Five Initial Steps to Meet the Governance, Risk and Compliance Obligations Brought on by Today's Big Data File Stores

The accelerating increase in the amount of unstructured Electronically Stored Information (ESI) is leaving IT organizations struggling with how to store and manage all of this new information. Aside from just providing the underlying storage infrastructure to host this amount of data, companies are also faced with the task of properly managing their Big Data file stores to meet existing governance, risk and compliance obligations. To do so, there are five steps they can take now to position their organization to meet them.

Labels: Big Data, Compliance, eDiscovery, FISMA, FRCP, Governance, GRC, HIPPA, Information Governance, Legal, Litigation, Risk, Sarbanes-Oxley

posted by Charles Skamser @ 10:50 AM 0 Comments

Cloud Computing is Maturing

With the dog days of summer 2011 upon us and the US debt ceiling negotiations in Washington DC seeming to be going nowhere, it is refreshing to be able to report that cloud computing is having a really great 2011 so far:

- The big IT providers are making progress building up their Infrastructure-as-a-Service (IaaS) offerings.

- Our favorite players such as Apple and Microsoft are beginning to make their moves with offerings such as iCloud and Azure.

- The whole concept of multi-tenancy and virtualization is beginning to become part of the mainstream discussion (i.e. 18 months ago only us techies even knew what those terms meant).

- Although there were some security bumps early this year with Amazon and Sony, the market seems to be getting comfortable with the notion of a public cloud.

- The Software-as-a-Service (SaaS) providers are beginning to close some big deals and therefore the previously radical idea of running a global 2000 enterprise in the cloud is no longer a “wild” idea.

- Global 2000 CFOs are ecstatic with the new economic realities of  cloud computing.

- Global 2000 CEOs are beginning to understand the strategic business benefits of cloud computing.

- The idea of Information Governance and eDiscovery in the cloud is beginning to take shape as some of the big IT providers are realizing that these components need to be a standard part of any IaaS/PaaS offering.

- Consolidation is enabling the market to begin to cull itself down to a more manageable number of players with the financial legs to provide the stability that the market is demanding.

So, the cloud computing market is maturing pretty much on schedule.  As such, the next five (5) years should be very exciting.  And,  as is the case with any new markets, there will be some big bumps along the way and maybe even some really unexpected turns.  However, under any circumstances, it will be fun to be able participate and watch.

In a blog posting by James Staten on the Forrester website on July 12, 2011 titled, “The Cloud Computing Market Grows Up”, Mr. Staten does an excellent  job listing the industry highlights and indicating that cloud computing is indeed growing up very nicely.

The full text of Mr. Staten’s Blog Posting is as follows:

Mark this date. While it isn't an anniversary of anything significant in the past, it is a day where our beloved cloud computing market showed significant signs of maturing. Major announcements by VMware, Citrix, and Microsoft all signaled significant progress in making cloud platforms (infrastructure-as-a-service [IaaS] and platform-as-a-service [PaaS]) more enterprise ready and consumable by I&O professionals.

* VMware updates its cloud stack. The server virtualization leader announced version 5 of its venerable hypervisor and version 1.5 of vCloud Director, its IaaS platform atop vSphere. Key enhancements to vCloud include more hardening of its security and resource allocation policy capabilities that address secure multitenancy concerns and elimination of the "noisy neighbor" problem, respectively. It also doubled the total capacity of VMs service providers can put in a single cloud to 20,000. VMware also resurrected a key feature from its now defunct Lab Manager — linked clones. This key capability for driving operational efficiency lets you deploy new VMs from the image library and the system will maintain the relationship between the golden image and the deployed VM. This does two things; it minimizes the storage footprint of the VM, much as similar technology does in virtual desktops, and second it uses the link to ensure clones maintain the patch level and integrity of the golden master. This alone is reason enough to consider vCloud Director.

