Brian Tuemmler IG Program Architect Nuix

(1)

Brian Tuemmler

IG Program Architect

Nuix

[email protected]

(2)



What is IG



What unstructured content is likely on shared drives



What your content tells you



Content and context for classification

(3)

(4)

WHAT WE’RE HEARING …

Storage Optimization

“Between legal holds, and the explosive growth of email and files, we are fighting a losing battle. Our budget is slashed and I have got to find a way to mitigate risks while cutting costs on eDiscovery and storage.”.

“We have all kinds of health records, credit card data and PII. There are just so many places to look: email, SharePoint, file shares ...”

Privacy

“Knowledge workers just don’t classify documents. They use email, file shares and their home drives to store official documents. If only I could easily find those

records …”

Information Management

“Not another discovery request! Searching our email archives is brutal. It takes forever, lots of vital staff resources, and I never know if it’s going to work or not.”

eDiscovery

General Counsel Records Manager Chief Privacy Officer CIO

Fraud

“Fraud is occurring every single day. I need a better way analyze all my data to find patterns.”

(5)

INFORMATION

GOVERNANCE



Analyzing, cleaning, classifying, and organizing content on network shared drives to improve information management

• Findability

- Searching

- Sorting

• Defensibility

• Storage & disaster recovery

• Retention – Categorization



Understand what information is managed by the

organization



Identify ways to improve that management

though policies and communication, applying best practices, adding or changing existing technologies



Clean and restructure information to meet

(6)

To govern unstructured data to reduce cost and risk, and add value using a repeatable four-stage process:



Identify and inventory content to make sense of murky pools of dark unstructured data



Understand the age, ownership, format and content of each item



Classify content based on the facts in context to determine whether information is an asset or a liability



Act and execute on governance decisions: optimize storage systems; classify, migrate and protect data; or make it more readily available to the business

(7)

ENTERPRISE KNOWLEDGE

Data

Wikis & Blogs

ECRM

Shared Drives

Hard Copy

SAP

Case

Mgt

GIS

Tech

Sup

Dev

Share

Point

Other

M:\

(8)

IDENTIFY

NAS02006

NAS01772

NAS11266

(9)

18 June 2014 ₉

RANGE OF ACTIONS TO TAKE

<= Stuff I want to migrate and control in ECRM

<= Stuff I want to schedule the retention of

<= Stuff I want to keep

<= Stuff I can’t inventory, but can’t get rid of

<= Stuff I need to ask someone’s permission

(10)

(11)



Are we in compliance?

• Acceptable use

• Risk

• Regulatory

• Records Management

• Best practices



Are we managing effectively?



Are we retaining efficiently?



How long will the XYZ program take?



How much benefit will we see?



What do we need to plan for?

(12)



Content value - Good, bad, and ugly



Retention categories



Information Security



Projects, cases, clients

(13)



Content

• Text (Capitals, punctuation, stop words, stemming)

• Summary

• Number patterns

• Similarity



Context

• Filename, path, extension

• Dates

• File Attributes

• Derived metadata

(14)

CONTENT CATEGORIES FINDINGS

WHERE CAN WE TAKE ACTION?

(15)



10 categories = 80% of expired records

PRIORITIZE CLASSIFICATION EFFORTS

Row Labels Event Retention Expired 2,012 2,011 2,010 2,009 2,008 2,007

(16)



Clean



Migrate documents to ECRM



Register documents in ECRM



Register documents in federated RM (MIP)



Purge in place



Move



Hide

(17)



Assessment to prepare for critical business-driven

transformation

• Evaluate the value and risks that may result from a merger,

divestiture, or re-organization

• Help groom the organization for a transformation by identifying

opportunities to improve information management and value

• Develop a plan to minimize negative operational or cultural

change requirements and to restructure content accordingly



Your content can tell you

• Active file ownership to identify thought leaders

• Volume of modified or accessed content to identify level of

decision documentation reuse

• Level of intellectual property control and organizations

(18)



Perception: Allen and Julia have the most experience writing contracts



Fact: Frank appears to have contributed the most content

EXPERTISE

Contracts and Proposals

(19)



Assessment to reduce future litigation costs

• Recommendations for establishing governance, identifying standards, change management and technology requirements necessary to ensure a comprehensive approach.

