Information Governance & Standards Across the World: DoD5015.2, VERS, MoReq Presented by: Mike Alsup, Gimmal June 16, 2015

Information Management for Everyone How did Gimmal Get Here? Retained by Microsoft to review alpha version of SharePoint 2010 Evaluated planned SharePoint 2010 capabilities against DoD Evaluated planned SharePoint 2010 capabilities against MoReq2 Gimmal productized in SharePoint when Microsoft didn’t – Certified Chapters 2 & 5 with Gimmal Compliance Suite in 2011 – Added Chapter 3, Classified Documents in 2013 Gimmal has the only DoD certified products inside SharePoint 2

Information Management for Everyone Target ECM Repositories for Information Governance Traditional RM SharePoint, Office 365 Traditional ECM File Shares ERP Archives

Information Management for Everyone Retention Location Metadata Security Versions Disposition Many others Retention XX Days Location(s) Network Shares Inbox Metadata Name Retention XX Months Location(s) Document Libraries Metadata Name Document Type Retention Retention Schedule Location(s) Repository of Record Metadata Name Document Type Information Lifecycle Best Practices All Information is managed from creation to disposition Retention for all information in every state of the ILC Early classification (indexing) is an important step to compliance Rules are enforced by the technology TemporaryIn-ProgressFinalArchive Hold Disposition ( Destroy or Archive )

Information Management for Everyone ISO ICA/ISO DoD VERS MoReq RM Standards Vary in Style & Content Soft Standards No Testing Regime Requires a Consultant to tell me I am compliant More Guidelines than Standards Hard Standards Testing and Certification Compatible and Interoperable

Information Management for Everyone DoD Overview DoD : – Defines mandatory and non-mandatory requirements for RM software – Functional Standard vs. Procedural Standard (e.g. ISO 15489) – Certify the product, not the solution Benefits of DoD Certification – Solution Credibility Considered the North American ‘Gold Standard’ for RM Applications Only standard endorsed by the National Archives and Records Administration (NARA) Leading ECM vendors are certified (Open Text, IBM, EMC, HP, Alfresco, Perceptive, Gimmal) – Legal Integrity Facilitates compliance with internal and external RM requirements Considered a secure records repository for evidentiary integrity – Industry Acceptance Endorsed by industry analysts and associations Gartner  MarketScope for RM required DoD certification 6

Information Management for Everyone Standard Test Procedures JITC maintains Baseline Test Procedures Section 2 – Test Readiness Evaluation Section 3 – User Management Section 4 – File Plan Management Section 5 – Filing Section 6 – Search Section 7 – Screening Section 8 – Disposition Management Section 9 – System Management Section 10 – Usability Evaluation JITC produces Summary & Detailed Reports JITC maintains certified Product Registry

Information Management for Everyone Critical DoD-certified RMA functionality records management Case management Event-based retention Vital records management File plan builder Secure electronic records destruction Enhanced security Enhanced search features  Very specific way of performing records management 8

Information Management for Everyone VERS – Standard is called PROS 99/007 – Version 2, 2003 is the most current VERS sets record keeping requirements for state agencies in Australia – By law, agencies in certain jurisdictions must comply to the requirements in the standard Standard concentrates heavily on formats for storage, long term preservation, and export to controlling/preservation agencies – VEOs (VERS Encapsulated Objects) – Records are aggregated in container objects (Files and File Parts)  Everything is a Record VERS (Victorian Electronic Records Strategy)

Information Management for Everyone MoReq History MoReq – Long history MoReq2 – 2008 – Defines RM requirements to support all needs of any Org. – Based on historical model of a single RM repository – Fabasoft only vendor ever certified – SharePoint  multi-repository, in-place RM changed market MoReq 2010 – 2011 – Modular governance – Export records – Big Vision, Big Plans  not realized, but it’s not too late!

Information Management for Everyone Aspirations that MoReq 2010 Abandons  A ‘file’ in electronic RM system is ERM equivalent of a traditional hard copy file o MoReq 2010 replaces concept of a ‘file’ with an ‘aggregation’ o An aggregation can be a multilevel hierarchy in its own right  A monolithic classification/fileplan applying retention rules to all records o Previously, a classification was linked to retention definitions to apply rules o A Moreq 2010 record can have several classifications that apply rules  A single ERM system that can meet the needs of all organisations in all sectors o MoReq 2010 core module contains rqmts. common to most organisations

Information Management for Everyone Electronic RM systems will integrate w/ applications used to create records MoReq compliant systems will control records held in other systems A new RM system can understand what happened to records in old RM system – MoReq 2010 compliant system needs to be able to export a record and associated metadata – MoReq 2010 is strict on how a system maintains audit logs and event histories Line of business system vendors may incorporate RM functionality The new aspirations of MoReq 2010

Information Management for Everyone MoReq2 vs. MoReq 2010 Product Oriented Traditional ERMS Large Core Tightly Coupled Some Modules One Size Fits All Entry Bar High An Extension of Original MoReq Consumer Oriented Contemporary Systems Small Core Loosely Coupled Many more Options Scaleable / Flexible Entry Bar Low A Foundation for Future Extensions

Information Management for Everyone MoReq 2010 Extensibility

Information Management for Everyone Interoperability

Information Management for Everyone Issues & Opportunities with MoReq 2010 Harmonization with E-Ark Rate of Evolution of Technology Support from ECM (& Other) Vendors Availability of DLM Forum Resources Information Policy – Many types of information policies – Reporting is required by regulatory groups – How to apply policy to multiple repositories consistently? – How to apply to transfer of records between repositories?

Information Management for Everyone Records Mgmt. vs. Regulatory Policy ISO Specification EU Data Protection Regulation 2014

Information Management for Everyone Standards Summary High Demand for governance in Europe and North America – Many new market and technology developments – RM standards  not designed for cloud, social, mobile, or Apps – Much need for RM and IG standards to be harmonized across vendors – Converging standards create a bigger market for RM and IG DoD not workable. US  RM and IG vacuum in standards VERS is minor standard, with similar goals to MoReq 2010 MoReq 2010 published  After 4 years, no vendors certified MoReq has great merits but not yet adopted

Information Management for Everyone What Do We Need to Do? Accept that MoReq is the Best RM Standard – Only Std. Built for Multi-Repository Governance – Only Std. Built for Transfer to Archives Testing Center needs to be completed – Great progress from Ricardo Vieira and Jose Borbinha Synchronize MoReq 2010 Export Rules with E-ARK Initiatives – Enables Consistent Capture into National Archives Use technical experts to update MoReq standard Work w/ N. American standards orgs, esp. JITC Solicit involvement of AIIM, ARMA, NARA and ICA

Information Management for Everyone ? Questions

Information Management for Everyone Mike