Nov 30, 2020 | Blog
As Information management consultants we engage with organisations to help them create, review and implement complex information governance frameworks. Many of these organisations are subject to frequent and recurring administrative and organisational change. These changes present significant challenges for continuity of information access.
Recently we undertook a large information governance project for a government department who had undergone administrative restructuring. Key challenges for the department were:
- The provision of a single, shared technology platform, and
- the transfer of data into the shared platform and applications.
Additionally, we are seeing government business operations being outsourced. This has been common practice for the past few years for the delivery of infrastructure assets, but is now becoming more frequent for delivery of services. This has profound implications for information governance frameworks. Information creators are separate entities – with their own systems, metadata and data governance practices. But from the point of view of the responsible government agencies, the resulting physical and information assets must be returned to public custody once the infrastructure is commissioned or services delivered. The issues of information governance become increasing complex across multiple organisations. Information governance therefore requires policy settings, understanding what information assets have been created, where they are held, who administers them.
For the information custodian or owner, the resulting information assets needed to be governed, identified, secured and made accessible to operational staff. Often there were some basic metadata standards and transfer protocols established under contracts. This can make the transfer of data easier, but data migration may not be the best or complete solution. It’s becomes increasingly important to maintain relationships between data and the creating entities (the private providers) for data integrity.
In addition, there is the difficulty within the government agencies to have information governance staff with the right skills and authority to support implementation and delivery of frameworks and associated activities, and to raise awareness of information governance requirements
For managers the information framework is complex. Frequently the business rules on information governance are unclear and there is poor visibility at the executive level. There is a policy in document format, but how is this implemented; who can access data; what are the requirements for security and privacy protection; what are the rules on overriding security settings when regulators and auditors request access; who owns the data?
This is not just a compliance issue, it is about the struggle organisations have to document all of their information, where it is, who controls it and how to apply governance.
“Eat the Data: Reclaim the web, #CNIE2014 keynote by @brlamb expertly DJd by @draggin” by giulia.forsythe is marked with CC0 1.0
We have been seeking tools and systems providing visibility of the datasets and dataflows, to understand who and how data is used, assess data quality, identify risks and prioritise remediation.
Recently we worked with Informatica’s solutions to provide discovery and visualization of information assets. Their AXON product provides a dashboard providing graphical display on information assets, business term definitions, enabling business context and policy documentation. It provides executive management with the ability to gain useful insight into organisational information assets. We believe this is a new way of providing managers with the insight they need to manage information assets, to better understand the information framework and to use data to assess and mediate risks
We’re looking for ways to use automation for better business analysis. We want solutions that provide a sustainable solution. Recently we participated in a webinar with Informatica’s Data Governance Practice lead to explore emerging options for the issues we are seeing in our client base.
The link to the webinar is available here.
About the Author
Kerry Gordon is a Director and Consultant with Recordkeeping Innovation. She works on digital recordkeeping and archives for clients in Australia and SEAsia. Kerry delivers regular training programs in records management and managing digital records. Kerry has a Masters Degree in Information Management from Monash University, Melbourne and has experience in developing large scale strategic studies for digital transition, classification and retention, managing administrative and organisational change, project management and communications supporting information governance.
Nov 19, 2020 | Blog
Retention labels in Microsoft 365 (M365) provide organisations with the ability to apply retention controls to documents through the solution interface. Unlike retention policies, when a retention label is published end users can view and apply retention labels themselves.
To understand how retention labels can be used to support your retention requirements, let’s look at how they can be configured. Retention labels can be set to keep content forever, start a disposition review, or dispose of content a certain period after the following retention triggers:
- the content was created
- the content was last modified
- an event (we will take a look at event-based retention in a later blog)
Retention labels also have the configuration option of classifying items as ‘Records’ or ‘Regulatory Records’ once the label is applied. Once an item is declared as a record, certain restrictions are placed on actions that can be performed, such as editing record content.
Retention labels can be imported as a file plan. Please note that in our experience when importing from CSV there appears to be a 36-character limit per cell for the import. As such, if using the file plan import organisations may wish to leave Comments, Notes, Reviewer Email and Citation URL’s blank and manually add this information to labels after import. Event-based retention labels also need to be manually created.
