabling convenient, on-demand network access to a shared pool of confi gurable computing resources (e.g., networks, servers, storage, applica- tions, and services) that can be rapidly provisioned and released with minimal management effort or service provider interaction. 4
NIST has offered its offi cial defi nition, but “the problem is that (as with Web 2.0) everyone seems to have a different defi nition.” 5 The phrase “the cloud” has entered the mainstream—it is promoted on prime-time TV—but its meaning and description are in fl ux: that is, if you ask 10 different people to defi ne it, you will likely get 10 dif- ferent answers. According to Eric Knorr and Galen Gruman in InfoWorld, it’s really just “a metaphor for the Internet,” but when you throw in “computing” alongside it, “the meaning gets bigger and fuzzier.” Cloud computing provides “a way to increase capacity [e.g., computing power, network connections, storage] or add capabilities dy- namically on the fl y without investing in new infrastructure, training new personnel, or licensing new software. Cloud computing encompasses any subscription-based or pay-per-use service that, in (near) real time over the Internet, extends IT’s existing capabilities.” 6
Given the changing nature of IT, especially for newer developments, NIST has stated that the defi nition of cloud computing “is evolving.” People looking for the lat- est offi cial defi nition should consult the most current defi nition available from NIST’s Web site at www.nist.gov (and other resources).
Key Characteristics of Cloud Computing
NIST also identifi es fi ve essential characteristics of cloud computing:
1. On-demand self-service. A [computing] consumer can unilaterally provision computing capabilities, such as server time and network storage, as needed automatically without requiring human interaction with each service’s provider.
2. Broad network access. Capabilities are available over the network and accessed through standard mechanisms that promote use by heterogeneous thin or thick client platforms (e.g., mobile phones, laptops, and PDAs [personal digi- tal assistants]).
3. Resource pooling. The [hosting] provider’s computing resources are pooled to serve multiple consumers using a multi-tenant model, with different physi- cal and virtual resources dynamically assigned and reassigned according to
Cloud computing enables convenient, on-demand network access to a shared pool of confi gurable computing resources that can be rapidly provisioned.
288 INFORMATION GOVERNANCE
consumer demand. There is a sense of location independence in that the customer generally has no control or knowledge over the exact location of the provided resources but may be able to specify location at a higher level of abstraction (e.g., country, state, or datacenter). Examples of resources include storage, processing, memory, network bandwidth, and virtual ma- chines.
4. Rapid elasticity. Capabilities can be rapidly and elastically provisioned, in some cases automatically, to quickly scale out, and rapidly released to quickly scale in. To the consumer, the capabilities available for provisioning often appear to be unlimited and can be purchased in any quantity at any time.
5. Measured service. Cloud systems automatically control and optimize resource use by leveraging a metering capability at some level of abstraction appro- priate to the type of service (e.g., storage, processing, bandwidth, and active user accounts). Resource usage can be monitored, controlled, and reported, providing transparency for both the provider and consumer of the utilized service.7
What Cloud Computing Really Means
Cloud computing growth is expected to continue to climb dramatically. A recent Gart- ner study shows that the United States is the leader in adopting cloud computing, and the market is expanding rapidly. 8 The cloud computing market is expected to grow 21 percent annually from 2012 to 2016, exceeding $16 billion in 2014 and growing to over $22 billion in 2016. 9
The use of service-oriented architecture —which separates infrastructure, ap- plications, and data into layers—permeates enterprise applications, and the idea of loosely coupled services running on an agile, scalable infrastructure may eventually “make every enterprise a node in the cloud.” That is the direction the trend is headed.
A common misconception is that an organization “moves to the cloud.” In reality, the organization may decide to transition some specifi c business applications to the cloud. Those specifi c business applications are selected because a cloud architecture may offer crucial functions that the internally hosted solution does not or because the internal solution is burdensome to maintain. Some examples of business applications that frequently are moved to the cloud include advertising, collaboration, e-mail, of- fi ce productivity applications, sales support solutions, customer response systems, fi le storage, and system backups.
Another common misconception is that if your organization does not decide to migrate to a cloud solution, you are protected from all the dangers of cloud computing. The hard facts are that, for the vast majority of organizations, users are already putting information in the cloud. They are simply using cloud solutions to compensate for
Among metatrends, “Cloud computing is the hardest one to argue with in the long term.”
INFORMATION GOVERNANCE FOR CLOUD COMPUTING 289
limitations of the current environment. They may be using Box.com to get at infor- mation when working remotely or Dropbox.com to share information with an outside business partner. Or they are using SkyDrive get to documents from their iPad. They may not even realize they have posted company information to a cloud environment, so they do not realize they violated any policy against doing that. To complicate mat- ters, they probably also left a copy of the information within your organization’s fi re- wall. Internal users might not realize they are not using the current version, and your records manager does not know another copy is fl oating around out there. This is completely ungoverned information in the cloud . The best defense against it is to deliver d solutions for those business needs so that users do not have to fi nd their own.
Cloud Deployment Models
Depending on user needs and other considerations, cloud computing services typically are deployed using one of four models, as defi ned by NIST:
1. Private cloud. This is dedicated to and operated by a single enterprise. This is a particularly prudent approach when privacy and security are key issues, such as in the health care and fi nancial services industries and also for sensitive gov- ernment or military applications and data. A private cloud may be managed by the organization or a third party and may exist on or off premises.
2. Community cloud. Think co-ops, nonprofi t organizations, and nongovernmen- tal organizations. In this deployment, the cloud infrastructure is shared by sev- eral organizations and supports a specifi c community that has shared concernss (e.g., mission, security requirements, policy, and compliance considerations). It may be managed by the organizations or a third party and may exist on or off premises.
3. Public cloud. Open to the public, this cloud can be maintained by a user group or even a fan club. In this case, “the cloud infrastructure is made available to the general public or a large industry group and is owned by an organization selling cloud services.”
4. Hybrid cloud. This utilizes a combined approach, using parts of the aforemen- tioned deployment models: private, community, and/or public. The cloud infrastructure is a “ composition of two or more clouds, (private, community, or public) that remain unique entities but are bound together by standardized
The idea of loosely coupled services running on an agile, scalable infrastruc- ture should eventually “make every enterprise a node in the cloud.”
There are four basic cloud computing models: private, public, community, and hybrid (which is a combined approach).
290 INFORMATION GOVERNANCE
or proprietary technology that enables data and application portability (e.g., cloud bursting for load-balancing between clouds)” (emphasis added). 11
Security Threats with Cloud Computing
Cloud computing comes with serious security risks—some of which have not yet been uncovered. In planning your cloud deployment, these risks must be borne in mind and dealt with through controls and countermeasures. Controls must be tested and audited, and the actual enforcement must be carried out by management. Key cloud computing security threats are discussed next, along with specifi c examples and reme- dial measures that can be taken (fi xes). The majority of this information and quotations are from the Cloud Security Alliance. 12
Information Loss
When information is deleted or altered without a backup, it may be lost forever. Information also can be lost by unlinking it from its indices, deleting its identifying metadata, or losing its encoding key, which may render it unrecoverable. Another way data/document loss can occur is by storing it on unreliable media. And as with any architecture—not just cloud computing—unauthorized parties must be prevented from hacking into the system and gaining access to sensitive data. In general, pro- viders of cloud services have more resources at their disposal than their individual clients typically have.
Examples ■ Basic operational failures, such as server or disk drive crashes. ■ Data center reliability, backup, and disaster recovery/business continuity issues. ■ Implementation of information purging without your approval (e.g., purging
all data over three years old without regard to your retention schedule or exist- ing legal holds).
The Fixes ■ Agreement by cloud provider to follow standard operating procedures for data
backup, archiving, and retention. ■ Standard procedures for information purges that require your signoff before
they are completed. ■ Check your insurance coverage. Are you covered for the costs or liability asso-
ciated with a breach or loss of information that is stored in the cloud? ■ Clear delineation of the process for notifying the client of a security breach or
data loss.
Cloud computing carries serious security risks—some of which have not yet been uncovered.
INFORMATION GOVERNANCE FOR CLOUD COMPUTING 291
Information Breaches
Many times damage to information is malicious, while other times damage is unintentional. Lack of training and awareness, for example, can cause an information user to accidentally compromise sensitive data. Organizations must have proactive IG policies that combat either type of breach. The loss of data, documents, and records is always a threat and can occur whether cloud computing is utilized or not.
But the threat of data compromise inherently increases when using cloud comput- ing, due to “the number of and interactions between risks and challenges which are either unique to cloud, or more dangerous because of the architectural or operational characteristics of the cloud environment.”
Examples ■ Lack of document life cycle security (DLS) technologies, such as data lossy
prevention (DLP) and information rights management (IRM) technologies. ■ Insuffi cient authentication, authorization, and audit controls to govern log-t
in access. ■ Ineffective encryption and software keys, including lost keys or inconsistent
encryption. ■ Security challenges related to persistent data or ineffective disposal methods. ■ Inability to verify disposal at the end of information lifecycle.
The Fixes ■ DLS implementation where needed to protect information from creation to
their fi nal disposition. ■ Strong encryption to protect sensitive data at rest, in use, and in transit. ■ IG policies for data and document security during the software application de-
sign phase as well as testing and auditing the controls for those policies during live operation.
■ Secure storage, management, and document destruction practices. ■ Contractual agreement by cloud service providers to completely delete data
before storage media are reused by other clients. ■ Check your insurance coverage. Are you covered for the costs or liability asso-
ciated with a breach or loss of information that is stored in the cloud? ■ Clear delineation of the process for notifying the client of a security breach or
data loss.
The Enemy Within: Insider Threats
Since the advent of the National Security Agency controversy and the slew of examples in the corporate world, the threat of the malicious insider is well known. “ This threat is amplifi ed for consumers of cloud services by the convergence of IT services and customers under
Lack of training on cloud use can lead to users compromising sensitive data.
292 INFORMATION GOVERNANCE
a single management domain, combined with a general lack of transparency into provider process and procedure” (emphasis added). It is important to understand your cloud pro-” vider’s security procedures for its employees: How are they screened? Are background checks performed? How is physical access to the building and data center granted and monitored? What are its remedial procedures for noncompliance?
When these security, privacy, and support issues are not fully investigated, it cre- ates an opportunity for identity thieves, industrial spies, and even “nation-state spon- sored intrusion. The level of access granted could enable such an adversary to harvest confi dential data or gain complete control over the cloud services with little or no risk of detection.”
Examples ■ A cloud provider’s employee steals information to give or sell to one of your
company’s competitors. ■ Inadequate screening processes (by your company or a cloud provider) can
result in the hiring of people with criminal records, granting them access to sensitive information.
■ A cloud provider’s subcontractor steals information to give or sell to one of your company’s competitors.
■ A cloud provider’s employee allows unauthorized access to data that your com- pany believes is secure in the cloud.
■ The physical cloud storage facility lacks security, so anyone can enter the build- ing and access information.
The Fixes ■ Implementation of DLP and IRM technologies and related technology sets at
all stages of DLS. ■ Assessment of suppliers’ practices and complete supply chain, especially those
services that are subcontracted. ■ Screening and hiring requirements (e.g., background checks) for employees as
part of contract with cloud provider. ■ Transparent policies regarding information security, data management, com-
pliance, and reporting, as approved by the client. ■ Clear delineation of the process for notifying the client of a security breach or
data loss.
Hacking and Rogue Intrusions
Although cloud computing providers, as a rule, invest heavily in security, they also can be the target of attacks, and those attacks can affect many client enterprises. Pro- viders of cloud infrastructure service (e.g., network management, computing power,
It is prudent to investigate the security and personnel screening processes of a potential cloud provider.
INFORMATION GOVERNANCE FOR CLOUD COMPUTING 293
databases, storage) offer their customers the illusion of unlimited infrastructure expan- sion in the form of computing, network resources, and storage capacity. Often this is coupled with a very easy sign-up process, free trials (even for anonymous users), and simple activation with a credit card. This is a boon to hackers who can assume multiple identities. Using these anonymous accounts to their advantage, hackers and spammers can engage in criminal operations while remaining elusive.
Examples ■ Cloud services providers have often unknowingly hosted malicious code,
including Trojan horses, keystroke loggers, bot applications, and other pro- grams that facilitate data theft. Recent examples include the Zeus botnet and InfoStealer.
■ Malware can masquerade as downloads for Microsoft Offi ce, Adobe PDFs, or other innocuous fi les.
■ Botnets can infect a cloud provider to gain access to a wide range of data, while leveraging the cloud provider’s control capabilities.
■ Spam is a perennial problem—each new countermeasure is met with new ways to sneak spam through fi lters to phish for sensitive data.
The Fixes ■ IG policies and monitoring controls must require tighter initial registration
and thorough user verifi cation processes. ■ IG policies and technologies to combat credit card fraud. ■ Total network monitoring, including deep content inspection. ■ Requirement that the cloud provider regularly monitor public blacklists to
check for exploitation.
Insecure Points of Cloud Connection
By their very nature, cloud computing solutions involve the movement of information. Information moves from a workstation in your network to the cloud, from the cloud to a mobile device user, from an external partner to the cloud and then to one of your workstations, and so on. Further, information may be moved automatically from an application in the cloud to an application you host internally and vice versa. The movement of information complicates the process of securing it, as it now must be protected at the point of origin, the point of receipt, on the device that transmits it, on the device that receives it and at all times when it is in transit.
An application programming interface (API) is a way of standardizing the con- nection between two software applications. APIs are essentially standard hooks that an application uses to connect to another software application—in this case, a system in
Easy sign-up procedures for cloud services mean that hackers can easily assume multiple identities and carry out malicious attacks.
294 INFORMATION GOVERNANCE
the cloud. System actions like provisioning, management, orchestration, and monitor- ing can be performed using these API interfaces.
It comes down to this: A chain is only as strong as its weakest link, so APIs must be thoroughly tested to ensure that all connections abide by established policy. Doing this will thwart hackers seeking work-arounds for ill intent as well as valid users who have made a mistake. It is possible for third parties to piggyback value-added services on APIs, resulting in a layered interface that is more vulnerable to security breaches.
Examples ■ Anonymous logins and reusable passwords can undermine the security of an
entire cloud community. ■ Unencrypted transmission or storage and unencrypted verifi cation allow suc-
cessful man-in-the-middle data theft. ■ Rigid basic access controls or false authorizations pose a threat. ■ Poor management, monitoring, and recording of cloud logins and activity
make it diffi cult to detect malicious behavior. ■ Weak APIs provide opportunities for data compromise. ■ Dependency on unregulated API interfaces, especially third-party add-ons, can
allow critical information to be stolen as necessary connections are made.
The Fixes ■ Utilization of multiple logon authentication steps and strong access controls. ■ Encryption of sensitive data during transmission. ■ More robust and secure API access control. ■ An understanding of the security model of cloud provider APIs and interfaces,
including any third-party or organization-created dependencies. ■ Understanding how the API impacts associated cloud usage.
Issues with Multitenancy and Technology Sharing
Basic cloud infrastructure is designed to leverage scale through the sharing of components. Despite this, many component manufacturers have not designed their products to function in a multitenant system. Newer architectures will evolve to address this issue.
In the meantime, virtual computing is often used, allowing for multiple instances of an operating system (OS) (and applications) to be walled off from others that are running on the same computer. Essentially, each instance of the OS runs indepen- dently, as if it were the only one on the computer. A “virtualization hypervisor me- diates access between guest operating systems and the physical compute resources” (like central processing unit processing power). Yet fl aws have been found in these hypervisors “that have enabled guest operating systems to gain inappropriate levels of control or infl uence on the underlying platform”—and therefore indirectly impact
APIs must be thoroughly tested to ensure they are secure and abide by policy.
INFORMATION GOVERNANCE FOR CLOUD COMPUTING 295
the other guest OSs running on the machine. To combat this, “security enforcement and monitoring” of all shared computing resources must be employed. Solid partitions between the guest OSs—known as compartmentalization—should be employed to en- sure that one client’s activities do not interfere with others running on the same cloud provider. Customers should never have access to any other tenant’s “actual or residualr data, network traffi c” or other proprietary data.
Examples ■ Joanna Rutkowska’s Blue Pill root technique, which describes how an unau-
thorized user could intercept data by using virtual hardware called a hypervisor. The Blue Pill would be undetectable as long as the host system was functioning properly. Rutkowska also developed a Red Pill, which could detect a Blue Pill hypervisor, allowing the owner to eliminate it.
■ Kostya Kortchinksy’s CloudBurst is another example of hypervisor exploitation.
The Fixes ■ Security IG that leverages best practices for installation, confi guration, moni-
toring, testing, and auditing of cloud computing resources. ■ Requirements for monitoring the computing environment for any rogue
intrusions or misuse of cloud resources. ■ Control and verifi cation of access. Promote a more secure two-factor authen-
tication procedure. ■ Enforceable service-level agreements (SLAs) for patching software bugs,
addressing data breaches, and fi xing vulnerabilities. ■ An IG policy that requires regular audits and evaluations to detect weaknesses
in cloud security and confi guration.
Hacking, Hijacking, and Unauthorized Access
Hacking into accounts to assume the identity of an authorized user has been happen- ing almost since personal e-mail existed. It can be as simple as stealing passwords with a keystroke logger. Attack methods such as social engineering (e.g., phishing), fraud by identity theft, and exploitation of software vulnerabilities are still effective at com- promising systems. Most people recycle a few passwords and reuse them for multiple accounts, so once one is breached, criminals can gain access to additional accounts. If login credentials are compromised, a hacker can monitor nearly everything your or- ganization is doing: A less passive hacker might alter or destroy sensitive documents, create false information, or replace your links with fraudulent ones that direct users to sites harboring malware or phishing scams. Once they have control, it can look like your organization is the origin of the malicious downloads or information capture. From here, the attackers can assume the good name and reputation of an organization to further their attacks.
Cloud providers use virtualization heavily and hypervisors may allow intrusions.
296 INFORMATION GOVERNANCE
Examples ■ Examples are widespread in the general population; however, no clear instances
of this occurring with cloud services providers are known (as this book goes to press).
The Fixes ■ IG policies should clearly state that users and providers should never reveal
their account information to anyone. ■ An IG policy should require more secure two-factor authentication techniques
to verify login identity, where possible. ■ Require your cloud services provider to actively monitor and log all activity
in order to quickly identify users engaging in fraudulent actions or those that otherwise fail to comply with the client’s IG policy.
■ Understand, analyze, and evaluate the cloud provider’s contract, especially re- garding security protocols. Negotiate improved terms in SLAs to improve or enhance security and privacy.
Who Are Your Neighbors?
Knowing your neighbors—those who are sharing the same infrastructure with you—is also important, and, as we all know, good fences make good neighbors. If the cloud services provider will not or cannot be forthcoming about who else is sharing its infra- structure services with your organization and this becomes a signifi cant issue, you may want to insert contract language that forbids any direct competitor from sharing your servers. These types of terms are always diffi cult to verify and enforce, so moving to a private cloud architecture may be the best option.
Examples ■ The Internal Revenue Service (IRS) utilized Amazon’s Elastic Compute Cloud
service. When the IRS asked Amazon for a certifi cation and accreditation (C&A) report, Amazon declined. (Note: The C&A process was developed to help ensure compliance with NIST standards and mandated by the Offi ce of Management and Budget, which oversees Federal Information Security Man- agement Act of 2002 compliance.)
■ Heartland, a payment processing corporation, suffered a data breach in 2008. Hackers stole account details for over 100 million credit and debit cards. This data was stored on Heartland’s network, which the hackers broke into using information (pertaining to employees, corporate structure, company networks, and related systems) it had stolen in the weeks leading up to the major breach.
It is important to know what other clients are being hosted with your cloud services provider, as they may represent a threat. Moving to a private cloud architecture is a solution.
INFORMATION GOVERNANCE FOR CLOUD COMPUTING 297
The Fixes ■ An IG policy that requires full disclosure of activity and usage logs, and related
information. Audit the policy for compliance. ■ Investigate the architecture of your cloud services provider (e.g., version levels,
network OSs, fi rewalls, etc.). ■ Robust and vigilant supervision, logs, and reporting of all system activity,
particularly requesting expansive and detailed reports on the handling of sensi- tive information.
Additional IG Threats and Concerns
A primary selling point of cloud computing is that enterprises are freed up to focus on their core business rather than being focused on providing IT services. Modulating computer hardware and software resources without making capital expenditures is an- other key advantage. Both of these business benefi ts allow companies to invest more heavily in line-of-business activities and focus on their core products, services, and operations. However, the security risks must be weighed against the fi nancial and operational advantages. Further complicating things is the fact that cloud deployments often are enthusiastically driven by advocates who focus inordinately on potential ben- efi ts and do not factor in risk and security issues. Additional examples of IG concerns are listed next.
■ Lack of clarity about who owns the information (and if that changes at any point). ■ Risk of association with any larger failures of the cloud provider. ■ Inability of the cloud services provider to manage records at the fi le level. ■ Inability to closely follow the user’s retention schedule and produce certifi cates of
destruction at the end of the information life cycle. This may result in informa- tion that is held for too long and ends up costing the client unnecessary expense if it is deemed to be responsive to litigation or other legal action.
■ Lack of RM functionality in many cloud-based applications. This problem is not unique to cloud platforms, but the key difference is that internal storage resource systems may have functionality that supports integration with a RM solution. It is unlikely that a cloud provider will provide the option of integrat- ing your in-house RM system with its system. Too many potential security, access control, and performance issues may result.
■ Inability to implement legal holds when litigation is pending or anticipated.s ■ Poor response time—inability to deliver fi les quickly and in line with user expectations. ■ Limited ability to ensure your cloud provider meets your duties to follow regulations
related to the governance of your information . ■ Jurisdiction and political issues that may arise due to the fact that the cloud
provider resides outside of the client’s geographic region. ■ Storage of personally identifi able information (PII) on servers in Europe or
other locales that prohibit or restrict the release of PII back to the United States (or s home country of the cloud services client organization). 13
An analysis of an organization’s exposure to risk must include checking on software t versions and revision levels, overall security design, and general IG practices. This includes updating software, tools, and policy, as needed.
298 INFORMATION GOVERNANCE
Finally, for each of these challenges, “IG policies and controls to secure informa- tion assets” and “IG policies and controls to protect the most sensitive documents and data” are a key part of the solution.
Benefi ts of the Cloud
The risks and security vulnerabilities of cloud computing have been reviewed in this chapter—so much so that perhaps some readers wondering whether cloud computing really is worth it. The answer is a qualifi ed yes—it can be, based on your organization’s d business needs and computing resource capabilities. Besides the obvious benefi t of getting your company out of the IT infrastructure business and back to focusing on its real business goals, there are many benefi ts to be gained from cloud computing solutions.
Some of the specifi c benefi ts offered by cloud computing solution are listed next.
■ Cloud computing solutions provide a means to support bring-your-own-device (BYOD) initiatives. As long as users have an Internet browser and Internet connectivity, they can use any device to access an application deployed in the cloud.
■ Your workers need to be able to access corporate information via a mobile device. Some cloud solutions allow them to access information stored in a secure location that only requires a smart phone and a login. Some of these solutions can even ensure that the information is not actually stored on the device itself. Entire applications, such as expense reporting, can be deployed this way and incorporate mobile capture technology as well.
■ Cloud computing solutions provide a mechanism to support collaboration with external business partners. You need to exchange information with an outside business partner in a manner that e-mail just will not support. For instance, you want to create one copy of the information that anyone on your team or on a business partner’s team can access and that refl ects any updates or changes on an ongoing basis. Or you need to exchange fi les that are large or in a format that is prohibited by your e-mail servers. And you do not want to grant part- ners access to information within your fi rewall and they do not want to grant you access to information within theirs. A third-party cloud-based fi le-sharing solution may provide the answer. You can post fi les there, partners can access them, you can update them as necessary, and everyone always has access to the most current version of the information without compromising security to your network.
■ A cloud fi le storage solution provides a better alternative to remote infor- mation access than having users copy information to unsecured removable media or send an e-mail to their personal e-mail account. Again, it prevents duplication of information, provides access to the most current version of information, and stores information in an environment that only authenti- cated users can access.
■ Cloud computing solutions also can form a key part of your organization’s disaster recovery/business continuity strategy. If your data center is rendered inoperable, users still can access applications and information hosted by cloud
INFORMATION GOVERNANCE FOR CLOUD COMPUTING 299
providers. Most cloud providers have redundant data centers so that even if one of their data centers was affected by the same incident that rendered your data center inaccessible, all your information is available. Many organizations deploy solutions to back up their in-house applications to a cloud-based storage provider for just this reason. It is a way to provide geographic diversifi cation.
The business benefi ts of cloud computing may largely outweigh the security threats for the vast majority of enterprises, so long as they are anticipated and the preventive actions described are taken.
Managing Documents and Records in the Cloud
The National Archives and Records Administration has established guidelines for cre- ating standards and policies for managing an organization’s e-documents records that are created, used, or stored in cloud computing environments.
1. Include the Chief Records Management Offi cer and/or lead RM staff in the planning, development, deployment, and use of cloud computing solutions.
2. Defi ne which copy of records will be declared as the organization’s record copy and manage these in accordance with information governance poli- cies and regulations. . . . Remember, the value of records in the cloud may be greater than the value of any other set because of indexing or other reasons. In such instances, this added value may require designation of the copies as records.
3. Include instructions for determining if records in a cloud environment are covered under an existing records retention schedule.
4. Include instructions on how all records will be captured, managed, re- tained, made available to authorized users, and retention periods applied.
5. Include instructions on conducting a records analysis, developing and sub- mitting records retention schedules to an organization’s central records department for unscheduled records in a cloud environment. These instructions should include scheduling system documentation, metadata, and related records.
6. Include instructions to periodically test transfers of records to other environments, including departmental servers, to ensure the records remain portable.
7. Include instructions on how data will be migrated to new formats, operating systems, etc., so that records are readable throughout their entire life cycles. Include in your migration planning provisions for transferring permanent records in the cloud to central records.
8. Resolve portability and accessibility issues through good records man- agement policies and other data governance practices. Data governance typically addresses interoperability of computing systems, portability of data (able to move from one system to another), and information security
300 INFORMATION GOVERNANCE
and access. However, such policies by themselves will not address an organization’s compliance and information governance demands and requirements.14
IG Guidelines for Cloud Computing Solutions
A set of guidelines aimed at helping you leverage cloud computing in a way that meets your business objectives without compromising your IG profi le is presented next.
1. As with any technology implementation, it is critical that you defi ne your business objectives fi rst, then select the provider that best meets your busi- ness objectives—provided, of course, it can meet your IG requirements. This is consistent with applying a proven IT project management methodology to the initiative. Even though the solution may reside outside your environment, the same basic phases for your project approach still apply, especially for those tasks related to documentation.
2. As part of the project documentation, make sure to identify roles and respon- sibilities related to the system in at least the same level of detail you do fort internally supported systems (preferably in more detail).
3. The biggest deviation from your standard approach is the need to incorporate the investigation and application of the appropriate fi xes described in the “Se- curity Threats with Cloud Computing” section into your project plan. Again, as with any service contract, it is helpful to involve a good contract negotiator. The contract negotiation phase is when you have the most infl uence with your provider. Therefore, you have the greatest chance of mitigating potential risks and optimizing the benefi ts if you can incorporate specifi c requirements into the contract language.
4. If the cloud computing paradigm is relatively new to your organization, try to fi gure out approaches to issues and high-level processes that can be reused in subsequent cloud computing projects. For instance, during the course of your project, you need to fi gure out:
■ How to migrate information, including metadata, to the cloud solution. ■ How to get your information, including metadata, back if you quit using
that solution. ■ How to implement a legal hold.
Utilizing cloud computing resources provides an economic way to scale IT resources which allows more focus on core business operations. It can render signifi cant business benefi ts, but its risks must be carefully weighed, and specifi c threats must be coun- tered, in the context of a long-range cloud deployment plan.
Most cloud services providers do not have mass content migration or RM capabilities.
INFORMATION GOVERNANCE FOR CLOUD COMPUTING 301
Notes
1. Cloud Security Alliance, “Top Threats to Cloud Computing V1.0,” March 2010, https://cloudsecurity- alliance.org/topthreats/csathreats.v1.0.pdf , p. 6.
2. R. “Ray” Wang, “Tuesday’s Tip: Understanding the Many Flavors of Cloud Computing and SaaS,” March 22, 2010, http://blog.softwareinsider.org/2010/03/22/tuesdays-tip-understanding-the-many- fl avors-of-cloud-computing-and-saas/ .
3. NARA Bulletin 2010-05, “Guidance on Managing Records in Cloud Computing Environments,” September 8, 2010, www.archives.gov/records-mgmt/bulletins/2010/2010-05.html .
4. Peter Mell and Tim Grance, “NIST Defi nition of Cloud Computing,” Version 15, 10-07-09, www.nist .gov/itl/cloud/upload/cloud-def-v15.pdf (accessed December 12, 2013).
5. Knorr and Gruman, “What Cloud Computing Really Means.” 6. Ibid. 7. Mell and Grance, “NIST Defi nition of Cloud Computing.” 8. Gartner Press Release, “Gartner Says Worldwide Public Cloud Services Market to Total $131 Billion,”
February 28, 2013, www.gartner.com/newsroom/id/2352816 (accessed October 11, 2013). 9. This and the next quotes in this section are from Louis Columbus, “451 Research: Cloud-Enabling
■ Cloud computing represents a paradigm shift in computing capabilities. It can streamline operations and cut costs but because it also has inherent risks, a well-researched and documented IG policy is needed.
■ Organizations need to understand cloud computing’s security risks and for- mulate IG policies and controls before deploying it.
■ Organizations are rapidly moving applications and storage to the cloud. Cloud computing allows users to access and use shared data and computing services via the Internet or a VPN.
■ Five key characteristics of cloud computing are: (1) on-demand self-service, (2) broad network access, (3) resource pooling, (4) rapid elasticity, and (5) measured service.
■ Cloud computing services typically are deployed using one of four models: (1) private cloud, (2) public cloud, (3) community cloud, and (4) hybrid cloud.
■ Utilizing cloud computing carries signifi cant security risks, which can be off- set by establishing IG policies and preventive measures so that the business benefi ts of agility and reduced cost may be exploited.
■ Cloud application services may have weaknesses related to supporting RM functions, such as: the inability to manage records at the fi le level; the inabil- ity to closely follow the user’s RM retention schedule, the inability to migrate data and documents to other platforms for preservation, and the inability to enforce legal holds when litigation is pending or anticipated.
CHAPTER SUMMARY: KEY POINTS
302 INFORMATION GOVERNANCE
Technologies Revenue Will Reach $22.6B by 2016,” September 26, 2013, http://softwarestrategies- blog.com/2013/09/26/451-research-cloud-enabling-technologies-revenue-will-reach-22-6b-by-2016/ (accessed October 11, 2013).
10. It’s a long-running trend with a far-out horizon. But among big metatrends, cloud computing is the hardest one to argue with in the long term. (emphasis added).
11. All defi nitions are from Mell and Grance, “NIST Defi nition of Cloud Computing.” 12. Cloud Security Alliance, “Top Threats to Cloud Computing V1.0.” 13. Gordon E. J. Hoke, CRM, e-mail to author, June 10, 2012. 14. NARA Bulletin 2010-05, “Guidance on Managing Records in Cloud Computing Environments.”
303
SharePoint® Information Governance*
C H A P T E R 16
By Monica Crocker, CRM, PMP, CIP, edited by Robert Smallwood
* Portions of this chapter are adapted from Chapter 14 , Robert F. Smallwood, Managing Electronic Records: Methods, Best Practices, and Technologies , © John Wiley & Sons, Inc., 2013. Reproduced with permission of John Wiley & Sons, Inc.s
M icrosoft’s SharePoint® server product dramatically altered the content and records management (RM) markets. Previous to SharePoint, solutions were somewhat cumbersome, managed large quantities of documents, and required
extensive implementation effort for each business application. SharePoint provided an enterprise level platform for the remaining small-volume, ad hoc solutions.
At a basic level, it is a collaboration platform, but it is often leveraged to be a con- tent repository as well. If properly implemented, SharePoint can reduce duplication of information, automate business processes, serve up a common lexicon for categorizing information, provide a social media platform, give users access to current and histori- cal e-documents, dramatically reduce network traffi c loads (by cutting the number of e-mails with attachments), and stop the growth of shared drives. It can also provide a secure platform to support bring-your-own-device (BYOD) mobile programs and other mobile solutions.
Given all its stated capabilities, SharePoint can be used to help organizations govern their information. But, in order to achieve those benefi ts, the implementing organization must take a structured approach to the deployment of its SharePoint environment. The 2006 amendment to the U.S. Federal Rules of Civil Procedure re- quire American organizations to produce any and all “electronically stored information that is relevant, not privileged, and reasonably accessible.” Similar legal requirements exist in Canada, the United Kingdom and Europe, Australia, and other developed countries. Information stored in SharePoint often is included in the “relevant” infor- mation that must be produced. So SharePoint should be deployed in a manner that makes all information contained within it fi ndable, accessible, securable by a legal hold notifi cation (LHN) and available for production in a timely manner.r
For SharePoint deployments, an ounce of prevention truly is worth a pound of cure. Since every SharePoint environment includes corporate information, organiza- tions can avoid a lot of headaches and future information governance (IG) risks if they invest time and deliberation in planning how they will deploy SharePoint. Theseg plans should be based on the business objectives for SharePoint that are tied to the
304 INFORMATION GOVERNANCE
organization’s overall business objectives and include making all the necessary IG policy decisions before rolling out the solution to users.
SharePoint itself is a tool; it is not a panacea for poor IG, and simply deploying it will not resolve business issues or compliance problems. When it comes to managing business records, “Like any RM solution, SharePoint alone will not solve your needs unless it is used to support clearly defi ned [business] processes.”1 Therefore, IG policy development and business process analysis are critical in the planning process.
SharePoint often is expected to perform content management and records man- agement, and also support e-discovery requests and legal holds. But sometimes, instead of solving records and IG problems, they become worse in an ungoverned SharePoint environment, since users often:
■ Do not understand which SharePoint content (documents, discussions, announcements, lists) should be managed as a record.
■ Are not clear on when or how to declare content a business record (and as a result make either everything a record or nothing a record).
■ Simply replicate their existing fi le share folder structure, creating a new (often redundant) set of disorganized documents on SharePoint.
■ Do not know how to attach well-defi ned metadata to information to make it fi ndable in the long term.
■ Do not understand how to apply appropriate security restrictions to information.
The unacceptable result of this lack of governance is that, instead of being a plat- form that can positively transform business processes, SharePoint actually can make it more diffi cult for people to do their jobs. And if users decide that SharePoint is actually t making their work harder, they will begin to revert back to old, familiar (disorganized) ways of managing their information. In other words, they may continue to keep du- plicate documents on their local C drives, go back to their existing shared drives, and keep sharing information by attaching documents to e-mails.
The SharePoint governance model should make it clear where and how users should both store and fi nd information. A well-governed SharePoint environment pro- vides enough consistency in how information is categorized to support sorting and fi ltering of search results so that users can quickly narrow results to the specifi c infor- mation or documents they need.
But keep in mind that a SharePoint governance model needs to be tailored to your organization. It will not work if it does not fi t with your culture, technology standards, and staffi ng resources.
There is no such thing as one set of SharePoint governance best practices that every orga- nization can adopt. Rather, developing a SharePoint governance model involves deter- mining the appropriate answer to a series of questions regarding your organization’s business goals, resource limitations and policy constraints. Once the initial plan is de- veloped, it should be validated against a broad sample of use cases for the system.
Process Change, People Change
As with any initiative that requires behavior change or additional effort, you will encounter resistance. The nature of the resistance will depend on the culture of your organization and the personalities of the individuals involved. Some of the
SHAREPOINT INFORMATION GOVERNANCE 305
SharePoint-specifi c objections you should be prepared to counter include the prem- ise that nothing in SharePoint is a record or that the very nature of SharePoint dictates that it should just be turned on and allowed to spread virally. Others are that “Users won’t follow those procedures” and “Governance is too much of a burden to the user.” And then, of course, there is all the standard user resistance to any system change implementation.
Too many organizations deploy SharePoint without putting the necessary effort t into planning how this technology tool will be governed. The result is similar to what is often found with e-mail or network shared drives —scattered information and docu-ss ments with no organization or governing policies. Only the situation is worse , because SharePoint has more types of content and quickly collects an even greater volume of information. At the highest level, all these types of content are part of SharePoint: sites, pages, libraries, and lists. And there are many subtypes within each of these content types. For instance, the list content type includes announcements, calendars, contacts, tasks, discussions, issues, surveys, and custom lists. And the site content type includes “MySites,” which allows users to store a vast array of content, including their own documents (which could be personal and/or work related) and social content, such as tags and ratings of content on other sites.
Another contributing risk factor for SharePoint is that, to a large degree, it is self- provisioned. This means that, while the environment typically is deployed by central information technology (IT) staff, business users usually are given the authority to cre- ate new repositories for information within that environment without IT intervention. This allows SharePoint to function as a dynamic collaboration platform.
Because of its nature, in an ungoverned SharePoint environment, you may have:
■ Information chaos because there is no way to identify who owns specifi c informa-s tion, no context for information, and no consistent organization or hierarchy to information.
■ Orphaned information , which results when the individual who understood the context of the information leaves the organization or when the site, page, list, or library is no longer in use.
■ Redundant information. If no one knows who should put what on SharePoint, t multiple users may upload the same new document to a dozen different loca- tions, and users have no way to identify the “authentic” version of a piece of information when multiples are found.
■ Unfi ndable information , which results when everyone decides for themselves how to secure a given piece of information and if and how to tag it with metadata. Then no one can fi nd anything outside the sphere of the information they con- trol or know if they have found everything in a search.
■ Noncompliant retention. The organization cannot apply any records retention periods to information if there is no means to determine which records series applies to specifi c information.
As with any initiative that requires behavior change or additional effort, you will encounter resistance when implementing a new SharePoint system.
306 INFORMATION GOVERNANCE
■ E-discovery risk. Ungoverned information limits the means to narrow the list of potentially responsive information, requiring the organization to fi nd and review a lot of information in response to an e-discovery request. t
■ Inappropriate use. Lack of governance means the organization is at risk from individuals or teams deciding to use SharePoint in a way that may not be ap- propriate or legally defensible.
In sum, lack of governance can signifi cantly diminish the business value and increase the risk of your SharePoint deployment.
This is more than a mess. It is a costly mess, because the organization is not achiev- ing the maximum business benefi t from SharePoint. Further, retrieving information during e-discovery for legal proceedings will be fraught with search and retrieval chal- lenges and will be more costly and less effi cient.
However, even if you have already started your SharePoint project or need to deploy before you feel your governance model is complete, you still can implement some IG strategies. That is, late is better than never, and gradual implementation of governance is better than none at all.
Where to Begin the Planning Process
As with any well-managed project, the fi rst step in a SharePoint deployment is to draft a project charter that defi nes the scope, budget, timeline, and business objectivesr for your s SharePoint environment.
The next step is to draft a project schedule that includes copious amounts of s time for the up-front planning effort necessary to create the SharePoint Governance Model. Have the project executive sponsor sign off on this timeline so that he orr she understands that the project will include time to think through key issues prior to deployment and why that is critical for your organization.
Then assemble your governance team. Include someone who understands the organization’s culture and the business objectives for SharePoint (such as a business analyst), someone who understands the technical aspects of SharePoint (like a system administrator), someone who understands the compliance aspects of SharePoint (such as a compliance offi cer, records manager, or legal counsel), and someone who can help
Lack of governance can signifi cantly diminish the business value and increase the risk of your SharePoint deployment.
Critical to success in SharePoint deployments is consulting with users about their processes and needs.
SHAREPOINT INFORMATION GOVERNANCE 307
implement the training and communications plan (perhaps from the human resources department). And, most important, make sure your governance team has the necessary authority level to determine the governance approach.
The SharePoint governance model planning process necessarily involves consulting with users about their collaboration, business process, document usage, and information s storage needs. If the governance structure interferes with their ability to do their jobs, users will start creating and storing documents without knowing what rules to follow, or why the rules exist, and they will fi nd their own work-arounds to satisfy their busi- ness requirements. For instance, if you restrict fi le size requirements too much, users still will store large fi les somewhere—perhaps unsecured in the cloud. If you do not allow certain fi le types and users need them, they will fi nd another place to store them where they might be diffi cult for other users to fi nd. And soon you will have all sorts of variations of folder and fi le systems and scattered documents and information, which results in the aforementioned information chaos scenario.
Regulatory and compliance factors also must be incorporated into SharePoint governance decisions for most organizations. Therefore, the process must include RM staff for guidance on crucial RM issues and legal staff for legal and compliance requirements.
Finally, create a formal SharePoint governance model “document.” Do not rely on meeting notes or design documents to refl ect the decisions made during governance discussions, though it may be valuable to keep those as a way to retain the reasoning and decision paths that led to the fi nal model. Governance decisions can be controversial, so the governance model selected should be explicitly stated in a dedicated document and offi cially “approved” by the appropriate stakeholders.
Begin at a High Level
Start from a high level, with strategy and corporate governance issues. Develop a problem statement in your project charter so that you know what you are trying to accomplish, and then develop measureable, time-constrained business objectives so progress and success toward milestones can be measured. Next, be sure to align these objectives with your organization’s overall vision statement or strategic plan. Aligning the technology with business considerations is key to a successful SharePoint deployment.
Governance decisions can be very controversial and require documentation.
First, develop a problem statement and formulate business objectives for the SharePoint deployment. Then align those objectives with your overall Strategic Plan.
