Introduction to Cloud Information Management

Cloud computing is the ability to deliver computing resources as a service and these resources are made available over the Internet. A basic and well know example is Google s Gmail, in which Google owns all of the resources (hardware and software and storage of the emails) needed to deliver email to a user and the user does not own any software or hardware and either pays a fee for the service or may get it free. Cloud computing today encompasses all types of applications from simple online data storage to running highly specialized data processing applications. As defined by the National Institute of Standards and Technology (NIST) 1, cloud computing is a model for enabling convenient, on-demand network access to a shared pool of configurable computing resources (e.g., networks, servers, storage, applications, and services) that can be rapidly provisioned and released with minimal management effort or service provider interaction. This cloud model promotes availability and is composed of essential characteristics, deployment models, and various service models. This article takes a more narrow view of cloud computing and focuses on those aspects of cloud computing that relate to the delivery of content and records management services for public agencies, private companies, and individual users. Cloud-based collaboration is a subset of cloud computing and only exists within a cloud computing framework. More specifically, this paper will primarily focus on, as it relates to cloud-based technologies, applications, and services: Document Imaging/Capture Electronic Document Management/Collaboration Records Management Workflow Think of cloud information management (CIM) as a subset of the greater cloud computing technology applications. A point to keep in mind as you read this article is that the basic document management technologies listed above are essentially the same document management technologies that are available as purchased systems or, on-premise systems that you purchase. For the most part (highly qualified!), the cloud-based collaboration applications available today provide the same functionality that we are accustomed to: document check-in/out, version control, metadata/key work indexing, search, modifiable security (file, folder), records management, etc. The difference is that you no longer buy onpremise software licenses (either by users, servers, or transactions), you don t purchase and own application and storage servers, and associated computer room peripherals because you are effectively renting the application from the vendor as a service. You don t even need a computer room; just a fast Ethernet connection and you can have a completely functioning office in the cloud! 1 National Institute of Standards and Technology, The NIST Definition of Cloud Computing, document posted October 2009, http://csrc.nist.gov/groups/sns/cloud-computing/. Page 1 Copyright Porter-Roth Associates 2013

The technology that drives cloud information management (CIM) systems is the Internet. The Internet allows cloud computing resources to be made available and without an Internet connection, real-time access to your cloud applications cannot be made. For cloud computing to occur for the average user all that is needed is a device that can access the Internet and a fast Internet connection. These include desktop computers, laptops, tablets, and smartphones. A recent development is the ability to bring peripheral devices, such as a printer, online and into the cloud so that you can print from any device, including smartphones, to any printer that you can see and access. This means that you could print a document from your smartphone to a printer, for example a printer in any office, by simply being on the WiFi network in the building and discovering the printer s address. Today, it is possible for a company to operate completely in the cloud without any of the traditional IT infrastructure such as a computer room with servers and no IT staff is required. The computer room and IT staff is replaced by a cable and/or WiFi Internet connection provided by and maintained by an Internet service provider (ISP). Users access their work from any location, on different devices (laptop, smartphone, tablet), which also effectively eliminates the need for large dedicated offices. If needed, there are also cloud-based companies that specialize in cloud-based IT services and they will provide IT services that are needed including such things as setting up your security groups, connecting different applications together, and monitoring all of the different cloud services that you have. This all sounds really great and you may already be using a cloud-based file storage application but what are the risks involved? CIM systems do present significant risks to users that must be weighed against the potential benefits. These risks can be divided into the following major areas: 1. Physical security. Is your data as physically secure in a remote datacenter that you do not own or operate. Physical security applies to the ability to protect your data from unauthorized physical access and is the remote datacenter able to withstand a catastrophic event such as a fire, flood, or earthquake. 2. Data security. Is the data secure both on the servers and during transmission to and from the datacenter. Data could be compromised or stolen if the datacenter is breached by a hacker, virus, or any number of ways. Does the CIM vendor s datacenter(s) employ all the latest protection hardware and software to ensure that data is never exposed and if exposed is not viewable (i.e., encrypted)? 3. Internet connection. With any CIM solution, the data and application is only available via the Internet. This means that if your Internet is down or the Internet connection to the datacenter is down, your business is potentially down. 4. CIM vendor viability. If the CIM vendor, for whatever reason, ceases to exist or is subject to a legal shutdown, can you retrieve your data? It must be considered that any vendor, no matter how large, may be subject to some event that forces them to close their business with little or Page 2 Copyright Porter-Roth Associates 2013

