Information Governance Concepts, Strategies and Best Practices

The essential guide to effective IG strategy and practice

Information Governance is a highly practical and deeply informative handbook for the implementation of effective Information Governance (IG) procedures and strategies. A critical facet of any mid- to large-sized company, this “super-discipline” has expanded to cover the management and output of information across the entire organization; from email, social media, and cloud computing to electronic records and documents, the IG umbrella now covers nearly every aspect of your business. As more and more everyday business is conducted electronically, the need for robust internal management and compliance grows accordingly. This book offers big-picture guidance on effective IG, with particular emphasis on document and records management best practices.

Step-by-step strategy development guidance is backed by expert insight and crucial advice from a leading authority in the field. This new second edition has been updated to align with the latest practices and regulations, providing an up-to-date understanding of critical IG concepts and practices.

• Explore the many controls and strategies under the IG umbrella
• Understand why a dedicated IG function is needed in today’s organizations
• Adopt accepted best practices that manage risk in the use of electronic documents and data

• Learn how IG and IT technologies are used to control, monitor, and enforce information access and security policy

IG strategy must cover legal demands and external regulatory requirements as well as internal governance objectives; integrating such a broad spectrum of demands into workable policy requires a deep understanding of key concepts and technologies, as well as a clear familiarity with the most current iterations of various requirements. Information Governance distills the best of IG into a primer for effective action.   

ROBERT F. SMALLWOOD, MBA, CIP, IGP, is founder of the Institute for Information Governance, a specialty training and consulting practice, and CEO, Publisher, and co-founder of Information Governance World magazine. Some of his past research and consulting clients include Abbott Labs, Kirkwood and Ellis LLP, NASA, Novartis Pharmaceuticals, and Verizon. He is the author of Managing Electronic Records: Methods, Best Practices, and Technologies and Safeguarding Critical E-Documents, both from Wiley.

Preface xvii

Acknowledgments xix

Part One—Information Governance Concepts, Definitions, and Principles 1

Chapter 1 The Information Governance Imperative 3

Early Development of IG 4

Big Data Impact 5

Defining Information Governance 7

IG is Not a Project, But an Ongoing Program 9

Why IG is Good Business 9

Failures in Information Governance 11

Form IG Policies, Then Apply Technology for Enforcement 14

Chapter 2 Information Governance, IT Governance, Data Governance: What’s the Difference? 19

Data Governance 19

Data Governance Strategy Tips 20

IT Governance 21

IT Governance Frameworks 22

Information Governance 25

Impact of a Successful IG Program 25

Summing Up the Differences 26

Chapter 3 Information Governance Principles 29

The Sedona Conference^® Commentary on Information Governance 29

Smallwood IG Principles 30

Accountability is Key 34

Generally Accepted Recordkeeping Principles^® 35
Contributed by Charmaine Brooks

Assessment and Improvement Roadmap 42

Information Security Principles 45

Privacy Principles 45

Who Should Determine IG Policies? 48

Part Two—Information Governance Risk Assessment and Strategic Planning 53

Chapter 4 Information Asset Risk Planning and Management 55

The Information Risk Planning Process 56

Create a Risk Profile 59

Information Risk Planning and Management Summary 65

Chapter 5 Strategic Planning and Best Practices for Information Governance 69

Crucial Executive Sponsor Role 70

Evolving Role of the Executive Sponsor 71

Building Your IG Team 72

Assigning IG Team Roles and Responsibilities 72

Align Your IG Plan with Organizational Strategic Plans 73

Survey and Evaluate External Factors 75

Formulating the IG Strategic Plan 81

Chapter 6 Information Governance Policy Development 87

The Sedona Conference IG Principles 87

A Brief Review of Generally Accepted Recordkeeping Principles^® 88

IG Reference Model 88

Best Practices Considerations 91

Standards Considerations 92

Benefits and Risks of Standards 93

Key Standards Relevant to IG Efforts 93

Major National and Regional ERM Standards 98

Making Your Best Practices and Standards Selections to Inform Your IG Framework 105

Roles and Responsibilities 105

Program Communications and Training 106

Program Controls, Monitoring, Auditing, and Enforcement 107

Part Three—Information Governance Key Impact Areas 113

Chapter 7 Information Governance for Business Units 115

Start with Business Objective Alignment 115

Which Business Units are the Best Candidates to Pilot an IG Program? 117

What is Infonomics? 117

How to Begin an IG Program 118

Business Considerations for an IG Program 119
By Barclay T. Blair

Changing Information Environment 119

Calculating Information Costs 121

Big Data Opportunities and Challenges 122

Full Cost Accounting for Information 123

Calculating the Cost of Owning Unstructured Information 124

The Path to Information Value 127

Challenging the Culture 129

New Information Models 129

Future State: What Will the IG-Enabled Organization Look Like? 130

Moving Forward 132

Chapter 8 Information Governance and Legal Functions 135
Robert Smallwood with Randy Kahn, Esq., and Barry Murphy

Introduction to E-Discovery: The Revised 2006 and 2015 Federal Rules of Civil Procedure Changed Everything 135

Big Data Impact 137

More Details on the Revised FRCP Rules 138

Landmark E-Discovery Case: Zubulake v. UBS Warburg 139

E-Discovery Techniques 140

E-Discovery Reference Model 140

The Intersection of IG and E-Discovery 143
By Barry Murphy

Building on Legal Hold Programs to Launch Defensible Disposition 146
By Barry Murphy

Destructive Retention of E-Mail 147

Newer Technologies That Can Assist in E-Discovery 147

Defensible Disposal: The Only Real Way to Manage Terabytes and Petabytes 151
By Randy Kahn, Esq.

