WHITE PAPER. Deficiencies in Traditional Information Management

Transcription

1 WHITE PAPER Deficiencies in Traditional Information Management

2 Table of Contents 3 Abstract 3 Information Management Defined 7 Problems with Traditional Approaches 8 Conclusion Table of Figures 5 Figure 1 The CGOC Survey Results 7 Figure 2 Traditional Archive Systems 2

3 Abstract Traditional approaches to information management are facilitated by classical systems of the following type: Records management and Enterprise content management (ECM) systems Archive systems The approaches advocated by these systems are plagued by deficiencies challenged further by the evolving data landscape of ballooning data volumes and also the emergence of the cloud as a major repository of data. This paper examines information management under traditional approaches in light of these new developments. It also discusses the specific limitations and problems that arise from attempting to use old approaches to govern today s information landscape. Information Management Defined What, exactly, are the characteristics of an information management solution? Most organizations are dealing with many of the drivers (as illustrated below) when trying to manage their information. The ability to address these issues effectively will determine if an organization will be successful in defining the best solutions and finally getting control of all of their information. End-User Productivity ediscovery Information Management Drivers Regulatory Compliance Defensible Deletion Security/ Privacy 3

4 Let s look at each of these information management drivers in more detail: End-User Productivity End-user productivity is adversely affected by a lack of information management in two ways. First, without IM, employees spend time managing their work files, contacts, s and attachments. This management time includes reviewing content, deciding whether a particular file or should be kept or deleted, deciding how long required s will be kept and where, and finally, moving these files to the final storage location. Many research organizations and experts have advised that this management time is estimated at anywhere from two to four hours per week. Consider a conservative example of two hours per week for this activity: this translates to 104 hours per year per employee or, for an organization of 5,000 employees, 520,000 hours per year devoted to individually managed data that may or may not have been performed efficiently or effectively. A second measure of lost employee productivity is in the number of hours per week that employees spend searching for information within the enterprise. Organizations without an information management program usually don t actively manage employee file shares. When searchable central indexes are not available and SharePoint searches have been underutilized, simple keyword searches rarely produce the results the employee is looking for in a timely manner, if at all. In some cases, the information might not be found due to weak search terms, poor file naming, or the fact that the file wasn t actually saved at all (i.e. the employee just thought it was). Risk of Non-Compliance In the 2013 AIIM Industry Watch: Information Governance report, 49% of survey respondents indicated that they had experienced issues with regulatory authorities due to a lack of complete electronic information. Regulatory Compliance The regulatory environment is quickly changing; it is becoming tougher. Organizations are dealing with increasing numbers of government regulations and more aggressive enforcement actions. Examples of these regulations include SEC 17, FINRA 3010/3011, Solvency II, Dodd-Frank, FAR, HIPAA, the Gramm-Leach-Bliley Act, Sarbanes-Oxley, Bill 198, Basel III, the Volcker Rule, employment- based regulations, and upcoming changes to the European Union Data Protection Directive. Because of the increase in enforcement actions, many General Counsels have moved towards retaining everything forever. The obvious problem with this strategy is that keeping information is only half of the regulatory requirement (and this goes above and beyond information privacy policies that require certain information to be corrected, amended or deleted). When an organization receives an information request from a government agency, it must be able to find and turn over the information relatively quickly. If the content is spread across the enterprise, much of it controlled by individual employees, then the risk of non-compliance rises significantly. In the 2013 AIIM Industry Watch: Information Governance report, 49% of survey respondents indicated that they had experienced issues with regulatory authorities due to a lack of complete electronic information. Security/Privacy Employees increasingly have access to gigabytes or terabytes of organizational information with a single click. As the communications, groupware and collaboration capability of enterprise applications have been adopted, protecting against the leakage of sensitive information has become extremely challenging for all sizes of organizations. 4

5 Enterprise security comprises two main objectives: the protection of intellectual property (IP) and customer/employee personally identifiable information (PII). The loss of IP and leakage of trade secrets are a continuing liability for companies as a direct result of this information being easily copied and moved out of the company via , IM or employee use of rogue clouds. Huge investments in IP and organizational know-how can be lost in the blink of an eye or the drag of a mouse. Knowledge based on reason An effective, ongoing defensible deletion process is dependent on an effective information management capability. To defensibly delete information no longer needed, an organization must know what information should be kept and for how long based on regulatory, legal and business value reasons. Many countries including the United States and Canada, as well as specific industries around the world, have strict laws for securing and controlling access to PII. Examples of PII include Social Security or Social Insurance numbers, bank and brokerage account numbers, personal addresses, driver s license numbers, and PII. Penalties for the leakage of PII have risen dramatically in the last several years. For example, under the new U.S. Health Insurance Portability and Accountability Act (HIPAA) Final Omnibus Rule, covered entities and business associates responsible for violating HIPAA privacy and security rules by failing to safeguard patient protected health information could face a potential of up to $1.5 million in annual fines. Defensible Deletion The Compliance, Governance and Oversight Counsel (CGOC) conducted a survey in 2012 demonstrating that, on average, 1% of organizational data is subject to litigation hold, 5% is subject to regulatory retention requirements and 25% had some business value (see Figure 1 below). This means that approximately 69% of any organization s retained data has no business value and could possibly be disposed of without legal, regulatory or business consequences. Business Value 25% Litigation 1% Regulatory 5% Redundant, Obsolete, Transitory Information 69% Figure 1 The CGOC Survey Results 5