308 INFORMATION GOVERNANCE
In order to identify specifi c business objectives for SharePoint, you may fi nd it useful to conduct some focus group sessions with thought leaders from across the organization. Some examples of questions you might ask are listed next:
■ How do you fi nd information owned by your unit? ■ How do you share information within your team? ■ How do you fi nd information owned by other units? ■ How do you share information with other teams? ■ How do you fi nd expertise to assemble a project team? ■ How do you fi nd expertise to perform a single task? ■ How do you exchange information with external business partners? ■ What processes are particularly painful? ■ How comfortable would you be sharing information with others in your unit?
With others outside your unit? ■ How would you like to connect with others in your organization?
Look for these themes in survey responses that might apply to your organization:
■ It is diffi cult to fi nd information without prior knowledge of its existence and location.
■ It is diffi cult to fi nd personnel resources with specifi c expertise (a subject matter expert ). t
■ It is diffi cult to determine whether a given piece of information is the current version.
■ The organization relies heavily on e-mail to create, share, and manage informa- tion. Therefore, the effort spent managing e-mail is burdensome.
■ Most document creation processes included review and approval steps among multiple users, which slow down critical business processes.
■ Users are struggling to fi nd a way to communicate outside their immediate work group, but they have strong motivation to do so.
■ It takes too long to onboard a new employee. ■ Users want solutions that provide seamless access for remote workers.
Understanding the organization’s current information management challenges al- lows the SharePoint governance team to identify business objectives for SharePoint and ensure that each individual governance decision supports accomplishment of the business objectives while at the same time supporting compliance with IG policy.
Once business objectives are formed, use them to defi ne the guiding principles for the SharePoint governance model. It is prudent to lay out the guiding principles early in the governance document, since they provide a framework for everything that follows. Decision categories that can help shape the guiding principles are:
■ Required or optional. Is this governance model a “mandated” approach or just “recommendations”? The answer must be clear to users, and enforcement ac- tions against violations must be taken if governance is mandated.
■ Appropriate use. What are the rules for SharePoint usage? For instance, you could declare that SharePoint is for business information only so that users know it is not OK to run their fantasy football league on a SharePoint site.
SHAREPOINT INFORMATION GOVERNANCE 309
■ Information access policy. Clarify your organization’s philosophy about access to information; is it open to every authenticated user by default, or is it strictly se- cured and available on a need-to-know basis only? As a compromise, sites could be open to all by default, with secured information as an exception.
■ Accountability. Who is accountable for information and managing governance at a site level?
■ Level of control. Clarify how tightly SharePoint will be managed. This might range from rigid control, where a typical user can publish only information that has gone through a review process; to “semicontrolled,” which permits superusers to create libraries and lists; to very loosely controlled, where site owners in the business are given complete site collections to manage according to their needs.
■ Information ownership. Since users come and go and site administrators are very often administrative staff with little authority, information ownership must be clearly defi ned (e.g., the responsibility of the manager or director of a business unit).
Each of these guiding principles should be linked to any appropriate organiza- tional policy or applicable law. In addition, they all should be linked to the business objectives for SharePoint. For instance, this could be a guiding principle:
Every site and page in SharePoint must have a clearly identifi ed owner and a backup owner.
This sets a standard for the project team to follow, which helps end users identify the authoritative copy of information and addresses the governance issue regarding orphaned content.
Establish Scope
After business objectives are formed and sharpened and guiding principles are es- tablished, determine the scope of the SharePoint deployment: Just where are the boundaries of information you are going to govern? Any governance model likely will cover sites and pages and documents. But will it also include specifi c types of content, such as calendar items, announcements, discussions, and lists? Which spe- cifi c documents will be governed in SharePoint (all/only those declared “records”/ only those that are fl agged as “fi nal”)? How will documents be managed in the different stages of their life cycle (delete anything that has not been modifi ed for a year/move anything declared fi nal to an archive)? How will your organization address e-discovery requirements? Which document and content types are not governed in SharePoint? For instance, some organizations govern down to the
Once business objectives are formed, use them to defi ne the guiding principles for the SharePoint governance model.
310 INFORMATION GOVERNANCE
“X” level (e.g., three levels deep in the site structure) but not below. Some choose to manage content on MySites while others simply impose a storage size limit on MySites.
These are the types of questions you should be asking, not only from an IG perspective but also to optimize future system performance of SharePoint. Better processes and fewer documents means faster performance when you are in the heat of the business battle.
Your governance model needs to address the two issues related to scope:
1. Describe the scope of SharePoint as a technology solution. In terms of the scope of SharePoint itself, document whether it is purely for internal use or whether it also includes external access, whether MySites are deployed, and which existing systems it was designed to replace, if applicable. Add any other information you can about what is included when you refer to “the SharePoint solution” in your organization, such as interfaces with other systems
2. Defi ne the scope of the governance model. In your description of the scope of the governance model, you should enumerate whether governance applies to all types of sites, all types of content, all users, or some subset of those; and who has the authority to change the scope of SharePoint governance.
Exactly what information will be stored and managed in SharePoint? And, of that,t which information or documents rise to the level of being records?
The selection criteria for storing information in SharePoint must be clear to all system us- ers and administrators. They need to know not only what fi le sizes are allowed but also what fi le formats are permitted—or prohibited—as well as size limits for lists, libraries, and the entire site itself.
Policy Considerations
You must determine how your organization’s IG policies relate to SharePoint. Micro- soft has structured SharePoint so that every piece of information is a “content type.” In addition, the tool allows you to confi gure RM policies/actions at various levels in the system; you can set them at a site collection level, a site level, a library or list level, or all the way down to the specifi c item level. Every particular instance of every content type could have a retention schedule and resulting actions associated with it, but that might be a lot of overhead for very little payback. What do you manage and what do you not manage? Examples of things you might not manage are work fl ow confi gurations, t views, searches, and page templates. Examples of things you probably want to manage are documents and lists.
Be sure to clearly state the selection criteria for storing information in SharePoint.
SHAREPOINT INFORMATION GOVERNANCE 311
Your IG policy section should answer these questions:
■ How is each type of content in SharePoint governed? ■ Who decides what gets governed? ■ At what point in the information’s SharePoint existence is a governance action
taken?
Any existing retention schedules must be translated into defensible disposition policies within your SharePoint environment. Finally, specifi c processes for managing business records must be established. s
For instance, if your SharePoint charter identifi ed “sharing administrative in- formation such as meeting agendas and minutes” as a primary objective of your deployment, you could create standard libraries for “administrative” documents on each division’s site, create an “administrative record” content type to categorize any document in that library, and associate the retention policy for that content to all those documents. This method would automate the purging of all administrative documents after the retention period has expired.
At some point in the SharePoint governance model document, you also need to address if and how you going to use document IDs and how major and minor versions of information are used and retained. For example, you could decide not to keep any previous versions of meeting agendas but to keep previous versions of policies for a number of years after they are superseded with new versions. The IG policy section is a good place for those items.
Roles and Responsibilities
Clear roles and their associated responsibilities for contributing to, maintaining, and utilizing the information in SharePoint must be established during the governance planning process. Only by spelling out who is responsible for what are you able to expect that your SharePoint environment will continue to follow the governance model.
Questions to ask with regard to defi nition of roles and responsibilities include these:
■ Who is the executive sponsor for the solution? ■ Who “owns” the system (and what does “ownership” entail)? ■ Who is the sponsor/steward for a specifi c site or site collection? ■ Who owns the information in the site? ■ Who is responsible for completing the initial deployment of a site or collection? ■ Who is responsible for day-to-day administration of the site? ■ Who defi nes and sets up various information architecture components, such as
content types, columns (metadata), and the term store (enterprise taxonomy)? ■ Who is responsible for controlling access to a site? For making changes to
security access as users’ roles change or as users are terminated? ■ Who will train super users and users initially? On an ongoing basis? ■ Who will contribute information? ■ Who will be allowed to view and/or edit information?
312 INFORMATION GOVERNANCE
Some examples of possible SharePoint roles within a given organization are listed next.
■ Executive sponsor ■ Information owner or “steward” for a site or site collection ■ Site owner ■ Site member ■ Site contributor ■ Site visitor ■ System administrator ■ Site collection administrator ■ Business analyst ■ Training, education, and user support ■ Information architect/taxonomist ■ IG representative
The roles and responsibilities section of the SharePoint governance model will need to describe how users can request a site and how they get support for their sites, including the support escalation process. For this purpose, a service-level agreement (SLA) that outlines the basic support levels, time frames, problem escalation processes, cost allocations, and other issues related to service is useful. Wherever possible, create an SLA and refer to it so that users have clear expectations regarding how long it will take them to get a new site or get support for an existing site.
Establish Processes
Guiding principles provide the “what” of SharePoint governance. Roles and responsibili- ties defi ne the “who.” The governance model, or a separate set of procedures referenced by the model, also needs to describe the “how” of governance. Most important, it should detail the process of requesting and creating SharePoint sites. Also critical, the model must include a process for decommissioning sites. Further, as the ownership of the site may change in the future, the process of transferring site ownership must be established and standardized. In addition, more specifi c processes, such as those for migrating information into SharePoint, must be created. If a business record is created, you need a process to manage it accordingly, whether that is by sending it to a central records repository to com- plete its life cycle or by managing it in the library where it originated. When legal holds are required, standard processes must be established to produce information requested dur- ing e-discovery. A demonstrated ability to produce trustworthy information—information that can be proven to be authentic and unaltered—is an absolute requirement. All these processes must be designed to be as effi cient and low cost as possible.
While guiding principles provide the “what” of SharePoint Governance, roles and responsibilities provide the “who”—that is, who can store information, access it, and make changes to the system.
SHAREPOINT INFORMATION GOVERNANCE 313
Training Plan
A well-defi ned training model as part of your SharePoint governance plan shows that your organization gave users the rules about SharePoint usage and the necessary tools to comply with those rules.
The training section of your SharePoint governance model should break down the overall training strategy: train everyone, just train site owners, or simply refer users to training resources. This section should explain the process for requesting training. It also should describe or include a reference to a detailed training plan. The train- ing plan describes the ways training will be delivered and how training content will be created. It should include a level of detail suffi cient to identify the different types of training (site owner training, information custodian training, user training, basic training, advanced training, etc.). As you defi ne the training plan, remember that any given individual may fi ll more than one role; one person might be an owner on one site, a contributor on another, and a reader on many. So the training plan should allow people to get all the training they need, without having to endure the same training modules (such as “Introduction to Our SharePoint environment”) multiple times.
An important training consideration is that SharePoint is a popular technol- ogy right now, and individuals with SharePoint skills are hot commodities in the marketplace. Therefore, in order to eliminate any single points of failure in your SharePoint roles, make sure to cross-train key roles to ensure that more than one person can perform critical functions.
Communication Plan
Your communication plan for SharePoint governance needs to take into account that you are asking people to change the fundamental way in which they manage much of the core information they use to do their work. So your communication plan needs to clearly state that the proposed SharePoint governance model:
■ Is good for the organization as a whole, not just for IT or the compliance offi ce. d ■ Makes it easier for team members to manage and fi nd the information they
need to do their jobs.
Your training plan needs to recognize that a given individual may fi ll more than one role on different SharePoint sites.
Your communication plan needs to recognize that you are asking people to change the fundamental way they access and manage documents.
314 INFORMATION GOVERNANCE
An understanding of the SharePoint governance model should make it clear to users what the organization intends to do with SharePoint: the business drivers behind the deployment. It also should be very clear what users are expected to do and the training they will receive so that they can work well in the SharePoint environment. Every person assigned a SharePoint role should be able to review the communications regarding governance and understand how, exactly, it will impact them.
Note
1. Don Lueders, “It’s All About the Processes,” June 18, 2009, http://sharepointrecordsmanagement. com/2009/06/18/its-all-about-the-processes/ .
■ As with any initiative that requires behavior or attitude change, you will en- counter resistance when implementing IG within SharePoint.
■ Lack of governance can signifi cantly diminish the business value and increase the risk of your SharePoint deployment.
■ Critical to success in most SharePoint deployments is an understanding of the business objectives for the solution and how those map to the organization’s strategic plan.
■ Your SharePoint governance model needs to be tailored to your organization.
■ Governance decisions can be very controversial and require documentation.
■ First, develop a problem statement and formulate business objectives for the SharePoint deployment. Then align those objectives with your overall strate- gic plan.
■ Once business objectives are formed, use them to defi ne the guiding prin- ciples for the SharePoint governance model.
■ While guiding principles provide the “what” of SharePoint governance, roles and responsibilities provide the “who”—that is, who can store information, access it, and make changes to the system.
■ Be sure to clearly state the selection criteria for storing information in Share- Point.
■ Your communication plan needs to consider that you are asking people to change the fundamental way they access, share and manage documents.
■ A well-designed SharePoint governance model can help your organization achieve its IG objectives and can contribute to the achievement of business objectives.
CHAPTER SUMMARY: KEY POINTS
PA RT F I V E Long-Term Program Issues
317
C H A P T E R 17 Long-Term Digital Preservation*
* Portions of this chapter are adapted from Chapter 17 , Robert F. Smallwood, Managing Electronic Records: Methods, Best Practices, and Technologies , © John Wiley & Sons, Inc., 2013. Reproduced with permission of John Wiley & Sons, Inc.s
By Charles M. Dollar and Lori J. Ashley
E very organization—public, private, or not for profi t—now has electronic records and digital content that it wants to access and retain for periods in excess of 10 years. This may be due to regulatory or legal reasons, a desire to preserve
organizational memory and history, or entirely by operational reasons. But long-term continuity of digital information does not happen by accident— it takes information gover-— nance (IG), planning, sustainable resources, and a keen awareness of the information technology (IT) and fi le formats in use by the organization, as well as evolving stan- dards and computing trends.
Defi ning Long-Term Digital Preservation
Information is universally recognized as a key asset that is essential to organizational success. Digital information, which relies on complex computing platforms and net- works, is created, received, and used daily to deliver services to citizens, consumers and customers, businesses, and government agencies. Organizations face tremendous challenges in the 21st century to manage, preserve, and provide access to electronic records for as long as they are needed.
Digital preservation is defi ned as long-term, error-free storage of digital infor- mation, with means for retrieval and interpretation, for the entire time span the information is required to be retained. Digital preservation applies to content that is born digital as well as content that is converted to digital form.
Some digital information assets must be preserved permanently as part of an organiza- tion’s documentary heritage. Dedicated repositories for historical and cultural memory, such as libraries, archives, and museums, need to move forward to put in place trust- worthy digital repositories that can match the security, environmental controls, and wealth of descriptive metadata that these institutions have created for analog assets (such as books and paper records). Digital challenges associated with records manage- ment affect all sectors of society—academic, government, private and not-for-profi t enterprises—and ultimately all citizens of all developed nations.
318 INFORMATION GOVERNANCE
The term “preservation” implies permanence, but it has been found that elec- tronic records, data, and information that is retained for only 5 to 10 years is likely to face challenges related to storage media failure and computer hardware/software obsolescence. A useful point of reference for the defi nition of “long term” comes from the International Organization for Standardization (ISO) standard 14721, which de- fi nes long-term as “long enough to be concerned with the impacts of changing tech- nologies, including support for new media and data formats, or with a changing user community. Long Term may extend indefi nitely.” 1
Long-term records are common in many different sectors, including govern- ment, health care, energy, utilities, engineering and architecture, construction, and manufacturing. During the course of routine business, thousands or millions of elec- tronic records are generated in a wide variety of information systems. Most records are useful for only a short period of time (up to seven years), but some may need to be retained for long periods or permanently. For those records, organizations must plan for and allocate resources for preservation efforts to ensure that the data remains acces- sible, usable, understandable, and trustworthy over time.
In addition, there may be the requirement to retain the metadata associated with records even longer than the records themselves.2 A record may have been destroyed according to its scheduled disposition at the end of its life cycle, but the organization still may need its metadata to identify the record, its life cycle dates, and the authority or person who authorized its destruction.
Key Factors in Long-Term Digital Preservation
Some electronic records must be preserved, protected, and monitored over long pe- riods of time to ensure they remain authentic, complete, and unaltered and available into the future. Planning for the proper care of these records is a component of an overall records management program and should be integrated into the organization’s information governance (IG) policies and technology portfolio as well as its privacy and security protocols.
Digital preservation is defi ned as long-term, error-free storage of digital infor- mation, with means for retrieval and interpretation, for the entire time span that the information is required to be retained.
Total capability for properly ensuring access to authentic electronic records over time, (in addition to the challenges of technological obsolescence), is a sophisticated combination of policies, strategies, processes, specialized re- sources, and adoption of standards.
LONG-TERM DIGITAL PRESERVATION 319
Enterprise strategies for sustainable and trustworthy digital preservation reposi- tories have to take into account several prevailing and compound conditions: the complexity of electronic records, decentralization of the computing environment, obsolescence and aging of storage media, massive volumes of electronic records, and software and hardware dependencies.
The challenges of managing electronic records signifi cantly increased with the trend of decentralization of the computing environment. In the centralized environ- ment of a mainframe computer, prevalent from the 1960s to 1980s but also in use today, it is relatively easy to identify, assess, and manage electronic records. This is not the case in the decentralized environment of specialized business applications and of- fi ce automation systems, where each user creates electronic objects that may constitute a formal record and thus will have to be preserved under IG polices that address record retention and disposition rules, processes, and accountability.
Electronic records have evolved from simple text-based word processing fi les or reports to include complex mixed media digital objects that may contain embedded images (still and animated), drawings, sounds, hyperlinks, or spreadsheets with compu- tational formulas. Some portions of electronic records, such as the content of dynamic Web pages, are created on demand from databases and exist only for the duration of the viewing session. Other digital objects, such as electronic mail, may contain mul- tiple attachments, and they may be threaded (i.e., related e-mail messages linked in send-reply chains). These records cannot be converted to paper or text formats for preservation without the loss of context, functionality, and metadata.
Electronic records are being created at rates that pose signifi cant threats to our ability to organize, control, and make them accessible for as long as they are needed. This continued volume increase includes documents that are digitally scanned or imaged from a vari- ety of formats to be stored as electronic records.
Electronic records are stored as representations of bits—1s and 0s—and therefore depend on software applications and hardware networks for the entire period of retention, whether it is 3 days, 3 years, or 30 years or longer. As information technologies become obsolete and are replaced by new generations, the capability of a specifi c software application to read the representations of 1s and 0s and render them into human- understandable form will degrade to the point that the records are neither readable nor understandable. As a practical matter, this means that the readability and understandability of the records can never be recovered, and there can be serious legal consequences.
Most records are useful for only a short period of time, but some may need to be retained for long periods or permanently.
Electronic records are being created at rates that pose signifi cant threats to our ability to organize, control, and make them accessible for as long as they are needed.
320 INFORMATION GOVERNANCE
Storage media are affected by the dual problems of obsolescence and decay. They are fragile, have limited shelf life, and become obsolete in a matter of a few years. Mitigating media obsolescence is critical to long-term digital preservation (LTDP) because the bitstreams of 1s and 0s that comprise electronic records must be kept “alive” through periodic transfer to new storage media.
In addition to these current conditions associated with technology and records management, organizations face tremendous internal change management challenges t with regard to reallocation of resources, business process improvements, collaboration and coordination between business areas, accountability, and the dynamic integration of evolving recordkeeping requirements. Building and sustaining the capability to manage digital information over long periods of time is a shared responsibility of all stakeholders.
Threats to Preserving Records
A number of known threats may degrade or destroy electronic records and data:
■ Failure of storage media. Storage media is inherently vulnerable to errors and malfunction, including disk crashes. Solid-state drives (SSD) largely address these concerns, as there are no moving parts and data can be stored without needing electrical power.
■ Failure of computer systems. Computer hardware has moving parts and circuits that deteriorate and fail over time, at an average rate called mean time between failure. Some failures are complete and irrecoverable, and some are minor and can be fi xed with no loss of data. Computer software is prone to bugs and mal- ware that can compromise the safekeeping of data.
■ Systems and network communications failures. A small number of network commu- nications is likely to contain errors or misreads, especially undetected check- sum errors, which may impact the authenticity of a record. Network errors can occur from changes or redirection of URLs, and any communication over a network is subject to intrusions, errors, and hackers.
■ Component obsolescence. As hardware, software, and media age, they become ob- solete over time, due to the continued innovation and advances by the computer industry. Sometimes obsolescence is due to outdated component parts, changes in software routines, or changes in the hardware to read removable media.
■ Human error. People make mistakes, and they can make mistakes in selecting, classifying, storing, or handling archived records. Some of these errors may be detected and can be remedied; some go unnoticed or cannot be fi xed.
■ Natural disaster. Hurricane Katrina is the clearest U.S. example of how a natu- ral disaster can interrupt business operations and destroy business records, al- though in some instances, damaged records were able to be recovered. Floods, fi res, earthquakes, and other natural disasters can completely destroy or cause media or computer hardware/software failures.
■ Attacks. Archived electronic records are subject to external attacks from malware, such as viruses and worms, so preserved records must be scanned for malware and kept separate from external threats. Preserved records also can be subject to theft or damage from insiders, such as the theft of historical ra-
LONG-TERM DIGITAL PRESERVATION 321
dio recordings by a National Archives And Records Administration employee, which was reported in 2012. Proper monitoring and auditing procedures must be in place to detect and avoid these types of attacks.
■ Financial shortfall. It is expensive to preserve and maintain digital records. Power, cooling and heating systems, personnel costs, and other preservation- associated costs must be budgeted and funded.
■ Business viability. If an organization has fi nancial or legal diffi culties or suffers a catastrophic disaster, it may not survive, placing the preserved records at risk. Part of the planning process is to include consideration of successor organiza- tion alternatives, should the originating organization go out of business. 3
The impact on the preserved records can be gauged by determining what per- centage of the data has been lost and cannot be recovered or, for the data that can be recovered, what the impact or delay to users may be.
It should be noted that threats can be interrelated and more than one type of threat may impact records at a time. For instance, in the event of a natural disaster, operators are more likely to make mistakes, and computer hardware failures can create new software failures.
Digital Preservation Standards
The digital preservation community recognizes that open standard technology-neutral standards play a key role in ensuring that digital records are usable, understandable, and reliable for as far into the future as may be required.
There are two broad categories of digital preservation standards. The fi rst category in- volves systems infrastructure capabilities and services that support a trustworthy re- pository. The second category relates to open standard technology-neutral fi le formats.
Digital preservation infrastructure capabilities and services that support trust- worthy digital repositories include the international standard ISO 14721:2003 , 2012 Space Data and Information Transfer Systems —Open Archival Information System (OAIS)—Reference Model , which is a key standard applicable to LTDP. 4
The fragility of digital storage media in concert with ongoing and sometimes rapid changes in computer software and hardware poses a fundamental challenge to ensuring access to trustworthy and reliable digital content over time. Eventually, ev- ery digital repository committed to LTDP must have a strategy to mitigate computer technology obsolescence. Toward this end, the Consultative Committee for Space Data Systems developed an Open Archival Information System (OAIS) reference model to support formal standards for the long-term preservation of space science data and information assets. OAIS was not designed as an implementation model.
Threats to LTDP of records can be internal or external, from natural disasters, computer or storage failures, and even from the fi nancial viability of an organization.
322 INFORMATION GOVERNANCE
The OAIS Reference Model defi nes an archival information system as an archive, consisting of an organization of people and systems that has accepted the responsibil- ity to preserve information and make it available and understandable for a designated community (i.e., potential users or consumers), who should be able to understand the information. Thus, the context of an OAIS-compliant digital repository includes producers who originate the information to be preserved in the repository, consumers who retrieve the information, and a management/organization that hosts and admin- isters the digital assets being preserved.
OAIS encapsulates digital objects into information packages. Each information package includes the digital object content (a sequence of bits) and representation infor- mation that enables rendering of an object into human usable information along with preservation description information (PDI) such as provenance, context, and fi xity.n
The OAIS Information Model employs three types of information packages: a submission information package (SIP), an archival information package (AIP), and a dissemination information package (DIP). An OAIS-compliant digital reposi- tory preserves AIPs and any PDI associated with them. A SIP encompasses digital con- tent that a producer has organized for submission to the OAIS. After the completion of quality assurance and transformation procedures, an AIP is created, which is the focus of preservation activity. Subsequently, a DIP is created that consists of an AIP or information extracted from an AIP customized to the requirements of the designated community of users and consumers.
The core of OAIS is a functional model that consists of six entities:
1. Ingest processes the formal incorporation (in archival terms, t accession ) of sub- mitted information (i.e., a SIP) into the digital repository. It acknowledges the transfer, conducts quality assurance, extracts metadata from the SIP, generates the appropriate AIP, and populates PDI and extracted metadata into the AIP.
2. Archival storage encompasses all of the activities associated with storage of AIPs. They include receipt of AIPs, transferring AIPs to the appropriate stor- age location, replacing media as necessary, transforming AIPs to new fi le for- mats as necessary, conducting quality assurance tests, supporting backups and business continuity procedures, and providing copies of AIPs to the access entity.
3. Data management manages the storage of description and system information, t generates reports, and tracks use of storage media.
4. Administration encompasses a host of technical and human processes that include audit, policy making, strategy, and provider and customer service, among other management and business functions. OAIS administration con- nects with all of the other OAIS functions.
5. Preservation planning does not execute any preservation activities. Rather, it g supports a technology watch program for sustainable standards, fi le formats, and software for digital preservation, monitoring changes in the access needs of the designated community, and recommending updated digital preserva- tion strategies and activities.
6. Access receives queries from the designated community, passes them to archi-s val storage, and makes them available as DIPs to the designated community.
Figure 17.1 displays the relationships between these six functional entities.5
LONG-TERM DIGITAL PRESERVATION 323
In archival storage, the OAIS reference model articulates a migration strategy based on four primary types of AIP migration that are ordered by an increas- ing risk of potential information loss: refreshment, replication, repackage, and transformation. 6
1. Migration refreshment occurs when one or more AIPs are copied exactly to the t same type of storage media with no alterations occurring in the packaging information, the content information, the PDI, or the AIP location and ac- cess archival storage mapping infrastructure.
2. Migration replication occurs when one or more AIPs are copied exactly to the same or new storage media with no alterations occurring in the packaging in- formation, the content information, and the PDI. However, there is a change in the AIP location and access archival storage mapping infrastructure.
3. Migration repackage occurs when one or more AIPs are copied exactly to new storage media with no alterations in the content information and the PDI. However, there are changes in the packaging information and the AIP loca- tion and to the access to the archival storage mapping infrastructure.
4. Migration transformation occurs when changes in bitstreams result when a new content encoding procedure replaces the current encoding procedure (e.g., Unicode representation of A through Z replaces the ASCII representation of A through Z), a new fi le format replaces an existing one, or a new software application is required to access and render the AIP content.
OAIS is the lingua franca of digital preservation. The international digital pres- ervation community has embraced it as the framework for viable and technologically sustainable digital preservation repositories. An LTDP strategy that is OAIS-conforming offers the best means available today for preserving the digital heritage of all organizations, private and public.
Figure 17.1 Open Archival Information System Reference Model
Preservation Planning
Data Management
Archival Storage
Descriptive info
Descriptive info
SIP
AIP AIP
Ingest
Access
DIP
Administration
MANAGEMENT
P R O D U C E R
C O N S U M E R
result sets
orders
queries
324 INFORMATION GOVERNANCE
ISO TR 18492 (2005), Long-Term Preservation of Electronic Document-Based Information
ISO 18492 provides practical methodological guidance for the long-term preservation and retrieval of authentic electronic document-based information, when the retention period exceeds the expected life of the technology (hardware and software) used to create and maintain the information assets. It emphasizes both the role of open stan- dard technology-neutral formats in supporting long-term access and the engagement of IT specialists, document managers, records managers, and archivists in a collabora- tive environment to promote and sustain a viable digital preservation program.
ISO 18492 takes note of the role of ISO 15489 but does not cover processes for the capture, classifi cation, and disposition of authentic electronic document-based information. Ensuring the usability and trustworthiness of electronic document-based information for as long as necessary in the face of limited media durability and technology obsolescence requires a robust and comprehensive digital preservation strategy. ISO 18492 describes such a strategy, which includes media renewal, software dependence, mi- gration, open standard technology-neutral formats, authenticity protection, and security:
■ Media renewal. ISO 18492 defi nes media renewal as a baseline requirement for digital preservation because it is the only known way to keep bitstreams of information based on electronic documents alive. It specifi es the conditions under which copying and reformatting of storage media and storage devices should occur.
■ Open standard technology-neutral formats. The fundamental premise of ISO 18492 is that open standard technology-neutral formats are at the core of a vi- able and technologically sustainable digital preservation strategy because they help mitigate software obsolescence. ISO 18492 recommends the use of several standard formats, including: eXtensible Markup Language (XML), Portable Document Format/Archival (PDF/A), tagged image fi le format (TIFF), and Joint Photographic Experts Group (JPEG).
■ Migrating electronic content. ISO 18492 recommends two ways of migrating electronic content to new technologies. The fi rst relies on backwardly compat- ible new open standard technology-neutral formats that are displacing existing ones. Generally, this is a straightforward process that typically can be executed with minimal human intervention. The second involves writing computer code that exports the electronic content to a new target application or open standard technology-neutral format. This can be a very labor-intensive activity and re- quires rigorous quality control.
■ Authenticity. ISO 18492 recommends the use of hash digest algorithms to validate the integrity of electronic content after execution of media renewal activities that do not alter underlying bit streams of electronic content. In
An OAIS-conforming LTDP strategy is the best way to preserve an organization’s digital heritage.
LONG-TERM DIGITAL PRESERVATION 325
instances where bitstreams are a result of format conversion, comprehensive preservation metadata should be captured that documents the process.
■ Security. ISO 18492 recommends protecting the security of electronic records by creating a fi rewall between electronic content in a repository and external users. In addition, procedures should be in place to maintain backup/disaster recovery capability, including at least one off-site storage location.
ISO 16363 (2012)—Space Data and Information Transfer Systems—Audit and Certifi cation of Trustworthy Digital Repositories
ISO 14721 (OAIS) acknowledged that an audit and certifi cation standard was needed that incorporated the functional specifi cations for records producers, records users, ingest of digital content into a trusted repository, archival storage of this content, and digital preserving planning and administration. ISO 16363 is this audit and certifi cation standard. Its use enables independent audits and certifi cation of trustworthy digital repositories and thereby promotes public trust in digital repositories that claim they are trustworthy. To date only a handful of ISO 16363 test audits have been undertaken; additional time is required to determine how widely adopted the standard becomes.
ISO 16363 is organized into three broad categories: organization infrastructure, digital object management, and technical infrastructure and security risk management. Each category is decomposed into a series of primary elements or components, some of which may be more appropriate for digital libraries than for public records digi- tal repositories. In some instances there are secondary elements or components. An explanatory discussion of each element accompanies “empirical metrics” relevant to that element. The “empirical metrics” typically include high-level examples of how conformance can be demonstrated. Hence, they are subjective high-level conformance metrics rather than explicit performance metrics.
Organizational infrastructure 7 consists of these primary elements:
■ Mission statement that refl ects a commitment to the preservation of, long-term t retention of, management of, and access to digital information
■ Preservation strategic plan that defi nes the approach the repository will take in the long-term support of its mission
ISO 18492 provides practical methodological guidance for the long-term pres- ervation of e-documents when the retention period exceeds the expected life of the technology that created it.
ISO 16363 is an audit and certifi cation standard organized into three broad categories: organization infrastructure, digital object management, and technical infrastructure and security risk management.
326 INFORMATION GOVERNANCE
■ Collection policy or other document that specifi es the types of information it will preserve, retain, manage, and provide access to
■ Identifi cation and establishment of the duties identifi ed and establishment of the du-d ties and roles that are required to perform along with a staff with adequate skills and experience to fulfi ll these duties
■ Dissemination of the defi nitions of its designated community and associated s knowledge base(s)
■ Preservation policies that ensure that the preservation strategic plan will be met s ■ Documentation of the history of changes to operations, procedures, software,
and hardware ■ Commitment to transparency and accountability in all actions supporting the op-
eration and management of the repository that affect the preservation of digital content over time
■ Dissemination as appropriate of the defi nition, collection, and tracking of infor- mation integrity measurements
■ Commitment to a regular schedule of self-assessment and external certifi cation t ■ Short- and long-term business planning processes in place to sustain the reposi-g
tory over time ■ Deposit agreements for digital materials transferred to the custody of the
organization ■ Written policies that specify when the preservation responsibility for contents of s
each set of submitted data objects occurs ■ Intellectual property ownership rights policies and procedures s
Digital object management,8 which is the core of the standard , comprises these pri-d mary elements:
■ Methods and factors used to determine the different types of information for which an organization accepts preservation responsibility
■ An understanding of digital collections suffi cient to carry out the preservation necessary for as long as required
■ Specifi cations that enable recognition and parsing of SIPs ■ An ingest procedure that verifi es each SIP for completion and correctness ■ An ingest procedure that validates successful ingest of each SIP ■ Defi nitions for each AIP or class of AIPs used that are adequate for parsing and
suitable for long-term preservation requirements ■ Descriptions of how AIPs are constructed from SIPs, including extraction of
metadata ■ Documentation of the fi nal disposition of SIPs, including those not ingested ■ A convention that generates unique, persistent identifi ers of all AIPs ■ Reliable linking services that support the location of each uniquely identifi ed
object, regardless of its physical location ■ Tools and resources that support authoritative representation information for
all of the digital objects in the repository, including fi le type ■ Documented processes for acquiring and creating PDI ■ Understandable content information for the designated community at the time
of creation of the AIPs
LONG-TERM DIGITAL PRESERVATION 327
■ Verifi cation of the completeness and correctness of AIPs at the point of their creation
■ Contemporaneous capture of documentation of actions and administration processes that are relevant to AIP creation
■ Documented digital preservation strategies ■ Mechanisms for monitoring the digital preservation environment ■ Documented evidence of the effectiveness of digital preservation activities ■ Specifi cations for storage of AIPs down to the bit level ■ Preservation of the content information of AIPs ■ Monitoring the integrity of AIPs ■ Documentation that preservation actions associated with AIPs complied with
the specifi cations for those actions ■ Specifi cation of minimum information requirements that enable the designated
community to discover and identify material of interest ■ Bidirectional linkage between each AIP and its associated descriptive information ■ Compliance with access policies ■ Policies and procedures that enable the dissemination of digital objects that are
traceable to the “originals,” with evidence supporting their authenticity ■ Procedures that require documentation of actions taken in response to reports
about errors in data or responses from users
Technical infrastructure and security risk management primary elements 9 include these:
■ Technology watches or other monitoring systems that track when hardware and software is expected to become obsolete
■ Procedures, commitment, and funding when it is necessary to replace hardware ■ Procedures, commitment, and funding when it is necessary to replace software ■ Adequate hardware and software support for backup functionality suffi cient for
preserving the repository content and tracking repository functions ■ Effective mechanisms that identify bit corruption or loss ■ Documentation captures of all incidents of data corruption or loss, and steps
taken to repair/replace corrupt or lost data ■ Defi ned processes for storage media and/or hardware change (e.g., refreshing,
migration) ■ Management of the number and location of copies of all digital objects ■ Systematic analysis of security risk factors associated with data, systems,
personnel, and physical plant ■ Suitable written disaster preparedness and recovery plan(s), including at least
one off-site backup of all preserved information together with an offsite copy of the recovery plan(s)
ISO 16363 represents the gold standard of audit and certifi cation for trustworthy digital repositories. In some instances the resources available to a trusted repository may not support full implementation of the audit and certifi cation specifi cations. Decisions about where full and partial implementation is appropriate should be based on a risk assessment analysis.
328 INFORMATION GOVERNANCE
PREMIS Preservation Metadata Standard
ISO 14721 specifi es that preservation metadata associated with all archival storage activities (e.g., generation of hash digests, transformation, and media renewal) should be captured and stored in PDI. This high-level guidance requirement demands greater specifi city in an operational environment.
Toward this end, the U.S. Library of Congress and the Research Library Group supported a new international working group called PREservation Metadata Informa- tion Strategies (PREMIS) 10 to defi ne a core set of preservation metadata elements with a supporting data dictionary that would be applicable to a broad range of digital pres- ervation activities and to identify and evaluate alternative strategies for encoding, man- aging, and exchanging preservation metadata. Version 2.2 was released in June 2012.11
PREMIS enables designers and managers of digital repositories to have a clear understanding of the information required to support the “functions of viability, renderability, understandability, authenticity, and identity in a preservation context.” PREMIS accomplishes this through a data model that consists of fi ve “semantic units” (think of them as high-level metadata elements, each of which is decomposed into sub- elements) and a data dictionary that decomposes these “semantic units” into a structure hierarchy. The fi ve semantic units and their relationships are displayed in Figure 17.2 .
Note the arrows that defi ne relationships between these entities:
■ Intellectual entities are considered a single intellectual unit such as a book, map, s photograph, database, or records (e.g., an AIP).
ISO 16363 represents the gold standard of audit and certifi cation for trustwor- thy digital repositories.
Figure 17.2 PREMIS Data Model Source: Library of Congress, P REMIS Data Dictionary for Preservation Metadata , Version 2.1 (January 2011).
Intellectual
Entities Rights
Agents
Events
Objects
LONG-TERM DIGITAL PRESERVATION 329
■ Objects are discrete units of information in digital form that may exist as a bit-s stream, a fi le or a representation.
■ Events denote actions that involve at least one digital object and/or agent knowns to the repository. Events may include the type of event (e.g., media renewal), a description of the event, and the agents involved in the event. Events support the chain of custody of digital objects.
■ Agents are actors in digital preservation that have roles. An agent can be ans individual, organization, or a software application.
■ Rights involve the assertion of access rights and access privileges that relate tos intellectual property, privacy, or other related rights
The PREMIS Data Dictionary decomposes objects, events, agents, and rights into a structured hierarchical schema. In addition, it contains semantic units that support documentation of relationships between Objects. An important feature of the PREMIS is an XML schema for the PREMIS Data Dictionary. The primary rationale for the XML schema is to support the exchange of metadata information, which is crucial in ingest and archival storage. The XML schema enables automated extraction of preservation related metadata in SIPs and population of this preserva- tion metadata into AIPs. In addition, the XML schema can enable automatic capture of preservation events that are foundational for maintaining a chain of custody in archival storage.
Recommended Open Standard Technology-Neutral Formats
A digital fi le format specifi es the internal logical structure of digital objects (i.e., binary bits of 1s and 0s) and signal encoding (e.g., text, image, sound, etc.). File formats are crucial to long-term preservation because a computer can open, process, and render fi le formats that it recognizes. Many fi le formats are proprietary (also known as native), meaning that digital content can be opened and rendered only by the software application used to create, use, and store it. However, as IT changed, some software vendors introduced new products that no longer support earlier versions of a fi le format. In such instances these formats become “legacy” format, and digital content embedded in them can be opened only with computer code written expressly for this purpose. Other vendors, such as Microsoft, support backward compatibility across multiple generations of technology so Microsoft Word 2010 can open and render documents in Microsoft Word 95. Nonetheless, it is unrealistic to expect any software vendor to support back- ward compatibility for its proprietary fi le formats for digital content that will be pre- served for multiple decades.
The PREMIS standard defi nes a core set of preservation metadata elements with a supporting data dictionary applicable to a broad range of digital preservation activities.
330 INFORMATION GOVERNANCE
In the late 1980s, an alternative to vendor-supported backward compatibility emerged to mitigate dependence on proprietary fi le formats through open system in- teroperable fi le formats. Essentially, this meant that digital content could be exported from one proprietary fi le format and imported to one or more other proprietary fi le formats. Over time, interoperable fi le formats evolved into open standard technology- neutral formats that today have these characteristics:
■ Open means that the process is transparent and that participants in the process reach a consensus on the properties of the standard.
■ Standard means that a recognized regional or international organization (e.g.,d the ISO) published the standard.
■ Technology neutral means that the standard is interoperable on almost any tech-l nology platform that asserts conformance to the standard.
Because even open standard technology-neutral formats are not immune to tech- nology obsolescence, their selection must take into account their technical sustain- ability and implementation in digital repositories. The PRONON program of the National Archives of the United Kingdom and long-term sustainability of fi le formats of the U.S. Library of Congress assess the sustainability of open standard technology- neutral formats.
The recommended open standard technology-neutral formats for nine content types listed in Table 17.1 are based on this ongoing work, along with preferred fi le for- mats supported by Library and Archives Canada and other national archives. Unlike PDF/A, several of these fi le formats (e.g., XML, JPEG 2000, and Scalable Vector
Many digital fi le formats are proprietary, meaning that content can be viewed and controlled only by the software application used to create, use, and store it.
Table 17.1 Recommended Open Standard Technology-Neutral Formats
PDF/A XML TIFF PNG JPEG 2000 SVG MPEG-2 BWF WARC
Text √ √
Spreadsheets √
Images (raster) √ √ √
Photographs (digital) √
Vector graphics √
Moving images √
Audio √
Web √
Databases √
LONG-TERM DIGITAL PRESERVATION 331
Graphics [SVG]) were not explicitly designed for digital preservation. It cannot be em- phasized too strongly that this list of recommended open standard technology-neutral formats (or any other comparable list) is not static and will change over time as technology changes.
ISO 19005 (PDF/A)—Document Management—Electronic Document File Format for Long-Term Preservation (2005, 2011, and 2012)
PDF/A is an open standard technology-neutral format that enables the accurate repre- sentation of the visual appearance of digital content without regard for the proprietary format or application in which it was created or used. PDF/A is widely used in digital repositories as a preservation format for static textual and image content. Note that PDF/A is agnostic with regard to digital imaging processes or storage media. PDFA/A supports conversion of TIFF and PNG images to PDF/A. There are two levels of con- formance to PDF/A specifi cations. PDF/A-1a references the use of a “well-formed” hierarchical structure with XML tags that enable searching for a specifi c tag in a very large digital document. PDF/A-1b does not require this conformance, and as a practi- cal matter, it does not affect the accurate representation of visual appearance.
