Mark Mandel, CRM, CIP, ERM m, BPM m, CDIA+ Records Management Solution Architect OpenText Public Sector Solutions BEST PRACTICE STRATEGIES NARA/OMB MANAGING GOVERNMENT RECORDS MANAGEMENT DIRECTIVE

M Deadlines NARA/OMB M-12-18, the Managing Government Records Directive, has the following key deadlines for federal agencies: 2016 – all must be managed electronically in a records management system – no more "print and file" 2019 – all permanent records must be delivered to NARA in electronic format only 2

NARA Automation Plan The NARA Automation Plan states, “Although the Directive uses the term “records management” and this report inherits that language, NARA recognizes that well-conceived automation can improve the management of all government information for a wide range of information governance purposes. These include information security, privacy, eDiscovery, Freedom of Information Act (FOIA), and proactive disclosure of government information as part of open government and open data programs. While records management is stressed here because of this report’s origin in the Directive, the greatest efficiencies and improvements in effectiveness will be achieved if agencies consider the automation of their information management in a holistic way.” 3

The Solution: Agency ECM Strategic Plan Implement an Agency-Wide Enterprise Content and Records Management System Manage All Records Policy with One Integrated Electronic Records Management System Single Unified Enterprise Repository Disaster Recovery Infrastructure Cloud or Virtual Services Integration with Business Applications, , Office Applications Apply Governance to All Records – Content Lifecycle Management 4

NARA/OMB Managing Government Records Directive “The current federal records management system is based on an outdated approach involving paper and filing cabinets. Today’s action will move the process into the digital age so the American public can have access to clear and accurate information about the decisions and actions of the Federal Government.” President Obama Benefits: Reduction in Cost Related to Storing and Filing Paper Reduction in Cycle Times and Cost for Transactions Increased Access to Information Complete Audit Trail of Transactions Compliance with FOIA, Privacy Act and eDiscovery Unified Repository Reduces Information Silos Supports PortfolioStat Model 5

Concept of Operations – Best Practices Records Management is Transparent to the End User ECM – with embedded RM - is Integrated with Existing Applications and User Interface Best Suited to the End User SharePoint ECM ERP BPM Business Application Journaling with Auto Classification Treated as Another Document Type Document Management with Versioning 6

SharePoint ERP Enterprise Storage and Cloud Services Disaster Recovery Infrastructure Mobile Fax/Copy 7 Record Centers FOIA / Privacy Act E-Discovery Federated Search Auto Classification Social BPM

IRS Under Scrutiny 8

VA Cancels Cloud Contract "The OIG wanted new contract language inserted into all VA cloud contracts designed to facilitate access and visibility into the system, preserve s and increase the security rating under the Federal Information Security Management Act. There was pending guidance from NARA on records retention that would affect the disposition of storage. It was determined that the necessary changes were out of scope with the … contract, and it was terminated." 9

There Are Many Approaches to Managing Different approaches serve the needs of different stakeholders in different ways It is important to understand the different approaches and their strengths vs. weaknesses A short-sighted approach that does not meet the needs of all stakeholders will likely need to replaced later on 10

Requirements Competing Priorities; Multiple Stakeholders RequirementStakeholder Optimize production systemIT Consolidate multiple systemsIT Lower operational and storage costsIT Provide oversight for complianceLegal FOIALegal eDiscoveryLegal stored with business records as part of the audit trail of transactions Business, Audit, RM CapstoneRM, Legal, Archivists 11

in the Cloud Three levels of maturity Level 1 – in the Cloud, no Records Management RequirementStakeholderMeets Requirement Optimize production systemITYes Consolidate multiple systemsITYes Lower operational and storage costsITYes Provide oversight for complianceLegalNo FOIALegalNo eDiscoveryLegalNo stored with business records as part of the audit trail of transactions Business, Audit, RMNo CapstoneRM, Legal, ArchivistsNo 12

in the Cloud Three levels of maturity Level 2 – in the Cloud, with Archive and Records Management, but not integrated with ECM RequirementStakeholderMeets Requirement Optimize production systemITYes Consolidate multiple systemsITYes Lower operational and storage costsITYes Provide oversight for complianceLegalYes FOIALegalYes eDiscoveryLegalYes stored with business records as part of the audit trail of transactions Business, Audit, RMNo CapstoneRM, Legal, ArchivistsYes 13

in the Cloud Three levels of maturity Level 3 – in the Cloud, with integrated ECM RequirementStakeholderMeets Requirement Optimize production systemITYes Consolidate multiple systemsITYes Lower operational and storage costsITYes Provide oversight for complianceLegalYes FOIALegalYes eDiscoveryLegalYes stored with business records as part of the audit trail of transactions Business, Audit, RMYes CapstoneRM, Legal, ArchivistsYes 14

