5 Steps
           to Compliance:
           Building an Automated Data Map
           With electronically stored informat...
The benefits of a data map are           mented, and often in a format that can-          save everything, increasing stor...
automated refresh process delivers an               plain the risks and benefits.           n   Designate a data comptroll...
Wait, there’s more …

The home page for records & information                                                    ...
manual data mapping system. The              – and, in fact, this step must be con-         In the past, maintaining a dat...
Upcoming SlideShare
Loading in …5

Five Steps to Compliance: Building an Automated Data Map


Published on

With electronically stored information duplicated and scattered across the enterprise, organizations benefit from creating a data map that identifies what information exists, where it is stored, and what policies govern it – particularly when facing litigation. Using automation tools to create the data map is the most effective way to keep it evergreen.

Information Management Nov/Dec 2009 article

Published in: Technology, Business
  • Be the first to comment

  • Be the first to like this

No Downloads
Total views
On SlideShare
From Embeds
Number of Embeds
Embeds 0
No embeds

No notes for slide

Five Steps to Compliance: Building an Automated Data Map

  1. 1. 5 Steps to Compliance: Building an Automated Data Map With electronically stored information duplicated and scattered across the enterprise, organizations benefit from creating a data map that identifies what information exists, where it is stored, and what policies govern it – particularly when facing litigation. Using automation tools to create the data map is the most effective way to keep it evergreen. Bobby Balachandran n a litigious business world awash enterprise data map. A data map can haven’t been any tools, applications, or I in electronically stored information (ESI), the need to access and ana- lyze data in a usable format is clear. quickly answer these questions: Where is the data stored, and how can I access it, if at all? Who controls this data? solutions available to organizations looking for a proactive approach for tracking and analyzing their data Unfortunately, many organizations’ What policies govern it? sources, custodians, IT personnel, or choices have been limited to reactive, The enormous amount of ESI and change histories. fire-drill style processes. Ad hoc re- paper-based documents stored in dis- sponses to e-discovery often lead to im- parate locations, the prevalence of Defining a Data Map partial or inaccurate production, an hard-to-track shadow data systems A data map is a comprehensive inability to prove inaccessibility, inad- and individual data marts, the com- and defensible inventory of an organi- vertent noncompliance, and skyrocket- plexity of records management policies zation’s IT systems; it is a repository ing risks and costs. and regulations, data churn, and for data and information mapped to With recent rulings on e-discovery human resources turnover make an- business units, data stewards, and cus- procedure requiring organizations to swering these questions extremely dif- todians; and it is a critical component have defensible knowledge of their data ficult, if not impossible, without the aid of a proactive litigation response plan infrastructure, the logical starting of technology. and essential to a number of other im- point for a litigation response plan is an Unfortunately, until recently, there portant business processes. 40 NOVEMBER/DECEMBER 2009 INFORMATIONMANAGEMENT
  2. 2. The benefits of a data map are mented, and often in a format that can- save everything, increasing stor- many. A data map aids with: not be readily preserved or produced. age costs and barring timely data n Risk mitigation and compliance Litigation, regulations, and personnel disposition management changes add to the complexity. Organ- n Collaboration between internal izations must be able to track changes Consultant Processes at Work and external teams in ESI and IT systems, but these Big Four consulting firms are often n Legal response to discovery re- changes exceed human capacity to called in to do the manual work of quests and regulatory inquiries track it effectively. building and implementing enterprise n U.S. Federal Rules of Civil Proce- Although the IT and records man- data maps, and they bring established dure Rule 26(f) meet-and-confer agement departments each have methodologies to the project. Most con- meeting preparation pieces of a data map, most organiza- duct extensive interviews with key n Targeting hold recipients quickly tions have not developed proactive constituents, determine the best ap- n Avoiding inconsistent or inaccu- policies around information gover- proach for the company, and then, to- rate representations nance. Often, communication between gether with key constituents, drive the n Mitigating spoliation risk IT and legal teams is so disjointed that majority of the data mapping process. n Lightening infrastructure archi- critical information is deleted or legal At one consulting group, for exam- tecture development burden ple, a team of consultants interviews a n Interrupting document destruc- company’s key constituents – leaders tion schedules for preservation in A data map is a from the IT, legal, and records and in- a timely manner comprehensive and formation management (RIM) depart- n Identifying redundant data ments, as well as executive – to sources defensible inventory of an understand business drivers and risks, n Addressing potential data anom- determine scope and appropriate level alies and outliers organization’s IT systems; of granularity, and identify key busi- it is a repository for data ness units. Manual Processes to Address Next the team conducts workshops Data Management and information mapped to define key ESI, business and process Many organizations have devel- owners, and subject matter experts. oped home-grown, ad hoc processes for to business units, data The bulk of data gathering is done addressing data management. stewards, and custodians… through questionnaires and surveys, Most legal departments will cre- and then it is analyzed and refined ate a partial data map. When a trig- through follow-up interviews. The ger event occurs, such as a letter teams unknowingly make unreason- team then determines