Build your cloud knowledge. With CIO surveys showing over 90% of businesses use the public cloud, now is the time to improve your cloud readiness! Engage in lively discussion with the experts who worked directly with Amazon, Box, Google, IBM, Microsoft and other major cloud providers on the IG elements of their cloud solutions. Explore the Cloud’s information governance (IG) features for retention, legal holds, disposition information protection and more! Expanding your knowledge will assure your place at the table as a valued resource, as your organization leverages the cloud. Key Takeaways: - Examine key information governance capabilities of cloud solutions - Compare and contrast cloud support for creation-date versus event-based retention - Discuss legal hold capabilities - Consider automated disposition features Speakers - Carol Stainbrook - Cohasset Associates - Michael Haley - Cohasset Associates

1. ARMA is the world's leading membership organization serving the professionals who manage and govern information assets. www.arma.org
Information Governance
in the Cloud
COMPARE AND CONTRAST
1

2. ARMA is the world's leading membership organization serving the professionals who manage and govern information assets. www.arma.org
Michael Haley, MBA, IGP
michael.haley@cohasset.com
908.642.3582
Michael joined Cohasset Associates in 2002 as a
Principal Consultant, following a career in the
insurance industry with Prudential. Michael works
with clients to refresh and strengthen their
information management programs. He develops
cost-effective and practical solutions, breaking down
complex issues to effect simple solutions.
2

3. ARMA is the world's leading membership organization serving the professionals who manage and govern information assets. www.arma.org
Carol Stainbrook
carol.stainbrook@cohasset.com
612.839.0998
Carol, Executive Director of Cohasset Associates’
consulting practice, responds to IG demands with
expertise and innovation. Her ongoing consultation
with Microsoft, Google, Amazon, Box, Dell/EMC, IBM,
and others, has facilitated an evolution of retention,
preservation and disposition capabilities in their
solutions’ designs. Her 20 plus years of experience
enables IG implementations for domestic and
multi‐national clients that support business goals,
increase information value, improve compliance, and
mitigate risk.
3

4. ARMA is the world's leading membership organization serving the professionals who manage and govern information assets. www.arma.org
• Speak at national and international
conferences and seminars
• Develop client communications
• Prepare tailored training content for
delivery to executives, management and
all employees
• Conduct client training sessions
Effect change by making records and
information governance concepts actionable
Management Consulting
Communication, Education and Training
• Guide domestic and multi-national clients’
advancement to Information Governance
• Align information lifecycle controls with
business priorities, resulting in:
• Ongoing regulatory compliance
• Effective risk mitigation
• Measurable business efficiencies
• Instill change across clients’ business
operations
• Problem solvers; not product sellers
• Seasoned consultants with 15 or more years of
exceptional experience
• Active Sedona Conference participants
4

5. ARMA is the world's leading membership organization serving the professionals who manage and govern information assets. www.arma.org
Learning Objectives
Upon completing this session, you will be able to:
1. Discuss the governance capabilities of each Cloud solution, from creation
through deletion
2. Compare and contrast cloud support for creation-date versus event-
based retention
3. Examine legal hold capabilities
4. Answer questions on the IG capabilities of each Cloud Service
5

6. ARMA is the world's leading membership organization serving the professionals who manage and govern information assets. www.arma.org
• WORM, SEC Rule 17a-4, FINRA Rule
4511
• CFTC Rule 1.31
• ISO 15489 -1, 16175, 30300, 30301,
23081-1
• Tax Regulations, Drug / Medical
Device Regulations
Expertise by Solution
Compliance Assessments
6

7. ARMA is the world's leading membership organization serving the professionals who manage and govern information assets. www.arma.org
Highest
Value
Required
Auxiliary
Discretionary
Information
Information Values
©2018 Cohasset Associates, Inc.
Information that Matters
~ 20% of Company information
• Highest business, regulatory and legal values
Information that Clutters
~ 80% of Company information
• Lower business value
What controls are important? When?

8. ARMA is the world's leading membership organization serving the professionals who manage and govern information assets. www.arma.org
Immutability Retention Legal Holds Disposition
Compliance Mode
Cannot be modified
(immutable)
Lengthen only On/Off switch Feature available
Enterprise Mode
May allow modification
(not immutable)
Lengthen
Shorten, or
Remove
On/Off switch Feature available
8
Mode
Information Governance in the Cloud

9. ARMA is the world's leading membership organization serving the professionals who manage and govern information assets. www.arma.org
Feature Name for Compliance Mode Feature Name for Enterprise Mode
• Object Lock mode set to Compliance • Object Lock mode set to Governance
Azure Blob Storage
• Immutability Policy (retention interval)
with the Policy Lock option
• Immutability Policy (retention interval)
• Bucket retention policy with locked status • Bucket retention policy
• Immutable Object Storage features,
including a Bucket Retention Policy
• n/a
• OSS Retention Strategy feature with a
defined retention period that is locked for a
Bucket
• n/a
9
Information Governance for Cloud Storage