Role Based Classification Business Records Auto Classification Big Bucket Temporary Records And Transitory Level 3 Pyramid Enterprise Connect Process Automation ECM Repository "Capstone" Auto Classification Transitory Records Permanent

Key Issues to Address in Your and ECM Solution Classification strategies to minimize user involvement in declaring records Managing growth of content to reduce storage costs DoD STD 16

When adding a document to a folder that has classification inheritance enabled, all items in that folder inherit the same classification. Add Document 17 Folder Classification Inheritance

Process Driven Classification Documents can be classified as part of a business process 18

Role-based Classification Documents can be classified according to the group to which the user belongs 19

Auto-Classification Automatically classify high volume, low-touch records such as and file system content. Step-by-step tuning guide and feedback Transparent Defensible Built-in statistical sampling and quality assurance 20

STD Demystified Baseline Chapter 2, Mandatory Requirements Chapter 5, Transfers Chapter 6, Non-Mandatory Features Classified - Chapter 3 is Management of Classified Records FOIA/PA - Chapter 4 is Managing Records for the Privacy Act and the Freedom of Information Act The Joint Interoperability Test Command (JITC) provides a list of certified products. DoD organizations may only purchase records management products that are on this list 21

STD This should be a requirement in your enterprise architecture. Why? It sets metadata standards for all records It defines the best methodology for destruction of electronic records at the end of their lifecycle It provides a standard approach for transfer of records from one agency to another, and for transfer from an agency to NARA It defines requirements for classified records It defines requirements for FOIA and Privacy Act solutions This approach promotes consistency across all agencies and NARA 22

JITC RMA Register List of Certified Products under STD 23

My agency is being tasked with moving to digital recordkeeping, but it is an unfunded mandate. There is no budget for Records Management modernization. Where do I find the money? Even in these tough economic times, agencies are spending money in their IT budget Their top priorities include Records Management, but they don't call it that The key is to align your plans with your agency top IT priorities 24

What are the Priorities for Federal Agency IT Spending? Key Requirements and Market Drivers U.S. Federal Government Cloud First Storage Costs Cyber Security Compliance (eDiscovery, FOIA, HIPAA, ) Audit Readiness Managing Government Records Directive A foundational element for meeting agency IT priorities 25

Cloud First – Shared Services Strategy Data Center Consolidation Cloud First Steven Van Roekel, U.S. Chief Information Officer, Office of Management and Budget "With information technology at the core of nearly everything the Federal Government does, we must use IT as a strategic asset and drive cost savings to pay for new and emerging technologies that can fundamentally improve the way government does business and delivers services to the American people… We recently issued new guidance to help agencies manage their investment in IT and drive low-value spending into more innovative efforts. The initiative—known as PortfolioStat—focuses on improving agency portfolio management to better deliver what we purchase and build." 26

Only 4% of Web content is available via search engines like Google The Public Web Source: The Deep Web: Semantic Search Takes Innovation to New Depths The Deep Web ~96% of information is inside the firewall 80% of data is unstructured Information is trapped in application silos Content is doubling every 90 days Storage Costs 27

Federal Agencies Hacked Red October Anonymous WikiLeaks AntiSec Cyber Security 28

Governance, Compliance and Risk SEC 17a-4 HIPAA Canadian Electronic Evidence Act DoD Basel II Capital Accord Electronic Ledger Storage Law 11 MEDIS-DC VERS AIPA GDPdU & GoBS & DOMEA NF Z BSI PD5000 Financial Services Authority MoReq 2010 ISO/PRFTR15081 Sarbanes-Oxley Act Federal Rules of Civil Procedure FDA 21 CFR Part 11 ATIP FOIA/Privacy Act Compliance 29