• Identifying types and value of culling eTrash, including duplicates, to reduce the volume of content to be delivered in an eDiscovery review • Develop information structures and practices to make finding and

producing content easier

• Expected costs and benefits from recommendations



Your content can tell you

• Term/subject specific content ownership

• Types and volume of non-content (applications, install files, other client driven definitions)

• Key product (or other word list) file volume and location

• Key term consistency adherence (Comparison of the use of key terms, such as product names, supply chain participants, or other key litigation entities, with possible misspelling, acronyms, and nicknames)

• ESI Data Map (Content function to share cross tab)

(20)



Perception: Our content consists of standard office content



Fact: Large collections of non- content can appear in single events.

FORMATS OVER TIME

(21)



Assessment for Enterprise Records and Content Management

(ECRM) planning

• Strategy development to identify library structures, required technologies, storage planning, security needs and other design elements for ECRM • Identification of the general categories of information that can be managed

or migrated directly, should be reviewed prior to migration, should NOT be migrated – and where it should go - and what should be deleted.

• Identifying and adding content types and metadata for sets of content worthy of capture and organization



What your content can tell you

• Cross departmental location of duplicates • Size, volume and growth of files

• Migratable and blocked content

• Content type and metadata analysis (Metadata standards for status, date, version, classification or workgroup level details)

• Template identifiers

(22)



Perception: We have 4 kinds of contracts to put in the drop down list



Fact: There are 9 that appear in the content

METADATA VALUES

Contract Type Word List

(23)



Assessment to plan for storage and IT services optimization

• Enable tiered storage or improved disaster recovery by identifying ways to minimize the impact low value content on high value storage

• High level technology environmental issues impacting cleanup, migration, and IT practices including volumes, network architecture, speed, policies and standards.

• Evaluate compliance with acceptable use and security policies and plan for increasing compliance



What your content can tell you

• Volume of duplicates

• Size and volume of files by category

• Security assessment and organization

• Non shared drive content analysis (virtual disks, pc backups, applications, databases, web content, installation files)

• Obsolete application analysis (Client applications older than current system registries, or matching typical “downloaded application” descriptions)

• Custom extension analysis (to identify internally created file formats)

(24)



Perception: We can base our tiered storage on the last access dates

of files



Fact: Last Accessed dates are often reset by virus or backup

programs (or they were)

RECORDS MANAGEMENT

0 100 200 300 400 500 600 700

Jan Feb Mar Apr May Jun Jul Aug Sep Oct Nov Dec

(25)



Assessment of Risk Impact and Mitigation

• Opportunities and level of effort required to apply audit requirements, privacy and risk mitigation, and other file tagging and identification to help the organization achieve greater compliance.

• Evaluate the level of and types of risk that the organization faces • Changing risky processes and behaviors to minimize future risk



What your content can tell you

• Risk element type analysis (High, medium, low) • Risk elements by year to identify trends

• Risk elements by other metadata value (geography, source format, source)

• Risk elements by user volume

• Compliance content organization and location

• Risk type overlap with other metadata such as department or geography (Venn diagram)

(26)



Perception: I need to address both CCNs and SSNs immediately



Fact: A singular event may not need fixing

RISK MITIGATION

0 5 10 15 20 25 30 35 40

Jan Feb Mar Apr May Jun Jul Aug Sep Oct Nov Dec

(27)



Assessment of an eRecords Management Program Initiative

• Recommendations for a program setup to identify required staff, SMEs, level of user interaction

• Map data sources to content and custodians

• Developing definitions of records, non-records and eTrash files to help build an RM communication and support program



What your content can tell you

• RM Program communication analysis and level of effort • Volume of non-record deletable files

• Volume of duplicates, renditions, and other courtesy copies • Volume of expired records

• Naming convention - Root level function, Acronyms, Date format • Custodian and liaison analysis

• Modification and file access analysis

(28)



Perception: The desired business retention of XXX1020 is 10 years



Fact: 90% of reports are never accessed after 4 days; 100% after 10 days

(29)

(30)

Enable active governance through Information Transparency

AN IG ENABLEMENT PLATFORM

IG Tool

Data Source Discover eDiscovery Investigation Audit Protect Risk Assessment/ Audit Migrate Email/ Archives Organize Classify/ Move Clean Storage Optimization Catalyst Point Information Transparency™ Information Transparency™ Analysis Layer Data Source

(31)

QUESTIONS