Fluent Essays

Topic: Information Governance Question: If you were the Executive Sponsor for the IT Risk Management department. What strategies will you use to build your IG Team and assign the specific roles and responsibilities. What methods would you use as the Executive Sponsor to develop and strategic plan for employee security policies? Instructions: Minimum 200 words.Need 2 APA References Textbook attachedSingle space.No Plagiarism please. information_governance_concepts_strategi.pdf Unformatted Attachment Preview INFORMATION GOVERNANCE Founded in 1807, John Wiley & Sons is the oldest independent publishing company in the United States. With offices in North America, Europe, Asia, and Australia, Wiley is globally committed to developing and marketing print and electronic products and services for our customers’ professional and personal knowledge and understanding. The Wiley CIO series provides information, tools, and insights to IT executives and managers. The products in this series cover a wide range of topics that supply strategic and implementation guidance on the latest technology trends, leadership, and emerging best practices. Titles in the Wiley CIO series include: The Agile Architecture Revolution: How Cloud Computing, REST-Based SOA, and Mobile Computing Are Changing Enterprise IT T by Jason Bloomberg Big Data, Big Analytics: Emerging Business Intelligence and Analytic Trends for Today’s Businesses by Michael Minelli, Michele Chambers, and Ambiga Dhiraj The Chief Information Officer’s Body of Knowledge: People, Process, and Technology by Dean Lane CIO Best Practices: Enabling Strategic Value with Information Technology (Second Edition) by Joe Stenzel, Randy Betancourt, Gary Cokins, Alyssa Farrell, Bill Flemming, Michael H. Hugos, Jonathan Hujsak, and Karl Schubert The CIO Playbook: Strategies and Best Practices for IT Leaders to Deliver Value by Nicholas R. Colisto Enterprise Performance Management Done Right: An Operating System for Your Organization by Ron Dimon Executive’s Guide to Virtual Worlds: How Avatars Are Transforming Your Business and Your Brandd by Lonnie Benson IT Leadership Manual: Roadmap to Becoming a Trusted Business Partnerr by Alan R. Guibord Managing Electronic Records: Methods, Best Practices, and Technologiess by Robert F. Smallwood On Top of the Cloud: How CIOs Leverage New Technologies to Drive Change and Build Value Across the Enterprise by Hunter Muller Straight to the Top: CIO Leadership in a Mobile, Social, and Cloud-based World (Second Edition) by Gregory S. Smith Strategic IT: Best Practices for Managers and Executivess by Arthur M. Langer and Lyle Yorks Transforming IT Culture: How to Use Social Intelligence, Human Factors, and Collaboration to Create an IT Department That Outperformss by Frank Wander Unleashing the Power of IT: Bringing People, Business, and Technology Together by Dan Roberts The U.S. Technology Skills Gap: What Every Technology Executive Must Know to Save America’s Future by Gary J. Beach Information Governance: Concepts, Strategies and Best Practicess by Robert F. Smallwood INFORMATION GOVERNANCE CONCEPTS, STRATEGIES AND BEST PRACTICES Robert F. Smallwood Cover image: © iStockphoto / IgorZh Cover design: Wiley Copyright © 2014 by Robert F. Smallwood. All rights reserved. Chapter 7 © 2014 by Barclay Blair Portions of Chapter 8 © 2014 by Randolph Kahn Published by John Wiley & Sons, Inc., Hoboken, New Jersey. Published simultaneously in Canada. No part of this publication may be reproduced, stored in a retrieval system, or transmitted in any form or by any means, electronic, mechanical, photocopying, recording, scanning, or otherwise, except as permitted under Section 107 or 108 of the 1976 United States Copyright Act, without either the prior written permission of the Publisher, or authorization through payment of the appropriate per-copy fee to the Copyright Clearance Center, Inc., 222 Rosewood Drive, Danvers, MA 01923, (978) 750-8400, fax (978) 646-8600, or on the Web at www.copyright.com. Requests to the