Log In

News from the IGI

Download Our Newest Deep Dive Case Study on Pandora Media

How Pandora Tuned In to Information Governance
To Take Control of Its Most Sensitive and Valuable Information Assets

An IGI Case Study

Usually when we think "Information Governance," we think traditional, large, litigated and regulated organizations. But as more and more organizations come to understand the value of IG, this image is rapidly changing. Recently, Pandora Media — a juggernaut in the streaming music business — partnered with IGI Supporter Active Navigation and its experts in governance and file analysis on a major IG project. We were fortunate enough to be able to do a deep dive on this project and bring the details to you.

Download the latest entry in our IG At Work series to learn:

  • How Pandora got rid of 60 percent of its unstructured data.
  • What it took for the company to identify and protect its most valuable and sensitive data. 
  • How Pandora developed policies for governing unstructured information.
  • How Pandora built executive support for IG. 
  • How Pandora used file analysis software to reach its IG goals.
  • How Pandora was able to sell the merits of IG to its employees.

The company that emerged on the other side of this critical IG project was more efficient, more versatile and more competitive. And their IG program only continues to grow in its sophistication and impact.

Click here to access the case study in the IGI Community.

 

How the General Counsel Can Shape Information Governance

Jake Frazier – Senior Managing Director, FTI Consulting & Sonia Cheng – Senior Director, FTI Consulting
As seen on ethicalboardroom.com

 

Information governance is often thought about in the context of IT efficiency, data security and regulatory compliance. While it is true that these are the most critical drivers for executing data governance programmes, there is an equally important factor that deeply resonates with a corporation’s board and C-suite: reputational risk.

Just as trust is a key and fragile pillar for relationships in our personal lives, it is essential – among shareholders, clients, customers and employees – for a business to thrive. Ultimately, top company leadership is responsible for managing reputational risk and ensuring that the overall direction of the company will uphold trust in the brand.

As we’ve seen countless times, failure to handle data properly often results in damaging data breaches, which beyond legal and compliance violations, break trust and allow doubt to become part of a company’s image. Thus, it is critical that the board views information governance (IG) as being about compliance and legal risk, as it must be, but also as an effort to instil a high standard for ethics and privacy into the company’s culture. By embracing this mindset, a corporation’s leadership can set the correct tone from the top down, building advocacy for actionable programmes that ensure safe and responsible handling of sensitive data, as well as strong compliance and efficiency.

“BECAUSE THE GENERAL COUNSEL HAS HISTORICALLY BEEN THE GO-TO STAKEHOLDER FOR DEALING WITH HIGHLY SENSITIVE ISSUES… THE CORPORATE LEGAL TEAM IS UNIQUELY POSITIONED TO LEAD THE CHARGE TOWARDS PROACTIVE DATA GOVERNANCE”

Because the general counsel (GC) has historically been the go-to stakeholder for dealing with highly sensitive issues – primarily for litigation and investigations – the corporate legal team is uniquely positioned to lead the charge towards proactive data governance. Given this fact, the issue of ethical obligation comes into play. In the US, federal and state laws require companies to implement reasonable security protections to safeguard personal data. There is a wide range of similar requirements around the world.

Beyond the duty to disclose, legal teams also have an ethical obligation to maintain a level of technical knowledge. In Day v. LSI Corp., in-house counsel was sanctioned for failing to document and supervise the discovery collection process and for allowing the company’s document retention policy to be ignored. In the context of IG, this is important, as legal teams must have a clear understanding about data sources and retention practices, the impact of how they choose to handle electronically stored information, and accuracy of how facts are represented to regulators, opposing parties and the courts. Ultimately, these points illustrate the fact that ethical obligations cannot be overlooked when considering the GC’s role in IG efforts.

Click here to continue reading about the top issues for 2017...

 

Getting Past Some of the Top Barriers to IG Success

Recently, the IGI caught up with Scott Burt, President and CEO of Integro, one of IGI’s newest supporters to discuss some of the IG challenges they see in the market and how organizations are overcoming them. Integro, a Gartner “Cool Vendor” and recipient of IBM’s Worldwide Business Partner Governance Excellence Award, joined the Information Governance Initiative (IGI) this year. IGI Supporters, like Integro, provide an annual financial contribution that enables the activities of the IGI, and by doing so demonstrate their commitment to the advancement of information governance (IG).

Executive Support Is Key

We asked Scott what he thought were the biggest challenges organizations face today in terms of their ability to implement successful IG programs and projects.

“I believe the biggest challenge is having the consensus and the broad executive support to affect the culture and to effect change on the company to mature to the next level. Often IG initiatives don’t become a big enough priority or the cultural challenges seem too difficult. It’s hard to imagine IG having less of a priority when I see all the risk and exposure that I do, but not all companies recognize IG’s potential, not only in reducing risk, but also greatly improving business decision-making,” says Scott.