To help both virtualization and cloud environments, VMware also made a significant change to its licensing model, moving away from CPU core entitlements (VMware will still count processor sockets, though) to pooled vRAM entitlements. This change ties licensing more to the use of the product and encourages greater VM consolidation as it counts VMs by size, rather than per physical server. This incents packing lots of VMs on a single system and even lets you share vRAM entitlements across physical systems to accommodate more seamless growth of your environment and management of the pool, a key operational change called out in our Virtualization Maturity Model. Basically, now you can entitle your virtual environment in total, based on its capacity, and fill it up as much as you want. This is much more consistent with their service provider pricing model; and if your goal is to build a private cloud, isn't that the point?

All in all, this shows that VMware gets it and is taking an active role in helping educate its customers that virtualization and cloud operations are two different things and making these distinctions clear is critical to their and your success. Well done, VMware.

* Citrix's acquisition of its OpenStack doppelganger, Cloud.com comes just months after Citrix announced its intention to commercialize an OpenStack solution for enterprises and service providers. Now they can stop that work. Cloud.com has successfully penetrated the service provider market with its OpenStack-based solution and racked up some solid wins in the enterprise to boot. This buy accelerates Citrix' IaaS efforts and gives solid financial backing to CloudStack. Sadly, though, it also reduces the number of commercial distributions of OpenStack by one.

Enterprise I&O pros should note that CloudStack is hypervisor agnostic, so this isn't a Xen-only play. And the synergies between CloudStack and the rest of its application and desktop virtualization portfolio aren't lost on the company or its service provider partners and prospects. Look to see more combined solutions that help you vend apps and desktops from a cloud in the future.

* Microsoft, here at its Worldwide Partner Conference in Los Angeles, stepped up its cloud game as well by showing the beta of System Center 2012, which adds a self-service portal for using Hyper-V as a private cloud platform and better orchestration for workload deployment. It also demonstrated new public cloud services from Boeing and General Mills plus a commissioned report by Forrester attesting to the differentiated economics of cloud platforms, something I talk about with CIOs in a report published this past spring.

For ISVs, Microsoft also announced commercial opportunities on Windows Azure for its massive software partner ecosystem. The Azure Marketplace can now vend commercial applications, meaning that any software application built for Windows (using the VMrole) or through Visual Studio (using the worker role) theoretically can be offered through Windows Azure as well.

Together, these announcements are strong milestones to the continuing progress and solid traction cloud platforms are having with the market. While the private cloud market is still very, very young, moves like these put it on more solid footing and should lead to expanded options for I&O professionals.

Labels: CEO, CFO, Cloud Computing, Compliance, eDiscovery, ESI, Forrester, Fujitsu, IBM, Information Governance

posted by Charles Skamser @ 3:50 PM 0 Comments

eDiscovery in the Cloud is Obviously Working

eDiscovery in the cloud is obviously working as this week Autonomy. a global leader in eDiscovery and GRC infrastructure software for the enterprise, announced that  they are now managing over 17 Petabytes of email, documents, and multimedia data on 6,500 servers on 8 data centers around the world. Seventeen Petabytes is equal to more than 11 times the size of the 10 billion photos on Facebook, or 226 years of HD video.

I think that this announcement answers questions about whether or not the enterprise will allow its data outside the firewall.  And, to a certain degree answers the debate about the future of cloud computing in the eDiscovery and GRC markets.

As a cloud based, software-as-a-service (SaaS) evangelist of the past 10 years,  I am really pleased to see that cloud based computing is gong mainstream and gaining momentum within the enterprise.  And, I am even more pleased to see these trends in eDiscovery and GRC market.

However, as I am also a best-in-class advocate and evangelist, it is disappointing to see that a vendor with a monolithic solution based on a proprietary database (IDOL) seems to have taken the lead in cloud based computing.  Don’t get me wrong, I am very impressed with what Autonomy has accomplished and have tremendous respect for their technology.  That being, said I am now curious about market penetration and acceptance, hosted data amounts and SaaS based application utilization by best-in-class component technologies in the same markets that Autonomy is playing.

We all know about the success of salesforce.com.   I wonder which technology vendor or technology vendors will take on Autonomy with an more open systems best-in-class type approach and rise to the level of success as a salesforce.com?

