Strategies for Managing SharePoint Chaos and Legal Risk

Strategies for Managing SharePoint Chaos and Legal Risk Proactively Manage the Arranged Marriage of Legal and IT to Optimize ediscovery and Information Governance. A DIGITAL REEF WHITE PAPER 1

Table of Contents Executive Summary...3! Managing SharePoint Chaos Within the Enterprise...3! Does the Enterprise Understand its SharePoint Content?...4! Overcoming ediscovery Risks with Scalable ECA and Analytics...5! AIIM SharePoint Utilization Survey Results...6! Balancing Legal Prudence and IT Efficiency...6! Implementing Information Governance with Digital Reef...7! Visibility...8! Insight...8! Control...9! Delivering Value Throughout the Organization...9! What About Non-SharePoint Content?...9! Manage SharePoint Content as a Valuable Asset...10! About Digital Reef...10! A DIGITAL REEF WHITE PAPER 2

Executive Summary The most recent 2010 AIMM SharePoint Utilization Survey reveals IT organizations are exposed to significant risk in legal and cost management for enterprises using SharePoint for content management (see sidebar, page 6). The survey shows only 28% of active users have a legal-discovery/legal-hold policy that extends to SharePoint. Organizations with Microsoft SharePoint deployments need greater enterprise visibility and control of SharePoint content to avoid SharePoint chaos and legal risk. Information exists tenuously in a chaotic state if it is not quickly identifiable and actionable on SharePoint lists and libraries. Understanding the inventory of content stored on multiple SharePoint farms is a major business challenge for IT departments and an ediscovery challenge for legal departments. Companies need the ability to gain visibility into SharePoint content without the hassle and cost of having to copy, archive, and search all SharePoint site collections. Digital Reef empowers enterprises to create a Virtual Governance Warehouse that provides visibility, insight, and control into SharePoint content to support legal requirements for ediscovery without imposing major financial and operational burdens on IT. Tradeoffs can be managed between risk and value, thereby establishing a legal requirements-ready information governance IT roadmap by: Immediately developing a virtual content and data map that classifies SharePoint content across the enterprise. Designing a proactive SharePoint governance model based on policies and the lifecycles selected by content type. Standardizing an IT file architecture so that SharePoint information sources, their locations, data types, and owners are ready for governance and control. Selecting and implementing an IT information governance infrastructure based on content inventory, in-place discovery, file and content analytics, automated policy management, and role-based reporting. This whitepaper evaluates strategies for managing SharePoint chaos and risks, and it discusses how organizations can create a Virtual Governance Warehouse to make sure the organization remains compliant with policies for protecting information and managing ediscovery risks. Managing SharePoint Chaos Within the Enterprise Microsoft SharePoint has flourished across the distributed enterprise as a web-based collaboration platform that allows users to efficiently share information. However, the same attributes that make SharePoint so popular and useful create a huge ediscovery risk for the business. Companies are therefore faced with the conflicting goals of fostering workgroup productivity through the use of collaboration and the need to centrally gain visibility into enterprise information resources. While IT seeks to secure SharePoint content inventory according to records management and acceptable use policies and efficiently utilize storage and other infrastructure resources, the legal department seeks to comply with amendments to the Federal Rules of Civil Procedure (FRCP) that place a heavy burden on organizations to find, analyze, and produce electronically stored information (ESI) in tight timeframes. Microsoft SharePoint is a software platform developed by Microsoft for collaboration and web publishing combined under a single set of servers. The end-user capabilities include developing web sites, portals, intranets, content management systems, search engines, wikis, blogs, and other tools for business intelligence. SharePoint is a Web 2.0 platform that provides users with tremendous freedom for creating and managing their own content, and it includes an indexed data repository that relies on proprietary index and search technologies to locate documents. It offers a centralized way to store data in a web-based interface that can be accessed on the corporate network and/or on the Internet. SharePoint allows users to easily create web-formatted data, such as blogs or wikis, and it includes a search tool that can find keywords in electronic documents. It is a data management system that uses a Microsoft SQL backend and a Microsoft Internet Information Server (IIS) web server frontend to store and present data. Due to the flexibility and extensiveness of the functional elements contained within SharePoint case sites and site A DIGITAL REEF WHITE PAPER 3

