Information governance: concepts, strategies, and best practices

Cover......Page 1
Title Page......Page 5
Copyright......Page 6
Contents......Page 9
Preface......Page 19
Acknowledgments......Page 21
Part One Information Governance Concepts, Definitions, and Principles......Page 23
 Chapter 1 The Information Governance Imperative......Page 25
  Early Development of IG......Page 26
  Big Data Impact......Page 27
  Defining Information Governance......Page 29
  Why IG Is Good Business......Page 31
  Failures in Information Governance......Page 33
  Form IG Policies, Then Apply Technology for Enforcement......Page 36
  Notes......Page 39
  Data Governance......Page 41
  Data Governance Strategy Tips......Page 42
  IT Governance......Page 43
  IT Governance Frameworks......Page 44
  Impact of a Successful IG Program......Page 47
  Summing Up the Differences......Page 48
  Notes......Page 50
  The Sedona Conference® Commentary on Information Governance......Page 51
  Smallwood IG Principles......Page 52
  Accountability Is Key......Page 56
  Generally Accepted Recordkeeping Principles®......Page 57
  Assessment and Improvement Roadmap......Page 64
  Privacy Principles......Page 67
  Who Should Determine IG Policies?......Page 70
  Notes......Page 72
Part Two Information Governance Risk Assessment and Strategic Planning......Page 75
 Chapter 4 Information Asset Risk Planning and Management......Page 77
  The Information Risk Planning Process......Page 78
  Create a Risk Profile......Page 81
  Information Risk Planning and Management Summary......Page 87
  Notes......Page 88
 Chapter 5 Strategic Planning and Best Practices for Information Governance......Page 91
  Crucial Executive Sponsor Role......Page 92
  Evolving Role of the Executive Sponsor......Page 93
  Assigning IG Team Roles and Responsibilities......Page 94
  Align Your IG Plan with Organizational Strategic Plans......Page 95
  Survey and Evaluate External Factors......Page 97
  Formulating the IG Strategic Plan......Page 103
  Notes......Page 107
  The Sedona Conference IG Principles......Page 109
  IG Reference Model......Page 110
  Best Practices Considerations......Page 113
  Standards Considerations......Page 114
  Key Standards Relevant to IG Efforts......Page 115
  Major National and Regional ERM Standards......Page 120
  Roles and Responsibilities......Page 127
  Program Communications and Training......Page 128
  Program Controls, Monitoring, Auditing, and Enforcement......Page 129
  Notes......Page 131
Part Three Information Governance Key Impact Areas......Page 135
  Start with Business Objective Alignment......Page 137
  What Is Infonomics?......Page 139
  How to Begin an IG Program......Page 140
  Changing Information Environment......Page 141
  Calculating Information Costs......Page 143
  Big Data Opportunities and Challenges......Page 144
  Full Cost Accounting for Information......Page 145
  Calculating the Cost of Owning Unstructured Information......Page 146
  The Path to Information Value......Page 149
  New Information Models......Page 151
  Future State: What Will the IG-Enabled Organization Look Like?......Page 152
  Moving Forward......Page 154
  Notes......Page 156
  Introduction to E-Discovery: The Revised 2006 and 2015 Federal Rules of Civil Procedure Changed Everything......Page 157
  Big Data Impact......Page 159
  More Details on the Revised FRCP Rules......Page 160
  Landmark E-Discovery Case: Zubulake v. UBS Warburg......Page 161
  E-Discovery Reference Model......Page 162
  The Intersection of IG and E-Discovery......Page 165
  Building on Legal Hold Programs to Launch Defensible Disposition......Page 168
  Newer Technologies That Can Assist in E-Discovery......Page 169
  Defensible Disposal: The Only Real Way to Manage Terabytes and Petabytes......Page 173
  Notes......Page 181
 Chapter 9 Information Governance and Records and Information Management Functions*......Page 183
  Records Management Business Rationale......Page 185
  Why Is Records Management So Challenging?......Page 187
  Benefits of Electronic Records Management......Page 188
  Additional Intangible Benefits......Page 189
  Inventorying E-Records......Page 190