Chapter 9 Information Governance and Records and Information Management Functions 161

Records Management Business Rationale 163

Why is Records Management So Challenging? 165

Benefits of Electronic Records Management 166

Additional Intangible Benefits 167

Inventorying E-Records 168

RM Intersection with Data Privacy Management 169
By Teresa Schoch

Generally Accepted Recordkeeping Principles^® 171

E-Records Inventory Challenges 172

Records Inventory Purposes 172

Records Inventorying Steps 173

Appraising the Value of Records 184

Ensuring Adoption and Compliance of RM Policy 184

Sample Information Asset Survey Questions 190

General Principles of a Retention Scheduling 191

Developing a Records Retention Schedule 192

Why are Retention Schedules Needed? 193

What Records Do You Have to Schedule? Inventory and Classification 195

Rationale for Records Groupings 196

Records Series Identification and Classification 197

Retention of E-Mail Records 197

How Long Should You Keep Old E-Mails? 199

Destructive Retention of E-Mail 199

Legal Requirements and Compliance Research 200

Event-Based Retention Scheduling for Disposition of E-Records 201

Prerequisites for Event-Based Disposition 202

Final Disposition and Closure Criteria 203

Retaining Transitory Records 204

Implementation of the Retention Schedule and Disposal of Records 204

Ongoing Maintenance of the Retention Schedule 205

Audit to Manage Compliance with the Retention Schedule 206

Chapter 10 Information Governance and Information Technology Functions 211

Data Governance 213

Steps to Governing Data Effectively 214

Data Governance Framework 215

Information Management 216

IT Governance 220

IG Best Practices for Database Security and Compliance 223

Tying It All Together 225

Chapter 11 Information Governance and Privacy and Security Functions 229

Information Privacy 229
By Andrew Ysasi

Generally Accepted Privacy Principles 231

Fair Information Practices (FIPS) 232

OCED Privacy Principles 233

Madrid Resolution 2009 234

EU General Data Protection Regulation 235

GDPR: A Look at Its First Year 237
By Mark Driskill

Privacy Programs 239

Privacy in the United States 240

Privacy Laws 244

Cybersecurity 245

Cyberattacks Proliferate 246

Insider Threat: Malicious or Not 247

Information Security Assessments and Awareness Training 248
By Baird Brueseke

Cybersecurity Considerations and Approaches 253
By Robert Smallwood

Defense in Depth 254

Controlling Access Using Identity Access Management 254

Enforcing IG: Protect Files with Rules and Permissions 255

Challenge of Securing Confidential E-Documents 256

Apply Better Technology for Better Enforcement in the Extended Enterprise 257

E-Mail Encryption 259

Secure Communications Using Record-Free E-Mail 260

Digital Signatures 261

Document Encryption 262

Data Loss Prevention (DLP) Technology 262

Missing Piece: Information Rights Management (IRM) 265

Embedded Protection 268

Hybrid Approach: Combining DLP and IRM Technologies 270

Securing Trade Secrets After Layoffs and Terminations 270

Persistently Protecting Blueprints and CAD Documents 271

Securing Internal Price Lists 272

Approaches for Securing Data Once It Leaves the Organization 272

Document Labeling 274

Document Analytics 275

Confidential Stream Messaging 275

Part Four—Information Governance for Delivery Platforms 283

Chapter 12 Information Governance for E-Mail and Instant Messaging 285

Employees Regularly Expose Organizations to E-Mail Risk 286

E-Mail Polices Should Be Realistic and Technology Agnostic 287

E-Record Retention: Fundamentally a Legal Issue 287

Preserve E-Mail Integrity and Admissibility with Automatic Archiving 288

Instant Messaging 291

Best Practices for Business IM Use 292

Technology to Monitor IM 293

Tips for Safer IM 294

Team and Channel Messaging Solutions Emerge 294

Chapter 13 Information Governance for Social Media 299
Dr. Patricia Franks and Robert Smallwood