no warning and if this happens, will your data be available and how long will it take to get your data if that is a possibility? The above risks should be considered as part of your overall plan to move content into a cloud-based application and part of your due diligence. Other risks are reviewed later in this article. In the AIIM report on Content in the Cloud, only 4% of the respondents had incidents of data loss, security intrusion or long-term unavailability from cloud applications. Of those incidents reported, only 2.5% reported actually losing data and 70% have been completely trouble free, while 26% have reported only minor incidents. Also, 37% of the respondents do not see data in the cloud as any more vulnerable than onpremise, including 10% who feel it is safer. Balancing the above risks are substantial benefits that can be immediately attained when a CIM system is implemented. On-demand Self-Service - User can order and provision services directly the user is empowered to acquire and maintain the application Basic site can be setup and operating within 30 minutes of provisioning the site User/owner can set libraries, folders, security, permissions, versions, workflows, and other aspects of site operation directly no IT required User can invite other users from within the company to share documents. You are able to identify an internal team and allow them access to the CIM site, which can be difficult internally without IT support. User can invite other users from outside of the company to share documents many projects require participation from people outside of your company and this is traditionally a problem for many companies event with IT support it may not be possible. Lower initial and startup costs when you implement a CIM system, there is no hardware or software to purchase, and no long implementation times since the system is built and only needs to be configured. No yearly major version upgrade costs CIM systems update automatically and frequently without your involvement for example how much does it cost to go from SharePoint 2003 to SP 2007 to SP 2010 how much did that cost in time, resources, and productivity? Measured service, pay as you go you can start a project with only 5 users and in 90 days, if needed, add another 5 users. No need to buy an initial seat license of 25 and have 20 seats not used. Also, (depending on your provider) you only pay for the storage you use, usually in gigabyte increments. No need to buy a server with 100 gigs that you won t need or use. Quality of service (SLA) reliable and available most CIMs have an uptime of 99.9% or better and also, most CIMs have a backup datacenter which is typically a real-time backup. This mean your data is available if you have an Internet connection. Highly scalable resources are available when needed and can be scaled up or down. Vendor provided maintenance there is no system hardware or software so there is no maintenance required for these sites. This can substantially lessen the cost burden when the average on-premise system is around 18% per year. Device independent (PC, Apple, Tablet, Smartphone) all CIM systems can be accessed via multiple devices including PCs or Apple. There are more benefits to be attained depending on your need and current company situation. These benefits should be considered a starting point and additional research will show that implementing a CIM system can be cost effective almost immediately. Page 3 Copyright Porter-Roth Associates 2013

Document Imaging/Capture Introduction to Cloud Information Management This is the ability to scan paper documents and have them stored in a cloud application. The cloud application may also include processing such as optical character recognition (OCR), converting the document to a PDF, or making the scanned document available for workflow processing for example. There are a number of vendors that have developed scanning applications to a cloud provider and this allows you to scan directly to the cloud application that you have established. Even if you don t have a direct connection established, it is still possible to move or copy scanned documents to a cloud environment but all processing has to be done prior to moving the file to Scan that cloud storage area. Processing of document images may include the following: Image clean-up and clarity/readability verification Convert image from TIFF to PDF or other format OCR image and convert for full text search Index image with established indexing terms One consideration to be aware of is that document images (TIFF, PDF, JPEG, etc.) are larger files than Office documents such as a MS Word, Excel, and PowerPoint files. Prior