In some respects, the answer to the question of who is competing with Autonomy may be found in the fact that there are no other providers that have put all of the “best-in-class” solutions together along with workflow management under a single enterprise class data center.  And that each of the individual SaaS based technology providers is only marketing a component of the overall solution and therefore doesn’t really have a single source solution to compete with Autonomy.

So, is the answer that some service provider needs to bring all of this together?  I have been studying several potential candidates over the past 12 months and will be reporting on their offering(s) and their potential impact on the market before the end of the year.  Stay tuned.
The full text of the Autonomy press release is as follows:

Cambridge, UK and SAN FRANCISCO – October 12, 2010 – Autonomy Corporation plc (LSE: AU. or AU.L), a global leader in infrastructure software for the enterprise, today announced that Autonomy's private cloud computing platform has reached a new data processing milestone, extending its lead as the world's largest private cloud. Autonomy private cloud now manages over 17 Petabytes of email, documents, and multimedia data on 6,500 servers on 8 data centers around the world. Seventeen Petabytes is equal to more than 11 times the size of the 10 billion photos on Facebook, or 226 years of HD video.

The continued dramatic growth of Autonomy's private cloud is the result of Autonomy's unique, meaning-based approach to cloud computing, as well as the rapid adoption for multichannel marketing applications. Powered by Autonomy's Intelligent Data Operating Layer (IDOL), Autonomy's private cloud automatically recognizes concepts and patterns in the billions of files it ingests and indexes every day. The ability to automatically understand the meaning within all forms of data provides a significant advantage to the customer, whether it's a compliance officer or lawyer responsible for archiving and reviewing emails, video, and social media posts around a particular case, or a chief marketing officer looking to deliver the most relevant and proven content to a website visitor in real-time.

As a result, Autonomy is now the dominant leader in a range of private cloud computing applications. Autonomy is driving rapid uptake amongst marketers looking for a cost-effective, fast, and turnkey platform for hosted marketing applications. For instance, a marketing team can form a virtual chain with its network of design and advertising agencies, to securely collaborate on the development of rich media content. Autonomy's cloud-based marketing modules include Autonomy Optimost, Autonomy TeamSite, and Autonomy Virage MediaBin.

Likewise, corporate legal departments are increasingly turning to Autonomy to form a virtual private chain with their law firm partners, in order securely collaborate on relevant information for a particular investigation or case. This cloud-based approach to eDiscovery results in radically compressed timeframes for the eDiscovery process. Autonomy's private cloud processed 36,000 eDiscovery audits year-to-date, producing 48 Terabytes of eDiscovery data. Autonomy's cloud-based information governance modules include Autonomy Consolidated Archive, Early Case Assessment, Introspect, Legal Hold, Records Manager, Supervisor, and iManage WorkSite.

"Most technology providers consider cloud computing to be nothing more than making the contents and applications in a digital storage box accessible via the internet," said Mike Lynch, CEO of Autonomy. "However, Autonomy's meaning-based approach to cloud computing brings intelligence to a range of applications, from archiving to eDiscovery to marketing. Autonomy provides the ideal platform for our Protect and Promote customers, who are dealing with an increasing array of content to govern and apply policy to, produce for eDiscovery investigations and review, and who are seeking greater agility in launching multichannel campaigns that resonate with their customers."
Autonomy's private cloud is hosted in state-of-the-art and high-security data centers. The data centers are under 24/7 surveillance, and each one undergoes annual Statement of Accounting Standard number 70 or "SAS 70" audits. Two fully synchronized, geographically separated systems provide complete data and system redundancy and parallel processing of all tasks. The design addresses all aspects of multi-tenancy, such as multiple firewalls and virus protection, and is ideally qualified to support the performance and volume requirements that are necessary for processing the rapidly expanding number of corporate formats and unified communications – including all forms of text, audio, and video.