Publisher for permission should be addressed to the Permissions Department, John Wiley & Sons, Inc., 111 River Street, Hoboken, NJ 07030, (201) 748-6011, fax (201) 748-6008, or online at http://www.wiley.com/go/permissions. Limit of Liability/Disclaimer of Warranty: While the publisher and author have used their best efforts in preparing this book, they make no representations or warranties with respect to the accuracy or completeness of the contents of this book and specifically disclaim any implied warranties of merchantability or fitness for a particular purpose. No warranty may be created or extended by sales representatives or written sales materials. The advice and strategies contained herein may not be suitable for your situation. You should consult with a professional where appropriate. Neither the publisher nor author shall be liable for any loss of profit or any other commercial damages, including but not limited to special, incidental, consequential, or other damages. For general information on our other products and services or for technical support, please contact our Customer Care Department within the United States at (800) 762-2974, outside the United States at (317) 572-3993 or fax (317) 572-4002. Wiley publishes in a variety of print and electronic formats and by print-on-demand. Some material included with standard print versions of this book may not be included in e-books or in print-on-demand. If this book refers to media such as a CD or DVD that is not included in the version you purchased, you may download this material at http://booksupport.wiley.com. For more information about Wiley products, visit www.wiley.com. Library of Congress Cataloging-in-Publication Data: Smallwood, Robert F., 1959Information governance : concepts, strategies, and best practices / Robert F. Smallwood. pages cm. — (Wiley CIO series) ISBN 978-1-118-21830-3 (cloth); ISBN 978-1-118-41949-6 (ebk); ISBN 978-1-118-42101-7 (ebk) 1. Information technology—Management. 2. Management information systems. 3. Electronic records—Management. I. Title. HD30.2.S617 2014 658.4’038—dc23 2013045072 Printed in the United States of America 10 9 8 7 6 5 4 3 2 1 For my sons and the next generation of tech-savvy managers CONTENTS PREFACE xv ACKNOWLEDGMENTS xvii PART ONE— Information Governance Concepts, Definitions, and Principles p 1 CH APT ER 1 The Onslaught of Big Data and the Information Governance Imperative 3 Defining Information Governance 5 IG Is Not a Project, But an Ongoing Program 7 Why IG Is Good Business 7 Failures in Information Governance 8 Form IG Policies, Then Apply Technology for Enforcement Notes 10 12 2 Information Governance, IT Governance, Data Governance: What’s the Difference? 15 CH APT ER Data Governance 15 IT Governance 17 Information Governance 20 Impact of a Successful IG Program Summing Up the Differences 20 21 Notes 22 CH APT ER 3 Information Governance Principles 25 Accountability Is Key 27 Generally Accepted Recordkeeping Principles® Contributed by Charmaine Brooks, CRM Assessment and Improvement Roadmap 27 34 Who Should Determine IG Policies? 35 Notes 38 PART TWO— Information Governance Risk Assessment and Strategic g Planning g CH APT ER 41 4 Information Risk Planning and Management 43 Step 1: Survey and Determine Legal and Regulatory Applicability and Requirements 43 vii viii CONTENTS Step 2: Specify IG Requirements to Achieve Compliance 46 Step 3: Create a Risk Profile 46 Step 4: Perform Risk Analysis and Assessment 48 Step 5: Develop an Information Risk Mitigation Plan 49 Step 6: Develop Metrics and Measure Results 50 Step 7: Execute Your Risk Mitigation Plan 50 Step 8: Audit the Information Risk Mitigation Program 51 Notes 51 5 Strategic Planning and Best Practices for Information Governance 53 CH APT ER Crucial Executive Sponsor Role 54 Evolving Role of the Executive Sponsor 55 Building Your IG Team 56 Assigning IG Team Roles and Responsibilities 56 Align Your IG Plan with Organizational Strategic Plans 57 Survey and Evaluate External Factors 58 Formulating the IG