A Practical Guide to Legacy Application Retirement WHITE PAPER

A Practical Guide to Legacy Application Retirement WHITE PAPER

This document contains Confidential, Proprietary and Trade Secret Information ( Confidential Information ) of Informatica Corporation and may not be copied, distributed, duplicated, or otherwise reproduced in any manner without the prior written consent of Informatica. While every attempt has been made to ensure that the information in this document is accurate and complete, some typographical errors or technical inaccuracies may exist. Informatica does not accept responsibility for any kind of loss resulting from the use of information contained in this document. The information contained in this document is subject to change without notice. The incorporation of the product attributes discussed in these materials into any release or upgrade of any Informatica software product as well as the timing of any such release or upgrade is at the sole discretion of Informatica. Protected by one or more of the following U.S. Patents: 6,032,158; 5,794,246; 6,014,670; 6,339,775; 6,044,374; 6,208,990; 6,208,990; 6,850,947; 6,895,471; or by the following pending U.S. Patents: 09/644,280; 10/966,046; 10/727,700. This edition published June 2012

White Paper Table of Contents Overview of Application Retirement....2 Business Drivers for Application Retirement...3 Reducing Costs...................................................... 3 Consolidating Applications...3 Upgrading to an Off-the-Shelf ERP Product...3 Complying with Regulations and ediscovery Requirements....3 A Framework for Determining Application Retirement Eligibility...4 The Business Value of a Legacy Application...4 The Cost of a Legacy Application...4 Strategies for Retiring Applications...5 Prioritizing Applications Eligible for Retirement...5 Retiring All or Only the Necessary Data...5 Retiring Applications for Which There is Little to No Knowledge....5 Eight Steps to Successfully Retire an Application...6 Create a Cross-Functional Team...6 Understand the Legacy Application and the Data That Needs to Be Retired...6 Preserve the Business Context of the Application Data...7 Validate Retired Data...7 Access to Retired Data....8 Secure Retired Data.................................................. 8 Set Retention Policies on Retired Data...8 Select a Vendor for Application Retirement...9 Informatica Addresses Application Retirement... 10 Discover, Classify and Extract Business Records...10 Validate Archived Data....10 Provide Easy, Secure Access to Retired Data...10 Comply with Data Retention and Privacy Regulations...11 Store Data Efficiently and Implement Tiered Storage Strategies...11 A Practical Guide to Legacy Application Retirement 1

Overview of Application Retirement As businesses grow, information technology (IT) departments are continuously challenged to look for new applications that address unmet business needs, drive efficiencies, and reduce costs. As an organization adapts to change and leverages the latest technology to deliver more value to customers, the corresponding change is reflected in the application portfolio. It is not uncommon for companies that have been in business for a decade to have hundreds of legacy applications that deliver marginal value to the business yet represent a significant operational and maintenance cost. The problem of having to maintain redundant applications is exacerbated when companies go through mergers, acquisitions, or initiatives in IT or application modernization or data center consolidation. According to Forrester Research, streamlining the existing application portfolio is a necessary step for organizations that have been in existence for a decade or more. That process was also found to be important for firms that need to free up their IT budgets as a result of spending too much on lights-on activity and therefore too little on innovation. Forrester has identified updating and modernizing legacy applications, upgrading packaged applications, and consolidating or rationalizing enterprise applications as three of the top four problematic software issues 1. What s more is that only some legacy applications will be reusable, while some aren t fit for anything but retirement but it s not always easy to tell which is which. Money is often wasted in maintaining applications that aren t worth keeping, when instead it could be spent in ways that could benefit the organization. Application retirement addresses these challenges by removing the legacy application and the supporting software and hardware stack while keeping the application data accessible for reporting, regulatory compliance, and regular business needs. Forrester has also reported that organizations across the board spend upwards of 66 percent of their software budgets on ongoing operations and maintenance versus just 35 percent on new software initiatives and projects. 2 IT departments are clearly challenged to fund projects that can have significant impact. Budget savvy CIOs appreciate the cost savings realized when legacy applications are retired. Many forward-thinking organizations have already established best practices and methodologies to review application portfolios at regular intervals and determine whether an application should be retired, replaced, modernized, or left as is. 1 Phil Murphy, Application Retirement It s Time To Put The Elephant In The Room On A Diet, Trends, Forrester Research, February 3, 2011, p. 1. 2 Phil Murphy, A Workable Application Modernization Framework Is Job No. 1 Now, Trends, Forrester Research, April 26, 2010, p. 2. 2