About Autonomy
Autonomy Corporation plc (LSE: AU. or AU.L), a global leader in infrastructure software for the enterprise, spearheads the Meaning Based Computing movement. IDC recently recognized Autonomy as having the largest market share and fastest growth in the worldwide search and discovery market. Autonomy's technology allows computers to harness the full richness of human information, forming a conceptual and contextual understanding of any piece of electronic data, including unstructured information, such as text, email, web pages, voice, or video. Autonomy's software powers the full spectrum of mission-critical enterprise applications including pan-enterprise search, customer interaction solutions, information governance, end-to-end eDiscovery, records management, archiving, business process management, web content management, web optimization, rich media management and video and audio analysis.

Autonomy's customer base is comprised of more than 20,000 global companies, law firms and federal agencies including: AOL, BAE Systems, BBC, Bloomberg, Boeing, Citigroup, Coca Cola, Deutsche Bank, DLA Piper, Ericsson, FedEx, Ford, GlaxoSmithKline, Lloyds Banking Group, NASA, Nestlé, the New York Stock Exchange, Reuters, Shell, Tesco, T-Mobile, the U.S. Department of Energy, the U.S. Department of Homeland Security and the U.S. Securities and Exchange Commission. More than 400 companies OEM Autonomy technology, including Symantec, Citrix, HP, Novell, Oracle, Sybase and TIBCO. The company has offices worldwide. Please visit http://www.autonomy.com/ to find out more.

Autonomy and the Autonomy logo are registered trademarks or trademarks of Autonomy Corporation plc. All other trademarks are the property of their respective owners.

Labels: Autonomy, Compliance, eDiscovery, Governance, GRC, Litigation Service Providers, Litigation Software, Risk and Compliance

posted by Charles Skamser @ 10:17 AM 0 Comments

Records Management and Early Case Assessment (ECA)

• Identify the specific business objectives for their records management initiative and select the right vendor, as a records management program requires a long-term commitment and the product needs to be compatible with the organization's content management strategy.
• Assess the records management product's capabilities to integrate and extend records retention policy into other content repositories, e-mail systems, document archives and file stores, as well as its search and legal discovery capabilities.
• Consider records management products with capabilities to support multiple content types and media — physical records, which may be in distributed record centers; electronic documents, which may reside in multiple repositories; and e-mail, which may exist in both the e-mail system and e-mail archives.
• Consider the records management product's certification under country- and regional-level standards such as Department of Defense (DoD) Directive 5015.2-STD, Model Requirements for the Management of Electronic Records (MoReq) and Victorian Electronic Records Strategy (VERS)

MarketScope Information management leaders, compliance officers, legal counsel and records managers are working on records management projects that involve managing business document retention and preservation. A good records management initiative includes people, processes and technology. Industry and government regulations have helped lead or even necessitate records management adoption, but e-discovery as well as the need for more effective control of vast information stores in the enterprise have become even more important drivers. While highly regulated industries, such as financial services, utilities and pharmaceuticals, have always had record retention requirements, changes in government regulations have impacted companies across a broader range of industries. Freedom of information legislation, which has proliferated on a global scale, has also increased the need in government organizations to implement records management initiatives, in order to properly retain appropriate documents so they can be produced as requested. Despite today's challenging economic environment, the need for transparency and accountability in government agencies continues to drive the adoption of records management.

Records management systems have evolved from little more than the creation of indexes and tracking mechanisms for the preservation of paper documents to the preservation of electronic documents. As the range of digital content types continues to grow, electronic records management systems should now include mechanisms for dealing with audio, video and Web content. The emergence of wikis, blogs and social networking platforms also requires policies and approaches for retention of user-generated content. E-mail has proved to be especially problematic when it comes to maintaining business records. While e-mail active archiving systems support role-based and event-based retention, records management is still needed for those e-mails that must be retained as records.