In order to use retention labels, they must first be published to a retention label policy, which we will focus on in a future blog.
The following rules apply to published retention labels:
- only one label can be applied to an item
- if a label is manually assigned, it can be changed by end users (I.e. you cannot prevent people from modifying the label assigned)
- if an auto-apply label is assigned, end users can apply a manual label instead
- if a manual label has been assigned, an auto-apply label cannot replace it
- if an item meets the conditions of multiple auto-apply labels, the label with the longest retention is applied
Disposition Reviews
A major benefit of using retention labels is the disposition review feature (only available to E5 licences with access to Advanced Information Governance). Where a Reviewer Email has been set on a retention label, once a record with that label applied passes its retention period the reviewed will receive an email notification asking to review disposal.
Pending dispositions can be viewed in the compliance centre, with Reviewers given the option to:
- permanently dispose of the item
- extend the retention period
- apply a different retention label
Proof of disposition is maintained for 7 years, and is based on Unified Audit Log data.
Organisations however may find that there are gaps in metadata required to be captured for proof of defensible disposition.
In the next part of our series we will look at event-based retention in M365.
About the Author
Adelaide Copland has worked as an information specialist and CM/TRIM application administrator since 2014. Adelaide has experience in Microsoft 365 implementations, process improvement, records training delivery, development of policies and procedures, strategy and establishing digitisation programs.
Nov 4, 2020 | Blog
World Preservation Day 5/11/2020
Did you know that the first Thursday of November is celebrated as World Digital Preservation Day (WDPD). WDPD allows preservation experts across various industries to come together and raise awareness of digital preservation initiatives and societal benefits of preservation.
The world in which we work today is largely digital. Digital information and records are growing exponentially every day, and appropriate strategies need to be developed and implemented to ensure appropriate records and information are preserved over time. As we live through the COVID-19 pandemic, it’s evident that evidence of worldwide organisational and social responses to the pandemic are likely to have ongoing historical, social and research value. So how do we ensure that relevant records and information are maintained and preserved for future generations?
In a past blog, we talked about digital preservation. In it we discussed what preservation means, its importance, and resources to support digital preservation programs and initiatives. The Digital Preservation Coalition act as champion of WDPD, and provide a plethora of resources to help organisations get their digital preservation journey underway. The Digital Preservation Handbook is a great starting point for organisations wanting to understand what preservation involves.
Before you get started it is important to understand:
- the digital records and information assets your organisation owns
- the repositories (i.e. systems) that house your records and information assets
- retention requirements for digital records and information assets
- organisational expertise and technical capacity to carry out digital preservation activities
From this, organisations can develop a digital asset register which can provide a clear and concise view of digital assets it owns. Having an understanding of organisational readiness will also help to inform preservation next steps, and whether external expertise is required to support your preservation journey.
If you’re looking to start your preservation journey and need some support the team at Recordkeeping Innovation can assist you. Learn more at http://www.records.com.au/
About the Author
Adelaide Copland has worked as an information specialist and CM/TRIM application administrator since 2014. Adelaide has experience in Microsoft 365 implementations, process improvement, records training delivery, development of policies and procedures, strategy and establishing digitisation programs.
Oct 28, 2020 | Blog
Just google the term “maximising the value of information” and you will get a plethora of results. How did we get here and why are we still struggling to manage information?
Technology has led to a massive growth in the volume of information. Now there are new technologies to manage the ever-increasing volumes of information across multiple systems and platforms. Some of these systems are great and really help us achieve efficiency, ease of use and better business outcomes. But shouldn’t we be more strategic instead of just throwing another piece of technology at it?
How can we maximise the value and minimize the risk to our information before implementing new technologies? Implementing Information Governance strategies can provide organisations with a framework to better understand and manage the information that they need to create, use, share and and at some point information that can be disposed of.
