Information governance concepts strategies and best practices download

INFORMATION GOVERNANCE

Founded in 1807, John Wiley & Sons is the oldest independent publishing company in the United States. With offi ces in North America, Europe, Asia, and Australia, Wiley is globally committed to developing and marketing print and electronic products and services for our customers’ professional and personal knowledge and understanding.

The Wiley CIO series provides information, tools, and insights to IT executives and managers. The products in this series cover a wide range of topics that supply strategic and implementation guidance on the latest technology trends, leadership, and emerging best practices.

Titles in the Wiley CIO series include:

The Agile Architecture Revolution: How Cloud Computing, REST-Based SOA, and Mobile Computing Are Changing Enterprise IT by Jason BloombergT

Big Data, Big Analytics: Emerging Business Intelligence and Analytic Trends for Today’s Businesses by Michael Minelli, Michele Chambers, and Ambiga Dhiraj

The Chief Information Offi cer’s Body of Knowledge: People, Process, and Technology by Dean Lane

CIO Best Practices: Enabling Strategic Value with Information Technology (Second Edition) by Joe Stenzel, Randy Betancourt, Gary Cokins, Alyssa Farrell, Bill Flemming, Michael H. Hugos, Jonathan Hujsak, and Karl Schubert

The CIO Playbook: Strategies and Best Practices for IT Leaders to Deliver Value by Nicholas R. Colisto

Enterprise Performance Management Done Right: An Operating System for Your Organization by Ron Dimon

Executive’s Guide to Virtual Worlds: How Avatars Are Transforming Your Business and Your Brand by Lonnie Bensond

IT Leadership Manual: Roadmap to Becoming a Trusted Business Partner by Alan R. r Guibord

Managing Electronic Records: Methods, Best Practices, and Technologies by Robert F. s Smallwood

On Top of the Cloud: How CIOs Leverage New Technologies to Drive Change and Build Value Across the Enterprise by Hunter Muller

Straight to the Top: CIO Leadership in a Mobile, Social, and Cloud-based World (Second Edition) by Gregory S. Smith

Strategic IT: Best Practices for Managers and Executives by Arthur M. Langer ands Lyle Yorks

Transforming IT Culture: How to Use Social Intelligence, Human Factors, and Collaboration to Create an IT Department That Outperforms by Frank Wanders

Unleashing the Power of IT: Bringing People, Business, and Technology Together by Dan Roberts

The U.S. Technology Skills Gap: What Every Technology Executive Must Know to Save America’s Future by Gary J. Beach

Information Governance: Concepts, Strategies and Best Practices by Robert F. Smallwoods

Robert F. Smallwood

INFORMATION GOVERNANCE

CONCEPTS, STRATEGIES AND

BEST PRACTICES

Cover image: © iStockphoto / IgorZh Cover design: Wiley

Copyright © 2014 by Robert F. Smallwood. All rights reserved.

Chapter 7 © 2014 by Barclay Blair

Portions of Chapter 8 © 2014 by Randolph Kahn

Published by John Wiley & Sons, Inc., Hoboken, New Jersey. Published simultaneously in Canada.

No part of this publication may be reproduced, stored in a retrieval system, or transmitted in any form or by any means, electronic, mechanical, photocopying, recording, scanning, or otherwise, except as permitted under Section 107 or 108 of the 1976 United States Copyright Act, without either the prior written permission of the Publisher, or authorization through payment of the appropriate per-copy fee to the Copyright Clearance Center, Inc., 222 Rosewood Drive, Danvers, MA 01923, (978) 750-8400, fax (978) 646-8600, or on the Web at www.copyright.com. Requests to the Publisher for permission should be addressed to the Permissions Department, John Wiley & Sons, Inc., 111 River Street, Hoboken, NJ 07030, (201) 748-6011, fax (201) 748-6008, or online at http://www.wiley.com/go/permissions.

Limit of Liability/Disclaimer of Warranty: While the publisher and author have used their best efforts in preparing this book, they make no representations or warranties with respect to the accuracy or completeness of the contents of this book and specifi cally disclaim any implied warranties of merchantability or fi tness for a particular purpose. No warranty may be created or extended by sales representatives or written sales materials. The advice and strategies contained herein may not be suitable for your situation. You should consult with a professional where appropriate. Neither the publisher nor author shall be liable for any loss of profi t or any other commercial damages, including but not limited to special, incidental, consequential, or other damages.

