Retain Data Commensurate with Value Module P7 Principle 7: Retain Data Commensurate with Value LEARNING OBJECTIVES: Understand the importance of planning for Enterprise data retention Discuss the requirements for quality data asset maintenance Understand the method for assessing the current and potential future value of Enterprise data holdings Understand the guidelines for disposing of data Page to have graphic representing secure data – lock on a file cabinet or treasure chest perhaps.

Proper planning and protection avoids data re-creation! Plan to Ensure Data are Available When Needed Later Planned Retention Requirements Data Stewardship Repository and Process Control Risk Reduction Presentation: Graphic to emphasize risk reduction – something that will reflect data redundancy or duplication (backup) Explanatory Material: Intro: Any data assets that are of potential business, project, operational, or historic value should be retained until their value is depleted. Data of sustained value to the enterprise should be retained and evaluated on an ongoing basis. Accurate and up-to-date data aids in critical business decisions. Timeliness of the decision-making process with value-added data increases competitive advantage. Planned Retention Requirements: Data assets should, upon their creation and initial storage, have planned retention requirements identified and documented. Such business processes should cover archive formats, frequency of reviews, purge planning, disposition funding, and related activities. Clearly defined methods for data retention help ensure that the data will be available when and if needed. Data Stewardship: To ensure proper planning for eventual disposition of data assets, the enterprise should identify an appropriate data steward for planning disposition dates early in the data life cycle. These stewards should be trained in the organization’s retention and disposal processes. Data stewards ensure that data is stored at authorized locations. They maintain backup copies at locations separate from the masters for best disaster recovery practice. They ensure that backup copies are not maintained or stored at unapproved locations, such as personal residences. They make certain that the physical location of data assets is known and that those assets are easily retrievable by those who need them. Repository and Process Control: Maintaining control of the repository and the associated processes or data holdings is a DM function. The data manager should pay special attention to changes of stewardship in order to avoid data loss. Risk Reduction: An essential element of preservation planning is to ensure planning for adequate protection of data against potential disaster commensurate with the value of the data. The enterprise should review risk areas where singular versions of data could be lost in the event of a disaster and develop plans to mitigate such risks. Mitigation may include developing duplicate copies or scanning paper documents to provide backup, as well as by maintaining electronic versions (tapes, CD, etc.) of files and associated software. Reference Material: ANSI/GEIA 859 - Principle 7 Intro and section 7.1 Proper planning and protection avoids data re-creation!

Maintain Data Assets Accurate and Complete records Security Requirements Storage Considerations Data Migration and Refresh Presentation: Graphic to reflect migration Explanatory Material: Accurate and Complete Records: Accurate and complete records of data assets should be available for view by those with a valid business need, controlled, retained, protected, and subsequently disposed of in accordance with the requirements set forth for the data assets. To ensure that data assets are well identified, the enterprise should use appropriate metadata—identifying data pertinent to the items—to enable retrieval of those assets. Effectively identified data assets enable timely retrieval and destruction as appropriate. Security Requirements: To protect data assets from unauthorized viewing, the enterprise should place security requirements on data assets as appropriate. Enterprise data assets may be of a proprietary, government classified, or other sensitive nature, warranting protection against unauthorized viewing. In a paper environment, protection may be ensured through physical security. In an electronic environment, protection may be ensured through segregation of data by server, by firewall, by password, and similar means. Storage Considerations: When evaluating how to store data, the following questions may assist with decision making: Will the data ever be used as direct source information in the creation of new material? How long will the data likely have value to the enterprise? How difficult will it be to retain compatible (and potentially obsolescent) equipment and software in order to provide for retrievability and readability of the files over their anticipated lives? Data Migration and Refresh: Data media types require migration and refresh to ensure future retrievability. Paper – migrate to electronic neutral format as inks fade and single copies can be destroyed. Electronic non-neutral software – migrate to neutral format for portability to future software versions. Portable electronic media (CDs, floppy disks, tape) – refresh to new media as shelf life limits present a risk to readability and retrievability. Reference Material: ANSI/GEIA 859 - Principle 7 section 7.2