Since its publication in 2005, there have been two revisions of PDF/A. The fi rst revision, PDF/A-2, was aligned with the Adobe Portable Document Format 1.7 pub- lished specifi cations, which Adobe released to the public domain in 2011. The sec- ond revision, PDF/A-3, supports embedding documents in other formats, such as the original source document, in a PDF document.
Extensible Markup Language (XML)—World Wide Web Consortium (W3C) Internet Engineering Group (1998)
XML is a markup language that is a derivative of Standard General Markup Language (SGML) that logically separates the rendering of a digital document from its content to enable interoperability across multiple technology platforms. Essentially XML defi nes rules for marking up the structure of content and its content in American Standard Code for Information Interchange (ASCII) text. Any conforming interoper- able XML parser can render the original structure and content. XML-encoded text is human-readable because any text editor can display the marked-up text and content. XML is ubiquitous in IT environments because many communities of users have developed document type defi nitions unique to their purposes, including genealogy, math, and relational databases. Structure data elements work with relational databases, so this enables relational database portability.
Tagged Image File Format (1992)
Tagged image fi le format (TIFF) was initially developed by the Aldus Corporation in 1982 for storing black-and-white images created by scanners and desktop publishing
The PDF/A fi le format was designed specifi cally for digital preservation.
332 INFORMATION GOVERNANCE
application. Over the next six years, several new features were added, including a wide range of color images and compression techniques, including lossless compression. The most recent version of TIFF 6.0 was released by Aldus in 1992. Subsequently, Adobe purchased Aldus and chose not to support any further signifi cant revisions and updates. Nonetheless, TIFF is widely used in desktop scanners for creating digital images for preservation. With such a large base of users, it is likely to persist for some time, but Adobe’s decision to discontinue further development of TIFF means that it will lack features of other current and future image fi le formats. Fortunately, there are tools available to convert TIFF images to PDF and PNG images.
ISO/IEC 15498:2003—Information Technology—Computer Graphics and Image Processing-Portable Network Graphics (PNG)—Functional Specifi cations
The W3C Internet Engineering Task Force supported the development of PNG as a replacement for graphics image format (GIF) because the GIF compression algo- rithm was protected by patent rights rather than being in the public domain, as many believed. In 2003, PNG became an international standard that supports lossless com- pression, grayscale, and true-color images with bit depths that range from 1 to 16 bits per pixel, fi le integrity checking, and streaming capability.
Scalable Vector Graphics (SVG)—W3C Internet Engineering Task Force (2003)
Vector graphics images consist of two-dimensional lines, colors, curves, or other geo- metrical shapes and attributes that are stored as mathematical expressions, such as where a line begins, its shape, where it ends, and its color. Changes in these mathematical ex- pressions will result in changes in the image. Unlike raster images, there is no loss of clarity of a vector graphics image when it is made larger. SVG images and their behavior properties are defi ned in XML text fi les, which means any named element in a SVG image can be indexed and searched. SVG images also can be accessed by any text editor, which minimizes on a specifi c software application to render and edit the images.
ISO/IEC 15444-1:2004—Joint Photographic Engineers Group (JPEG 2000)
JPEG 2000 is an international standard for compressing full-color and grayscale digital im- ages and rendering them as full-size images and thumbnail images. Unlike JPEG, its s predecessor, which supported only lossy compression, JPEG 2000 supports both lossy and lossless compression. Lossy compression means that during compression, bits that are considered technically redundant are permanently deleted. Lossless compression means no bits are lost or deleted. The latter is very important for LTDP because lossy
PNG replaced GIF as an international standard for grayscale and color images in 2004.
LONG-TERM DIGITAL PRESERVATION 333
compression is irreversible. JPEG 2000 is widely used in producing digital images in digital cameras and is an optional format in many digital scanners.
ISO/IEC 13818–3:2000—Motion Picture Expert Group (MPEG-2)
MPEG-2 is an international broadcast standard for lossy compression of moving im- ages and associated audio. The major competitor for MPEG-2 appears to be Motion JPEG 2000, which is used in small devices, such as cell phones.
European Broadcasting Tech 3285—Broadcast Wave Format (BWF) (2011)
First issued by the European Broadcasting Union in 1997 and revised in 2001 (v1) and 2011 (v2), BWF is a fi le format for audio data that is an extension of the Microsoft Wave audio format. Its support of metadata ensures that it can be used for the seamless exchange of audio material between different broadcast environments and between equipment based on different computer platforms.
ISO 28500:2009—WebARChive (WARC)
WebARChive (WARC) is an extension of the Internet Archive’s ARC format to store digi- tal content harvested through “Web crawls.” WARC was developed to support the stor- age, management, and exchange of large volumes of “constituent data objects” in a single fi le. Currently, WARC is used to store and manage digital content collected through Web crawls and data collected by environmental sensing equipment, among others.
Digital Preservation Requirements
Implementing a sustainable LTDP program is not an effort that should be undertaken lightly. Digital preservation is complex and costly and requires collaboration with all of the stakeholders who are accountable for or have an interest in ensuring access to usable, understandable, and trustworthy electronic records for as far into the future as may be required.
As noted earlier, ISO 14721 and ISO 16363 establish the baseline functions and specifi cations for ensuring access to usable, understandable, and trustworthy electron- ic records, whether this involves regulatory and legal compliance for a business entity, vital records, accountability for a government unit, or cultural memory for a public or private institution. Most fi rst-time readers who review the functions and specifi cations of ISO 14721 and ISO 16363 are likely to be overwhelmed by the detail and complex- ity of almost 150 specifi cations.
JPEG 2000 is an international standard for compressing and rendering full- color and grayscale digital images in full size or as thumbnails.
334 INFORMATION GOVERNANCE
Long-Term Digital Preservation Capability Maturity Model®
A useful approach that both simplifi es these specifi cations and provides explicit criteria regard- ing conformance to ISO 14721 and ISO 16363 is the Long-Term Digital Preservation Capability Maturity Model® (DPCMM). 12 The DPCMM, which is described in some detail in this section, draws on functions and preservation services identifi ed in ISO 14721 (OAIS) as well as attributes specifi ed in ISO 16363, Audit and Certifi cation of Trustworthy Repositories. It is important to note that the DPCMM is not a one-size- fi ts-all approach to ensuring long-term access to authentic electronic records. Rather, it is a fl exible approach that can be adapted to an organization’s specifi c requirements and resources.
DPCMM can be used to identify the current state capabilities of digital preserva- tion that form the basis for debate and dialogue regarding the desired future state of digital preservation capabilities, and the level of risk that the organization is willing to assume. In many instances, this is likely to come down to the question of what constitutes digital preservation that is good enough to fulfi ll the organization’s mis- sion and meet the expectations of its stakeholders. The DPCMM has fi ve incremental stages, which are depicted in Figure 17.3 . In Stage 1, a systematic digital preservation
The Long-Term Digital Preservation Capability Maturity Model (DPCMM) sys- tematically organizes high-level conformance to ISO 14721 and ISO 16363.
Figure 17.3 Five Levels of Digital Preservation Capabilities
Nominal
Optimal
Advanced
Intermediate
Minimal
Practically all digital records that merit long-term
preservation are at risk.
Most digital records that merit long-term
preservation are at risk.
Many digital records that merit long-term
preservation are at risk.
Some digital records that merit long-term
preservation are at risk.
Few digital records that merit long-term
preservation are at risk.
Evaluate capabilities and requirements for Stage 5.
Evaluate capabilities and requirements for Stage 4.
Evaluate capabilities and requirements for Stage 3.
Evaluate capabilities and requirements for Stage 2.
LONG-TERM DIGITAL PRESERVATION 335
program has not been undertaken or the digital preservation program exists only on paper, whereas Stage 5 represents the highest level of sustainable digital preservation capability and repository trustworthiness that an organization can achieve.
The DPCMM is based on the functional specifi cations of ISO 14721 and ISO 16363 and accepted best practices in operational digital repositories. It is a systems- based tool for charting an evolutionary path from disorganized and undisciplined management of electronic records, or the lack of a systematic electronic records man- agement program, into increasingly mature stages of digital preservation capability.
The goal of the DPCMM is to identify at a high level where an electronic records management program is in relation to optimal digital preservation capabilities, report gaps, capability levels, and preservation performance metrics to resource allocators and other stakeholders to establish priorities for achieving enhanced capabilities to preserve and ensure access to long-term electronic records.
Stage 5: Optimal Digital Preservation Capability
Stage 5 is the highest level of digital preservation readiness capability that an organi- zation can achieve. It includes a strategic focus on digital preservation outcomes by continuously improving the manner in which electronic records life cycle manage- ment is executed. Stage 5 digital preservation capability also involves benchmarking the digital preservation infrastructure and processes relative to other best-in-class digital preservation programs and conducting proactive monitoring for breakthrough tech- nologies that can enable the program to signifi cantly change and improve its digital preservation performance. In Stage 5, few if any electronic records that merit long-term preservation are at risk.
Stage 4: Advanced Digital Preservation Capability
Stage 4 capability is characterized by an organization with a robust infrastructure and digital preservation processes that are based on ISO 14721 specifi cations and ISO 16363 audit and certifi cation criteria. At this stage, the preservation of electronic re- cords is framed entirely within a collaborative environment in which there are mul- tiple participating stakeholders. Lessons learned from this collaborative framework serve as the basis for adapting and improving capabilities to identify and proactively bring long-term electronic records under lifecycle control and management. Some elec- tronic records that merit long-term preservation still may be at risk.
Stage 3: Intermediate Digital Preservation Capability
Stage 3 describes an environment that embraces the ISO 14721 specifi cations and other best practice standards and schemas and thereby establishes the foundation for sustaining an enhanced digital preservation capability over time. This foundation includes successfully completing repeatable projects and outcomes that support the enterprise digital preservation capability and enables collaboration, including shared resources, between record-producing units and entities responsible for managing and maintaining trustworthy digital repositories. In this environment, many electronic records that merit long-term preservation are likely to remain at risk.
336 INFORMATION GOVERNANCE
Stage 2: Minimal Digital Preservation Capability
Stage 2 describes an environment where an ISO 14721–based digital repository is not yet in place. Instead, a surrogate repository for electronic records is available to some records producers that satisfi es some but not all of the ISO 14721 specifi cations. Typically, the digital preservation infrastructure and processes of the surrogate reposi- tory are not systematically integrated into business processes or universally available, so the state of digital preservation is somewhat rudimentary and life cycle management of the organization’s electronic records is incomplete. There is some understanding of digital preservation issues, but it is limited to a relatively few individuals. There may be virtually no relationship between the success or failure of one digital preservation initiative and the success or failure of another one. Success is largely the result of ex- ceptional (perhaps even heroic) actions of an individual or a project team. Knowledge about such success is not widely shared or institutionalized. Most electronic records that merit long-term preservation are at risk.
Stage 1: Nominal Digital Preservation Capability
Stage 1 describes an environment in which the specifi cations of ISO 14721 and other standards may be known, accepted in principle, or under consideration, but they have not been formally adopted or implemented by the record-producing organization. Generally, there may be some understanding of digital preservation issues and con- cerns, but this understanding is likely to consist of ad hoc electronic records man- agement and digital preservation infrastructure, processes, and initiatives. Although there may be some isolated instances of individuals attempting to preserve electronic records on a workstation or removable storage media (e.g., DVD or hard drive), practi- cally all electronic records that merit long-term preservation are at risk.
Scope of the Capability Maturity Model
This capability maturity model consists of 15 components, or key process areas, that are necessary and required for the long-term preservation of usable, understandable, accessible, and trustworthy electronic records. Each component is identifi ed and is accompanied by explicit performance metrics for each of the fi ve levels of digital pres- ervation capability.
The objective of the model is to provide a process and performance framework (or benchmark) against best practice standards and foundational principles of digital preservation, records management, information governance, and archival science. Figure 17.4 displays the components of the DPCMM.
Scope notes for each of the graphic elements in Figure 17.4 diagram are provided next for additional clarity. Numbered components in the model are associated with performance metrics and capability levels described in the next section.
■ Producers and Users ■ Records creators and owners are stakeholders who have either the obligation or s
the option to transfer permanent and long-term (10+-year retention) electronic records to one or more specifi ed digital repositories for safekeeping and access.
LONG-TERM DIGITAL PRESERVATION 337
■ Users. Individuals or groups that have an interest in and/or right to access records held in the digital repository. These stakeholders represent a variety of interests and access requirements that may change over time.
■ Digital preservation infrastructure. Seven key organizational process areas re- quired to ensure sustained commitment and adequate resources for the long- term preservation of electronic records are: 1. Digital preservation policy. The organization charged with ensuring preser-
vation and access to long-term and permanent legal, fi scal, operational, and historical records should issue its digital preservation policy in writing, in- cluding the purpose, scope, accountability, and approach to the operational management and sustainability of trustworthy repositories.
2. Digital preservation strategy. The organization charged with the preser- vation of long-term and permanent business, government, or historical electronic records must proactively address the risks associated with technology obsolescence, including plans related to periodic renewal of storage devices, storage media, and adoption of preferred preservation fi le formats.
3. Governance. The organization has a formal decision-making framework that assigns accountability and authority for the preservation of electronic records with long-term and permanent historical, fi scal, operational, or le- gal value, and articulates approaches and practices for trustworthy digital repositories suffi cient to meet stakeholder needs. Governance is exercised in conjunction with information management and technology functions and with other custodians and digital preservation stakeholders, such as records-producing units and records consumers, and enables compliance with applicable laws, regulations, record retention schedules, and disposi- tion authorities.
4. Collaboration. Digital preservation is a shared responsibility. The organi- zation with a mandate to preserve long-term and permanent electronic
Figure 17.4 Digital Preservation Capability Maturity Model
3. Governance
2. Strategy
1. Policy
4. Collaboration
5. Technical Expertise
6. Open
Sources/ Neutral Formats
7. Designated Community
Digital Preservation Infrastructure
Trustworthy Digital Repository
Digital Preservation Services
9. Ingest
10. Storage
11. Device/ Media
Renewal
12. Integrity
13. Security
14. Metadata
Producers Users
8. Electronic Records Survey
15. Access
338 INFORMATION GOVERNANCE
business, government, or historical records in accordance with accepted dig- ital preservation standards and best practices is well served by maintaining and promoting collaboration among its internal and external stakeholders. Interdependencies between and among the operations of records produc- ing units, legal and statutory requirements, IT policies and governance, and historical accountability should be addressed systematically.
5. Technical expertise. A critical component in a sustainable digital preserva- tion program is access to professional technical expertise that can proac- tively address business requirements and respond to impacts of evolving technologies. The technical infrastructure and key processes of an ISO 14721/ISO 16363–conforming archival repository requires professional expertise in archival storage, digital preservation solutions, and life cycle electronic records management processes and controls. This technical ex- pertise may exist within the organization or be provided by a centralized function or service bureau or by external service providers, and should in- clude an in-depth understanding of critical digital preservation actions and their associated recommended practices.
6. Open standard technology-neutral formats. A fundamental requisite for a sus- tainable digital preservation program that ensures long-term access to us- able and understandable electronic records is mitigation of obsolescence of fi le formats. Open standard platform-neutral fi le formats are developed in an open public setting, issued by a certifi ed standards organization, and have few or no technology dependencies. Current preferred open standard technology fi le format examples include:
■ XML and PDF/A for text ■ PDF/A for spreadsheets ■ JPEG 2000 for photographs ■ PDF/A, PNG, and TIFF for scanned images ■ SVG for vector graphics ■ BWF for audio ■ MPEG-4 for video ■ WARC for Web pages Over time, new digital preservation tools and solutions will emerge that
will require new open standard technology-neutral standard fi le formats. Open standard technology-neutral formats are backwardly compatible so they can support interoperability across technology platforms over an ex- tended period of time.
7. Designated community. The organization that has responsibility for preser- vation and access to long-term and permanent legal, operational, fi scal, or historical government records is well served through proactive outreach and engagement with its designated community. There are written proce- dures and formal agreements with records-producing units that document the content, rights, and conditions under which the digital repository will ingest, preserve, and provide access to electronic records. Written proce- dures are in place regarding the ingest of electronic records and access to its digital collections. Records producers will submit fully conforming ISO 14721/ISO 16363 SIPs while DIPs are developed and updated in conjunc- tion with its user communities.
LONG-TERM DIGITAL PRESERVATION 339
■ Trustworthy digital repository. This includes the integrated people, processes, and technologies committed to ensuring the continuous and reliable design, op- eration, and management of digital repositories entrusted with long-term and permanent electronic records. A trustworthy digital repository may range from a simple system that involves a low-cost fi le server and software that provide nonintegrated preservation services, to complex systems comprising data cen- ters and server farms, computer hardware and software, and communication networks that interoperate.
The most complete trustworthy digital repository is based on models and standards that include ISO 14721, ISO 16363, and generally accepted best digi- tal preservation practices. The repository may be managed by the organization that owns the electronic records or may be provided as a service by an external third party. It is likely that many organizations initially will rely on surrogate digital preservation capabilities and services that approximate some but not all of the capabilities and services of a conforming ISO14721/ISO 16363 trust- worthy digital repository.
■ Digital preservation processes and services. Eight key business process areas needed for continuous monitoring of the external and internal environ- ments in order to plan and take actions to sustain the integrity, security, usability and accessibility of electronic records stored in trustworthy digital repositories. 1. Electronic records survey. A trustworthy repository cannot fully execute
its mission or engage in realistic digital preservation planning without a projected volume and scope of electronic records that will come into its custody. It is likely that some information already exists in approved retention schedules, but it may require further elaboration as well as periodic updates, especially with regard to preservation ready, near pres- ervation ready, and legacy electronic records held by records-producing units.
2. Ingest. A digital repository that conforms to ISO 14721/ISO 16363 has the capability to systematically ingest (receive and accept) electronic records from records-producing units in the form of SIPs, move them to a staging area where virus checks and content and format validations are performed, transform electronic records into designated preservation formats as ap- propriate, extract metadata from SIPs and write it to PDI, create AIPs, and transfer the AIPs to the repository’s storage function. This process is con- sidered the minimal work fl ow for transferring records into a digital reposi- tory for long-term preservation and access.
3. Archival storage. ISO 14721 delineates systematic automated storage ser- vices that support receipt and validation of successful transfer of AIPs from ingest, creation of PDI for each AIP that confi rms its “fi xity”13 during any preservation actions through the generation of hash digests, capture and maintenance of error logs, updates to PDI including transformation of electronic records to new formats, production of DIPs from access, and collection of operational statistics.
4. Device and media renewal. No known digital device or storage medium is invulnerable to decay and obsolescence. A foundational digital preserva- tion capability is ensuring the readability of the bitstreams underlying the
340 INFORMATION GOVERNANCE
electronic records. ISO 14721/ ISO 16363 specify that a trustworthy digital repository’s storage devices and storage media should be monitored and re- newed (“refreshed”) periodically to ensure that the bitstreams remain read- able over time. A projected life expectancy of removable storage media does not necessarily apply in a specifi c instance of storage media. Hence, it is important that a trustworthy digital repository have a protocol for continu- ously monitoring removable storage media (e.g., magnetic tape, external tape drive, or other media) to identify any that face imminent catastrophic loss. Ideally, this renewal protocol would execute renewal automatically af- ter review by the repository.
5. Integrity. A key capability in conforming ISO 14721/ISO 16363 digital repositories is ensuring the integrity of the records in its custody, which involves two related preservation actions. The fi rst action generates a hash digest algorithm (also known as a cyclical redundancy code) to address a vulnerability to accidental or intentional alterations to elec- tronic records that can occur during device/media renewal and internal data transfers. The second action involves integrity documentation that supports an unbroken electronic chain of custody captured in the PDI in AIPs.
6. Security. Contemporary enterprise information systems typically execute a number of shared or common services that may include communica- tion, name services, temporary storage allocation, exception handling, role-based access rights, security, backup and business continuity, and directory services, among others. A conforming ISO 14721/ISO 16363 digital repository is likely to be part of an information system that may routinely provide some or perhaps all of the core security, backup, and business continuity services, including fi rewalls, role-based access rights, data-transfer-integrity validations, and logs for all preservation activities, including failures and anomalies, to demonstrate an unbroken chain of custody.
7. Preservation metadata. A digital repository collects and maintains metadata that describes actions associated with custody of long-term and permanent records, including an audit trail that documents preservation actions car- ried out, why and when they were performed, how they were carried out, and with what results. A current best practice is the use of a PREMIS-based data dictionary to support an electronic chain of custody that documents authenticity over time as preservation actions are executed. Capture of all related metadata, transfer of the metadata to any new formats/systems, and secure storage of metadata are critical. All metadata is stored in the PDI component of con- forming AIPs.
8. Access. Organizations with a mandate to support access to permanent business, government, or historical records are subject to authorized restrictions. A conforming ISO 14721/ISO 16363 digital repository will provide consumers with trustworthy records in “disclosure-free” DIPs redacted to protect, privacy, confi dentiality, and other rights, where ap- propriate, and searchable metadata that users can query to identify and retrieve records of interest to them. Production of DIPs is tracked, espe- cially when they involve extractions, to verify their trustworthiness and to
LONG-TERM DIGITAL PRESERVATION 341
identify query trends that are used to update electronic accessibility tools to support these trends.
Digital Preservation Capability Performance Metrics
Digital preservation performance metrics for each level of the fi ve levels of the model have been mapped to each of the 15 numbered components described in the previ- ous section. The performance metrics are explicit empirical indicators that refl ect an incremental level of digital preservation capability. The digital preservation capability performance metrics for digital preservation strategy listed in Table 17.2 illustrate the results of this mapping exercise.14
Conducting a gap analysis of its digital preservation capabilities using these performance metrics enables the organization to identify both its current state and desired future state of digital preservation capabilities . In all likelihood, this desired future state will depend ons available resources, the organization’s mission, and stakeholder expectations. “Good- enough” digital preservation capabilities will vary by organization; what is good enough for one organization is unlikely to coincide with what is good enough for another.
Digital Preservation Strategies and Techniques
Any organization with long-term or permanent electronic records in its custody must ensure that the electronic records can be read and correctly interpreted by a computer application, rendered in an understandable form to humans, and trusted as
Table 17.2 Digital Preservation Performance Metrics
Level Capability Description
0 A formal strategy to address technology obsolescence does not exist.
1 A strategy to mitigate technology obsolescence consists of accepting electronic records in their native format with the expectation that new software will become available to support these formats. During this interim period, viewer technologies will be relied on to render usable and understandable electronic records.
2 Electronic records in interoperable “preservation-ready”* fi le formats and transformation of one native fi le format to an open standard technology-neutral fi le format are supported. Changes in information technologies that may impact electronic records collections and the digital repository are monitored proactively and systematically.
3 The organization supports transformation of selected native fi le formats to preferred/ supported preservation fi le formats in the trustworthy digital repository. Records- producing units are advised to use preservation-ready fi le formats for permanent or indefi nite long-term (e.g., case fi les, infrastructure fi les) electronic records in their custody.
4 Electronic records in all native formats are transformed to available open standard technology-neutral fi le formats.
* The term “preservation-ready fi le formats” refers to open standard technology-neutral formats that the organiza-* tion has identifi ed as preferred for long-term digital preservation.
342 INFORMATION GOVERNANCE
accurate representations of their logical and physical structure, substantive content, and context. To achieve these goals, a digital repository should operate under the man- date of a digital preservation strategy that addresses 10 digital preservation processes and activities:
1. Adopt preferred open standard technology-neutral formats. Earlier, nine open stan- dard technology-neutral fi le formats that covered text, images, photographs, vector graphics, moving images, audio, and Web pages were discussed. Adop- tion of these fi le formats means that the digital repository will support their use in its internal digital preservation activities and notify the producers of records of the preferred formats for preservation-ready electronic records to be transferred to the repository’s custody.
2. Acquire electronic records in preservation-ready formats. Likely many born-digital electronic records along with scanned images will be created or captured in a preservation-ready format. Acquisition or ingest of electronic records already in preservation-ready formats can signifi cantly reduce the workload of the repository because it will not be necessary to transform records to open stan- dard technology-neutral formats.
3. Acquire and transform electronic records in near-preservation-ready formats. Near- preservation-ready formats are native proprietary fi le formats that can be eas- ily transformed to preservation-ready fi le formats through widely available software plug-ins. Ideally, over time, the volume of near-preservation-ready records will diminish as records producers increasingly convert records sched- uled for long-term retention into preservation-ready formats before they are transferred to the repository.
4. Acquire legacy electronic records. Legacy electronic records initially were cre- ated in a proprietary fi le format that is obsolete and no longer supported by a vendor. In most instances, electronic records embedded in legacy fi le formats can be recovered and saved in a preservation-ready format only if special com- puter code is written to extract the records from their legacy format. Once ex- tracted from the legacy format, they can be written to a contemporary format. Niche vendors provide this kind of service, but it is relatively expensive and perhaps beyond the resources of many repositories.
An alternative is to forgo this costly process in the hope that a future tech- nology, such as emulation , will be widely available and relatively inexpensive. Meanwhile, the repository would rely on a fi le viewer technology, such as Inside Out, to render legacy electronic records into format understandable to humans with the exact logical and physical structure and representation at the time they were created and used.
5. Maintain bitstream readability through device/media removal. No known digital storage device or media is exempt from degradation and technology obso- lescence. Consequently, the bitstreams of 1s and 0s that underlie electronic records are stored on media that are vulnerable to degradation and technol- ogy obsolescence. Technology obsolescence may occur when a vendor intro- duces a new form factor for storage device/media, such as the transition from 5.25-inch disk drives and disks to 3.5-inch disk drives and media to thumb drives. With today’s technology, periodic device/medial renewal is the only known way to keep bitstreams available. A rule of thumb is to renew storage
LONG-TERM DIGITAL PRESERVATION 343
device/media at least every 10 years. Failure to maintain the readability of bit- streams over time is an absolute guarantee the electronic records cannot be re- covered and that the records will be permanently lost for all practical purposes.
6. Migrate to new open standard technology-neutral formats. These formats are not im- mune to technology obsolescence. The inevitable changes in IT mean that new open standard technology formats will be created that displace current ones. The solution to this issue is migration from an older or current open standard technology-neutral format to newer ones. Seamless migration from old to new open standard technology-neutral formats is made possible through backward compatibility. “Backward compatibility” means that a new standard can interpret digital content in an old standard and then save it in the new format standard. Migration is the most widely used tool to mitigate fi le format obsolescence.
7. Protect the integrity and security of electronic records. Imperfect information tech- nologies inevitably have glitches that, along with accidental human error and intentional human actions, can corrupt or otherwise compromise the trust- worthiness of electronic records though some alteration in the underlying bitstream. Accidental alteration occurs when preservation actions are initiated for electronic records. These actions may occur during transformation, migra- tion, media renewal, accessions to digital records, and relocation of electronic records from one part of the repository to another. The most effective tool for validating that no unauthorized changes to electronic records occur is to compute a hash digest before a preservation action occurs and after the action is completed. If there is change of only one bit, a comparison of the two will identify it. Capturing these pre- and posthash digests and saving them as preser- vation description information can contribute to an electronic chain of custody.
A robust fi rewall that blocks unauthorized access with tightly controlled role-based permission rights will help protect the security of records in the custody of the repository.
A further enhancement to protect against a cataclysmic natural or man- made disaster is maintaining a backup copy of the repository’s holdings at an off-site facility.
8. Capture and save preservation metadata. Preservation metadata, which consists of tracking, capturing, and maintaining documentation of all preservation ac- tions associated with electronic records, involves identifying these events, the agents that executed the actions, and the results of the actions, including any corrective action taken. Saving this metadata along with the hash digest integ- rity validations just discussed enables a robust electronic chain of custody and establishes a strong basis for the trustworthiness of electronic records in the custody of the digital repository
9. Provide access. Access to usable and trustworthy records is the ultimate justifi cation for digital preservation. In some respects, this may be the most challenging as- pect of digital preservation because user expectations for customized retrieval tools, access speed, and delivery formats of electronic records may exceed the current resources of a trusted digital repository. Nonetheless, some form of user access through replication of records in a single open standard technol- ogy format, such as PDF/A for text and scanned images and JPEG 2000 for digital photographs, would be a major accomplishment and form the basis for a more aggressive access program over time.
344 INFORMATION GOVERNANCE
10. Engage proactively with records producers and other stakeholders. The traditional no- tion of an archive being in a reactive mode with regard records producers and other stakeholders in LTDP simply will not work in today’s world. Proactive engagement with records producers about how capturing electronic records in open standard technology-neutral formats can support both current business operation requirements and long-term requirements for usable, understand- able, and trustworthy archives can be a win-win for the digital repository and the records producers. Equally important is the notion of proactive engagement with all of the stakeholders in ensuring long-term access to usable, understand- able, and trustworthy electronic records. Support of other stakeholders can be leveraged to gain broad organizational support for the digital repository.
Evolving Marketplace
The design and implementation of a digital repository that operates under this digital preservation strategy can be carried out in several different ways. One way is to use internal expertise to build a stand-alone repository that conforms to these digital preservation strategy requirements. Typically, an internally built repository is costly, takes considerable time to implement, and may not meet all expectations because of technical inexperience. An alternative is to use the services and/or solutions offered by an external institution or supplier. A third-party solution is offered by Archivematica, a Vancouver, British Columbia, company that specializes in the use of open-source software and conformance to the specifi cations of ISO 14721. “Archivematica is a free and open-source digital preservation system that is designed to maintain standards- based, long-term access to collections of digital objects.” 15 Another company, Tessella Technology & Consulting,16 has an ISO 14721–conforming digital preservation solution called Safety Deposit Box that has been implemented in a number of national archives. In June 2012, Tessella introduced Preservica, 17 a cloud-based implementation of the Safety Deposit Box that runs on Amazon Web Services. It is likely that other repository solutions, preservation services, and cloud-based digital preservation services will emerge over the next few years. The digital preservation strategy discussed earlier can be used to assess the capabilities of these solutions.
Looking Forward
Organizations face signifi cant challenges in meeting their LTDP needs, especially organizations whose primary mission is to preserve and provide access to permanent records. They must collaborate with internal and external stakeholders, develop gov- ernance policies and strategies to govern and control information assets over long periods of time, inventory records in the custody of records producers, monitor tech- nology changes and evolving standards, and sustain trustworthy digital repositories. The most important consideration is to determine what level of LTDP maturity is appropriate, achievable, and affordable for the organization and to begin working me- thodically toward that goal for the good of the organization and its stakeholders over the long term. In addition, organizations should focus on what is doable over the next 10 to 20 years rather than the next 50 or 100 years.
LONG-TERM DIGITAL PRESERVATION 345
CHAPTER SUMMARY: KEY POINTS
■ Digital preservation is defi ned as long-term, error-free storage of digital infor- mation, with means for retrieval and interpretation, for the entire time span the information is required to be retained.
■ Digital preservation applies to content that is born digital as well as content that is converted to digital form.
■ Capability for properly ensuring access to authentic electronic records over time, (regardless of the challenges of technological obsolescence), is a sophisticated combination of policies, strategies, processes, specialized re- sources, and adoption of standards.
■ Most records are useful for only a short period of time, but some may need to be retained for long periods or permanently. For those records, organizations will need to plan for their preservation to ensure that they remain accessible, trustworthy, and useful.
■ Electronic records are being created at rates that pose signifi cant threats to our ability to organize, control, and make them accessible for as long as they are needed.
■ Threats to LTDP of records can be internal or external, from natural disasters, computer or storage failures, and even from the fi nancial viability of an orga- nization, which can limit needed funding.
■ Building and sustaining the capability to manage digital information over long periods of time is a shared responsibility among all stakeholders.
■ ISO 14721 is the lingua franca of digital preservation. The international digi- tal preservation community has embraced it as the framework for viable and technologically sustainable digital preservation repositories.
■ An ISO 14721 (OAIS)–compliant repository is the best way to preserve an organization’s long-term digital assets.
■ ISO/TR 18492 provides practical methodological guidance for the long-term preservation of e-documents, when the retention period exceeds the expect- ed life of the technology that created it.
■ ISO 16363 is an audit and certifi cation standard organized into three broad categories: organization infrastructure, digital object management, and tech- nical infrastructure and security risk management.
■ ISO 16363 represents the gold standard of audit and certifi cation for trust- worthy digital repositories.
■ The PREMIS standard defi nes a core set of preservation metadata elements with a supporting data dictionary applicable to a broad range of digital pres- ervation activities.
(Continued )
346 INFORMATION GOVERNANCE
Notes
1. Consultative Committee for Space Data Systems, Reference Model for an Open Archival Information Sys- tem (OAIS) (Washington, DC: CCSDS Secretariat, 2002), pp. 1-1.
2. Kate Cumming, “Metadata Matters,” in Julie McLeod and Catherine Hare, eds., Managing Electronic Records , p. 48 (London: Facet, 2005).s
3. David Rosenthal et al., “Requirements for Digital Preservation Systems,” D-Lib Magazine 11, no. 11 (November 2005), www.dlib.org/dlib/november05/rosenthal/11rosenthal.html .
4. “ISO 14721:2003, 2012 Space Data and Information Transfer Systems—Open Archival Informa- tion System—Reference Model,” www.iso.org/iso/catalogue_detail.htm?csnumber=24683 (accessed May 21, 2012).
5. Ibid., section 4.1. 6. Ibid., section 5.4. 7. See ISO 16363:2012 (E), sections 3.1–3.5.2. 8. See ibid., sections 4.1–4/6/2/1. 9. See ibid., sections 5.1–5.2.3. 10. For a useful overview of PREMIS, see Priscilla Caplan, “Understanding PREMIS,” Library of Con-
gress, February 1, 2009, www.loc.gov/standards/premis/understanding-premis.pdf . 11. Library of Congress, “PREMIS Data Dictionary Version 2.2: Hierarchical Listing of Semantic Units,”
September 13, 2012, www.loc.gov/standards/premis/v2/premis-dd-Hierarchical-Listing-2-2.html . 12. Charles Dollar and Lori Ashley are codevelopers of this model. Since 2007 they have used it successfully in
both the public and private sectors. The most recent instance is a digital preservation capability assessment for the U.S. Council of State Archivists (CoSA). For more information about the model, see “Digital Pres- ervation Capability Maturity Model” at www.savingthedigitalworld.com (accessed December 12, 2013).
13. ISO 14721 uses “fi xity” to express the notion that there have been no unauthorized changes to elec- tronic records and associated Preservation Description Information in the custody of the repository. See ISO 14721:2003 (E): 1.6.
■ Many digital fi le formats are proprietary, meaning that content can be viewed and controlled only by the software application used to create, use, and store it.
■ The digital preservation community recognizes that open standard technology- neutral standards play a key role in ensuring that digital records are usable, understandable, and reliable for as far into the future as may be required.
■ The PDF/A fi le format was specifi cally designed for digital preservation.
■ PNG replaced GIF as an international standard for grayscale and color images in 2004.
■ JPEG 2000 is an international standard for compressing and rendering full- color and grayscale digital images in full size or as thumbnails.
■ The Long-Term Digital Preservation Capability Maturity Model simplifi es con- formance to ISO 14721 and ISO 16363.
■ Migration, refreshment, and replication are examples of specifi c preservation techniques.
■ It is likely that new third-party repository solutions and preservation services, including cloud-based offerings, will emerge over the next few years.
CHAPTER SUMMARY: KEY POINTS (Continued )
LONG-TERM DIGITAL PRESERVATION 347
14. For information about digital preservation capability performance metrics, visit “Digital Preservation Capability Maturity Model.”
15. Archivematica, “What Is Archivematica?” October 15, 2012, www.archivematica.org/wiki/Main_Page . 16. Tessella, “Tessella SDB” www.tessella.com/tag/safety-deposit-box/ (accessed June 28, 2012). 17. Tessella, “Preservica: Digital Preservation as a Service” January 2011, www.digital-preservation.com/
wp-content/uploads/Paas-Description-V3-Alternate-Web.pdf .
349
C H A P T E R 18 Maintaining an Information Governance Program and Culture of Compliance*
* Portions of this chapter are adapted from Chapter 17 , Robert F. Smallwood, Safeguarding Critical E-Documents: Implementing a Program for Securing Confi dential Information Assets , © John Wiley & Sons, Inc., 2012. Reproduced with s permission of John Wiley & Sons, Inc.
M aintaining your information governance (IG) program beyond an initial proj- ect effort is key to realizing continued and long-term benefi ts of IG. This means that the IG program must become an everyday part of an organiza-
tion’s operations and communications. It requires vigilant and consistent monitoring and auditing to ensure that IG policies and processes are effective and consistently followed and enforced. If proper controls are in place, IG-infused processes should become a regular part of the enterprise’s operations. It also requires an ongoing train- ing and communications program to keep employees apprised of approved processes and behaviors that support IG.
Monitoring and Accountability
Monitoring and accountability require a continuous tightening and expansion of pro- tections and the implementation of newer, strategic technologies. Information tech- nology (IT) developments and innovations that can foster the effort must be steadily monitored and evaluated, and those technology subsets that can assist in providing security need to be incorporated into the mix.
The IG policies themselves must be reviewed and updated periodically to acco- mmodate changes in the business environment, laws, regulations, and technology. Program gaps and failures must be addressed, and the effort should continue to improve and adapt to new types of security threats.
That means accountability: Some individual must remain responsible for an IG policy’s administration and results.1 Perhaps the executive sponsor for the initial project becomes the chief information governance offi cer or IG czar of sorts; or the chief executive offi cer continues ownership of the program and drives its active
350 INFORMATION GOVERNANCE
improvement. The organization also may decide to form a standing IG board, steer- ing committee, or team with specifi c responsibilities for monitoring, maintaining, and advancing the program.
However it takes shape, an IG program must be ongoing, dynamic, and aggressive in its execution in order to remain effective.
Staffi ng Continuity Plan
In today’s work environment, employees are more mobile in their careers: people take new career opportunities outside of the organization and also change jobs and move to other positions within an organization, so it is critical to have a continuity plan for your IG program. Backup and supporting designates must be named and kept current on the administration of the program. So you must have a supporting sponsor or se- nior sponsor to fi ll the role of executive sponsor, should the need arise; likewise, there needs to be other human resource/staffi ng redundancies built in to ensure the smooth and continued operation of the IG program, in the event of an unplanned incident that threatens it.
The approach to an IG program is similar to that of a a vital records (those critical business records that an organization must have to continue operations) program. Backups of backups must be built in. In vital records, there must be backups of backup copies of vital records, and they must be safely stored and also there needs to be backup IT systems and processes in place to ensure that an or- ganization can continue its operations. These redundancies must be considered, tested, and implemented. This may mean that when the formal program manager is unable to execute his or her duties, an assistant or designated backup can carry out those duties.
It is also a good idea to cross-train employees. With this approach, the legal team, for instance, will better understand the needs and requirements of the records man- agement function, and vice versa. Cross-training improves overall organization ac- ceptance and understanding of the IG program while building in safeguards to ensure that it keeps running.
Maintaining an IG program for requires that someone is accountable for continual monitoring and refi nement of policies and tools.
IG programs need built-in staffi ng redundancies to ensure their continued operation in the event of employee turnover or transfer.
MAINTAINING AN INFORMATION GOVERNANCE PROGRAM 351
Continuous Process Improvement
Maintaining IG program effectives requires implementing principles of continuous process improvement (CPI). CPI is a “never-ending effort to discover and eliminate the main causes of problems. It accomplishes this by using small-steps improvements, rather than implementing one huge improvement.” In Japan, the word kaizen refl ects this gradual and constant process, as it is enacted throughout the organization, regard- less of department, position, or level.2 To remain effective, the program must continue using CPI methods and techniques.
Maintaining and improving the program will require monitoring tools, periodic audits, and regular meetings for discussion and approval of changes to improve the program. It will require a cross section of team leaders from IT, legal, records manage- ment, compliance, internal audit, and risk management as well as functional business units participating actively and discussing possible threats and sources of information leakage.
Why Continuous Improvement Is Needed
Although the specifi c drivers of change are always evolving, the reasons that organiza- tions need to continuously improve their program for securing information assets are relatively constant. These reasons include:
■ Changing technology. New technology capabilities need to be monitored and considered with an eye to improving, streamlining, or reducing the cost of IG. The IG program needs to anticipate new types of threats and also evaluate add- ing or replacing technologies to continue to improve it.
■ Changing laws and regulations. Compliance with new or updated laws and regu- lations must be maintained.
■ Internal IG requirements. As an organization updates and improves its overall IG, the program elements that concern critical information assets must be kept aligned and synchronized.
■ Changing business plans. As the enterprise develops new business strategies and enters new markets, it must reconsider and update its IG program. If, for in- stance, a fi rm moves from being a domestic entity to a regional or global one, new laws and regulations will apply, and perhaps new threats will exist and new security strategies must be formed.
■ Evolving industry best practices. Best practices change, and new best practices arise with the introduction of each successive wave of technology and with changes in the business environment. The program should consider and leverage new best practices.
■ Fixing program shortcomings. Addressing fl aws in the IG program that are dis- covered through testing, monitoring, and auditing; or addressing an actual breach of confi dential information; or a legal sanction imposed due to non- compliance are all reasons why a program must be revisited periodically and kept updated. 3
352 INFORMATION GOVERNANCE
Maintaining the IG program requires that a senior-level offi cer of the en- terprise continues to sponsor it and pushes for enforcement, improvement, and expansion. This requires leadership and consistent and clear messages to employees. IG and the security of information assets must be on the minds of all members of the enterprise; it must be something they are aware of and think about daily. They must be on the lookout for ways to improve it, and they should be rewarded for those contributions.