collections, they are frequently deployed without centralized IT involvement. While SharePoint enables efficient sharing and collaboration, it creates chaos when litigation is pending and discovery needs to be performed against data contained within SharePoint servers. SharePoint hosts both structured content stored in database fields as well as unstructured content, such as emails, spreadsheets, presentations, and word processing documents. Adding to this complexity is the ability to create files directly within a SharePoint content library or list. SharePoint resources are typically distributed throughout the organization, so ediscovery challenges are not only about finding the needle in the haystack the enterprise first has to find the right haystack to search. The average multi-national corporation has more than 150 simultaneous legal matters 1 and most expect litigation levels to stay the same or increase. The average cost of ediscovery is greater than $1.5 million per matter. 2 That means that a typical large organization spends greater than $225 million on ediscovery per year. With litigation and costs on the rise, organizations are getting serious about ediscovery solutions. The digital information explosion compounds regulatory pressures and the need for increased corporate accountability as organizations increasingly store both structured and unstructured content inventory in SharePoint environments distributed across the enterprise. This leads to inconsistent records management practices, intellectual property losses, security problems, and privacy violations. When faced with the need for ediscovery, the enterprise is required to sort through which SharePoint information is valuable and which SharePoint information is not many times leading to chaos during that critical early phase of case assessment. Multiple copies of the same content can be stored in multiple locations, leading to expensive storage costs and even more haystacks to search during ediscovery. While some enterprises have centrally managed SharePoint server farms, others have SharePoint environments distributed across departments and geographic regions. To proactively manage SharePoint content inventory, organizations need: An understanding of what content is stored and where it is located to centrally define and enforce policies for managing risk. Visibility into electronically stored information (ESI) to discover and understand content inventory and develop policies and procedures for records management, storage, and archiving content across its lifecycle. For example, IT management may set a policy that all email will be stored for a year, but refine that policy so the CEO s and CFO s emails are archived indefinitely. By gaining central visibility into SharePoint resources, information governance can be implemented to identify, collect, and extract content so SharePoint chaos can be managed so legal risks and high expenses can be mitigated.!"#$%&'#%()&#*+*,$#%-).#*$&/).%,&$%0'/*#1",)&%2")&#)&3% Evaluating how SharePoint is used within the enterprise requires the ability to answer crucial questions. The following are some representative questions to consider when evaluating whether enterprise IT and legal departments are prepared for ediscovery of SharePoint content: Does our company have an inability to efficiently make information actionable for legal, regulatory, compliance, and line-of-business applications? How many files do we have that are older than two years? Are there multiple copies of our important documents across multiple locations? Are there any documents that contain information we have also have saved in our email? How do we see what s in image files? How do we find documents that are similar to one another? How do we know which data is where? Does our company have consistent records management practices? How do we know which information is valuable and which is junk? Who has the rights to access content on which SharePoint site collection? Do we have visibility into the content in all of our SharePoint deployments? A DIGITAL REEF WHITE PAPER 4

Overcoming ediscovery Risks with Scalable ECA and Analytics Responding to litigation can be a risky, time-consuming, and costly process. Each step is not only laden with its own inherent cost, but if not done can correctly can exacerbate the downstream cost and risk. Organizations must scramble to: Identify, preserve, and collect all potentially responsive ESI Cull it down to a manageable set for review by counsel Produce the responsive ESI to opposing counsel SharePoint data is stored and maintained differently than data in other types of storage repositories, and its storage method creates a myriad of issues relating to identification, collection, and extraction of content. It is not engineered for content extraction, and it has limited capabilities for managing the context of information. Contextual analysis is essential to ediscovery so that the legal team can understand the framework for the content including who created it and who modified it. There are also different versions of SharePoint, so searching across multiple versions is a manual and painstaking process. There have been three major SharePoint releases SharePoint 2003, SharePoint 2007, and SharePoint 2010 and it is available in a Standard version as well as an Enterprise version that offers more advanced components. Managing interoperability pitfalls is a major IT challenge, and while later versions of SharePoint have enhanced document management versioning capabilities and improved integration with Microsoft Office applications, the ability to search multiple releases and versions is extremely limited. SharePoint offers out-of-the-box content types and users can also create custom content types, and it shares common data elements, such as: Lists Libraries Calendars Alerts Wikis Logs Tasks Most ediscovery challenges are related to lists and libraries, and the legal department often has limited ability to understand the context for this content. Lists are essentially online spreadsheets accessed and modified by multiple users, and users can attach items to each list. This leads to increased data complexity, making it difficult for legal staff to isolate needed content during the ediscovery process. Document libraries can be configured to use point-in-time snapshots or versions of a given document, so the ability to understand the metadata is essential for understanding the context of an inventory item. In addition to wrestling with multiple versions of SharePoint, organizations also have to manage non-traditional forms of ESI. SharePoint supports audiences and permission levels that determine who can create, modify, and view content, and it enables audit trails for tracking changes to content throughout its lifecycle. For example, the ediscovery team may want to analyze a centralized web page or web part that could be edited by multiple users. The ability to access the metadata to determine who made which changes could be valuable information, but would be difficult to find given traditional approaches. The good news is that SharePoint stores a great deal of metadata associated with each item and the ability to understand the metadata and correlate it with content items which is essential for efficient ediscovery. A DIGITAL REEF WHITE PAPER 5