Information Governance, as described by Gartner[1], “is the specification of decision rights and an accountability framework to ensure appropriate behaviour in the valuation, creation, storage, use, archiving and deletion of information. It includes the processes, roles and policies, standards and metrics that ensure the effective and efficient use of information…”. In guidance for Establishing an Information Governance Framework, the National Archives of Australia describes Information Governance as a “system for managing information assets across an entire organisation to support its business outcomes”. Data.NSW promotes an Information Management Framework that’s provides a shared direction for how information should be managed within the NSW public sector. The common theme here is to have a framework and systems that manage all of an organisation’s information, including records and data, from creation through to business use and eventual disposal.
With effective information governance practices in place organisations can achieve responsible corporate governance and leverage opportunities to maximise the value of information assets.
Information Governance Frameworks
Developing an information governance framework with a ‘by design’ approach will help organisations to have information that is trusted, reliable and business outcome focused. Effective frameworks require collaboration across specialty areas including privacy, security, compliance, information management, records management, data management and information technology. A key component in aligning theses specialty areas is an information asset register.
Information Asset Register
You can’t develop an effective information governance framework or maximise the value of your information until you know what you have and understand its context, who controls it and its limitations. An Information Asset Register helps you to understand:
- what your information assets are,
- where your information assets are located,
- what software applications they are managed in,
- what formats they are in,
- who the business owners or custodians are,
- requirements for access, security and privacy,
- the value of information to the organisation legally or otherwise (high or low),
- requirements for retention and disposal, and
- possible risks that need to be mitigated
An information asset register should be a key component in any information governance framework and is a great starting point in maximizing the value of your information. Below are just 2 examples of what an information asset register might look like.
[1] https://www.gartner.com/en/information-technology/glossary/information-governance#:~:text=Gartner%20defines%20information%20governance%20as,archiving%20and%20deletion%20of%20information.
About the Author
Annette Senior has a Graduate Diploma of Science (Information Services) and has worked in information specialist roles since 2000. She has delivered front line support services for Electronic Information Management systems and has extensive experience as a systems administrator for TRIM. In addition to her technical understanding, she is a knowledgeable and adept trainer, designing and delivering information management and system-based training for diverse audiences. Annette’s’ experience in risk and compliance areas informs her approach to information and records management frameworks. She has experience developing and maintaining recordkeeping policy, procedures, classification and disposal tools to support business objectives and the implementation of technology.
Oct 19, 2020 | Blog
In our last Microsoft 365 (M365) article we began to touch on retention capabilities within M365. A core retention capability within M365 is that of retention policies, which provide the ability to:
- decide whether to retain and/or delete information assets
- apply a single policy to the entire Agency or specific locations and users
- apply a policy to all content in a location or to content meeting certain conditions
Retention Policies are a great feature for organisations with relatively simple retention and disposal requirements. Policies work as a behind the scenes feature, and are applied to content matching policy settings without any end user intervention.
When a retention policy is applied to locations or information assets, people can continue to edit and work with information assets. However if a document is deleted or modified a copy of the document is retained in the Preservation Hold Library (PHL) in SharePoint or the Recoverable Items Folder (RIF) in Exchange. It is important to note that if content is deleted or modified:
- for deleted items the original document/email is moved to the Recycle Bin and deleted after 93 days (SharePoint, OneDrive, Teams) or Deletions folder and deleted after a default 14 days (Exchange)
- where a copy is taken, the copy will have its own GUID and it is not clear whether any relational link is created between the copy and the original (including audit history of the original)
- recycle bins are not indexed therefore any searches, including eDiscovery searches, will not be able to discover information assets within a recycle bin. However the PHL and RIF are indexed and searchable
PHL exist at a site collection level within SharePoint (or SharePoint backend solutions like Teams and OneDrive). The libraries are only created when the first item needs to be copied to the library, rather than when the retention policy is created. PHL are only viewable by Site Collection Administrators (or other admin roles with access to Site Collection Administrator permissions). Microsoft MVP Joanne Klein has written a helpful explainer on the Preservation Hold Library, including a table which documents PHL behaviours when particular site actions are performed.
