For this discussion you are to explain the roles and responsibilities of those involved in IG policy development.
For this discussion you are to explain the roles and responsibilities of those involved in IG policy development.
Select one of the individuals from the following list and discuss what role they play in IG policy development:
IT Security Analyst
IT Security Engineer
IT Audit
IT Risk
Compliance
CISO- Chief Information Security Officer
CIO- Chief Information Officer
CTO – Chief Technology Officer
CEO- Chief Executive Officer
CFO- Chief Financial Officer
CPO- Chief Privacy Officer
Legal
Governmental Affairs
Next, take the role and select a law, standard, or regulation to apply their role. Lastly, find a company that either uses the standard or is subject to the law or regulation.
Chapter 6
Information Governance policy development
Dr. Sandra J. Reeves
ITS 833 – INFORMATION GOVERNANCE Chapter 6 Information Governance Policy Development Dr. Sandra J. Reeves
Copyright@Sandra J. Reeves 2018
1
1
CHAPTER GOALS AND OBJECTIVES
Know the 8 Generally Accepted Recordkeeping Principles®
What is the IG Reference Model?
What does the IGRM Diagram consist of?
What are the best practice considerations?
What is the benefits and risks of having standards?
What are the key standards relevant to IG
Copyright@Sandra J. Reeves 2018
2
2
A Review of the 8 Generally Accepted Recording Keeping Principles®
Accountability
Transparency
Integrity
Protection
Compliance
Availability
Retention
Disposition
So…what is the significance of these principles?
Copyright@Sandra J. Reeves 2018
3
3
Copyright@Sandra J. Reeves 2018
4
IG REFERENCE MODEL
Who?
ARMA International & CGOC
When?
2012
Where?
As part of the EDRM Project Verson 3.0
Why?
To foster the adoption by facilitating communication and collaboration between IG stakeholder functions, legal, records management, risk management, and business unit stakeholders.
4
HOW TO INTERPRET THE IGRM DIAGRAM
Outter Ring: Complex set of interoperable processes and implementing he procedures and structural element to put them into practice
Requirements:
Understanding of business imperatives
Knowledge of appropriate tools and infrastructure
Sensitivity to legal and regulatory obligations
Copyright@Sandra J. Reeves 2018
5
5
HOW TO INTERPRET THE IGRM DIAGRAM…continued
Inner Ring: Depicts a work-flow (life-cycle) diagram. Shows that information management is important at all stages of the lifecycle.
Copyright@Sandra J. Reeves 2018
6
6
So….How is the IGRM Diagram related to the Generally Accepted Recordkeeping Principles®?
Support the ARMA Principle by identifying the cross-functional groups of IG stakeholders
Depicts the intersecting objectives of the organization
Depicts the relationship duty, value and information assets
Used by proactive organizations as an introspective lens to facilitate visualization, understanding and discussion concerning how to apple the “Principles” to the organization.
Puts focus on the “Principles”
Provides essential context for the maturity model
Copyright@Sandra J. Reeves 2018
7
7
Considerations in IG Policy Formation?
Best Practices?
YES!
Understand that Best Practices will vary per organization
Review 25 generic Best Practices, Pages 75 and 76 of text book
Copyright@Sandra J. Reeves 2018
8
Standards?
YES!
Two types to consider
De Jure Standards-Legal standards published by standards setting bodies such as IOS, ANSI, NIST, BTS and others
De Facto Standards – Informal standards regarded by many as actual standards – arising through popular use (Example: Windows in the business world in 2001-2010). May be published by formal standards setting bodies without having “Formal” status
8
Benefits and Risks of Standards
Benefits
Quality Assurance Support
Interoperability Support
Implementation Framework and Certification Checklists
Cost Reduction
International Consensus
Copyright@Sandra J. Reeves 2018
9
Risks
Possible Decreased Flexibility
Standards Confusion
Real-World Shortcomings to due Theoretical Basis
Cost and Maintenance Involving in Updating Standard
9
KEY STANDARDS RELEVANT TO IG
Risk Management
ISO 31000-2009 – States principles and generic guidelines of risk management applicable to IG
Provides a structured framework for development and implementation of risk management strategies and programs
“Risk Management Framework”: Set of two basic components (foundations and organizational arrangements) that support and sustain risk management throughout the organization.
Copyright@Sandra J. Reeves 2018
10
10
KEY STANDARDS RELEVANT TO IG…continued
Information Security Management
ISO/IEC 27001:2005- Information Security Management System Standard that provides guidance in development of security controls for protection of information assets
Flexible –can be applied to different activities and processes
Includes use of standards by auditors and stakeholders
ISO/IEC 27002:2005-Information Technology-Security Techniques-Code of Practice for Information Security
Establishes guidelines and general principle for initiating, implementing, maintaining and improving information security mgt.