Business Drivers for Application Retirement Reducing Costs One of the reasons for an organization to initiate an application retirement project is to save costs. Because application retirement allows the application and the supporting hardware and software stack to be shut down, the organization saves on licensing, maintenance, and administration costs. Also noteworthy are the savings in storage space and power consumption. Consolidating Applications There are a few drivers for consolidating applications. Examples include: a merger or acquisition; a regional office or department running different applications for financials, procurement, projects, or other line-ofbusiness functions; and a data center consolidation program resulting in the consolidation of applications hosted in its affected data centers. The benefits of consolidating applications include simplifying the user experience and cost savings. Upgrading to an Off-the-Shelf ERP Product As market-leading ERP software products provide broader and deeper capabilities, more and more organizations are looking to consolidate and standardize on a single application suite. Application or IT modernization initiatives to move off aged hardware and software stacks may also spur the proliferation of legacy or redundant applications. Reasons for upgrading from a legacy system include high costs, withdrawal of support from the vendor, limitations in IT knowledge and skill, and the inability to maintain and access the data within those applications in a timely and efficient manner. Complying with Regulations and ediscovery Requirements Organizations have to comply with several data retention regulations that require data to be retained for extended periods of time. Examples include Sarbanes-Oxley, SEC rule 17a, HIPAA, and FDA regulations. The heightened regulatory environment and the new Federal Rules of Civil Procedure are putting renewed emphasis on ediscovery and information management policies. Legacy applications cannot be simply shut down. The information in these applications must be classified, associated with retention policies, and be made discoverable in the event of an audit or litigation procedure. Keeping legacy applications active just to retain their data for compliance or ediscovery is not necessarily an option either, due to the lack of IT staff who has the knowledge to maintain and access the application data, increasing the potential risk of delayed responses to audits and ediscovery. A Practical Guide to Legacy Application Retirement 3

A Framework for Determining Application Retirement Eligibility Determining whether an application is eligible for retirement is a fundamental trade-off between the business value the application provides and the costs of supporting and maintaining the application. An application is eligible for retirement when the cost of supporting and maintaining the application exceeds the business value it supplies. The Business Value of a Legacy Application Simply stated, the business value of an application is a function of the business problem the application addresses and the value the application provides to its users and the business as a whole. There are several parameters (see Figure 1) that determine the business value of an application. All these parameters must be analyzed together to determine the business value of an application. Serial Number Parameters Determining the Business Value of an Application 1. What is the legacy application being used for? 2. How many employees, partners, or customers use the application? 3. Is the application being accessed regularly by many users or are a handful of users using the application? 4. The date of last usage. Nearly all production control or application inventory monitors record the date of last usage. 5. What is the age of the application? 6. Is new content being actively created in the application or is the application used for reporting purposes? 7. Can other applications in the organization serve the same purpose of the application in question? If so, how many users will have to be trained on the new system and what is the cost of training and customizing the new system? Figure 1: Several parameters determine the business value of an application. The Cost of a Legacy Application There are several parameters that determine the cost of a legacy application. Examples of some of the parameters include: the costs of the application s licensing, maintenance, and administration; the application s complexity; the expense of customizing the application; and the availability of resources to support it once customized. If technical expertise is no longer available to operate and access the application, the risk of potential fines resulting from delayed responses to audit and ediscovery requests should also be considered. In addition, the expense of a legacy application should include the cost of the entire software and hardware stack that supports it. 4

