W H I T E P A P E R E X E C U T I V E S U M M AR Y S I T U AT I O N O V E R V I E W. Sponsored by: EMC Corporation. April 2009

Transcription

1 W H I T E P A P E R I n f o r m a t i o n G o v e r n a n c e f o r t h e 2 1 s t C e n t u r y : B u i l d i n g a n A r c h i v e - B a s e d A r c h i t e c t u r e t o S u p p o r t I n f o r m a t i o n M a n a g e m e n t Sponsored by: EMC Corporation Laura DuBois April 2009 Vivian Tero Global Headquarters: 5 Speen Street Framingham, MA USA P F E X E C U T I V E S U M M AR Y Information is universally recognized as the key business asset, essential to business success. What was once simply a storage procedure - primary storage and backup - has been transformed by events of the 21 st century into information governance. Where IT once set priorities and backup rules, today business policy dictates how information will be governed, based on its business purposes, security and privacy, regulatory compliance issues, archiving tactics, ediscovery requirements and more. Information governance turns out to be about managing risk, according to the business value of information, and thus costs, while also enabling a firm to access and re-use corporate information for competitive advantage. However, with these demands come requirements for more sophisticated software solutions to assure these requirements are being met. Many companies are beginning to understand the necessity of a formal process to ascertain the ROI derived from information governance. Without such a process, it is difficult to assess if good information governance is occurring and to determine if it is a profitable undertaking. In recent years, it has become evident that the best solution is an architecture that has been designed specifically to support and sustain information governance and which applies corporate policies consistently across a wide range of content types. The organization must be able to manage multiple content types that assure consistent information retention, a reliable plan for backup and collecting essential discovery materials, and an overarching lifecycle management strategy for proactive content management whether that content is structured or unstructured. This IDC White Paper discusses an emerging information management architecture to accomplish these objectives, and specifically how the new EMC SourceOne family of products and solutions are an integrated set of information governance solutions to help firms of different sizes do more with less by focusing on both archiving and ediscovery/compliance.. S I T U AT I O N O V E R V I E W It has long been understood that information is the key driver in business process and the weld that forges the links in the value chain. More recently, many business managers have come to the realization that the richness of information what we think of as content is really the key differentiating factor for a competitive advantage

2 and assuring the enterprise is accountable and in compliance. If the information content is shallow, out of date, or fragmentary, then business processes are handicapped and cracks appear in the value chain. If the information is not accessible and able to be efficiently gathered for accountability and compliance requirements, then good information governance is not occurring. Moreover, if it isn t possible to determine if the cost of acquiring, storing, and processing the information, the risks attendant in storing and processing it, and translating it into business practices and good information governance practices to produce a profitable return on the investment, then too many unknowns are left unattended to. As thinking has shifted from assessing the cost of information technology to the economic return from high-value information, several trends have emerged: The sheer quantity of information collected and in use has grown at an extraordinary pace. IDC research shows that information that has been either created, captured or replicated in digital form totaled 281 exabytes in That figure is expected to reach nearly 1,800 exabytes in 2011 almost ten times the amount produced in The complexity and diversity of information that must be retained has multiplied in recent years to the point where it can no longer simply be thought of as data. The amount of unstructured content that must be maintained and archived is rivaling structured content, and is often crucial to regulatory and compliance matters. From corporations such as Enron to the White House, messages unstructured content cannot simply disappear any longer. Risk has grown both in magnitude and consequence. Priceless information may be compromised due to a stolen laptop, a wi-fi theft such as occurred at TJX Corporation, inadequate backup or archiving, rogue employee theft the list continues to grow. Enterprises are now held responsible even liable not just for security breaches but for protecting customer information. Indeed, holding too much customer information, for too long, is now an offense. Storage, backup, archiving, and later extracting and collecting stored information consume vast amounts of IT time and resources, and with the ever-growing amount of content that needs to be retained, so does the cost rise. Budgetary constraints and the fact that it is difficult to substantiate ROI for storing and accessing content appear to run counter to the importance of retaining structured and unstructured content for business planning, regulatory compliance, legal ediscovery, and records retention. Yet all these matters must be addressed and attended to in a strategic manner; they are critical to business success and to remaining competitive in a world where the edge is extraordinarily keen and short-lived. Today s tools and methods are not substantial enough for the business sustainability in this relatively new environment. What is required is the application of good corporate information governance and a new perspective on the enterprise information architecture. 2 # IDC