  RM Intersection with Data Privacy Management......Page 191
  Generally Accepted Recordkeeping Principles®......Page 193
  Records Inventory Purposes......Page 194
  Records Inventorying Steps......Page 195
  Ensuring Adoption and Compliance of RM Policy......Page 206
  Sample Information Asset Survey Questions......Page 212
  General Principles of a Retention Scheduling......Page 213
  Developing a Records Retention Schedule......Page 214
  Why Are Retention Schedules Needed?......Page 215
  What Records Do You Have to Schedule? Inventory and Classification......Page 217
  Rationale for Records Groupings......Page 218
  Retention of E-Mail Records......Page 219
  Destructive Retention of E-Mail......Page 221
  Legal Requirements and Compliance Research......Page 222
  Event-Based Retention Scheduling for Disposition of E-Records......Page 223
  Prerequisites for Event-Based Disposition......Page 224
  Final Disposition and Closure Criteria......Page 225
  Implementation of the Retention Schedule and Disposal of Records......Page 226
  Ongoing Maintenance of the Retention Schedule......Page 227
  Audit to Manage Compliance with the Retention Schedule......Page 228
  Notes......Page 231
 Chapter 10 Information Governance and Information Technology Functions......Page 233
  Data Governance......Page 235
  Steps to Governing Data Effectively......Page 236
  Data Governance Framework......Page 237
  Information Management......Page 238
  IT Governance......Page 242
  IG Best Practices for Database Security and Compliance......Page 245
  Tying It All Together......Page 247
  Notes......Page 248
  Information Privacy......Page 251
  Generally Accepted Privacy Principles......Page 253
  Fair Information Practices (FIPS)......Page 254
  OCED Privacy Principles......Page 255
  Madrid Resolution 2009......Page 256
  EU General Data Protection Regulation......Page 257
  GDPR: A Look at Its First Year......Page 259
  Privacy Programs......Page 261
  Privacy in the United States......Page 262
  Privacy Laws......Page 266
  Cybersecurity......Page 267
  Cyberattacks Proliferate......Page 268
  Insider Threat: Malicious or Not......Page 269
  Information Security Assessments and Awareness Training......Page 270
  Cybersecurity Considerations and Approaches......Page 275
  Controlling Access Using Identity Access Management......Page 276
  Enforcing IG: Protect Files with Rules and Permissions......Page 277
  Challenge of Securing Confidential E-Documents......Page 278
  Apply Better Technology for Better Enforcement in the Extended Enterprise......Page 279
  E-Mail Encryption......Page 281
  Secure Communications Using Record-Free E-Mail......Page 282
  Digital Signatures......Page 283
  Data Loss Prevention (DLP) Technology......Page 284
  Missing Piece: Information Rights Management (IRM)......Page 287
  Embedded Protection......Page 290
  Securing Trade Secrets after Layoffs and Terminations......Page 292
  Persistently Protecting Blueprints and CAD Documents......Page 293
  Approaches for Securing Data Once It Leaves the Organization......Page 294
  Document Labeling......Page 296
  Confidential Stream Messaging......Page 297
  Notes......Page 301
Part Four Information Governance for Delivery Platforms......Page 305
 Chapter 12 Information Governance for E-Mail and Instant Messaging*......Page 307
  Employees Regularly Expose Organizations to E-Mail Risk......Page 308
  E-Record Retention: Fundamentally a Legal Issue......Page 309
  Preserve E-Mail Integrity and Admissibility with Automatic Archiving......Page 310
  Instant Messaging......Page 313
  Best Practices for Business IM Use......Page 314
  Technology to Monitor IM......Page 315
  Team and Channel Messaging Solutions Emerge......Page 316
  Notes......Page 318
  Types of Social Media in Web 2.0......Page 321
  Additional Social Media Categories......Page 325
  Social Media in the Enterprise......Page 326
  Key Ways Social Media Is Different from E-Mail and Instant Messaging......Page 327
  Biggest Risks of Social Media......Page 328
  Legal Risks of Social Media Posts......Page 329
  Tools to Archive Social Media......Page 331
  IG Considerations for Social Media......Page 333
  Key Social Media Policy Guidelines......Page 334