Strategic Plan 65 Notes 69 CH APT ER 6 Information Governance Policy Development 71 A Brief Review of Generally Accepted Recordkeeping Principles® 71 IG Reference Model 72 Best Practices Considerations 75 Standards Considerations 76 Benefits and Risks of Standards 76 Key Standards Relevant to IG Efforts 77 Major National and Regional ERM Standards 81 Making Your Best Practices and Standards Selections to Inform Your IG Framework 87 Roles and Responsibilities 88 Program Communications and Training 89 Program Controls, Monitoring, Auditing and Enforcement Notes PART THREE— Information Governance Key Impact p Areas Based on the IG Reference Model CH APT ER 89 91 95 7 Business Considerations for a Successful IG Program 97 By Barclay T. Blair Changing Information Environment 97 CONTENTS ix Calculating Information Costs 99 Big Data Opportunities and Challenges 100 Full Cost Accounting for Information 101 Calculating the Cost of Owning Unstructured Information 102 The Path to Information Value Challenging the Culture New Information Models 105 107 107 Future State: What Will the IG-Enabled Organization Look Like? 110 Moving Forward Notes CH APT ER 111 113 8 Information Governance and Legal Functions 115 By Robert Smallwood with Randy Kahn, Esq., and Barry Murphy Introduction to e-Discovery: The Revised 2006 Federal Rules of Civil Procedure Changed Everything 115 Big Data Impact 117 More Details on the Revised FRCP Rules 117 Landmark E-Discovery Case: Zubulake v. UBS Warburg 119 E-Discovery Techniques 119 E-Discovery Reference Model 119 The Intersection of IG and E-Discovery By Barry Murphy 122 Building on Legal Hold Programs to Launch Defensible Disposition 125 By Barry Murphy Destructive Retention of E-Mail 126 Newer Technologies That Can Assist in E-Discovery 126 Defensible Disposal: The Only Real Way To Manage Terabytes and Petabytes By Randy Kahn, Esq. Retention Policies and Schedules 137 By Robert Smallwood, edited by Paula Lederman, MLS Notes 144 9 Information Governance and Records and Information Management Functions 147 CH APT ER Records Management Business Rationale 149 Why Is Records Management So Challenging? 150 Benefits of Electronic Records Management Additional Intangible Benefits 152 153 Inventorying E-Records 154 Generally Accepted Recordkeeping Principles® E-Records Inventory Challenges 155 155 130 x CONTENTS Records Inventory Purposes 156 Records Inventorying Steps 157 Ensuring Adoption and Compliance of RM Policy 168 General Principles of a Retention Scheduling 169 Developing a Records Retention Schedule 170 Why Are Retention Schedules Needed? 171 What Records Do You Have to Schedule? Inventory and Classification 173 Rationale for Records Groupings 174 Records Series Identification and Classification Retention of E-Mail Records 174 175 How Long Should You Keep Old E-Mails? Destructive Retention of E-Mail 176 177 Legal Requirements and Compliance Research 178 Event-Based Retention Scheduling for Disposition of E-Records 179 Prerequisites for Event-Based Disposition 180 Final Disposition and Closure Criteria 181 Retaining Transitory Records 182 Implementation of the Retention Schedule and Disposal of Records 182 Ongoing Maintenance of the Retention Schedule 183 Audit to Manage Compliance with the Retention Schedule 183 Notes 186 10 Information Governance and Information Technology Functions 189 CH APT ER Data Governance 191 Steps to Governing Data Effectively 192 Data Governance Framework 193 Information Management 194 IT Governance 196 IG Best Practices for Database Security and Compliance 202 Tying It All Together Notes 204 205 11 Information Governance and Privacy and Security Functions 207 CH APT ER Cyberattacks Proliferate 207 Insider Threat: Malicious or Not Privacy Laws 208 210 Defense in Depth 212 Controlling Access Using Identity Access Management 212 Enforcing IG: Protect Files with Rules and Permissions 213 CONTENTS xi Challenge of Securing Confidential E-Documents 213 Apply Better Technology for Better Enforcement in the Extended Enterprise 215 E-Mail