Transcript Information governance - Florida Gulf Coast ARMA Chapter

1
INFORMATION
GOVERNANCE (IG)
What Does That Really Mean?
Donna Read, CRM, CDIA+
November 18, 2014
Florida Gulf Coast ARMA Chapter
2
Agenda
• Defining Information Governance
• Why is it difficult to implement?
• People – Processes - Technology
• Wrap your arms around the beast.
3
Difference Between RIM & IG
• Records Management is tactical
• Information Governance is strategic
To be strategic, you need partners, sponsors, and a
network
• Tactical - Designed to achieve a particular effect or goal.
adj.tactical, expedient, schematic, strategic.
• Strategic - or a strategy - A method worked out for
accomplishing something : plan, blueprint, design, course
of action, plan of action, game plan, master plan, project,
scheme, strategy, format, stratagem, procedure.
4
IG – What Does It Mean?
• “..a holistic approach to managing and leveraging
information for business benefits encompassing
information quality, protection and lifecycle
management.” AIIM
• “..multi-disciplinary structures, policies,
procedures, processes and controls implemented
to manage information at an enterprise level,
supporting an organization’s immediate and
future regulatory, legal, risk, environmental and
operational requirements.” WikiPedia
5
From The Sedona Conference
“Information governance means an organization’s
coordinated, interdisciplinary approach to satisfying
compliance requirements and managing information risks
while optimizing information value.
As such, Information Governance encompasses and
reconciles the various legal and compliance requirements
and risks addressed by different information-focused
disciplines, such as records and information
management, data privacy, information security, and ediscovery.”
 Source: The Sedona Conference®
Commentary on Information Governance (Dec. 2013)
6
No – Really What Does It Mean?
• “…enterprise-wide program that incorporates
multiple organizational disciplines and that
contemplates policies, procedures, processes,
and controls designed and implemented to
management information.” AIIM
• “...a vehicle to ensure compliance to regulation,
encompassing people, processes and
technologies to support the best practices of the
organization.” KM World
7
Key Words
• Holistic ----- the parts of something as intimately
interconnected and explicable only by reference to
the whole
• Managing – Leveraging – Controlling
• Policies - Procedures - Processes
• Ensure Compliance
• Encompassing:
Information quality & protection
Immediate and future operational requirements
People, processes, & technologies
8
Information
Security
(PII)
Non-Records
Holds
Official Records
Duplicates
Reference and
Convenience
Information
Trash
9
10
11
What Does ARMA Have To Say?
• The Principles!!!!
• Information Governance Maturity Model
“Information is one of the most vital, strategic assets organizations
possess. They depend on information to develop products and services,
make critical strategic decisions, protect property rights, propel
marketing, manage projects, process transactions, service customers,
and generate revenues. This critical information is contained in the
organizations' business records.
• It has not always been easy to describe what "good information
governance" looks like.”
www.arma.org
12
Beginning to Look A Little Confusing –
Like Herding Cats?
13
Why Is IG So Difficult?
• Confusion Terminology
• Frustration - inability to focus on positive side of cost
avoidance and managing risk
• Why is adoption rate low?
 Perceived to have no direct business benefit
 Challenges in business buy-in and funding
 Seen as critical but highly political, complex, long-term and multi-year
initiative
 Currently a “on size fit all” approach
 Lack of metrics-driven measurement of benefit
 Total cost of IT ownership (TCO) rarely measured or tracked
14
Status Quo Not Working
• “The one thing that everyone can agree
upon is that the status quo is not working.
Symptoms are everywhere with comments
like ‘we need help to govern the data in
these warehouses since the date is always
wrong, incomplete or erroneous’ are the
norm rather than the exception.”
• Thornton May, Futurist & Executive Director, IT Leadership Academy
15
TMI
• IDC (International Data Corporation) Report: 1800 new
exabytes this year -- (1 exabyte = data equivalent to
50,000 years of continuous movies)
• Information governance is needed in a world where . . .
