With electronically stored information duplicated and scattered across the enterprise, organizations benefit from creating a data map that identifies what information exists, where it is stored, and what policies govern it – particularly when facing litigation. Using automation tools to create the data map is the most effective way to keep it evergreen. Information Management Nov/Dec 2009 article

1. 5 Steps
to Compliance:
Building an Automated Data Map
With electronically stored information duplicated and scattered across the enterprise,
organizations benefit from creating a data map that identifies what information exists,
where it is stored, and what policies govern it – particularly when facing litigation. Using
automation tools to create the data map is the most effective way to keep it evergreen.
Bobby Balachandran
n a litigious business world awash enterprise data map. A data map can haven’t been any tools, applications, or
I in electronically stored information
(ESI), the need to access and ana-
lyze data in a usable format is clear.
quickly answer these questions: Where
is the data stored, and how can I access
it, if at all? Who controls this data?
solutions available to organizations
looking for a proactive approach for
tracking and analyzing their data
Unfortunately, many organizations’ What policies govern it? sources, custodians, IT personnel, or
choices have been limited to reactive, The enormous amount of ESI and change histories.
fire-drill style processes. Ad hoc re- paper-based documents stored in dis-
sponses to e-discovery often lead to im- parate locations, the prevalence of Defining a Data Map
partial or inaccurate production, an hard-to-track shadow data systems A data map is a comprehensive
inability to prove inaccessibility, inad- and individual data marts, the com- and defensible inventory of an organi-
vertent noncompliance, and skyrocket- plexity of records management policies zation’s IT systems; it is a repository
ing risks and costs. and regulations, data churn, and for data and information mapped to
With recent rulings on e-discovery human resources turnover make an- business units, data stewards, and cus-
procedure requiring organizations to swering these questions extremely dif- todians; and it is a critical component
have defensible knowledge of their data ficult, if not impossible, without the aid of a proactive litigation response plan
infrastructure, the logical starting of technology. and essential to a number of other im-
point for a litigation response plan is an Unfortunately, until recently, there portant business processes.
40 NOVEMBER/DECEMBER 2009 INFORMATIONMANAGEMENT

2. The benefits of a data map are mented, and often in a format that can- save everything, increasing stor-
many. A data map aids with: not be readily preserved or produced. age costs and barring timely data
n Risk mitigation and compliance Litigation, regulations, and personnel disposition
management changes add to the complexity. Organ-
n Collaboration between internal izations must be able to track changes Consultant Processes at Work
and external teams in ESI and IT systems, but these Big Four consulting firms are often
n Legal response to discovery re- changes exceed human capacity to called in to do the manual work of
quests and regulatory inquiries track it effectively. building and implementing enterprise
n U.S. Federal Rules of Civil Proce- Although the IT and records man- data maps, and they bring established
dure Rule 26(f) meet-and-confer agement departments each have methodologies to the project. Most con-
meeting preparation pieces of a data map, most organiza- duct extensive interviews with key
n Targeting hold recipients quickly tions have not developed proactive constituents, determine the best ap-
n Avoiding inconsistent or inaccu- policies around information gover- proach for the company, and then, to-
rate representations nance. Often, communication between gether with key constituents, drive the
n Mitigating spoliation risk IT and legal teams is so disjointed that majority of the data mapping process.
n Lightening infrastructure archi- critical information is deleted or legal At one consulting group, for exam-
tecture development burden ple, a team of consultants interviews a
n Interrupting document destruc- company’s key constituents – leaders
tion schedules for preservation in A data map is a from the IT, legal, and records and in-
a timely manner comprehensive and formation management (RIM) depart-
n Identifying redundant data ments, as well as executive – to
sources defensible inventory of an understand business drivers and risks,
n Addressing potential data anom- determine scope and appropriate level
alies and outliers organization’s IT systems; of granularity, and identify key busi-
it is a repository for data ness units.
Manual Processes to Address Next the team conducts workshops
Data Management and information mapped to define key ESI, business and process
Many organizations have devel- owners, and subject matter experts.
oped home-grown, ad hoc processes for to business units, data The bulk of data gathering is done
addressing data management. stewards, and custodians… through questionnaires and surveys,
Most legal departments will cre- and then it is analyzed and refined
ate a partial data map. When a trig- through follow-up interviews. The
ger event occurs, such as a letter teams unknowingly make unreason- team then determines tools and tech-
arriving that threatens legal action, able requests of the IT staff. nology that can be used to house and
organizations must locate relevant Ad hoc data maps and discovery so- maintain the ESI on an ongoing basis.
data, custodians, and data systems lutions face some serious challenges:
and implement a legal hold. Legal n Lack of documentation Automating the Enterprise
teams learn over time where the highly n Duplicative background work in Data Map
litigious data resides and can get a response to each request A usable data map must be agile
feel for who manages it and whom to n Cross-departmental redundan- enough to adapt to constantly changing
ask when they need to access it for cies data, litigation profiles, retention poli-
discovery. n Critical information stored as cies, HR information, and regulations.
Organizations often also have IT easily lost tribal knowledge Combining established processes and
inventories. For example, financial and n Risk of human error, incorrect or best practices with automated data
human resources systems are typically incomplete production, and mapping technology is the best way to
well-documented due to corporate and costly sanctions achieve this needed agility.
records retention policies. Others grow n Time-consuming data searches Today, dynamic data mapping
up due to the needs of the business and that lead to missed deadlines and software facilitates the data mapping
exist in sub-organizations or as project higher costs process through standardized, intelli-
resources and are largely documented n Heavy burden on IT as they may gent workflows to produce a compre-
through tribal knowledge. be tasked to find information hensive, evergreen data map. Built-in
The end result is ESI scattered they didn’t know they needed to checks and balances eliminate human
across the organization, undocu- save, or they may be asked to error and manage compliance, and an
NOVEMBER/DECEMBER 2009 INFORMATIONMANAGEMENT 41