For general information on our other products and services or for technical support, please contact our Customer Care Department within the United States at (800) 762-2974, outside the United States at (317) 572-3993 or fax (317) 572-4002.

Wiley publishes in a variety of print and electronic formats and by print-on-demand. Some material included with standard print versions of this book may not be included in e-books or in print-on-demand. If this book refers to media such as a CD or DVD that is not included in the version you purchased, you may download this material at http://booksupport.wiley.com. For more information about Wiley products, visit www.wiley.com.

Library of Congress Cataloging-in-Publication Data:

Smallwood, Robert F., 1959- Information governance : concepts, strategies, and best practices / Robert F. Smallwood. pages cm. — (Wiley CIO series)

ISBN 978-1-118-21830-3 (cloth); ISBN 978-1-118-41949-6 (ebk); ISBN 978-1-118-42101-7 (ebk) 1. Information technology—Management. 2. Management information systems. 3. Electronic

records—Management. I. Title. HD30.2.S617 2014 658.4’038—dc23

2013045072

Printed in the United States of America

10 9 8 7 6 5 4 3 2 1

http://www.copyright.com
http://www.wiley.com/go/permissions
http://booksupport.wiley.com
http://www.wiley.com
For my sons

and the next generation of tech-savvy managers

vii

CONTENTS

PREFACE xv

ACKNOWLEDGMENTS xvii

PA RT O N E — Information Governance Concepts, Defi nitions, and Principles 1p

C H A P T E R 1 The Onslaught of Big Data and the Information Governance Imperative 3

Defi ning Information Governance 5

IG Is Not a Project, But an Ongoing Program 7

Why IG Is Good Business 7

Failures in Information Governance 8

Form IG Policies, Then Apply Technology for Enforcement 10

Notes 12

C H A P T E R 2 Information Governance, IT Governance, Data Governance: What’s the Difference? 15

Data Governance 15

IT Governance 17

Information Governance 20

Impact of a Successful IG Program 20

Summing Up the Differences 21

Notes 22

C H A P T E R 3 Information Governance Principles 25

Accountability Is Key 27

Generally Accepted Recordkeeping Principles® 27 Contributed by Charmaine Brooks, CRM

Assessment and Improvement Roadmap 34

Who Should Determine IG Policies? 35

Notes 38

PA RT T W O — Information Governance Risk Assessment and Strategic Planning 41g g

C H A P T E R 4 Information Risk Planning and Management 43

Step 1: Survey and Determine Legal and Regulatory Applicability and Requirements 43

viii CONTENTS

Step 2: Specify IG Requirements to Achieve Compliance 46

Step 3: Create a Risk Profi le 46

Step 4: Perform Risk Analysis and Assessment 48

Step 5: Develop an Information Risk Mitigation Plan 49

Step 6: Develop Metrics and Measure Results 50

Step 7: Execute Your Risk Mitigation Plan 50

Step 8: Audit the Information Risk Mitigation Program 51

Notes 51

C H A P T E R 5 Strategic Planning and Best Practices for Information Governance 53

Crucial Executive Sponsor Role 54

Evolving Role of the Executive Sponsor 55

Building Your IG Team 56

Assigning IG Team Roles and Responsibilities 56

Align Your IG Plan with Organizational Strategic Plans 57

Survey and Evaluate External Factors 58

Formulating the IG Strategic Plan 65

Notes 69

C H A P T E R 6 Information Governance Policy Development 71

A Brief Review of Generally Accepted Recordkeeping Principles® 71

IG Reference Model 72

Best Practices Considerations 75

Standards Considerations 76

Benefi ts and Risks of Standards 76

Key Standards Relevant to IG Efforts 77

Major National and Regional ERM Standards 81

Making Your Best Practices and Standards Selections to Inform Your IG Framework 87

Roles and Responsibilities 88

Program Communications and Training 89

Program Controls, Monitoring, Auditing and Enforcement 89

Notes 91

PA RT T H R E E — Information Governance Key Impact Areas Based on the IG Reference Model 95p