4556%0'/*#1",)&%-&,7,8/&,")%09*:#;%<#$97&$% For more than 60 years, AIIM has been the leading non-profit organization focused on helping users understand the challenges associated with managing documents, content, records, and business processes. Download its free SharePoint Strategies and Experiences report ( AIIM 2010, www.aiim.org) to review its conclusions about SharePoint deployments drawn from a survey of 624 members of the AIMM community in May and June, 2010. Key findings of the report include: The rapid adoption rate for SharePoint has created confusion in many organizations regarding their future strategy for information management, particularly those with existing and established ECM (Enterprise Content Management), RM (Records Management) and BPM (Business Process Management) systems. 44% of respondents have rolled out SharePoint across 10 or more geographical sites, with 14% covering over 100 geographical sites. One third of installations span more than one country. Collaboration is the most popular application, followed closely by document management and file-share replacement. Portals and intranets are the next most popular usage. 37% of organizations consider SharePoint to be their first significant implementation of ECM. 19% have SharePoint and an existing ECM suite, but do not yet have a strategy as to how they will co-exist. Granularity of security and poor provision of records management were cited as technical shortcomings by 28% of users. 43% have yet to bring SharePoint-stored content into their existing retention and long-term archive policies, including 11% who feel that their exposure in these areas is being increased by SharePoint. Only 22% of organizations provide their users with any guidance on corporate classification and use of content types and columns. Only 10% have a policy on dealing with emails and email attachments. Team site sprawl, with no policy on ownership and end-of-life, is an issue for a quarter of users. 58% of active users do have a policy on site ownership and responsibilities, but only 19% on end-of-life. Only 28% of active users have a legal-discovery/legal-hold policy that extends to SharePoint. Balancing Legal Prudence and IT Efficiency While legal counsel wants early case assessment (ECA) and ediscovery capabilities, IT wants to implement information governance via the ability to identify, collect, manage, and extract data according to clearly defined policies. Balancing legal s natural desire to understand all the content in SharePoint with IT s natural desire to manage SharePoint content according to policies is a delicate balancing act. But the forced marriage between legal and IT is necessary so the organization can cost-effectively manage legal risks without imposing unwieldy structure on users and on IT resources. Traditional tools, processes, and analytical methodologies for identifying, preserving, and accessing SharePoint content are labor-intensive and impose difficult financial burdens on the enterprise. There are several traditional options to consider. Using SharePoint s search features to identify ESI across cases or within sites, lists, and libraries is a timeconsuming process that places the organization at high risk due to SharePoint s limited search capabilities. Manually searching documents and lists one at a time is a very slow process that is prohibitively labor-intensive. Forensically copying files from libraries using tools such as RoboCopy is an option, but the content would be limited mainly to lists and libraries. IT could extract specific content from SharePoint, but this would result in severely limiting legal s access to content. IT could also create virtual images of case sites that need to be evaluated, but this would be a point-in-time solution that would not be updated on an ongoing basis, and it would result in increased storage costs and still require the ediscovery team to figure out how to go through the content to categorize relevant information. Today s enterprises have uncontrolled SharePoint deployments and must confront the chaos of managing an evolutionary use of SharePoint. While SharePoint offers a powerful, cost-effective means of collaboration, it was not architected for information governance. The ability to share information easily via browser-based web interfaces has led to broad acceptance of SharePoint, but organizations need to establish formal information and governance standards so they balance legal prudence and IT efficiency. A new approach to information governance is needed A DIGITAL REEF WHITE PAPER 6