to committing to scanning to a cloud storage application, ensure that you understand the pricing model that is offered. If it is based on the amount of storage you use, ensure that you anticipate the amount of storage versus the costs. Also, consider whether the documents you are storing have a short or long-term lifecycle and that you have a procedure (such as records management) that tells you when a document can be deleted from the system. Otherwise, you may be facing large storage costs for documents that are no longer viable for your business purposes. As with your own on-premise systems, finding or searching for document images requires the image to either indexed with appropriate metadata or converted to text for full text searching via optical character recognition (OCR). If kept only as an image, such as a TIFF file, the only way to find or search for this file is by using the indexing or metadata attached to the file, such as File Name, Author, Scan Date, Vendor Number, and other metadata that has been entered for this file. If the image has been OCRed and converted to a PDF file, then contents within the file can be searched and the file retrieved. One note of caution is that an on-premise document imaging system typically uses a separate database to store the indexing information and this indexing information is not embedding in or part of the TIFF image itself. For example, if you are trying to index an image with vendor name, vendor ID #, vendor contract #, etc., this information is not stored in the image header and is therefore not transferred with the image to the cloud repository. If this type of functionality is needed, consult with the intended CIM provider to determine if this is possible. Ensure that you select a scanning/capture product that includes indexing software so that you can apply metadata to the file when it is scanned to or moved to the CIM system. This will allow you to search for the document and be able to find the single document you are trying to retrieve. In the AIIM report on Content in the Cloud only 10% of companies are scanning to the cloud, either via email, through an in-house server/scanner (7%), or via and outsourcing (6%). This shows us that due to the limitations of the typical CIM system, as reviewed above, scanning to the cloud is still not a viable use of the cloud. This will remain limited until CIM vendors develop a method to allow indexing of Page 4 Copyright Porter-Roth Associates 2013

documents with multiple metadata fields and allowing for a robust search. Also, CIM systems should provide some method for applying retention schedules to allow documents to be deleted in a timely fashion. In the meantime, many service bureaus (companies dedicated to scanning documents for you and providing the scanned documents and indexing information to you) also provide cloud-based applications that allow you to access your scanned documents in their cloud-based application. There are both nation-wide companies and local (to your area) companies that can provide this service. Electronic Document Management and Collaboration The primary reason for having a CIM system is to facilitate the sharing and collaborating on documents. These systems are generally very easy to setup and use and a collaboration site can be operational within minutes with work starting almost immediately. CIM systems also allow the user to store and retrieve their documents from a variety of devices such as tablets, smartphones, laptops, and virtually any internet connected device. CIM systems differ in what functionality they offer to the user such as: 1. Simple file storage and retrieval. This type of application offers the user the ability to store files in a cloud-based storage area that provides only basic functions, like login security, but does not offer any document management related functions such as version control, check in/out, workflow, etc. These sites may be called simple collaboration because you can give your site password to other users who can then upload or download documents. Essentially, this is an easy to use cloud-based FTP-type site. 2. Simple document management. This type of application offers the user content storage as well as document management functionality such as the ability to create folders/subfolders, version control, check in/out, audit history, and other basic document management functions. This type of site also allows the owner to assign security privileges such as edit or view only to users and security may be at the site, file folder, document level. This type of site may be viewed as a lightweight document management system. This type of site may also offer integration with other applications via an API but typically the site functions are limited and not customizable. 3. Complex document management. This type of application offers all of the functions listed above but may also include the actual applications for content creation these sites may include a word processor, spreadsheet creation, presentation creation, records management capabilities, a calendar function, an email function, more complex workflows, and other application functions that one would expect in a fully realized document management system. Once a user is logged into the site, everything needed for document creation and management is included and the user operates in a complete environment. This type of site may also offer integration with other applications via an API but the site functions are limited to those offered and typically not customizable. 4. Functional applications with document storage. This type of application offers specific applications such as human resources (HR), enterprise resource planning (ERP), project management (PM), customer relationship management (CRM), and others. This type of application is built to provide the necessary functional requirements for the application, such as CRM, and may also provide the ability to create and/or upload documents into a storage area typically related to a client account. However, these systems typically do not provide any document management capabilities no version control, no check in/out, no records Page 5 Copyright Porter-Roth Associates 2013