C H A P T E R 7 Business Considerations for a Successful IG Program 97

By Barclay T. Blair

Changing Information Environment 97

CONTENTS ix

Calculating Information Costs 99

Big Data Opportunities and Challenges 100

Full Cost Accounting for Information 101

Calculating the Cost of Owning Unstructured Information 102

The Path to Information Value 105

Challenging the Culture 107

New Information Models 107

Future State: What Will the IG-Enabled Organization Look Like? 110

Moving Forward 111

Notes 113

C H A P T E R 8 Information Governance and Legal Functions 115

By Robert Smallwood with Randy Kahn, Esq., and Barry Murphy

Introduction to e-Discovery: The Revised 2006 Federal Rules of Civil Procedure Changed Everything 115

Big Data Impact 117

More Details on the Revised FRCP Rules 117

Landmark E-Discovery Case: Zubulake v. UBS Warburg 119

E-Discovery Techniques 119

E-Discovery Reference Model 119

The Intersection of IG and E-Discovery 122 By Barry Murphy

Building on Legal Hold Programs to Launch Defensible Disposition 125 By Barry Murphy

Destructive Retention of E-Mail 126

Newer Technologies That Can Assist in E-Discovery 126

Defensible Disposal: The Only Real Way To Manage Terabytes and Petabytes 130 By Randy Kahn, Esq.

Retention Policies and Schedules 137 By Robert Smallwood, edited by Paula Lederman, MLS

Notes 144

C H A P T E R 9 Information Governance and Records and Information Management Functions 147

