Information Is Your Most Important Asset. #AIIM Learn the Skills to Manage It.

Transcription

1 Information Is Your Most Important Asset. #AIIM Learn the Skills to Manage It. Developing Developing a Successful a Successful Data Data Retention Retention Policy Policy An AIIM Webinar Presented March 22, 2017 Presented March 22, 2017

2 AIIM is the Community for Information Professionals AIIM believes that information is your most important asset. Learn the skills to manage it. Our mission is to improve organizational performance by empowering a community of leaders committed to information-driven innovation. Learn more at

3 Today s Speakers Craig Shogren Manager, Information Governance HBR Consulting Rich Lauwers Information Governance HPE Kelly Huckman, JD Consultant Iron Mountain

4 Introducing our Featured Speaker Craig Shogren Manager, Information Governance HBR Consulting

5 We really don t even know what we have, let alone where it is! I only have 24 hours to respond to a regulatory request, yet it will take me 4 times that amount of time to sift through all the garbage. We re pretty sure we are not providing all responsive data, since we don t know what we don t know! There is probably a lot of PII on our shared drives that we really need to purge. Could be devastating if we are ever breached. Our workforce is so mobile, we know our employees are saving stuff to unsanctioned cloud storage. This shadow IT will sabotage our efforts at comprehensive disposition.

6 Why Do We Care? Compliance Discovery Risk and Cost Privacy Efficiency Storage Savings Customer Service Knowledge Management / IP

7 The Path Forward Is Clear Define Governance Requirements Know Where Everything Is Eliminate Unnecessary Data (ROT) Unbury Treasures

8 But Littered with Obstacles! Change management?! Organizational silos obstruct comprehensive approach! Don t know where the data is or what it contains! No internal sponsor / champion! Lack of budget & resources Communication gaps between Legal, IT and the business! Software-as-Savior turns into Software-as-Shelfware!! Bleeding out

9 Define What Governs Your Information Retention and disposition requirements Privacy and security requirements FRCP requirements (legal holds, etc.) Intellectual property considerations ISO standards Business requirements

10 Foundational Components for Defensibility IG / RIM Policy Purpose, scope, objectives, accountabilities, responsibilities, standards and definitions Records Retention Schedule Updated regulatory research Actionable, understandable Comprehensive Records, but what about everything else?

11 Foundational Components for Defensibility Privacy PII / PHI / PCI handling requirements Retention limitations Cross border considerations Privacy Shield GDPR

12 Foundational Components for Defensibility Information Security Data Classification Standard Data Mapping / Data Flows Technologies End-Point Detection, DLP, Access Controls, Virus Detection, Big Data Security Analytics, Containment / Isolation Tools, Security Testing, etc. BYOD Policies

13 Foundational Components for Defensibility Litigation Readiness Legal Hold Policy / Procedure ediscovery Tools and Technologies Litigation Profile Intellectual Property Training (Change Management) But, we ve always done it that way!

14 The Path Forward Is Clear Define Governance Requirements Know Where Everything Is Eliminate Unnecessary Data Unbury Treasure

15 Preliminary Steps Identify and assess locations / repositories of unstructured content Collaboration sites, shared drives, personal drives, document management systems, content management system, , physical etc.) Functional requirements of content / records management system Identify content placement strategy Is there clarity on how the retention schedule applies to electronic data? Determine content assessment methodology

16 Content Assessment Manual User-Dependent Technology-Enabled IT Tools ediscovery Technology File Analysis Software Content Metadata

17 What is File Analysis? Two Primary Levels of Analysis File System Metadata Includes information about individual files Examples include contextual metadata about associated servers, volumes, shares, folders, and identity related information such as company / department / group / user permissions and ownership; as well as file specific metadata such as file owner, last author, author, file extension / item type, and create, last modified, and last accessed dates File Content Includes information within individual files Represents a much more granular level of detail, and subsequently a larger data footprint and supporting set of infrastructure requirements Repositories , File Shares, ERM / EDM / ECM Systems, SharePoint, File sync and share sites such as Box.net or Dropbox, Data Archives, Business Intelligence (BI) / Data Warehouse Environments

