How To Manage Data In Hk Kong

Transcription

1 Digital Data Archiving Nice to Have or Need to Have? For ISACA Presentation

2 Introduction: AXS-One - Established over 28 years ago - AMEX listed for over 10 years - Prestigious established customer base within Financial Services, Pharmaceutical, Manufacturing, Transportation, Logistics and other industries for over 10+ years 2

3 A glossary of terms What is digital data? dig i tize dɪdʒ ɪtaɪz/ Pronunciation Key - Show Spelled Pronunciation[dij-i-tahyz] Pronunciation Key - Show IPA Pronunciation verb (used with object), -tized, -tiz ing. Computers. 1. to convert (data) to digital form for use in a computer. 2. to convert (analogous physical measurements) to digital form. What is archiving? ar chive Show Spelled Pronunciation[ahr-kahyv] Pronunciation Key - Show IPA Pronunciation noun, verb, -chived, -chiv ing. 1. Usually, archives. documents or records relating to the activities, business dealings, etc., of a person, family, corporation, association, community, or nation. 2. archives, a place where public records or other historical documents are kept. 3. any extensive record or collection of data: The encyclopedia is an archive of world history. The experience was sealed in the archive of her memory. verb (used with object) 4. to place or store in an archive: to vote on archiving the city's historic documents. 3

4 A glossary of terms Source: Merriam-Webster Online Dictionary Governance is about leadership, financial and operational management standards adhering to international best practices. The need for compliance with external regulatory requirements and heightened awareness over information security has meant a requirement to plan policies on how to use IT effectively across the whole organization. Creation of specific governance committees and ROI evaluation to identify which solutions will deliver value are key steps Source: Computerworld, 25 March 2005 Adoption of best practices will result in compliance and good governance! 4

5 If you have any of these solutions implemented.. The core systems required to run your business, usually stored in a RDBMS Designed to enable the consolidation of structured data from various disparate systems for reporting and analytics across the organization DOCUMENT MANAGEMENT SYSTEM: Designed to enable the tracking of documents as they go through various iterations and are handled by different people 5

6 You will also be experiencing these problems. Access time Increasing Search Time Increasing Memory Problems (RDBMS) Increasing Backup Times Increasing Maintenance Windows Decreasing Database Handling More Complex Document Handling Outward Image Storage (PO s) Inward Image Storage (Supplier Invoices) 6

7 The ongoing challenges for IT are.. Leveraging technology investments to date while ensuring operational efficiencies Managing storage and associated infrastructure costs 7

8 considering governance and compliance Identifying, tracking, retaining and accessing information a compliance issue 8

9 understanding that.. Corporate officers, legal counsel, CFO s, CEOs, CIO s and middle managers will be held accountable for records management failures by investors, shareholders, statutory and regulatory bodies. This compliance risk goes to the heart of an organisation s policy, statutory, legal and regulatory obligations, the effectiveness of its internal policies, procedures and controls, using technology as an enabler. 9

10 Is back-up good enough? Architecture Internet Financials Data & Documents SCM Data DMS Filenet/ Documentum Other Apps Transaction Data CRM Siebel Router Firewall Mail Gateway Firewall and/or File Server Storage Devices: Disk/Tape/Jukebox/SAN/NAS 10

11 Not anymore While some problems may be solved with backups. Access Time Can be managed by taking older data offline Search Time Can be managed by taking older data offline Memory Problems (RDBMS) Can be managed by taking older data offline Backup Times Can be managed by taking older data offline Maintenance Windows Can be managed by taking older data offline Database Handling Can be managed by taking older data offline Document Handling Can be managed by taking older documents and images offline Other have been created Access Time Increased complexity in retrieving current and historical data Increased costs in retrieval of historic information from tape Search Time Increased complexity in searching across current and historical data Maintenance Windows Who manages the retention and destruction of the data in accordance with internal policy and external statutory, legal and regulatory requirements? Document Handling Who manages the retention and destruction of the data in accordance with internal policy and external statutory, legal and regulatory requirements? 11