Records Management Business Rationale 149

Why Is Records Management So Challenging? 150

Benefi ts of Electronic Records Management 152

Additional Intangible Benefi ts 153

Inventorying E-Records 154

Generally Accepted Recordkeeping Principles® 155

E-Records Inventory Challenges 155

x CONTENTS

Records Inventory Purposes 156

Records Inventorying Steps 157

Ensuring Adoption and Compliance of RM Policy 168

General Principles of a Retention Scheduling 169

Developing a Records Retention Schedule 170

Why Are Retention Schedules Needed? 171

What Records Do You Have to Schedule? Inventory and Classifi cation 173

Rationale for Records Groupings 174

Records Series Identifi cation and Classifi cation 174

Retention of E-Mail Records 175

How Long Should You Keep Old E-Mails? 176

Destructive Retention of E-Mail 177

Legal Requirements and Compliance Research 178

Event-Based Retention Scheduling for Disposition of E-Records 179

Prerequisites for Event-Based Disposition 180

Final Disposition and Closure Criteria 181

Retaining Transitory Records 182

Implementation of the Retention Schedule and Disposal of Records 182

Ongoing Maintenance of the Retention Schedule 183

Audit to Manage Compliance with the Retention Schedule 183

Notes 186

C H A P T E R 10 Information Governance and Information Technology Functions 189

Data Governance 191

Steps to Governing Data Effectively 192

Data Governance Framework 193

Information Management 194

IT Governance 196

IG Best Practices for Database Security and Compliance 202

Tying It All Together 204

Notes 205

C H A P T E R 11 Information Governance and Privacy and Security Functions 207

Cyberattacks Proliferate 207

Insider Threat: Malicious or Not 208

Privacy Laws 210

Defense in Depth 212

Controlling Access Using Identity Access Management 212

Enforcing IG: Protect Files with Rules and Permissions 213

CONTENTS xi

Challenge of Securing Confi dential E-Documents 213

Apply Better Technology for Better Enforcement in the Extended Enterprise 215

E-Mail Encryption 217

Secure Communications Using Record-Free E-Mail 217

Digital Signatures 218

Document Encryption 219

Data Loss Prevention (DLP) Technology 220

Missing Piece: Information Rights Management (IRM) 222

Embedded Protection 226

Hybrid Approach: Combining DLP and IRM Technologies 227

Securing Trade Secrets after Layoffs and Terminations 228

Persistently Protecting Blueprints and CAD Documents 228

Securing Internal Price Lists 229

Approaches for Securing Data Once It Leaves the Organization 230

Document Labeling 231

Document Analytics 232

Confi dential Stream Messaging 233

Notes 236

PA RT F O U R — Information Governance for Delivery Platforms 239y

C H A P T E R 12 Information Governance for E-Mail and Instant Messaging 241

Employees Regularly Expose Organizations to E-Mail Risk 242

E-Mail Polices Should Be Realistic and Technology Agnostic 243

E-Record Retention: Fundamentally a Legal Issue 243

Preserve E-Mail Integrity and Admissibility with Automatic Archiving 244

Instant Messaging 247

Best Practices for Business IM Use 247

Technology to Monitor IM 249

Tips for Safer IM 249

Notes 251

C H A P T E R 13 Information Governance for Social Media 253

By Patricia Franks, Ph.D, CRM, and Robert Smallwood

Types of Social Media in Web 2.0 253

Additional Social Media Categories 255

Social Media in the Enterprise 256

Key Ways Social Media Is Different from E-Mail and Instant Messaging 257

Biggest Risks of Social Media 257

Legal Risks of Social Media Posts 259

xii CONTENTS

Tools to Archive Social Media 261

IG Considerations for Social Media 262

Key Social Media Policy Guidelines 263

Records Management and Litigation Considerations for Social Media 264

Emerging Best Practices for Managing Social Media Records 267

Notes 269

C H A P T E R 14 Information Governance for Mobile Devices 271

Current Trends in Mobile Computing 273

Security Risks of Mobile Computing 274

Securing Mobile Data 274

Mobile Device Management 275

IG for Mobile Computing 276

Building Security into Mobile Applications 277

Best Practices to Secure Mobile Applications 280

Developing Mobile Device Policies 281

Notes 283

C H A P T E R 15 Information Governance for Cloud Computing 285

By Monica Crocker CRM, PMP, CIP, and Robert Smallwood

Defi ning Cloud Computing 286

Key Characteristics of Cloud Computing 287

What Cloud Computing Really Means 288

Cloud Deployment Models 289

Security Threats with Cloud Computing 290

Benefi ts of the Cloud 298

Managing Documents and Records in the Cloud 299

IG Guidelines for Cloud Computing Solutions 300

Notes 301

C H A P T E R 16 SharePoint Information Governance 303

By Monica Crocker, CRM, PMP, CIP, edited by Robert Smallwood

Process Change, People Change 304

Where to Begin the Planning Process 306

Policy Considerations 310

Roles and Responsibilities 311

Establish Processes 312

Training Plan 313

Communication Plan 313

Note 314

CONTENTS xiii

PA RT F I V E — Long-Term Program Issues 315g g

C H A P T E R 17 Long-Term Digital Preservation 317

By Charles M. Dollar and Lori J. Ashley

Defi ning Long-Term Digital Preservation 317

Key Factors in Long-Term Digital Preservation 318

Threats to Preserving Records 320

Digital Preservation Standards 321

PREMIS Preservation Metadata Standard 328

Recommended Open Standard Technology-Neutral Formats 329

Digital Preservation Requirements 333

Long-Term Digital Preservation Capability Maturity Model® 334

Scope of the Capability Maturity Model 336

Digital Preservation Capability Performance Metrics 341

Digital Preservation Strategies and Techniques 341

Evolving Marketplace 344

Looking Forward 344

Notes 346

C H A P T E R 18 Maintaining an Information Governance Program and Culture of Compliance 349

Monitoring and Accountability 349

Staffi ng Continuity Plan 350

Continuous Process Improvement 351

Why Continuous Improvement Is Needed 351

Notes 353

A P P E N D I X A Information Organization and Classifi cation: Taxonomies and Metadata 355

By Barb Blackburn, CRM, with Robert Smallwood; edited by Seth Earley

Importance of Navigation and Classifi cation 357

When Is a New Taxonomy Needed? 358

Taxonomies Improve Search Results 358

Metadata and Taxonomy 359

Metadata Governance, Standards, and Strategies 360

Types of Metadata 362

Core Metadata Issues 363

International Metadata Standards and Guidance 364

Records Grouping Rationale 368

Business Classifi cation Scheme, File Plans, and Taxonomy 368

Classifi cation and Taxonomy 369

xiv CONTENTS

Prebuilt versus Custom Taxonomies 370

Thesaurus Use in Taxonomies 371

Taxonomy Types 371

Business Process Analysis 377

Taxonomy Testing: A Necessary Step 379

Taxonomy Maintenance 380

Social Tagging and Folksonomies 381

Notes 383

A P P E N D I X B Laws and Major Regulations Related to Records Management 385

United States 385

Canada 387 By Ken Chasse, J.D., LL.M.

