Managing the Perpetual Risk of Web Content Compliance

Transcription

1 white paper Managing the Perpetual Risk Sitecore reduces the cost and effort required to meet compliance guidelines and serve users better

2 Table of Contents Content Compliance: Many Facets, Many Risks 1 Sitecore Reduces the Friction in Achieving Content Compliance 2 At the Point of Content Creation: Native Compliance Capabilities 2 Sitecore Workflow: A Flexible, Integral Component 3 Flexible, Permissions-based Workflow Enhances Security and Compliance 4 Sitecore Validation Delivers Integrated Content Validation 4 HiSoftware Compliance Sheriff for Sitecore App Center: Comprehensive, Customizable, Cloud-based 6 Sitecore Offers Cloud and On-premise Options 7 Addressing Existing Compliance Exposure 7 Why a Pervasive Approach to Content Compliance? The Multiplier Effect 8 About Sitecore 9 Copyright Copyright 2013 Sitecore. All Rights Reserved. Restricted Rights Legend This document may not, in whole or in part, be photocopied, reproduced, translated, or reduced to any electronic medium or machine readable form without prior consent, in writing, from Sitecore. Information in this document is subject to change without notice and does not represent a commitment on the part of Sitecore. Trademarks Sitecore is a registered trademark of Sitecore. All other company and product names are trademarks of their respective owners. HiSoftware Compliance Sheriff is a registered trademark of HiSoftware Inc.

3 Content Compliance: Many Facets, Many Risks As companies shift more information and transactions to their websites and intranets, many processes are streamlined, and economies of scale are achieved. Compliance with a wide range of external and internal content guidelines is, unfortunately, not one of the domains that becomes streamlined or easier. It is a perpetual risk that, in fact, escalates as organizations empower more people to post content at a faster rate. With so much information being made available on online, the business risk associated with poor compliance is high, and growing. Companies therefore must have in place a comprehensive approach to address four types of content compliance: Privacy and Confidentiality Protection: As visitors grow more comfortable with entering personal data online, personal data (such as health records, financial information, educational and career details, and addresses) is being added to corporate databases through websites at a skyrocketing rate. Companies collecting such information must provide Internet confidentiality as part of their corporate governance policy, requiring extensive safety mechanisms. Site Quality: Website quality is all about usability and consistency. Quality websites have minimal defects, provide top usability and performance, and promote the corporate brand in a consistent manner. To ensure the best experience for everyone who accesses enterprise content, organizations need to address key technical, content and marketing issues, ranging from slow-loading pages to spell checking, inappropriate language scanning, and typos and broken links. Accessibility Compliance: In the aftermath of US retailer Target s landmark $6 million settlement with the National Federation of the Blind in , website accessibility has become a prominent consideration for every company and government agency, driven by the sheer quantity of potential users who are disabled or impaired. For example, In the US, an estimated 20 percent of the public cannot take advantage of Internet resources due to accessibility problems. 2 In Australia, a 2003 government survey founding that one in Sitecore takes a comprehensive approach to mitigating the inherent risk of publishing content on any website. As a result, Sitecore greatly reduces the friction the time, effort and cost of achieving content compliance. five people (about four million Australians) reported that they had a disability 3. Thus, around the world, a large number of potential customers can t research or purchase products online, and they can t find companies through search engines that otherwise might answer their questions or solve their problems. Companies that follow Web Content Accessibility Guidelines (WCAG) from the World Wide Web Consortium (W3C) and US Section 508 regulations for web accessibility can reach the widest possible audience, and also meet the compliance requirements of many countries and government agencies. 1 In 2006, the National Federation of the Blind (NFB) brought a class action lawsuit against Target, regarding access to the Target.com Web site by blind people. The NFB claimed that blind people were unable to access much of the information on Target.com, nor purchase anything from the website independently, violating the California Unruh Civil Rights Act, the California Disabled Persons Act, and the Americans with Disabilities Act of In 2009, the judge on the case additionally awarded $3.7 million in attorney s fees and costs to the NFB. 2 Source: US Census Bureau 3 Australian Bureau of Statistics 2003, Disability, Ageing and Careers: summary of findings cat No , ABS Canberra. 1