12 Why are these issues critical? Data Retention/Management/Destruction 65% of companies lack retention policies and procedures 94% of companies fail to retain & archive instant messages (Source: Osterman Research) 33% of senior executives and subject matter experts interviewed said their company had no policy in place around digital data and 20% did not know. (Source: Rules about to change in e-discovery game, Nov 2006) Data Retrieval 71% of organizations have been required to search through back-up tapes to retrieve one or more electronic records in response to a request from legal, HR, 39% of organizations have been ordered by a court or regulatory body to produce employee (Source: Osterman Research) 12

13 Why are these issues critical? Data Retrieval (cont d) 36.4 % of senior executives and subject matter experts interviewed said their companies had no technologies or policies in place to manage a legal discovery order involving electronic records Companies with annual revenues greater than US$1 billion dollars are sometimes juggling as many as 147 lawsuits simultaneously Companies with annual revenues less than US$1 billion dollars are sometimes juggling up to 37 lawsuits simultaneously One third of firms surveyed spend 2% of gross revenues on litigation expenses, while 10% spend over 5% of gross revenues. (Source: Rules about to change in e-discovery game, Nov 2006) Data Supervision 50% of workplace IM users send/receive risky content including attachments, jokes, gossip, confidential info, porn, etc. (Source: Osterman Research) 13

14 Why are these issues critical? Retention, Management, Retrieval and Disposition. In HK HK Companies Ordinance of 1984: every company must keep proper books of account preserved for seven years from the end of the financial year to which the last entry made or matter recorded in them relates. Inland Revenue Ordinance of 1977: must retain such records for a period of not less than seven years after the completion of the transaction Personal Data (Privacy) Ordinance of 1995: A data user has a duty to comply with a valid data access request not later than 40 days after receiving that request. Difficulty in searching through records (whether electronic or otherwise) is not regarded as a good excuse for failing to meet the timetable. 14

15 Why are these issues critical? Retrieval, Search and Destruction. In HK Basic Law, the rules of court procedure in Hong Kong of 1990: if the parties and their legal advisers do not adopt a 'sensible and responsible approach in dealing with discovery', they face cost penalties meted out by the Court The Electronic Transactions Ordinance of 2004: "Without prejudice to any rules of evidence, an electronic record shall not be denied admissibility in evidence in any legal proceeding on the sole ground that it is an electronic record" HKMA Supervisory Policy Manual: ensure that all media are adequately protected, and establish secure processes for disposal and destruction of sensitive information in both paper and electronic media 15

16 Why are these issues critical? Retention, Management, Retrieval and Disposition elsewhere Japan: A version of Sarbanes-Oxley is due to be released in Japan before the end of 2006 Australia: Attorney-General, Rob Hulls said Victoria will be the first State to create a specific Why are these document issues critical? In destruction HK offence whereby a corporation and its employees can be prosecuted in circumstances where there was no direct instruction to destroy a document but it was implied by the corporation s culture. In addition to a jail term, individuals can be fined up to $62,886 and corporations can be hit with a $314,430 fine. US: On December 1, 2006, several amendments to the Federal Rules of Civil Procedure regarding a company s duty to preserve and produce electronically stored information, in the face of litigation - or pending litigation, is scheduled to take effect. 16

17 Why are these issues critical? Operational Risk Mitigation Source: Wall Street Journal Asia, 13 Feb

18 So what does all of this mean? Let s get back to the basics of the business process from a non-digital perspective, and ask yourself the following questions: 1. Who is the owner of the business process? 2. Who is the owner of the data being stored? 3. How often will the data owner or other interested parties need access to this data? 4. How long does this data need to be kept? 5. Who is responsible for the destruction of this data? So why should IT be responsible for the storage, management, access and destruction of this data, when all they have done is provide technology tools to enable the automation of the above traditional business process? 18