Gaining this level of mindshare in employees’ heads will require follow-up messages in the form of personal speeches and presentations, newsletters, corporate announcements, e-mail messages, and even posters placed at strategic points (e.g., near the shared printing station advising about secure procedures). Employees must be reminded that information governance is everyone’s job and meeting compliance and legal demands help contribute to achieving business objectives, and also that los- ing, misusing, or leaking confi dential information harms the organization over the long term and erodes its value.
Maintaining the IG program requires that a senior-level offi cer of the enter- prise continues to push for enforcement, improvement, and expansion of the program to secure and control information.
CHAPTER SUMMARY: KEY POINTS
■ Keeping an enterprise’s IG program effective requires vigilant and consistent monitoring and auditing to ensure that IG are followed and enforced.
■ Information technologies that can assist in advancing the program must be steadily monitored, evaluated, and implemented.
■ To maintain and improve the IG program requires monitoring tools, regular audits, and regular meetings for discussion and approval of changes to the program to continually improve it.
■ IG programs need built-in staffi ng redundancies to ensure their continued operation in the event of employee turnover or transfer.
■ Organizations need to continuously improve their program for securing in- formation assets due to:
■ Changing technology
■ Changing laws and regulations
MAINTAINING AN INFORMATION GOVERNANCE PROGRAM 353
Notes
1. Mark Woeppel, “Is Your Continuous Improvement Organization a Profi t Center?” June 15, 2009, www.processexcellencenetwork.com/process-management/articles/is-your-continuous-improvement- organization-a-prof/ (accessed September 12, 2011).
2. Donald Clark, “Continuous Process Improvement,” Big Dog and Little Dog’s Performance Juxtaposi- tion (blog), March 11, 2010, www.nwlink.com/~donclark/perform/process.html (accessed September 12, 2011).
3. Randolph Kahn and Barclay T. Blair, Information Nation: Seven Keys to Information Management Compli- ance (New York: AIIM International, 2004), pp. 242–243.
■ Internal information governance requirements
■ Changing business plans
■ Evolving industry best practices
■ Program shortcomings
■ Maintaining an IG program requires that a senior-level offi cer of the enter- prise continues to push for enforcement, improvement, and expansion of the program to secure and control information.
CHAPTER SUMMARY: KEY POINTS (Continued )
355
By Barb Blackburn, CRM, with Robert Small- wood; edited by Seth Earley
A P P E N D I X A Information Organization and Classifi cation: Taxonomies and Metadata*
* Portions of this appendix are adapted from Chapter 6 and 16, Robert F. Smallwood, Managing Electronic Records: Methods, Best Practices, and Technologies , © John Wiley & Sons, Inc., 2013. Reproduced with permission of John Wiley s & Sons, Inc.
Information governance (IG) necessarily involves organizing and classifying information. IG is critical to enabling improved search results to base business deci-sions on, executing records retention schedule (RRS) tasks, and sifting through and fi nding responsive (relevant) information in the e-discovery process. Well-organized information constructs provide downstream benefi ts across the organization in not only compliance and legal efforts but also day-to-day decision-making and knowledge worker productivity. It is even more crucial in the era of Big Data.
The creation of electronic documents and records is exploding exponentially and multiplying at an increasing rate. Sifting through all this information results in a lot of wasted, unproductive (and expensive) knowledge worker time. This has real costs to the enterprise. According to the study “The High Cost of Not Finding Information,” “knowledge workers spend at least 15 to 25 percent of the workday searching for information. Only half the searches are successful.”1 Experts point to poor taxonomy design as being at the root of these failed searches and lost productivity.
Taxonomies are at the heart of the solution to harnessing and governing information. Taxonomies are hierarchical classifi cation structures used to standardize the s naming and organization of information, and their role and use in managing electronic records cannot be overestimated.
Although the topic of taxonomies can get complex, in electronic records man- agement (ERM) they are a sort of online card catalog that is cross-referenced witht hyperlinks that is used to organize and manage records and documents. 2
According to Forrester Research, taxonomies “represent agreed-upon terms and relationships between ideas or things and serve as a glossary or knowledge map help- ing to defi ne how the business thinks about itself and represents itself, its products and services to the outside world.” 3
356 APPENDIX A
Gartner Group researchers warn that “to get value from the vast quantities of in- formation and knowledge, enterprises must establish discipline and a system of gover- nance over the creation, capture, organization, access, and utilization of information.”4
Over time, organizations have implemented taxonomies to attempt to gain control over their mounting masses of information, creating an orderly structure to harness unstructured information (such as e-documents, e-mail messages, scanned records, and other digital assets), and to improve searchability and access. 5
Taxonomies for ERM standardize the vocabulary used to describe records, making it easier and faster for searches and retrievals to be made.
Search engines are able to deliver faster and more accurate results from good taxonomy design by limiting and standardizing terms. A robust and effi cient taxonomy design is the underpinning that indexes collections of documents uniformly and helps knowledge workers fi nd the proper fi les to complete their work. The way a taxonomy is organized and implemented is critical to the long-term success of any enterprise, as it directly impacts the quality and productivity of knowledge workers who need orga- nized, trusted information to make business decisions.
It does not sound so complicated, simply categorizing and cataloging information, yet most enterprises have had disappointing or inconsistent results from the taxono- mies they use to organize information. Designing taxonomies is hard work. Developing an effi cient and consistent taxonomy is a detailed, tedious, labor-intensive team effort on the front end, and its maintenance must be consistent and regular and follow estab- lished IG guidelines in order to maintain its effectiveness.
Once a taxonomy is in place, it requires systematic updates and reviews to ensure that guidelines are being followed and new document and record types are included in the taxonomy structure. Technology tools like text mining, social tagging, and auto- classifi cation can help uncover trends and suggest candidate terms. (More on these technologies later in this chapter.)
When done correctly, the business benefi ts of good taxonomy design go much further than speeding search and retrieval; an effi cient, operational taxonomy also is a part of IG efforts that help the organization to manage and control information so that it may effi ciently respond to litigation requests, comply with governmental regu- lations, and meet customer needs (both external and internal).
Taxonomies are crucial to fi nding information and optimizing knowledge worker pro- ductivity, yet some surveys estimate that nearly half of organizations do not have a standardized taxonomy in place. 6
Knowledge workers spend at least 15 to 25 percent of the workday searching for information with only half the searches being successful.
To maximize effi cient and effective retrieval of records for legal, business, and regulatory purposes, organizations must develop and implement taxonomies.
INFORMATION ORGANIZATION AND CLASSIFICATION: TAXONOMIES AND METADATA 357
According to the Montague Institute:
The way your company organizes information (i.e., its taxonomy) is critical to its future. A taxonomy not only frames the way people make decisions, but also helps them fi nd the information to weigh all the alternatives. A good taxonomy helps decision makers see all the perspectives, and “drill down” to get details from each , and explore lateral relationships among them.7 (Emphasis added.)
Without a taxonomy, your company will fi nd it diffi cult to leverage intellectual capital, engage in electronic commerce, keep up with employee training, and get the most out of strategic partnerships.
With the explosion in growth of electronic documents and records, a standardized classifi - cation structure that a taxonomy imposes optimizes records retrievals for daily business opera- tions and also for legal and regulatory demands. s 8
Since end users can choose from topic areas, subject categories, or groups of docu- ments rather than blindly typing word searches, taxonomies narrow searches and speed search time and retrieval.9
“The link between taxonomies and usability is a strong one. The best taxonomies effi ciently guide users to exactly the content they need. Usability is judged in part by how easily content can be found,” according to the Montague Institute.10
Importance of Navigation and Classifi cation
Taxonomies need to be considered from two main perspectives: navigation and classifi cation. Most people consider the former, but not the latter. The navigational con- struct that is represented by a taxonomy is evident in most fi le structures and fi le shares—the nesting of folders within folders—and in many Web applications where users are navigating hierarchical arrangements of pages or links. However, classifi ca- tion is frequently behind the scenes. A document can “live” in a folder that the user can navigate to. But within that folder, the document can be classifi ed in different ways through the application of metadata. Metadata are descriptive fi elds that delineate a (document or) record’s characteristics, such as author, title, department of origin, date created, length, number of pages or fi le size, and so forth. The metadata is also part of the taxonomy or related to the taxonomy. In this way, usability can be impacted by giving the user multiple ways to retrieve their information. s 11
Taxonomies speed up the process of retrieving records because end users can select from subject categories or topics.
Taxonomies need to be considered from two main perspectives: navigation and classifi cation.
358 APPENDIX A
When Is a New Taxonomy Needed?
In some cases, organizations have existing taxonomy structures, but they have gone out of date or have not been maintained. They may not have been developed with best practices in mind or with correct representation of user groups, tasks, or applications. There are many reasons why taxonomies no longer provide the full value that they can offer. Certain situations clearly indicate that the organization needs a refactored or new taxonomy.12
If knowledge workers in your organization regularly conduct searches and receive hundreds of pages of results, then you need a new taxonomy. If you have developed a vast knowledge base of documents and records and designated subject matter ex- perts (SMEs), yet employees struggle to fi nd answers, you need a new taxonomy. If there is no standardization of the way content is classifi ed and cataloged, or there is confl ict between how different groups or business units classify content, you need a new taxonomy. And if your organization has experienced delays, fi nes, or undue costs in producing documentation to meet compliance requests or legal demands, your or- ganization needs to work on a new taxonomy. 13
Taxonomies Improve Search Results
Taxonomies can improve a search engine’s ability to deliver results to user queries in fi nding documents and records in an enterprise. The way the digital content is indexed (e.g., spidering, crawling, rule sets, algorithms) is a separate issue, and a good taxonomy improves search results regardless of the indexing method. 14
Search engines struggle to deliver accurate and refi ned results since the wording in queries may vary and since words can have multiple meanings. A taxonomy ad- dresses these problems since the terms are set and defi ned in a controlled vocabulary. y
Metadata (data fi elds that describe content, such as document type, creator, date of creation, etc.) must be leveraged in the taxonomy design effort.
A formal defi nition of metadata is “standardized administrative or descriptive data about a document [or record] that is common for all documents [or records] in a given repository.” Standardized metadata elements of e-documents should be utilized and supported by including them in controlled vocabularies when possible. 15
The goal of a taxonomy development effort is to help users fi nd the information they need, in a logical and familiar way, even if they are not sure what the correct search terminology is. Good taxonomy design makes it easier and more comfortable for users
Taxonomies improve search results by increasing accuracy and also improving the user experience.
Poor search results, inconsistent or confl icting fi le plans, and the inability to locate information on a timely basis are indications taxonomy work is needed.
INFORMATION ORGANIZATION AND CLASSIFICATION: TAXONOMIES AND METADATA 359
to browse topics and drill down into more narrow searches to fi nd the documents and records they need. Where it really becomes useful and helps contribute to productivity is when complex or compound searches are conducted.
Metadata and Taxonomy
One potential limitation of a purely hierarchical taxonomy is the lack of association be- tween tiers (or nodes). There are often one-to-many or many-to-many associations be- tween records. For example, an employee travels to a certifi cation course. The resultant “expense report” is classifi ed in the Finance/Accounts Payable/Travel Expense node of the taxonomy. The “course completion certifi cate” that is generated from the same travel (and is included as backup documentation for the expense report) is appropriately classifi ed in the Human Resources/Training and Certifi cation/Continuing Education node. For ERM systems that do not provide the functionality for a multifaceted taxonomy, metadata is used to provide the link between the nodes in the taxonomy (see Figure A.1 ).
Metadata, which are the characteristics of a document expressed in data fi elds, must be leveraged in taxonomy design.
Figure A.1 Metadata Link to Taxonomy Example Source: Blackburn Consulting
Finance
Accounts Payable
Travel Expense
Taxonomy
Human Resources
Applicant
Processing
Position Posting
M e ta
d a ta
L in
k
Training and
Certification
Continuing Education
Course
Completion Certificate
Expense Report
Title: Expense Report
Travel Date: 12/01/2004
Employee ID: 999-99-9999
(etc. ...)
Title: Course Completion Certificate
Subject: Real Estate
Employee ID: 999-99-9999 (etc. ...)
Metadata
Employee ID: 999-99-9999
360 APPENDIX A
Metadata schema must be structured to provide the appropriate associations as well as meet the users’ keyword search needs. It is important to limit the number of meta- data fi elds that a user must manually apply to records. Most recordkeeping systems provide the functionality to automatically assign certain metadata to records based on rules that are established in advance and set up by a system administrator (referred in this book as inherited metadata ). The record’s classifi cation or location in the taxonomy is appropriate for inherited metadata.
Metadata can also be applied by auto-categorization software. This can reduce the bur- den placed on the user and increase the quality and consistency of metadata. These approaches need to be tested and fi ne-tuned in order to ensure that they meet the needs of the organization. 16
The fi le plan will provide the necessary data to link the taxonomy to the docu- ment via inherited metadata. In most systems, this metadata is applied by the system and is transparent to the users. Additional metadata will need to be applied by the user. To maintain consistency, a thesaurus , which contains all synonyms and defi nitions, is used to enforce naming conventions (see Figure A.2 ).
Metadata Governance, Standards, and Strategies
Metadata can be a scary term to a lot of people. It just sounds complicated. And it s can get complicated. It is often defi ned as “data about data,” which is true but some- what confusing, and this does not provide enough information for most people to understand.
Figure A.2 Application of Metadata to Taxonomy Structure Source: Blackburn Consulting
Applying Metadata
Taxonomy
Services for Citizens
Mode of Delivery
Support Delivery
of Services
Management of Government
Resources
Human Resources
Applicant Processing
Position Posting
Announce- ment
Metadata
Thesaurus File Plan
User Supplied: Inherited: Business Area: Human Resources Function: Applicant Processing Subfunction: Position Posting
Title: Position Announcement Date: Position Title: (etc. ...)
INFORMATION ORGANIZATION AND CLASSIFICATION: TAXONOMIES AND METADATA 361
“Meta” derives from a Greek word that means “alongside, with, after, next.” Meta- data can be defi ned as “structured data about other data.” 17
In ERM, metadata identifi es a record and its contents. ERM metadata describes a record’s characteristics so that it may be classifi ed more easily and completely. Metadata fi elds, or terms, for e-records can be as basic as identifying the name of the document, the creator or originating department, the subject, the date it was created, the document type, the length of the document, its security classifi cation, and its fi le type.
Creating standardized metadata terms is part of an IG effort that enables faster, more complete, and more accurate searches and retrieval of records. This is impor- tant not only in everyday business operations but also, for example, when searching through potentially millions of records during the discovery phase of litigation.
Good metadata management also assists in the maintenance of corporate memory and in improving accountability in business operations. 18
Using a standardized format and controlled vocabulary provides a “precise and comprehensible description of content, location, and value.”19 Using a controlled vo- cabulary means your organization has standardized a set of terms used for metadata elements describing records. This “ensures consistency across a collection” and helps with optimiz- ing search and retrieval functions and records research as well as meeting e-discovery requests, compliance demands, and other legal and regulatory requirements. Your organization may, for instance, decide to use the standardized Library of Congress Subject Headings as standard terms for the “subject” metadata fi eld. 20
Metadata also describes a record’s relationships with other documents and records and s what actions may have been taken on the record over time. This helps to track its his- tory and development.
The role of metadata in managing records is multifaceted; it helps to:
■ Identify the records, record creators and users, and the areas within which they are utilized.
■ Determine the relationships between records and the knowledge workers who use them, and the relationships between the records and the business processes they are supporting.
■ Assist in managing and preserving the content and structure of the record. ■ Support IG efforts that outline who has access to records and the context (when
and where) in which access to the records is granted. ■ Provide an audit trail to document changes to or actions on the record and its
metadata. ■ Support the fi nding and understanding of records and their relationships. 21
In addition, good metadata management provides additional business benefi ts in- cluding increased management control over records, improved records authenticity and security, and reusability of metadata.22
Metadata terms or fi elds describe a record’s characteristics so that it may be classifi ed, managed, and found more easily.
362 APPENDIX A
Often, organizations will establish mandatory metadata terms that must accom- pany a record and some optional ones that may help in identifying and fi nding it. A record is more complete with more metadata terms included, which also facilitates search and retrieval of records.23 This additional metadata is particularly helpful when knowledge workers are not quite sure which records they are searching for and therefore enter some vague or conceptual search terms. The more detail that is in the metadata fi elds, the more likely—and faster—that end users can fi nd the records they need to complete their work. Populating metadata fi elds provides a measurable productivity benefi t to the organization, although it is diffi cult to quantify. Certainly, search times will de- crease upon implementation of a standardized metadata program, and improved work output and decisions will also follow.
Standardizing the metadata terms, defi nitions, and classifi cations for documents and records is done by developing and enforcing IG policy. This standardization effort gives users confi dence that the records they are looking for are, in fact, the complete and current set they need to work with. And it provides the basis for a legally defensible records management (RM) program that will hold up in court.
A metadata governance program must be an ongoing effort that keeps metadata up to date and accurate. Often, once a metadata project is complete, attention to it wanes, mainte- nance tasks are not executed, and soon the accuracy and completeness of searches for documents and records deteriorates. So metadata maintenance is an ongoing process, and it must be formalized into a program that is periodically checked, tested, and audited.
Types of Metadata
Several types or categories of metadata are described next.
Administrative metadata. Metadata that includes management information about the digital resource, such as ownership and rights management.
Descriptive metadata. Metadata that describes the intellectual content of a resource and is used for the indexing, discovery, and identifi cation of a digital resource.
Preservation metadata. Metadata that specifi cally captures information that helps facilitate management and access to digital fi les over time. This inherently
Metadata terms can be as basic as the name of the document, the creator, the subject, the date it was created, the document type, the length of the docu- ment, its security classifi cation, and its fi le type.
A metadata governance and management program must be ongoing.
INFORMATION ORGANIZATION AND CLASSIFICATION: TAXONOMIES AND METADATA 363
includes descriptive, administrative, structural, and technical metadata elements that focus on the provenance, authenticity, preservation activity, technical envi- ronment, and rights management of an object.
Structural metadata. Metadata that is used to display and navigate digital resources and describes relationships between multiple digital fi les, such as page order in a digitized book.
Technical metadata. Metadata that describes the features of the digital fi le, such as resolution, pixel dimension, and hardware. The information is critical for migration and long-term sustainability of the digital resource. 24
Core Metadata Issues
Some key considerations and questions that need to be answered for effective imple- mentation of a metadata governance program are listed next.
■ Who is the audience? Which users will be using the metadata in their daily opera- tions? What is their skill level? Which metadata terms/fi elds are most important to them? What has been their approach to working with documents and records in the past, and how can it be streamlined or improved? What terms are im- portant to management? How can the metadata schema be designed to accom- modate the primary audience and other secondary audiences? Answers to these questions will come only with close consultation with these key stakeholders.
■ Who else can help? That is, which other stakeholders can help build a consensus on the best metadata strategy and approach? What other records creators, us- ers, custodians, auditors, and legal counsel personnel can be added to the team to design a metadata approach that maximizes its value to the organization? Are there subject matter experts (SMEs)? What standards and best practices can be applied across functional boundaries to improve the ability of various groups to collaborate and leverage the metadata?
■ How can metadata governance be implemented and maintained? Creating IG guidelines? and rules for metadata assignment, input, and upkeep are a critical step—but how will the program continue to be updated to maintain its value to the organization? What business processes and audit checks should be in place? How will the quality of the metadata be monitored and controlled? Who is accountable?
■ What will the user training program look like? How will users be trained initially, and how will continued education and reinforcement be communicated? Will there be periodic meetings of the IG or metadata team to discuss issues and concerns? What is the process for adding or amending metadata terms as the business progresses and changes? These questions must be answered, and a documented plan must be in place.
The main types of metadata are: administrative, descriptive, preservation, structural, and technical metadata.
364 APPENDIX A
■ What will the communications plan be? Management time and resources are also needed to continue the practice of informing and updating users, and encour- aging compliance with internal metadata standards and policies. Users need to know on a consistent basis why metadata is important and the value that good metadata management can bring to the organization.
International Metadata Standards and Guidance
Metadata is what gives an e-record its record status; in other words, electronic records metadata is what makes an electronic fi le a record. There are a number of established international standards for metadata structure, and additional guidance on strategy and implementation has been provided by standards groups, such as the International Organization for Standardization (ISO) and American National Standards Institute/ National Information Standards Organization (ANSI/NISO), and other bodies, such as the Dublin Core Metadata Initiative (DCMI).
ISO 15489 Records Management Defi nitions and Relevance
The international RM standard ISO 15489 states that “a record should correctly re- fl ect what was communicated or decided or what action was taken. It should be able to support the needs of the business to which it relates and be used for accountability purposes.” Its metadata defi nition is “data describing context, content, and structure of records and their management through time.” 25
A key difference between a document and a record is that a record is fi xed, whereas a document can continue to be edited. Preventing records from being edited can be ac- complished in part by indicating their formal record status in a metadata fi eld, among other controls.
Proving that a record is, in fact, authentic and reliable necessarily includes prov- ing that its metadata has remained intact and unaltered through the entire chain of custody of the record.
ISO Technical Specifi cation 23081–1:2006 Information and Documentation—Records Management Processes—Metadata for Records—Part 1: Principles
[ISO 23081–1] covers the principles that underpin and govern records man- agement metadata. These principles apply through time to:
■ Records and their metadata; ■ all processes that affect them;
Proving that a record is authentic and reliable includes proving that its metadata has remained intact and unaltered through the record’s entire chain of custody.
INFORMATION ORGANIZATION AND CLASSIFICATION: TAXONOMIES AND METADATA 365
■ any system in which they reside; ■ any organization that is responsible for their management. 26
This standard provides guidance for metadata management within the “frame- work” of ISO 15489 and addresses the relevance and roles that metadata plays in RM intensive business processes. There are no mandatory metadata terms set, as these will differ by organization and by location and governing national and state/provincial laws. 27 The standard lists 10 purposes or benefi ts of using metadata in records manage- ment, which can help build the argument for convincing users and managers of the importance of good metadata governance and its resultant benefi ts.
Dublin Core Metadata Initiative
The DCMI produced a basic or core set of metadata terms that have served as the basis for many public and private sector metadata governance initiatives. Initial work in workshops fi lled with experts from around the world took place in 1995 in Dublin, Ohio ( not Ireland). From these working groups arose the idea of a set of “core meta-t data” or essential metadata elements with generic descriptions. “The fi fteen-element ‘Dublin Core’ achieved wide dissemination as part of the Open Archives Initiative Protocol for Metadata Harvesting (OAI-PMH) and has been ratifi ed as IETF RFC 5013, ANSI/NISO Standard Z39.85–2007, and ISO Standard 15836:2009.” 28
Dublin Core has as its goals:
Simplicity of creation and maintenance The Dublin Core element set has been kept as small and simple as possible to allow a nonspecialist to create simple descriptive records for information resources easily and inexpensively, while providing for effective retrieval of those resources in the networked environment. Commonly understood semantics Discovery of information across the vast commons of the Internet is hin- dered by differences in terminology and descriptive practices from one fi eld of knowledge to the next. The Dublin Core can help the “digital tourist”—a nonspecialist searcher—fi nd his or her way by supporting a common set of elements, the semantics of which are universally understood and supported. For example, scientists concerned with locating articles by a particular
ISO 23081 defi nes needed metadata for records and provides guidance for metadata management within the “framework” of ISO 15489.
Goals of the Dublin Core Metadata Initiative are simplicity, commonly under- stood semantics, international scope, and extensibility.
366 APPENDIX A
author, and art scholars interested in works by a particular artist, can agree on the importance of a “creator” element. Such convergence on a common, if slightly more generic, element set increases the visibility and accessibility of all resources, both within a given discipline and beyond. International scope The Dublin Core Element Set was originally developed in English, but ver- sions are being created in many other languages, including Finnish, Norwegian, Thai, Japanese, French, Portuguese, German, Greek, Indonesian, and Spanish. The DCMI Localization and Internationalization Special Interest Group is coordinating efforts to link these versions in a distributed registry. Although the technical challenges of internationalization on the World Wide Web have not been directly addressed by the Dublin Core development com- munity, the involvement of representatives from virtually every continent has ensured that the development of the standard considers the multilingual and multicultural nature of the electronic information universe. Extensibility While balancing the needs for simplicity in describing digital resources with the need for precise retrieval, Dublin Core developers have recognized the impor- tance of providing a mechanism for extending the DC [Dublin Core] element set for additional resource discovery needs. It is expected that other commu- nities of metadata experts will create and administer additional metadata sets, specialized to the needs of their communities. Metadata elements from these sets could be used in conjunction with Dublin Core metadata to meet the need for interoperability. The DCMI Usage Board is presently working on a model for accomplishing this in the context of “application profi les.” 29 The fi fteen element “Dublin Core” described in this standard is part of a larger set of metadata vocabularies and technical specifi cations maintained by the Dublin Core Metadata Initiative. . . . The full set of vocabularies, DCMI Metadata Terms . . . , also includes sets of resource classes (including the DCMI Type Vocabulary . . . ), vocabulary encoding schemes, and syntax encoding schemes. The terms in DCMI vocabularies are intended to be used in combination with terms from other, compatible vocabularies in the context of application profi les and on the basis of the DCMI Abstract Model. 30
Global Information Locator Service
Global Information Locator Service (GILS) is ISO 23950, the international standard for information searching over networked (client/server) computers, which is a sim- plifi ed version of structured query language (SQL). ISO 23950 is a federated search protocol that equates to the U.S. standard ANSI/NISO Z39.50. The U.S. Library of Congress is the offi cial maintenance agency for both standards, “which are technically identical (though with minor editorial differences).” 31
ISO 23950 grew out of the library science community, although it is widely used, particularly in the public sector. 32 The use of GILS has tapered off as other meta- data standards at the international, national, industry level, and agency level have been established. 33
INFORMATION ORGANIZATION AND CLASSIFICATION: TAXONOMIES AND METADATA 367
“It [GILS] specifi es procedures and formats for a client to search a database provid- ed by a server, retrieve database records, and perform related information retrieval func- tions.” It does not specify a format, but information retrieval can be accomplished through full-text search, although it “also supports large, complex information collections.” 34 The standard specifi es how searches are made and how results are returned.
GILS helps people fi nd information, especially in large, complex environments, such as across multiple government agencies. It is used in more than 40 U.S. states and a number of countries, including Argentina, Australia, Brazil, Canada, France, Germany, Hong Kong, India, Spain, Sweden, Switzerland, United Kingdom, and many others.
Text Mining
On a continuing basis, text mining can be conducted on documents to learn of emerg- ing potential taxonomy terms. Text mining is simply performing detailed full-text searches on the content of document. And with more sophisticated tools like neural computing and artifi cial intelligence, concepts, not just keywords, can be discovered and leveraged for improving search quality for users.
Another tool is the faceted search (sometimes referred to as faceted navigation or faceted browsing), where, for instance, document collections are classifi ed in multiple ways rather than in a single, rigid taxonomy. Knowledge workers may apply multiple fi lters to search across documents and records and fi nd better and more complete results. And when they are not quite sure what they are looking for, or if it exists, a good taxonomy can help suggest terms, related terms, and associated content, truly contributing to enterprise knowledge management (KM) efforts, adding to corpo-t rate memory and increasing the organizational knowledge base. 35 Good KM helps to provide valuable training content for new employees and helps to reduce the impact of turnover and retiring employees.
Search is ultimately about metadata —whether your content has explicit metadata or not. The search engine creates a forward index and determines what words are contained in the documents being searched. It then inverts that index to provide the documents that words are contained in. This is effectively metadata about the content. A taxonomy can be used to enrich that search index in various ways. Index enrichment does require confi guration and integration with search engines, but the result is the ability to increase both precision and recall of search results. Search results can also be grouped and clustered using a taxonomy. Doing this allows large numbers of results
ISO 23950 (GILS) is the international standard for information searching over networked computers.
Text mining is simply performing detailed full-text searches on the content of document.
368 APPENDIX A
to be scanned and understood by the user more easily. Many of these functions are de- termined by the capabilities of search tools and document and RM systems. As search functionality is developed, do not miss this opportunity to leverage the taxonomy.
Records Grouping Rationale
Records are grouped together for fi ve primary reasons:
1. They tie together documents with like content, purpose, or theme. 2. To improve search and retrieval capabilities. 3. To identify content creators, owners, and managers. 4. To provide an understandable context. 5. For retention and disposition scheduling purposes.36
Taxonomies group records with common attributes. The groupings are constructed not only for RM classifi cation and functions but also to support end users in their search and retrieval activities. Associating documents of a similar theme enables users to fi nd documents when they do not know the exact document name. Choosing the theme or topic enables the users to narrow their search to fi nd the relevant information.
The theme or grouping also places the document name into context. Words have many meanings and adding a theme to them further defi nes them. For example, the word “article” could pertain to a newspaper article, an item or object, or a section of a legal document. If it were grouped with publications, periodicals, and so on, the mean- ing would be clear. The challenge here is when to choose to have a separate category for “article” or to group “article” with other similar publications. Some people tend to develop fi ner levels of granularity in classifi cation structures. These people can be called “splitters.” Those who group things together are “lumpers.” But there can be clear rules for when to lump versus split. Experts recommend splitting into another category when business needs demand that we treat the content differently or users need to seg- ment the content for some purpose. This rule can be applied to many situations when trying to determine whether a new category is needed. 37
Management, security, and access requirements are usually based on a user’s role in a process. Grouping documents based on processes makes the job of assigning the responsibilities and access easier. For example, documents used in fi nancial processes can be sensitive, and there is a need to restrict access to only those users that have the role in the business with a need to know.
Records retention periods are developed to be applied to a series (or group) of documents. When similar documents are grouped, it is easier to apply retention rules. However, when the grouping for retention is not the same as the grouping for other user views, a cross-mapping ( fi le plan ) scheme must be developed and incorporated into the taxonomy effort.
Business Classifi cation Scheme, File Plans, and Taxonomy
In its simplest defi nition, a business classifi cation scheme (BCS) is a hierarchical conceptual representation of the business activity performed by an organization. 38 The highest level of a BCS is called an information series, which signifi es “high-level
INFORMATION ORGANIZATION AND CLASSIFICATION: TAXONOMIES AND METADATA 369
business functions” of a business or governmental agency. The next level is themes, which represent the specifi c activities that feed into the high-level functions at the information series level. These two top levels are rarely changed in an organization.39
A BCS is often viewed as synonymous with the term “fi le plan,” which is the shared fi le structure in an ERM system, but it is not a direct fi le plan.
Yet a fi le plan can be developed and mapped back to the BCS and automated through an electronic document and records management system (EDRMS) or ERM system.40
A BCS is required by ISO 15489, the international RM standard. Together with the folders and records it contains, the BCS comprises what in the paper environment was called simply a “fi le plan.” A BCS is therefore a full representation of the business of an organization.
Classifi cation and Taxonomy
Classifi cation of records extends beyond the categorization of records in the taxonomy. It also must include the application of retention requirements. These are legal and busi- ness requirements that specify the length of time a record must be maintained. A records retention schedule is a document that specifi es the periods for which an organization’s records should be retained to meet its operational needs and to comply with legal and other requirements. The RRS groups documents into records series that relate to specifi c business activities. This grouping is performed because laws and regulations are mainly based on the business activity that creates the documents. These business activities are not neces- sarily the same as the activities described in the hierarchy of the taxonomy. Therefore, there must be a method to map the RRS to the Taxonomy. This is accomplished with a File Plan. The File Plan facilitates the application of retention rules during document categorization without requiring a user to know or understand the RRS (see Figure A.3 ).
Finance
Accounts Payable
Travel Expense
Taxonomy
Record Series 10
File Plan Retention Schedule
Classification
Retention Requirement #1
Retention Requirement #2
Retention Requirement #3
Retention Requirement #4
Retention Requirement #5
Retention Requirement #6
Retention Requirement #7
Record Series 20
Record Series 20-02
Record Series 10-08
Human Resources
Applicant Processing
Position Posting
FN-AP-10
FN-AP-10-08
HS-AP -20
HS-A P-20-
02
Business Function
Business Function
Business Function
Travel
Request
Form
Expense
Report
Job
Announce-
ment
Figure A.3 Mapping the Records Retention Schedule to the Taxonomy Source: Blackburn Consulting
370 APPENDIX A
Prebuilt versus Custom Taxonomies
Taxonomy templates for specifi c vertical industries (e.g., law, pharmaceuticals, aero- space) are provided by ECM, ERM/EDRMS, KM, enterprise search vendors, and trade associations. These prebuilt taxonomies use consistent terminology, have been tried and tested, and incorporate industry best practices, where possible. They can provide a jump-start and faster implementation at a lower cost than developing a cus- tom taxonomy in-house or with external consulting assistance.
There are advantages and disadvantages to each approach. A prebuilt taxonomy typically will have some parameters that can be confi gured to better meet the busi- ness needs of an organization, yet compromises and trade-offs will have to be made. It also may introduce unfamiliar terminology that knowledge workers will be forced to adapt to, increasing training time and costs, and reducing overall effectiveness. These considerations must be factored into the build-or-buy decision. Using the custom- developed approach, a taxonomy can be tailored to meet the precise business needs of an organization or business unit and can include nuances such as company-specifi c nomenclature and terminology. 41
Frequently, the longer and more costly customized approach must be used, since no prebuilt taxonomies fi t well. This is especially the case with niche enterprises or those operating in developing or esoteric markets. For mature industries, more pre- built taxonomies and template choices exist. Attempting to tailor a prebuilt taxonomy actually can end up taking longer than building one from scratch if it is not a good fi t in the fi rst place, so best practices dictate that organizations use prebuilt taxonomies where practical and custom-design taxonomies where needed.
There really is no one size fi ts all when it comes to taxonomy. And even when two or- ganizations do the exact same thing in the exact same industry, differences in their culture, process, and content will require customization and tuning of the taxonomy. Standards are useful for improving effi ciency of a process, and taxonomy projects really are internal standards projects. However, competitive advantage is attained through differentiation. A taxonomy specifi cally tuned to meet the needs of a particular enter- prise is actually a competitive advantage. 42
There is one other alternative, which is to “auto-generate” a taxonomy from the metadata in a collection of e-documents and records by using sophisticated statisti- cal techniques, such as term frequency and entity extraction, to attempt to create a taxonomy. 43 This method seems to be perhaps the best of both worlds in that it offers instant customization at a low cost, but, although these types of tools can help provide useful insights into the data on the front end of a taxonomy project and help provide valuable statistical renderings, the only way to focus on user needs is to interview and work with users to gain insights into their business process needs and requirements while considering the business objectives of the taxonomy project. This cannot be done with mathematical computations—the human factor is key.
Best practices dictate that taxonomy development includes designing the taxonomy structure and heuristic principles to align with user needs.
INFORMATION ORGANIZATION AND CLASSIFICATION: TAXONOMIES AND METADATA 371
In essence, these auto-generated taxonomy tools can determine which terms and documents are used frequently, but they cannot assess the real value of information be- ing used by knowledge workers and how they use the information. That takes consulta- tion with stakeholders, studied observation, and business analysis. 44 Machine-generated taxonomies look like they were generated by machines —which is to say, they are not very ss usable by humans. 45
Thesaurus Use in Taxonomies
In the use of taxonomies, a thesaurus contains the agreed-on synonyms and similar names for terms used in a controlled vocabulary. So, “invoice” may be listed as the equivalent term for “bill” when categorizing records. The thesaurus goes further and lists “information about each term and their relationships to other terms within the same thesaurus.”
A thesaurus is similar to a hierarchical taxonomy but also includes “associative relationships.” 46 An associative relationship is a conceptual relationship. It is the “see also” that we may come across in the back of the book index. But the question is, why do we want to see it? Associative relationships can provide a linkage to specifi c classes of in- formation of interest to users and for particular processes. Use of associative relation- ships can provide a great deal of functionality in content and document management systems and needs to be considered in RM applications. 47
There are international standards for thesauri creation from International ISO, ANSI, and the British Standards Institution (BSI).48
ISO 25964, “Information and Documentation—Thesauri and Interoperability with Other Vocabularies,” “will draw on [the British standard, BS 8723] but reorga- nize the content to fi t into two parts.” Part 1, “Thesauri for Information Retrieval,” of the standard ISO 25964 was published in August 2011. Part 2, “Interoperability with Other Vocabularies,” was approved in 2013. 49
Taxonomy Types
Taxonomies used in ERM systems are usually hierarchical where categories (nodes) in the hierarchy progress from general to specifi c. Each subsequent node is a subset of the higher level node. There are three basic types of hierarchical taxonomies: subject, business-unit, and functional. 50
A subject taxonomy uses controlled terms for subjects. The subject headings are t arranged in alphabetical order by the broadest subjects, with more precise subjects listed under them. An example is the Library of Congress subject headings used to cat- egorize holdings in a library collection (see Figure A.4 ). Even the Yellow Pages could be considered a subject taxonomy.
There are three basic types of hierarchical taxonomies: subject, business unit, and functional.
372 APPENDIX A
It is diffi cult to establish a universally recognized set of terms in a subject taxonomy. If users are unfamiliar with the topic, they may not know the appropriate term heading with which to begin their search. For example, say people are searching through the Yellow Pages for a place to purchase eyeglasses. They begin their search alphabetically by turning to the E’s and scanning for the term “eyeglasses.” Since there are no topics titled “eyeglasses,” they consult the index, fi nd the term “eyeglasses,” and this provides a list of preferred terms or “see alsos” that direct them to “Optical—Re- tail” for a list of eyeglass businesses. (See Figure A.5 .)
In both examples, the subject taxonomy is supported by a thesaurus. Again, a the- saurus is a controlled vocabulary that includes synonyms, related terms, and preferred terms. In the case of the Yellow Pages, the index functions as a basic thesaurus.
In a business unit –based taxonomy, the hierarchy refl ects the organizational chartstt (e.g., department/division/unit). Records are categorized based on the business unit that manages them. Figure A.6 shows the partial detail of one node of a business unit– based taxonomy that was developed for a county government.
One advantage of a business unit–based taxonomy is that it mimics most exist- ing paper-fi ling system schemas. Therefore, users are not required to learn a “new” system. However, confl icts arise when documents are managed or shared among mul- tiple business units. As an example, for the county government referenced earlier, a property transfer document called the “TD1000” is submitted to the recording offi ce for recording and then forwarded to the assessor for property tax evaluation process- ing. This poses a dilemma as to where to categorize the TD1000 in the taxonomy.
Another issue arises with organizational changes. When the organizational struc- ture changes, so must the taxonomy based on business units.
In a functional taxonomy, records are categorized based on the functions andl activities that produce them (function/activity/transaction). The organization’s busi- ness processes are used to establish the taxonomy. The highest or broadest level rep- resents the business functions. The next level down the hierarchy constitutes the
Figure A.4 Library of Congress Subject Headings
...
...
H — SOCIAL SCIENCES J — POLITICAL SCIENCE K — LAW L — EDUCATION M — MUSIC AND BOOKS ON MUSIC N — FINE ARTS P — LANGUAGE AND LITERATURE Q — SCIENCE R — MEDICINE – Subclass RA Public aspects of medicine – Subclass RB Pathology – Subclass RC Internal medicine – RC31-1245 Internal medicine – RC49-52 Psychosomatic medicine – RC251 Constitutional diseases (General)
– RC254-282 Neoplasm. Tumors. Oncology
INFORMATION ORGANIZATION AND CLASSIFICATION: TAXONOMIES AND METADATA 373
Figure A.5 Yellow Pages Example
Eyeglasses
Not listed under “E”
Consult the index for
preferred term
Eyeglasses & Eye Care - see Laser Vision Correction ...121
Optical Goods - Retail .....135
Opticians .........................135
Optometrics, O.D. ............135
Physicians & Surgeons-
Medical & Osteopathic .....140
Safety Equipment
& Clothing ........................164
activities performed for the function. The lowest level in the hierarchy consists of the records that are created as a result of the activity (the transactions ). s
Figure A.7 shows partial detail of one node of a functional taxonomy developed for a state government regulatory agency. The agency organizational structure is based on regulatory programs. Within the program areas are similar (repeated) functions and activities (e.g., permitting, compliance, and enforcement, etc.). When the repeated functions and activities are universalized, the results are a “fl atter” taxonomy. This type of taxonomy is better suited to endure organizational shifts and changes. In addition, the process of universalizing the functions and activities inherently results in broader and
374 APPENDIX A
Figure A.6 County Government Business Unit Taxonomy
...
Assessor Building Commissioners Coroner District Attorney Finance Health and Environment Human Resources Human Services Motor Vehicle Clerk and Recorder Department • Election Divisions • Motor Vehicle • Recording – TD1000 Records – Warranty Deed
– Quitclaim Deed
– Subdivision Plat
Sheriff
Treasury
Accounting
Procurement
Contracts and Agreements
Licensing and Certification
Technical Assistance
Permitting
Compliance and Enforcement Function
• Inspections Activities
• Complaints
• Emergency Response
• Enforcement
– Notice of Violation Transactions
– Consent Decree
– Request for Response Actions
– Stipulation Agreement
Function 4. Permitting
5.5 Enforcement Actions
5.4 Monitoring Reporting
4.1 Registration
4.2 Application
4.3 Public Notice
4.4 Permit Development &
Issuance
4.5 Termination
5.1 Inspections
5.2 Complaints
5.3 Emergency Response &
Preparedness
5. Compliance and Enforcement
Activity
INFORMATION ORGANIZATION AND CLASSIFICATION: TAXONOMIES AND METADATA 375
more generic naming conventions. A functional taxonomy provides fl exibility when adding new record types (transactions) because there will be fewer changes to the hierarchy structure.
