STORAGE MANAGEMENT/ EXECUTIVE: Managing a Compliant Infrastructure Processes and Procedures Mike Casey Principal Analyst Contoural Inc.

Agenda Anticipate the impact of future compliance requirements Get agreement on policies & processes Leverage best practices & standards Link compliance with ILM to minimize risks & costs

Anticipate the impact of future compliance requirements Policy drivers: regulatory compliance, litigation readiness, stakeholder expectations Anticipate changes and new requirements, by understanding these drivers Strategy: Understand the common policy goals that drive regulatory activity – and the common technical capabilities that enable organizations to comply

Policy goals drive archiving goals Operational needs End-user productivity Customer service levels Corporate IP protection Litigation readiness Liabilities and risks Discovery costs Regulatory compliance Laws Regulations Standards Guidelines Archiving goals Retention Security Efficiency

Foundations of compliance & ILM Records management Archiving Record definition Identification Classification Index & search Storage management Media Migration Cost Retention Retrieval Disposition Security Integrity Confidentiality Accessibility What to save How to save it

Archiving goals and capabilities Admini- strative TechnicalPhysical Admin. retention Technical retention Admin. efficiency Admin. security Physical retention Technical security Physical security Technical efficiency Physical efficiency Security goals Integrity Confidentiality (privacy) Availability (transparency) Retention goals Scope (completeness) Duration Efficiency goals Service levels Cost reduction

Example: Technical security capabilities 45 CFR Subpart C Security Standards for the Protection of Electronic Protected Health Information Technical safeguards (a) Access control. Implement technical policies and procedures... to allow access only to those persons or software programs … (b) Audit controls. … (d) Person or entity authentication.. (e) Transmission security.... (e)(2)(ii) Encryption … HIPAA security rule

Get agreement on policies & processes AssessPolicyArchitectDeployManage Response to change Ongoing operation 123 Compliance initiative: Process steps

Step one: Assessment Regulatory compliance Litigation readiness Stakeholder expectations 1

Regulatory compliance Data Protection Act (UK) and similar laws implementing EU Directives GMP Directive (EU) Basel II ISO 9000 Europe: United States: Global: SecuritiesBanking Insurance Health insurance Health care Medical devices Financial services Health servicesLife sciences Drugs Sarbanes-Oxley Act Gramm-Leach-Bliley Act HIPAA21 CFR 11, GxP

Litigation readiness Discovery requested by one party Result review Deliver response To the court First internal awareness Discovery request Court order issued Issue internal retention hold Search, Query Archive DB User directory Discovery depends on effective archiving

Not sure 42% Other 8% Preserving all and IM content for long periods is least risky: 29% Enterprise views toward and IM archiving Deleting all and IM content on a regular basis is least risky: 21% Source: Osterman Research

Stakeholder expectations Operational perspectives Application perspectives Legal perspectives Technology perspectives  CEO  CFO  Records mgr  Compliance Officer  Storage admin  System admin  CIO  End user  Application admin  Legal counsel

Step two: Policy development Save almost nothing Selective deletion Selective retention Save nearly everything IMPACTSPOLICY CHOICE Example – Retention scope 2 Regulatory compliance Litigation readiness Stakeholder expectations

Step two: Policy development (2) Example – Retention periods Many, content-based Few, organization-based One for all IMPACTSPOLICY CHOICE Regulatory compliance Litigation readiness Stakeholder expectations

Step three: Define architecture and processes Provide required and recommended capabilities for retention and security Use technology to enable cost-effective retention, storage and migration over lifecycle Start with point solutions and information silos if needed, but move toward an integrated ILM architecture as technology evolves 3

Leverage best practices & standards Example 1: HIPAA Security Rule Example 2: Sarbanes-Oxley Act Example 3: DoD Standard

Example 1: HIPAA

Example 2: Sarbanes-Oxley Act IT Control Objectives for Sarbanes-Oxley IT Governance Institute and SEC refers to the COSO framework Auditors endorse IT control frameworks COBIT ISO/IEC 17799

Example 3: DoD STD C RMAs shall enforce data integrity … C The RMA shall prevent unauthorized access to the repository. C The RMA … shall use identification and authentication … C If the RMA provides a web user interface, it shall provide 128-bit encryption C RMAs shall delete electronic records … in a manner such that the records cannot be … reconstructed. C The RMA … shall provide an audit capability to log the actions, date, time, unique object identifier(s) and user… Records Management Applications

Link compliance with ILM to minimize risks and costs Compliance initiatives can minimize risk by establishing policies and processes for response to new regulations – and for anticipating future regulations and standards Best policy response is commonly to retain more data, for longer retention periods ILM processes and architecture can help reduce storage and management costs, making increased data retention feasible and affordable

TCO example for archiving Hard IT costs Storage hardware Archiving software Operations/IT staff Maintenance Soft costs User productivity Operational costs Potential costs Litigation discovery Increased liability Regulatory discovery Potential penalties $9 $6 $80 Potential $53 $210 $102 Total $4 $0 $19 Soft $40 Save nearly everything intelligently $204 Save nearly everything (primary disk) $3 Save nothing (delete at 30 days) Hard Average costs per user per year POLICY CHOICE

Conclusions Understand common compliance goals and technical capabilities Start with business needs assessment: compliance, litigation and stakeholder requirements Use standards and best practices to guide policies, processes and architecture Define ILM policies and strategies to enable cost-effective implementation

Questions? Ask the Expert Resources searchstorage.techtarget.com/ ateQuestion/0,289624,sid5_tax295552,00.html