An Automated Cornerstone to Privacy & Industry Regulations; End-to-End: Researched Legal Requirements to Defensible Disposition

Transcription

1 An Automated Cornerstone to Privacy & Industry Regulations; End-to-End: Researched Legal Requirements to Defensible Disposition

2 Speakers Brian Aungst: Business Development Executive; Hewlett Packard Enterprise Information Governance Teresa Schoch: Consulting Principle; Iron Mountain Privacy Practice Licensed Attorney Masters in Library and Information Science Certified Records Manager- CRM (ICRM) Certified Information Privacy Professional- CIPP (IAPP) Electronic Records Management Masters- ERM m (AIIM) Certified Information Professional- CIP (AIIM) Certified Change Manager- CCM (Prosci) Information Governance Professional- IGP (ARMA) Certified Law Librarian- CLL (AALL) Authored 50+ publications, including Attorneys in the Information Age Is There a Duty to Make the Transition, which remains required reading for many incoming law students. Received Author of the Year Award for Online Article, Natural Language Comes Of Age. Thom Whittemore: Principle, Professional Services; Iron Mountain Information Governance 2

3 Agenda The Problem. Tackling IG and Privacy requires Automation Fitting into the existing Infrastructure Solution Kit approach Help with the journey Q&A

4 The Problem There are Quickly Evolving Legal & Regulatory Compliance Requirements, including the escalating focus on Privacy Privacy Regulations are well established in some state jurisdictions EU is Leading the Privacy global movement with GDPR GDPR has long arms There is an explosion of Digital Data Applications: Legacy & Cloud Internally developed & off the shelf Documents spread across the enterprise Legacy and Cloud (Office 365 ) 4

5 Privacy and Security are at a tipping point Privacy Security The new GDPR, effective May, 2018, mandates higher level of privacy protection to any person residing in EU. EU restrictions are becoming the global standard. Privacy retention maximums conflict with other legally required retention minimums. You can t have privacy without security. You can t secure data if you don t know where it is. Hackers are becoming more sophisticated with increasing success. Security risk is at all enterprise levels, not just IT; accountability is at board level. Responsibility for breaches reaching C level under US state data breach statutes. Fines of 20M euros or 4% global sales 5

6 Privacy = Security + Governance All data needs to be addressed Scale mandates Automation Automation requires the ability to work across the entire environment by Policy Classification is required to understand data and map to Policy Policy must be compliant, comprehensive, current and automatically enforced

7 Starting with Policy Center & Global Research.. Policy Center is a modern cloud-based authoring and distribution platform that is tightly integrated with the Global Research Service (GRS) Understand and interrogate legal and regulatory requirements with advanced filtering and searching Associate granular legal citations directly with your retention schedule class scheme Overcome the limitations of a flat retention schedule with the ability to map your organizational structure, data locations, stewards and custodians. Meet defensibility requirements with a full audit trail Systematically link your retention schedule with your content infrastructure through integration with HPE Secure Content Manager

8 Your Policy, Current Everywhere 8

9 Policy Center POV 9

10 Deconstructed Records Retention Schedule 10

11 How do we better connect legal regulations and policies to our content? Retention Laws & Privacy Requirements Audit logs Connect Auto collection of laws Classification, Automation & Enforcement Government regulations Physical Content Cloud IT Operations Industry specific regulations Business Needs Apply at scale Centralized policy Translate to retention rules Structured Repositories Unstructured repositories File Shares SAP Desktop 11

12 All of the Data Find Data Repositories Applications Files Document Management SharePoint Messaging Data Warehouses Social Media Web Content

13 Automation often starts with Classification of Structured Content Where most of the Personal Data Lives Most Personal Data lives in Business Applications that run on databases Vast Data Corpus Companies can have 10-10,000 applications Applications have ,000 tables Tables can have 100 s of columns and millions of rows Geographical spread of data and multiple jurisdictions Databases offer no tools to find Personal Data Discovery is a manual Spreadsheet + Human effort This is slow, error prone, expensive, becomes obsolete when application changes The manual process can take 6-18 months to complete The ability of HPE s Automated solution to recognize privacy patterns and relationships and then apply encryption rapidly accelerates the journey to compliance

14 Unstructured Data mapping and Classification Identify and index to understand your information landscape Connect and identify repositories Common data sources include: Index File systems MS SharePoint MS Exchange Notes Hadoop HPE TRIM, Records Manager & Content Manager Metadata and content index Identify sensitive information Identify potential business records Yields greater insight into business value and context Metadata only index (light index) identifies redundant, obsolete and trivial data Provides insight into data aging and business relevance

15 Unstructured Data Content Curation Policy to drive content clean-up, management or migration Identify Items of interest to protect Sensitive information Personal Data, etc. Records and critical content Intellectual property Redundant, obsolete and trivial (ROT) data Duplicates, unauthorized copies Out of date or no longer used Junk, executables Apply policy to drive action Dispose Migrate Manage-in-place 15

16 Information Governance and Data Security by Policy Across the Entire Environment Find Classify Data Repositories Applications Files Read Analyse Declare Document Management SharePoint Messaging Data Warehouses Social Media Web Content Store

17 Information Governance and Data Security by Policy Across the Entire Environment Find Classify Govern Data Repositories Apply Retention rules Compliance, Legal Hold & Audit Applications Files Read Analyse Declare Record Repository Document Management SharePoint Messaging Data Encryption Data Warehouses Social Media Web Content Store

18 Information Governance and Data Security by Policy Across the Entire Environment Find Classify Govern Data Repositories Apply Retention rules Compliance, Legal Hold & Audit Applications Files Read Analyse Declare Record Repository Document Management SharePoint Messaging Apply Action Data Encryption Eligible Records Data Warehouses Social Media Web Content Store Data Archive

19 Fits into the existing Infrastructure 19

20 Solution Kit Approach Privacy Data management with HPE Secure Content Manager Find UD Classify Govern Data Repositories Apply Retention rules Compliance, Legal Hold & Audit Applications Document Management Files SharePoint Messaging Read Apply SDM SDM Analyse Action Control Point Control Point SecureData ESKM Data Encryption Declare Eligible Records Content Manager Record Repository Content Manager Data Warehouses Social Media Web Content Store Data Archive UD: SDM: ESKM: Universal Discovery Structured Data Manager Enterprise Secure Key Manager

21 Help with the Journey Preparedness Assessment Privacy Program Assessment Governance Risk Map Program GAP Data Protection Accountability Remediation Assurance 5 Respond to 4 Respond & 3 2 Data 1 0 Personal Data Consulting Services to create custom privacy policies Data Flow Privacy by Records Policy Data Protection Systems & Privacy Program Implementation Technology Implementation/Integration Data Processing / Lifecycle Mgmt. Records Mgmt. 5 Data Flow 4 Records Mgmt. 3 2 Right to be 1 0 Archival Consent Obtaining Registry and Accuracy Purpose Limitation Data Minimisation Data Retention Pseudonymisati Contractual Storage Limitation Legal base for Transfer Controls Lawful & 21

22 Summary HPE s GDPR focused solution: Centrally Controlled Governance Accurate & Up-to-date regulations & policies Comprehensive Discovery & Classification Structured Unstructured Policy Driven Automation HPE & Iron Mountain can help you become GDPR Compliant

23 Questions

24 Speaker Contact Information Brian Aungst: Business Development Executive, HPE Information Governance Teresa Schoch: Principle Consultant, Iron Mountain Privacy Practice Thom Whittemore: Principle, Professional Services, Iron Mountain Information Governance

25 Thank You