“Digital Preservation” by zipckr is licensed under CC BY 2.0
The RIF in Exchange is hidden from end users, but content is discoverable via eDiscovery searches. Administrators with appropriate controls can perform actions on user RIF using the Exchange Management Shell. Users RIF storage quota, when a retention policy is applied to the mailbox, is automatically set to between 90GB and 100GB. If the auto-expanding archiving feature in Exchange Online is enabled, the storage quota for the RIF in the user’s archive will be unlimited.
When configuring a retention policy rules can be set to keep content forever, or dispose of content a certain period after the following retention triggers:
- the content was created
- the content was last modified
Retention Policy Gaps
Retention policies are unable to accommodate retention triggers that are event-based (e.g. date of termination, expiry of contract, date of birth, etc). While Retention Policies present a promising feature for managing simple retention requirements, the lack of disposition review process for Retention Policies leaves gaps in compliance if proof of defensible destruction is a requirement.
In the next part of our series we’ll look at Retention Labels in M365.
About the Author
Adelaide Copland has worked as an information specialist and CM/TRIM application administrator since 2014. Adelaide has experience in Microsoft 365 implementations, process improvement, records training delivery, development of policies and procedures, strategy and establishing digitisation programs.
Oct 2, 2020 | Blog
NZ has led the world in issuing its Algorithmic Charter for Aotearoa New Zealand in July this year. The charter is designed to ensure NZ citizens have confidence in how government agencies use algorithms and demonstrating a commitment to transparency and accountability in using data.
Algorithmic accountability has been much on my mind for a while now. I first wrote about this as an emerging issue for recordkeeping in 2016. Since that time, algorithms have been identified as decision making tools in many contexts and are likely to increase in use by organisations as the trends towards datafication of all types of things, not least of which is people.
Many books have been written identifying the inherent bias built into assumptions controlling algorithms; one of the best known of these is Professor Sofiya Noble’s Algorithms of Oppression, but many other scholarly articles have emerged around the use of algorithms. Similarly there has been an expansion of attention to data ethics, following the Snowden revelations about widespread unauthorised data collection by multiple governments and the Cambridge Analytica Facebook scandals of 2015-2016. Some of the world’s biggest data players are even backing calls for ethical approaches to data use and regulation of AI.
Examples of misintended (we assume) results which severely impact people, are growing. They include the Google facial recognition service that labelled images based on skin colour and the earlier labelling of dark skinned individuals as ‘gorillas’; or more locally the use of AI and predictive technologies in our own home grown Robo-debt scandal linked to the suicide of a number of targeted individuals; and most recently the controversy surrounding the algorithmic grading of UK’s school leaver results in CoVID times. The emergence of the Indigenous Data Sovereignty initiatives reflect just how seriously Indigenous communities regard the appropriation and perpetuation of stereotyping in data use. Of course there are great benefits, new insights and advantages to also be found in greater activation of data – it’s just that the problem stories show the devastating results of misapplied use of technology.
Recordkeeping and Algorithms
“3D-Printed Algorithm” by tonnerrelombard is licensed under CC BY 2.0
So what is the role of recordkeeping in the process of documenting algorithms which learn and evolve? It’s a big topic, far too big for me to be able to answer and one which needs much more work. The UK Information Commissioner’s Office is doing interesting work in building an AI Auditing Framework which will likely have recordkeeping implications. But what seems likely as a starting point is far more systematic documentation about algorithms, AI and predictive learning. So here is perhaps some beginning thoughts:
- identify and maintain the data on which the algorithms are trained;
- document and records all processes in the design of systems and algorithmic development;
- clear documentation about the intent of the algorithm, and
- development of a regular, systematic and documented auditing approach to test whether the algorithm is still doing what it set out to do.
All this also brings with it questions of individual consent (and the use of umbrella consent models), social expectations and larger social conversations about consultation, about whether the outcomes are ethical etc.
It’s a big topic – I’m not going to be the one to ‘solve’ it. There is so much to know and find out. But I am actively thinking in this space, and would love to hear from like minded recordkeeping people.
About the Author
Ms Barbara Reed, Director of Recordkeeping Innovation Pty Ltd, has been a consultant in the fields of records, archives and information management since 1985. She is active in professional arenas, including the teaching and training environments. She has played a major role in the development of Australian and International standards for records management, digitisation, recordkeeping metadata and others.