Types of Social Media in Web 2.0 299

Additional Social Media Categories 303

Social Media in the Enterprise 304

Key Ways Social Media is Different from E-Mail and Instant Messaging 305

Biggest Risks of Social Media 306

Legal Risks of Social Media Posts 307

Tools to Archive Social Media 309

IG Considerations for Social Media 311

Key Social Media Policy Guidelines 312

Records Management and Litigation Considerations for Social Media 313

Emerging Best Practices for Managing Social Media Records 315

Chapter 14 Information Governance for Mobile Devices 319

Current Trends in Mobile Computing 322

Security Risks of Mobile Computing 323

Securing Mobile Data 324

Mobile Device Management (MDM) 324

IG for Mobile Computing 325

Building Security into Mobile Applications 326

Best Practices to Secure Mobile Applications 330

Developing Mobile Device Policies 330

Chapter 15 Information Governance for Cloud Computing 335
Monica Crocker and Robert Smallwood

Defining Cloud Computing 336

Key Characteristics of Cloud Computing 337

What Cloud Computing Really Means 338

Cloud Deployment Models 339

Benefits of the Cloud 340

Security Threats with Cloud Computing 341

Managing Documents and Records in the Cloud 351

IG Guidelines for Cloud Computing Solutions 351

IG for SharePoint and Office365 352
By Robert Bogue

Chapter 16 Leveraging and Governing Emerging Technologies 357

Data Analytics 357

Descriptive Analytics 358

Diagnostic Analytics 358

Predictive Analytics 358

Prescriptive Analytics 359

Which Type of Analytics is Best? 359

Artificial Intelligence 363

The Role of Artificial Intelligence in IG 363

Blockchain: A New Approach with Clear Advantages 366
By Darra Hoffman

Breaking Down the Definition of Blockchain 366

The Internet of Things: IG Challenges 372

IoT as a System of Contracts 375

IoT Basic Risks and IG Issues 376

IoT E-Discovery Issues 377

Why IoT Trustworthiness is a Journey and Not a Project 380
By Bassam Zarkout

Governing the IoT Data 381

IoT Trustworthiness 382

Information Governance Versus IoT Trustworthiness 384

IoT Trustworthiness Journey 385

Conclusion 386

Part Five—Long-Term Program Issues 391

Chapter 17 Long-Term Digital Preservation 393
Charles M. Dollar and Lori J. Ashley

Defining Long-Term Digital Preservation 393

Key Factors in Long-Term Digital Preservation 394

Threats to Preserving Records 396

Digital Preservation Standards 397

PREMIS Preservation Metadata Standard 404

Recommended Open Standard Technology–Neutral Formats 405

Digital Preservation Requirements 409

Long-Term Digital Preservation Capability Maturity Model^® 409

Scope of the Capability Maturity Model 412

Digital Preservation Capability Performance Metrics 416

Digital Preservation Strategies and Techniques 417

Evolving Marketplace 419

Looking Forward 420

Conclusion 421

Chapter 18 Maintaining an Information Governance Program and Culture of Compliance 425

Monitoring and Accountability 425

Change Management—Required 426
By Monica Crocker

Continuous Process Improvement 429

Why Continuous Improvement is Needed 430

Appendix A Information Organization and Classification: Taxonomies and Metadata 433
Barb Blackburn, CRM, with Robert Smallwood; edited by Seth Earley

Importance of Navigation and Classification 435

When is a New Taxonomy Needed? 435

Taxonomies Improve Search Results 436

Metadata and Taxonomy 437

Metadata Governance, Standards, and Strategies 438

Types of Metadata 440

Core Metadata Issues 441

International Metadata Standards and Guidance 442

Records Grouping Rationale 446

Business Classification Scheme, File Plans, and Taxonomy 446

Classification and Taxonomy 447

Prebuilt Versus Custom Taxonomies 448

Thesaurus Use in Taxonomies 449

Taxonomy Types 449

Business Process Analysis 453

Taxonomy Testing: A Necessary Step 457

Taxonomy Maintenance 457

Social Tagging and Folksonomies 458

Appendix B Laws and Major Regulations Related to Records Management 463

United States 463

Gramm-Leach-Bliley Act 463

Healthcare Insurance Portability and Accountability Act of 1996 (HIPAA) 463

PATRIOT Act (Uniting and Strengthening America by Providing Appropriate Tools Required to Intercept and Obstruct Terrorism Act of 2001) 464

Sarbanes-Oxley Act (SOX) 464

SEC Rule 17A-4 464

CFR Title 47, Part 42—Telecommunications 464

CFR Title 21, Part 11—Pharmaceuticals 464

US Federal Authority on Archives and Records: National Archives and Records Administration (NARA) 465

US Code of Federal Regulations 465

Canada 466

United Kingdom 468

Australia 469

Identifying Records Management Requirements in Other Legislation 471

Appendix C Laws and Major Regulations Related to Privacy 475

United States 475

European Union General Data Protection Regulation (GDPR) 476

Major Privacy Laws Worldwide, by Country 478

Glossary 481

About the Author 499

About the Major Contributors 501

Index 505

The New copy of this book will include any supplemental materials advertised. Please check the title of the book to determine if it should include any access cards, study guides, lab manuals, CDs, etc.

The Used, Rental and eBook copies of this book are not guaranteed to include any supplemental materials. Typically, only the book itself is included. This is true even if the title states it includes any access cards, study guides, lab manuals, CDs, etc.