The good news is, challenges like this can be overcome and successful change management is possible, explains Scott. He’s witnessed and helped foster success across a variety of IG projects. Scott sees high level support and goal-setting as key elements to success.

“Support from the executive level makes a huge difference in a successful project. I recommend forming an executive level, cross-functional committee that has support from the Board or CEO. When chartered with goals and metrics that are effective for the company, this cross-functional leadership group can lead and direct and delegate to an executive who runs the program.

Likewise, it’s important to have goals and objectives that matter for the company. If the initiative and its goals don’t hold value for executives, they aren’t going to give it the time of day. With a cross functional executive team and goals that matter, the benefits can be huge,” he added.

Scott’s observations are consistent with IGI’s research results as reported in the 2015-16 IGI Annual Report. Change management was the third most commonly reported barrier to successful IG; 60% of IG practitioners identified it as a barrier to IG progress at their organizations. Additionally, more than one third of practitioners identified lack of executive support as a barrier.

IG Results Are Achievable: A Customer Success Story

One of Integro’s specialties is email governance, an area in which change management can be very tricky. All too often, Scott shares, he hears organizations and stakeholders within them making all types of excuses as to why they can’t effectively govern their emails.

“The thought of trying to change users’ email habits scares a lot of company executives. But it doesn’t need to be complicated or controversial. I’ve seen companies of all sizes, from small firms to large, multinational corporations, have success. explains Scott.

Scott points to a large email governance initiative as an example of a customer who achieved IG success by effectively garnering executive support and developing strong goals, as he recommends.

“We have a global, fortune 500 client with tens of thousands of users in dozens of countries. They have had tremendous success with an enterprise-wide email management solution Integro helped the company implement. The solution, which leverages Integro’s product, Integro Email Manager and Microsoft Exchange, enables the company to organize and manage email by its value. They retain a small percentage of corporate email that has value, while at the same time regularly, defensibly and soundly disposing of the transient content. The end result for the client has been millions saved on eDiscovery and storage costs. They are achieving the goal that so many think is too big of a challenge,” Scott says.

“This customer, like others who have been successful, did a great job of change management and communication. They had strong executive support up to the highest levels, and they followed a thorough change management plan that involved internal marketing and communications about the program and its importance,” he notes.

The customer’s specific approach to change management was so successful that Integro has used best practices from the project to help other companies undertaking similar endeavors.

“With the right amount of planning, forethought, and executive support, IG projects are very doable and can result in tremendous benefit for any company,” comments Scott.

 

About Integro

Integro is an award winning, industry recognized products and services firm specializing in Information Governance, Enterprise Content Management, and Content Security solutions. Since 1995, Integro has been delighting clients with technology solutions that support defensible disposal, minimize risk, reduce eDiscovery and storage costs, ensure compliance, govern email records, and enable auto-classification. Integro is proud to be named a Top ECM Consultant by research firm, Clutch, a “Cool Vendor” by analyst firm, Gartner, and a Worldwide Governance award-winner by IBM. Learn more at www.Integro.com.

 

Iron Mountain Launches New IG Resources Site

Are you an information governance professional who’s always on the lookout for tips and tricks to help you become even better in your role? You may find exactly what you’re looking for on InfoGoTo, a new website that focuses on serving content to everyone involved in the creation and management of information.

Launched in April by Iron Mountain, a charter supporter of the IGI, InfoGoTo, as the name suggests, seeks to become the go-to destination for IG professionals looking for helpful, insightful, and educational content.

“Whether you’re a RIM professional looking for creative ways to implement training programs, a governance and compliance manager seeking best practices for creating an internal culture of compliance, or an IT manager researching options for secure IT asset disposition, InfoGoTo is a trusted resource to help you manage your information needs,” the website’s About Us section reads.

The site features five topics: IG, Regulations & Compliance, Privacy & Security, Storage & Destruction, Training & Awareness, and Professional Development. It also has industry-specific content, with stories about the legal, healthcare, and financial services sectors on display.

For the month of May, InfoGoTo will publish content around the following themes: professional development and hiring skills, defensible disposition, IG leadership, and the state of tape. For June, the site will focus on how to create a culture of compliance and the effect of digital transformation on RIM and IG.

Sound like the content is right up your alley? Head on over to the site and check it out. Who knows? It could quickly become your go-to source for all things IG.