Many records management products are integral components of enterprise content management (ECM) suites and will require additional software licenses. The ability to integrate and declare documents from ECM applications should be a prerequisite for records management products. Integration with Microsoft Office is also important, because much of the creation of future business records occurs in this information worker environment. As e-mail and instant messaging are now staples of conducting business, records management products must also be able to integrate with these infrastructure applications. Records management vendors are also emphasizing increased integration with e-mail active archiving, compliance and e-discovery applications. As the diversity of applications and content repositories expands, policy-driven records management, allowing for the automatic classification of records, will become the preferred choice.
Standards have been established in many countries to provide local requirements for records management. These standards include how different record types should be managed, rules for metadata creation, security definitions and implementation guidelines. Many of these standards have released their second versions. Key records management standards include:

• DoD Directive 5015.2-STD — A U.S. standard and certification for records management developed by the Department of Defense. The DoD 5015.2-STD version 2 standard includes a Chapter 2 version and a Chapter 4 version, which detail additional security and classification requirements. The latest version, which records management vendors are now being certified for, is DoD 5015.2-STD version 3.
• MoReq2 — The European Model Requirements for the Management of Electronic Records is a European standard for records management functionality and deployment. The goal of MoReq is to subsume individual national records management standards in the European community. MoReq2, the latest version developed and released in February 2008, is more comprehensive in terms of testing, governance and functionality. Certification and testing of MoReq2 for records management products is just beginning, and as MoReq2 becomes more formalized, we believe that it will serve as a key records management standard.
• TNA2 — TNA2 is a U.K. standard and certification published by The National Archives. Its requirements reflect the legislation and standards for information management and include aspects of ISO 15489, MoReq, e-government and freedom of information. TNA-approved records management products meet compliance with the standards but no certification process is used.
• Document Management and Electronic Archiving (DOMEA) — A German strategy and standard for records management and document management in government agencies. It has seen limited compliance and adoption by records management vendors.
• VERS 2 — The Victorian Electronic Records Strategy is a framework of standards and implementation with the goal of reliably and authentically archiving electronic records created or managed by the Victorian government in Australia. This standard has become the de facto standard for records management projects in Australia.
• Information & Documentation on Records Management Guidelines (ISO 15489) — The first international standard for the implementation of records management. It defines how records should be created, captured and managed, including policies and processes. Many national records management standards include elements of ISO 15489.

These standards can be used as a foundation and guideline for the evaluation and implementation of records management products. The DoD 5015.2 standard is well-established and is the only one that has a formal certification process. It is the de facto benchmark for records management products and acts as certification for essential product functionality. Gartner recommends that enterprises use the DoD 5015.2 STD 2007, version 3 standard as a key requirement when acquiring any records management product, along with consideration of local standards.

Labels: 26(f), Compliance, Early Case Assessment, ECA, eDiscovery, General Counsel, Records Management, Records Rentention

posted by Charles Skamser @ 10:36 AM 1 Comments

When to Bring eDiscovery In-house or Move to Cloud Computing?

Over the past 18 months, the “big buzz” in the eDiscovery market has been that the Global 2000 are bringing eDiscovery in house.  The value proposition is that outsourcing to legal vendors, service providers and/or outside counsel is just too expensive.  And, ultimately, ensuring that it (eDiscovery) is done properly (i.e. in a legally defensible manner, etc.) is the responsibility of the General Counsel (GC) and other C level executives (i.e. CIO, CFO, CEO) anyway.

However, what about members of the Global 2000 that don’t have enough litigation to justify bringing it (eDiscovery) in-house?  And, what about all the rest of the enterprises outside of the Global 2000 (the majority of the enterprises worldwide) that never have to deal with the issues and costs of eDiscovery?

First of all, with the inevitable convergence of eDiscovery and Governance, Risk and Compliance (See “ Government Intervention and Oversight Driving the Convergence of eDiscovery and Governance, Risk and Compliance (GRC)”) all enterprises worldwide are going to have to deal with the issues of information management and reporting as it relates to eDiscovery and GRC.
So, just because you never have to respond to requests to produce information due to litigation, it is negligent to not  be prepared (e.g. have a data retention policy and a plan for eDiscovery).  And now, with the accelerating increase in government intervention and oversight, Governance, Risk and Compliance (GRC) are almost certainly going to affect all enterprises worldwide in some way shape or form.