4 Again, using Australia as an example, WCAG 2.0 compliance is now mandatory across federal, state and local government sites. WCAG 2.0 establishes an improved level of accessibility, to cater to the needs of a constantly evolving and increasingly dynamic web environment, according to a 2010 report, Web Accessibility National Transition Strategy, which further states that never before [has Australia] embarked upon such a significant effort to improve website accessibility, delivered on a whole-of-government basis, with strengthened governance and reporting arrangements in-built. Sitecore Reduces the Friction in Achieving Content Compliance As companies strive to achieve content compliance, today s enterprise websites present a dual vulnerability: existing content, and new content that is being created daily, may both be non-compliant. Sitecore addresses both, taking a comprehensive approach to mitigating the inherent risk of publishing content on any website. With transparent workflow, validation and real-time compliance checking of new content, and integrated applications to assess and remediate existing content, Sitecore greatly reduces the friction the time, effort and cost of achieving content compliance. In doing so, the Sitecore solution: Empowers content creators to focus more on the overall quality of their content, while speeding its publication to the web Easily monitor their sites for and site quality issues. As a result, companies that choose Sitecore mitigate their downstream risk associated with poor content compliance, while effortlessly serving a larger audience. At the Point of Content Creation: Native Compliance Capabilities Many systems can only show compliance errors after the content is published. Sitecore provides embedded capabilities that allow companies to keep non-compliant material from ever going live on a site. The Sitecore system provides two key native functions, workflow and validation, that help ensure content is created in compliance with any number of specified internal and Sitecore Workflow: Superior Support for Compliance Many workflow engines don t allow the level of customization necessary to streamline the content compliance process. The Sitecore platform allows for very tight integration; compliance validation can be incorporated directly into the Sitecore client, instead of bolting it on after the website goes live. Additionally, the Sitecore client is built to be fully extensible, allowing the integration to appear seamlessly in the user interface. This is illustrated in Figure 2 (page 4), which shows how the Sitecore system delivers validation directly in the Content Editor. Sitecore holds patents on the side bar indicators that show the user the non-compliant items and fields in the Content Editor. external guidelines thus preventing the publication of non-compliant material, and saving untold resources from having to correct or otherwise remedy compliance breaches. 2

5 Sitecore Workflow: A Flexible, Integral Component Sitecore Workflow provides strong, permissions-based, customizable workflow processes for versioning, approvals, incremental publishing, notifications and archiving. Companies can create multiple workflows to meet a variety of needs; approximately 20% of Sitecore customers have more than three workflows, with half of this group using six or more. 4 Sitecore Workflow is state-based; a content item moved from one state (such as Draft) to another (Approved) through commands (such as Approve or Reject ) that correspond with buttons in the Sitecore interface. Permissions are applied directly to the command. For example, in many organizations, anyone can submit a content item from draft mode, but only a select group can approve or reject a content item. Content Contributors Content Approval Content Published Figure 1: Sitecore allows a democratic approach to content creation, while maintaining strong control over published content. In addition to controlling content s progression from one state to another, commands can also trigger actions. An action is a task that the system performs, such as publishing content or sending an notification to an editor. Actions are based on conditions that are easily configured. Figure 2: Sitecore s graphical, permissions-based workflow facilitates speedy, secure approval processes. For example, when the Approve button is clicked by the appropriate party, the Approve command is triggered. The workflow is configured so the Approve command triggers a Validate action, which then triggers the content validation process. The content validation process has one of two possible results: 4 Source: Sitecore Support 3