One disadvantage of a functional taxonomy is its inability to address case fi les (or project fi les). A case fi le is a collection of records that relate to a particular entity, person, or project. The records in the case fi le can be generated by multiple activities. For ex- ample, at the regulatory agency, enforcement fi les are maintained that contain records generated by enforcement activities (notice of violation, consent decree, etc.) and other ancillary but related activities, such as contracting, inspections, and permitting.
To address the case fi le issue at the regulatory agency, metadata cross-referencing was used to provide a virtual case fi le view of the records collection. (See Figure A.8 .)
A functional taxonomy is better suited to endure organizational changes.
Figure A.8 Metadata Cross-Referencing within a Taxonomy Source: Blackburn Consulting
5. Compliance and Enforcement 5.1. Inspections 5.2. Complaints 5.3. Emergency Response & Preparedness 5.4. Monitoring Reporting 5.5. Enforcement Actions 6. Program Development 6.1. Directives 6.2. Advisory Committees 6.3. Public Notice and Comments 6.4. Hearings 6.5. Rules 6.6. Legislation 7. Communication & Information 7.1. Publications & Fact Sheets 7.2. Graphics Design 7.3. Speeches and Presentations 7.4. Meetings Facilitation 7.5. Media Contact 7.6. Public Contact 7.7. News Releases 7.8. Clipping Service 8. Environmental Review 8.1. Pellion Order 8.2. Environmental Assessment Worksheet 8.3. Environment Impact Statement 8.4. Public Notice/Comment 8.5. Review/Decision 9. Process Improvement 9.1. Six Sigma 10. Approvals 11. Licensing and Certification 11.1. Application Processing 11.2. Fee Collection 11.3. Training and Testing 11.4. Registrant Tracking/List Maintenance 12. TMDL Studies 12.1. Source Identification Ranking 12.2. Implementation Planning 12.3. Data Collection 12.4. Study Results and Recommendations 13. TMDL Implementation 14. Program Management and Leadership 15. Budgeting 16. Accounting 16.1. Accounts Payable 16.2. Experise Reports 16.3 Accounts Receivable 16.4. Financial Reporting 16.5 Payroll 17. Procurement 17.1. Formal Competitive Bid 17.2. Master Contracts 17.3. Informal Bid Process 17.4. Commodities Purchasing 18. Grants-Incoming 18.1. Application/Amendment 18.2. Award or Rejection 18.3. Reporting 18.4. Grants Management Communication
18.5. Closeout
5. Compliance and Enforcement
5.2 Complaints
5.3 Emergency Response & Preparedness
5.1 Inspections
16. Accounting
16.2 Expense Reports
16.3 Account Receivable
16.1 Accounts Payable
5.4 Monitoring Reporting
5.5 Enforcement Actions
16.4 Financial Reporting
16.5 Payroll
21. Contracts and Agreements
21.2 Contracts and Agreements
21.3 Administration and Tracking
21.1 Review and Approval
Emergency
Response
Project File
Duty Officer Report
Purchase Order
Notice of Violation
Contract
Taxonomy
376 APPENDIX A
A hybrid taxonomy is usually the best approach. Certain business units usually do d not change over time. For example, accounting and human resources activities are fairly constant. Those portions of the taxonomy could be constructed in a business unit manner even when other areas within the organization use a functional structure. (See Figure A.9 .)
Faceted taxonomies allow for multiple organizing principles to be applied to information along various dimensions. Facets can contain subjects, departments, busi- ness units, processes, tasks, interests, security levels, and other attributes used to de- scribe information. With faceted taxonomies, there is never really one single taxonomy but rather collections of taxonomies that describe different aspects of information. In the e-commerce world, facets are used to describe brand, size, color, price, and other context-specifi c attributes. RM systems can also be developed with knowledge and process attributes related to the enterprise. 51
Figure A.9 Basic Accounting Business Unit Taxonomy Source: Blackburn Consulting
One disadvantage of a functional taxonomy is its inability to address case fi les (or project fi les).
INFORMATION ORGANIZATION AND CLASSIFICATION: TAXONOMIES AND METADATA 377
Business Process Analysis
To establish the taxonomy, business processes must be documented and analyzed. There are two basic process analysis methods: top down and bottom up. In the top-down method, a high-level analysis of business functions is performed to establish the higher tiers. Detailed analyses are performed on each business process to fi ll in the lower tiers. The detailed analyses usually are conducted in a phased approach, and the taxonomy is updated incrementally.
In order to use the bottom-up method, detailed analyses must be performed for all processes in one effort. Using this method ensures that there will be fewer modi- fi cations to the taxonomy. However, sometimes conducting a comprehensive analysis is not feasible for organizations with limited resources. A phased or incremental approach is usually more budget friendly and places fewer burdens on the organiza- tion’s resources.
Many diagramming formats and tools will provide the details needed for the analysis. The most basic diagramming can be accomplished with a standard tool such as Visio ® from Microsoft. More advanced modeling tools can be used to produce the diagrams that provide the functionality to statistically analyze process changes through simulation and provide information for architecture planning and other process initia- tives within the organization.
Any diagramming format will suffi ce as long as it depicts the fl ow of data through the processes showing process steps, inputs, and outputs (documents), decision steps, organizational boundaries, and interaction with information systems. The diagrams should depict document movement within as well as between the subject department and other departments or outside entities.
Figure A.10 uses a swim-lane type diagram. Each horizontal “lane” represents a participant or role. The fl ow of data and sequence of process steps is shown with lines (the arrows note the direction). Process steps are shown as boxes.
1.0
Complete Traval
Request From
A hybrid approach to taxonomy design is usually the best.
Business processes must be documented and analyzed to develop a taxonomy.
378 APPENDIX A
Decision steps are shown as diamonds.
3.0 Approve request?
Documents are depicted as a rectangle with a curved bottom line.
Travel Request From
The fi rst step is to review any existing business process documentation (e.g., busi- ness plans, procedures manuals, employee training manuals, etc.) in order to gain a better understanding of the functions and processes. This is done in advance of in- terviews in order to provide a base-level understanding to reduce the amount of time required of the interviewees.
Two different types of interviews (high level and detailed business process) are conducted with key personnel from each department. The initial (high-level) inter- views are conducted with a representative who will provide an overall high-level view of the department, including its mission, responsibilities, and identifi cation of the functional areas. This person will identify those staff members who will provide details of the specifi c processes in each of the functional areas identifi ed. For instance, if the department is human resources, functional areas of the department might include: applicant processing, classifi cation, training, and personnel fi le management. It is ex- pected that this fi rst interview/meeting will last approximately one hour.
The second interviews are detailed interviews that focus on daily processes performed in each functional area. For example, if the function is human resources
Figure A.10 Business Process Example—Travel Expense Process Source: Blackburn Consulting
Expense Check
A c c o u n ts
P a y a b le
C le
rk C
it y M
a n a g e r
S u p e rv
is o r
S ta
ff
(R e q u e s to
r)
1.0
Complete Travel Request Form
Receive Travel
Request
2.0
Approve travel request
4.0
Yes
6.0
Data enter approved travel
into accounting system
7.0
Generate expense check
8.0
Receive travel authorization
Approved Travel Request
Form
9.0
Perform travel
10.0
Complete Expense Report
Travel Receipts
Travel Receipts
Expense Report
11.0
Approve Expense Report
Travel
Receipts
Approved
Expense Report
Data enter
approved travel into accounting
system
12.0
3.0
Approve request?
Travel Request Form
Approved
Travel Request Form
Denied Travel Request Form
No
Yes
Approved
Travel Request Form
5.0
Approve request?
No
INFORMATION ORGANIZATION AND CLASSIFICATION: TAXONOMIES AND METADATA 379
classifi cation, the process may be the creation/management of position descriptions. It is only necessary to interview one person who represents a particular process—there is no need to interview multiple staff members performing the same function. These second interviews likely will last one to two hours each, depending on the complexity of the process.
When there are processes that “connect” (e.g., the output from one process is the input to another), it is useful to conduct group interviews with representatives for each process. This often results in a-ha moments when employees from one process fi nally understand why they are sending certain records to another process. It also brings to light business process improvement opportunities. When employees understand t the big-picture process, they can identify unnecessary process steps and redundant or obsolete documents that can be eliminated.
One purpose of process analysis is to develop taxonomy facets that can be used to bring to the surface information for particular steps in the process. In some cases, process steps can s directly inform the types of artifacts that are needed at a particular part of the process and therefore be used to develop content types in KM use cases. This is related to RM in that KM applications are simply another lens under which content can be viewed. Process analysis also can help determine the scope of metadata for content. For exam- ple, if developing an application to view invoices, if the process includes understanding line item detail, this will dictate a different metadata model than if the process sought only to determine whether invoices over a certain threshold were unpaid. Different processes, different use cases, different metadata.
Taxonomy Testing: A Necessary Step
Once a new taxonomy is developed, it must be tested and piloted to see if it meets user needs and expectations. To attempt the rollout of a new taxonomy without testing it fi rst is imprudent, and will end up costing more time and resources in the long run. So budget the time and money for it. 52 Taxonomy testing is where the rubber meets the road; it provides real data to see if the taxonomy design has met user expectations and actually helps them in their work.
User testing provides valuable feedback and allows the taxonomist or taxonomy team to fi ne-tune the work they have done to more closely align the taxonomy with user needs and business objectives. What may have seemed an obvious term or category may, in fact, be way off. This may result from the sheer focus and myopia of the taxonomy team. So getting user feedback is essential.
Many taxonomy testing tools can assist in the design effort. Once an initial de- sign is drafted, a low-tech approach is to hand-write classifi cation categories and document types on Post-it notes or index cards. Then bring in a sampling of users and ask them to place the notes or cards in the proper category. Track and calculate the results.
Software is available to conduct this card sorting in a more high-tech way, and more sophisticated software can assist in the development and testing effort and to help to update and maintain the taxonomy.
Regardless of the method used, the taxonomy team or even IG team or task force needs to be the designated arbiter when confl icting opinions arise.
380 APPENDIX A
Taxonomy testing is not a one-shot task; with feedback and changes, you progress in iterations closer and closer to meeting user requirements, which may take several rounds of testing and changes.
Taxonomies can be tested in multiple ways. User acceptance throughout the deri- vation process can be simple conference room pilots or validation, formal usability testing based on use cases, card sorting (open and closed), and tagging processes. Au- totagging of content with target taxonomies is also an area that requires testing. 53
Taxonomy Maintenance
After a taxonomy has been implemented, it will need to be updated over time to refl ect changes in document management processes as well to increase usability. Therefore, users should have the opportunity to suggest changes, addition, and deletions. There should be a formal process in place to manage requests for changes. A person or commit- tee should be assigned the responsibility to determine how and if each requests will be facilitated.
There must be guidelines to follow in making changes to the taxonomy. A U.S. state agency organization uses these guidelines in determining taxonomy changes:
■ The new term must have a defi nition, preferably provided by the proposer of the new term.
■ It should be a term someone would recognize even if they have no back- ground within our agency’s workings; use of industry standard terminology is preferred.
■ Terms should be mutually exclusive from other terms. ■ Terms that can be derived using a combination of other terms or facilitated
with metadata will not be added. ■ The value should not be a “temporary” term—it should have some expec-
tation to have a long life span. ■ We should expect that there would be a signifi cant volume of content that
could be assigned the value—otherwise, use of a more general document type and clarifi cation through the metadata on items is preferred: if enough
There should be a formal process in place to manage requests for taxonomy changes.
There is nothing better than getting quantitative feedback to see if you are hitting the mark with users.
INFORMATION ORGANIZATION AND CLASSIFICATION: TAXONOMIES AND METADATA 381
items are titled with the new term over time to warrant reconsideration, it will be reconsidered.
■ For higher-level values in the hierarchy, the relationship between parents and children (functions and activities) is always “is a kind of . . .” Other relationships are not supported.
■ Document type values should not refl ect the underlying technology used to capture the content and should not refl ect the format of the content directly.
Social Tagging and Folksonomies
Social tagging is a method that allows users to manage content with metadata they g apply themselves using keywords or metadata tags. Unlike traditional classifi cation, which uses a controlled vocabulary, social tagging keywords are freely chosen by each individual.
Folksonomy is the term used for this free-form, social approach to metadata y assignment.
Folksonomies are not an ordered classifi cation system; rather, they are a list of keywords input by users that are ranked by popularity. 54
Taxonomies and folksonomies both have their place. Folksonomies can be used in concert with taxonomies to nominate key terms for use in the taxonomy , which contributes toward the updating and maintenance of the taxonomy while making the user experi- ence better by utilizing users’ own preferred terms.
A combined taxonomy and folksonomy approach may provide for an op- tional free-text metadata field for social tags that might be titled “Subject” or “Comment.” Then users could search that free-form, uncontrolled field to nar- row document searches. The folksonomy fields will be of most use to a user or departmental area, but if the terms are used frequently enough, they may need to be added to the formal taxonomy’s controlled vocabulary to benefit the entire organization.
In sum, taxonomy development, testing, and maintenance is hard work—but it can yield significant and sustained benefits to the organization over the long haul by providing more complete and accurate information when knowledge workers make searches; better IG and control over the organization’s documents, records, and information; and a more agile compliance and litigation readiness posture.
A folksonomy uses free-form words to classify documents. A folksonomy ap- proach is useful for updating your taxonomy structure and improves the user search experience.
382 APPENDIX A
■ Knowledge workers spend 15 to 25 percent of an average workday searching for information, often due to poor taxonomy design.
■ Taxonomies are hierarchical classifi cation structures used to standardize the naming and organization of information using controlled vocabularies for terms.
■ Taxonomies speed up the process of retrieving records because end users can select from subject categories or topics.
■ Taxonomies need to be considered from two main perspectives: navigation and classifi cation.
■ Poor search results, inconsistent or confl icting fi le plans, and the inability to locate information on a timely basis are indications that taxonomy work is needed.
■ Metadata, which are the characteristics of a document expressed in data fi elds, must be leveraged in taxonomy design.
■ Best practices dictate that taxonomy development includes designing the taxonomy structure and heuristic principles to align with user needs.
■ There are three basic types of hierarchical taxonomies: subject, business unit, and functional.
■ A hybrid approach to taxonomy design is usually the best.d
■ An SME can be a valuable resource in taxonomy development. SMEs should not be relied on too heavily, though, or the taxonomy may end up fi lled with esoteric jargon.
■ A document inventory is conducted to gather detailed information regarding the documents managed.
■ Business processes must be documented and analyzed to develop a taxonomy.
■ User testing is essential, provides valuable feedback, and allows the taxono- mist or taxonomy team to fi ne-tune the work.
■ Begin by using low-cost, simple tools for taxonomy development, and mi- grate to more capable ones as your organization’s needs grow and mainte- nance is required.
■ A folksonomy uses free-form words to classify documents. A folksonomy ap- proach is useful for updating your taxonomy structure and improves the user search experience.
APPENDIX SUMMARY: KEY POINTS
INFORMATION ORGANIZATION AND CLASSIFICATION: TAXONOMIES AND METADATA 383
Notes
1. ARMA Metro Maryland Newsletter, Cadence Group, “Taxonomies: The Backbone of Enterprise Content Management,” December 2008—January 2009, www.arma-metromd.org/wp-content/ uploads/2012/11/2009-01NewImages.pdf.
2. Delphi Group White Paper, “Taxonomy and Content Classifi cation: Market Milestone Report,” 2002, www.delphigroup.com/whitepapers/pdf/WP_2002_TAXONOMY.PDF (accessed April 25, 2012).
3. Ibid. 4. Cadence Group, “Taxonomies.” 5. Daniela Barbosa, “The Taxonomy Folksonomy Cookbook,” www.slideshare.net/HeuvelMarketing/
taxonomy-folksonomy-cookbook (accessed October 12, 2012). 6. Ibid. 7. Montague Institute Review, “Your Taxonomy Is Your Future” (February 2000), www.montague.com/
abstracts/future.html. 8. Free Library, “Creating Order Out of Chaos with Taxonomies,” 2005, www.thefreelibrary.com/
Creating+order+out+of+chaos+with+taxonomies%3A+the+increasing+volume+of…-a0132679071 (accessed April 25, 2012).
9. Susan Cisco and Wanda Jackson, “Creating Order Out of Chaos with Taxonomies,” Information Management Journal (May/June 2005), www.arma.org/bookstore/fi les/Cisco.pdf. l
10. Marcia Morante, “Usability Guidelines for Taxonomy Development,” April 2003, www.montague.com/ abstracts/usability.html.
11. Seth Earley, e-mail to author, September 10, 2012. 12. Ibid. 13. Cadence Group, “Taxonomies,” p. 3. 14. DAM News Staff, “8 Things You Need to Know about How Taxonomy Can Improve Search,” May 17,
2010, http://damcoalition.com/index.php/metadata/story/8_things_you_need_to_know_about_how_ taxonomy_can_improve_search/.
15. Ibid. 16. Earley e-mail. 17. National Archives of Australia, “AGLS Metadata Standard, Part 2—Usage Guide,” Version 2.0, July 2010,
www.naa.gov.au/Images/AGLS%20Metadata%20Standard%20Part%202%20%20Usage%20Guide_ tcm16-47011.pdf.
18. Kate Cumming, “Metadata Matters,” in Julie McLeod and Catherine Hare, eds., Managing Electronic Records , p. 34 (London: Facet, 2005).s
19. Minnesota State Archives, “Electronic Records Management Guidelines: Metadata,” March 12, 2012, www.mnhs.org/preserve/records/electronicrecords/ermetadata.html.
20. Ibid. 21. Cumming, “Metadata Matters,” p. 35. 22. Ibid. 23. NISO, “Understanding Metadata,” 2004, www.niso.org/publications/press/UnderstandingMetadata.
pdf (accessed October 15, 2012). 24. This and the next section are based on Minnesota State Archives, “Electronic Records Management
Guidelines.” 25. National Archives, “Requirements for Electronic Records Management Systems: 2: Metadata Standard,”
2002, www.nationalarchives.gov.uk/documents/metadatafi nal.pdf (accessed June 21, 2012). 26. International Organization for Standardization, “ISO 23081-1:2006, Information and Documentation—
Records Management Processes—Metadata for Records—Part 1: Principles,” www.iso.org/iso/iso_ catalogue/catalogue_tc/catalogue_detail.htm?csnumber=40832 (accessed June 26, 2012).
27. Carl Weise, “ISO 23081-1: 2006, Metadata for Records, Part 1: Principles,” January 27, 2012, www .aiim.org/community/blogs/expert/ISO-23081-1-2006-Metadata-for-records-Part-1-principles.
28. Dublin Core Metadata Initiative, http://dublincore.org/metadata-basics/ (accessed June 26, 2012). 29. Diane Hillman, Dublin Core Metadata Initiative, “User Guide,” November 7, 2005, http://dublincore
.org/documents/usageguide/. 30. Dublin Core Metadata Initiative, “Dublin Core Metadata Element Set,” Version 1.1, June 14, 2012,
http://dublincore.org/documents/dces/. 31. International Standard Maintenance Agency, Z39.50, Library of Congress www.loc.gov/z3950/agency/
(accessed July 7, 2012).
384 APPENDIX A
32. National Information Standards Organization, “ANSI/NISO Z39.50-2003 (R2009) Information Retrieval: Application Service Defi nition & Protocol Specifi cation,” www.niso.org/apps/group_public/ project/details.php?project_id=49 (accessed July 7, 2012).
33. Jenn Riley, “Glossary of Metadata Standards,” 2009–2010, www.dlib.indiana.edu/~jenlrile/metadata- map/seeingstandards_glossary_pamphlet.pdf (accessed July 9, 2012).
34. Global Information Locator Service, “Initiatives—Includes Spatial Data Initiatives,” www.gils.net/ initiatives.html (accessed July 7, 2012).
35. Ibid. 36. Adventures in Records Management, “The Business Classifi cation Scheme,” October 15, 2006, http://
adventuresinrecordsmanagement.blogspot.com/2006/10/business-classifi cation-scheme.html. 37. Earley e-mail. 38. National Archives of Australia, www.naa.gov.au/Images/classifcation%20tools_tcm16-49550.pdf (ac-
cessed December 13, 2013). 39. Adventures in Records Management, “Business Classifi cation Scheme.” 40. Ibid. 41. Cisco and Jackson, “Creating Order Out of Chaos.” 42. Earley e-mail. 43. www.earley.com/blog/the-popularity-contest-taxonomy-development-in-the-petabyte-era (accessed
April 25, 2012). 44. Ibid. 45. Earley e-mail. 46. Hedden, “The Accidental Taxonomist,” 10. 47. Earley e-mail. 48. Hedden, “The Accidental Taxonomist,” 8. 49. NISO, “Project ISO 25964: Thesauri and Interoperability with Other Vocabularies,” www.niso.org/
workrooms/iso25964 (accessed April 25, 2012). 50. This section is adapted with permission from Barb Blackburn, “Taxonomy Design Types,” e-Doc Magazine
(May/June 2006): 14, 16, www.imergeconsult.com/img/114BB.pdf (accessed October 12, 2012). 51. Earley e-mail. 52. Details in this section are from Stephanie Lemieux, “The Pain and Gain of Taxonomy User Testing,”
July 8, 2008, www.earley.com/blog/the-pain-and-gain-of-taxonomy-user-testing. 53. Earley e-mail. 54. Tom Reamy, “Folksonomy Folktales,” KM World 18, no. 9 (October 2009), www.kmworld.com/Articles/d
Editorial/Feature/Folksonomy-folktales-56210.aspx.
385
A P P E N D I X B Laws and Major Regulations Related to Records Management
United States
Records management practices and standards are delineated in many federal regulations. Also, a number of state statutes have passed. In some cases they actually supersede federal regulations; therefore, it is crucial to understand compliance within the state or states where an organization operates.
On the federal level, public companies must be vigilant in verifying, protecting, and reporting fi nancial information to comply with requirements under Sarbanes— Oxley (SOX) and the Gramm–Leach–Bliley Acts. Health care concerns must meet the requirements of the Health Insurance Portability and Accountability Act (HIPAA), and investment fi rms must comply with a myriad of regulations by the Securities and Exchange Commission (SEC) and National Association of Securities Dealers (NASD).
This appendix presents a brief description of current rules, laws, regulators, and their records retention and corporate policy requirements . (Note: This is an overview, and fi rms should consult their own legal counsel for interpretation and applicability.)
Gramm–Leach–Bliley Act
The Financial Institution Privacy Protection Act of 2001 and Financial Institution Privacy Protection Act of 2003 (Gramm–Leach–Bliley Act) was amended in 2003 to improve and increase protection of nonpublic personal information. Through this act, fi nancial records must be properly secured, safeguarded, and eventually completely destroyed so that the information cannot be further accessed.
Health Insurance Portability and Accountability Act of 1996
HIPAA requires that security standards be adopted for:
■ Controlling who may access health information. ■ Providing audit trails for electronic record systems. ■ Isolating health data, making it inaccessible to unauthorized access. ■ Ensuring the confi dentiality and safeguarding of health information when it is
electronically transmitted to ensure it is physically, electronically, and admin- istratively secure.
■ Meeting the needs and capabilities of small and rural health care providers.
386 APPENDIX B
USA-PATRIOT Act (Uniting and Strengthening America by Providing Appro- priate Tools Required to Intercept and Obstruct Terrorism Act of 2001)
The USA-PATRIOT Act does two things: It (1) requires that the identity of a person opening an account with any fi nancial institution is verifi ed by the fi nancial institu- tion, which must implement reasonable procedures to maintain identity information; and (2) provides law enforcement organizations broad investigatory rights, including warrantless searches.
Sarbanes–Oxley Act
The key provisions of SOX require that:
■ Public corporations implement extensive policies, procedures, and tools to pre- vent fraudulent activities.
■ Financial control and risk mitigation processes be documented and verifi ed by independent auditors.
■ Executives of publicly traded companies certify the validity of the company’s fi nancial statements.
■ Business records must be kept for not less than fi ve years.
SEC Rule 17A-4
SEC Rule 17A-4 requires that: (1) records that must be maintained and preserved must be available to be produced or reproduced using either micrographic media (such as microfi lm or microfi che) or electronic storage media (any digital storage medium or system); and (2) original copies of all communications, such as interoffi ce memoranda, be preserved for no less than three years, the fi rst two in an easily accessible location.
Code of Federal Regulations Title 21, Part 11—Pharmaceuticals
CFR Title 21, Part 11, requires that companies: (1) have controls in place to protect content stored on both open and closed systems to ensure the authenticity and integ- rity of electronic records; and (2) generate accurate and complete electronic copies of records so that the Food and Drug Administration may inspect them.
Code of Federal Regulations Title 47, Part 42—Telecommunications
CFR Title 47, Part 42, requires that telecommunications carriers keep original records or reproductions of original records, including memoranda, documents, papers, and correspondence that the carrier prepared or that were prepared on behalf of the carrier.
U.S. Federal Authority on Archives and Records: National Archives and Records Administration
The National Archives and Records Administration (NARA: go to nara.gov):
■ Oversees physical and electronic recordkeeping policies and procedures of government agencies, requiring adequate and proper documentation on the conducting of U.S. government business.
LAWS AND MAJOR REGULATIONS RELATED TO RECORDS MANAGEMENT 387
■ Defi nes “formal e-records” as machine-readable materials created or received by an agency of the U.S. federal government under federal law or in the course of the transaction of public business.
■ Requires that organized records series be established for electronic records (e-records) on a particular subject or function to facilitate the management of these e-records.
NARA regulations affecting federal agencies and their records management pro- grams are found in Subchapter B of 36 CFR Chapter XII. 1
■ Part 1220—Federal Records; General ■ Part 1222—Creation and Maintenance of Records ■ Part 1223—Managing Vital Records ■ Part 1224—Records Disposition Program ■ Part 1225—Scheduling Records ■ Part 1226—Implementing Disposition ■ Part 1227—General Records Schedule ■ Part 1228—Loan of Permanent and Unscheduled Records ■ Part 1229—Emergency Authorization to Destroy Records ■ Part 1230—Unlawful or Accidental Removal, Defacing, Alteration, or Destruc-
tion of Records ■ Part 1231—Transfer of Records from the Custody of One Executive Agency
to Another ■ Part 1232—Transfer of Records to Records Storage Facilities ■ Part 1233—Transfer, Use, and Disposition of Records in a NARA Federal Re-
cords Center ■ Part 1234—Facility Standards for Records Storage Facilities ■ Part 1235—Transfer of Records to the National Archives of the United States ■ Part 1236—Electronic Records Management ■ Part 1237—Audiovisual, Cartographic, and Related Records Management ■ Part 1238—Microform Records Management ■ Part 1239—Program Assistance and Inspections ■ Part 1240–1249 [Reserved]
U.S. Code of Federal Regulations
In the CFR, there are more than 5,000 references to retaining records. It can be found online at www.ecfr.gov/cgi-bin/ECFR?page=browse
Canada
By Ken Chasse, J.D., LL.M. The National Standards of Canada for electronic records management are: (1) Elec- tronic Records as Documentary Evidence, CAN/CGSB-72.34–2005 (72.34), pub- lished in December 2005; and (2) Microfi lm and Electronic Images as Documentary Evidence, CAN/CGSB-72.11–93, fi rst published in 1979 and updated to 2000 (72.11).2 72.34 incorporates all that 72.11 deals with and is therefore the more important of the two. Because of its age, 72.11 should not be relied on for its “legal” content. However,
388 APPENDIX B
72.11 has remained the industry standard for “imaging” procedures—converting orig- inal paper records to electronic storage. The Canada Revenue Agency has adopted these standards as applicable to records concerning taxation. 3
72.34 deals with nine topics:
1. Management authorization and accountability 2. Documentation of procedures used to manage records 3. “Reliability testing” of electronic records according to existing legal rules 4. The procedures manual and the chief records offi cer 5. Readiness to produce (the “prime directive”) 6. Records recorded and stored in accordance with “the usual and ordinary
course of business” and “system integrity,” key phrases from the Evidence Acts in Canada
7. Retention and disposal of electronic records 8. Backup and records system recovery 9. Security and protection
From these standards practitioners have derived many specifi c tests for auditing, estab- lishing, and revising electronic records management systems (ERMS). 4
The “prime directive” of these standards states: “An organization shall always be prepared to produce its records as evidence.” 5 The duty to establish the “prime directive” falls on senior management.6
Senior management, the organization’s own internal law-making authority, pro- claims throughout the organization the integrity of the organization’s records system (and, therefore, the integrity of its electronic records) by establishing and declaring:
1. The system’s role in the usual and ordinary course of business. 2. The circumstances under which its records are made. 3. Its prime directive for all records management system purposes, i.e., an or-
ganization shall always be prepared to produce its records as evidence. This dominant principle applies to all of the organization’s business records, in- cluding electronic, optical, original paper source records, microfi lm, and other records of equivalent form and content.
Being prepared to produce records (the “dominant principle” of an organization’s ERMS) means the duty to maintain compliance with the prime directive should fall on its senior management.
Because an electronic record is completely dependent on its ERM system for every- thing, compliance with these National Standards and their prime directive should be part of the determination of the “admissibility” (acceptability) of evidence and of electronic discovery in court proceedings (litigation) and in regulatory tribunal proceedings. 7
There are 14 legal jurisdictions in Canada: 10 provinces; 3 territories; and the federal jurisdiction of the Government of Canada. Each has an Evidence Act (the Civil Code in the province of Quebec 8 ), which applies to legal proceedings within its legislative jurisdic- tion. For example, criminal law and patents and copyrights are within federal legislative jurisdiction, and most civil litigation comes within provincial legislative jurisdiction.9
The admissibility of records as evidence is determined under the “business record” provi- sions of the Evidence Acts.10 These acts require proof that a record was made “in the
LAWS AND MAJOR REGULATIONS RELATED TO RECORDS MANAGEMENT 389
usual and ordinary course of business” and of “the circumstances of the making of the record.” In addition, to obtain admissibility for electronic records, most of the Evidence Acts contain electronic record provisions, which state that an electronic record is admissible as evidence on proof of the “integrity of the electronic record system in which the data was recorded or stored.”11 This is the “system integrity” test for the admissibility of electronic records. The word “integrity” has yet to be defi ned by the courts. 12
However, by way of sections such as the next one, the electronic record provi- sions of the Evidence Acts make reference to the use of standards such as the National Standards of Canada:
For the purpose of determining under any rule of law whether an electronic record is admissible, evidence may be presented in respect of any standard, procedure, usage or practice on how electronic records are to be recorded or stored, having regard to the type of business or endeavor that used, recorded, or stored the electronic record and the nature and purpose of the electronic record. 13
Six areas of law and records and information management (RIM) are applicable to paper and electronic records:
1. The laws of evidence applicable to electronic and paper records 14 2. The National Standards of Canada concerning electronic records 15 3. The records requirements of government agencies, such as the Canada
Revenue Agency 16 4. The electronic commerce legislation 17 5. The privacy laws 18 6. The guidelines for electronic discovery in legal proceedings19
These six areas are closely interrelated and are based on very similar concepts. They all make demands of records systems and of the chief records offi cer or others responsible for records. Therefore, a failure to satisfy the records management needs of any one of them will likely mean a failure to satisfy all of them. Agencies that manage these areas of law look to the decisions of the courts to determine the requirements for ac- ceptable records.
Each of these areas of law affects RIM, just as these areas are affected by the laws governing the use of records as evidence in legal proceedings—the laws of evidence. These relationships make mandatory compliance with the prime directive provided by the National Standards, which states: “an organization shall always be prepared to produce its records as evidence.” 20
United Kingdom
Regulations and Legislation Impacting Records Retention
The following Acts and Statutory Instruments of the U.K. and Scottish Parlia- ments contain provisions that are relevant to records retention and disposal:
390 APPENDIX B
Acts of the U.K. Parliament
■ 1957 c31 Occupiers Liability Act 1957 ■ 1969 c57 Employers’ Liability (Compulsory Insurance) Act 1969 ■ 1970 c41 Equal Pay Act 1970 ■ 1970 c9 Taxes Management Act 1970 ■ 1973 c52 Prescription and Limitations (Scotland) Act 1973 ■ 1974 c37 Health and Safety at Work (etc.) Act 1974 ■ 1975 c65 Sex Discrimination Act 1975 ■ 1976 c74 Race Relations Act 1976 ■ 1980 c58 Limitation Act 1980 ■ 1992 c4 Social Security Contributions and Benefi ts Act 1992 ■ 1994 c30 Education Act 1994 ■ 1994 c23 Value Added Tax Act 1994 ■ 1995 c50 Disability Discrimination Act 1995 ■ 1998 c29 Data Protection Act 1998
Acts of the Scottish Parliament
■ 2002 asp13 Freedom of Information (Scotland) Act 2002
Statutory Instruments of the U.K. Parliament
■ SI 1977/500 The Safety Representatives and Safety Committees Regula- tions 1977
■ SI 1981/917 The Health and Safety (First Aid) Regulations 1981 ■ SI 1982/894 The Statutory Sick Pay (General) Regulations 1982 ■ SI 1986/1960 The Statutory Maternity Pay (General) Regulations 1986 ■ SI 1989/1790 The Noise at Work Regulations 1989 ■ SI 1989/635 The Electricity at Work Regulations 1989 ■ SI 1989/682 The Health and Safety Information for Employees Regula-
tions 1989 ■ SI 1991/2680 The Public Works Contracts Regulations 1991 ■ SI 1992/2792 The Health and Safety (Display Screen Equipment) Regula-
tions 1992 ■ SI 1992/2793 The Manual Handling Operations Regulations 1992 ■ SI 1992/2932 The Provision and Use of Work Equipment Regulations
1992 ■ SI 1992/2966 The Personal Protective Equipment at Work Regulations 1992 ■ SI 1993/3228 The Public Services Contracts Regulations 1993 ■ SI 1993/744 The Income Tax (Employments) Regulations 1993 ■ SI 1995/201 The Public Supply Contracts Regulations 1995 ■ SI 1995/3163 The Reporting of Injuries, Diseases and Dangerous Occur-
rences Regulations 1995 ■ SI 1996/1513 The Health and Safety (Consultation with Employees) Reg-
ulations 1996 ■ SI 1996/341 The Health and Safety (Safety Signs and Signals) Regulations
1996
LAWS AND MAJOR REGULATIONS RELATED TO RECORDS MANAGEMENT 391
■ SI 1996/972 The Special Waste Regulations 1996 ■ SI 1997/1840 The Fire Precautions (Workplace) Regulations 1997 ■ SI 1998/1833 The Working Time Regulations 1998 ■ SI 1998/2306 The Provision and Use of Work Equipment Regulations 1998 ■ SI 1998/2307 The Lifting Operations and Lifting Equipment Regulations
1998 ■ SI 1998/2573 The Employers’ Liability (Compulsory Insurance) Regula-
tions 1998 ■ SI 1999/3242 The Management of Health and Safety at Work Regulations
1999 ■ SI 1999/3312 The Maternity and Parental Leave (etc.) Regulations 1999 ■ SI 1999/584 The National Minimum Wage Regulations 1998 ■ SI 2002/2675 The Control of Asbestos at Work Regulations 2002 ■ SI 2002/2676 The Control of Lead at Work Regulations 2002 ■ SI 2002/2677 The Control of Substances Hazardous to Health Regula-
tions 2002
Other Provisions
■ HMCE 700/21 HM Customs and Excise Notice 700/21: Keeping [VAT] records and accounts
■ IR CA30 Statutory Sick Pay Manual for Employers CA30 21
Australia*
Archives Act
The Archives Act 1983 empowers the Archives to preserve the archival resources of the Australian Government—those records designated “national archives.” Under the act, it is illegal to destroy Australian government records without permission from the Archives unless destruction is specifi ed in another piece of legislation or allowed under a normal administrative practice.
The act also establishes a right of public access to nonexempt commonwealth records in the “open access period” (transitioning from 30 years to 20 years over the period 2011 to 2021 under amendments to the act passed in 2010). Different open access periods exist for cabinet notebooks (transitioning from 50 years to 30 years over the period 2011 to 2021) and records containing census information (99 years).
Freedom of Information Act
The Freedom of Information (FOI) Act 1982 gives individuals the legal right to access documents held by Australian government ministers, departments, and most agencies, including Norfolk Island government agencies. From November 1, 2010, the FOI Act also applies to documents created or held by contractors or subcontractors who pro- vided services to the public or third parties on behalf of agencies.
*The information in this section is taken from www.naa.gov.au © Commonwealth of Australia (National Archives of Australia) 2013
392 APPENDIX B
The FOI Act applies to records that are not yet in the open access period un- der the Archives Act unless the document contains personal information (including personal information about a deceased person). The Archives Act regulates access to records in the open access period.
When a member of the public requests information, your agency must identify and preserve all relevant sources, including records, until a fi nal decision on the re- quest is made. The FOI Act also sets out how agencies may correct, annotate, or up- date records if a member of the public shows that any personal information relating to them is incomplete, incorrect, out of date, or misleading.
The FOI Act also establishes the Information Publication Scheme (IPS), which requires agencies subject to the FOI Act to take a proactive approach to publishing a broad range of information on their Web site. The IPS does not apply to a small num- ber of security and intelligence agencies that are exempt from the FOI Act.
Australian Information Commissioner Act
The Australian Information Commissioner Act 2010 established the Offi ce of the Aus- tralian Information Commissioner (OAIC). The OAIC has three sets of functions. These are:
1. Freedom of information functions —protecting the public’s right of access to doc-ss uments under the amended FOI Act and reviewing decisions made by agen- cies and ministers under that act.
2. Privacy functions —ensuring proper handling of personal information in accor-ss dance with the Privacy Act 1988.
3. Government and information policy functions , conferred on it by the Australian s Information Commissioner Act 2010—these include strategic functions re- lating to information management and ensuring maximum coordination, ef- fi ciency, and transparency in government information policy and practice.
As part of its government and information policy function, the OAIC is commit- ted to leading the development and implementation of a national information policy framework to promote secure and open government. It aims to achieve this by driv- ing public access to government information and encouraging agencies to proactively publish information.
Privacy Act
The Privacy Act 1988 regulates the handling of personal information by Australian government agencies, Australian Capital Territory (ACT) government agencies, ACT government agencies, Norfolk Island government agencies, and a range of private and not-for-profi t organizations. The Privacy Act regulates the way in which personal in- formation can be collected, its accuracy, how it is kept secure, and how it is used and disclosed. It also provides rights to individuals to access and correct the information that organizations and government agencies hold about them. Records in the open access period as defi ned in the Archives Act 1983 are not covered by the Privacy Act. The Privacy Act also sets out requirements that may apply when an agency enters into a contract under which services are provided to the agency.
LAWS AND MAJOR REGULATIONS RELATED TO RECORDS MANAGEMENT 393
Evidence Act
The Evidence Act 1995 defi nes what documents, including records, can be used as evidence in a commonwealth court. 22
All agencies need to take account of evidence legislation. A court may need to examine records as evidence of an organization’s decisions and actions. 23
Electronic Transactions Act
The Electronic Transactions Act 1999 encourages online business by ensuring that electronic evidence of transactions is not invalidated because of its format. This act does not authorize the destruction of any Australian government records, whether originals or copies. The obligations placed on agencies under the Archives Act 1983 for the preservation and disposal of commonwealth records continue to apply.
Financial Management and Accountability Act
The Financial Management and Accountability Act 1997 states that an Australian Public Service (APS) employee who misapplies, improperly disposes of, or improperly uses commonwealth records may be in breach of the Financial Management and Ac- countability Act ( s. 41). Regulation 12 of the act requires that the terms of approval for(( a proposal to spend money be recorded in writing as soon as practicable.
Australian government records fall within the meaning of “public property” as defi ned in this act.
Crimes Act
The Crimes Act 1914 outlines crimes against the commonwealth. Several parts of the act relate to records. For example, section 70 prohibits public servants (or anyone working for the Australian government, including contractors, and consultants) from publishing or communicating facts, documents, or information that they gain access to through their work unless they have permission to do so. This includes taking or selling records that should be destroyed.
This act also makes it an offense for people to intentionally destroy documents that they know may be required as evidence in a judicial proceeding.
Identifying Records Management Requirements in Other Legislation
Your agency [or business] needs to be aware of the legislation governing its own re- cords practices.
Some legislative requirements apply to many agencies [and businesses]. For exam- ple, occupational health and safety legislation requires an organization to keep certain types of records for prescribed periods of time. Requirements that apply to all agencies are included in the National Archives’ Administrative Functions Disposal Authority.
Other legislative requirements may apply only to the particular business of one or a number of agencies.
Record-keeping requirements may be stipulated in your agency’s enabling legisla- tion (legislation that established the agency) or in specifi c legislation that your agency is responsible for administering. 24
394 APPENDIX B
Notes
1. NARA Records Management Guidance and Regulations, www.archives.gov/records-mgmt/policy/ guidance-regulations.html (accessed October 17, 2012).
2. These standards were developed by the Canadian General Standards Board, which is a standards- writing agency within Public Works and Government Services Canada (a department of the federal government). It is accredited by the Standards Council of Canada as a standards development agency. The council must certify that standards have been developed by the required procedures before it will designate them as being National Standards of Canada. 72.34 incorporates by reference as “normative references”: (1) many of the standards of the International Organization for Standardization (ISO) in Geneva, Switzerland; and (2) several of the standards of the Canadian Standards Association. The “Normative references” section of 72.34 (p. 2) states that these “referenced documents are indispens- able for the application of this document.” 72.11 cites (p. 2, “Applicable Publications”) several standards of the American National Standards Institute/Association for Information and Image Management (ANSI/AIIM) as publications “applicable to this standard.” The process by which the National Stan- dards of Canada are created and maintained is described within the standards themselves (reverse side of the front cover), and on the CGSB’s Web site (see “Standards Development”), from which Web site these standards may be obtained; online: www.ongc-cgsb.gc.ca.