management, etc. They may provide simple workflows for the documents once they are associated with a client s file. 5. Business & Social networking applications with document storage. This type of application offers the ability to provide business and social networking through establishing an individual home page, ability to tag or invite other users to your home page, the ability to establish communities of users, form discussion groups, instant messaging, etc. This types of applications may also offer the ability to store and share documents with other users but typically do not include any document or records management capabilities. CIM systems may also include 1. Libraries/folders/files 2. Upload single or multiple files to the directory (mass migration still limited) 3. Upload files via email (which allows you to email a file directly to a directory/sub-directory) 4. Security at the directory/folder/file/document level for view or edit permissions 5. Real-time collaboration (simultaneous editing of a single file) 6. Commenting area for documents (comments viewable on the CIM system, not the document) 7. Calendaring function for group projects 8. Workflow (from simple tasks to complex workflows) 9. Blogs 10. Wikis 11. Whiteboard(s) 12. Discussion boards 13. IM or mico-blogging 14. Project management 15. Connecting to third-party apps (other cloud-based applications such as ERP, CRM, PM) 16. User profiles (Facebook-like personal areas) Each CIM application may host a variety of functionality that allows it work with all of the different mobile devices including laptops, tablets, smartphones, and whether the devices are Apple, Android, Microsoft, or others. Typically, the user/owner will be responsible for managing the site design, permission/security, content, and all other aspects of the site operation. If an invited user needs assistance or has a problem, he or she will be directed to the site owner. As part of your planning process, you may want to involve your IT department so that they become the help center for the site and questions/problems can be directed to the IT department. The AIIM report on Content in the Cloud found that: 68% are looking to use cloud collaboration within the business and between remote sites. 64% would like to do so with customers - of which only 15% are doing so already. File sharing is the most-important aspect of cloud collaboration, with 58% considering folder and document permissions to be an essential feature. Most would also like features such as approval workflows, capture, and annotation. The most useful application reported by those already using cloud content is for sharing content amongst specific projects and project teams, particularly those outside the firewall. The second Page 6 Copyright Porter-Roth Associates 2013

set of benefits is that cloud sets them free from the limitations of in-house infrastructure, is simpler, allows fast deployment, and the chance to experiment. Records Management, Governance, and ediscovery An essential consideration for using a CIM is whether you can control the documents once they are in the cloud-based system. A records management capability allows you to define the retention or lifecycle of a document and to be able to delete that document according to the retention schedule. Many of the basic file storage applications do not include any type of records management or legal compliance and hold capabilities. This means that there is basically no inherent way to apply a records retention schedule to the documents that are moved to or created in the CIM application. The result of this type of environment is that deletion of documents is left to the individual that created them on a manual basis and also that individual will also be responsible for determine whether a document is a record and should be kept and if so, for how long. The industry (vendors and users) has learned over the years that manually applying records management criteria (inputting retention schedule information) to a record is very difficult and largely ineffective when trusted to the user. The inevitable result will be that document repositories will continue to grow without any controls and will at some point become a problem for the company. One immediate problem will be the associated increased storage costs, another will be a growing dissatisfaction with the inability to find documents which means that the typical file share has been recreated in the cloud application. In essence, all the problems that are present with an un-governed file share, or other DM system, will be present in the CIM system. If the CIM system has no provision for records management, the suggested