that will allow the enterprise to manage SharePoint chaos and legal risk by managing the arranged marriage of legal and IT to optimize ediscovery and information governance. Implementing Information Governance with Digital Reef According to Gartner, Information governance is the specification of decision rights and an accountability framework to encourage desirable behavior in the valuation, creation, storage, use, archiving, and deletion of information. It includes the processes, roles, standards, and metrics that ensure the effective and efficient use of information in enabling an organization to achieve its goals. Digital Reef provides the fastest way to implement information governance and transform unmanaged SharePoint information into valuable assets. With the industry's first massively scalable and open Virtual Governance Warehouse, corporations and legal counsel can discover, analyze, and govern business information and deliver unprecedented insight into unstructured emails, documents, files, and data in any format while complementing existing technology investments. The Digital Reef Virtual Governance Warehouse is a platform for ediscovery and information governance. Digital Reef transforms enterprise-wide content including data stored in SharePoint infrastructure into valuable assets by taking data in the wild and enabling legal, corporate, and IT visibility, insight, and control. The enterprise gains unprecedented business insight into SharePoint content while complementing existing investments in email, archiving, and storage management. A Virtual Governance Warehouse provides the foundation for digital information governance applications across the enterprise and allows order to be imposed on SharePoint chaos. Preparing for information governance requires the organization to create an information model where information is classified, values are assigned to content inventory, and ownership of the information is clear. The line of business managers can then work closely with IT and legal departments to develop a governance model based on policies and the lifecycle of the content. For example, the content used by senior executives would likely be archived for a longer lifecycle than the content inventory of the marketing, sales, or manufacturing departments. IT has to worry about managing large volumes of data, enforcing policies, and understanding where the data resides and who has access to it, and this requires visibility, insight, and control of SharePoint environments that can be provided by the Virtual Governance Warehouse. A DIGITAL REEF WHITE PAPER 7

Visibility The enterprise needs the ability to dynamically discover SharePoint site collections and then index and search across all SharePoint resources to uncover the content inventory so authorized users can locate data by: Type Content Metadata The Digital Reef Virtual Governance Warehouse supports over 400 data types and associated metadata out of the box, providing clear insight into SharePoint content inventories. Now stored content can be easily identified and accessed in multiple SharePoint site collections and in multiple geographic areas, and users can gain one-click visibility across all sites. Digital Reef provides in-place discovery and management of all information assets. The Digital Reef solution examines SharePoint assets and catalogs what has been found and where it is physically located. The index accommodates the massive scale required to present a single, federated view of all information assets wherever they reside without introducing onerous storage requirements or a huge tax on network infrastructure. Insight With our Virtual Governance Warehouse, organizations can: Classify content using analytics and virtually organize content by categories. Obtain the ability to understand who has access to the information, where it resides, and who has made changes to it. Gain a rich content understanding via analytics. In addition, legal departments can leverage Digital Reef s Virtual Governance Warehouse to: Analyze a full inventory of relevant content and benefit from context-sensitive selections. Better understand the value of the information they are reviewing. Provide access to a single version of the facts and information, while also providing context-specific insights to diverse users throughout the organization. While lawyers will naturally seek a legal context, human resources executives will have an employment-focused context, and compliance professionals will view the information through a prism of regulatory reporting. A DIGITAL REEF WHITE PAPER 8