10. ARMA is the world's leading membership organization serving the professionals who manage and govern information assets. www.arma.org
Cloud Collaboration
Information Governance in the Cloud

11. ARMA is the world's leading membership organization serving the professionals who manage and govern information assets. www.arma.org
11
Feature Name for Compliance Mode Feature Name for Enterprise Mode
• Retention Policy (when locked)
• Regulatory Retention Label (private preview
for SharePoint and OneDrive)
• Retention Policy
• Retention Label
• Governance • n/a
• Compliance • n/a
• n/a • Retention Policy
Information Governance for Cloud Collaboration Tools

12. ARMA is the world's leading membership organization serving the professionals who manage and govern information assets. www.arma.org
12
Immutability1 Retention Legal Holds Disposition
• Yes2,3, when
retention or hold
applies
• Time or
Event-based2,3
• Yes2 • May be automated
• Yes2, when
retention or hold
applies
• Time or
Event-based
• Yes2 • May be automated
• Yes2, when
retention or hold
applies
• Time or
Event-based
• Yes2 • May be automated
• Yes2, when
retention or hold
applies
• Time-based • Yes2 • May be automated
Information Governance for Cloud Collaboration Tools
1 Must apply controls for immutability 2 Depends on Location or Service 3 Depends on type of policy

13. ARMA is the world's leading membership organization serving the professionals who manage and govern information assets. www.arma.org
Cloud Storage
Information Governance in the Cloud

14. ARMA is the world's leading membership organization serving the professionals who manage and govern information assets. www.arma.org
Receive or
Generate Object
(File/Document)
Write object to
Cloud Storage,
along with
custom
metadata and
default or
specified retain
until date
Apply hold, as
needed
Run a program
that finds
eligible objects
and deletes
them
Run lifecycle
action to delete
(will only delete
objects past
retention
without a hold)

15. ARMA is the world's leading membership organization serving the professionals who manage and govern information assets. www.arma.org
Immutability Retention Legal Holds Disposition
Compliance Mode
Cannot be modified
(immutable)
Lengthen only On/Off switch Feature available
Enterprise Mode
May allow modification
(not immutable)
Lengthen
Shorten, or
Remove
On/Off switch Feature available
15
Mode
Information Governance in the Cloud

16. ARMA is the world's leading membership organization serving the professionals who manage and govern information assets. www.arma.org
Immutability Retention Legal Holds Disposition
• Yes, during and after
Retention or Hold
• Time-based • Object Level (S3) • Lifecycle action
• Bucket Level (Glacier)
Azure Blob Storage
• Yes, during and after
Retention or Hold
• Time-based • Bucket Level • Lifecycle action
• Yes, during and after
Retention or Hold
• Time or Event-based • Object Level • Lifecycle action
• Yes, during
Retention or Hold
• Time or Event-based • Object Level • Lifecycle action
• Yes, during and after
Retention or Hold
• Time-based • Bucket Level • Lifecycle action
16
Information Governance for Cloud Storage

17. ARMA is the world's leading membership organization serving the professionals who manage and govern information assets. www.arma.org
Thank you.
Information Governance in the Cloud

18. ARMA is the world's leading membership organization serving the professionals who manage and govern information assets. www.arma.org
Carol Stainbrook Michael Haley
Information Governance in the Cloud
Information Governance
in the Cloud
COMPARE AND CONTRAST

19. ARMA is the world's leading membership organization serving the professionals who manage and govern information assets. www.arma.org
Appendix
Information Governance in the Cloud

20. ARMA is the world's leading membership organization serving the professionals who manage and govern information assets. www.arma.org
Immutability
20
ISO 15489-1 5.2.2.3 A record that has
integrity is one that is complete and
unaltered. A record should be protected
against unauthorized alteration. … Any
authorized annotation, addition or deletion
to a record should be explicitly indicated and
traceable.
Information Governance in the Cloud

21. ARMA is the world's leading membership organization serving the professionals who manage and govern information assets. www.arma.org
Retention
21
ISO 15489-1 9.9: Records and metadata
should be retained for the time periods
specified in disposition authorities.
Information Governance in the Cloud

22. ARMA is the world's leading membership organization serving the professionals who manage and govern information assets. www.arma.org
Preservation
(Legal, Tax Holds, etc.)
22
ISO 15489-1 9.9: ... Records pertaining to
pending or actual litigation or legal action or
investigation should not be destroyed while
that action is underway or anticipated to
arise.
Information Governance in the Cloud

23. ARMA is the world's leading membership organization serving the professionals who manage and govern information assets. www.arma.org
Deletion
23
ISO 15489-1 9.9: Disposition processes
should be carried out in conformance with
rules in authorized and current disposition
authorities. Record systems should be
designed to support the execution of
disposition actions.
Information Governance in the Cloud