3. automated refresh process delivers an plain the risks and benefits. n Designate a data comptroller for
up-to-date and accurate data map n Show how benefits of a data map the data map
ready for use. can be leveraged across the en-
An automated data map will: terprise. 2. Assemble: Identification and
n Streamline processes by build- Next, organizations must choose a Data Gathering
ing, analyzing, and refreshing dynamic data mapping process-control A thorough process is essential
the data map automatically solution. By providing a solid, central- to creating a comprehensive cata-
n Enforce compliance with data ized framework for a data map project, logue of data sources and custodi-
policies and processes an automated data mapping solution ans; it ensures no shadow or
n Facilitate efficient legal pro- cuts down on the time and money paper-based data systems are
cesses, from risk assessment and spent on this difficult initial phase and missed. Distribute questionnaires
litigation profile building to legal each of the following steps by: and surveys, conduct workshops and
hold creation and discovery n Institutionalizing roles interviews, and follow up with sec-
n Reduce downstream staffing n Providing timeline and task ondary interviews.
needs alerts Through automation, the num-
n Reduce risks like data loss and ber of staff hours needed to gather
spoliation this information decreases, accuracy
n Facilitate data disposition
A thorough process is increases, and costs are reduced. Au-
n Provide a solid foundation for essential to creating a tomation:
litigation preparation, legal risk n Provides automated informa-
assessment, and discovery re- comprehensive catalogue tion request notifications and
sponse reminders
Today, consulting companies and of data sources and n Automates interview, question-
leading experts recommend the follow- custodians; it ensures naire and survey templating,
ing five steps to create and manage a management, and self-submis-
data map: no shadow or paper- sion
1. Define n Tracks and manages responses
2. Assemble based data systems to questionnaires, surveys, and
3. Analyze are missed. interviews, and it monitors
4. Automate compliance with data mapping
5. Refresh requests
n Planning and budgeting tools n Integrates with HR and IT sys-
1. Define: Preparation and Design n Enabling project managers to tems to find up-to-date lists of
In order to begin a data mapping monitor and enforce compliance custodians, servers, etc.
project, it’s important to ensure three with roles and duties n Builds compliance into daily
things: n Providing a centralized location workflows
n Buy-in from executives and em- for custodian and data source n Allows custodians and data
ployees information stewards to self-upload infor-
n Access to an automated system of Next, companies must create a mation through a compliance
alerts to enforce and monitor project team comprising key stake- portal
compliance holders from departments most af- n Allows managers and data
n Time and resources needed for a fected by a data map – IT, legal, and comptrollers to track and man-
comprehensive project RIM. Hold one or more initial meet- age compliance easily
The importance of buy-in can’t be ings to: n Auto-populates the data map
overstated. In a recent panel presenta- n Determine project objectives, de- Often, ESI is stored centrally in a
tion, Cheryl Strom, senior manager of fine scope, identify key and data warehouse. However, many peo-
records information management at high-risk business units, and ple will keep their own copies and set
McDonald’s Inc., provided the following determine the appropriate level up shadow systems or data marts on
guidelines for securing buy-in from of granularity desktops, removable storage devices, or
upper management: n Assign roles and responsibilities, in hard copy format.
n Identify cost savings in hard determine clear timelines and An automated data map can ac-
numbers. deliverables, and create a de- count for private copies that are out-
n Bring in an outside expert to ex- tailed project plan and budget side the normal parameters of a
42 NOVEMBER/DECEMBER 2009 INFORMATIONMANAGEMENT