6 As has been pointed out by Magistrate Judge Andrew J. Peck, a lecturer and author regarding issues relating to ediscovery, organizations are not disposing of unneeded information in a systematic process mainly because they aren t managing their information on an ongoing basis. By default, they end up keeping everything. Instead, organizations should focus on adopting an information management program that includes proactively removing unneeded or valueless information to save on storage an approach that makes information retrieval easier while reducing the risks and costs associated with ediscovery. An effective, ongoing defensible deletion process is dependent on an effective information management capability. To defensibly delete information no longer needed, an organization must know what information should be kept and for how long based on regulatory, legal and business value reasons. Part of the reason ediscovery is so expensive is because companies have so much data that serves no business need. Companies are going to realize that it s important to get their information governance under control to get rid of all the data that has no business need in ways that will improve the company s bottom line Judge Andrew J. Peck, U.S. Magistrate ediscovery The ediscovery process continues to be an extremely costly and tedious process. In many cases, organizations that are repeatedly forced to comply with ediscovery requests may not recognize the direct connection between the cost of discovery and the effectiveness (or ineffectiveness) of their information management capability. According to the RAND Institute for Civil Justice report entitled Where the Money Goes 1, the ediscovery document review process consumes more than 70% of every dollar spent. This fact is important when discussing information management (or the lack of it) because organizations create/receive and stockpile so much digital data that the amount of reviewable content for even a single lawsuit can easily reach into the millions or billions of pages of reviewable content. A respected U.S. Magistrate, Judge Andrew J. Peck, stated in a video interview on February 4, 2013: Part of the reason ediscovery is so expensive is because companies have so much data that serves no business need. Companies are going to realize that it s important to get their information governance under control to get rid of all the data that has no business need in ways that will improve the company s bottom line Discovery, if not done in an expedient and good faith manner, can result in huge fines, the potential loss of a case, and responsibility for all court costs not to mention negative impact on an organization s public reputation. An effective information management capability greatly reduces the risk of inadequate ediscovery response by ensuring all relevant content can be easily identified and preserved

7 Problems with Traditional Approaches Both of the traditional approaches to information management i.e. records management/ecm systems and archive systems are prone to deficiencies that hinder not only the ability to address the five drivers just described, but also work against an organization s ability to find the best possible solutions. Not good enough Next-generation records and information managers recognize the importance of working with IT to bring all information into the scope of management. They are concluding that traditional methodologies and technologies are lacking, particularly in the following ways: Regulatory compliance requires actionable intelligence over corporate data, wherever it resides and no matter what stage in the information lifecycle it is. Litigation is an unpredictable event that can turn any information into a record in an instant, no matter what stage in the information lifecycle it is. End-user productivity is hindered when the burden is on the end-user to manage the information. Not only do some end-users not follow through, but results from one end-user to the next will be inconsistent. Records Management & ECM Systems In reality, traditional records management and ECM systems only manage a small percentage of an organization s total information. A successful implementation is often considered 5% of the information that exists. What about all the information not found in the records system? As organizations adopt the cloud, information management capabilities need to extend there as well. Unfortunately, many of the traditional records management approaches and tools meet a hard wall with the cloud because cloud-based systems demand new interfaces and approaches for working with information. In essence, the cloud necessitates the renewal of records management thinking as it applies to digital information. Archiving Systems Traditional archiving systems tend to store everything and for the most part, they result in organizations keeping information forever. Data volumes and the data landscape have changed dramatically since archiving systems became widely adopted. Some organizations are discovering the high cost of getting their data out while others are experiencing end-user productivity issues, incompatible shortcuts and a lack of support for the modern interfaces through which users expect to access their information. As a result, modern-day organizations are concluding that archiving systems are lacking in the following ways, s described in Figure 2 below: 1 2 Cloud File Servers Exchange SharePoint Servers Other Systems 3 Archiving Servers Indexing Servers Query/Retrieval Servers 4 5 Archive Storage Index Storage RDBMS Archiving of cloud-based systems is often unnecessary and inefficient. Large impact on production servers. Items must be opened/copied. Stubs require agent installation or configuration changes. Large server infrastructure demands for archiving, indexing and query/retrieval services. 4 Data stored in proprietary format. Vendor lock-in. 5 Large storage demands for full-text indexes (30-120% of the original data size). Negates any savings from de-duped/compressed archive storage. Figure 2 Traditional Archive Systems 7

8 Conclusion Traditional approaches to information management are, in general, not suitable to meet today s information management needs. The foundational move-to-manage premise is expensive, fraught with difficulties and antithetical to modern data repositories that (a) are either cloud-based, (b) have built-in governance tools, or (c) contain data that best resides in the native repository. The unstructured data problem, along with the emerged reality of the cloud, have brought us to an inflection point: either continue to use decadeold, higher-cost and higher-risk approaches to manage huge quantities of information and pay the consequences, or proactively govern this information to more effectively identify, organize and advance the best possible outcomes for security, compliance, litigation response and innovation. Today s enterprise-ready hardware and storage solutions as well as scalable business productivity applications featuring built-in governance tools are both affordable and easily accessible. For forward-thinking organizations, there is no question that in-place information management is the most viable and cost-effective methodology for information management in the 21st century. About Acaveo Based in Ottawa, Canada, Acaveo develops software for information managers, IT storage administrators and ediscovery professionals to simplify information governance with unified, in-place management of unstructured information existing in the wild. Acaveo s simple yet powerful solutions make it easy to analyze and classify information, take actions to defensibly reduce and organize storage, streamline in-house ediscovery and proactively govern information assets to improve security and compliance. For more information, please visit Acaveo Headquarters World Exchange Plaza 45 O Connor St. - Suite 1150 Ottawa, ON K1P 1A4 Canada t: 1 (613) e: Acaveo Inc. All rights reserved. Acaveo and Smart Information Server are registered trademarks of Acaveo Inc.