Strategies for Retiring Applications When reviewing an organization s application portfolio for the first time, it is not uncommon to find hundreds of applications that are candidates for retirement. When devising your application retirement strategy, it is important to consider the following: Prioritizing Applications Eligible for Retirement The priorities for application retirement can be driven by one or more of the following: Cost savings. Starting with applications that generate the greatest cost savings showcases the value of the application retirement project by freeing up budget and resources. Knowledge of the application and the reporting requirements of the retired data. One of the challenges with application retirement projects is the lack of functional application knowledge. Because legacy applications were deployed years ago, several employees educated on these applications most likely have since left or retired. Additionally, finding people with the right skill set is difficult when technologies are dated. Starting with legacy applications where there is a good understanding of the application functionality and reporting requirements makes success more likely and helps build the business case to retire other applications. Retiring All or Only the Necessary Data This decision is primarily driven by the knowledge of the application and the data that needs to be retained for reporting, auditing, and regulatory compliance. Retiring only the data required for business needs is the best approach with organizations that have a strong understanding of the application data and the reporting requirements. Retiring all the application data is the best approach when neither the application data model nor the reporting requirements are fully understood. In this situation, retiring all the application data mitigates risk and saves costs. Because all the retired data is accessible, the organization can dedicate resources to analyze the data if and when the need arises versus spending time and resources upfront. A best-in-class application retirement software product gives customers the ability to add relationships between the data and modify reporting at a future date even though the application data has already been retired. Retiring Applications for Which There is Little to No Knowledge In this scenario, application retirement is a sound strategy if the business value of the application is marginal. Retiring the application ensures that all the data is preserved. The organization saves costs by shutting down the legacy application. As stated above, the ability to add additional relationships between the data at a later time, even though the application data is retired, protects the firm if this data needs to be accessed later. A Practical Guide to Legacy Application Retirement 5

Eight Steps to Successfully Retire an Application To successfully retire an application, follow these eight steps: 1. Create a cross-functional team 2. Understand the legacy application and the data that needs to be retired 3. Preserve the original business context of the data 4. Validate retired data 5. Understand how users will access retired data 6. Secure retired data 7. Set retention policies 8. Select a solution for application retirement 1. Create a Cross-Functional Team Successful application retirement projects are typically staffed by cross-functional teams with representation from compliance, the line-of-business function, and IT. Figure 2 lists some of the typical roles played by the team members. Serial Number department/ function team members 1. Compliance/Audit Compliance managers, internal auditors, general counsel staff 2. Line-of-business managers 3. Information technology professionals Business analysts, line of business managers IT managers, database administrators, application developers role Determine what data should be retired for compliance purposes, the retention period, and the security access controls that should be associated with the retired data. Describe how the legacy application is being used; define the data that needs to be retained for regular business needs and the type of access and reports that need to run against the retired data. The line of business may also provide further refinements to the retention requirements for different data within the application. Develop the application retirement strategy, evaluate software products for application retirement, retire the application, and shut down the legacy application. Figure 2: Members of cross-functional teams have typical roles in successful application retirement projects. 2. Understand the Legacy Application and the Data That Needs to Be Retired A good understanding of an application and the underlying data model ensures that data required for normal business needs and regulatory compliance is archived and retained. To get a better understanding of the scenarios in which an application is used and the business benefits, conduct interviews with employees, partners, customers, and auditors who use the legacy application. Answering the following questions will develop a better understanding of the legacy application and the data that needs to be retired. 6

What purpose does the application serve today versus when the application was originally deployed? What application modules or functionality are no longer in use? What reports are run against the application? If there are several reports being run, can reports be consolidated? Are there similar applications in the organization that serve the purpose of the legacy application? Should data be migrated to another application? What data needs to be retained for compliance purposes? 3. Preserve the Business Context of the Application Data Once you understand the data that needs to be retained, it is important that the original business context of the data object is preserved. For example, if you are retiring purchase orders from a legacy financial application, all the transactional, referential, and audit information associated with the purchase order must be captured. Transactional information associated with the purchase order includes each item purchased, quantity, price, and shipping details. Referential information includes vendor name, address, and contact information. The audit trail includes details about who approved the purchase order and the user who changed the purchase order. This data is typically stored in several tables in the database. There are complex relationships between the data in the tables and business rules that define additional semantics. Adding to the complexity is the fact that many of these relationships and business rules are defined at the application layer and cannot be mined directly from the database. Preserving the original business context of the application data requires application knowledge and sophisticated data modeling techniques that ensure that the relationships between the data and the business rules are not compromised. 4. Validate Retired Data Once data has been retired, the application from which it originated is shut down entirely. Therefore, it s important to verify that the archived data is complete and correct prior to retirement. But because that legacy data may be stored in an application-specific manner, there may be some transformations required to covert it into a common format. Some examples of this are: dates in DB2 mainframes that may be stored as integers; dates in JD Edwards stored in Julian (versus Gregorian); and encrypted data that would need to be decrypted to ensure its accessibility after archiving. Since application-specific data types and formats require such transformations, the archived data may not be exactly the same as it was in the original application. It s important to identify the transformations required on the original data when archived to ensure its accessibility and ease of display and viewing. These transformations need to be reviewed and validated after archiving to ensure that the differences and exceptions are acceptable. The output of the data validation step after retirement is a report that verifies that all the data to be retained are in the archive, and indicates whether either they are exactly the same or different. If there are differences, then the exceptions should be acknowledged and approved. The report is an important part of establishing a chain of custody during an audit process. A Practical Guide to Legacy Application Retirement 7