4. Wait, there’s more …
arma.org
The home page for records & information management
If you’re involved in managing your organization’s information and haven’t visited arma.org lately, look what you’ve missed!
WWW. . .
Go to arma.org for
• Standards & best practices
• Articles & white papers
• Regulatory updates
• Professional competencies
[Articles] [Video] • Web seminar archives
At Your Technology Spotlight • Podcasts & blogs
Fingertips Top industry movers and • RIM marketing tools
From auto classifi- shakers discuss the latest • News & more news
cation to Zubulake, information management
technology trends. The
PODCAST • Risk assessment tools
you can find
articles, books, and panel includes representa- [Podcasts] • Books & videos on RIM
other resources unavailable tives from CA, IBM, Iron Hear and There • Event calendar
anywhere else in the ARMA Mountain, and Oracle; From the Expo floor, hear • Buyer’s Guide
International Bookstore. The moderated by IDC Senior interviews with decision
Bookstore includes all past Research Analyst Vivian Tero. makers, visionaries, and
feature articles fromThe leaders of information Learn more about
Information Management management policy. Visit
www.arma.org/podcast • Electronic records management
Journal and Information
Management magazine. • RIM fundamentals
• Regulatory issues
• E-discovery
• Standards & best practices
IDC’s Vivian Tero
• Information security
• Global RIM issues
• Information technology
[Buyer’s Guide]
Online!
[White Papers] Search vendors and
A Broader Perspective companies that provide products
Download free white papers from and services to the RIM industry alphabetically,
some of the leading industry experts by company, by product category, or by keyword.
on topics such as electronic records Your search will return a list of companies that
management, compliance, e-discovery, match your criteria. Select from that list to find
enterprise content management, and more information about that company.
general records management. www.arma.org

5. manual data mapping system. The – and, in fact, this step must be con- In the past, maintaining a data
best source of information for shadow ducted in concert with all the other map was a painful, protracted
data systems are individual employ- steps. Until recently, options for tools process that required a massive,
ees, and it’s important to ask them and technology have been limited to quarterly, manual effort. Often,
pointed questions, such as: Word documents, spreadsheets, MS many companies left their data
n Where do you store data other Access databases, custom or home- maps to flounder rather than incur
than central, non-custodial data grown systems, or existing IT config- the costs in time and effort of keep-
sources? uration management and tracking ing it up to date.
n Do you have a filing cabinet or systems. To keep the data map updated
paper-based storage system? However, these tools are ineffec- with an automated data mapping so-
n Do you use spreadsheets? Access tive and do not offer an effective lution in place, all stakeholders must
databases? means of maintaining information do is monitor compliance with pro-
This enables two-part automation: from the data mapping process. It’s cesses set forth at the outset of the
1) When it’s time to refresh, shadow important to take into account pre-ex- data mapping project. A good solu-
data sources are automatically ac- isting IT configuration management tion will provide alerts and notifica-
counted for; and 2) shadow data sys- tions that make it easy for managers
tems are searchable and can be to monitor and manage compliance.
exported to Excel or other reports, With the right mix of Business events, such as the ad-
therefore ensuring no data will be dition of a new data source or system
missed during discovery or regulatory
established methodology, or HR changes, trigger intelligent
inquiries. tools and technology, workflows. The automated data map-
ping system can automatically send
3. Analyze: Compile, Analyze, the resulting data map questionnaires and interview re-
Synthesize Information quests to employees, IT personnel,
It’s not enough to gather the in-
should be self-sustaining, and other key data stewards, or it can
formation; it must be organized in requiring little manual search and crawl a company’s data
such a way as to maximize useful- sources periodically in order to ensure
ness to key stakeholders. Automated intervention to remain an an up-to-date data map free from
solutions enable users to filter infor- costly inaccuracies. Additionally, su-
mation by risk level and litigation
up-to-date, relevant tool… pervisors may log into the centralized
profile, retention and governance system at any time to see and take ac-
policies, department or business and tracking systems, which can tion on detailed progress reports.
unit, custodian or data steward, and serve as a frame of reference during
discovery or hold history. A good au- the initial launch of a data map. How- Result: An Evergreen
tomated data map solution should ever, these tools paint an incomplete Data Map
provide: picture of a company’s data universe. With the right mix of established
n Intelligent data sculpting What leading consultants recommend methodology, tools and technology,
n Navigation dashboard is a compliance process-control solu- the resulting data map should be
n Reports and analysis that can be tion designed specifically to manage self-sustaining, requiring little man-
exported to Excel, etc. data mapping projects. ual intervention to remain an up-to-
n At-a-glance views of overall data date, relevant tool for data analysis,
map structure, as well as the 5. Refresh: Maintenance and litigation preparation and discovery,
ability to drill down into business Governance risk and compliance management,
units, litigation profiles, and in- The data map is a living docu- and IT processes. An automated
dividual employee histories ment that must be consistently data mapping solution is the only
n A way to indicate legal holds on maintained to ensure accuracy, and way to achieve an evergreen data
data systems, data stewards, the best, least painful way to ensure map that provides the collaboration
and individual custodians maintenance is through automation. and visibility required by all the in-
An outdated data map represents a volved parties.
4. Automate: Tools and substantial legal risk that directly
Technology affects counsel’s ability to provide Bobby Balachandran can be contacted
Tools and technology are utilized timely and accurate information re- at bbobby@exterro.com. See his bio on
throughout the data mapping process quired for judicial proceedings. page 47.
44 NOVEMBER/DECEMBER 2009 INFORMATIONMANAGEMENT