3. The Canada Revenue Agency informs the public of its policies and procedures by means, among others, of its Information Circulars and GST/HST Memoranda (GST: goods and services tax; HST: harmonized sales tax, i.e., the harmonization of federal and provincial sales taxes into one retail sales tax.) In particular, see: IC05-1, dated June 2010, entitled Electronic Record Keeping , paragraphs 24, g 26, and 28. Note that use of the National Standard cited in paragraph 26, Microfi lm and Electronic Images as Documentary Evidence , CAN/CGSB-72.11-93, is mandatory for “Imaging and microfi lm (including microfi che) reproductions of books of original entry and source documents.” Paragraph 24 recommends the use of the newer national standard, Electronic Records as Documentary Evidence , CAN/CGSB-72.34-2005, “To ensure the reliability, integrity and authenticity of electronic records.” However, if this newer standard is given the same treatment by CRA as the older standard, it will be made mandatory as well. And similar statements appear in the GST Memoranda Computerized Records 500-1-2, Books and Records 500-1. IC05-1. s Electronic Record Keeping , concludes with the note: “Most g Canada Revenue Agency publications are available on the CRA website, www.cra.gc.ca, under the heading ‘Forms and Publications.’”
4. More than 200 specifi c compliance tests can be applied to determine if the principles of 72.34 are being complied with. The analysts—a combined team of records management and legal expertise—analyze: (1) the nature of the business involved; (2) the uses and value of its records for its various functions; (3) the likelihood and risk of the various types of its records being the subject of legal proceedings, or of their being challenged by some regulating authority; and (4) the consequences of the unavailability of acceptable records—for example, the consequences of its records not being accepted in legal proceed- ings. Similarly, in regard to National Standard of Canada 72.11, a comparable series of more than 50 tests can be applied to determine the state of compliance with its principles.
5. Electronic Records as Documentary Evidence, CAN/CGSB-72.34-2005 (72.34), clause 5.4.3 c at p. 17; and Microfi lm and Electronic Images as Documentary Evidence , CAN/CGSB-72.11-93 (72.11).
6. 72.34, Clause 5.4.3, ibid. 7. “Admissibility” refers to the procedure by which a presiding judge determines if a record or other
proffered evidence is acceptable as evidence according the rules of evidence. “Electronic discovery” is the compulsory exchange of relevant records by the parties to legal proceedings prior to trial. As to the admissibility of records as evidence, see: Ken Chasse, “The Admissibility of Electronic Business Re- cords,” Canadian Journal of Law and Technology 8 (2010): 105; and Ken Chasse, “Electronic Records for Evidence and Disclosure and Discovery,” Criminal Law Quarterly 57 (2011): 284. For the electronic dis- covery of records, see: Ken Chasse, “Electronic Discovery—Sedona Canada Is Inadequate on Records Management—Here’s Sedona Canada in Amended Form,” Canadian Journal of Law and Technology 9 (2011): 135; and Ken Chasse, “Electronic Discovery in the Criminal Court System” Canadian Criminal Law Review 14 (2010): 111.
8. For the province of Quebec, comparable provisions are contained in Articles 2831–2842, 2859–2862, 2869–2874 of Book 7 “Evidence” of the Civil Code of Quebec, S.Q. 1991, c. C-64, to be read in con- junction with “An Act to Establish a Legal Framework for Information Technology,” R.S.Q. 2001, c. C-1.1, sections. 2, 5–8, and 68.
9. For the legislative jurisdiction of the federal and provincial governments in Canada, see the Constitu- tion Act, 1867 (U.K.) 30 and 31 Victoria, c. 3, section 91 (federal) and section 92 (provincial); at online: www.canlii.org/en/ca/laws/stat/30—31-vict-c-3/latest/30—31-vict-c-3.html.
LAWS AND MAJOR REGULATIONS RELATED TO RECORDS MANAGEMENT 395
10. The two provinces of Alberta, and Newfoundland and Labrador do not have business record provisions in their Evidence Acts. Therefore “admissibility” in those jurisdictions would be determined by way of the court decisions that defi ne the applicable common law rules; such decisions as Ares v. Venner , [1970]r S.C.R. 608, 14 D.L.R. (3d) 4 (S.C.C.) and decisions that have applied it.
11. See, for example, the Canada Evidence Act, R.S.C. 1985, c. C-5, sections 31.1–31.8; Alberta Evidence Act, R.S.A. 2000, c. A-18, sections 41.1–41.8; (Ontario) Evidence Act, R.S.O. 1990, c. E.23, s. 34.1; and the (Nova Scotia) Evidence Act, R.S.N.S. 1989, c. 154, sections 23A–23G. The Evidence Acts of the two provinces of British Columbia and Newfoundland and Labrador do not contain electronic record provisions. However, because an electronic record is no better than the quality of the record system in which it is recorded or stored, its “integrity” (reliability, credibility) will have to be determined under the other provincial laws that determine the admissibility of records as evidence.
12. The electronic record provisions have been in the Evidence Acts in Canada since 2000. They have been applied to admit electronic records into evidence, but they have not yet received any detailed analysis by the courts.
13. This is the wording used in, for example, section 41.6 of the Alberta Evidence Act, section 34.1(8) of the (Ontario) Evidence Act; and section 23F of the (Nova Scotia) Evidence Act, supra note 10. Section 31.5 of the Canada Evidence Act, supra note 58, uses the same wording; the only signifi cant difference is that the word “document” is used instead of “record.” For the province of Quebec, see sections 12 and 68 of An Act to Establish a Legal Framework for Information Technology , R.S.Q., chapter C-1.1.
14. Supra notes 54 to 59 and accompanying texts. 15. Supra notes 49 and 52 and accompanying texts. 16. Supra note 50 and accompanying text. 17. All 14 jurisdictions of Canada have electronic commerce legislation except for the Northwest Territo-
ries. See, for example, the Personal Information Protection and Electronic Documents Act, S.C. 2000, c. 5, Parts 2 and 3; Ontario’s Electronic Commerce Act, 2000, S.O. 2000, c. 17; and, British Columbia’s Electronic Transactions Act, R.B.C. 20001, c. 10. The concept of “system integrity” in the Evidence Acts ( supra( ( note 58 and accompanying text), is also found in the electronic commerce legislation. See, for example, section 8 of the Ontario Electronic Commerce Act, 2000, under the heading “Legal Re- quirement re Original Documents.”
18. For example, Part 1, “Personal Information Protection,” of the federal Personal Information Protection and Electronic Documents Act (PIPEDA), S.C. 2000, c. 5, which applies within provincial legislative jurisdiction as well as federal, until a province enacts its own personal information protection act (a PIPA), which displaces it in the provincial sphere. British Columbia, Alberta, and Quebec are the only provinces that have done so.
19. The dominant guideline for electronic discovery in Canada is The Sedona Canada Principles—Address- ing Electronic Discovery ; online: The Sedona Conference, Canada, January 2008: www.thesedonacon- ference.com/content/miscFiles/canada_pincpls_FINAL_108.pdf or www.thesedonaconference.org/ dltForm?did=canada_pincpls_FINAL_108.pdf; and E-Discovery Canada Web site, hosted by LexUM (at the University of Montreal), online: www. lexum.umontreal.ca/e-discovery. And see also the law journal articles concerning electronic discovery cited in note 54 supra .
20. Supra notes 52 and 53 and accompanying texts. 21. “Information Governance Record Retention Guidance,” www.rec-man.stir.ac.uk/rec-ret/legislation.
php (accessed October 17, 2012). 22. www.comlaw.gov.au/Details/C2012C00518, accessed Nov. 30, 2012. 23. General advice on the impact of the Evidence Act is given in the publication Commonwealth Records
in Evidence (pdf). www.comlaw.gov.au/Details/C2012C00518 (accessed Nov. 30, 2012). 24. National Archives of Australia, www.naa.gov.au/records-management/strategic-information/stan-
dards/recordslegislation.aspx (accessed October 17, 2012).
397
A P P E N D I X C Laws and Major Regulations Related to Privacy
United States
Note: This list is representative and not to be considered an exhaustive listing.1 State laws and industry regulations may apply to your organization. Consult your legal counsel for defi nitive research.
Americans with Disabilities Act (ADA) Cable Communications Policy Act of 1984 (Cable Act) California Senate Bill 1386 (SB 1386) Children’s Internet Protection Act of 2001 (CIPA) Children’s Online Privacy Protection Act of 1998 (COPPA) Communications Assistance for Law Enforcement Act of 1994 Computer Fraud and Abuse Act of 1986 (CFAA) Computer Security Act of 1987: superseded by the Federal Information Security
Management Act (FISMA) Consumer Credit Reporting Reform Act of 1996 (CCRRA): modifi es the Fair
Credit Reporting Act (FCRA) Controlling the Assault of Non-Solicited Pornography and Marketing (CAN-
SPAM) Act of 2003 Driver’s Privacy Protection Act of 1994 Electronic Communications Privacy Act of 1986 (ECPA) Electronic Freedom of Information Act of 1996 (E-FOIA) Electronic Funds Transfer Act (EFTA) Fair and Accurate Credit Transactions Act (FACTA) of 2003 Fair Credit Reporting Act of 1999 (FCRA) Family Education Rights and Privacy Act of 1974 (FERPA; aka the Buckley
Amendment) Federal Information Security Management Act (FISMA) Federal Trade Commission Act (FTCA) Gramm–Leach–Bliley Financial Services Modernization Act of 1999 (GLBA)
398 APPENDIX C
Privacy Act of 1974: including U.S. Department of Justice Overview Privacy Protection Act of 1980 (PPA) Right to Financial Privacy Act of 1978 (RFPA) Telecommunications Act of 1996 Telephone Consumer Protection Act of 1991 (TCPA) Uniting and Strengthening America by Providing Appropriate Tools Required to
Intercept and Obstruct Terrorism Act of 2001 (USA-PATRIOT Act) Video Privacy Protection Act of 1988
Major Privacy Laws Worldwide, by Country
Note: This list is representative and not to be considered an exhaustive listing. 2 State or provincial laws and industry regulations may apply to your organization. Consult your legal counsel for defi nitive research.
Argentina. Personal Data Protection Act of 2000 (aka Habeas Data) Australia. Privacy Act of 1988 Austria. Data Protection Act 2000, Austrian Federal Law Gazette part I No.
165/1999 (Datenschutzgesetz 2000 or DSG 2000) Belgium. Belgium Data Protection Law Brazil. Privacy currently governed by Article 5 of the 1988 Constitution Bulgaria. Bulgarian Personal Data Protection Act Canada. Privacy Act—July 1983 Personal Information Protection and Electronic
Data Act (PIPEDA) of 2000 (Bill C-6) Chile. Act on the Protection of Personal Data, August 1998 Colombia. Law 1266 of 2008: (in Spanish) and Law 1273 of 2009 (in Spanish) Czech Republic. Act on Protection of Personal Data (April 2000) No. 101 Denmark. Act on Processing of Personal Data, Act No. 429, May 2000 Estonia. Personal Data Protection Act of 2003. (June 1996, Consolidated
July 2002) European Union. European Union Data Protection Directive of 1998; EU Internet
Privacy Law of 2002 (Directive 2002/58/EC) Finland. Act on the Amendment of the Personal Data Act (986) 2000 France. Data Protection Act of 1978 (revised in 2004) Germany. Federal Data Protection Act of 2001 Greece. Law No. 2472 on the Protection of Individuals with Regard to the Pro-
cessing of Personal Data, April 1997 Guernsey. Data Protection (Bailiwick of Guernsey) Law of 2001 Hong Kong. Personal Data Ordinance (the Ordinance)
LAWS AND MAJOR REGULATIONS RELATED TO PRIVACY 399
Hungary. Act LXIII of 1992 on the Protection of Personal Data and the Publicity of Data of Public Interests
Iceland. Act of Protection of Individual; Processing Personal Data, January 2000 Ireland. Data Protection (Amendment) Act, Number 6, of 2003 India. Information Technology Act of 2000 Italy. Processing of Personal Data Act, January 1997; Data Protection Code of
2003 Japan. Personal Information Protection Law (Act) Law for the Protection of
Computer Processed Data Held by Administrative Organs, December 1988 Korea. Act on Personal Information Protection of Public Agencies Act on Infor-
mation and Communication Network Usage Latvia. Personal Data Protection Law, March 2000 Lithuania. Law on Legal Protection of Personal Data, June 1996 Luxembourg. Law of August 2002 on the Protection of Persons with Regard to the
Processing of Personal Data Malaysia. Common Law Principle of Confi dentiality Personal Data Protection
Bill Banking and Financial Institutions Act of 1989 Privacy Provisions Malta. Data Protection Act (Act XXVI of 2001), amended March 22, 2002,
November 15, 2002 and July 15, 2003 Mexico. Federal Law for the Protection of Personal Data Possessed by Private
Persons (Spanish) Morocco. Data Protection Act Netherlands. Dutch Personal Data Protection Act 2000 as amended by Acts dated
April 5, 2001, Bulletin of Acts, Orders and Decrees 180, December 6, 2001 New Zealand. Privacy Act, May 1993; Privacy Amendment Act, 1993; Privacy
Amendment Act, 1994 Norway. Personal Data Act (April 2000)–Act of April 14, 2000 No. 31 Relating to
the Processing of Personal Data (Personal Data Act) Philippines. Data Privacy Act of 2011 (There is also a recognized right of privacy
in civil law and a model data protection code.) Romania. Law No. 677/2001 for the Protection of Persons Concerning the Pro-
cessing of Personal Data and the Free Circulation of Such Data Poland. Act of the Protection of Personal Data (August 1997) Portugal. Act on the Protection of Personal Data (Law 67/98 of 26 October) Singapore. E-commerce Code for the Protection of Personal Information and
Communications of Consumers of Internet Commerce Slovak Republic. Act No. 428 of July 3, 2002, on Personal Data Protection Slovenia. Personal Data Protection Act, RS No. 55/99 South Africa. Electronic Communications and Transactions Act, 2002 South Korea. Act on Promotion of Information and Communications Network
Utilization and Data Protection of 2000
400 APPENDIX C
Spain. Organic Law 15/1999 of December 13 on the Protection of Personal Data Switzerland. Federal Law on Data Protection of 1992 Sweden. Personal Data Protection Act (1998: 204), October 24, 1998 Taiwan. Computer Processed Personal Data Protection Law (public institution
applicability only) Thailand. Offi cial Information Act, B.E. 2540 (1997) (for state agencies) United Kingdom. UK Data Protection Act 1998; Privacy and Electronic Commu-
nications (EC Directive) Regulations 2003 Vietnam. Law on Electronic Transactions 2008
Notes
1. Information Shield, “United States Privacy Laws,” www.informationshield.com/usprivacylaws.html (accessed October 18, 2013).
2. Information Shield, “International Privacy Laws,” www.informationshield.com/intprivacylaws.html (accessed February 1, 2014).
401
GLOSSARY
access control list In systems such as electronic records management, electronic document and records management systems, or document management systems, a list of individuals authorized to access, view, amend, transfer, or delete documents, records, or fi les. Access rights are enforced through software controls.
application programming interface (API) A way of standardizing the connection between two software applications. It is essentially a standard hook that an appli- cation uses to connect to another software application.
archival information package (AIP) One of three types of information packages that can be submitted in the Open Archival Information System (OAIS) preserva- tion model.
archive Storing information and records for long-term or permanent preservation. With respect to e-mail, it is stored in a compressed and indexed format to reduce storage requirements and allow for rapid, complex searches. (This also can done for blogs, social media, or other applications.) Archiving of real-time applications like e-mail can be deemed reliable with record integrity only if it is performed immediately, in real time.
ARMA Association for Records Managers and Administrators, the United States- based nonprofi t organization for records managers with a network of interna- tional chapters.
authentication, authorization, and audit (or accounting) (AAA) A network man- agement and security framework that controls computer system logons and access to applications that enforces IG policies and audits usage.
authenticity of records Verifi ed content and author information as original for the purposes of electronic records management; in a legal context, proof that the e-document is what it purports to be when electronically stored information is submitted during the e-discovery process.
auto-classifi cation Setting predefi ned indices to classify documents and records and having the process performed automatically by using software rather than human intervention. A strong trend toward auto-classifi cation is emerging due to the impact of Big Data and rapidly increasing volumes of documents and records.
backup A complete spare copy of data for purposes of disaster recovery. Backups are nonindexed mass storage and cannot substitute for indexed, archived information that can be quickly searched and retrieved (as in archiving).
best practices Those methods, processes, or procedures that have been proven to be the most effective, based on real-world experience and measured results.
Big Data More data than can be processed by today’s database systems, or acutely high volume, velocity, and variety of information assets that demand IG to manage and leverage for decision-making insights and cost management.
402 GLOSSARY
bidders’ conference A formal meeting where vendors bidding on a request for proposal (RFP) can ask questions and raise issues about the RFP, proposal require- ments, and procurement process.
business activities The tasks performed to accomplish a particular business func- tion. Several activities may be associated with each business function.
business case A written analysis of the fi nancial, productivity, auditability, and other factors to justify the investment in software and hardware systems, implementa- tion, and training.
business classifi cation scheme (BCS) The overall structure an organization uses for organizing, searching, retrieving, storing, and managing documents and re- cords in electronic records management. The BCS must be developed based on the business functions and activities. A fi le plan is a graphic representation of the BCS, usually a hierarchical structure consisting of headings and folders to indicate where and when records should be created during the conducting of the business of an offi ce. In other words, the fi le plan links the records to their business context. t
business driver A compelling business reason that motivates an organization to im- plement a solution to a problem. Business drivers can be based on fi nancial, legal, or operational gaps or needs.
business functions Basic business units, such as accounting, legal, human resources, and purchasing.
business process A coordinated set of collaborative and transactional work activi- ties carried out to complete work steps.
business process improvement (BPI) Analyzing and redesigning business pro- cesses to streamline them and gain effi ciencies, reduce cycle times, and improve auditability and worker productivity.
business process outsourcing (BPO) Contracting with a third party to perform specifi c business processes. One example could be using a customer service center taking inbound telephone calls from U.S. customers and handling customer re- quests and complaints from a service center located offshore, in locations such as India, where labor costs are lower.
business process management (BPM) Managing the work steps and business activities of an organization’s workers in an automated way.
business process management system (BPMS) A superset of workfl ow software, and more. BPMS software offers fi ve main capabilities:
1. Puts existing and new application software under the direct control of busi- ness managers
2. Makes it easier to improve existing business processes and create new ones 3. Enables the automation of processes across the entire organization and
beyond it 4. Gives managers real-time information on the performance of processes 5. Allows organizations to take full advantage of new computing services
GLOSSARY 403
capture Components that also often are called input components. There are several levels and technologies, from simple document scanning and capture to complex information preparation using automatic classifi cation.
case records Records that are characterized as having a beginning and an end but are added to over time. Case records generally have titles that include names, dates, numbers, or places.
change management Methods and best practices to assist an organization and its employees in implementing changes to business processes, culture, and systems.
classifi cation Systematic identifi cation and arrangement of business activities and/ or records into categories according to logically structured conventions, methods, and procedural rules represented in a classifi cation system. A coding of content items as members of a group for the purposes of cataloging them or associating them with a taxonomy.
cloud computing The provision of computational resources on demand via a network. Cloud computing can be compared to the supply of electricity and gas or the provi- sion of telephone, television, and postal services. All of these services are presented to users in a simple way that is easy to understand without users’ needing to know how the services are provided. This simplifi ed view is called an abstraction. Similarly, cloud computing offers computer application developers and users an abstract view of services, which simplifi es and ignores much of the details and inner workings. A provider’s offering of abstracted Internet services is often called the cloud.
CobiT (Control Objectives for Information and related Technology) A process- based information technology governance framework that represents a consensus of experts worldwide. It was codeveloped by the IT Governance Institute and ISACA.
Code of Federal Regulations (CFR) The annual edition of the CFR contains all the rules published in the Federal Register by the departments and agencies of the federal government. It is divided into 50 broad subject areas and contain at least one individual volumes, and is update annually, on a staggered basis.
cold site An empty computer facility or data center that is ready for operation with air-conditioning, raised fl oors, telecommunication lines, and electric power. Backup hardware and software will have to be purchased and shipped in quickly to resume operations. Arrangements can be made with suppliers for rapid delivery in the event of a disaster.
compliance monitoring Being regularly apprised and updated on pertinent regula- tions and laws and examining processes in the organization to ensure compliance with them. In a records management sense, this involves reviewing and inspecting the various facets of a records management program to ensure it is in compliance. Compliance monitoring can be carried out by an internal audit, external organiza- tion, or records management and must be done on a regular basis.
computer memory Solid state volatile (erasable) storage capability built into cen- tral processing units of computers. At times memory size can be increased by ex- panding it to the computer’s hard drive or external magnetic disks.
404 GLOSSARY
content In records, the actual information contained in the record; more broadly, content is information. For example, content is managed by enterprise content management systems and may be e-mail, e-documents, Web content, report con- tent, and so on.
controlled vocabulary Set, defi ned terms used in a taxonomy.
corporate compliance The set of activities and processes that result in meeting and adhering to all regulations and laws that apply to an organization.
data cleansing (or data scrubbing) The process of removing corrupt, redundant, and inaccurate data in the data governance process.
data governance Processes and controls at the data level; a newer, hybrid quality control discipline that includes elements of data quality, data management, information governance policy development, business process improvement, and compliance and risk management.
data loss prevention (DLP; or data leak prevention) A computer security term referring to systems that identify, monitor, and protect data in use (e.g., endpoint actions), data in motion (e.g., network actions), and data at rest (e.g., data storage) through deep content inspection, contextual security analysis of transaction (attributes of originator, data object, medium, timing, recipient/ destination, etc.) and with a centralized management framework. Systems are designed to detect and prevent unauthorized use and transmission of confi den- tial information.
declaration Assignment of metadata elements to associate the attributes of one or more record folder(s) to a record; for categories to be managed at the record level, providing the capability to associate a record category to a specifi c record.
de-duplication The process of identifying and eliminating redundant occurrences of data.
defensible deletion Disposing of unneeded data, e-documents, and reports based on set policy that can be defended in court. It reduces an organization’s informa- tion footprint.
Designing and Implementing Recordkeeping Systems (DIRKS) An Australian methodology consisting of eight steps developed by the Archives Authority of New South Wales, included in ISO 15489, the international standard for records management. Roughly analogous to the Generally Accepted Recordkeeping Prin- ciples ® developed by the Association for Records Managers and Administrators in the United States.
destruction The process of eliminating or deleting records, beyond any possible reconstruction.
destruction certifi cate A certifi cate issued once destruction of a record is complete. It verifi es that destruction has taken place, who authorized the destruction, and who carried it out. It also may include some metadata about the record.
destructive retention policy Permanently destroying documents or e-documents (such as e-mail) after retaining them for a specifi ed period of time.
GLOSSARY 405
disaster recovery (DR)/business continuity (BC) The planning, preparation, and testing set of activities used to help a business plan for and recover from any major business interruption and to resume normal business operations.
discovery The process of gathering and exchanging evidence in civil trials; or dis- covering information fl ows inside an organization using data loss prevention tools.
disposition The range of processes associated with implementing records retention, destruction, or transfer decisions, which are documented in disposition authorities or other instruments.
dissemination information package (DIP) One of three types of information packages that can be submitted in the Open Archival Information System (OAIS) preservation model.
document Recorded information or object that can be treated as a unit.
document analytics Detailed usage statistics on e-documents, such as time spent viewing, which pages were viewed and for how long, number of docu- ments printed, where printed, number of copies printed, and other granular information about how and where a document is accessed, viewed, edited, or printed.
document imaging Scanning and digitally capturing images of paper documents.
document life cycle The span of a document’s use, from creation, through active use, storage, and fi nal disposition, which may be destruction or preservation.
document life cycle security (DLS) Providing a secure and controlled environ- ment for e-documents. This can be accomplished by properly implementing technologies including information rights management and data loss prevention, along with complementary technologies like digital signatures.
document management Managing documents throughout their life cycle from creation to fi nal disposition, including managing revisions. Also called document life cycle management.
document type A term used by many software systems to refer to a grouping of related records.
e-document An electronic document (i.e., a document in digital form).
electronic Code of Federal Regulations (e-CFR) An unoffi cial, editorial com- pilation of CFR material and Federal Register amendments produced by the National Archives and Records Administration’s Offi ce of the Federal Register and the Government Printing Offi ce.
electronic document and records management system (EDRMS) Software that has the ability to manage documents and records.
electronic records management (ERM) The management of electronic and nonelectronic records by software, including maintaining disposition sched- ules for keeping records for specifi ed retention periods, archiving, or de- struction. (For enterprise rights management, see information rights management [IRM ].) MM
406 GLOSSARY
electronic record Information recorded in a form that requires a computer or oth- er machine to process and view it and that satisfi es the legal or business defi nition of a record.
electronic records repository A direct access device on which the electronic re- cords and associated metadata are stored.
electronically stored information (ESI) Any information stored by electronic means; this can include not just e-mail and e-documents but also audio and video recordings and any other type of information stored on electronic media. The term was created in 2006 when the U.S. Federal Rules of Civil Procedure were revised to include the governance of ESI in litigation.
e-mail and e-document encryption Encryption or scrambling (and often authen- tication) of e-mail messages, which can be done in order to protect the content from being read by unintended recipients.
enterprise content management (ECM) Software that manages unstructured information such as e-documents, document images, e-mail, word processing documents, spreadsheets, Web content, and other documents; most systems also include some records management capability.
enterprise process analytics Detailed statistics and analysis of business process cycle times and other data occurring throughout an enterprise. This business intelligence can help spot bottlenecks, optimize work fl ow, and improve worker productivity while improving input for decision making.
enterprise risk profi le An assessment of the threats and risks an enterprise faces and the likelihood of those risks occurring.
event-based disposition A disposition instruction in which a record is eligible for the specifi ed disposition (transfer or destroy) when or immediately after the speci- fi ed event occurs. No retention period is applied, and there is no fi xed waiting period, as with timed or combination timed-event dispositions. Example: Destroy when no longer needed for current operations.
faceted search Where document collections are classifi ed in multiple ways rather than in a single, rigid taxonomy.
faceted taxonomy Allow for multiple organizing principles to be applied to in- formation along various dimensions. Facets can contain subjects, departments, business units, processes, tasks, interests, security levels, and other attributes used to describe information. There is never really one single taxonomy but rather col- lections of taxonomies that describe different aspects of information.
Federal Rules of Civil Procedure (FRCP)—Amended 2006 In U.S. civil litiga- tion, the FRCP governs the discovery and exchange of electronically stored infor- mation, which includes not only e-mail but all forms of information that can be stored electronically.
fi le plan A graphic representation of the business classifi cation scheme, usually a hi- erarchical structure consisting of headings and folders to indicate where and when records should be created during the conduct of business of an offi ce. In other words, the fi le plan links the records to their business context.
GLOSSARY 407
fi le transfer protocol (FTP) A standard network protocol used to copy a fi le from one host to another over a TCP-based network, such as the Internet. FTP is built on a client-server architecture and utilizes separate control and data connections between the client and server. FTP users may authenticate themselves using a clear-text sign-in protocol but can connect anonymously if the server is confi g- ured to allow it.
folksonomy The term used for a free-form, social approach to metadata assignment. Folksonomies are not an ordered classifi cation system but are lists of keywords input by users that are ranked by popularity.
functional retention schedule A schedule that groups records series based on busi- ness functions, such as fi nancial, legal, product management, or sales. Each func- tion or grouping is also used for classifi cation. Rather than detail every sequence of records, these larger functional groups are less numerous and are easier for users to understand.
Generally Accepted Recordkeeping Principles ® (the Principles) A set of eight principles published in 2009 by U.S.-based ARMA International to foster aware- ness of good recordkeeping practices and to provide guidance for records manage- ment maturity in organizations. These principles and associated metrics provide an information governance framework that can support continuous improvement.
governance model A framework or model that can assist in guiding governance efforts. Examples include using a SharePoint governance model, the information governance reference model (IGRM), MIKE2.0, and others.
guiding principles The basic principles used to guide the development of a gov- ernance model (e.g., for a SharePoint deployment). They may include principles such accountability (who is accountable for managing the site, who is accountable for certain content), who has authorized access to which documents, and whether the governance model is required for use or is to be used optionally as a reference.
heat map A color-coded matrix generated by stakeholders voting on risk level by color (e.g., red being highest).
HIPAA The Healthcare Insurance Portability and Accountability Act enacted by the U.S. Congress in 1996. Title II of HIPAA, known as the administrative sim- plifi cation (AS) provision, requires the establishment of national standards for electronic health care transactions and national identifi ers for providers, health insurance plans, and employers.
hot site One that has identical or nearly identical hardware and operating system confi gurations and copies of application software, and receives live, real-time backup data from business operations. In the event of a business interruption, the information technology and electronic vital records operations can be switched over automatically, providing uninterrupted service.
information footprint The total size of the amount of information an organization manages.
information governance (IG) A subset of corporate governance. It is an all- encompassing term for how an organization manages the totality of its information. IG “encompasses the policies and leveraged technologies meant to dictate and
408 GLOSSARY
manage what corporate information is retained, where and for how long, and also how it is retained (e.g., protected, replicated, and secured). Information gover- nance spans retention, security, and life cycle management issues.” 1 IG is an ongo- ing program that helps organizations meet external compliance and legal demands and internal governance rules.
information governance reference model (IGRM) A graphically depicted practi- cal framework that includes risk and profi t considerations for the business, legal, informational technology, records and information management (RIM), and privacy and security functions of an organization. IGRM enables organizations to establish IG programs that more effectively deal with the rising volume and diversity of information and the risks, costs, and complications this presents. IGRM is most frequently used to facilitate dialogue and combine disparate infor- mation stakeholders and perspectives across legal, records, information technol- ogy, and business organizations.
information life cycle The span of the use of information, from creation, through active use, storage, and fi nal disposition, which may be destruction or preservation.
information map A graphic diagram that shows where information is created, where it resides, and the path it takes.
information rights management (IRM) Often referred to as enterprise rights man- agement (ERM) or enterprise digital rights management (E-DRM). IRM applies to a technology set that protects sensitive information, usually documents or e- mail messages, from unauthorized access. IRM is technology that allows for infor- mation (mostly in the form of documents) to be remote controlled. Information and its control can be separately created, viewed, edited, and distributed.
information technology (IT) Technology used to manage digital information.
IT governance Controls and process to improve the effectiveness of information technology; also, the primary way that stakeholders can ensure that investments in IT create business value and contribute toward meeting business objectives.
IT governance framework Constructs or frameworks that guide informational technology governance efforts, including CobiT® and ITIL.
ITIL (Information Technology Infrastructure Library) A set of process-oriented best practices and guidance originally developed in the United Kingdom to stan- dardize delivery of informational technology service management. ITIL is appli- cable to both the private and public sectors and, according to its Web site, is the “most widely accepted approach to IT service management in the world.”
inherited metadata Automatically assigning certain metadata to records based on rules that are established in advance and set up by a system administrator.
inventorying records A descriptive listing of each record series or system, together with an indication of location and other pertinent data. It is not a list of each docu- ment or each folder but rather of each series or system.
ISO International Organization for Standardization, a highly regarded and widely accepted global standards body.
GLOSSARY 409
jukebox (optical disk jukebox) Optical disc autochanger units for mass storage that use robotics to pick and mount optical disks and remove and replace them after use; dubbed a “jukebox” for its similarity in mechanics to jukebox units for playing vinyl records and later CDs.
knowledge management (KM) The accumulation, organization, and use of expe- rience and lessons learned, which can be leveraged to improve future decision- making efforts. KM often involves listing and indexing subject matter experts, project categories, reports, studies, proposals, and other intellectual property sources or outputs that are retained to build corporate memory. Good KM sys- tems help train new employees and reduce the impact of turnover and retirement of key employees.
legal hold or litigation hold Also known as a preservation order or hold order. A temporary suspension of the company’s document retention destruction poli- cies for the documents that may be relevant to a lawsuit or that are reasonably anticipated to be relevant. It is a stipulation requiring the company to preserve all data that may relate to a legal action involving the company. A litigation hold ensures that the documents relating to the litigation are not destroyed and are available for the discovery process prior to litigation. The legal hold process is a foundational element of information governance.
legal hold notifi cation (LHN) The process of identifying information that may be requested in legal proceeding and locking that (data or documents) down to prevent editing or deletion while notifying all parties within an organization who may be involved in processing that information that it is subject to a legal hold. LHN man- agement is arguably the absolute minimum an organization should be doing in order to meet the guidelines provided by court rules, common law, and case law precedent.
limitation period The length of time after which a legal action cannot be brought before the courts. Limitation periods determine the length of time records must be kept to support court actions, including subsequent appeal periods.
long-term digital preservation (LTDP) The managed activities, methods, stan- dards, and technologies used to provide long-term, error-free storage of digital information, with means for retrieval and interpretation, for the entire time span the information is required to be retained.
magnetic disk drives A common data storage device using erasable magnetic media. Magnetic disk drives are common peripherals and built-in storage devices in desk- top PCs, minicomputers, and mainframe computers.
master retention schedule A retention schedule that includes the retention and disposition requirements for records series that cross business unit boundaries. The master retention schedule contains all records series in the entire enterprise.
metadata Data about data, or detailed information describing context, content, and structure of records and their management through time. Examples include the author, department, document type, date created, and length, among others.
migration The act of moving records from one system to another while maintain- ing their authenticity, integrity, reliability, and usability.
410 GLOSSARY
negotiated procurement A way to acquire a new system or components when the buying organization wants to make a rapid decision and requirements are known (e.g., making a bulk purchase of additional workstations or tablet computers that will be added to an existing network). Often a trusted consulting fi rm is engaged to solicit bids, negotiate with vendors, and make a recommendation for procure- ment. This approach can be a better fi t than issuing a request for proposal when cost and time are leading issues.
NENR Nonerasable, nonrewritable media (e.g., optical, magnetic) that, once writ- ten, do not allow for erasure or overwriting of the original data.
OAIS (Open Archival Information System) Describes how to prepare and submit digital objects for long-term digital preservation and retrieval but does not specify technologies, techniques, or content types. The OAIS Reference Model defi nes an archival information system as an archive, consisting of an organization of peo- ple and systems that has accepted the responsibility to preserve information and make it available and understandable for a designated community (i.e., potential users or consumers), who should be able to understand the information. Thus, the context of an OAIS-compliant digital repository includes producers who origi- nate the information to be preserved in the repository, consumers who retrieve the information, and a management/organization that hosts and administers the digital assets being preserved. The OAIS Information Model employs three types of information packages: a Submission Information Package (SIP), an Archival Information Package (AIP), and a Dissemination Information Package (DIP). An OAIS-compliant digital repository preserves AIPs and any preservation descrip- tion information (PDI) associated with them. A SIP encompasses digital content that a producer has organized for submission to the OAIS. After the completion of quality assurance and normalization procedures, an AIP is created, which is the focus of preservation activity. Subsequently, a DIP is created that consists of an AIP or information extracted from an AIP that is customized to the requirements of the designated community of users and consumers.
optical character recognition (OCR) A visual recognition process that involves photo-scanning text character by character.
optical disk Round, platter-shape storage media written to using laser technologies. Optical disk drives use lasers to record and retrieve information, and optical me- dia has a much longer useful life (some purported to be 100 years or more) than magnetic.
phishing A way of attempting to acquire sensitive information, such as user names, passwords, and credit card details, by masquerading as a trustworthy entity in an electronic communication. Communications purporting to be from popu- lar social Web sites, auction sites, online payment processors, or information technology administrators are commonly used to lure the unsuspecting public. Phishing typically is carried out by e-mail or instant messaging, and it often di- rects users to enter details at a fake Web site that looks and feels almost identical to the legitimate one. Phishing is an example of social engineering techniques used to fool users, and it exploits the poor usability of current Web security technologies.
GLOSSARY 411
PII (personally identifi able information) Information about individuals that iden- tifi es them personally, such as Social Security number, address, credit card infor- mation, health information, and the like. PII is subject to privacy laws.
predictive coding A court-endorsed process utilized to perform document review during the early case assessment phase of e-discovery. It uses human expertise and information technology to facilitate analysis and sorting of documents. Predictive coding software leverages human analysis when experts review a subset of docu- ments to “teach” the software what to look for, so it can apply this logic to the full set of documents, making the sorting and culling process faster and more accurate than solely using human review or automated review.
preservation description information (PDI) In the long-term digital preserva- tion process adhering to the Open Archival Information System reference model, description information such as provenance, context, and fi xity.
process-enabled technologies Information technologies that automate and streamline business processes. Process-enabled technologies often are divided into two categories that have a great deal in common: work fl ow automation or busi- ness process management. It is fair to say that a good deal of the technology that underpins business process management concepts has its roots in the late 1980s and early 1990s and stems from the early efforts of the work fl ow community.
project charter A document that formally authorizes a project to move forward. Having such a document reduces project cancellation risk due to lack of sup- port or perceived value to the company. A charter documents the project’s overall objectives and helps manage expectations of those involved.
project management The process of managing required project activities and tasks in a formal manner to complete a project; performed primarily by the project manager.
project manager The person primarily responsible for managing a project to its successful completion.
project plan Includes the project charter and project schedule and a delineation of all project team members and their roles and responsibilities.
project schedule A listing of project tasks, subtasks, and estimated completion times.
policy A high-level overall plan, containing a set of principles that embrace the gen- eral goals of the organization and are used as a basis for decisions. A policy can include some specifi cs of processes allowed and not allowed.
preservation The processes and operations involved in ensuring the technical and intellectual survival of authentic records through time. Preservation involves recording information created, received, and maintained as evidence and informa- tion by an organization or person, in pursuit of legal obligations or in the transac- tion of business.
provenance In records management, information about who created a record and what it is used for.
412 GLOSSARY
records appraisal The process of assessing the value and risk of records to deter- mine their retention and disposition requirements. Legal research is outlined in appraisal reports. This may be accomplished as a part of the process of developing the records retention schedules as well as conducting a regular review to ensure that citations and requirements are current.
record category A description of a particular set of records within a fi le plan. Each category has retention and disposition data associated with it, applied to all record folders and records within the category.
records integrity Refers to the accuracy and consistency of records, and the assur- ance that they are genuine and unaltered.
records management (RM) or records and information management (RIM)) The fi eld of management responsible for the effi cient and systematic control of the creation, receipt, maintenance, use, and disposition of records, including pro- cesses for capturing and maintaining evidence of and information about business activities and transactions in the form of records. It is also the set of instructions allocated to a class or fi le to determine the length of time for which records should be retained by the organization for business purposes, and the eventual fate of the records on completion of this period of time.
records retention schedule Spells out how long different types of records are to be held and how they will be archived or disposed of at the end of their life cycle. Such a schedule considers legal, regulatory, operational, and historical requirements.
record series A group or unit of identical or related records that are normally used and fi led as a unit and that can be evaluated as a unit or business function for scheduling purposes.
refreshment The process of copying stored e-records to new copies of the same media, to extend the storage life of the record by using new media.
return on investment (ROI) A common investment return measure, where the fi nancial benefi t is divided by the cost rendering a percentage or ratio.
risk assessment An evaluation of the risks and possible bad outcomes an organiza- tion faces and the likelihood these may occur.
risk map A simple identifi cation and ranking of the 10 greatest risks an organization faces in relation to business objectives. The risk map is a visual tool that is easy to grasp, with a grid depicting a likelihood axis and an impact axis, usually rated on a scale of 1 to 5.
risk profi le A listing of risks an organization faces and their relative liklihood; used as a basic building block in enterprise risk management that assists executives in understanding the risks associated with stated business objectives, and allocating resources, within a structured evaluation approach or framework.
secure sockets layer (SSL)/transport layer security (TLS) Cryptographic pro- tocols that provide communications security over the Internet. SSL and TLS encrypt the segments of network connections above the transport layer, using
GLOSSARY 413
symmetric cryptography for privacy and a keyed message authentication code for message reliability.
senior records offi cer (SRO) The leading records manager in an organization; may also be titled chief records offi cer or similar.
service-level agreement (SLA) The service or maintenance contract that states the explicit levels of support, response time windows or ranges, escalation procedures in the event of a persistent problem, and possible penalties for nonconformance in the event the vendor does not meet its contractual obligations.
service-oriented architecture (SOA) An information technology architecture that separates infrastructure, applications, and data into layers.
Six Sigma A highly structured approach for eliminating defects in any process, whether from manufacturing or transactional processes. It can be applied to a product or a service-oriented process in any organization. Further, six sigma is a statistical term that measures how far a given process deviates from perfection. The goal of the Six Sigma is to systematically measure and eliminate defects in a process, aiming for a level of fewer than 3.4 defects per million instances, or “opportunities.”
social tagging A method that allows users to manage content with metadata they apply themselves using keywords or metadata tags. Unlike traditional classifi ca- tion, which uses a controlled vocabulary, social tagging keywords are freely chosen by each individual. This can help uncover new categories of documents that are emerging and helps users fi nd information using their terms they believe are relevant.
solid state disk drive Storage devices that can be built in or external that have no moving parts and are made of semiconductor materials. They are used more often in tablet computers as they are faster and more reliable than magnetic disk drives, although also more expensive. Memory sticks and removable USB thumb or fl ash drives are also solid state technology.
spoliation The loss of proven authenticity of a record. Spoliation can occur in the case of e-mail records if they are not captured in real time or if they have been edited in any way.
strategic planning A systematic process of envisioning a desired future and trans- lating this vision into broadly defi ned goals or objectives and a sequence of steps to achieve them.
structured data/records A collection of records or data that is stored in a com- puter; records maintained in a database or application.
subject matter expert (SME) A person with deep knowledge of a particular topical area. SMEs can be useful in the consultation phase of the taxonomy design process.
subject records (Also referred to as topic or function records.) Records containing information relating to specifi c or general topics. The records are arranged by in- formational content or by the function, activity, or transaction to which they pertain.