3 E n t e r p r i s e w i d e I n f o r m a t i o n G o v e r n a n c e Across the global business landscape, most medium- to large-scale enterprises have a variety of information repositories in different divisions, groups or locations. Each has its own, as well as shared, content, but it is distributed and rarely managed with a single overarching corporate policy. Moreover, with storage at a premium and growing, information is not stored or archived consistently, making access for business, compliance, or legal requirements difficult if not impossible. In other words, what is absent is a sound, uniform, ubiquitous information governance policy. Good governance is a proactive information management strategy, designed to address the limitations of simple compliance, ediscovery or information security (privacy) strategies. Its impact is felt throughout the global economy. Companies reap the benefits of secure lifecycle information management by: Applying retention and disposition policies to information Defining who can access the information Determining collection methodologies and how and where it will be used and stored (or left untouched), and Deciding whether to archive it for later use and/or when to destroy it. Information governance is of equal importance to corporate governance or financial governance. In fact, you could say they are inseparable, because they all seek to accomplish the same business objectives. IDC believes that increased attention to sound information governance policies, coupled with a discovery collection and management policy for compliance with regulatory requirements, will improve the focus on structured and unstructured information storage and management. Active archiving, which is critical for , is becoming more comprehensive and is including disparate content, starting first with other unstructured information. Archiving will become more integral to information management initiatives. Good information governance reduces corporate risk and legal exposure while facilitating content management, which in turn opens the doors for knowledge management, which should be the ultimate focus of every enterprise. It also enables measuring the return on investment (ROI) made in content storage, archiving, retention and recovery and provides the data to determine the total cost of ownership (TCO) that addresses not just these costs but the cost savings from the advanced efficiencies. An information governance policy for today s enterprise aids in IT optimization while reducing risk, taking into consideration the following: Continuous IT optimization including storage capacity optimization, shorter backup times, reduced backup infrastructure costs, improved application server performance. Assurance of security and privacy for employees, customers, and corporate intelligence Compliance with business rules and policies for record retention requirements 2009 IDC #

4 Compliance with industry and governmental regulations E-Discovery preparedness for anticipated legal discovery requests Discovery of Electronically Stored Information (ESI) for the purposes of compliance audits, regulatory investigations as well as litigation Improving the efficiency, accuracy and repeatability of the ediscovery process for both legal and compliance purposes Managing ever-increasing amounts of structured and unstructured information. When an enterprise-wide governance policy is implemented to deal with these matters, decisions can be rendered consistently, necessary information can be retrieved promptly, business can be conducted as-usual, and productivity does not suffer. A n A r c h i t e c t u r e f o r I n f o r m a t i o n G o v e r n a n c e Information technology projects, priorities and processes are being increasingly driven by governance, risk and compliance, and cost considerations. But what information to save, and how to comply? Corporations tend to save everything due to their inability to manage information properly. The old model for data retention is based on hardware-defined storage and backup procedures: store everything on fixed-disk drives, then incrementally back everything up to clumsy sequential tape cartridges. Good information governance cannot thrive in such an environment because all data are treated the same, when in fact information has varying degrees of value. Yet fear of being out of compliance or at risk of litigation not to mention the arduous and costly deliberations over implementing a new solution often prevail. Interestingly, when an enterprise or business unit moves out of the putting-out-fires mode and takes a holistic view of information management through governance, solutions become much clearer. In fact, governance, risk management and compliance (GRC) can now be thought of cohesively. It becomes possible to more consistently locate, classify, retain, preserve, monitor, control access to, dispose of, and certify destruction of prescribed content required for a legal, regulatory, or business issue. The entire architecture, should it exist, does not have to be put in place all at once. Instead, the conversion should proceed on a highest-needs basis, installing crossfunctional applications that will continue to support the holistic information governance initiative or model. Considerations for such an architecture ought to include: Ability to manage across departmental or business unit boundaries Ability to manage across geographic boundaries, countries and languages including global support for all types of character sets. Accessibility by end users across a broad range of distributed devices and access points Ability to manage across IT platforms, domains, divisions, business units Compliance issues: adhering to a clearly defined specification, organizational policy, or industry standard, and being able to document and prove conformance 4 # IDC