5. Access to Retired Data Providing quick and efficient access to retired data is key to the success of your application retirement project. Organizations must have the capability to retrieve historical data on demand. The ability to query, browse, and generate reports allows you to respond to audits and discovery requests. Once the application is shut down, the retirement software must provide robust application-independent access leveraging such open industry standards as ODBC/JDBC, XML, and SQL, and reporting tools such as Crystal Reports, MicroStrategy, and Business Objects. Access to retired data should be provided in a manner that does not compromise the user experience. For example, if a legacy insurance policy administration system is retired, the policies should be accessible in its original format. Consider the following when developing a plan that defines how retired data will be accessed: How will business users and administrators access data? What format do they need to see retired data in? How will auditors access the data? What reports do auditors typically access? What reporting tools are users and administrators familiar with? How will users search for retired data? 6. Secure Retired Data It is not uncommon for a legacy application to contain privileged information. For example, a policy administration application in an insurance company may contain sensitive personal information while other applications may contain intellectual property that must be protected. When retiring applications, it is important to protect privileged information. Consider the following when developing a plan to secure retired data: Should only administrators and privileged users be entitled to access retired data or should a broader group be allowed to access the retired data? Should the same security policy that controlled access in the legacy application apply or should the security policy be further restricted or relaxed? 7. Set Retention Policies on Retired Data More and more organizations are recognizing the costs and the risks associated with retaining data indefinitely. Retired data, just as other information in the organization, should be managed according to the enterprisewide information management policy. An application retirement software product must provide comprehensive policy management features as well as integration with storage platforms that manage retention. Organizations and industries have varying complexities of retention policies. Some organizations specify a retention policy per application, whereas others may need it at a business entity level, such as customer or employee records. For healthcare organizations, the retention requirements for adult patients vs. minors are usually different, in which case retention policies may need to be assigned at a level more granular than entities at the level of a group of records. Other organizations may have even more complex requirements where multiple retention policies may need to be assigned to the same record, and conflicts among the rules need to be resolved by the retention management system. It s important to understand your organization s retention requirements early on so that you select an application retirement solution able to meet those requirements. 8

8. Select a Vendor for Application Retirement Because application retirement requires sophisticated data modeling, extraction, retrieval, validation, and retention capabilities, organizations are better served by seeking out a vendor with an existing, proven application retirement solution rather than reinventing the wheel altogether. An application retirement product must provide the following capabilities: Model the data in the legacy application Discover unknown data relationships Create policies that define what data should be retired Extract the data with its full application context Index the data for efficient searching Validate completeness and correctness of retired data Provide application-independent access and reporting Ensure immutability of the retired data and secure it for access by only privileged users Enforce retention and disposal policies at the application, entity, or groups of records level, based on regulatory and organizational requirements Audit all access and any actions against the retired data (changes in retention policies or disposal and legal hold) Every organization has unique requirements with application retirement projects, so there is often a substantial services component involved. Vendors who have extensive experience with archiving large volumes of data from structured applications, proven project management capabilities, and implementation best practices definitely have the upper hand. A Practical Guide to Legacy Application Retirement 9

