Developing an Information Management Program EDUCAUSE 2008 Merri

Developing an Information Management Program EDUCAUSE 2008 © Merri Beth Lavagnino, Jenny Mehmedovic, & Daniel Noonan 2008. This work is the intellectual property of the authors. Permission is granted for this material to be shared for non-commercial, educational purposes, provided that this copyright statement appears on the reproduced materials and notice is given that the copying is by permission of the author. To disseminate otherwise or to republish requires written permission from the author.

Which is your view of Information Management?

Setting the Stage… v Introductions Ø Presentation Team Ø Attendees: q Names q Institution & Role q Why are you at this particular pre-conference session?

Setting the Stage… v Information Management defined… v Why do we do this? v Building support & buy-in… v Developing Tools: Ø Data classification & mapping… Ø Information Security & Privacy… Ø Records Management & Archives…

Information Management Defined

What is Information? v “Knowledge communicated concerning some particular fact, subject, or event; that of which one is apprised or told” OED 2 nd ed. v “Data that has been given value through analysis, interpretation, or compilation in a meaningful form” Glossary of records and Information Management Terms, 3 rd ed. ARMA International (2007)

Information Lifecycle… v Created (or received) v Managed v Used Ø Actively Ø In-Active (stored) Ø Transformed Ø Permanently Archived Ø Disposed

Information Management v An illustration… Take 1 Take 2

Comprehensive planning v. holes & loose threads

A Woven Analogy… Ball = Information Red Thread = Privacy Orange Thread = Security Khaki Thread = Records Management White Thread = Archives Invisible Thread = support threads on which everything else is built, i. e. University Support

Is Information Management the answer? v Information …my Management ensures… ability to do my work by getting what I need when I need it.

Elements of a Comprehensive Program… v University Support v Data Classification & Mapping v Security & Privacy v Records Management & Archives

…to Manage Information throughout its Life Cycle! UNIVERSITY SUPPORT Get what I need Data Classification & Mapping Do my work Security Keep others from getting to it if they shouldn’t have it Privacy Records Management & Archives Ensure it’s there when I need it Get rid of it when I don’t need it anymore

Analog vs. Digital: The Myth of the Paperless Office*… v What is your goal? Ø Paperless for the sake of paperlessness? Ø More effective “business” processes? v Analog vs. Digital: Is there a difference? Ø Yes, but there are roles and affordances for each. Ø Don’t necessarily mimic analog, create new more efficient processes *(Sellen & Harper, 2002)

What is your Goal? …users who are pulling out their hair?

What is your Goal? …OR… users who are certain they can get what they need when they need it?

Why Do We Do This?

Management Drivers… v Legal v Fiscal v Administrative v Research & Scholarship v Historical/institutional memory

Risks That Result from Lack of Information Management… v Historical…. end of the Roman empire & the burning of the Library of Alexandria library Ø 1992 destruction of the National Library in Sarajevo Ø intentional book burning throughout history… Ø Domesday Book Ø Viking Mars Lander Ø http: //dheera. net/photos/

Risks That Result from Lack of Information Management… v Current… Ø Up in (virtual) Smoke: (preservation of institutional memory) This Week in KU History (http: //www. kuhistory. com) q The Valley of the Shadow (http: //valley. vcdh. virginia. edu/) q Ø Data Breaches: The Walk of Shame (Managing Your Reputation & Mitigating Risk Exposure) loss of privacy/identity theft q loss of credibility q loss of enrollment q loss of financial solvency (fines, etc…), q liability q loss of accreditation q etc. , etc… q

Benefits That Result from Information Management… v More effective delivery of services v More efficient “business” processes v Legal/Fiscal Compliance v Enhanced environment for collaboration

The Granularity Limbo: How Low Do You Go? enterprise systems v enterprise information v online class discussion transcripts v information generated by Web 2. 0 technologies, as long as they support a service provided by the University (i. e. , Ask-a-Librarian, or Help. Desk blogs, etc…) v information generated by Web 2. 0 technologies, even if they belong to/are managed by an individual? ? ? v

Building Support & Buy-In

Is Your U’s Approach… …like one of these? EDUCAUSE 2008

But… …could it be like this? EDUCAUSE 2008

Raising Awareness… Moving Mountains…or… Stonehenge Wasn’t Built in a Day v Getting Them to Care Ø v Getting a Champion of the Cause Ø v Use a Common Language (and I don’t mean English) Wanted: Top-level Administrators needed… (Auditors & Lawyers are also helpful) Getting Them to Participate Individuals Ø Committees/task forces/governance groups Ø