5 Content management integrated with archiving for precise, rapid identification of and access to required information ediscovery requirements: finding, identifying, locating, retrieving, and reviewing potentially relevant information from designated computer systems while maintaining chain of custody by limiting access and preserving content and metadata Foundational technology or architecture for an "integrated content archiving" strategy that includes messaging ( , instant messages, etc.) but expands to into other content (Files, SharePoint, SAP, reports, images, etc) Monitoring and supervisory roles Privacy concerns such as uniquely identifiable personal information collected and stored, in digital form or otherwise, by another entity Records management (encompassing records retention and disposition) for all information Security and privacy, including endpoints, wireless, 3G access Server allocations Storage considerations, including backup schema and active archiving Enabling users to leverage information and collaborate, particularly in the context of new Web 2.0 ways of doing business Good information management, established on the foundation of an information architecture designed specifically to support and sustain it, produces intelligent information management that satisfies all the business, regulatory and legal issues of the modern enterprise. Moreover, risk is reduced, business intelligence is secured, costs go down, and because the business environment is more secure, opportunities for competitive advantage improve. T h r e e O v e r a r c h i n g P r i n c i p l e s o f G o o d I n f o r m a t i o n G o v e r n a n c e It is often the case that key organizations and functional groups object to information governance because they believe it takes power or control from them. This can be neutralized when these three overarching principles - integrity, security, and accessibility - are designed into the governance system. Creating information governance is an enterprise project, and all key people and organizations should be involved in planning it. Ownership goes a long way; the rest of the distance is covered when everyone sees how much more efficient it becomes to work with information. Here, then, are the three principles of information governance success: Integrity. The system must support business policies that have been created in order to meet industry regulations and address all regulatory and compliance requirements. While this sounds very basic and it is applications must be configured so that the system does such things as Ensure legally defensible preservation, collection and retention 2009 IDC #

6 Provide complete audit trails and reporting Apply and enforce legal holds and preserve chain of custody Move content to intelligent retention-enabled folders. Integrity as an underlying pillar for good information governance takes into account the consistency of methods used to retain, preserve, move, report on and monitor content. If the integrity of the content or the processes to manage content are called into question, the integrity of the information governance practice can be placed in a compromising position. Security. Information governance supports services that facilitate secure information management. These may include content encryption access control enhanced auditing digital shredding. All are key for protecting structured information, such as corporate records and intelligence, as well as unstructured information such as and PowerPoint presentations that contain proprietary information. Again, the objective here is risk mitigation and information protection, as well as secure services like lifecycle enforcement and controlled printing. Accessibility. Everyone knows that security and ease of access are opposing seats on the teeter-totter of computer use. Information governance is no exception; generally speaking, both active and archived information have varying degrees of importance to users, and all information should be accessible according to user needs. Accessibility concerns include: Interface commonality Passwords Information manipulation Access by a range of devices and endpoints End user experience consistent with known information navigation and graphical interfaces to present a transparent experience and a feedback mechanism. If end users receive the training to use the new application properly, they will not be exposed to unnecessary complexities associated with the higher orders of information management. The risk of human error is reduced in the learning, and end users themselves become a critical success factor in moving information governance forward. It is easy to see why integrity, security, and accessibility are the foundation for good information governance. Indeed, one might be quick to conclude that any system, whether computer-based or simply organizational in nature, should embrace these principles. It is often the case that people believe in, and pay lip service to, these 6 # IDC

