1.  Proposal for Retention- and Legal Hold Management based on Secondary Types Alfresco OpenText SAP

2. Retention Types  Repository Managed Retentions  Client Managed Retentions  Legal Holds

3. Repository Managed Retentions  A repository exposes a set of managed retention types with a repository determined semantic  A CMIS client can apply one of the exposed retention types to a document  The repository calculates the specific retention period according to the semantic of the applied retention type

4. Example for Repository Managed Retentions

5. Client Managed Retentions  CMIS client calculates the retention period itself  CMIS client applies the calculated expiration date to a document using a repository defined managed retention type  Repository assures that the documents are preserved according to the given retention period  Usually used in multi-system environments

6. Example for Client Managed Retentions ILM Retention Management End-of-Life Data CMIS Repository CMIS Interface Legal Cases Retent. Policies ERP System Data Archiving Data Volume Management CMIS Repository ERP System

7. Client Managed Retentions – General Rules  A Retention period is defined by an expiration-date and an optional start-of-retention date  The expiration-date is either set to a concrete date or in the state not-set  If the expiration-date is set to a concrete date, deletion of the object shall be prohibited until the specified expiration date  If the expiration-date is in the state not set, the object shall not be deletable at all

8. Client Managed Retentions – Assignment Rules  A expiration date must not be replaced with expiration-date not-set  A retention policy with an expiration-date not-set can be replaced by a retention policy with a concrete expiration- date  A expiration-date must not lie in the past

9. Client Managed Retentions – Prolongation Rules  If an object has already a expiration date applied, the repository shall only accept new expiration-dates equal or greater than current one  Once a retention type is set, the type shall not be removable  A violation of a rule shall result in a constraint exception

10. Comparison Client Managed  Client manages retention and exposes expiration date to repository  Required in multi system scenarios where the retention rules are hosted outside the repository  Already a widely implemented pattern by many vendors Repository Managed  Simple interface to client app  App does not have to be aware of retention mgmt rules  Full power of retention mgmt in repository can be used  Common pattern for many integrations

11. Legal Holds  A Legal-Hold is used to protect an object from being deleted due to pending litigation or audits, regardless of any retention period  A Legal-Hold type has a multi-valued property to store identifiers for the corresponding litigation or audit

12. Type Hierarchy for secondary retention types cmis:secondaryType cmis:rm:repMgtRetention (Abstract) Repository Specific Retention Type 1 … Repository Specific Retention Type n cmis:rm:clientMgtRetention - cmis:rm:expirationDate - cmis:rm:startOfRetention cmis:rm:destructionRetention - cmis:rm:destructionDate cmis:rm:hold - cmis:holdId (multivalued)

13. Advantages of Secondary Types approach  CMIS domain model needs no change  Secondary Types are query-able  An application can inspect the type model to know what kind of retention types are supported  Retentions can be set in an atomic transaction

14. Relation to other standards  Legal Hold part of other standards (DoD, MoReq)  Moreq2010 has some overlaps:  Export import of records (via CMIS?)  Spec considers distribution of records in multiple repositories instead of one central system  Spec not finalized yet  Looking for some expert in this area