So, given the cost of “outsourcing” along with this inevitable new playing field, when do you bring eDiscovery in-house? Or, given the convergence of eDiscovery and GRC, maybe a better question is when should the enterprise have an  in-house plan and associated capabilities to support whatever legal and/or GRC requests come along?

The answer for some may be to keep outsourcing.  However, those that do had better brush up on their responsibilities (outsourcing or not) as the courts are no longer accepting ignorance as a defense.

Another alternative maybe to investigate Cloud Computing as a cost effective way of moving eDiscovery / GRC in-house without having to invest in all of the IT infrastructure.  Obviously, archiving data (e.g. email) “in the Cloud” has matured to the point where it is almost a “no brainer” for most enterprises to consider (no hate mail from the anti Cloud contingency please as your security concerns are beginning to wear a bit thin).  And, most if not all of the applications that it takes to support eDiscovery / GRC processing such as Early Case Assessment (ECA), Legal Holds, Search and Analytics and Document Review are now available as Infrastructure-as-a-Service (IaaS), Platform-as-a-Service (PaaS) and Software-as-a-Service (SaaS).  Moving large amounts of data around and maintaining an appropriate chain-of-custody are still issues that need to be watched closely in this environment.

Enterprises worldwide, whether in or outside the Global 2000, are having to deal with the paradigm shift and subsequent realities of eDiscovery and Governance, Risk and Compliance (GRC) reporting.   And, the pressures of the worldwide financial crisis along with the accelerating increase in government intervention and oversight have unfortunately added another layer of complexity.

However, Cloud Computing is now a very viable alternative when considering moving your eDiscovery and GRC operations in-house.

Labels: Cloud Computing, Compliance, Convergence, Early Case Assessment, eDiscovery, eDiscovery Costs, eDiscovery Market, Electronically Stored Information, Governance, GRC, Risk and Compliance

posted by Charles Skamser @ 9:16 AM 0 Comments

eDiscovery Data Mapping Should be a Top Priority for General Counsel and CIOs within the Global 2000

A key aspect and legal requirement of eDiscovery is the creation of a data map to determine precisely what information is available within an organization and where it resides. This is a process that should begin long before a company ever finds itself in court. Surprisingly, over the past 2 years, I haven’t found more than a hand full of General Counsel and CIOs at some of the largest companies in the world that truly understand the importance of eDiscovery Data Mapping, the risks involved in not having a working eDiscovery Data Map nor the fact that they should be leading the charge to develop and manage an enterprise wide eDiscovery Data Map.

Ganesh Vednere, a manager at Capgemini, wrote an excellent overview of the key aspects of eDiscovery Data Mapping titled, “The Quest for eDiscovery: Creating a Data Map”. that appeared on the November / December 2009 Informatics site. In this overview, Ganesh indicated that, at a minimum, the enterprise should consider completing the following tasks as a general practice to start the eDiscovery Data Mapping process:

Get a list of all systems – and be prepared for a few surprises
Begin the process by creating a list of all systems that exist in the company. This is easier said than done, as in many cases, IT does not even have a full list of all systems. Sure, they usually have a list of systems, but don’t take that as the final list! Due diligence involves talking to business process owners, employees, and contractors, which often brings to light hidden systems, utilities, and home-grown applications that were unbeknownst to IT. Ensure that all types of systems are covered, e.g. physical servers, virtual servers, networks, externally hosted systems, backups (including tapes), archival systems, and desktops, etc. Pay special attention to emails, instant messaging, core business systems, collaboration software, and file shares, etc.

Document system information
After the list of all systems is known, gather as much information about each as possible. This exercise can be performed with the help of system infrastructure teams, application support teams, development teams, and business teams. Here are some types of information that can be gathered: system name, description, owner, platform type, location; is it a home grown-package, and does it store both structured and unstructured data; system dependencies (i.e., what systems are dependent on it and what systems does it depend on); business processes supported, business criticality of the system, security and access controls, format of data stored, format of data produced, reporting capabilities, how/ where the system is hosted; backup process and schedule, archival process and schedule, whether data is purged or not; if purged, how often and what data gets purged; how many users, is there external access allowed (outside of the company firewall), are retention policies applied, what are the audit-trail capabilities, what is the nature of data stored, e.g. confidential data, nonpublic personal information, or still others.