7 principles, but once the mission statement or system requirements are set down, higher-order objectives may be set aside or lost in procedural details. What makes good information governance work, however, is that these principles are integral to its design. Remember, the underlying concept of good information governance is that the system is designed for compliance. Because it simply isn t possible to dilute these three principles or set them aside as the governance system is built, of necessity they become the foundation. This becomes even more apparent in the next phase or iteration, when the following ten criteria are designed into the system. Or, conversely, it becomes starkly apparent that the criteria cannot be implemented unless integrity, security, and accessibility are already embedded in the system design. 1 0 C r i t e r i a f o r G o o d I n f o r m a t i o n G o v e r n a n c e Like any enterprise initiative, the success of information governance is founded on buy-in from all who are involved or affected. In truth, no one should feel they or their group are losing anything because information will be centrally administered. There are some initiatives that work well at the group or business unit level, and others that do not; good information governance is one of them. It is a high-level, systematic approach to information management, the ordering of business intelligence, and ultimately knowledge repositories, and it can only succeed based on the policies, processes and technology initiatives that were discussed and agreed upon in the foundation meetings in which it was designed. These foundation meetings should be prepared to discuss the ten most important criteria for good information governance. Expect that these discussions will drill down into a number of other critical issues, many of which are specific to your enterprise. 1. Applicable to different content types, both structured and unstructured, but also prioritized for your organization. For example, an insurance claims department will value photographs accompanying accident reports more than a brokerage. 2. Holistic approach crosses systems, locations, repositories, content types. The fewer exceptions to the information governance program, the better. Everyone likes to think they have unique issues, but most can be grouped into common categories as designated in the server organizations and file structures common across the organization. 3. Applies retention and disposition rules depending on formal or informal rules within the organization. For example, patient records are permanent, while RFP vendor solicitations are more informal and often not retained for lengthy periods, according to corporate policy. 4. Information governors, a select committee with an appointed chief information officer or similar vested enterprise officer, monitors and enforces rules (hold, retention, etc.). 5. Enables location of relevant content based on the scope (users, groups, systems, etc.) and depth (topic, keyword, etc) of information needed. 6. Follow on integration with different content analytics applications for further data mining IDC #

8 7. Security services enabled such as content encryption, access control, auditing, supervision, shredding, destruction certificates, roles and who can search content and archive repositories etc. 8. Accessibility and retrieval of information based on variable need. 9. Archiving services and policies based on relevance and with cost savings in mind; an architecture that can support different content types, scaled to volume today as well as five years from now. 10. Enterprise-wide, holistic approach to information management, with execution of policies across different repositories and content types. Another consideration for global enterprises, and even for companies with global business partners, is that compliance and litigation matters vary from country to country. For example: In North America there are the Federal Rules of Civil Procedure (FRCP) that address retention based on regulatory mandates, data loss prevention, controlling corporate information assets, storage optimization, etc. In the European Union, issues and concerns include the European Medicines Association (EMEA), storage optimization, privacy (employees own their mailboxes, not the corporation), the Markets in Financial Instruments Directive (MIFID), data protection directives, larger multinational corporations that have legal discovery events that span geographies and mail servers, etc. In Asia/Pacific and Australia, users focus on records retention; the Japanese have their own version of Sarbanes-Oxley (J-SOX). Information and its uses are constant, and constantly changing. Yet it must be governed if the enterprise is to use information strategically and intelligently while simultaneously protecting its assets and meeting all its business and regulatory responsibilities. So even while information and information needs are constantly changing, the management of that information must be consistent and predictable. I N T R O D U C I N G E M C S O U R C E O N E The EMC SourceOne family of products and solutions are an integrated set of information governance solutions to help firms of different sizes do more with less. EMC SourceOne solutions are focused on archiving and ediscovery/compliance and the first products in the family will be delievered for archiving, ediscovery and compliance. EMC SourceOne is based on the concept that all enterprises need to manage their information resources intelligently, and that translates to the highest return on investment, at the lowest risk, and for maximum competitive advantage and economic value. The SourceOne approach addresses: Archiving: The SourceOne approach to archiving allows a firm to reduce IT costs while increasing IT efficiency. Creating an archive not only supports cost reduction objectives but also easy content access and information reuse while meeting regulatory and corporate governance requirements. 8 # IDC