method for control is to establish a governance policy that applies to the CIM system. This policy may require, for example, that documents that are designated as business records be locked (if the CIM allow for this) and that these documents are prevented from being deleted if the document repository is deleted. However, this is extremely difficult to control and monitor as the number of CIM system repositories grow and change. There are CIM systems that do have full records management capabilities and if your company requires strict compliance to company and regulatory rules, the CIM system with RM capability should be chosen over the systems that have no RM capabilities. This also applies to regulatory rules such as HIPAA, SOX, Sec Rule 17a, FISMA, GLBA, and others if your company is regulated and you need to show audited compliance statements. In the AIIM report on Content in the Cloud: 50% of cloud users are attempting to manually replicate on-premise security and records policies to cloud usage, with a further 40% admitting that their cloud governance is somewhat ad hoc. Only 10% are automatically synchronizing rights between on-premise and cloud systems. 63% see cloud file-share sites as the new wild west. A net of 50% agree that cloud does not yet tick enough of the security and reliability boxes. Page 7 Copyright Porter-Roth Associates 2013

While the efforts to replicate security and governance are well intentioned, they are held back by at least two factors: 1. Only a small number of CIM systems include the capability to have records and governance management in place in the CIM. Therefore there is no way to apply policies to the CIM. 2. Companies may not be involving IT in the initial CIM site set up and therefore CIM sites are being adopted and run by the user/owner who is not able to set company policies for a variety of reasons. Workflow Workflow is the automation of business processes, in whole or in part, where documents, information, or tasks are passed from one participant to another for action, according to a set of rules. A business process is a logically related set of workflows, work steps, and tasks that provide a product, service, or result to internal users or customers. A simple example may be the routing of an electronic vacation request form automatically to both a manager and the HR department for approval. Your HR department may approve the request based on your available vacation days but your manager may not approve the request due to an upcoming project. Your denied request is returned to you via email and the denied request is also sent to HR simultaneously. Workflow controls the steps needed for approval and non-approval and electronically routs the documents accordingly. Most CIM systems do not have complex workflow capabilities that are available in established ECM systems and this may be a consideration when defining the requirements for a CIM system. Depending on the CIM system, workflow capabilities may be: 1. No workflow capability. Any routing of a document is done by email. 2. Limited task oriented workflow for such tasks as a simple approval process. 3. Full workflow capabilities that are similar in functionality to existing workflow capabilities in an on-premise ECM system. Workflow is useful for many reasons its use can greatly enhance a project or a process. For example, an accounts payable (AP) process has (for most companies) a highly structured process that is standardized and repeatable. When workflow is applied to the process, it become much more efficient and it becomes auditable how many AP invoices are processed per day, time and resource savings can be gained, late or missing invoices can be tracked, and many other benefits are available. Because workflow can be an important productivity tool, the need for it should be accessed as part of the CIM requirements that are developed and documented. Migration of Document into the CIM System As part of the site implementation planning, a migration of existing documents and content may be considered. Many CIM systems have different approaches to migrating existing content that range from uploading one-file-at-a-time to being able to move multiple files or directories at a time. If there is a need to move, for example, 1000 or more files as part of setting up a new site, the CIM system vendor should be consulted as many CIM vendors do not have the tools to move very large numbers of files or Page 8 Copyright Porter-Roth Associates 2013

to do a mass migration that can be accomplished by the user. In some cases, the CIM vendor has to be given a backup file of the content to be migrated and the vendor will be responsible for the work. A basic migration strategy can be one of the following: 1. Allow users to move documents on an as needed basis. This allows users to move the documents from their current repository to the new repository when the document(s) are needed. 2. Work with the users to establish a range of documents to be moved to the new repository this is typically a date range as in in all documents dated from xx to xx. Users may move older documents left behind on an as needed basis. The CIM vendor may assist with this effort. 3. Migrate complete repositories (file shares or other document management system repositories) prior to the new system going live. Note: check with the CIM vendor as automated or programmable means may not be available. 