Raising Awareness… v Developing a Communications Approach Craft an “Elevator Speech” Ø Share info on a website Ø Hold meetings to present concepts/issues Ø q tailored to what your audience will be able to absorb Develop an online seminar/tutorial Ø Develop classroom workshop/seminar Ø http: //www. provost. ku. edu/policy/infomanagement/docs/stakeholder. Meeting. pdf

Collaborating… v Within your State: Ø Kansas q Kansas Historical Society’s Records Management Division q Kansas Electronic Records Committee Ø Ohio: q Inter-University Council of Ohio – 14 public Univs q Ohio Electronic Records Committee q Ohio Historical Records Advisory Board

Collaborating… v With Higher Ed Consortia: Ø Committee on Institutional Cooperation

Collaborating… v With Professional Associations: Ø AIIM Ø ARMA International Ø EDUCAUSE Ø International Council on Archives Ø Society of American Archivist

But it’s an evolutionary process… …where will YOU start? v Inventory v Assessment v Strategic Planning

But it’s an evolutionary process… …where will YOU start? v University of Kansas (after several false starts) is building support and creating a framework… KU Information Management website: http: //www. provost. ku. edu/policy/infomanagement/

But it’s an evolutionary process… …where will YOU start?

But it’s an evolutionary process… …where will YOU start? v Indiana University is creating really strong threads… Data Governance Privacy & Security Program University Records Management v With the hope that one day they will weave together into a beautiful carpet…

Developing Tools: Data Classification & Mapping

What & Where? ? ? v What data are we talking about? Ø Generally individual data elements, not “information” q If the elements are classified, then you can classify documents containing those elements… v Where might that data be? Ø Enterprise systems Ø Local systems Ø “Shadow” systems – multiple copies, oh my!

Why? ? ? v Why is it necessary (or even mandatory!) to classify data? Ø There are laws, regulations, rules, or policies (federal, state and/or institutional) that require classification of data. Ø In higher education institutions, where data stewardship is usually decentralized and where data is held by autonomous units, more guidance is needed.

A Prerequisite To… v Risk Assessment activities Ø v Security & Privacy requirements Ø v Which data have the most risk? Which data need the most protections? Incident Response Ø Which data need the highest level of response if there is an exposure?

Who? ? ? v It’s not (just) an IT thing! Ø The business owners are the experts for that data: q Registrar (for student data) q HR (for employee data) q Financial (for credit card numbers, financial info) Ø The IT people provide systems to manage that data

Defining Roles… v No standard on terms used to define the various roles and responsibilities. Ø Governance level (trustee, owner, steward? ) Ø Management level (steward, manager? ) Ø Operational level (supervisor, custodian, user? )

Defining Classification Levels… v Again, no standard on terms used to define the various levels. Ø Although, your state may already define some or all levels for you, and what words to use to describe the levels. Ø Check for recognized standards that may already define some or all levels for you, and what words to use to describe the levels.

Confidential Public Restricted Level 3 Sensitive Level 1 Level 2

Resource: EDUCAUSE Data Classification Toolkit https: //wiki. internet 2. edu/confluence/display/secguide/Data+Classification+Toolkit

Resource: Stanford University http: //www. stanford. edu/group/security/securecomputing/dataclass_chart. html

Resource: OSU http: //cio. osu. edu/policies/institutional_data/

Resource: University of Texas http: //www. utexas. edu/its/policies/opsmanual/dataclassification. php

Developing Tools: Information Security & Privacy

One Definition of Security v “Computer Security is concerned with the risks related to computer use, and ensures the availability, integrity and confidentiality of information managed by the computer system, permitting authorized users to carry out legitimate and useful tasks within a secure computing environment. ” SANS Institute

One Definition of Privacy v “Privacy is the claim of individuals, groups or institutions to determine for themselves when, how, and to what extent information about them is [collected and] communicated to others. ” Alan Westin: Privacy & Freedom, 1967

Another POV… v “An American has no sense of privacy. He does not know what it means. There is no such thing in the country. ” George Bernard Shaw, Irish dramatist and socialist (1856 -1950)

Who Does Security & Privacy (S&P)? Security Officers v Privacy Officers v Legal Counsel v Internal Audit v Risk Management v Sector-Specific Officers (Research, Financial, Human Resources, Health…) v Purchasing (or whomever does contracts with vendors) v