9 ediscovery and Compliance: The SourceOne approach to ediscovery and compliance supports policy-driven management of information and consistent, defensible and repeatable edisocvery and litigation hold processes while reducing ediscovery costs. First in the EMC SourceOne family of products and solutions is SourceOne Management which can be used standalone or with the Documentum platform. Now it is possible to establish a reliable, cost-effective information governance program that covers all types of information, both structured and unstructured, with full Unicode support for worldwide applications. Complimentary to this, the SourceOne Discovery Manager application provides discovery, search and secure legal holds of found in the SouceOne Management archive. The EMC SourceOne family of products and solutions currently features: EMC SourceOne Management: Provides all core archiving capabilities for Microsoft Exchange, IBM Lotus Notes/Domino, and Instant Messaging. This new generation of archiving replaces Xtender. EMC SourceOne Discovery Manager: A compliment to SourceOne Management, this application provides discovery search and secure legal hold of found in Xtender 4.8 SP1 and EMC SourceOne archives. EMC SourceOne Discovery Collector: Provides defensible content collection from desktops, file servers, archives, servers and other repositories for movement into an EMC SourceOne archive. Includes a rich set of features designed for ediscovery including indexing, classification, retention and deletion. E M C S o u r c e O n e E m a i l M a n a g e m e n t EMC SourceOne Management is the first of three information governance applications designed for the EMC SourceOne information governance architecture. It is EMC s next-generation archiving product - a native archive packaged with the product to support high-volume archiving, retention and disposition. The application provides the following advantages: Scalable architecture which is incrementally expandable and highly available for continuous processing of tasks Low TCO achieved through reduced administration costs and more efficient mailbox management Litigation readiness by moving content into a centralized archive for consistent retention and compliance access Based on a Unicode compliant architecture. EMC SourceOne Management users can natively archive and search multi-byte character sets. The user interface is localized in seven languages including French, Italian, German, Spanish, Korean, simplified Chinese and Japanese. This enables extended deployment of EMC SourceOne Management to geographically dispersed locations and usage in multi-jurisdictional locations, outside of the United States IDC #

10 The SourceOne Management architecture supports next generating scalability and performance. The distributed architecture is designed to run efficiently in a single server. The architecture is also designed to scale to meet very large enterprise needs and intensive processing, such as massive PST ingestion for example. Processing tasks such as ingestion, archiving and shortcutting can be distributed across multiple servers which may be physical or virtual machines to better meet workload and performance needs. Built in high availability is another benefit of the architecture where server or task failure will not bring the system to a halt. The EMC SourceOne Management software architecture can be distributed and scaled out, rather than requiring additional instances of the software be deployed to scale out the number of mailboxes supported. EMC SourceOne Management is EMC s new generation of archiving that replaces EMC s Xtender, which was architected in a previous decade when, like other products of that time, the business requirements and massive information growth were not as critical. E M C S o u r c e O n e D i s c o v e r y M a n a g e r EMC SourceOne Discovery Manager is the second application in the SourceOne family and provides search, collection, tagging and export for electronically stored information as part of a legal discovery or a regulatory compliance audit. Creation of legal matter folders can be enabled where legal holds can be implemented. Among its features: Legal Matter Views. Enables setting up legal matters in response to litigation, regulatory audit, internal investigation Discovery Processes. Performs search, collection, preservation, culling, and production of relevant results Defensible Legal Holds. Enforces a legal hold and preserves chain of custody Management According Lifecycle. Manages entire content according to matter lifecycle Integration with EDRM value chain. Supports ediscovery partners through EDRM XML export of search results Fast, accurate, and integrated search and legal hold via connectors with EMC SourceOne Discovery Manager for acting upon discovery requests. EMC SourceOne Discovery Manager provides an intuitive interface for Legal teams, paralegals, human resources professionals and litigation support to drive the ediscovery processes using familiar language. Discovery Manager assures matter lifecycle management to mitigate the risk of legal spoliation by utilizing legally defensible processes that preserve chain of custody to prove information authenticity. E M C S o u r c e O n e D i s c o v e r y C o l l e c t o r EMC SourceOne Discovery Collector is the third application in the family of products and solutions are an integrated set of information governance solutions. (REWRITE PREVIOUS SENTENCE) The SourceOne Discover Collector solution helps firms get 10 # IDC

