Information Governance in the Cloud

Transcription

1 Information Governance in the Cloud Interoperability and Transfer Requirements Lori Ashley - Tournesol Consulting ARMA Chicago Chapter September 9, 2014

2 Position Statement Continuity of digital information across time and systems requires planning, governance, resources, and an awareness of file formats, standards, and computing trends Capabilities to transfer complete digital objects and their related metadata between systems while retaining ownership, privacy and security rights is essential to records management 2

3 Definition: CHAIN OF CUSTODY n. ~ 1. Records The succession of offices or persons who have held materials from the moment they were created. The ability to demonstrate an unbroken chain of custody is an important test of the authenticity of records or evidence 3

4 Definition: DISPOSITION ISO Information and documentation Records management 3.9 disposition range of processes associated with implementing records retention, destruction or transfer decisions which are documented in disposition authorities or other instruments 4

5 Document Records Processes 5 ISO Information and documentation Records management All decisions on which records should be captured and how long records should be maintained should be clearly documented and retained Decisions may be presented as a disposition authority From DRAFT ISO Revision

6 Definition: INTEROPERABILITY 6 n. ~ Computing The ability of different systems to use and exchange information through a shared format. Interoperability in the technical sense tackles the problem of digital obsolescence by reducing the dependency of files and records on a particular combination of hardware and software.

7 The New (US Fed Gov) Default 7 To promote continued job growth, efficiency, and the social good, the default state of new and modernized Government information resources shall be open and machine readable. Government information shall be managed as an asset throughout its life cycle to promote interoperability and openness, and, wherever possible and legally permissible, to ensure that data are released to the public in ways that make the data easy to find, accessible, and usable. Executive departments and agencies shall ensure that they safeguard individual privacy, confidentiality, and national security.

8 Case in Point Australian National Archives Digital Transition Policy Records that are created digitally after 2015 will be accepted for transfer to the National Archives in digital formats only Requires all agencies to move to digital information and records management for efficiency purposes Where possible, incoming paper records will be scanned so that new paper files are not created 8

9 Trustworthy Digital Repositories 9

10 10 ISO 14721:2012 OAIS Reference Model

11 OAIS Reference Model Migration Types Refreshment Transferred (unchanged) from medium to medium of same type Example: Copying from one CD-R to another Replication Transferred (unchanged) from medium to medium of a different type Example : Copying from hard drive to CD-R 11

12 OAIS Reference Model Migration Types Repackaging Transferred (unchanged) into a different structure Example: Copying files from hard drive with large file directory structure to a CD-R with truncated file directory Transformation (reversible/nonreversible) Transferred and changed in the process Example: JPEG changed to TIFF 12 12

13 CASE STUDY County to State Archives County Recorder Offices custodians of public records Store and manage electronic filings (land surveys, maps and plats, etc) Statutory obligation to send specific types of filings to the State Archives Filings held by small third party vendor Impossible to export the records to the Counties or anyone else 13

14 Transfer Requirements Leveraging DoD STD and MoReq2 14

15 DoD Functional Requirements for records management software Defines required system interfaces and search criteria Describes minimum records management requirements based on current NARA regulations 15

16 DoD STD RMA Design Criteria Standard Current version signed 25 April 2007 Defines basic requirements based on operational, legislative and legal needs that must be met by records management application (RMA) products acquired by the Department of Defense (DoD) and its Components Defines requirements for RMA's managing classified records Includes requirements to support the Freedom of Information Act (FOIA), Privacy Act, and interoperability 16

17 Transfer Interoperability Context Management Writing Out Context Ingesting Context Linking Organization-defined Metadata Elements Transfer Schema Export Schema and Rendering Aids Records Elements 17

18 Record Level Elements Record Identifier Folder Identifier Title Creator Media Format Date Published Links to supporting records/files Original Content Open Content 18

19 In Addition to Core Records Elements Sender, addresses, subject, timestamps, attachments Scanned records Format, resolution and bit depth PDF records Application version, PDF version Digital photographs Caption Web records Platform, site name and URL, capture method and date 19

20 Lifecycle Phase & Transfer Access Control Lifecycle Phase Identifier Lifecycle Phase Name (File Room, Records Center, etc.) Lifecycle Phase Precedence User Rights Infrastructure set up RM administration Privileged user 20