Includes Best Practices of Control Objectives in 11 key areas of information security management
ISO/IE 38500:2008 –International Standard for high-level principle and guidance for senior executives and directors, and advisors for effective and efficient use of IT
Three major sections
Scope, Application and Objectives
Framework for Good Corporate Governance of IT
Guidance for Corporate Governance of IT
Copyright@Sandra J. Reeves 2018
11
11
KEY STANDARDS RELEVANT TO IG…continued
RECORDS AND E-RECORDS MANAGEMENT
ISO 15489-1:2001 and ISO 15489-2:2001– International Standard for Records Management
Part 1:Provides a framework and high-level overview of RM core principles
Part 1:Defines RM as “Field of management responsibility for the efficient and systematic control of creation receipt, maintenance, use and disposition of records, including processes for capturing and maintaining evidence of and information about business activities and transactions in the form of records”1
Part 2: Technical Specifications and Methodology for implementing standard
ISO 30300;2011 – Information and Documentation-Management Systems for Records-Fundamentals and Vocabulary
ISO 30301:2011 – Information and Documentation-Management Systems for Records – Requirments
1ISO 15489-1:2001 Information and Documentation-Records Management, Part 1:General Geneva: ISO, 2001), section 3.16.
Copyright@Sandra J. Reeves 2018
12
12
NATIONAL, INTERNATIONAL AND REGIONAL ERM STANDARDS
United States E-Records Standard
U.S. DOD 5015.2 Design Criteria Standard For Electronic Records Management Software Applications
Developed in 1997
Updated in 2002 and 2007
Canadian Standards
Electronic Records as Documentary Evidence CAN/CGSB-72.34-2005
Microfilm and Electronic Images as Documentary Evidence CAN/DGSB-72.11-93
Canadian Legal Considerations
Relies on prime directive-that an organization shall always be prepared to produce its records as evidence- and its national standards, for the admissibility of electronic records in court proceedings
The admissibility of records as evidence is determined under the business records provisions of the Evidence Act
Copyright@Sandra J. Reeves 2018
13
13
NATIONAL, INTERNATIONAL AND REGIONAL ERM STANDARDS…CONTINUED
United Kingdom
The National Archives
To sets of functions requirements to promote the development of the electronic records management software market (one in 1999 and one in 2002)
Model Requirements of Electronic Records
MoReq2
MoReq2010
Copyright@Sandra J. Reeves 2018
14
Australian ERM and Records Management Standards
Has consistently been world leader in this area
Adopted all three parts of ISO 16175 as its e-records standard
Australian Government Recordkeeping Metadata Standard Version 2.0
Australian Government Locator Service
AS 5090:2003 – Work Process Analysis for Recordkeeping
14
LONG-TERM DIGITAL PRESERVATION
Referred to as “LTDP”
LTDP is a key area for IG policy development
Frequently not addressed in an IG plan
Should be applied in preserving historical and “vital records” and in order to maintain its corporate or organizational memory
Key Standards for LTDP:
PDF/A-2 –official standard format for preserving electronic documents, developed by Adobe.
ISO 19005-1:2005 Document Management is the published specification requiring PDF format
ISO 14721:2012 – Space Data and Information Transfer Systems –Open Archival Information Systems
ISO TR 18492(2005) – Long Term Preservation of Electronic Document Based Information
ISO 16363:2012 – Space Data and Information Transfer Systems-Audit and Certification of Trustworthy Digital Repositories
Copyright@Sandra J. Reeves 2018
15
15
BUSINESS CONTINUITY MANAGEMENT
ISO 22301:2012 – Societal Security – Business Continuity Management Systems Requirements
Specifies requirements for creating and implementing a standardized approach to business continuity management —–this is also known as Disaster Recovery
Benefits of ISO 22301
Threat Identification and Assessment
Threat and Recovery Planning
Mission-critical process protection
Stakeholder Confidence
Copyright@Sandra J. Reeves 2018
16
16
THINGS TO REMEMBER IN DEVELOPING THE IG POLICY
Take into account organizational goals
Draw clear lines of authority
Make sure you have an executive sponsor who can garner executive support for the IG program and policies
IG program must contain communications and training component
Stakeholders must be made aware of new policies and practices
Make sure you have metrics that are relevant and useful and can actually be measured
Test and audit
Give feedback to employees based upon metrics, tests and audit results
Establish and enforce clear penalties for policy violations and communicate that to employees
Take into account organizational culture
Copyright@Sandra J. Reeves 2018
17
17
The End
Copyright@Sandra J. Reeves 2018
18
18