Control Digital Reef allows organizations to: Define and enforce content discovery policies to gain maximum control over SharePoint content. Organize policy management projects. Manage access privileges and restrictions to secure private and confidential information to only be accessed by authorized users. This level of control allows the legal team to ensure they are gaining access to all relevant SharePoint content, and it provides the scalability that ensures that an organization can see all the content in context. Delivering Value Throughout the Organization A Digital Reef Virtual Governance Warehouse is the fastest and most scalable solution for ediscovery and digital information governance of SharePoint content, and it provides value throughout the enterprise: Board members better protect the information assets of the enterprise while enforcing the organization s ability to protect its legal rights. CEOs resolve the inevitable conflicts between IT and legal by enabling a cost-efficient and effective way of governing large volumes of unmanaged and unstructured information. CIOs gain the ability to manage distributed SharePoint content according to policies while minimizing content redundancy, better serving the legal department, and more efficiently utilizing enterprise storage resources. CFOs more effectively manage legal costs while avoiding potentially massive surprise expenses for ediscovery. Corporate attorneys gain greater control over ediscovery including discovery, collection, preservation, and processing from within one scalable, integrated ediscovery solution. Compliance officers develop insights into sensitive and regulated information stored on SharePoint site collections, making it easier to respond to regulatory requests and manage compliance initiatives. Human resources personnel can more effectively design and implement policies for retaining employee content based on policies and content lifecycles. Security executives are better equipped to help the organization avoid the negative consequences of security breaches, and they can classify sensitive data such as customer information or intellectual property to optimize data loss prevention efforts. ='/&%4>"9&%?")@0'/*#1",)&%2")&#)&3% Visibility, insight, and control are essential for optimizing ediscovery and information governance for SharePoint resources but what about non-sharepoint data on file server shares, data stored in enterprise applications and data stored in vertical industry applications or homegrown applications? A point solution that focused on ediscovery and information governance would be insufficient for enterprise requirements, and Digital Reef allows organizations to build a Virtual Governance Warehouse that provides visibility, insight, and control over nearly 400 types of data found in many of the popular repositories and file systems used today, including the following content sources: EMC Documentum Enovia MatrixOne HP TRIM IBM Content Manager IBM FileNET IBM Lotus Notes and Quickplace IBM WebSphere Portal PDM Interwoven TeamSite and WorkSite NT IRIS Archea Microsoft Exchange Microsoft SharePoint NFS File Servers Open Text edocs and LiveLink Oracle Stellent UCM Windows File Servers Xerox Docushare Symantec Enterprise Vault A DIGITAL REEF WHITE PAPER 9

Manage SharePoint Content as a Valuable Asset The Digital Reef Virtual Governance Warehouse allows legal and IT to manage SharePoint content as a valuable asset for both business and IT compliance. This approach allows classification and understanding of all SharePoint data without disrupting where it lives. The enterprise gain the visibility, insight, and control needed to understand their SharePoint content inventory and measure risk and value when developing policies for information governance, and SharePoint information can be optionally duplicated to centralized archives or left in place. Organizations can manage the tradeoffs between risk and value and establish a legal counsel-ready information governance IT roadmap by: Immediately developing a virtual content and data map that classifies SharePoint content across the enterprise. Designing a proactive SharePoint governance model based on policies and the lifecycles selected by content type. Standardizing an IT file architecture so that SharePoint information sources, their locations, data types, and owners are ready for governance and control. Selecting and implementing an IT information governance infrastructure based on content inventory, in-place discovery, file and content analytics, automated policy management, and role-based reporting. The Digital Reef Virtual Governance Warehouse is the most scalable and open software for ediscovery and digital information governance, based on the most powerful analytical engine ever created. Organizations can proactively manage the arranged marriage of legal and IT to optimize ediscovery and information governance, and can deploy a Virtual Governance Warehouse on premises or in the cloud using our hosted solutions. Using pure mathematical power, this solution is capable of automatically indexing, analyzing, classifying, and managing massive amounts of SharePoint content across formats and locations, with a degree of speed and accuracy that is unprecedented. Find out how to manage SharePoint chaos and legal risk by deploying Digital Reef solutions. We offer a no-cost, oneday Data Map Workshop designed to give organizations a sense of the SharePoint data available so legal and IT can assess the risk and value of more effectively protecting SharePoint content. Send an email to info@digitalreefinc.com and ask how to apply for our no-cost Data Map Workshop. About Digital Reef Digital Reef is a leading software provider helping enterprises, law firms, and service providers with ediscovery and Digital Information Governance. Both corporate and IT executives are challenged to find and manage the right information, at the right time necessary, to respond to constant business demands such as government laws and regulations, corporate accountability and compliance, and IT digital file and storage policies. Using the industry s most scalable and open Virtual Governance Warehouse, businesses can rapidly collect, analyze, and then govern information. Digital Reef gives businesses an unprecedented control of their information, which can be derived from wherever it resides including emails, documents, repositories, and over 400 different types of files, including images. With Digital Reef, organizations have a standard, disciplined approach to continuously govern information for projects driven by Federal Rules of Civil Procedure, FTC false claims, Sarbanes-Oxley, SEC risk assessments, FDA approvals, and internal IT policies for digital information security, retention, and file management. Enterprises and their law firms, services providers, and consultants across all industries rely on Digital Reef for the fastest way to transform unmanaged information into valuable assets. Founded in 2006, Digital Reef is headquartered in Boxborough, MA. For more information call 978-893-1000 or visit www.digitalreefinc.com. References 1 ediscovery Solutions Group, June 2009 2 ediscovery Solutions Group, June 2009 A DIGITAL REEF WHITE PAPER 10