11 control of content "out in the wild" on assets such as desktops, file servers, servers, archives and other repositories. The SourceOne Discovery Collector appliance is pointed at these live data stores and creates a full content index of these sources. The solution indexes different content in place and then allows a firm to take action on that content by taking actions such as copying, collecting, moving, deleting or classifying it. Among its features include the following: Defensible Legal Processes. Defensible processes Including legally sound collection, in-house processing, culling and de-duplication, and export into native and load file formats Policy Management. Policy management to identify, classify, secure, retain and delete content. Firms can choose to Index and classify content in-place, retain and delete content according to policy or delete data to reduce operational and ediscovery costs Records Management. Helps identify business information that should be declared and managed as a record (this is called records remediation finding records that are not managed and bringing them under retention management) In today's budget constrained corporate environments, fast time to value/roi is essential. EMC SourceOne Discovery Collector can be quickly deployed to reduce the volume of content sent for processing and review due to de-duplication and other processing and analysis features. A N E X T - G E N E R AT I O N S O L U T I O N The EMC SourceOne approach to management, compliance and ediscovery has been completely re-architected as an information governance architecture that significantly improves on the myriad demands placed on information and content in a 21 st century business. Because its foundation is information governance not simply technology it is of immediate usefulness to the organization. Consider these benefits: Ability to segment messages based on business value through flexible classification Expanded discovery functionality for new and existing environments Support for in-house legal review and early case assessment Increased granularity to apply retention policy services (retention management) and workflow to discrete s Simplified, centralized administration across the enterprise and reduced demands on management for integrated content archiving Open architecture to support customization and integration with 3rd party vendors Lower TCO through reduced administration costs and streamlined, end-to-end compliance processes IDC #

12 C H AL L E N G E S As with any new initiative of this scope and magnitude, EMC faces a number of challenges. New types of content will have to be addressed, for example structured files in SAP applications, SharePoint content, rich media such as audio podcasts all will require new problem-solving approaches to collection, discovery and management. EMC will have to provide a smooth transition for Xtender customers to the EMC SourceOne platform. And EMC SourceOne will have to complement the existing platform and third-party middleware to assure that information is federated across the enterprise information landscape. It must be said that the organization that takes the high road, so to speak, by redesigning their information landscape from the top down, using GRC as a basis for addressing integrated content archiving from a compliance perspective, will be much more successful in the transition to information governance. I N C O N C L U S I O N : E M C T H O U G H T L E AD E R S H I P EMC has been a thought leader in content management, in large part based on its decision to acquire Documentum, Inc. in In so doing, it significantly moved from providing storage to managing information. EMC SourceOne takes the next step in federating information, using the principles of good information governance to approach all forms of content from the perspective of compliance a wise and thoughtful idea. EMC has obviously thought through its EMC SourceOne family of products and solutions, since it is presented as a fully scalable architecture with a number of products that can be used either in standalone mode or with Documentum support. The EMC SourceOne family of applications enables sound information governance, which fully supports all compliance and ediscovery needs in search functionality, classifications, and monitoring the retention, preservation and disposal of prescribed content. The SourceOne information governance approach not only enables firms to mitigate risks but also to more effectively re-use its information assets for user productivity and competitive advantage. It also creates a business-process flow from acquisition to collection, retrieval, organization and management, and presentation of compliance-based information, which is very forward-looking. In today s business environment, risks and threats abound. It is not possible to guard against everything, but EMC SourceOne takes a momentous step forward in meeting this need with an intelligent, adaptable solution that addresses the significant shifts in how information is managed by pointing to the future of good information governance. 12 # IDC

13 C o p y r i g h t N o t i c e External Publication of IDC Information and Data Any IDC information that is to be used in advertising, press releases, or promotional materials requires prior written approval from the appropriate IDC Vice President or Country Manager. A draft of the proposed document should accompany any such request. IDC reserves the right to deny approval of external usage for any reason. Copyright 2009 IDC. Reproduction without written permission is completely forbidden IDC #