  Records Management and Litigation Considerations for Social Media......Page 335
  Emerging Best Practices for Managing Social Media Records......Page 337
  Notes......Page 339
 Chapter 14 Information Governance for Mobile Devices......Page 341
  Current Trends in Mobile Computing......Page 344
  Security Risks of Mobile Computing......Page 345
  Mobile Device Management (MDM)......Page 346
  IG for Mobile Computing......Page 347
  Building Security into Mobile Applications......Page 348
  Developing Mobile Device Policies......Page 352
  Notes......Page 355
 Chapter 15 Information Governance for Cloud Computing*......Page 357
  Defining Cloud Computing......Page 358
  Key Characteristics of Cloud Computing......Page 359
  What Cloud Computing Really Means......Page 360
  Cloud Deployment Models......Page 361
  Benefits of the Cloud......Page 362
  Security Threats with Cloud Computing......Page 363
  IG Guidelines for Cloud Computing Solutions......Page 373
  IG for SharePoint and Office365......Page 374
  Notes......Page 377
  Data Analytics......Page 379
  Predictive Analytics......Page 380
  Which Type of Analytics Is Best?......Page 381
  The Role of Artificial Intelligence in IG......Page 385
  Breaking Down the Definition of Blockchain......Page 388
  The Internet of Things: IG Challenges......Page 394
  IoT as a System of Contracts......Page 397
  IoT Basic Risks and IG Issues......Page 398
  IoT E-Discovery Issues......Page 399
  Why IoT Trustworthiness Is a Journey and Not a Project......Page 402
  Governing the IoT Data......Page 403
  IoT Trustworthiness......Page 404
  Information Governance Versus IoT Trustworthiness......Page 406
  IoT Trustworthiness Journey......Page 407
  Conclusion......Page 408
  Notes......Page 410
Part Five Long-Term Program Issues......Page 413
  Defining Long-Term Digital Preservation......Page 415
  Key Factors in Long-Term Digital Preservation......Page 416
  Threats to Preserving Records......Page 418
  Digital Preservation Standards......Page 419
  PREMIS Preservation Metadata Standard......Page 426
  Recommended Open Standard Technology–Neutral Formats......Page 427
  Long-Term Digital Preservation Capability Maturity Model®......Page 431
  Scope of the Capability Maturity Model......Page 434
  Digital Preservation Capability Performance Metrics......Page 438
  Digital Preservation Strategies and Techniques......Page 439
  Evolving Marketplace......Page 441
  Looking Forward......Page 442
  Conclusion......Page 443
  Notes......Page 445
  Monitoring and Accountability......Page 447
  Change Management—Required......Page 448
  Continuous Process Improvement......Page 451
  Why Continuous Improvement Is Needed......Page 452
  Notes......Page 453
Appendix A Information Organization and Classification: Taxonomies and Metadata......Page 455
 When Is a New Taxonomy Needed?......Page 457
 Taxonomies Improve Search Results......Page 458
 Metadata and Taxonomy......Page 459
 Metadata Governance, Standards, and Strategies......Page 460
 Types of Metadata......Page 462
 Core Metadata Issues......Page 463
 International Metadata Standards and Guidance......Page 464
 Business Classification Scheme, File Plans, and Taxonomy......Page 468
 Classification and Taxonomy......Page 469
 Prebuilt Versus Custom Taxonomies......Page 470
 Taxonomy Types......Page 471
 Business Process Analysis......Page 475
 Taxonomy Maintenance......Page 479
 Social Tagging and Folksonomies......Page 480
 Endnotes......Page 482
 Healthcare Insurance Portability and Accountability Act of 1996 (HIPAA)......Page 485
 CFR Title 21, Part 11—Pharmaceuticals......Page 486
 US Code of Federal Regulations......Page 487
 Canada*......Page 488
 United Kingdom......Page 490
 Australia......Page 491
 Identifying Records Management Requirements in Other Legislation......Page 493
 Notes......Page 494
 United States......Page 497
 European Union General Data Protection Regulation (GDPR)......Page 498
 Major Privacy Laws Worldwide, by Country......Page 500
 Notes......Page 502
Glossary......Page 503
 Notes......Page 520
About the Author......Page 521
About the Major Contributors......Page 523
Index......Page 527
EULA......Page 547