Encryption 217 Secure Communications Using Record-Free E-Mail 217 Digital Signatures 218 Document Encryption 219 Data Loss Prevention (DLP) Technology 220 Missing Piece: Information Rights Management (IRM) 222 Embedded Protection 226 Hybrid Approach: Combining DLP and IRM Technologies Securing Trade Secrets after Layoffs and Terminations 227 228 Persistently Protecting Blueprints and CAD Documents 228 Securing Internal Price Lists 229 Approaches for Securing Data Once It Leaves the Organization 230 Document Labeling 231 Document Analytics 232 Confidential Stream Messaging 233 Notes 236 PART FOUR— Information Governance for Deliveryy Platforms CH APT ER 239 12 Information Governance for E-Mail and Instant Messaging 241 Employees Regularly Expose Organizations to E-Mail Risk 242 E-Mail Polices Should Be Realistic and Technology Agnostic 243 E-Record Retention: Fundamentally a Legal Issue 243 Preserve E-Mail Integrity and Admissibility with Automatic Archiving 244 Instant Messaging 247 Best Practices for Business IM Use 247 Technology to Monitor IM Tips for Safer IM Notes CH APT ER 249 249 251 13 Information Governance for Social Media 253 By Patricia Franks, Ph.D, CRM, and Robert Smallwood Types of Social Media in Web 2.0 253 Additional Social Media Categories 255 Social Media in the Enterprise 256 Key Ways Social Media Is Different from E-Mail and Instant Messaging 257 Biggest Risks of Social Media 257 Legal Risks of Social Media Posts 259 xii CONTENTS Tools to Archive Social Media 261 IG Considerations for Social Media 262 Key Social Media Policy Guidelines 263 Records Management and Litigation Considerations for Social Media 264 Emerging Best Practices for Managing Social Media Records 267 Notes CH APT ER 269 14 Information Governance for Mobile Devices 271 Current Trends in Mobile Computing 273 Security Risks of Mobile Computing 274 Securing Mobile Data 274 Mobile Device Management IG for Mobile Computing 275 276 Building Security into Mobile Applications 277 Best Practices to Secure Mobile Applications 280 Developing Mobile Device Policies 281 Notes 283 CH APT ER 15 Information Governance for Cloud Computing 285 By Monica Crocker CRM, PMP, CIP, and Robert Smallwood Defining Cloud Computing 286 Key Characteristics of Cloud Computing 287 What Cloud Computing Really Means Cloud Deployment Models 288 289 Security Threats with Cloud Computing 290 Benefits of the Cloud 298 Managing Documents and Records in the Cloud 299 IG Guidelines for Cloud Computing Solutions 300 Notes CH APT ER 301 16 SharePoint Information Governance 303 By Monica Crocker, CRM, PMP, CIP, edited by Robert Smallwood Process Change, People Change 304 Where to Begin the Planning Process 306 Policy Considerations 310 Roles and Responsibilities 311 Establish Processes 312 Training Plan 313 Communication Plan 313 Note 314 CONTENTS xiii PART FIVE— Long-Term g Program g Issues CH APT ER 315 17 Long-Term Digital Preservation 317 By Charles M. Dollar and Lori J. Ashley Defining Long-Term Digital Preservation 317 Key Factors in Long-Term Digital Preservation Threats to Preserving Records 320 Digital Preservation Standards 321 318 PREMIS Preservation Metadata Standard 328 Recommended Open Standard Technology-Neutral Formats 329 Digital Preservation Requirements 333 Long-Term Digital Preservation Capability Maturity Model® 334 Scope of the Capability Maturity Model 336 Digital Preservation Capability Performance Metrics 341 Digital Preservation Strategies and Techniques 341 Evolving Marketplace Looking Forward Notes 344 344 346 18 Maintaining an Information Governance Program and Culture of Compliance 349 CH APT ER Monitoring and Accountability 349 Staffing Continuity Plan 350 Continuous Process Improvement 351 Why Continuous Improvement Is Needed 351 Notes 353 A Information Organization and Classification: Taxonomies and Metadata 355 APPEN DI X By Barb Blackburn, CRM, with Robert Smallwood; edited by Seth Earley Importance of Navigation and Classification 357 When Is a New Taxonomy Needed? 