How Do You Approach S&P? GLBA I’ll take care of the Health Info! HIPAA ISO I’m talking about the Security of Info! COBIT I’ll take care of the Credit Card Info! PCI-DSS I’m taking care of our Students and their Info! FERPA

An Overarching S&P Program v Learn: what S&P principles apply at a high level Ø what S&P standards exist at a high level Ø what S&P legal, statutory, regulatory, and contractual requirements exist for your sector(s) Ø v Create a strategic overarching S&P Program that is general and flexible to cover all areas Ø Then add special differences as needed…

Example: Security Principles v The Generally Accepted Information Security Principles (GAISP) identifies nine pervasive principles that “provide general governance-level guidance to establish and maintain the security of information. ”

GAISP Security Principles v v Accountability Principle accountability and responsibility must be clearly defined and acknowledged Awareness Principle - university community must be aware of principles, standards, conventions or mechanisms for the security of information Ethics Principle - information should be used, and security should be executed, in an ethical manner Multidisciplinary Principle - the program should address the considerations and viewpoints of all interested parties v v v Proportionality Principle - controls should be proportionate to the risks Integration Principle - security should be coordinated and integrated Timeliness Principle - parties should act in a timely and coordinated manner to prevent or respond to breach of and threats to security Assessment Principle - risk to information should be assessed periodically Equity Principle - rights and dignity of individuals should be respected while carrying out the program

Example: Privacy Principles v The Generally Accepted Privacy Principles (GAPP) are an operational framework “to help management create an effective privacy program that addresses privacy risks and obligations” and “takes into consideration local, national, or international requirements. ”

GAPP Privacy Principles v v Management – defines, documents, communicates, and assigns accountability for its privacy policies and procedures Notice – informs about its privacy policies and procedures and identifies purposes for which PII is collected, used, retained, and disclosed Choice and Consent – obtains implicit or explicit consent with respect to the collection, use, and disclosure of PII Collection – collects PII only for the purposes identified in the notice v v v Use and Retention – uses PII only as outlined in the notice and which individual has consented to, and keeps PII only as long as necessary to fulfill stated purposes Access – provides access to individual to review and update or correct Disclosure to Third Parties – only for purposes stated and with consent Security for Privacy – protects against unauthorized access Quality – maintains accurate, complete, and relevant PII Monitoring and Enforcement – monitors its compliance and has procedures to address complaints and disputes

Unfortunately, There Isn’t ONE Standard… v But there are common themes!! v Choose the one that fits your organization best, and build structure on that Ø Then add special differences as needed… Ø (does this sound familiar? ? )

Common Themes in Security Standards v v v Security Policy Asset Management Physical and Environmental Security Access Control Communications and Operations Management v v v Information Systems Acquisition, Development, and Maintenance Incident Management Business Continuity Management

Then There’s the Legal, Statutory, Regulatory, and Contractual… Sector covered Concerns Privacy Act 1974 U. S. Government Privacy Family Educational Rights and Privacy Act (FERPA ) 1974 Education records Privacy Health Insurance Portability and Accountability Act (HIPAA) 1996 Protected Health Privacy and Information security rules Financial Modernization Act (Gramm-Leach-Bliley or GLB) 1999 Certain Financial Data Security safeguards Fair and Accurate Credit Transactions Act (FACTA) 2003 Credit records Secure disposal State Laws 2002 + Personal data (primarily SSN) Privacy, notification, secure disposal Payment Card Industry Data Security Standards (PCI-DSS) 2005 Credit card data Security standards EDUCAUSE 2008

So, Build An Overarching S&P Program (or Information Security Management System) v Principles and areas covered [build on Principle documents provided here] Ø Get approved at high levels v Outlining of plan [build on Standards documents provided here] Ø Gap analysis, risk assessment, short and long term plans v Implementation Ø Collate, collaborate, and organize

Example…

Developing Tools: Records Management & Archives

Definition of a record… v Recorded information, regardless of medium or characteristics, made or received by an organization in the pursuance of legal obligations or in the transaction of business. Glossary of records and Information Management Terms, 3 rd ed. ARMA International (2007)

Characteristics of a record… Content v Structure v Context v Fixity v Evidence of Activity v Record

Components of an Effective RIM Program… Records Inventory Preservation Disposition Files & Forms Management Records Classification Records & Information Management Retention Scheduling DPR Vital Record Conversion Policy & Procedures

Elements of an Effective RIM Program… The Ohio State University Archives - http: //library. osu. edu/sites/archives/retention. php#7