United Kingdom 389

Australia 391

Notes 394

A P P E N D I X C Laws and Major Regulations Related to Privacy 397

United States 397

Major Privacy Laws Worldwide, by Country 398

Notes 400

GLOSSARY 401

ABOUT THE AUTHOR 417

ABOUT THE MAJOR CONTRIBUTORS 419

INDEX 421

xv

PREFACE

I nformation governance (IG) has emerged as a key concern for business executives and managers in today’s environment of Big Data, increasing information risks, co- lossal leaks, and greater compliance and legal demands. But few seem to have a clear

understanding of what IG is; that is, how you defi ne what it is and is not, and how to implement it. This book clarifi es and codifi es these defi nitions and provides key in- sights as to how to implement and gain value from IG programs. Based on exhaustive research, and with the contributions of a number of industry pioneers and experts, this book lays out IG as a complete discipline in and of itself for the fi rst time.

IG is a super-discipline that includes components of several key fi elds: law, records management, information technology (IT), risk management, privacy and security, and business operations. This unique blend calls for a new breed of information pro- fessional who is competent across these established and quite complex fi elds. Training and education are key to IG success, and this book provides the essential underpinning for organizations to train a new generation of IG professionals.

Those who are practicing professionals in the component fi elds of IG will fi nd the book useful in expanding their knowledge from traditional fi elds to the emerging tenets of IG. Attorneys, records and compliance managers, risk managers, IT manag- ers, and security and privacy professionals will fi nd this book a particularly valuable resource.

The book strives to offer clear IG concepts, actionable strategies, and proven best practices in an understandable and digestible way; a concerted effort was made to simplify language and to offer examples. There are summaries of key points through- out and at the end of each chapter to help the reader retain major points. The text is organized into fi ve parts: (1) Information Governance Concepts, Defi nitions, and Principles; (2) IG Risk Assessment and Strategic Planning; (3) IG Key Impact Areas; (4) IG for Delivery Platforms; and (5) Long-Term Program Issues. Also included are appendices with detailed information on taxonomy and metadata design and on re- cords management and privacy legislation.

One thing that is sure is that the complex fi eld of IG is evolving. It will continue to change and solidify. But help is here: No other book offers the kind of compre- hensive coverage of IG contained within these pages. Leveraging the critical advice provided here will smooth your path to understanding and implementing successful IG programs.

Robert F. Smallwood

xvii

ACKNOWLEDGMENTS

I would like to sincerely thank my colleagues for their support and generous contribu- tion of their expertise and time, which made this pioneering text possible.

Many thanks to Lori Ashley, Barb Blackburn, Barclay Blair, Charmaine Brooks, Ken Chasse, Monica Crocker, Charles M. Dollar, Seth Earley, Dr. Patricia Franks, Randy Kahn, Paula Lederman, and Barry Murphy.

I am truly honored to include their work and owe them a great debt of gratitude.

PA RT O N E Information Governance Concepts, Defi nitions, and Principles

3

The Onslaught of Big Data and the Information Governance Imperative

C H A P T E R 1

T he value of information in business is rising, and business leaders are more and more viewing the ability to govern, manage, and harvest information as critical to success. Raw data is now being increasingly viewed as an asset that can be

leveraged, just like fi nancial or human capital.1 Some have called this new age of “Big Data” the “industrial revolution of data.”

According to the research group Gartner, Inc., Big Data is defi ned as “high-volume, high-velocity and high-variety information assets that demand cost-effective, inno- vative forms of information processing for enhanced insight and decision making.” 2 A practical defi nition should also include the idea that the amount of data—both struc- tured (in databases) and unstructured (e.g., e-mail, scanned documents) is so mas- sive that it cannot be processed using today’s database tools and analytic software techniques. 3

In today’s information overload era of Big Data—characterized by massive growth in business data volumes and velocity—the ability to distill key insights from enor- mous amounts of data is a major business differentiator and source of sustainable com- petitive advantage. In fact, a recent report by the World Economic Forum stated that data is a new asset class and personal data is “the new oil.” 4 And we are generating more than we can manage effectively with current methods and tools.