18 Representative Vendors Primary Use Cases Supported by 2016 List Vendors Capax Discovery Data Global Egnyte Index Engines Spirion STEALTHbits Varonis Veritas Efficiency/ Optimization Kazoup Condrey Haystac Governance/Policy Management Risk Mitigation Active Navigation Adlib Software BeyondRecognition Bloomberg Controle Cryptzone Druva Exterro SailPoint Titus Source: Gartner: Market Guide for File Analysis Software (19 September 2016) Gartner s Note: Though most vendors support some elements of each use case, vendors are listed in the above diagram according to the major use case supported and what customers acquire the solution for. Analytics HPE IBM ZL Technologies

19 Demerger Example

20 Thank You! Craig Shogren Manager HBR Consulting

21 Introducing our Speakers Rich Lauwers Information Governance Subject Matter Expert HPE Kelly Huckman, JD Consultant Iron Mountain

22 How Do We Better Connect Legal Regulations and Operational Requirements to Our Content? The first and last mile of retention The First Mile: Retention Considerations Connect The Last Mile: Policy Execution Audit logs Auto collection of laws Government regulations IT Operations Industry specific regulations Business Needs Apply at scale Centralized policy Translate to retention rules Physical Content Structured Repositories Cloud Unstructured repositories File Shares SAP Desktop

23 Why Has Connecting the First and Last Mile of Retention Been So Difficult? Policy is not digitally connected to content Appeared complex, time consuming, costly & hard to maintain Origins of Records Management were paper not IT Demand was for commercial off-the-shelf solutions A lack of standards

24 GDPR Enacted to Help Protect EU Citizen Data from Risk

25 What Challenges Does GDPR Create? Understand of the scope of PII Identify PII, determine format locate it within IT real estate Isolate and classify PII Appreciate the retention times for personal data and contact information Obtain and retain explicit consent of data subjects Limit access of PII based upon scope of consent Facilitate the right to erasure of personal data

26 Create a Data Map Map both PII and Non-PII data sources Establish relationships b/w data sources/owners with relevant Record Classes Represent processing purposes consented to by data subjects Identify PII locations, create an e-discovery data map, and inform a coherent e-comms policy in a single project

27 Digitally Connect Policy to Content Physical Content Cloud Enterprise Content Management Unstructured repositories SAP Retention Schedule, Organization Structure, Data Maps, etc. Structured repositories File Shares

28 Mapping Get Consent Report Compliance Manage Data In Scope (Personal Data) Secure Personal Data Find Classify Govern Information Management & Governance Security Records Repository Data Repositories Data Security Application Security Security Intelligence (Breach Detection)

29 Complete GDPR Platform Find Classify Govern Data Repositories Apply Retention Rules Compliance, Legal Hold & Audit Applications Document Management Files SharePoint Messaging Read Apply Analyse Action Data Encryption Declare Eligible Records Record Repository Data Warehouses Social Media Web Content Store Data Archive

30 Methodology Redundant Obsolete Trivial Survey and confirm Index metadata and content of documents Extract named entities (SSN, s, phones ) «ROT» analysis «Technical» analysis (size, type, age ) Creation of Categories based on entities, metadata and/or content Apply tags Move Secure Archive Review

31 Content Manager Component Overview Ingested Policy Center data stays in Content Manager Retention laws, jurisdictions and vertical industry information is mapped Policy Center is polled for updates Updates are ingested and managed permanently Content Manager is licensed perpetually All components remain active Annual support renewal Connector that extracts and ingests Retention Requirements into Electronic Content Manager Mapping of data Classifications Retention schedules HPE CM Policy Center Connector HPE CM Auto- Classification Module Trained on existing content or BCS Holding node prior to classification Automatic folder creation Linked security & retention Information lifecycle management Governance-based ECM Access defined by authorized seats Perpetual license + annual maintenance HPE Content Manager (ECM + Retention)

32 Take a look at what HPE has to offer HPE GDPR self assessment

33 Thank You! Rich Lauwers Information Management Subject Matter Expert HPE CST, Chicago Kelly Huckman, JD Consultant Iron Mountain

34

35 You ve just attended an AIIM Webinar. What now? Take your skills to the next level by learning how to map, design, capture, and automate operational processes using a combination of strategies, and technologies with AIIM s Training Courses

36