6 validation passes or validation fails. If validation passes, the content is moved to the next state, Approved. If validation fails, the content is moved to the Needs Correction state, and can even be rerouted to a compliance specialist for correction. When the content enters the Approved state, the workflow, which has been previously configured, triggers an action that automatically publishes the content. Content Approved Validation Pass Approved & Auto-Published Fail Compliance Specialist Needs Correction Figure 3: Sitecore s workflow incorporates an automatic validation step. Flexible, Permissions-based Workflow Enhances Security and Compliance In the Sitecore system, the concept of workflow is pervasive and can be flexibly applied. Options include: A generic approval process workflow can be applied across the site. Access to workflow approvals can be differentiated among multiple users or groups, and permissions applied on an individual item basis. Permissions on the content dictate who has the ability to control the item through workflow. Workflows that are applied to individual items are inherited by default. For example, different products within a product family can have different workflows, and different types of content items can have the same or different workflows. Publishing a web page and a news article on the same product may have the same or different workflow. These examples are just a few that illustrate how Sitecore s workflow adapts to companies business practices not the reverse. For security, Sitecore s approach assigns permissions to individual items, a workflow, a workflow state or a workflow command. Based on the type of object selected, different permissions can be applied to individuals, roles (such as Content Editor or Content Manager), or groups to which individuals belong. A combination of permissions set on content items themselves, and also on workflow commands, determine how who is able to control what on the website, providing strong audit trails and enhancing compliance. Sitecore Validation Delivers Integrated Content Validation The Sitecore solution offers integrated validation capabilities that are triggered at two points: first, as content is being entered into the system and second, as a part of a workflow. 4

7 Configured by an administrator through an easy to use validation rulebook, real-time validation occurs transparently, as a background process in the Sitecore Content Editor. It guides users to create appropriate content that complies with specified internal and external guidelines, at both item and field levels. Validation rules that run in the Content Editor are highly configurable; administrators can determine which validations will run based on specific triggers. Item-level validation (such as full-page XHTML validation) can apply to an entire content block; different validation rules can be applied to different fields, such as phone numbers, company/division spelling, etc. These types of rules prevent authors from entering content that is incorrect or does not meet company standards. The Content Editor also has workflow validation. As shown in Figure 2 on the previous page, each button triggers a workflow action that checks content against a set of validation rules. Each item can have its own associated validation rules, coupled with workflow. Users may also identify which validation rules they want, regardless of the context of the content. HiSoftware Compliance Sheriff for Sitecore App Center, described in Section III, is a prime example of how a distinct set of validation rules can be invoked. Sitecore was able to plug into this industry-leading solution by taking advantage of the extensibility built into Sitecore validation framework. This framework was designed for easy integration. To incorporate external compliance checking with Sitecore s existing compliance and validation functionality, a custom validation rule was created, which invokes the web service-based API to HiSoftware Compliance Sheriff for Sitecore App Center. Once this validation rule was created a straightforward process it could be used anywhere in Sitecore where validation rules are supported. This includes on-demand validation that is triggered by the Validation button, and real-time validation that is controlled by the Sitecore client application. As shown in Figure 4, Sitecore s user interface is so extensible that additional or third party validation functionality can be seamlessly incorporated simply through configuration; no programming or development is necessary. Figure 4: When the Validation button is clicked in the Sitecore interface, content can be transparently validated against internal guidelines. It can also be validated with add-on modules like HiSoftware Compliance Sheriff for Sitecore App Center, which immediately displays detailed results. 5

8 These same processes may be applied to any custom validation rules a company may want to invoke on a product or organizational level. HiSoftware Compliance Sheriff for Sitecore App Center: Comprehensive, Customizable, Cloud-based Available through the Sitecore App Center an online marketplace of pre-integrated, on-demand applications, services, and integration solutions developed for Sitecore s Customer Engagement Platform Sitecore provides enhanced compliance capabilities that validate web content and applications against standards-based and organization-specific policies. HiSoftware Compliance Sheriff for Sitecore App Center is based on industryleading compliance technology from HiSoftware, which continuously maintains and updates the Sitecore solution with the most up-to-date compliance policies and regulations. The tool integrates seamlessly into the Sitecore environment, allowing organizations to validate web content and applications, and ensure: Privacy, including the disclosure of personally identifiable information (PII) Accessibility by sight-impaired individuals Site quality. These policies, which translate into more than 20 compliance validation checkpoints, incorporate the current standards outlined by US Section 508, US Section 208 (privacy), and WCAG 1.0. and 2.0. Figure 5: HiSoftware Compliance Sheriff for Sitecore App Center integrates enhanced compliance-checking capabilities into the familiar Sitecore interface. 6