358 Taxonomies Improve Search Results 358 Metadata and Taxonomy 359 Metadata Governance, Standards, and Strategies 360 Types of Metadata 362 Core Metadata Issues 363 International Metadata Standards and Guidance 364 Records Grouping Rationale 368 Business Classification Scheme, File Plans, and Taxonomy Classification and Taxonomy 369 368 xiv CONTENTS Prebuilt versus Custom Taxonomies 370 Thesaurus Use in Taxonomies 371 Taxonomy Types 371 Business Process Analysis 377 Taxonomy Testing: A Necessary Step Taxonomy Maintenance 379 380 Social Tagging and Folksonomies 381 Notes 383 B Laws and Major Regulations Related to Records Management 385 APPEN DI X United States 385 Canada 387 By Ken Chasse, J.D., LL.M. United Kingdom 389 Australia 391 Notes 394 C Laws and Major Regulations Related to Privacy 397 APPEN DI X United States 397 Major Privacy Laws Worldwide, by Country Notes GLOSSARY 400 401 ABOUT THE AUTHOR 417 ABOUT THE MAJOR CONTRIBUTORS 419 INDEX 421 398 PREFACE I nformation governance (IG) has emerged as a key concern for business executives and managers in today’s environment of Big Data, increasing information risks, colossal leaks, and greater compliance and legal demands. But few seem to have a clear understanding of what IG is; that is, how you define what it is and is not, and how to implement it. This book clarifies and codifies these definitions and provides key insights as to how to implement and gain value from IG programs. Based on exhaustive research, and with the contributions of a number of industry pioneers and experts, this book lays out IG as a complete discipline in and of itself for the first time. IG is a super-discipline that includes components of several key fields: law, records management, information technology (IT), risk management, privacy and security, and business operations. This unique blend calls for a new breed of information professional who is competent across these established and quite complex fields. Training and education are key to IG success, and this book provides the essential underpinning for organizations to train a new generation of IG professionals. Those who are practicing professionals in the component fields of IG will find the book useful in expanding their knowledge from traditional fields to the emerging tenets of IG. Attorneys, records and compliance managers, risk managers, IT managers, and security and privacy professionals will find this book a particularly valuable resource. The book strives to offer clear IG concepts, actionable strategies, and proven best practices in an understandable and digestible way; a concerted effort was made to simplify language and to offer examples. There are summaries of key points throughout and at the end of each chapter to help the reader retain major points. The text is organized into five parts: (1) Information Governance Concepts, Definitions, and Principles; (2) IG Risk Assessment and Strategic Planning; (3) IG Key Impact Areas; (4) IG for Delivery Platforms; and (5) Long-Term Program Issues. Also included are appendices with detailed information on taxonomy and metadata design and on records management and privacy legislation. One thing that is sure is that the complex field of IG is evolving. It will continue to change and solidify. But help is here: No other book offers the kind of comprehensive coverage of IG contained within these pages. Leveraging the critical advice provided here will smooth your path to understanding and implementing successful IG programs. Robert F. Smallwood xv ACKNOWLEDGMENTS I would like to sincerely thank my colleagues for their support and generous contribution of their expertise and time, which made this pioneering text possible. Many thanks to Lori Ashley, Barb Blackburn, Barclay Blair, Charmaine Brooks, Ken Chasse, Monica Crocker, Charles M. Dollar, Seth Earley, Dr. Patricia Franks, Randy Kahn, Paula Lederman, and Barry Murphy. I am truly honored to include their work and owe them a great debt of gratitude. xvii PART ONE Information Govern ... Purchase answer to see full attachment