1. Governance in the Cloud: Where on earth do you start  Blake E. Richardson, CIP, CRM  Manager of Records  Safeway Inc.  twitter@titansfan100

2. #AIIM13 Agenda  First things first  Motivators  Data identification  Group effort  Information governance  Bringing stakeholders together  Considerations  The checklist  Internal  External  Cloud Contracts  Q & A

3. #AIIM13 First Things First  If you don’t know your objective, then how can you determine if you’ve achieved it?  Why the cloud?  IT infrastructure  IT support  Cost  Intended use  IaaS (infrastructure as a service)  PaaS (platform as a service)  SaaS (software as a service)  A combination of the above

4. #AIIM13 First Things First  Data identification  Static  Dynamic  Privacy and regulatory concerns

5. #AIIM13 Group Effort  Cloud planning should be a group effort.  Information Governance (IG) Committee  Stakeholders  Business owners  Compliance  Information Security  IT  Legal  Records Management  Risk Management

6. #AIIM13 Cloud Considerations  Privacy  Security  Availability  Compliance  Legal

7. #AIIM13 Cloud Checklists  Internal  Used to determine if an organization’s current IT infrastructure or a cloud solution best accommodates the matter under consideration.  Internal checklist topics  Premise and cloud-base options  Short or long-term solution  Speed to market  Integration requirements  Information security  Architecture

8. #AIIM13 Cloud Checklists  External  Once the organization decides to pursue a cloud- based solution, the external checklist is used to evaluate a vendor’s cloud environment.

9. #AIIM13 Cloud Checklists  External checklist topics  Data location  Security  Availability  Retention  Ownership  Extraction  Sub-contractors  Employee background checks  Incident response  eDiscovery requests

10. #AIIM13 Cloud Contract Components  Availability  Uptime/Downtime percentage  Schedule downtime  Data processing and storage  Ownership of data  Data breaches  Disposition of data  Legal/Regulatory requests to access data  Location of data

11. #AIIM13  Infrastructure and security  Service Level Agreement (SLA) remedies  Audits/Certifications/Inspections  Disaster recovery/Business continuity  Mergers and acquisitions  Subcontractors