414 GLOSSARY
submission information package (SIP) One of three types of information pack- ages that can be submitted in the Open Archival Information System preservation model.
taxonomy A hierarchical structure of information components (e.g., a subject, busi- ness unit, or functional taxonomy), any part of which can be used to classify a content item in relation to other items in the structure.
technology-assisted review (TAR) (Also known as computer-assisted review). In- cludes aspects of the nonlinear review process, such as culling, clustering, and de-duplication, but TAR does not meet the requirements for comprehensive pre- dictive coding. According to Barry Murphy of eDJ Group, here are three main methods for using technology to make legal review faster, less costly, and generally smarter:
1. Rules driven . “I know what I am looking for and how to profi le it.” In this sce- nario, a case team creates a set of criteria, or rules, for document review and builds what is essentially a coding manual. The rules are fed into the tool for execution on the document set.
2. Facet driven . “I let the system show me the profi le groups fi rst.” In this sce- nario, a tool analyzes documents for potential items of interest or groups po- tentially similar items together so that reviewers can begin applying decisions.
3. Propagation based.d “I start making decisions and the system looks for similar- related items.” This type of TAR is about passing along, or propagating, what is known based on a sample set of documents to the rest of the documents in a corpus.
text mining Performing detailed full-text searches on the content of document.
thesaurus In taxonomies, a listing that contains all synonyms and defi nitions and is used to enforce naming conventions in a controlled vocabulary (e.g., invoice and bill could be terms that are used interchangeably).l
time- /date-based disposition A disposition instruction specifying when a record shall be cut off and when a fi xed retention period is applied. The retention period does not begin until after the records have been cut off, for example: Destroy after two years.
time, date, and event based A disposition instruction specifying that a record shall be disposed of after a fi xed period of disposition time after a predictable or speci- fi ed event. Once the specifi ed event has occurred, then the retention period is applied. Example: Destroy three years after close of case. In this example, the record does not start its retention period until after the case is closed. At that time, its folder is cut off and the retention period (three years) is applied.
total cost of ownership (TCO) All costs associated with owning a system over the life of the installation and implementation—usually considered over a range of three to fi ve years. TCO includes implementation price and change orders (and the change order approval process), which occur when changes to the project are made outside of the original proposal. Timing and pricing of the software support
GLOSSARY 415
fees are also critical TCO components and may include warranty periods, annual fees, planned and maximum increases, trade-in and upgrade costs, hardware main- tenance costs, and other charges that may not be immediately apparent to buyers.
transfer Moving records from one location to another, or change of custody, owner- ship, and/or responsibility for records.
unstructured records Records that are not expressed in numerical rows and col- umns but rather are objects, such as image fi les, e-mail fi les, Microsoft Offi ce fi les, and so forth. Structured records are maintained in databases.
usage (records) The purpose a record is used for (i.e., its primary use).
ValIT A newer value-oriented information technology governance framework that is compatible with and complementary to CobiT. Its principles and best practices focus is on leveraging IT investments to gain maximum value.
vital records Mission-critical records that are necessary for an organization to con- tinue to operate in the event of disruption or disaster and cannot be re-created from any other source. Typically, they make up about 3 to 5 percent of an organi- zation’s total records. They are the most important records to be protected, and a plan for disaster recovery/business continuity must be in place to safeguard these records.
warm site A computer facility location that has all (or almost all) of the hardware and operating systems as a hot site does, and software licenses for the same appli- cations, and needs only to have data loaded to resume normal operations. Internal information technology staff may have to retrieve magnetic tapes, optical disks, or other storage media containing the most recent backup data, and some data may be lost if the backup is not real time and continuous.
work fl ow, work fl ow automation, and work fl ow software Software that can route electronic folders through a series of work steps to speed processing and improve auditability. Not to be confused with business process management sys- tems, which have more robust capabilities.
WORM Write Once Read Many optical disk storage media that is nonerasable and can be written to only one time.
Notes
1. Kathleen Reidy, “The Rise of Information Governance,” Too Much Information: The 451 Take on In- formation Management (blog), August 5, 2009, http://blogs.the451group.com/information_manage-t ment/2009/08/05/the-rise-of-information-governance/
417
ABOUT THE AUTHOR
Robert F. Smallwood is a founding partner of IMERGE Consulting and heads up its E-Records Institute, a specialty consulting practice, as executive director. Mr. Smallwood has over 25 years of experience in the information technology industry and holds an MBA from Loyola University of New Orleans. He has been recognized as one of the industry’s “25 Most Infl uential People” and “Top 3 Independent Consultants” by KM World magazine. He consults with Fortune 500 companies and governmentsd to assist them in making technology decisions and implementations. Some of his past research and consulting clients include the World Bank, Johnson & Johnson, Apple, Miller-Coors, AT&T, the Supreme Court of Canada, Xerox, and IBM. Smallwood was an AIIM International chapter founder and president, and a member of the executive committee of the Board of Direcctors, and is active in ARMA International. He has published more than 100 articles and given more than 50 conference presentations on documents, content, and records management. He is the author of Managing Elec- tronic Records: Methods, Best Practices, and Technologies (Wiley, 2013); s Safeguarding Critical E-Documents (Wiley, 2012); s Managing Social Media Business Records (CreateSpace, s 2011) , Taming the Email Tiger (Bacchus Business Books, 2008) and several other r books, including a novel, a theatrical play, and the fi rst published personal account of Hurricane Katrina.
419
Lori J. Ashley is a Wisconsin-based consultant, writer, and educator dedicated toy helping clients improve the performance of their record and information management practices and controls. An experienced business strategist and organizational devel- opment specialist, she has codeveloped four continuous improvement methodologies aimed at jump-starting collaboration among stakeholders who share accountability for effective and effi cient life cycle management of valued records and information assets.
Barbara Blackburn , CRM, is an electronic records management consultant who as- sists organizations in defi ning, researching, selecting, and implementing cost-effective solutions. She assists clients in preparing for technology deployment by providing strategic planning and developing record-keeping programs and taxonomies. Ms. Blackburn has expert taxonomy design skills and has taught AIIM’s Electronic Records Management and Electronic Content Management certifi cation classroom courses.
Barclay T. Blair is an advisor to Fortune 500 companies, software and hardware r vendors, and government institutions and is an author, speaker, and internationally recognized authority on information governance. He has led several high-profi le consulting engagements at the world’s leading institutions to help them globally transform the way they manage information. Mr. Blair is the president and founder of ViaLumina.
Charmaine Brooks, CRM, is a principal with IMERGE Consulting, Inc., and has more than 25 years of experience in records and information management and content management. Ms. Brooks is a certifi ed trainer and has taught AIIM classroom courses on ERM and provided many workshops for ARMA. Formerly a records manager for a leading worldwide provider of semiconductor memory solutions and a manager in a records management software development company, today Ms. Brooks provides clients, small and large, public and private, with guidance in developing records man- agement and information governance programs.
Monica Crocker, CRM, PMP, CIP, is the corporate records manager for Land r O’Lakes, Inc. Ms. Crocker has also been an information management consultant for 20 years, defi ning content and records management best practices for organizations across the United States. Her expertise includes SharePoint governance, cloud com- puting, enterprise strategies for content management, records management, electronic discovery, taxonomy design, project management, and business process redesign. Ms. Crocker is a recipient of AIIM’s Distinguished Service Award.
Charles M. Dollar is an internationally recognized archival educator, consultant, and r author who draws on more than three decades of knowledge and experience in work- ing with public and private sector organizations to optimize the use of information technologies to satisfy legal, regulatory, business, and cultural memory recordkeep- ing requirements for digital preservation. He is co-developer of a capability maturity
ABOUT THE MAJOR CONTRIBUTORS
420 ABOUT THE MAJOR CONTRIBUTORS
model for long-term digital preservation that incorporates the specifi cations of ISO 15489, ISO 14721, ISO 18492, and ISO 16363.
Patricia Franks, Ph.D., is a certifi ed records manager and the coordinator for the Master of Archives and Records Administration degree program in the School of Library and Information Science at San José State University. She served as the team lead for both the ANSI/ARMA standard released in January of 2011, Implications of Web-based Collaborative Technologies in Records Management , and the 2012 technical re-t port, Using Social Media in Organizations . Her latest publication, s Records and Infor- mation Management (ALA Neal-Schuman, 2013), offers insight into a range of topicst affecting records and information management professionals.
Randolph Kahn, Esq., is the founder of Kahn Consulting, one the premier informa- tion governance advisory fi rms. The Kahn Consulting team has provided consulting services to major global organizations, including advising U.S. and foreign govern- ments, courts systems, and major multinational corporations on a wide variety of in- formation issues, including e-communications strategies, social media policy, records management programs implementation, and litigation response processes. Mr. Kahn is a highly sought after speaker and a two-time recipient of the Britt Literary Award. He has authored dozens of published works, including Chucking Daisies , his new book on s defensible disposition; Email Rules ; s Information Nation: Seven Keys to Information Man- agement Compliance ; Information Nation Warrior ; and r Privacy Nation . He is a cofounder of the Council for Information Auto-Classifi cation and has been expert witness and an advocate in many industry organizations. Mr. Kahn is an attorney who attained his J.D. degree from Washington University in St. Louis, Missouri, and he has taught at George Washington University.
Barry Murphy is a cofounder of eDJ Group, Inc. and a thought leader in informationy governance, e-discovery, records management, and content archiving. Previously, he was director of product marketing at Mimosa Systems, a leading content archiving and e-discovery software provider. He joined Mimosa after a highly successful stint as principal analyst for e-discovery, records management, and content archiving at Forrester Research. Mr. Murphy received a B.S. from the State University of New York at Binghamton and an M.B.A. from the University of Notre Dame. He is an ac- tive member of both AIIM and ARMA.
421
Abatan, Peter, 228, 229 Aberdeen Group, 271 Accenture, 9 Accessibility of information:
costs associated with, 104 identity access management for,
212–213, 272 long-term digital preservation for,
26, 32, 322, 340–341, 343 principles of IG including, 26,
28, 32, 35, 37 records and information management
availability principle on, 28, 32, 35, 37, 151, 309
security balanced with, 26, 32, 151, 203, 212–213, 215–216, 224
Accountability: for data governance, 16, 192 for disposition, 133 for IG policy implementation, 88 for IT governance, 17 for maintenance of IG program,
349–350 principles of IG including, 27,
28, 30, 35, 36 for records and information
management, 28, 30, 35, 36, 53, 133, 309, 311–312
for SharePoint, 309, 311–312 for social media, 267 for strategic planning, 53–54
Adler, Steven, 192 Adobe, 85, 331, 332 AirWatch, 275 Aldus Corporation, 331–332 Alperovitch, Dmitri, 207 Amazon:
Elastic Compute Cloud service, 296
Web Services, 344 American National Standards Institute
(ANSI), 76, 87, 155, 371
Andrews, James, 259 AntiSec, 241–242 AOL Instant Messenger,
247, 249 Apple:
AppSense, 275 iOS, 271, 276, 279 iPhone, 271, 278 iTunes App Store, 278–279
Application programming interface (API), 293–294
ArchiveFacebook, 261 Archivematica, 344 Archiving information, 33, 34,
63–64, 85–86, 177, 244–247, 248–249, 261–262, 263, 321–323, 339. See also Long-term digital preservation
Association for Information and Image Management (AIIM), 176
Association of Records Managers and Administrators (ARMA), 6, 20, 28, 34, 62, 71, 72, 147, 155, 176
Auditing: database auditing tools for, 203 IG policies, 89–90 long-term digital preservation audit
and certifi cation standards, 325–327
principles of IG including, 26, 30, 32
records and information management including, 30, 32, 150, 183
risk mitigation plan, 51, 63 security functions including, 26, 203,
211, 213, 225, 291 strategic planning including, 63 technology-assisted review, 130
Australasian Digital Recordkeeping Initiative (ADRI), 80
INDEX
422 INDEX
Australia: AS 4390-1996 records and
information management standard in, 84
AS 5044-2010 metadata standard in, 85
AS 5090:2003 records and information management standard in, 85
AS 8015 IT governance standard in, 19–20, 79, 201
Archives Act in, 391, 392 Australian Government Locator
Service in, 85 Australian Government
Recordkeeping Metadata Standard Version 2.0 in, 84–85
Australian Information Commissioner Act 2010 in, 392
Crimes Act 1914 in, 393 Designing and Implementing
Recordkeeping Systems (DIRKS) used in, 62, 80, 155
Electronic Transactions Act 1999 in, 393
Evidence Act 1995 in, 393 Financial Management and
Accountability Act 1997 in, 393 Freedom of Information Amendment
[Reform] Act 2010 in, 169, 391–392
AS ISO 15489 records and information management standard in, 84, 85
National Archives of Australia in, 80, 393
Offi ce of the Australian Information Commissioner in, 392
Privacy Act 1988 in, 392, 398 records and information management
regulations and standards in, 84–85, 149, 150, 303, 391–393
Standards Australia in, 76, 84, 87 standards in, 19–20, 76, 79,
84–85, 201
Bearing Point, 62 Best Buy, 264
Best practices: for cloud computing, 64 of cross-functional IG
implementation team, 62 for disposition of information, 62,
63–64 of executive sponsorship, 63, 65 for IG policy development and
enforcement, 62, 75–76, 87–88 for instant messaging, 247–249 for international and national
guideline standards usage, 64 for IT functions for IG, 190, 202–203 for long-term digital preservation,
64–65 for maturity model usage, 62 for metadata and taxonomy usage, 64,
190 for mobile devices, 280–281 for ongoing program aspect of IG,
61–62 for privacy protection, 63 for records and information
management, 61, 62 for retention of information, 62–63,
64–65 for risk management, 62–63 of security functions, 62, 63, 202–203 for social media, 64, 262, 267–268 strategic planning consideration of,
61–65 Big Data, 3–5, 100–101,
106–107, 117, 355 Biometric authentication technologies,
272, 277 Blair, Barclay, 8 Blogs, 260, 265 Bloomberg Messaging, 247 Bollinger, Bryan, 108 Booz Allen Hamilton, 241–242 Box, 289 BoxTone, 275 British Standards Institute (BSI),
76, 371 Broddy, William, 216 Business considerations:
business classifi cation schemes as, 368–369
INDEX 423
business conditions and economic environment survey, 59–60
business continuity management as, 86–87, 150, 153, 320, 321, 327, 350
business intelligence for, 191, 194 business process analysis as, 377–379 changing information environment
as, 97–99 cloud computing as, 285, 297 corporate culture impacts as, 107 cost sources impacting, 103–105 data governance impact as, 16 disposition issues related to, 103,
136–137 full cost accounting of, 101–102 IG as good business, 7–8, 110–111 IG-enabled organization positives as,
110–111 impact of successful IG program as,
20–21, 97–112 information-calorie intake
analysis as, 108 information cap-and-trade
model as, 109 information cost calculations as,
99–100 information value creation as,
105–107 IT functions impacted by, 190,
194, 196–197 legal issues related to, 99–100,
103, 110, 125, 136–137 opportunities and challenges of Big
Data as, 100–101, 106–107 professionalism as, 153 records and information management
issues related to, 110, 149–150, 153, 303–304, 307–309
security functions related to, 111 SharePoint business objectives as,
303–304, 307–309 strategic plan alignment with, 57–58 taxonomies addressing, 356–357,
368–369, 377–379 unstructured information
management as, 97–99, 101–111 BWF (broadcast wave format), 333
Canada: Canada Revenue Agency, 82, 92,
388, 394 Canadian General Standards Board
(CGSB), 92, 394 Canadian Standards Association
(CSA), 92 cyberattacks on government of, 207 Electronic Records as Documentary
Evidence CAN/CGSB-72.34- 2005, 82, 92, 387–388, 394
Evidence Acts in, 82–83, 93, 388–389, 394–395
Fraser Health Authority in, 10 Freedom of Information and
Protection of Privacy Act in, 169 Health Information Act in, 169 Library and Archives Canada, 330 Microfi lm and Electronic Images as
Documentary Evidence CAN/ CGSB-72.11-93, 82, 92, 387–388, 394
privacy laws in, 169, 398 records and information management
regulations and standards in, 82, 92, 150, 303, 387–389, 394–395
records retention citation services in, 44, 138, 139, 178–179
Standards Council of Canada in, 76, 92, 394
standards in, 76, 82–83, 92–93, 387–388, 394
Centrify, 275 China:
instant messaging in, 247 mobile devices in, 271 security issues of fi les sent to, 229
CIOZone.com, 273 Cisco Unifi ed Presence, 247 CIS Database Server Benchmarks, 202 Citibank, 278 Citrix, 275 Cloud computing:
application programming interface in, 293–294
benefi ts of, 298–299 best practices for, 64 business considerations for, 285, 297
424 INDEX
Cloud computing (continued ) cloud-based mobile device
management, 276 cloud deployment models, 289–290 community, 289 defi nition and description of, 285–286 disposition and retention issues in,
297, 299–300 employee/insider threats in, 291–292 growth of, 288 guidelines for, 300 hacking and unauthorized access in,
292–293, 295–296 hybrid, 289–290 hypervisors in, 294–295 IG policies on, 76, 291, 293,
296, 297–298 information breaches in, 291 information loss in, 290 IT trend analysis of, 59 key characteristics of, 287–288 legal issues with, 297 meaning of, 288–289 multitenancy and technology sharing
issues in, 294–295 neighbors/other users of
infrastructure in, 296–297 overview of, 285–286 private, 289 public, 289 records and information management
for, 151, 160, 297, 299–300 security issues with, 213, 224,
285–286, 290–298 Cloud Security Alliance, 290 CobiT® (Control Objectives for
Information and related Technology), 18, 111, 197, 198–199, 200
Code of Federal Regulations (CFR), 44–45, 138–140, 178, 386, 387
Communication: of business and fi nancial cost
considerations, 108 of IG policies, 25, 35, 89, 242–243,
248, 282, 352 of instant messaging policies, 248 of inventory goals, 158
of metadata use, 364 of mobile device policies, 282 principles of IG including, 25 of records and information
management policies, 31, 158, 169, 313–314
of security functions, 233–234 of SharePoint policies, 313–314 of strategic plan, 55
Compliance, Governance and Oversight Counsel (CGOC), 4, 72, 73
Computer-assisted review, 128–130, 135 Computer Fraud and Abuse Act, 210 Computerworld, 106 Conniff, Richard, 109 Consultative Committee for Space Data
Systems, 321 Corporate culture:
business and fi nancial impacts of, 107 IT governance impacted by, 199 legal and e-discovery readiness
impacted by, 124 SharePoint usage necessitating
changes to, 304–305 strategic planning consideration of, 58
Corporate governance: data governance in, 15–17, 25, 110,
191–194, 299–300 information governance in, 5, 6,
7, 15, 20 (see also(( Information governance)
IT governance in, 17–20, 79, 111, 196–201
Costs. See Financial issues Council of Australasian Archives and
Records Authorities, 80 Council of Information Auto-
Classifi cation, “Information Explosion” survey, 131
CTIA (The Wireless Association), 271 Customs and Border Protection, U.S.,
223 CyberArk, 209
Data architecture, 195 Database activity monitoring
(DAM), 203 Database auditing tools, 203
INDEX 425
Data governance, 15–17, 25, 110, 191– 194, 299–300
Data Governance Institute, 193 Data loss prevention (DLP) technology,
220–222, 227–228, 231, 291, 292 Data modeling, 195–196, 197 Data Protection Act, 156 Defense in depth, 212 Delivery platforms:
best practices using, 64, 247–249, 262, 267–268, 280–281
cloud computing as, 59, 64, 76, 151, 160, 213, 224, 276, 285–301
disposition of information from, 63– 64, 125–126, 244–247, 248–249, 261–262, 263, 297, 299–300
e-mail as (see(( E-mail) IG for various, 8, 9, 11, 241–251,
253–268, 271–283, 285–301, 303–314
IG policies applied to, 76, 242–243, 247–249, 257, 258, 259–260, 262–264, 267, 276, 281–282, 291, 293, 296, 297–298, 310–311
instant messaging as, 243, 247–250, 257
IT trend analysis of, 59 legal issues related to specifi c, 116,
119, 125–126, 243–244, 245, 259– 260, 264–267, 282, 297, 303, 307
mobile devices as, 9, 11, 59, 151, 160, 164, 213, 220, 225, 230, 271–283, 298, 303
records and information management on various, 151, 159, 160, 164, 232, 264–267, 297, 299–300, 303–314
removable media as, 159, 164, 223, 277
retention of information on, 64, 126, 175–178, 243–247, 248–249, 261–262, 263, 264–267, 297, 299–300
risk management issues with, 242–243, 257–260
security issues with, 213, 217–218, 220, 223–224, 225, 226–227, 230,
233–234, 241–251, 256–268, 271–283, 285–286, 290–298, 303–314
SharePoint as, 160, 232, 303–314 social media as, 59, 64, 76, 151, 213,
253–268 training in specifi c, 258, 268, 282, 313
Department of Defense, U.S. (DoD) standards, 76, 80, 81–82, 179
Design Criteria Standard for Electronic Records Management Software Applications, 81
Designing and Implementing Recordkeeping Systems (DIRKS), 62, 80, 155
Device control methods, 227 Digital signatures, 218–219, 220 Digital Systems Knowledge Transfer
Network, 271 DISA Security Technical
Implementation Guides (STIGs), 202
Disasters, business continuity after, 86– 87, 150, 153, 320, 321, 327, 350
Disposition of information: accountability for, 133 archiving as, 33, 34, 63–64, 85–86,
177, 244–247, 248–249, 261–262, 263, 321–323, 339 (see also(( Long- term digital preservation)
auto-classifi cation and analytics technologies assisting with, 134–135
best practices for, 62, 63–64 business considerations related to,
103, 136–137 cloud computing, specifi cally, 297,
299–300 costs associated with, 103 discarding as, 34 e-mail, specifi cally, 63–64, 125–126,
244–247 essential steps to defensible, 136 event-based, 179–181 fi nal disposition and closure criteria,
181–182 IG policies on, 75–76, 121–122 imaging as, 34
426 INDEX
Disposition of information (continued ) implementation of, 182–183 importance of, 4–5 information control through, 26 information value increased through
appropriate, 106 instant messages, specifi cally, 248–249 legally defensible, 4–5, 6, 8, 62, 117,
121–122, 125–126, 130–137 methods of, 34, 170 proving record destruction in, 183 purging as, 34 records and information management
addressing, 28, 33–34, 35, 37, 130–137, 150, 151, 170, 177–178, 179–183, 297, 299–300
shredding as, 34 social media, specifi cally, 261–262,
263 strategic plan consideration of,
62, 63–64 technologies assisting with,
134–136, 179, 183 volume of information necessitating
improved, 131–132 DLM Forum, 84 Document analytics, 232–233 Document labeling, 26, 231–232 Document life cycle security (DLS)
technologies, 291, 292. See also Data loss prevention (DLP) technology; Information rights management (IRM) software
Dropbox, 289 Dublin Core Metadata Initiative
(DCMI), 85, 365–366
Economist Intelligence Unit, 8, 105 E-discovery:
costs associated with, 60, 99–100, 103, 123
disposition issues with, 117, 121–122, 125–126
e-discovery process, steps of, 120 Electronic Discovery Reference
Model, 62, 72, 119–122 e-mail as, 244 Federal Rules of Civil Procedure
impacting, 115–116, 117–118, 119, 150, 265, 303
guidelines for e-discovery planning, 121–122
IG impact on, 123 IG proactive management of, 8 legal hold process impacting, 26, 60,
62, 117, 122–126, 297, 303 predictive coding assistance with,
58, 127–128 retention issues with, 4, 100,
121–126 social media as, 260, 264–265 techniques of, 119 technologies assisting with,
58, 126–130 technology-assisted review assistance
with, 128–130 Zubulake v. UBS Warburg on, 119g
Eisenberg, Anne, 99 Electronic Code of Federal Regulations
(e-CFR), 45, 139–140, 178 Electronic Communications Privacy Act
(ECPA), 210 Electronic Discovery Reference Model
(EDRM), 62, 72, 119–122 Electronic records management.
See Records and information management
E-mail: archiving of, 244–247 as business records, 175–176, 241,
245–246 destructive retention of, 64, 126,
177–178, 246–247 disposition of, 63–64, 125–126,
244–247 encryption of, 217, 226 IG control of, 8, 241–247 IG policies on, 76, 242–243 information value creation through,
106 legal issues related to, 116, 119,
125–126, 243–244, 245 ownership of, 98 realistic policies on, 243 retention of, 64, 126, 175–178,
243–247
INDEX 427
risk management issues with, 242–243 security issues with, 217–218,
223–224, 226–227, 233–234, 241–247
social media distinction from, 257 stream messaging vs., 217–218,
233–234, 236 technology-agnostic policies on, 243 unstructured information
management including, 97–99, 106
Employees/staff: accountability of, 16, 17, 27,
28, 30, 35, 36, 53–54, 88, 133, 192, 267, 309, 311–312, 349–350
communication with (see(( Communication)
corporate culture among, 58, 107, 124, 199, 304–305
e-mail ownership issues with, 98 executive sponsorship by senior,
16, 25, 28, 30, 53–55, 63, 65, 88, 157, 159, 169, 182, 192,
197, 306, 349–350, 352, 388 IG benefi ts for, 8 IG continuity plan involving, 350 IG policies for (see(( Information
governance policies) IG teams/governance bodies
including, 11, 35, 38, 55, 56–57, 62, 88, 124–125, 262–263, 281, 306–307, 350
information misuse by, 8–10, 26, 208– 210, 228, 229, 242–243, 258–259, 291–292, 320–321
inventory team including, 157, 160 risk profi le interviews with, 47–48 stakeholder consultation including,
26–27 training for (see(( Training)
Encryption, 26, 164, 203, 217, 219–220, 225, 226–227, 228, 276, 277, 281, 291, 294
Enterprise content management (ECM), 149
Environmental Protection Agency, U.S., 101, 153
ePolicy Institute, 233, 244 Etsy, Dan, 109 European Union. See also specifi c
countries European Broadcasting Union in, 333 mobile devices in, 271 privacy laws in, 398 records and information management
regulations in, 303 Executive sponsorship:
continuity of, 350 for data governance, 16, 192 for IG maintenance, 349–350, 352 for IG policy development and
implementation, 88 for inventory of records, 157, 159 for IT governance, 197 key purposes of, 54 as principle of IG, 25, 28, 30 for records and information
management, 28, 30, 157, 159, 169, 182, 306, 388
for SharePoint implementation, 306 for strategic planning, 53–55, 63, 65
Facebook, 254, 256, 257, 261, 265 Federal Bureau of Investigation, 9 Federal Deposit Insurance Corporation
(FDIC), 280 Federal Information Security
Management Act of 2002, 296 Federal Register, 45, 139, 178 Federal Reserve Bank of New York, 244 Federal Rules of Civil Procedure
(FRCP): e-discovery impacts of, 115–116,
117–118, 119, 150, 265, 303 FRCP 1, 117 FRCP 16, 118 FRCP 26, 118, 119, 265 FRCP 33, 118 FRCP 34, 118 FRCP 37, 118
Federal Wiretap Act, 210 FedEx, 259 FILELAW®WW , 44, 138, 139, 178–179 Financial Institution Privacy Protection
Act of 2001/2003, 385
428 INDEX
Financial issues: accessibility costs as, 104 business considerations based on, 7–8,
16, 20–21, 59–60, 99–112, 125, 136–137
business process structuring costs as, 104–105
classifi cation and organization costs as, 103
cost-benefi t analysis of, 20–21, 152 digitization and automation costs as,
103–104 disposition costs as, 103 e-discovery costs as, 60, 99–100, 103,
123 full cost accounting of, 101–102 IG enabling or maturity impacting,
110–111 information cost calculations as,
99–100 information value creation as, 105–
107 knowledge transfer costs as, 105 long-term digital preservation costs
as, 321 migration to current system costs as,
104 mobile device costs as, 281–282 policy management and compliance
costs as, 104 records and information management
costs as, 151, 152 retention costs as, 4–5, 99, 104, 131 risk assessment calculating, 48 security breach costs as, 207, 220–221,
227, 271 sources of costs in, 103–105 standards-related costs as, 77 strategic planning of budgets as, 53,
54, 59–60 unstructured information ownership
costs as, 102–105 Flash drives. See Removable media Flickr, 261 Flynn, Nancy, 233, 244, 245 Folksonomies, 381 Food and Drug Administration, 386 Ford Motor Company, 9
Forrester Research, 227, 230, 355 France:
privacy laws in, 398 records and information management
regulations in, 149 Société Générale breach in, 212
FRCP. See Federal Rules of Civil Procedure
Freedom of Information Act, U.S., 45–46, 156, 169, 210
Friedman, Ted, 5 Frost & Sullivan, 275 Fulbright and Jaworski research, 126,
177
Gartner, Inc., 3, 5, 10, 27, 189, 194, 220, 271, 275, 288, 356
Geithner, Timothy, 244 General Accounting Offi ce (GAO), 173 Generally Accepted Recordkeeping
Principles®, 27–35, 36–37, 53, 71, 74, 155, 171
Germany: privacy laws in, 398 records and information management
regulations in, 149 Global Aerospace, Inc., et al. v. Landow
Aviation, LP, et al., 127–128 Global Information Locator Service
(GILS), 366–367 Good Technology, 275 Google:
Android Marketplace of, 278–279 Android OS of, 271, 272, 276, 279 security breach of, 229
Government Printing Offi ce, 45, 139, 178
GPS (Global Positioning System), 273 Gramm-Leach-Bliley Act, 385 Gruman, Galen, 287
Health Insurance Portability and Accountability Act, 223, 385
Heartland, 296 Homeland Security, U.S., 223 House of Representatives Oversight and
Government Reform Committee, U.S., 244
INDEX 429
Huawei Technologies, 9 Hypervisors, virtualization, 294–295
Ibas, 208 IBM:
Endpoint Manager for Mobile Devices, 275
Lotus Sametime, 247 Identity access management,
212–213, 272 IG. See Information governance India:
cyberattacks on government of, 207 mobile devices in, 271 privacy laws in, 399 records and information management
regulations in, 149 security issues of fi les sent to, 229
Indonesia, security of fi les sent to, 229 Information governance (IG):
auditing in (see(( Auditing) Big Data age necessitating, 3–5,
100–101, 106–107, 117, 355 business considerations in (see((
Business considerations) communication related to (see((
Communication) continuity plan for, 350 continuous improvement to, 27,
34–35, 36–37, 351–352 corporate governance including, 5, 6,
7, 15, 20 data governance distinction from,
15–17 (see also(( Data governance) defi nition and description of, 5–7, 20 delivery platforms for (see(( Delivery
platforms) disposition of information in (see((
Disposition of information) employees working with (see((
Employees/staff) executive sponsorship of (see((
Executive sponsorship) failures in, 8–10 fi nancial issues in (see(( Financial issues) impact of successful, 20–21 imperative for, 3–5 information technology functions in
(see(( Information technology (IT) functions)
IT governance distinction from, 17–20 (see also(( IT governance)
key points related to, 12, 21–22, 38, 51, 68, 90–91, 111–112, 142–143, 184–186, 204, 234–236, 250–251, 268, 283, 301, 314, 345–346, 352–353, 382
laws and regulations impacting (see(( Laws and regulations)
legal issues for (see(( Legal issues) long-term program issues with (see((
Long-term program issues) maintenance of IG program, 349–353 metadata management in
(see(( Metadata) monitoring in (see(( Monitoring) policies for (see(( Information
governance policies) principles of, 25–38 privacy protection in (see(( Privacy
protection) records and information management
in (see(( Records and information management)
retention of information and (see(( Retention of information)
risk management in (see(( Risk management)
security functions in (see(( Security functions)
strategic planning and best practices for (see(( Strategic planning)
taxonomies in (see(( Taxonomy/common terminology)
training in (see(( Training) Information governance policies:
accountability for, 88 best practices for developing and
enforcing, 62, 75–76, 87–88 business continuity management
under, 86–87 cloud computing under, 76, 291, 293,
296, 297–298 communication of, 25, 35, 89, 242–
243, 248, 282, 352
430 INDEX
Information governance (continued ) controls, monitoring, auditing and
enforcement of, 89–90 cost of development of and
compliance with, 104 development of, 10–11, 25, 62, 71–91 disposition under, 75–76, 121–122 e-mail under, 76, 242–243 Information Governance Reference
Model usage for, 62, 72–75 instant messaging under, 243,
247–249 international and national standards
impacting, 76–88, 92–93 legal issues impacting, 76–88 long-term digital preservation under,
85–86, 326, 327, 337, 338 mobile devices under, 276, 281–282 realistic, 243 records and information management
under, 71, 74, 79–86, 92–93, 150–151, 310–311
retention under, 46, 75–76, 85–86, 121–122
risk management under, 46, 62–63, 75, 77
roles and responsibilities for, 88 security function under, 72, 78–79,
213, 214, 221, 222, 224, 233–234, 291, 293, 297–298
SharePoint under, 310–311 social media under, 76, 257, 258,
259–260, 262–264, 267 strategic plan shaping, 53–68 teams/governance bodies
determining, 11, 35, 38, 88 technology-agnostic, 243
training in, 35, 89, 282 Information Governance Reference
Model, 62, 72–75 Information life cycle management
(ILM), 195. See also Disposition of information; Retention of information
Information management, 194–196, 197 Information rights management (IRM)
software, 9, 26, 62, 164, 210, 222–226, 227–228, 229, 291, 292
Information technology (IT) functions: best practices for, 190, 202–203 business considerations impacting,
190, 194, 196–197 customization of, 190 data architecture as, 195 data governance as, 15–17, 25, 110,
191–194, 299–300 data modeling as, 195–196, 197 delivery platforms for (see(( Delivery
platforms) IG enabling or maturity impacting,
110–111 information life cycle management
as, 195 (see also(( Disposition of information; Retention of information)
information management as, 194–196, 197
IT governance as, 17–20, 79, 111, 196–201
IT network diagram detailing, 160 IT strategic planning as, 58, 59 IT trend analysis as, 59 master data management as, 194 overview of, 189–190, 204 records and information management
relationship to, 151, 160, 164, 176 risk management through, 192, 193, 198 security functions as, 202–203
Information Technology Infrastructure Library (ITIL), 18, 19, 197, 198, 200–201
Inside Out, 342 Insider threats, 8–10, 26, 208–210, 228,
229, 242–243, 258–259, 291–292, 320–321
Instagram, 261 Instant messaging:
best practices for, 247–249 disposition and retention of, 248–249 IG policies on, 243, 247–249 monitoring of, 249 security issues with, 247–250 social media distinction from, 257 tips for safer use of, 249–250
Intellectual property, security of, 9, 208–210, 223, 228, 229, 260
INDEX 431
Intel/McAfee, 207–208 Internal Revenue Agency, 296 International Council on Archives
(ICA), Principles and Functional Requirements for Records in Electronic Offi ce Environments (Req), 80
International Data Corporation (IDC), 131, 272
International Olympic Committee, 207 International Organization for
Standardization (ISO): best practices on referral to, 64 IG policies impacted by, 76,
77–81, 84 ISO 14721:2003, 321 ISO 14721:2012, 85–86, 318, 325,
333, 334, 335–336 ISO 15489-1:2001, 79–80, 141, 155,
324 ISO 15489-2:2001, 80, 141 ISO 15498:2004, 332 ISO 15836:2009, 365 ISO 15849, 364–365, 369 ISO 16175, 80, 84 ISO 16175-1:2010, 141 ISO 16363 (2012), 325–327,
333, 334, 335 ISO 16363:2012, 86 ISO 17799, 18, 198 ISO 19005, 331 ISO 19005-1:2005, 85 ISO 22301:2012, 86–87 ISO 23081-1:2006, 364–365 ISO 23950, 366 ISO 25964, 371 ISO 28500:2009, 333 ISO 30300:2011, 80–81 ISO 30301:2011, 80–81 ISO 31000:2009, 77 ISO/IEC 13818-3:2000, 333 ISO/IEC 15444:2000, 332–333 ISO/IEC 20000, 19, 200 ISO/IEC 27001:2005, 78 ISO/IEC 27002:2005, 78, 210 ISO/IEC 38500:2008, 19–20,
79, 111, 201 ISO TR 18492 (2005), 86, 324–325
IT governance standards, 19–20, 111, 198, 200–201
long-term digital preservation standards, 85–86, 318, 321, 324–327, 331, 332–333, 334, 335–336
metadata standards, 364–365 records management standards,
79–81, 84, 85–86, 141, 147, 155, 369
risk management standards, 46, 77 security standards, 78–79, 210 thesauri standards, 371
Inventory of records: challenges of, 155–156 conducting of, 157, 163–166 conductor of inventory determined
for, 157, 160 defi nition of, 154 executive sponsorship of, 157, 159 Generally Accepted Recordkeeping
Principles® for, 155 goals of, 157–158 information/elements to be collected
determination for, 157, 159–160 information location determination
for, 157, 163 interviews as method of conducting,
164, 165–166, 167 inventory forms for, 157, 160, 161–
163 IT security based on, 202 long-term digital preservation use of,
339 observation as method of conducting,
164 overview of, 154–155 purposes of, 156 records and information management
including, 154–168, 173, 202, 339 records value appraisal in, 167–168 results verifi cation and analysis for,
157, 166–168 retention schedule detailed in, 154,
173, 339 scope of, 157, 158–159 steps of creating, 157–168 surveys as method of conducting, 164
432 INDEX
IRC Federal, 242 ISACA (formerly Information Systems
Audit and Control Association), 18, 198
ISO. See International Organization for Standardization
IT. See Information technology (IT) functions
IT governance, 17–20, 79, 111, 196–201 IT Governance Institute:
Board Briefi ng on IT Governance, 17 CobiT® development by, 18, 198
ITIL (Information Technology Infrastructure Library), 18, 19, 197, 198, 200–201
Jabber XCP, 247 Japan:
privacy laws in, 399 records and information management
regulations in, 149 Jaquith, Andrew, 230 Jolicloud, 261 JPEG 2000 (joint photographic
engineers group) standard, 332–333, 343
Key point summaries, 12, 21–22, 38, 51, 68, 90–91, 111–112, 142–143, 184–186, 204, 234–236, 250–251, 268, 283, 301, 314, 345–346, 352–353, 382
Knorr, Eric, 287 Kortchinksy, Kostya, 295
Labels, documents, 26, 231–232 LANDesk, 275
Laws and regulations. See also specifi c regulatory bodies; Standards
citation services summarizing, 44, 138, 139, 178–179
cloud computing impacted by, 297 Code of Federal Regulations, 44–45,
138–140, 178, 386, 387 e-mail under, 245 Federal Rules of Civil Procedure,
115–116, 117–118, 119, 150, 265, 303
freedom of information laws as, 45–46, 156, 169, 210, 391–392
IG policies impacted by, 76–88 privacy, 169, 210–211, 297, 385, 392,
397–400 records and information management
compliance with, 28, 32, 33, 35, 36–37, 130–142, 149–150, 151, 156, 169, 176–179, 303, 307, 385–395
risk management research and application of, 43–46, 62–63, 123
security functions impacted by, 223, 227, 296
social media impacted by, 265 strategic planning consideration of,
56–57, 60 Legal issues. See also Laws and
regulations Big Data effect on, 117 business considerations related to,
99–100, 103, 110, 125, 136–137 cloud computing-specifi c, 297 e-discovery as, 4, 8, 26, 58, 60, 62, 72,
99–100, 103, 115–130, 150, 244, 260, 264–265, 297, 303
e-mail-specifi c, 116, 119, 125–126, 243–244, 245
FRCP impacting, 115–116, 117–118, 119, 150, 265, 303
IG policies impacted by, 76–88 legal hold process as, 26, 60, 62, 117,
122–126, 297, 303 legally defensible disposition of
information as, 4–5, 6, 8, 62, 117, 121–122, 125–126, 130–137
mobile device-specifi c, 282 overview of, 115 privacy protection impacted by,
43–44, 63, 169, 210–211, 297, 385, 392, 397–400
