Downloaded 10 times
Uploaded byJay Leask
Develop your Information Governance Strategy in Four Steps
The document outlines a four-step strategy for developing an information governance strategy, emphasizing the importance of planning for the future, classifying data, and ensuring compliance. It also discusses the need for effective data governance policies to manage data access and ownership, as well as the significance of proactive measures to enforce these policies. Additionally, it highlights the role of various tools and technologies, like Microsoft offerings, in supporting data governance efforts.
Develop your Information Governance Strategy in Four Steps
- 1. Accessible content isavailable upon request. Develop Your Information Governance Strategy in 4 Steps Jay Leask | @jayleask AvePoint Public Sector SharePoint Office 365 Hybrid
- 2. June 2017 #SPSDC @jayleask Identifythe Challenges Define the Value Develop the Strategy
- 3.
- 4. June 2017 #SPSDC @jayleask % FO R T U N E 5 0 0 C O M PA N I E S F R O M T H E 1 9 5 0 s A R E G O N E
- 5. June 2017 #SPSDC @jayleask 1999- IPO 2004 – 9000 stores 2010 – Bankrupt 2013 – RIP
- 7. June 2017 #SPSDC @jayleask “The reasonable man adapts himself to the world: the unreasonable one persists in trying to adapt the world to himself. Therefore all progress depends on the unreasonable man. ” - George Bernard Shaw
- 8. June 2017 #SPSDC @jayleask Everyone has aVoice Everyone is a Contributor Access from Anywhere
- 9.
- 10.
- 11. ©AvePoint, Inc. Allrights reserved. Confidential and proprietary information of AvePoint, Inc. Why do you need brakes?
- 12. ©AvePoint, Inc. Allrights reserved. Confidential and proprietary information of AvePoint, Inc.
- 13.
- 14. June 2017 #SPSDC @jayleask Hackersproved to be far less of a threat than simple, human error
- 15. June 2017 #SPSDC @jayleask Weneed to establish confidence
- 16. Per Breached RecordPer Breach Event
- 17.
- 18. June 2017 #SPSDC @jayleask Planfor the future Remove what’s unnecessary Keep what’s required Protect what’s important Establish a way to identify it Find out what it really is Reduce Cost. Increase Productivity. $ Users: Relevant Information IT Admins: Easier Maintenance Compliance Officers: Lowered Risks
- 19.
- 20.
- 21.
- 22. June 2017 #SPSDC @jayleask Whereis it? File Share SharePoint Office 365 Databases Who can access it? Who owns it? Who can read it? Who can edit it? What is it? ? File Level Analysis Content Level Analysis • Redundant, outdated and trivial (ROT) data • File types (Music, log files, etc..) • Sensitive data • Date Created • Owner
- 23.
- 24. June 2017 #SPSDC @jayleask RegulatedData Data that requires retention / long-term archives ITAR / export controlled data Gold copies or replication Sensitive Data “Controlled Unclassified Information” (CUI) PII / PHI / PCI data that about employees / citizens Classified Data Operational security (OpSec) Intellectual Property Classified documents
- 25.
- 26. Activity: How DoYou Classify?
- 27.
- 28. June 2017 #SPSDC @jayleask Tags OwnershipPurpose Audience Sensitivity level Classify Is it a record? Is it high business impact? Who should have access?Where should it live?
- 29. Identify sensitivity levelof the document Identify retention schedule Finish with managed keywords for search
- 30. June 2017 #SPSDC @jayleask CompliantMigration to… End-of-Life Another location on the file system for archiving Another system (SharePoint, Office 365, storage, etc.) Another location for “legal hold” Another location on the file system
- 31.
- 32. June 2017 #SPSDC @jayleask Howis Governance viewed in most organizations?
- 33. June 2017 #SPSDC @jayleask Howdo you know where to park?
- 34. June 2017 #SPSDC @jayleask Personal/MySites Governance Visibility Project/Team Sites Community Sites Portal
- 35. June 2017 #SPSDC @jayleask Build“controls” into containers Make sure no one messes with your controls Ensure the system is used as intended
- 36.
- 37.
- 38.
- 39.
- 40.
- 41. June 2017 #SPSDC @jayleask Whatdoes Microsoft offer? Protect The FileProtect The AccessProtect The System RMSCASBDLP • Enterprise-Wide Classification • Data Governance Framework • Risk Assessment • Enterprise-Wide Classification • Data Governance Framework • Risk Assessment
- 42.
- 43.
- 44. June 2017 #SPSDC @jayleask Sayhello to Joe • It’s Friday 5pm and Joe wants to go home • He doesn’t have time to classify documents • Company policy: everything in SharePoint MUST be classified
- 45.
- 46.
- 47. June 2017 #SPSDC @jayleask Violationidentified
- 48. June 2017 #SPSDC @jayleask Classification& Compliance Enforced
- 49. Admins, Compliance and Governancestakeholders
- 50. June 2017 #SPSDC @jayleask Example:Matter Center
- 51. June 2017 #SPSDC @jayleask Example:External Collaboration
- 52.
- 53.
- 54.
- 55.
- 56.
- 58.
- 59. June 2017 #SPSDC @jayleask “RECERTIFICATION” “ATTESTATION” “ANNUALREVIEW” Hey! take a look… are the current settings still appropriate? If no– make the changes. If yes– sign off on it. Recertification drivers may be internal (company controls), external (regulatory requirement) or both
- 60. June 2017 #SPSDC @jayleask Wesaid… “We won’t expose PII on this system”. We implemented… Rules to block PII from sites. Which resulted in… Reports to showcase violations over time. PROVE IT KRI – Key Risk Indicators Reports DO IT KCI – Key Control Indicators Product Configurations SAY IT Suggestions on Controls APIA Responses
- 61. June 2017 #SPSDC @jayleask DataOwnership Who is responsible for the stuff in here? Are they still here and willing to own it? Access Permissions Who can do what to the stuff in here? Does Bob still need his access? Classification Tell me about the stuff that lives in here… Is it sensitive? Is it important?
- 62.
- 63.
- 64. June 2017 #SPSDC @jayleask IT’SNOT ALL OR NOTHING. On-Prem Office 365 IaaS or Private Cloud “I need to maintain full control over my data and have specific data sovereignty requirements.” “I’d like to cut cost and facilitate collaboration.” “I’d like to minimize hardware but maintain control.” • Critical workloads • Collaboration spaces • Productivity apps • Custom solutions • Full control • No hardware • Sensitive workloads • Data with location restrictions • Legacy solutions and customizations • Full Control
- 65. June 2017 #SPSDC @jayleask Resources •2016 Data Breach Ponemon Report • Office 365 Compliance Center • Azure Information Protection • Microsoft Cloud App Security • AvePoint Online Services • AvePoint Compliance Guardian
- 66.
- 67.
- 68.