4. Make the existing file shares (or document management system) read only so that users are not able to continue to input new documents into the old repository. Make the existing repository available for a limited time (1 year) in order to encourage users to move all of the documents in a timely manner. 5. When the migration is complete or the file share availability time period has been reached, remove the repository from general access and back it up or delete it if legally possible. Check with legal on this for their comments. Source Document Repository Staging & Verification Target Document Repository As part of the migration process, clean-up of existing repositories should be considered prior to the migration. This will involve identifying and deleting files that are no longer viable documents such as the following: 1. Duplicate files that existing in the repository 2. Files that are past their retention period (but not on legal or audit or tax hold) 3. Files that are corrupt or otherwise not viable files (files with extensions that no longer have programs associated with them.) 4. Files that have no owner and have not been accessed for at least a year (of course subject to any legal review to ensure the documents are not subject to a legal or tax hold). Many recent studies have shown that at least 50% of all documents in any given repository can be deleted because they are duplicates, outdated, corrupted, no longer have value, no longer have an owner, or are empty files (created but not used). If you choose to migrate complete directories or repositories, consider doing a file cleanup as part of the migration strategy. Migration may pose records management and/or legal issues that should be considered. In some cases, simply copying files from the owner s repository to the CIM system may cause the metadata associated Page 9 Copyright Porter-Roth Associates 2013

with the file to change such as the owner/creator, date created, etc. From a legal point of view this is not acceptable (because the file s metadata has changed) and the migration method should be tested and reviewed with legal prior to a migration plan is committed to and used. And finally, there should be some method to audit the migration so that it can be verified that if 100 files were moved, 100 files were accepted by the CIM. For various reasons, the CIM system may not accept certain file types or sizes and these files will not be moved but there may not be an error message from the CIM stating that the following files were not moved. One last note, as part of your due diligence, how documents are migrated within the CIM (i.e., from one project or department to another) should be reviewed with the vendor. But more importantly, how are documents migrated from the CIM to a new CIM or back to your own repository services. It is entirely possible that at some point in the life your CIM system that you will either want to move to a new CIM that offers inexpensive archival storage or to return the documents stored in the CIM to your company. This includes not only the documents but their metadata values and other structural elements such as the directory/subdirectory structure. What does the Future Hold? The future of CIM systems is bright and getting brighter as the pace of improvements and innovation pick up throughout the industry. Many of the original CIM systems have continued to improve their internal functionality (and stability) over the past year and many have begun to connect with other cloud system providers. For example, a straight-forward store and retrieve provide may now offer connections to systems that offer project management, CRM, ERP, and others. It is now entirely possible that a small company can operate completely in the cloud and not have any physical office space, computer room, or IT department. The following functions exist as cloud-based application: 1. Customer relationship management (CRM) working with your customers 2. Enterprise resource planning (ERP) managing your accounting and financials 3. Human resources (HR) managing your personnel 4. Project management managing your projects 5. Email managing your email 6. Document and content management 7. Company webpages and corporate presence on social media sites 8. Information management (IT) managing your IT needs and monitoring your clouds With the above basic sites, a company can actually exist without any corporate facility except a physical mail address (which can be a post office box) and all company employees and operate from virtually anywhere there is an Internet connection. Also, employees are not restricted to any device and can use Apple, Microsoft, and Android PCs, and their choice of tablets and smartphones. There is also virtually no restriction on the software used to compose documents (word processing, spreadsheets, and presentations) as many cloud-based applications supply their own software to provide these functions as well as providing a common format (such as a.doc file format). All-in-all, the CIM systems have opened up a new and exciting avenue for the content management industry. The existing legacy systems have been getting more complex and expensive while user adoption has gone down hence, one of the reasons for the rise in CIM systems. As CIM system continue to grow and add functionality, they will become more and more part of the ECM toolkit that is employed to manage content within a corporation. Page 10 Copyright Porter-Roth Associates 2013