DOD Financial Improvement and Audit Readiness (FIAR) FIAR Plan priorities were established in August 2009 and require the Components to first focus on improving processes, controls, and systems supporting information most often used to manage the Department. This is the starting point for achieving the goal of obtaining auditable financial statements. To achieve these objectives, the FIAR priorities are: Budgetary information Mission critical asset information The program objective is full audit readiness by Audit Readiness 30

Cost Savings Examples In 2010, Federal agencies spent nearly a half billion taxpayer dollars on processing FOIA requests. Source: FOIA.gov. PortfolioStat could save or help the government avoid spending $2.5 billion over the next three years. In the first year alone, agencies saved or avoided spending $300 million. Cobell v. Salazar is a class-action lawsuit brought by Native American representatives against two departments of the United States government. The case was settled for $3.4 billion in 2009, with $1.4 billion going to the plaintiffs and $2 billion allocated to repurchase land and return it to communal tribal ownership. The Government Accountability Office said in January 2013 that it could not complete an audit of the federal government, pointing to serious problems with the Department of Defense. 31

BPM Example - Current Process Costs 32

Future Process Costs Savings of $38, per transaction 33

A Proposed Blueprint Basis For an Agency 5 Year Strategic Plan 1. Perform a Complete Records Inventory Paper, Film, Digital Content Sources, Storage Locations, Systems of Record Develop volume counts, document all issues 2. Constitute a Steering Committee Include top officials, including CFO, Legal, IT, Records Officers, FOIA, Business Units Sign Off on Records Schedule, Strategic Plan, Funding Meet Quarterly 3. Update your Records Retention Schedule Big Bucket, No More than 20 Record Series, 10 or less is optimal 34

A Proposed Blueprint Basis For an Agency 5 Year Strategic Plan 4. Create Collaboration Site for All Things Records Post events, policies, schedules, links to content, online courses, FAQs, Progress Against Strategic Plan Records Officer User Group to Meet Quarterly – include related roles such as FOIA, Privacy, Security, Legal Ongoing Training on Policies, Procedures, and Technology 5. Conduct Agency Wide Taxonomy Study Develop Standardized Search and Index Criteria 6. Move File Shares to Document Management System, Place Under Version Control – Eliminate PST Files 35

A Proposed Blueprint Basis For an Agency 5 Year Strategic Plan 7. Document Your ECM/RM Enterprise Architecture Enterprise Content/Records Repository, DoD STD Enterprise Storage Architecture Content Capture and Ingestion E-Fax, E-Signature, E-Filing Records Policy – Content Lifecycle Management E-Discovery, FOIA, Full Text and Enterprise Search Classification, Archive IM, Social Media, Mobile Disaster Recovery Infrastructure Integrate with Existing Applications (ERP, HR, Case Management) Integrate the ECM/RM EA with the Agency EA 36

A Proposed Blueprint Basis For an Agency 5 Year Strategic Plan 8. Digitize Paper Records Scan Paper That is Frequently Accessed Scan on Demand Digital Copiers Central Scan Centers Outsource 37

A Proposed Blueprint Basis For an Agency 5 Year Strategic Plan 9. Implement Agency Wide Document/Records Management System 9.Establish Central Repository 10.Basic Feature Set 11.Establish RM Policy 10. Integrate with Existing Systems ERP Case Management Migrate Data From Other ECM Systems 38

A Proposed Blueprint Basis For an Agency 5 Year Strategic Plan 11. Add Advanced Features Workflow/BPM E-Discovery Auto Classification 12. Ensure Funding for Ongoing Operations, Backfile Scanning 13. Move Paper Based Processes to Constituent Self Service Using Electronic Forms 39

Strategic Plan Timeline 40

Key Take-Aways Get started with your ROUG and Steering Committee Involve the SAO Start your inventory if you have not already Start your taxonomy study if you not have already Modernize your records schedule Get funding by aligning your ECM solution requirements with agency IT priorities – don't call it Records Management!  PortfolioStat  Management  Cloud First  Security  Audit  Lower Operations Cost Make your enterprise architecture drive deployment decisions 41

MARK MANDEL