The Big Data numbers are overwhelming: Estimates and projections vary, but it has been stated that 90 percent of the data existing worldwide today was created in the last two years 5 and that every two days more information is generated than was from the dawn of civilization until 2003. 6 This trend will continue: The global market for Big Data technology and services is projected to grow at a compound annual rate of 27 percent through 2017, about six times faster than the general information and com- munications technology (ICT) market. 7

Many more comparisons and statistics are available, and all demonstrate the incredible and continued growth of data.

Certainly, there are new and emerging opportunities arising from the accu- mulation and analysis of all that data we are busy generating and collecting. New enterprises are springing up to capitalize on data mining and business intelligence opportunities. The U.S. federal government joined in, announcing $200 million in Big Data research programs in 2012.8

4 INFORMATION GOVERNANCE

Big Data values massive accumulation of data, whereas in business, e-discovery realities and potential legal liabilities dictate that data be culled to only that which has clear business value.

But established organizations, especially larger ones, are being crushed by this onslaught of Big Data: It is just too expensive to keep all the information that is being generated, and unneeded information is a sort of irrelevant sludge for decision makers to wade through. They have diffi culty knowing which information is an accurate and meaningful “wheat” and which is simply irrelevant “chaff.” This means they do not have the precise information they need to base good business decisions upon.

And all that Big Data piling up has real costs: The burden of massive stores of information has increased storage management costs dramatically, caused overloaded systems to fail, and increased legal discovery costs. 9 Further, the longer that data is kept, the more likely that it will need to be migrated to newer computing platforms, driving up conversion costs; and legally, there is the risk that somewhere in that mountain of data an organization stores is a piece of information that represents a signifi cant legal liability.10

This is where the worlds of Big Data and business collide . For Big Data proponents, more data is always better, and there is no perceived downside to accumulation of mas- sive amounts of data. In the business world, though, the realities of legal e-discovery mean the opposite is true. 11 To reduce risk, liability, and costs, it is critical for unneeded information to be disposed of in a systematic, methodical, and “legally defensible” (jus- tifi able in legal proceedings) way, when it no longer has legal, regulatory, or business value. And there also is the high-value benefi t of basing decisions on better, cleaner data, which can come about only through rigid, enforced information governance (IG) policies that reduce information glut.

Organizations are struggling to reduce and right-size their information footprint by discarding superfl uous and redundant data, e-documents, and information. But the critical issue is devising policies, methods, and processes and then deploying information technol- ogy (IT) to sort through which information is valuable and which no longer has business value and can be discarded.

IT, IG, risk, compliance, and legal representatives in organizations have a clear sense that most of the information stored is unneeded, raises costs, and poses risks. According to a survey taken at a recent Compliance, Governance and Oversight Counsel summit, respondents estimated that approximately 25 percent of information stored in organizations has real business value, while 5 percent must be kept as busi- ness records and about 1 percent is retained due to a litigation hold. “This means that

The onslaught of Big Data necessitates that information governance (IG) be implemented to discard unneeded data in a legally defensible way.

THE ONSLAUGHT OF BIG DATA AND THE INFORMATION GOVERNANCE IMPERATIVE 5

[about] 69 percent of information in most companies has no business, legal, or regulatory value. Companies that are able to dispose of this data debris return more profi t to sharehold- ers, can leverage more of their IT budgets for strategic investments, and can avoid excess expense in legal and regulatory response” (emphasis added). 12

With a smaller information footprint , organizations can more easily fi nd what they tt need and derive business value from it.13 They must eliminate the data debris regularly and consistently, and to do this, processes and systems must be in place to cull valuable information and discard the data debris daily. An IG program sets the framework to accomplish this.

The business environment has also underscored the need for IG. According to Ted Friedman at Gartner, “The recent global fi nancial crisis has put information gov- ernance in the spotlight. . . . [It] is a priority of IT and business leaders as a result of various pressures, including regulatory compliance mandates and the urgent need for improved decision-making.” 14

And IG mastery is critical for executives: Gartner predicts that by 2016, one in fi ve chief information offi cers in regulated industries will be fi red from their jobs for failed IG initiatives. s 15