9 Sitecore Offers Cloud and On-premise Options In addition to the cloud-based version of HiSoftware Compliance Sheriff for Sitecore App Center, an on-premise version is also available. It can be easily modified to incorporate any number of company-specific compliance checklist items. Addressing Existing Compliance Exposure Beyond validating content for compliance when it is created, HiSoftware Compliance Sheriff for Sitecore App Center helps companies address an even larger area of potential risk: compliance of existing content. It provides comprehensive testing and monitoring features to assess the compliance of existing content. The solution then produces detailed reports on areas of exposure, as well as guidance on remediation. At the request of a user or administrator, and monitored on scheduled intervals (such as every five minutes, daily, monthly or quarterly) to meet specific needs. Some industries, such as financial services and government, have more stringent compliance requirements than others, such as consumer electronics, and thus benefit from frequent monitoring. Compliance levels of live content can be scanned on-demand. For example, the Audit Report ranks non-compliant content by severity, helping to prioritize remediation efforts. This streamlines the compliance burden, allowing Sitecore to further reduce the friction in achieving content compliance on enterprise websites and intranets. Figure 6: The Audit Report provides validation results, helping to focus resources to address the areas of highest risk exposure, first. source: HiSoftware 7

10 Why a Pervasive Approach to Content Compliance? The Multiplier Effect Compliance traditionally has had a punitive connotation. Certainly, the business risks of poor content compliance are highly negative: lawsuits, penalties, remediation costs, and untold damage to reputation, brand and future revenues. Along those lines, Sitecore s end-toend approach to seamlessly integrated compliance helps to: Assure compliance with federal and international accessibility guidelines, reducing the risk of litigation and penalties. Prevent privacy breaches involving personal information. Sitecore s pervasive, transparent approach to compliance which combines real-time validation, checking and security-conscious workflow with monitoring and remediation also has a positive, enabling effect. By reducing the friction of compliance, Sitecore lessens associated time, cost and resource requirements. With Sitecore, companies can: Empower content creators to focus more on the overall quality of their content, while speeding its publication to the web. Architecture Highlight: How Sitecore Enables Greater Accessibility The Sitecore system is designed to help companies make their websites more accessible to sightimpaired visitors. For example, if Sitecore senses an incoming request from someone using an assistive reader for a blind person, it can automatically switch the presentation to give that user the highly accessible version of the page. This is accomplished through one of the fundamental tenets of the Sitecore architecture, which separates content and presentation. Sitecore website pages are dynamically created at a granular level by assembling each piece of data (content) for that page. Like pieces in a jigsaw puzzle, the content presented on one page can easily be reused and redisplayed on dozens of other pages, and in different ways or combinations, as appropriate. Content can comprise text, images, video, tables or other content format. In this way, by separating content from the presentation, a page for a sight-impaired visitor would be automatically assembled using the proper elements. Increase site usage by making all of their web properties accessible to people with disabilities. Specifically, Sitecore sites achieve a high level of W3C and accessibility compliance by providing more than simple template checking. Sitecore additionally manages ongoing content creation, providing authors with built-in accessibility checkers. Easily monitor their sites for brand integrity and site quality issues, to promote site excellence. These issues, which are particularly vexing for large/global organizations, include broken links and typos. Together, these strong compliance benefits allow companies to maximize the value users receive from all of their web and intranet assets while reducing the omnipresent risk of compliance failure. 8

11 For more information about Sitecore, the App Center and HiSoftware Compliance Sheriff for Sitecore App Center, please visit About Sitecore Sitecore redefines how organizations engage with audiences, powering compelling experiences that sense and adapt to visitors both online and in-person. Sitecore s leading Content Management System software is the first to cohesively integrate with marketing automation, intranet portal, e-commerce, web optimization, social media and campaign management technologies. This broad choice of capabilities enable marketing professionals, business stakeholders and information technology teams to rapidly implement, measure and manage a successful website and digital business strategy. Businesses can now easily identify, serve and convert new customers with Sitecore s Digital Marketing System, part of its encompassing Customer Engagement Platform. Thousands of public and private organizations have created and now manage more than 32,000 dynamic websites with Sitecore including, ATP World Tour, CA Technologies, Colliers International, Comcast, Heineken, Microsoft, Nestlé, Royal Navy, The Knot, TOP-TOY, Visa Europe and Verizon. For more information, please visit 9