 

Information Governance Oversight: Questions for Board Members To Ask

Jason R. Baron, Of Counsel at Drinker, Biddle & Reath LLP and Co-chair of the Information Governance Initiative, has published an article in Ethical Boardroom titled, “Information Governance Oversight: Questions for Board Members To Ask.” The article provides insight into the emergence of a variety of calls for boards of directors to be asking questions of their CEOs, CISOs and CIOs about how companies are preparing for breaches and how they will deal with their aftermath through agreed protocols.

While factoring in cyber risk as an increasingly real part of the corporate world, arguably there is an even more fundamental material weakness across the enterprise that boards of directors should be addressing: the company’s lack of a clear information governance strategy or framework for decision-making.

Information governance has been defined as “the activities and technologies that organizations employ to maximize the value of their information while minimizing risks and costs”. Of course, a part of the overall risk posed by data is the possibility of cyber breach. But there is much more to information governance than simply addressing one’s security concerns. At bottom, there are the questions of why and how data has been left to accumulate in the first place and what policies are in place to manage and control its continued growth.

There are a host of overlapping issues surrounding not only security and preservation of data but also touching on data sensitivities and privacy, access to data in litigation and investigations, regulatory compliance and, increasingly, performing analytics for the purpose of monetizing corporate data assets. Board focus on cyber breach issues alone is a start, but, high-level attention should be paid to a much broader range of technical and policy issues touching on all aspects of the overall corporate data environment.

Read Jason’s full comments in “Information Governance Oversight: Questions for Board Members To Ask.

 

Guest Post: Privacy Lost – Can Information Privacy Survive the Era of Analytics?

Authored by Kon Leong, CEO and Founder of ZL Technologies

In a recent article published in Harvard Business Review, I discussed the growing capabilities of analytics technologies, and the need to be conscious of the privacy implications that accompany them. Though I believe the piece to be of general interest, it also offered focused advice for a management audience. Now, I would like to take a step back and expand the data privacy conversation, as well as provide some insight for the executive level.

Decoding Data Privacy

When I published the initial article, several of my colleagues responded that they believe data created at work necessarily cannot constitute personal information, and therefore belongs solely to the employer. Though I may have at one point agreed with this statement, my thinking has shifted in recent years. The influx of new data sources has given rise to more personal data being created—at work, at home, everywhere—while it simultaneously becomes harder to separate personal data from corporate data. In light of these changes, it could be time we rethink what privacy in the workplace really means.

In a corporate context, some might define privacy as meaning no organizational knowledge of sensitive, personal information. Due to regulatory and legal requirements to collect and preserve data, and the increasing rate at which such data is created, this is quickly becoming unrealistic. Do organizations then do their best to ignore this data, until it’s needed by Legal or Compliance? In today’s age, turning a blind eye to sensitive information and pretending it doesn’t exist is akin to the philosophy of “see no evil, hear no evil, speak no evil”: The problem is that just because sensitive information goes untouched, doesn’t necessarily remove any or all privacy and security concerns.

Because it’s near impossible for us to keep personal data out of the organizational reach, more reasonably, modern privacy might simply come to mean that personal data cannot be improperly utilized, processed, or accessed. Although counterintuitive, in order for this type of system to work, an organization must have complete command over its data. In other words, rather than knowing as little as possible, this new information governance approach seeks to know more in order to exert control over data.

The following insight highlights this paradox: The CIA’s system of managing classified information could arguably be very intrusive because of the oftentimes private nature of the content it manages, and the expansiveness of its reach. However, thanks to classification schemes and access privileges, data can only be accessed for its intended purposes, thus ensuring privacy is maintained.

Privacy by Design

Although it can be extremely effective, the governance approach to privacy is easier said than done. Privacy can’t just be an afterthought. It must be instituted by design, at the architectural level of an organization’s information strategy.

Before going down this path, organizations should consider convening an information governance committee to determine what kind of compliance and ethical values they want the latest information technologies to usher in. The committee can help define corporate policies on gathering, handling, managing and analyzing what is perhaps the most significant asset of the modern enterprise: information.

Concurrently, begin internal assessments of employee values on privacy, ethics, and fair use of data. You may need to account for significant cultural and regulatory variations across different regions and countries. Such findings can then inform and guide the information governance committee in creating policies down the line.

The Road Ahead

When I published the original article in Harvard Business Review, I hoped to jumpstart the information privacy conversation. When compared to Europe, it’s hard to ignore the fact that the U.S. perspective towards privacy is less developed. However, with data growth only increasing, and new ways to track, monitor, and analyze individuals springing up all the time, it’s a conversation that’s getting harder to avoid, within living rooms and boardrooms alike.

These reasons alone might not be enough to get the U.S to rethink privacy. But if money talks, fines of up to 4% of global sales should be at least enough to get the ball rolling once the GDPR hits next May. Let’s just hope that for companies who wait until then to start planning, it’s not too little, too late.