tools and tech- arriving that threatens legal action, able requests of the IT staff. nology that can be used to house and organizations must locate relevant Ad hoc data maps and discovery so- maintain the ESI on an ongoing basis. data, custodians, and data systems lutions face some serious challenges: and implement a legal hold. Legal n Lack of documentation Automating the Enterprise teams learn over time where the highly n Duplicative background work in Data Map litigious data resides and can get a response to each request A usable data map must be agile feel for who manages it and whom to n Cross-departmental redundan- enough to adapt to constantly changing ask when they need to access it for cies data, litigation profiles, retention poli- discovery. n Critical information stored as cies, HR information, and regulations. Organizations often also have IT easily lost tribal knowledge Combining established processes and inventories. For example, financial and n Risk of human error, incorrect or best practices with automated data human resources systems are typically incomplete production, and mapping technology is the best way to well-documented due to corporate and costly sanctions achieve this needed agility. records retention policies. Others grow n Time-consuming data searches Today, dynamic data mapping up due to the needs of the business and that lead to missed deadlines and software facilitates the data mapping exist in sub-organizations or as project higher costs process through standardized, intelli- resources and are largely documented n Heavy burden on IT as they may gent workflows to produce a compre- through tribal knowledge. be tasked to find information hensive, evergreen data map. Built-in The end result is ESI scattered they didn’t know they needed to checks and balances eliminate human across the organization, undocu- save, or they may be asked to error and manage compliance, and an NOVEMBER/DECEMBER 2009 INFORMATIONMANAGEMENT 41
  3. 3. automated refresh process delivers an plain the risks and benefits. n Designate a data comptroller for up-to-date and accurate data map n Show how benefits of a data map the data map ready for use. can be leveraged across the en- An automated data map will: terprise. 2. Assemble: Identification and n Streamline processes by build- Next, organizations must choose a Data Gathering ing, analyzing, and refreshing dynamic data mapping process-control A thorough process is essential the data map automatically solution. By providing a solid, central- to creating a comprehensive cata- n Enforce compliance with data ized framework for a data map project, logue of data sources and custodi- policies and processes an automated data mapping solution ans; it ensures no shadow or n Facilitate efficient legal pro- cuts down on the time and money paper-based data systems are cesses, from risk assessment and spent on this difficult initial phase and missed. Distribute questionnaires litigation profile building to legal each of the following steps by: and surveys, conduct workshops and hold creation and discovery n Institutionalizing roles interviews, and follow up with sec- n Reduce downstream staffing n Providing timeline and task ondary interviews. needs alerts Through automation, the num- n Reduce risks like data loss and ber of staff hours needed to gather spoliation this information decreases, accuracy n Facilitate data disposition A thorough process is increases, and costs are reduced. Au- n Provide a solid foundation for essential to creating a tomation: litigation preparation, legal risk n Provides automated informa- assessment, and discovery re- comprehensive catalogue tion request notifications and sponse reminders Today, consulting companies and of data sources and n Automates interview, question- leading experts recommend the follow- custodians; it ensures naire and survey templating, ing five steps to create and manage a management, and self-submis- data map: no shadow or paper- sion 1. Define n Tracks and manages responses 2. Assemble based data systems to questionnaires, surveys, and 3. Analyze are missed. interviews, and it monitors 4. Automate compliance with data mapping 5. Refresh requests n Planning and budgeting tools n Integrates with HR and IT sys- 1. Define: Preparation and Design n Enabling project managers to tems to find up-to-date lists of In order to begin a data mapping monitor and enforce compliance custodians, servers, etc. project, it’s important to ensure three with roles and duties n Builds compliance into daily things: n Providing a centralized location workflows n Buy-in from executives and em- for custodian and data source n Allows custodians and data ployees information stewards to self-upload infor- n Access to an automated system of Next, companies must create a mation through a compliance alerts to enforce and monitor project team comprising key stake- portal compliance holders from departments most af- n Allows managers and data n Time and resources needed for a fected by a data map – IT, legal, and comptrollers to track and man- comprehensive project RIM. Hold one or more initial meet- age compliance easily The importance of buy-in can’t be ings to: n Auto-populates the data map overstated. In a recent panel presenta- n Determine project objectives, de- Often, ESI is stored centrally in a tion, Cheryl Strom, senior manager of fine scope, identify key and data warehouse. However, many peo- records information management at high-risk business units, and ple will keep their own copies and set McDonald’s Inc., provided the following determine the appropriate level up shadow systems or data marts on guidelines for securing buy-in from of granularity desktops, removable storage devices, or upper management: n Assign roles and responsibilities, in hard copy format. n Identify cost savings in hard determine clear timelines and An automated data map can ac- numbers. deliverables, and create a de- count for private copies that are out- n Bring in an outside expert to ex- tailed project plan and budget side the normal parameters of a 42 NOVEMBER/DECEMBER 2009 INFORMATIONMANAGEMENT