records and information management legal compliance as, 28, 32, 33, 35, 36–37, 130–142, 149–150, 151, 156, 169, 176–179, 303, 307, 385–395
retention impacted by, 4, 26, 33, 43– 44, 62–63, 122–126, 137–142, 169, 177–179, 243–244
INDEX 433
risk management research and application of, 43–46, 62–63, 123
security functions impacted by, 43–44, 223, 227, 296
SharePoint compliance with, 303, 307 social media-specifi c, 259–260,
264–267 strategic planning consideration of,
56–57, 60, 62–63, 123 taxonomies addressing, 357 technologies assisting with, 58, 126–
130, 134–136 Leslie, Phillip, 108 Library of Congress, U.S., 328, 330,
361, 366, 371–372 Lightweight directory access protocol
(LDAP), 226 LinkedIn, 254, 256, 259–260, 262 Logan, Debra, 10, 27, 189 Long-term digital preservation:
accessibility of information through, 26, 32, 322, 340–341, 343
archiving as, 177, 321–323, 339 audit and certifi cation standards for,
325–327 best practices for, 64–65 business continuity issues in, 320,
321, 327 costs of, 321 defi nition of, 317–318 digital object management in, 326–327 digital preservation infrastructure of,
337–338 digital preservation processes and
services of, 339–341 evolving marketplace for, 344 future of, 344 IG policies on, 85–86, 326, 327, 337,
338 integrity of information in, 340, 343 key factors in, 318–320 Long-Term Digital Preservation
Capability Maturity Model®, 334–341
media obsolescence and renewal in, 320, 339–340, 342–343
metadata in, 318, 328–329, 340, 343 OAIS Reference Model for, 321–323
open standard technology-neutral formats for, 321, 324, 329–333, 338, 342, 343
optimal to nominal stages of preservation in, 335–336
organizational infrastructure of, 325–326
performance metrics for, 341 preservation description information
for, 322–323 principles of IG including, 26, 32 producers and users of, 336–337, 344 records and information management
addressing, 177, 182, 317–346 requirements for, 333 risk management of, 327 security issues related to, 32, 320–321,
325, 327, 340, 343 standards on, 85–86, 318, 321–333,
334, 335–336 strategic planning including, 59,
64–65, 325, 337 strategies and techniques for,
341–344 technical infrastructure of, 327, 338 threats to, 320–321 trustworthy digital repository for, 339
Long-term program issues: IG as ongoing, long-term program, 7,
11, 27, 61–62 IG policies addressing, 85–86, 326,
327, 337, 338 long-term digital preservation as, 26,
32, 59, 64–65, 85–86, 177, 182, 317–346
principles of IG including, 26, 32 standards on, 85–86, 318, 321–333,
334, 335–336 strategic plan addressing, 59, 61–62,
64–65, 325, 337
Mah, Paul, 242 Maintenance of IG program, 349–353 Management support. See Executive
sponsorship Managing Electronic Records: Methods,
Best Practices and Technologies (Smallwood), 81
434 INDEX
Man-in-the-middle attacks, 279, 280 Manning, Bradley, 258 Masking technology, 203 Master data management, 194 Master Data Management (MDM)
Institute, 189 McKinsey, 100, 105, 107 Metadata:
best practices for, 64 core issues with, 363–364 defi nition of, 357, 358, 361 digital signatures in, 220 Dublin Core Metadata Initiative on,
85, 365–366 Global Information Locator Service
on, 366–367 information organization and
classifi cation using, 26, 357, 358, 359–368, 370, 375, 381
long-term digital preservation of, 318, 328–329, 340, 343
records and information management use of, 265, 361–368, 370, 375, 381
security issues related to, 220 social media, 265 standards on, 82, 84–85, 328–329,
340, 360–362, 364–368 taxonomy relationship to, 357, 358,
359–360, 367–368, 370, 375, 381 (see also(( Taxonomy/common terminology)
text mining of, 367–368 training and communication in use of,
363–364 types of, 362–363
MI6, 10 Microsoft:
Active Direction, 226 instant messaging system, 247 Offi ce (Word, Excel, PowerPoint),
215, 216, 232, 261, 329 Offi ce Communications Server, 247 Outlook TwInbox, 261 SharePoint, 160, 232, 303–314 Visio®, 377 Wave audio format, 333 Windows OS, 272
MIKE2.0, 62 Mobile devices:
3G and 4G interoperability of, 273 anti-virus security measures for,
274, 278 authentication methods for, 277, 280 best practices for, 280–281 biometric authentication used with, 277 bring-your-own-device (BYOD)
approach to, 275, 281–282, 298, 303 cloud computing via, 298 confi dential information removal
from, 274–275 costs associated with, 281–282 e-commerce via, 277–280 encryption on, 276, 277, 281 GPS for, 273 hacking protection for, 276 IG for, 9, 11, 271–283 IG policies for, 276, 281–282 innovation vs. security for, 279–280 IT trend analysis of, 59 legal issues related to, 282 long-term evolution of, 273 mobile application security for,
277–280 mobile device management of, 273,
275–276 number of users, 271, 272 overview of, 271–273 password protection for, 276, 277 push-button applications for, 274 records and information management
for, 151, 160, 164 security issues with, 213, 220, 225,
230, 271–283 SharePoint supporting, 303 smartphone applications for, 273 software updates for, 276 solid state drives for, 274 supplemental broadband for, 274 timeout function for, 276, 277 training and communication related
to, 282 trends in mobile computing, 273–274 Virtual Private Network hardware and
software for, 273 WiMax networks for, 273
INDEX 435
MobileIron, 275 Model Requirements for Management
of Electronic Records (MoReq2010), 80, 82–83
Monitoring: cloud computing, 295, 296 database activity monitoring
as, 203 data governance plan, 192 IG policies, 89–90 instant messaging, 249 maintenance of IG program
including, 349–350 principles of IG including, 26, 32 records and information management
including, 150, 169 security functions including, 202–203,
209, 249, 295, 296 Montague Institute, 357 Motorola, 9 MPEG-2 (motion picture expert group)
standard, 333 MSN instant messaging system, 249
National Archives and Records Administration, 45, 76, 81, 139–140, 141, 154, 172–173, 178, 254, 299, 321, 386–387
Offi ce of the Federal Register, 45, 139–140, 178
National Association of Securities Dealers (NASD), 223
National Institute of Standards and Technology (NIST), 76, 286–287, 296
National Labor Relations Board, 263 National Security Agency, U. S., 8–9,
208, 241–242, 291 Nerney, Chris, 258
Offi ce of Management and Budget, 296 Offi ce of the Federal Register, 45,
139–140, 178 Open archival information system
(OAIS), 85–86, 321–323 Organizational culture. See Corporate
culture Osterman Research, 126, 176, 177
Pace, Nicholas M., 99 PageFreezer, 261, 262 Passwords, computer, 215, 276,
277, 295 PATRIOT Act, 386 Payment Card Industry
Data Security Standard (PCI-DSS), 227
PDF995, 262 PDF/A format, 85, 331, 343 PDFCreate, 262 Peck, Andrew, 135 Pew Research Center, 101 Phishing, 202, 279, 293, 295 Picasa, 261 PNG (portable network graphics)
format, 332 Policies. See Information governance
policies Political environment, 60. See also
Laws and regulations; specifi c governments by country name
Ponemon Institute, 207, 220 Portable storage devices. See Removable
media Predictive coding, 58, 127–128 PREMIS preservation metadata
standard, 328–329, 340 PrimoPDF, 262 Principles of information governance:
accountability as, 27, 28, 30, 35, 36 continuous improvement as, 27,
34–35, 36–37 executive sponsorship
as, 25, 28, 30 Generally Accepted Recordkeeping
Principles® as, 27–35, 36–37 information accessibility as, 26,
28, 32, 35, 37 information control as, 26 information governance monitoring
and auditing as, 26, 30, 32 information integrity as, 25, 28, 31,
35, 36 information organization and
classifi cation as, 25–26 information policy development and
communication as, 25
436 INDEX
Principles of information (continued ) information security as, 26, 28, 32,
35, 36 overview of, 25–27 stakeholder consultation as, 26–27 team/governance body for
implementing, 35, 38 Privacy protection:
best practices for, 63 failures of, 10 IG policies addressing, 72, 264 instant messaging policy on, 248 legal requirements for, 43–44,
63, 169, 210–211, 297, 385, 392, 397–400
perimeter security limitations impacting, 211
personally identifi able information (PII) in, 26, 43–44, 210, 297, 385
principles of IG including, 26 redaction as, 210–211 risk management consideration of,
43–44, 63 security function of, 9, 10, 26, 43–44,
63, 72, 169, 207, 210–211, 248, 264, 297, 385, 392, 397–400
social media, 264 strategic planning consideration of, 63
PRONON program, 330
Quest Software, 248
Records and information management: accountability for, 28, 30, 35, 36, 53,
133, 309, 311–312 adoption and compliance with,
168–169 assessment and improvement roadmap
for, 34–35, 36–37 audit process for, 30, 32, 150, 183 availability of records through, 28, 32,
35, 37, 151, 309 benefi ts of, 152–153 best practices for, 61, 62 business considerations related to,
110, 149–150, 153, 303–304, 307–309
challenges of, 150–151, 304–306
cloud computing issues with, 297, 299–300
communication related to, 31, 158, 169, 313–314
costs of, 151, 152 defi nition of, 147 delivery platforms impacting, 151,
159, 160, 164, 232, 264–267, 297, 299–300, 303–314
disposition requirements in, 28, 33–34, 35, 37, 130–137, 150, 151, 170, 177–178, 179–183, 297, 299–300 (see also(( Disposition of information)
enterprise content management relationship to, 149
executive sponsorship of, 28, 30, 157, 159, 169, 182, 306, 388
Federal Rules of Civil Procedure impacting, 150, 265, 303
Generally Accepted Recordkeeping Principles® for, 27–35, 36–37, 53, 71, 74, 155, 171
IG policy relationship to, 71, 74, 79– 86, 92–93, 150–151, 310–311
integrity of, 28, 31, 35, 36, 340, 343, 389
inventory of records in, 154–168, 173, 202, 339 (see also(( Inventory of records)
IT relationship to, 151, 160, 164, 176 legal and policy compliance through,
28, 32, 33, 35, 36–37, 130–142, 149–150, 150–151, 156, 169, 176–179, 303, 307, 385–395
long-term (see(( Long-term program issues)
maturity levels/model of, 29, 34, 36–37, 62, 334–341
metadata in, 265, 361–368, 370, 375, 381
monitoring of, 150, 169 overview of, 147–149 protection or security of records in,
28, 32, 35, 36, 151, 202, 215, 232, 297 (see also(( Security functions)
records groupings rationale in, 174, 368
INDEX 437
records series identifi cation and classifi cation in, 174–175
retention requirements in, 28, 32–33, 35, 37, 85–86, 137–142, 150, 151, 154, 167–168, 169–183, 264–267, 297, 299–300, 368, 369 (see also(( Retention of information)
risk management through, 158 SharePoint for, 160, 232, 303–314 social media-specifi c, 151, 264–267 standards on, 79–86, 92–93, 141, 147,
155, 179, 364–365, 369, 387–389 taxonomies in, 134, 355–360, 367–381 training in, 31, 169, 313 transparency of, 28, 31, 35, 36 user assistance and compliance with,
151, 164–167, 307 Redaction, 210–211 Reference data management, 196 Regulations. See Laws and regulations Removable media, 159, 164, 223, 277 Research Library Group, 328 Retention of information:
auditing of, 183 best practices for, 62–63, 64–65 classifi cation of records for, 173–175 cloud computing, specifi cally, 297,
299–300 cost of, 4–5, 99, 104, 131 destructive, 64, 126, 177–178, 246–
247 disposition vs. (see(( Disposition of
information) e-mail, specifi cally, 64, 126, 175–178,
243–247 event-based impact on, 179–181 Generally Accepted Recordkeeping
Principles® for, 28, 32–33, 35, 37, 171
IG policies on, 46, 75–76, 85–86, 121–122
implementation of retention schedule, 182–183
information control through, 26 instant messages, specifi cally, 248–249 inventory of records detailing, 154,
173, 339 legal requirements for, 4, 26, 33, 43–
44, 62–63, 122–126, 137–142, 169, 177–179, 243–244
long-term digital preservation for, 26, 32, 59, 64–65, 85–86, 177, 182, 317–346
need for retention schedules, 171–173 ongoing maintenance of retention
schedule for, 183 principles of retention scheduling,
169–170 records and information management
addressing, 28, 32–33, 35, 37, 85–86, 137–142, 150, 151, 154, 167–168, 169–183, 264–267, 297, 299–300, 368, 369
records groupings rationale related to, 174, 368
records retention citation services on, 44, 138, 139, 178–179
records series identifi cation and classifi cation for, 174–175
records value appraisal for, 167–168 retention period/duration/schedule of,
33, 46, 63, 126, 137–138, 140–142, 154, 169–183, 266, 339, 368, 369
risk management consideration of, 43–44, 46, 63, 100
social media, specifi cally, 261–262, 263, 264–267
steps for retention schedule development, 171–173
strategic planning consideration of, 59, 62–63, 64–65
technologies assisting with, 183 transitory record retention as, 182
Reuters Messaging, 247 Risk management:
best practices for, 62–63 corporate culture on risk tolerance in,
58 data governance role in, 192, 193 delivery platform impacting, 242–243,
257–260 heat maps in, 47 IG policy relationship to, 46, 62–63,
75, 77 IG role in, 8, 43–51 inventory of records for, 158
438 INDEX
Risk management (continued ) IT functions role in, 192, 193, 198 legal and policy research and
compliance in, 43–46, 62–63, 123 long-term digital preservation
consideration of, 327 metrics and results measurements in,
50, 63 privacy issues addressed through,
43–44, 63 retention of information addressed
through, 43–44, 46, 63, 100 risk analysis and assessment in, 48–49,
192 risk maps in, 47 risk mitigation plan auditing in, 51, 63 risk mitigation plan development in,
49, 63 risk mitigation plan execution in, 50 risk profi le creation in, 46–48, 63 security issues addressed through,
43–44, 213, 327 standards on, 46, 77 strategic planning consideration of,
58, 62–63 top-10 lists in, 47
Rutkowska, Joanna, 295
Safety Deposit Box, 344 SAP Afaria MDM, 275 Sarbanes-Oxley Act of 2002 (SOX), 149,
223, 245, 386 Securities and Exchange Commission,
Rule 17A-4, 386 Security functions:
accessibility balanced with, 26, 32, 151, 203, 212–213, 215–216, 224
anti-virus security measures as, 274, 278
application programming interface as, 293–294
auditing as, 26, 203, 211, 213, 225, 291
best practices of, 62, 63, 202–203 biometric authentication technologies
as, 272, 277 blueprint and CAD document
protection as, 228–229
business considerations related to, 111 challenges of, 213–215 costs of security breaches, 207, 220–
221, 227, 271 cyberattack proliferation
necessitating, 207–208 data loss prevention technology as,
220–222, 227–228, 231, 291, 292 defense in depth as, 212 deletion of fi les as, 215 delivery platforms impacting, 213,
217–218, 220, 223–224, 225, 226–227, 230, 233–234, 241–251, 256–268, 271–283, 285–286, 290– 298, 303–314
device control methods as, 227 digital signatures as, 218–219, 220 document analytics as, 232–233 document labeling as, 231–232 document life cycle security
technologies as, 291, 292 embedded protection as, 226–227, 231 employee information misuse
necessitating, 8–10, 26, 208–210, 228, 229, 242–243, 258–259, 291– 292, 320–321
encryption as, 26, 164, 203, 217, 219– 220, 225, 226–227, 228, 276, 277, 281, 291, 294
external access blockage as, 215–216 hybrid approach to, 227 identity access management as, 212–
213, 272 IG addressing, 8–10, 26, 207–236 IG enabling or maturity impacting,
111 IG policy relationship to, 72, 78–79,
213, 214, 221, 222, 224, 233–234, 291, 293, 297–298
information rights management software as, 9, 26, 62, 164, 210, 222–226, 227–228, 229, 291, 292
innovation balanced with, 279–280 internal price list protection as,
229–230 IT functions as, 202–203 legal requirements for, 43–44, 223,
227, 296
INDEX 439
long-term digital preservation security issues, 32, 320–321, 325, 327, 340, 343
masking technology for, 203 monitoring as, 202–203, 209, 249,
295, 296 outside the organization security
approaches as, 230–231 password protection as, 215, 276, 277,
295 perimeter security limitations
impacting, 211, 214 persistent, 222–226, 228–229 (see also((
Information rights management (IRM) software)
principles of IG including, 26, 28, 32, 35, 36
print fi le security as, 216–217 privacy protection as, 9, 10, 26, 43–44,
63, 72, 169, 207, 210–211, 248, 264, 297, 385, 392, 397–400
protected data as, 231 protected process as, 230 records and information management
protection as, 28, 32, 35, 36, 151, 202, 215, 232, 297
redaction as, 210–211 repository-based approach to, 214–
215 risk management consideration of,
43–44, 213, 327 secure printing as, 216, 230 standards on, 78–79, 210 strategic plan consideration of, 62, 63 stream messaging as, 217–218, 233–
234, 236 technologies improving, 215–217 thin clients as, 227, 230 thin devices as, 230 timeout function as, 276, 277 trade secret protection as, 228, 260 training in, 209, 228, 233–234, 236 zero trust model of, 230–231
Security Technical Implementation Guides (STIGs), 202
SharePoint: accountability/responsibility for, 309,
311–312
business objectives of, 303–304, 307–309
challenges of implementing, 304–306 communication related to, 313–314 corporate culture changes necessitated
by, 304–305 guiding principles for, 308–309 IG policy relationship to, 310–311 legal and policy compliance through,
303, 307 overview of, 303–304 planning process for use of, 306–310 process established for use of, 312 records and information management
including, 160, 232, 303–314 scope of deployment of, 309–310 training in, 313
Signatures, digital, 218–219, 220 Singapore:
privacy laws in, 399 Standards Singapore in, 87
SkyDrive, 289 Snapchat, 255 Snowden, Edward, 9, 208, 241–242 SocialFolders, 261 Social media:
accountability for, 267 best practices for, 64, 262, 267–268 as business records, 260, 265–266 categories of, 254–256 content control models for, 267–268 disposition and retention of, 261–262,
263, 264–267 e-mail and instant messaging
distinction from, 257 employee misuse of, 258–259 enterprise use of, 256 IG policies on, 76, 257, 258, 259–260,
262–264, 267 IT trend analysis of, 59 legal issues related to, 259–260, 264–267 privacy expectations for, 264 records and information management
for, 151, 264–267 risk management issues with, 257–260 security issues with, 213, 256–268 training in, 258, 268 types of, 253–256
440 INDEX
SocialSafe, 261, 262 Social tagging, 356, 381 Sorensen, Alan, 108 Space Data Information Transfer
System-Open Archival Information System (OAIS) Reference Model, 321–323
Spear phishing, 202 Sprint, 273, 274 SQL injections, 202 Staff. See Employees/staff Standards. See also Laws and regulations
American National Standards Institute (ANSI), 76, 87, 155, 371
benefi ts and risks of, 76–77 best practices for usage of, 64 British Standards Institute (BSI), 76,
371 on business continuity management,
86–87 de jure vs. de facto, 76 Dublin Core Metadata Initiative
standards, 85, 365–366 Global Information Locator Service
standard, 366–367 IG policies impacted by, 76–88, 92–93 International Organization for
Standardization (ISO), 18, 19–20, 46, 64, 76, 77–81, 84, 85–87, 111, 141, 147, 155, 198, 200–201, 210, 318, 321, 324–327, 331, 332–333, 334, 335–336, 364–366, 369, 371
on IT governance, 19–20, 79, 111, 198, 200–201
on long-term digital preservation, 85– 86, 318, 321–333, 334, 335–336
major national and regional, 81–87 (see also under specifi c countries)
on metadata, 82, 84–85, 328–329, 340, 360–362, 364–368
National Institute of Standards and Technology (NIST), 76, 286–287, 296
open standard technology-neutral, 321, 324, 329–333, 338, 342, 343
PREMIS preservation metadata standard, 328–329, 340
on records and information
management, 79–86, 92–93, 141, 147, 155, 179, 364–365, 369, 387–389
on risk management, 46, 77 on security functions, 78–79, 210 Space Data Information Transfer
System-Open Archival Information System (OAIS) Reference Model, 321–323
Standards Australia, 76, 84, 87 Standards Council of Canada, 76, 92,
394 Standards Singapore, 87 on thesauri, 371 U.S. Department of Defense, 76, 80,
81–82, 179 Storage of information. See Retention
of information Stored Communications and
Transactional Records Act (SCTRA), 210
Strategic planning: accountability for, 53–54 budgets/fi nancial considerations in,
53, 54, 59–60 business conditions and economic
environment survey in, 59–60 communication of, 55 corporate culture consideration in, 58 disposition consideration in, 62,
63–64 execution of, 67 executive sponsorship of, 53–55, 63, 65 external factors survey and evaluation
in, 58–65 IG team building and responsibilities
in, 55, 56–57, 62 industry best practices analysis in,
61–65 IT trend analysis in, 59 legal issues consideration in, 56–57,
60, 62–63, 123 long-term program issues in, 59,
61–62, 64–65, 325, 337 metadata and taxonomy consideration
in, 64 organizational and IG strategic plan
alignment, 57–58
INDEX 441
overview of, 53–54 project manager role in, 54–55, 56 retention of information
consideration in, 59, 62–63, 64–65
risk management consideration in, 58, 62–63
security function consideration in, 62, 63
strategic plan formulation, 65–67 Stream messaging, 217–218,
233–234, 236 SVG (scalable vector graphics)
format, 332 Symantec Mobile Management
Suite, 275
Taxonomy/common terminology: auto-classifi cation for, 356 auto-generated, 370–371 best practices for, 64, 190 business classifi cation scheme or fi le
plan using, 368–369 business process analysis for
development of, 377–379 business-unit, 372, 374 defi nition of, 355 disposition of information use of, 134 faceted, 376 folksonomies as, 381 functional, 372–375 hybrid, 376 information organization and
classifi cation using, 26, 355–360, 367–381
maintenance of, 380–381 metadata relationship to, 357, 358,
359–360, 367–368, 370, 375, 381 (see also(( Metadata)
navigation using, 357 need for new, 358 prebuilt vs. custom, 370–371 records and information management
use of, 134, 355–360, 367–381 search results improvement through,
358–359, 367–368 security functions use of, 231 social tagging for, 356, 381
subject, 371–372, 373 successful IG program including, 21 testing of, 379–380 text mining for, 356, 367–368 thesaurus for, 360, 371, 372 types of, 371–376
Technology-assisted review (TAR), 128–130, 135
Tessella Technology & Consulting, 344 Texas Children’s Hospital, 10 Text mining, 356, 367–368 Thesauri, 360, 371, 372 Thin clients, 227, 230 Thin devices, 230 Thumb drives. See Removable media TIFF (tagged image fi le format), 331–
332 Trade secret protection, 228, 260. See
also Intellectual property, security of
Training: in business and fi nancial cost
considerations, 108 in data governance, 17, 192 in IG policies, 35, 89, 282 of IG team/governance body, 35 in inventorying records, 157 in metadata, 363 in mobile device policies, 282 in records and information
management, 31, 169, 313 in security related to IG, 209, 228,
233–234, 236 in SharePoint, 313 in social media, 258, 268
TweetTake, 261 TwInbox, 261 Twitter, 254, 255, 256, 257, 258, 259–
260, 261
United Kingdom: British Standards Institute (BSI) in,
76, 371 BS 8723 thesauri standard in, 371 BS 15000 IT governance standard in,
200 BS 25999-2 business continuity
standard in, 87
442 INDEX
United Kingdom (continued ) Digital Systems Knowledge Transfer
Network in, 271 Freedom of Information Act 2000 in,
46, 169, 210 ITIL developed in, 19, 200 MI6 in, 10 Model Requirements for Management
of Electronic Records (MoReq2010) in, 80, 82–83
National Archives of, 330 National Health Service in, 10 privacy laws in, 210, 400 records and information management
regulations and standards in, 80, 82–83, 150, 303, 389–391
standards in, 76, 83–84, 87, 200, 371 United Nations, 207–208 United States:
Code of Federal Regulations of, 44– 45, 138–140, 178, 386, 387
Customs and Border Protection of, 223
cyberattacks on/by government of, 207, 208
Department of Defense of, 76, 80, 81–82, 179
Environmental Protection Agency of, 101, 153
Food and Drug Administration of, 386
General Accounting Offi ce of, 173 Government Printing Offi ce of, 45,
139, 178 Homeland Security of, 223 House of Representatives Oversight
and Government Reform Committee of, 244
information governance in (see(( Information governance)
Internal Revenue Agency of, 296 laws and regulations of (see(( Laws and
regulations) Library of Congress of, 328, 330, 361,
366, 371–372 National Archives and Records
Administration of, 45, 76, 81, 139–140, 141, 154, 172–173, 178, 254, 299, 321, 386–387
National Security Agency of, 8–9, 208, 241–242, 291
Offi ce of Management and Budget of, 296
Offi ce of the Federal Register of, 45, 139–140, 178
political environment in, 60 Securities and Exchange Commission
of, 386 U.S. Protection Profi le for
Authorization Server for Basic Robustness Environments in, 213
ValiT®, 18, 198, 199–200 Verizon, 274 ViaLumina, 105 Vine, 255–256 Virtual Private Network (VPN), 273,
286
W3C Internet Engineering Task Force, 332
Wayback Machine, 261, 262 Web 2.0, 253–254 WebARChive (WARC), 333 WikiLeaks, 214, 220, 258 WiMax (Worldwide Interoperability for
Microwave Access) networks, 273 World Economic Forum, 3
XML (extensible markup language), 329, 331
Yahoo! instant messaging system, 247, 249
Zakaras, Laura, 99 Zornes, Aaron, 189 Zubulake v. UBS Warburg, 119
- INFORMATION GOVERNANCE
- CONTENTS
- PREFACE
- ACKNOWLEDGMENTS
- PART ONE—Information Governance Concepts, Definitions, and Principles
- CHAPTER 1 The Onslaught of Big Data and the Information Governance Imperative
- Defining Information Governance
- IG Is Not a Project, But an Ongoing Program
- Why IG Is Good Business
- Failures in Information Governance
- Form IG Policies, Then Apply Technology for Enforcement
- Notes
- CHAPTER 2 Information Governance, IT Governance, Data Governance: What’s the Difference?
- Data Governance
- Data Governance Strategy Tips
- IT Governance
- IT Governance Frameworks
- Information Governance
- Impact of a Successful IG Program
- Summing Up the Differences
- Notes
- CHAPTER 3 Information Governance Principles
- Accountability Is Key
- Generally Accepted Recordkeeping Principles®
- The Principles
- Assessment and Improvement Roadmap
- Who Should Determine IG Policies?
- Notes
- PART TWO—Information Governance Risk Assessment and Strategic Planning
- CHAPTER 4 Information Risk Planning and Management
- Step 1: Survey and Determine Legal and Regulatory Applicability and Requirements
- Step 2: Specify IG Requirements to Achieve Compliance
- Step 3: Create a Risk Profile
- Step 4: Perform Risk Analysis and Assessment
- Step 5: Develop an Information Risk Mitigation Plan
- Step 6: Develop Metrics and Measure Results
- Step 7: Execute Your Risk Mitigation Plan
- Step 8: Audit the Information Risk Mitigation Program
- Notes
- CHAPTER 5 Strategic Planning and Best Practices for Information Governance
- Crucial Executive Sponsor Role
- Evolving Role of the Executive Sponsor
- Building Your IG Team
- Assigning IG Team Roles and Responsibilities
- Align Your IG Plan with Organizational Strategic Plans
- Survey and Evaluate External Factors
- Analyze IT Trends
- Survey Business Conditions and the Economic Environment
- Analyze Relevant Legal, Regulatory, and Political Factors
- Survey and Determine Industry Best Practices
- Formulating the IG Strategic Plan
- Synthesize Gathered Information and Fuse It into IG Strategy
- Develop Actionable Plans to Support Organizational Goals and Objectives
- Create New IG Driving Programs to Support Business Goals and Objectives
- Draft the IG Strategic Plan and Gain Input from a Broader Group of Stakeholders
- Get Buy-in and Sign-off and Execute the Plan
- Notes
- CHAPTER 6 Information Governance Policy Development
- A Brief Review of Generally Accepted Recordkeeping Principles®
- IG Reference Model
- Interpreting the IGRM Diagram
- Center
- How the IGRM Complements the Generally Accepted Recordkeeping Principles
- Best Practices Considerations
- Standards Considerations
- Benefits and Risks of Standards
- Key Standards Relevant to IG Efforts
- Risk Management
- Information Security and Governance
- Records and E-Records Management
- Major National and Regional ERM Standards
- United States E-Records Standard
- Canadian Standards and Legal Considerations for Electronic Records Management
- U.K. and European Standards
- Australian ERM and Records Management Standards
- Long-Term Digital Preservation
- Business Continuity Management
- Making Your Best Practices and Standards Selections to Inform Your IG Framework
- Roles and Responsibilities
- Program Communications and Training
- Program Controls, Monitoring, Auditing and Enforcement
- Notes
- PART THREE—Information Governance Key Impact Areas Based on the IG Reference Model
- CHAPTER 7 Business Considerations for a Successful IG Program
- Changing Information Environment
- Calculating Information Costs
- Big Data Opportunities and Challenges
- Full Cost Accounting for Information
- Calculating the Cost of Owning Unstructured Information
- Sources of Cost
- The Path to Information Value
- Challenging the Culture
- New Information Models
- Information Calorie
- Information Cap-and-Trade
- Future State: What Will the IG-Enabled Organization Look Like?
- Moving Forward
- Notes
- CHAPTER 8 Information Governance and Legal Functions
- Introduction to e-Discovery: The Revised 2006 Federal Rules of Civil Procedure Changed Everything
- Big Data Impact
- More Details on the Revised FRCP Rules
- Landmark E-Discovery Case: Zubulake v. UBS Warburg
- E-Discovery Techniques
- E-Discovery Reference Model
- The Intersection of IG and E-Discovery
- Legal Hold Process
- How to Kick-Start Legal Hold Notification
- IG and E-Discovery Readiness
- Building on Legal Hold Programs to Launch Defensible Disposition
- Destructive Retention of E-mail
- Newer Technologies That Can Assist in E-Discovery
- Predictive Coding
- Technology-Assisted Review
- Defensible Disposal: The Only Real Way To Manage Terabytes and Petabytes
- Growth of Information
- Volumes Now Impact Effectiveness
- How Did This Happen?
- What Is Defensible Disposition, and How Will It Help?
- New Technologies—New Information Custodians
- Why Users Cannot, Will Not—and Should Not—Make the Hard Choices
- Technology Is Essential to Manage Digital Records Properly
- Auto-Classification and Analytics Technologies
- Can Technology Classify Information?
- Moving Ahead by Cleaning Up the Past
- Defensibility Is the Desired End State; Perfection Is Not
- Business Case around Defensible Disposition
- Defensible Disposition Summary
- Retention Policies and Schedules
- Meeting Legal Limitation Periods
- Legal Requirements and Compliance Research
- What Is a Records Retention Schedule?
- Benefits of a Retention Schedule
- Notes
- CHAPTER 9 Information Governance and Records and Information Management Functions
- Records Management Business Rationale
- Why Is Records Management So Challenging?
- Benefits of Electronic Records Management
- Additional Intangible Benefits
- Inventorying E-Records
- Generally Accepted Recordkeeping Principles®
- E-Records Inventory Challenges
- Records Inventory Purposes
- Records Inventorying Steps
- Goals of the Inventory Project
- Scoping the Inventory
- Management Support: Executive Sponsor
- Information/Elements for Collection
- Creating a Records Inventory Survey Form
- Who Should Conduct the Inventory?
- Determine Where Records Are Located
- Conduct the Inventory
- Analyze and Verify the Results
- Ensuring Adoption and Compliance of RM Policy
- General Principles of a Retention Scheduling
- Developing a Records Retention Schedule
- Why Are Retention Schedules Needed?
- Information Included on Retention Schedules
- Steps in Developing a Records Retention Schedule
- What Records Do You Have to Schedule? Inventory and Classification
- Rationale for Records Groupings
- Records Series Identification and classification
- Retention of E-Mail Records
- How Long Should You Keep Old E-Mails?
- Destructive Retention of E-Mail
- Long-Term Archival Records
- Meeting Legal Limitation Periods
- Legal Requirements and Compliance Research
- Event-Based Retention Scheduling for Disposition of E-Records
- Prerequisites for Event-Based Disposition
- Final Disposition and Closure Criteria
- Retention Periods: Online versus Offl ine
- Closure Dates
- Retaining Records Indefinitely
- Retaining Transitory Records
- Implementation of the Retention Schedule and Disposal of Records
- Getting Acceptance and Formal Sign-off of the Retention Schedule
- Disposition Timing: Records Disposal
- Automating Retention/Disposal Actions
- Disposal Date Changes
- Proving Record Destruction
- Ongoing Maintenance of the Retention Schedule
- Audit to Manage Compliance with the Retention Schedule
- Notes
- CHAPTER 10 Information Governance and Information Technology Functions
- Data Governance
- Steps to Governing Data Effectively
- Data Governance Framework
- Information Management
- IT Governance
- IT Governance Frameworks
- CobiT®
- COBIT 5
- ValIT®
- ValIT Integrated with CobiT 5
- ITIL
- ISO 38500
- IG Best Practices for Database Security and Compliance
- Tying It All Together
- Notes
- CHAPTER 11 Information Governance and Privacy and Security Functions
- Cyberattacks Proliferate
- Insider Threat: Malicious or Not
- Countering the Insider Threat
- Malicious Insider
- Nonmalicious Insider
- Solution
- Privacy Laws
- Redaction
- Limitations of Perimeter Security
- Defense in Depth
- Controlling Access Using Identity Access Management
- Enforcing IG: Protect Files with Rules and Permissions
- Challenge of Securing Confidential E-Documents
- Protecting Confidential E-Documents: Limitations of Repository-Based Approaches
- Apply Better Technology for Better Enforcement in the Extended Enterprise
- Protecting E-Documents in the Extended Enterprise
- Basic Security for the Microsoft Windows Office Desktop
- Where Do Deleted Files Go?
- Lock Down: Stop All External Access to Confidential E-Documents
- Secure Printing
- Serious Security Issues with Large Print Files of Confidential Data
- E-Mail Encryption
- Secure Communications Using Record-Free E-Mail
- Digital Signatures
- Document Encryption
- Data Loss Prevention (DLP) Technology
- Promise of DLP
- What DLP Does Well (and Not So Well)
- Basic DLP Methods
- Data Loss Prevention: Limitations
- Missing Piece: Information Rights Management (IRM)
- Key IRM Characteristics
- Other Key Characteristics of IRM
- Embedded Protection
- Is Encryption Enough?
- Device Control Methods
- Thin Clients
- Note about Database Security
- Compliance Aspect
- Hybrid Approach: Combining DLP and IRM Technologies
- Securing Trade Secrets after Layoffs and Terminations
- Persistently Protecting Blueprints and CAD Documents
- Securing Internal Price Lists
- Approaches for Securing Data Once It Leaves the Organization
- Document Labeling
- Document Analytics
- Confidential Stream Messaging
- Notes
- PART FOUR—Information Governance for Delivery Platforms
- CHAPTER 12 Information Governance for E-Mail and Instant Messaging
- Employees Regularly Expose Organizations to E-Mail Risk
- E-Mail Polices Should Be Realistic and Technology Agnostic
- E-Record Retention: Fundamentally a Legal Issue
- Preserve E-Mail Integrity and Admissibility with Automatic Archiving
- E-Mail Archiving Rationale: Compliance, Legal, and Business Reasons
- Don’t Confuse E-Mail Archiving with Backup
- No Personal Archiving in the Workplace
- Are All E-Mails Records?
- Destructive Retention of E-Mail
- Instant Messaging
- Best Practices for Business IM Use
- Technology to Monitor IM
- Tips for Safer IM
- Notes
- CHAPTER 13 Information Governance for Social Media
- Types of Social Media in Web 2.0
- Additional Social Media Categories
- Social Media in the Enterprise
- Key Ways Social Media Is Different from E-Mail and Instant Messaging
- Biggest Risks of Social Media
- Legal Risks of Social Media Posts
- Tools to Archive Social Media
- Public Social Media Solutions
- Government and Industry Solutions
- IG Considerations for Social Media
- Key Social Media Policy Guidelines
- Records Management and Litigation Considerations for Social Media
- Records Retention Guidelines
- Content Control Models
- Emerging Best Practices for Managing Social Media Records
- Notes
- CHAPTER 14 Information Governance for Mobile Devices
- Current Trends in Mobile Computing
- Security Risks of Mobile Computing
- Securing Mobile Data
- Mobile Device Management
- Trends in MDM
- IG for Mobile Computing
- Building Security into Mobile Applications
- Real Threats Are Poorly Understood
- Innovation versus Security: Choices and Trade-offs
- Best Practices to Secure Mobile Applications
- Developing Mobile Device Policies
- Notes
- CHAPTER 15 Information Governance for Cloud Computing
- Defining Cloud Computing
- Key Characteristics of Cloud Computing
- What Cloud Computing Really Means
- Cloud Deployment Models
- Security Threats with Cloud Computing
- Information Loss
- Information Breaches
- The Enemy Within: Insider Threats
- Hacking and Rogue Intrusions
- Insecure Points of Cloud Connection
- Issues with Multitenancy and Technology Sharing
- Hacking, Hijacking, and Unauthorized Access
- Who Are Your Neighbors?
- Additional IG Threats and Concerns
- Benefits of the Cloud
- Managing Documents and Records in the Cloud
- IG Guidelines for Cloud Computing Solutions
- Notes
- CHAPTER 16 SharePoint Information Governance
- Process Change, People Change
- Where to Begin the Planning Process
- Begin at a High Level
- Establish Scope
- Policy Considerations
- Roles and Responsibilities
- Establish Processes
- Training Plan
- Communication Plan
- Note
- PART FIVE—Long-Term Program Issues
- CHAPTER 17 Long-Term Digital Preservation
- Defining Long-Term Digital Preservation
- Key Factors in Long-Term Digital Preservation
- Threats to Preserving Records
- Digital Preservation Standards
- ISO TR 18492 (2005), Long-Term Preservation of Electronic Document-Based Information
- ISO 16363 (2012)—Space Data and Information Transfer Systems—Audit and Certification of Trustworthy Digital Repositories
- PREMIS Preservation Metadata Standard
- Recommended Open Standard Technology-Neutral Formats
- ISO 19005 (PDF/A)—Document Management—Electronic Document File Format for Long-Term Preservation (2005, 2011, and 2012)
- Extensible Markup Language (XML)—World Wide Web Consortium (W3C) Internet Engineering Group (1998)
- Tagged Image File Format (1992)
- ISO/IEC 15498:2003—Information Technology—Computer Graphics and Image Processing-Portable Network Graphics (PNG)—Functional Specifications
- Scalable Vector Graphics (SVG)—W3C Internet Engineering Task Force (2003)
- ISO/IEC 15444-1:2004—Joint Photographic Engineers Group (JPEG 2000)
- ISO/IEC 13818–3:2000—Motion Picture Expert Group (MPEG-2)
- European Broadcasting Tech 3285—Broadcast Wave Format (BWF) (2011)
- ISO 28500:2009—WebARChive (WARC)
- Digital Preservation Requirements
- Long-Term Digital Preservation Capability Maturity Model®
- Stage 5: Optimal Digital Preservation Capability
- Stage 4: Advanced Digital Preservation Capability
- Stage 3: Intermediate Digital Preservation Capability
- Stage 2: Minimal Digital Preservation Capability
- Stage 1: Nominal Digital Preservation Capability
- Scope of the Capability Maturity Model
- Digital Preservation Capability Performance Metrics
- Digital Preservation Strategies and Techniques
- Evolving Marketplace
- Looking Forward
- Notes
- CHAPTER 18 Maintaining an Information Governance Program and Culture of Compliance
- Monitoring and Accountability
- Staffing Continuity Plan
- Continuous Process Improvement
- Why Continuous Improvement Is Needed
- Notes
- APPENDIX A Information Organization and Classification: Taxonomies and Metadata
- Importance of Navigation and Classification
- When Is a New Taxonomy Needed?
- Taxonomies Improve Search Results
- Metadata and Taxonomy
- Metadata Governance, Standards, and Strategies
- Types of Metadata
- Core Metadata Issues
- International Metadata Standards and Guidance
- ISO 15489 Records Management Definitions and Relevance
- ISO Technical Specification 23081–1:2006 Information and Documentation—Records Management Processes—Metadata for Records—Part 1: Principles
- Dublin Core Metadata Initiative
- Global Information Locator Service
- Text Mining
- Records Grouping Rationale
- Business Classification Scheme, File Plans, and Taxonomy
- Classification and Taxonomy
- Prebuilt versus Custom Taxonomies
- Thesaurus Use in Taxonomies
- Taxonomy Types
- Business Process Analysis
- Taxonomy Testing: A Necessary Step
- Taxonomy Maintenance
- Social Tagging and Folksonomies
- Notes
- APPENDIX B Laws and Major Regulations Related to Records Management
- United States
- Gramm–Leach–Bliley Act
- Health Insurance Portability and Accountability Act of 1996
- USA-PATRIOT Act (Uniting and Strengthening America by Providing Appropriate Tools Required to Intercept and Obstruct Terrorism Act of 2001)
- Sarbanes–Oxley Act
- SEC Rule 17A-4
- Code of Federal Regulations Title 21, Part 11—Pharmaceuticals
- Code of Federal Regulations Title 47, Part 42—Telecommunications
- U.S. Federal Authority on Archives and Records: National Archives and Records Administration
- U.S. Code of Federal Regulations
- Canada
- United Kingdom
- Regulations and Legislation Impacting Records Retention
- Australia
- Archives Act
- Freedom of Information Act
- Australian Information Commissioner Act
- Privacy Act
- Evidence Act
- Electronic Transactions Act
- Financial Management and Accountability Act
- Crimes Act
- Identifying Records Management Requirements in Other Legislation
- Notes
- APPENDIX C Laws and Major Regulations Related to Privacy
- United States
- Major Privacy Laws Worldwide, by Country
- Notes
- GLOSSARY
- ABOUT THE AUTHOR
- ABOUT THE MAJOR CONTRIBUTORS
- INDEX