Informatica Addresses Application Retirement The Informatica Application Information Lifecycle Management product family manages the full lifecycle of content in database applications. It is designed especially to manage the application retirement challenge by providing five capabilities (see Figure 3): 1. Discover, classify, and extract business records 2. Validate archived data 3. Provide easy, secure access to retired data 4. Comply with data retention and privacy regulations 5. Store data efficiently and implement tiered storage strategies Discover, Classify and Extract Business Records Sophisticated data modeling techniques allow you to classify and extract related subsets of data that represent the business object. The original context of the business object is preserved in an audit-ready format that is readily accessible for compliance and regular business needs. In the event that retired data needs to be further analyzed at a future date, additional relationships between the data can be created. If information on the relationship between tables and records is neither stored in the source system nor known by functional experts, then the Informatica ILM product family offers a Discovery Option to infer table relationships and business entities based on the discovered relationships. Knowledge about data relationships is important for establishing retention policies for related records as well as determining how data will be accessed. Validate Archived Data The Informatica ILM product family provides a Data Validation Option that enables the definition of business rules to easily validate the completeness and correctness of the data archive process. These business rules are used to compare the archived data against the data in the original application to ensure that it is complete and correct in the archive. The ability to define validation rules eliminates the need to write SQL scripts to perform the comparison, ultimately increasing productivity. Any discrepancies between the archive and source system are noted in the report output, which can be used later for review and audit purposes. Provide Easy, Secure Access to Retired Data As part of the Informatica Application ILM product family, Informatica Data Archive supplies several ways to ensure that retired data is appropriately secured and can be accessed on demand during the regular course of business as well as for audits and ediscovery. Informatica furnishes several options for accessing and securing retired data: Retired data can be accessed via standard interfaces such as ODBC/JDBC and SQL and through reporting tools such as Crystal Reports, MicroStrategy, and others. Retired application data can be searched based on business entities, with full application context, from the data discovery portal, which is available as part of Informatica Data Archive. 10

Comply with Data Retention and Privacy Regulations Informatica Data Archive provides a comprehensive feature set to ensure that retired data is secured and retained for the period specified by the regulations. A policy engine enforces assigned retention policies to retired data from the application level to a granular group of records. It then purges the data when the retention period expires so that it s not retained beyond a period of time that would pose a legal risk. Legal hold capabilities are also available to ensure that data relevant to a legal case is retained even if the retention period has expired. Integration with best-in-class storage platforms, such as EMC Centera and Hitachi HCP, guarantees that retired data is locked down until the retention period expires. At the same time, reporting and ediscovery ensure that retired data remains accessible in the event of an audit or litigation. Store Data Efficiently and Implement Tiered Storage Strategies Informatica Data Archive converts the retired data to an optimal, highly compressed file archive format, yielding up to 98% compression. The data is fully indexed to support query and search, while reducing storage capacity requirements. Additionally, as retired data is infrequently accessed and typically never modified, it can be stored on an inexpensive storage tier. As a result, organizations can save costs and free up high-speed storage for critical business needs. About Informatica Informatica Corporation (NASDAQ: INFA) is the world s number one independent provider of data integration software. Organizations around the world rely on Informatica for maximizing return on data to drive their top business imperatives. Worldwide, over 4,630 enterprises depend on Informatica to fully leverage their information assets residing on-premise, in the Cloud and across social networks. Process Flow Process Flow Content creation Archive Policy & data extraction Indexing & storage Discovery requests Reports Search CRM ERP Digital Asset Mainframes Legacy Applications Archive Object Business Rule Policies Informatica Data Archive Engine Policy based Retention archival and destruction Data, Metadata, Retention, Security Reporting and ediscovery ArchiveBridge NetApp/EMC/HDS/Sun NAS DAS SAN CAS Data Discovery Legal/Audit Production Optimized File Archive Figure 3: Informatica provides a family of products that manage the full lifecycle of content in database applications. A Practical Guide to Legacy Application Retirement 11

Worldwide Headquarters, 100 Cardinal Way, Redwood City, CA 94063, USA phone: 650.385.5000 fax: 650.385.5500 toll-free in the US: 1.800.653.3871 informatica.com linkedin.com/company/informatica twitter.com/informaticacorp 2012 Informatica Corporation. All rights reserved. Printed in the U.S.A. Informatica, the Informatica logo, and The Data Integration Company are trademarks or registered trademarks of Informatica Corporation in the United States and in jurisdictions throughout the world. All other company and product names may be trade names or trademarks of their respective owners. IN09_0612_06957