19 So what does all of this mean? ARCHIVE!! Archiving solutions should solve the BUSINESS of digital data retention, management, retrieval and disposal using TECHNOLOGY as AN Architecture ENABLER Internet Financials ERP DMS Data & Documents Data Filenet/ Documentum Other Apps Instant Message Transaction Data IM Router Firewall Mail Gateway Archive Server Firewall and/or File Server Storage Archiving Process Retrieval Process Retrieval Process Web Server 19

20 ARCHIVE for Operational AND Business Benefits Message Management Lotus Notes MS Exchange IM 250 File Types Word Docs Adobe PDF PowerPoint Excel Text Reports PCL 5 AFP Meta Code EBCDIC Text Object Types Voice Video IP Traffic To benefit the business: Storage optimisation Migration/consolidation of data Operational efficiencies Compliance Knowledge exploitation Search Disclose Share Retain/Delete Case Management Supervise Policy Driven Archiving Compress Single Instance Index Future Proof Shortcut/Stub Categorise 20

21 Common Myths/Misconceptions about ARCHIVING Compliance is a costly exercise I need separate solutions to manage all of my corporate data Archiving will enforce/enhance our risk management strategy The main driver for compliance activities is the fear of the consequences of non-compliance There are no strategic solutions available in the marketplace just point solutions Corporate governance encompasses regulatory compliance, legislative compliance and adhering to internal policies The only positive consequence of being compliant is staying out of jail 21

22 ARCHIVE solutions come in different forms Enterprise Content Management (ECM) is any of the strategies and technologies employed in the information technology industry for managing the capture, storage, security, revision control, retrieval, distribution, preservation and destruction of documents and content. ECM especially concerns content imported into or generated from within an organization in the course of its operation, and includes the control of access to this content from outside of the organization's processes. Information Lifecycle Management refers to a wide-ranging set of strategies for administering storage systems on computing devices. Specifically, four categories of storage strategies may be considered under the auspices of ILM: Policy Management Operational Infrastructure Source: 22

23 ARCHIVE solutions come in different forms Records Management is the practice of identifying, classifying, archiving, preserving, and sometimes destroying records. ISO 15489: 2001 defines records management as, "The field of management responsible for the efficient and systematic control of the creation, receipt, maintenance, use and disposition of records, including the processes for capturing and maintaining evidence of and information about business activities and transactions in the form of records". Source: Companies should look for solutions to support multiple regulations and multiple business units Source: Business Wire, 12 December Through 2008, Investment in new technologies will slow as discretionary budgets are diverted to regulatory compliance projects. 23

24 ARCHIVE with Retention and Disposition Rules Scanned Category: Finance HR Personal Unknown Invoice Purchase Order Payable etc Sick Leave Annual Leave Resume etc Home Lunch Joke etc Retention: 7 Years Tape 12 Months Disk 30 Days Disk Indefinite Disk Destruction: 24

25 ARCHIVE with Portal Access to ALL Data 25

26 ARCHIVE with Portal Access to ALL Data 26

27 ARCHIVE with Portal Access to ALL Data 27

28 A few suggestions Ensure there are written policies for traditional and digital record retention, management and disposal. Educate users on these policies Educate users regarding the impact of internal policy and external regulatory requirements on their use of , IM and SMS tools for business purposes. Implement the defined policies and associated procedures Determine IT strategy based on the tools required to support the policies and processes defined, implemented and communicated. 28

29 Corporate-wide benefits of ARCHIVING Compliance Operational Efficiency Compliance Policy adherence Statutory adherence Regulatory adherence Discovery Forensics Storage Management Operational Efficiency Reduced TCO System performance improvements Shortened backup timeframes DIY search and retrieval Achieve quick and measurable ROI Greater Knowledge Exploitation Storage Management Primary storage burdens eased SIS and Compression Data management and disposal Integration of data from disparate systems 29

30 DIGITAL DATA ARCHIVING: Nice to Have or Need to Have? Information Repository Risk Assessment Corporate Confidence BPR Corporate Governance Components Policies/Procedures Company Activities IM Memos/Spreadsheets Transactional Data Identification and resolution of non-compliant activities 30