Records Retention Scheduling… v Inventory v Schedules: Ø Existing – apply Ø Develop - Research: q Legal Need q Fiscal Need q Administrative Need q Research Need q Institutional Historical Need 1921 Makio

Records Retention Periods… (Dean’s Correspondence) Time Permanent Retention # Time Long Term retention (Legal Contracts) # Time & # Time Short-Term Records (Invoices, Timesheets) Transient Records (Drafts, Notice of Meeting) # Time # Non-records (Spam, catalogs)

Records Disposition Policies… v Secure vs. Unsecure? v Documentation v Roles & Responsibilities

Records Management Benefits… v Mechanism for more effective: Ø data classification Ø timely disposition of sensitive data v Pac-Man® Effect

Records Retention Examples… v Institutional Ø Indiana Records Retention Schedules: University: http: //www. libraries. iub. edu/index. php? page. Id=3148 Ø University of Kansas: Status = Draft http: //www. provost. ku. edu/policy/infomanagement /review. shtml Ø The Ohio State University: http: //library. osu. edu/sites/archives/retention/schedules. php

Records Retention Schedule Development … Public Institutions typically driven by state public records laws… v Private institutions typically driven by best practices… v Example> OSU & the IUC (public universities in Ohio): v Record Series Ø Based upon Record Group form Matrix Ø Mapped to legal group index Ø Based upon legal research Ø q Requirements q Considerations

Schedule Development Example… v Accounts payable: Ø Amounts owed on open account for goods or services received Ø Retain - 4 Years Ø Disposition – Destroy Ø Retention Group – ACC 1000

Schedule Development Example…

Schedule Development Example…

Schedule Development Example…

Electronic Records Management… v Policy v Document Ø EDM Management Systems: – Electronic Document Management Ø ERM – Electronic Records Management Ø ECM – Enterprise Content Management

EDM/ERM/ECM Institutional Examples… v Indiana University: Ø Hyland q Used On. Base by Facilities, Legal Counsel, Financial Management (for invoices), and Risk Management (for insurance forms)

EDM/ERM/ECM Institutional Examples… v University of Kansas: Ø Xythos q KU Policy Library q Emergency Management Response Plan (public & internaluse only) q Various other task forces/committees Ø Image. Now q Human Resources q Payroll Ø World. Docs q General Counsel

EDM/ERM/ECM Institutional Examples… v The Ohio State University: Ø Xpedio/Stellent/Oracle: q OIT PS Programming Documentation q Office of Undergraduate Education: New Course Approval Ø Docfinity: q B&F: Financial Documents q Registrar: Student documentation Ø Hyland On. Base: q Development Ø Image. Now: q President’s Office Correspondence

Records Requests… v e-Discovery Ø Specifically identifies electronic information as being discoverable Ø Fed (Dec 2006) applies only to cases in Federal Courts Ø Local (Ohio July 2008) mirrors Fed regs in state courts

Records Requests… v Freedom of Information Act (FOIA): A federal law that allows citizens to request information from the federal government and its agencies. Requests can be a “fishing expedition” or “research project” that ends up creating a new record

Records Requests… v Open Public Records Laws (sometimes know as Freedom of Information Laws): State laws that allow citizens to request records from state and local agencies. Typically, one must request specific records, not “all information about…”

Records Requests… Private Institution: not subject to FOIA or Open Records Laws; unless the institution wants to be forthcoming with records, they are only accessible via the discovery process. v EDUCAUSE Data Incident Notification Toolkit (https: //wiki. internet 2. edu/confluence/display /secguide/Data+Incident+Notification+Toolkit or http: //tinyurl. com/yuahgk) v

Wrap-up/Conclusion

Training Opportunities… v Seminars v Workshops v Classroom v Online

If You Do Nothing Else, Do These 8 Things v v Get people to care. Start at the top. Identify a champion of the cause at the executive level. Build a team to help spread the word or do the work. Find out what others in your region are doing. If they’ve already invented the wheel, use it & modify it. v v v Find out what you have. Decide how sensitive or valuable it is. Start with the most sensitive/valuable (the most risky) and: Ø Ø v Keep track of it… Protect it… Get rid of it… Perfect it… Keep on going!!

The Team… v Merri Beth Lavagnino Ø mbl @ iu. edu Ø 317. 274. 3739 v Jenny Mehmedovic Ø jmehmedo @ ku. edu Ø 785. 864. 4532 v Daniel Noonan Ø noonan. 37 @ osu. edu Ø 614. 247. 2425