Data Evaluation is Key to Efficient Retention! Assess the Current and Potential Future Value of Enterprise Data Holdings Evaluation and Reevaluation Intervals Evaluation Considerations Active Data vs. Inactive Data Storage Presentation: Graphics as presented Explanatory Material: Evaluation and Reevaluation Intervals: To make sure that it does not retain non-value-added data, the enterprise should assess its data periodically. As a minimum, data should be reevaluated at the time originally designated for disposition, its original default retention date. Reevaluation considers the latest of dates set by law, by local policy, or by ascertained potential need to the enterprise or potential need to the customer. Evaluation Considerations: When evaluating the current and future value of data, some questions that may be asked are as follows: What data is currently stored and for what purpose? Is the data accurate and up-to-date? What are the criteria for the storage life of data? What are the costs associated with data retention? Will retaining the data enhance network security? Is there potential for this data to satisfy contractual or other legal requirements? Active vs. Inactive Data Storage: Active data needs to be readily available to the enterprise for regular reference. Inactive data still retains value but is not considered to have a regular, continuing need. Such data needs to be retrievable, but can be stored less centrally, generally saving cost to and resource of the organization. Non-active data should be periodically reviewed for continuing value. Reference Material: ANSI/GEIA 859 - Principle 7, section 7.3 Data Evaluation is Key to Efficient Retention!

Data Disposal Obtain Disposal Authorization Generate and Maintain Accurate Disposal Records Disposal Methods Presentation: Include graphic of shredder or trashcan Explanatory Material: Intro: Upon determination that data retained is not of continued value, the enterprise should arrange for disposal so that costly resources are not required to maintain non-value assets. Disposal Authorization and Records: An enterprise needs to have an effective process to ensure that qualified individuals or teams of potentially interested parties authorize destruction. In some cases, as in merger environments, other enterprises may be required to jointly authorize destruction. A record should be retained to identify what documents were destroyed, when they were destroyed, and who authorized the destruction Disposal Methods: The enterprise should ensure that data assets of potential value to other parties are destroyed in a way that prevents those assets from becoming publicly available. For example, such measures as electronic deletion, shredding, or burning may be appropriate methods for destruction. Effective destruction processes ensure that the enterprise’s non-value-added data—its trash—is not compromised, becoming another enterprise’s treasure. Reference Material: ANSI/GEIA 859 - Principle 7, section 7.4

Quiz Questions – P7 Which of the following statements best explains why an Enterprise should plan for data retention: a. Planning for data retention ensures appropriate funding is available for archiving when needed. b. Clearly defined methods for data retention help ensure that the data will be available when and if needed. c. Plans for data retention are needed to ensure facilities will be available to store data. d. It is important to plan for data retention to ensure tasking is assigned to the Data Manager. An essential element of preservation planning is to ensure planning for adequate protection of data against potential disaster commensurate with the age of the data. True or False Why is it important to use appropriate metadata when identifying retained data? a. To enable retrieval of those assets. b. To enable development of detailed reports. c. To enable timely destruction as appropriate. d. All of the above.

Quiz Questions – P7 True or False Which of the following is not a method to ensure data assets are protected in an electronic environment? a. Segregation of data by server b. Padlock c. Firewall d. Password When evaluating the current and future value of data, some questions that may be asked are as follows: What data is currently stored and for what purpose? Is the data accurate and up-to-date? What are the criteria for the storage life of data? What are the costs associated with data retention? Will retaining the data enhance network security? Is there potential for this data to satisfy contractual or other legal requirements? True or False

Quiz Questions – P7 Once data is considered non-value, which of the following is true: a. The enterprise should arrange for disposal so that costly resources are not required to maintain non-value assets. b. A record should be retained to identify what documents were destroyed, when they were destroyed, and who authorized the destruction. c. Data assets of potential value to other parties should be destroyed in a way that prevents those assets from becoming publicly available. d. All of the above