1. 80% of enterprise data is unstructured
2. 60% of documents are obsolete
3. 50% of documents are duplicate
4. 80% documents are not retrieved by traditional search
16
What Is Needed For IG
• Organizational Mindshare
• Senior Level Support
• Awareness of need for change
• Willingness to change
• Resources
17
Who Are The Stakeholders?
• Senior level management
• IT
• Legal
• Records Management
• Accounting
• The Users
18
Getting Buy-In
• Not an easy job
• What does everyone care about? WIIFM
“You have to align with what your organization cares about
– figure out what that is - to use as a lever for embedding
Information Governance.” Monica Crocker
19
IG and Social Media
• New trends constantly emerging
Today – SMC – Social/Mobile/Cloud
• Requires updating IG program and it’s deployment
• BYOD (bring your own device) muddies the water
Does your organization have polices in place for BYOD?
• Content generated from company account or…
• Content generated using personal account for business
purposes…..
• Must be governed under same policies as rest of information
20
IG and Big Data
21
The Meeting of IG and BD
• BD – “data lake” stores unlimited amounts of data, in any format,
scheme and type
• Theoretically could hold all of an organization’s data
• 1000’s of regulations impacting management of information
• Balance – information value with information risk
• Must know what you have – starting point for IG
• As data gets older, value diminishes – never really useless
• Risks in keeping include – increased storage
costs, litigation, & regulatory sanctions
• Saving everything is unsustainable
22
Archives Must Include
• Ingesting & retaining all types of information – both structured
and unstructured
• Auditing and preserving data and content to meet regulatory
and governance mandates
• Require no dependence on originating applications to manage
or reference information and records
• Maintain clear, defensible chain of custody
• Deliver records and retention capabilities
with audit trails
• Preserve information in an immutable form
23
Three-Phased Approach
• Current State Assessment
 Review all relevant policies and procedures
 Stakeholder interviews and focus groups to define current state of information
management practices
 Identify RIM vulnerabilities and develop key observations of “as is” state
• Analysis and Recommendations
 Identify best practice standards and benchmarking targets
 Evaluate current information management processes against standards and industry
best practices including “The Principles”
 Assign maturity rating and develop recommendations for the enhancement of
information management practices
• Strategy and Roadmap
 Summarize assessment, methodology and recommendations
 Validate with sponsors
 Develop strategies
 Develop tactical project plans for each strategy
 Develop implementation roadmap
Huron Consulting Group
24
Information Governance Infrastructure
Huron Consulting Group
25
Assess Current Situation – not an easy job
• Are your retention policies being applied to both structured and
unstructured data?
• Are your shared drives/hard drive used as a dumping ground
with no structure?
• Do you have an EDMS/RMA etc. in place but it not being fully
utilized?
• Do you have an ESI Data Map, or a Data Source Catalogue?
• Are there workarounds for system limitations that set, i.e. size
of email box?
• Can your employees find the correct and relevant
data they need to perform their work?
26
Huron Consulting Group
Three Buckets
1.
The stuff you know enough about to keep
2.
The stuff you know enough about to throw away
3.
Outliers & anomalies: the stuff you don’t have enough
information on to make a reasonable decision
Taking slices of the data: looking at a minimum amount of
information (logs, dates, times, domains, custodians) to make
the remediation call.
27
Structured Data Remediation Plan
For each identified system: (do you know your critical systems)
• Does the system contain “records” and how does this
relate to the retention schedule
Issue of relational databases, transactional systems, etc.
• Risk / cost analysis of over-retention
• Remediation options
• Manual
• Systematic
Huron Consulting Group
28
Potential “To Do” List
1. Does your RIM program need refinement?
2. Are your retention schedules and legal compliance rules
3.
4.
5.
6.
7.
up to date?
Do you need to update policies and procedures?
Should training be enhanced or include more staff?
Is there a strategy for dealing with unstructured content?
Do you have a structured Data System remediation plan?
Who is responsible for constructing the ESI Data Map?
29
Summary
• Need to define IG for stakeholders
• Convince them why they should care
• Assess current situation
• Create plan for remediation
30
The End
Donna Read, CRM, CDIA+
Florida Gulf Coast ARMA Chapter
[email protected]