21 Bulk Transfer & Records Folders Folder Identifier Record Category Identifier Last Disposition Action Last Disposition Action Date Final Disposition Action Final Disposition Action Date 21

22 Computer File Elements Unique File ID File Name File Extension Creating Application File Create Date File Size File Encoding Specific Security Computer File (binary content) 22

23 Security Marking Current Classification for DoD this means Confidential, Secret, Top Secret or other CAPCO marking Initial Classification Downgrading and Declassification 23

24 Record Category Record Category Identifier Record Category Description Disposition Authority Permanent Record Indicator Vital Record Indicator Vital Record Review and Update Cycle Period Disposition Level Record or Folder 24

25 Events & Triggers Event Identifier Event Name Trigger Identifier Trigger Type Trigger Mode Time Unit Time Unit Type Trigger Execution Date Lifecycle Start Date 25

26 MoReq2 Specification 26

27 Public Sector Example Bulk Records Transfer Transferring records and aggregations due to organizational changes and/or redistribution of business Transferring records and aggregations with archival value for permanent retention Transferring records and aggregations due to reasons such as corporatization, privatization or outsourcing 27

28 Cloud Computing Records Requirements Checklist 28

29 Disruptive and Transformative 29 SCALABILITY User can scale up or scale down quickly and cheaply DEVICE AGNOSTIC RESOURCE POOLING Users access cloud services over a network through a broad range of devices Significant economies of scale help reduce costs and speed innovation Qualities of Cloud Services METERING Users can measure their consumption of services quickly and easily and adjust accordingly CAPACITY ON DEMAND Service already exists and can be provisioned when needed, usually through self-service interfaces

30 Cloud Momentum A recent study by Compuware reported that cloud remains the highest IT investment priority and will continue to be the highest priority over the next five years Four out of five companies also revealed that they were worried about the potential hidden costs of cloud computing 30 30

31 Microsoft Privacy Case Has Cloud Industry on Edge Relates to court order to turn over s stored in Microsoft data center in Ireland Could spell trouble for privacy rights and international law, and also 31

32 Delaware Enacts Data Destruction Law 32 January 1, 2015 According to the National Conference of State Legislatures, by states had enacted laws requiring business entities to destroy, dispose or otherwise make personal information unreadable or undecipherable. Companies that do business in Delaware will be required to take reasonable steps to protect consumers personal information when disposing of business documents Provides customers with civil action Authority to AG

33 Match Consumer Requirements to Provider Capabilities Drivers IT efficiency, data center consolidation, cloud computing Requirements Reliability, interoperability, security and performance Process Negotiate relationships Match requirements to capabilities Vendor approval system/catalog 33

34 Vendor Lock-In and Interoperability Data portability is a key mitigating strategy against vendor or service provider lock-in Data liberation: Some vendors are taking steps to improve operability between providers and reduce vendor lock-in. Google s product Takeout for example allows users to migrate their data out of some Google products and into the systems of other vendors, and vice versa. 34

35 Checklist for Records Management and the Cloud Records in the cloud should be authentic, accurate and trusted Consider where your records are held Consider whether provider has sufficient audit management Evaluate the security Beware of multiple layers of third party providers 35 35

36 Checklist continued Records in the cloud should be complete and unaltered Consider the impact of altered records Specify migration, conversion and refreshment techniques for your providers Providers must obtain permission prior to conversion or migration of records Consider the format in which records are transferred, created or stored in the cloud 36 36

37 Checklist continued Records in the cloud should be secure from unauthorized access, alteration and deletion Consider who has access to and use of records Assess the provider s viability Consider the risks of incomplete destruction 37 37

38 Checklist continued Records in the cloud should be findable and readable Consider the readability and usability of records created or stored in the cloud Ensure records can be recovered Consider the metadata required to identify and retrieve records Assess the likelihood of vendor lock-in 38

39 Checklist continued Records in the cloud should be related to other relevant records Consider metadata maintenance and management Consider how records in the cloud related to records stored in-house Consider records classification 39

40 <Information System Name> Access to content is tracked and logged Strict security controls in certified computing facilities Redundancy in the storage architecture Line of sight into the content repositories Interoperability standards and protocols 40

41 Resources National Agenda for Digital Stewardship - US Digital Transition Policy - Australia Sustainability of Digital Formats - US Library of Congress FedRAMP Templates US General Services Administration (GSA) 41

42 42 Thank You! Contact me at Visit