  4. 4. Wait, there’s more … arma.org The home page for records & information management If you’re involved in managing your organization’s information and haven’t visited arma.org lately, look what you’ve missed! WWW. . . Go to arma.org for • Standards & best practices • Articles & white papers • Regulatory updates • Professional competencies [Articles] [Video] • Web seminar archives At Your Technology Spotlight • Podcasts & blogs Fingertips Top industry movers and • RIM marketing tools From auto classifi- shakers discuss the latest • News & more news cation to Zubulake, information management technology trends. The PODCAST • Risk assessment tools you can find articles, books, and panel includes representa- [Podcasts] • Books & videos on RIM other resources unavailable tives from CA, IBM, Iron Hear and There • Event calendar anywhere else in the ARMA Mountain, and Oracle; From the Expo floor, hear • Buyer’s Guide International Bookstore. The moderated by IDC Senior interviews with decision Bookstore includes all past Research Analyst Vivian Tero. makers, visionaries, and feature articles fromThe leaders of information Learn more about Information Management management policy. Visit www.arma.org/podcast • Electronic records management Journal and Information Management magazine. • RIM fundamentals • Regulatory issues • E-discovery • Standards & best practices IDC’s Vivian Tero • Information security • Global RIM issues • Information technology [Buyer’s Guide] Online! [White Papers] Search vendors and A Broader Perspective companies that provide products Download free white papers from and services to the RIM industry alphabetically, some of the leading industry experts by company, by product category, or by keyword. on topics such as electronic records Your search will return a list of companies that management, compliance, e-discovery, match your criteria. Select from that list to find enterprise content management, and more information about that company. general records management. www.arma.org
  5. 5. manual data mapping system. The – and, in fact, this step must be con- In the past, maintaining a data best source of information for shadow ducted in concert with all the other map was a painful, protracted data systems are individual employ- steps. Until recently, options for tools process that required a massive, ees, and it’s important to ask them and technology have been limited to quarterly, manual effort. Often, pointed questions, such as: Word documents, spreadsheets, MS many companies left their data n Where do you store data other Access databases, custom or home- maps to flounder rather than incur than central, non-custodial data grown systems, or existing IT config- the costs in time and effort of keep- sources? uration management and tracking ing it up to date. n Do you have a filing cabinet or systems. To keep the data map updated paper-based storage system? However, these tools are ineffec- with an automated data mapping so- n Do you use spreadsheets? Access tive and do not offer an effective lution in place, all stakeholders must databases? means of maintaining information do is monitor compliance with pro- This enables two-part automation: from the data mapping process. It’s cesses set forth at the outset of the 1) When it’s time to refresh, shadow important to take into account pre-ex- data mapping project. A good solu- data sources are automatically ac- isting IT configuration management tion will provide alerts and notifica- counted for; and 2) shadow data sys- tions that make it easy for managers tems are searchable and can be to monitor and manage compliance. exported to Excel or other reports, With the right mix of Business events, such as the ad- therefore ensuring no data will be dition of a new data source or system missed during discovery or regulatory established methodology, or HR changes, trigger intelligent inquiries. tools and technology, workflows. The automated data map- ping system can automatically send 3. Analyze: Compile, Analyze, the resulting data map questionnaires and interview re- Synthesize Information quests to employees, IT personnel, It’s not enough to gather the in- should be self-sustaining, and other key data stewards, or it can formation; it must be organized in requiring little manual search and crawl a company’s data such a way as to maximize useful- sources periodically in order to ensure ness to key stakeholders. Automated intervention to remain an an up-to-date data map free from solutions enable users to filter infor- costly inaccuracies. Additionally, su- mation by risk level and litigation up-to-date, relevant tool… pervisors may log into the centralized profile, retention and governance system at any time to see and take ac- policies, department or business and tracking systems, which can tion on detailed progress reports. unit, custodian or data steward, and serve as a frame of reference during discovery or hold history. A good au- the initial launch of a data map. How- Result: An Evergreen tomated data map solution should ever, these tools paint an incomplete Data Map provide: picture of a company’s data universe. With the right mix of established n Intelligent data sculpting What leading consultants recommend methodology, tools and technology, n Navigation dashboard is a compliance process-control solu- the resulting data map should be n Reports and analysis that can be tion designed specifically to manage self-sustaining, requiring little man- exported to Excel, etc. data mapping projects. ual intervention to remain an up-to- n At-a-glance views of overall data date, relevant tool for data analysis, map structure, as well as the 5. Refresh: Maintenance and litigation preparation and discovery, ability to drill down into business Governance risk and compliance management, units, litigation profiles, and in- The data map is a living docu- and IT processes. An automated dividual employee histories ment that must be consistently data mapping solution is the only n A way to indicate legal holds on maintained to ensure accuracy, and way to achieve an evergreen data data systems, data stewards, the best, least painful way to ensure map that provides the collaboration and individual custodians maintenance is through automation. and visibility required by all the in- An outdated data map represents a volved parties. 4. Automate: Tools and substantial legal risk that directly Technology affects counsel’s ability to provide Bobby Balachandran can be contacted Tools and technology are utilized timely and accurate information re- at bbobby@exterro.com. See his bio on throughout the data mapping process quired for judicial proceedings. page 47. 44 NOVEMBER/DECEMBER 2009 INFORMATIONMANAGEMENT