Get a list of business processes
Inventory the list of business processes and map it to the system list obtained in the step above to ensure that all the various types of ESI are documented. The list of business processes is also useful during the discovery process, when one can leverage the list to hone in on a particular type of ESI and obtain information about how it was generated, who owned the data, how the data was processed, how it was stored, and so on. A list of business processes can also be useful when assessing information flows.

Develop a list of roles, groups, and users (custodians)
Obtain the organizational chart and determine the roles and groups across the business and the business processes. Document the process custodians and map out who had privileges to do what. Understand the human actors in the information lifecycle flow.

Document the information flow across the entire organization
Determine where critical pieces of information got initiated, how the information was/is manipulated, what systems touch the information, who processes the information, what systems depend on the information, and so on. Understanding the flow of information is key to the data mapping/discovery process.

Determine how email is stored, processed, and consumed
Given the large percentage of business information and business records that reside in email, special attention needs to be placed on email ESI. Typically email is the first thing that opposing counsel go after, so determining whether email retention and disposition policies are consistently enforced will be key to proving good faith. There are a number of automated tools that will enable you to create email maps, link threads of conversation, heuristically perform relevancy search, extract underlying metadata, and so on. Before deciding to buy the best-of-breed solution, however, perform due diligence on existing email processes. Understand how employees are using email. Are they creating local archives (.PST files), are they storing emails on a network or a repository, are they disposing of them at the end of retention periods, are they using personal emails to conduct official business, and so on. Identify deficiencies and violations in email policies before the opposing counsel does.

Identify use of collaboration tools
SharePoint will have the lion’s share of the collaboration space in many organizations, but even then you must ensure that all other tools – whether they are social networking tools, Web-based tools, or home-grown tools – are included in the data-mapping process. You need to carefully document the types of information being stored on each of these tools. Sometimes company information has a nasty habit of being found in the most unlikely of places. Wherever possible work with compliance, information management, or records management groups to establish usage policies to prevent runaway viral growth of these tools. If the organization already has thousands of unmanaged SharePoint sites, work with IT and business to institute governance controls to prevent further runaway growth.

Don’t forget offsite storage
After inventorying and mapping all systems, one would think the job is done. Alas, there is more work ahead. Offsite storage is an often under-appreciated aspect of the discovery process. It is quite reasonable to assume that there might be substantial evidence stored offsite which might become incriminating at a later date. Offsite storage may contain boxes or tapes full of records whose existence was somehow never properly documented, with the result that they cannot be located unless someone opens the box or attempts to recover the tape data. These records continue to live well past their onsite cousins. This means the organization continues to have the record in backup tapes (or paper) and other formats that it purportedly claimed to have destroyed. The search for records in offsite storage is made more complicated if the offsite storage process did not create detailed indices about the contents. If there are tapes labeled “2007 Backup Y: Drive,” then it may become quite an arduous task to determine what information is really contained in those tapes. Nevertheless the journey must be started. It could involve anything from a full-scale review of all tapes, followed by reclassifying and re-filing the tapes, to perhaps a review of just the offsite storage manifests. It could also involve a search for critical information or a clean-up of the last three years’ worth of tapes, and so on.

eDiscovery Data Mapping Platform
This is an impressive beginning best practice. However, I would add the requirement of seriously considering investing in an eDiscovery Data Mapping platform to help guide you through the eDiscovery Data Mapping process and then manage all of the information that you discovery. After all, just creating your eDiscovery Data Map is just the beginning of the process. The real value of creating the eDiscovery Data Map will be seen when your enterprise uses the eDiscovery Data Map to support your first legal matter and enables you to more fully meet the legal requirements of the the Federal Rules of Civil Procedure (FRCP) and the associated state and local rules.

Genome from Exterro, is an excellent example of a new generation of data mapping solutions that are dynamic, shifting to reflect your company's information universe as it evolves.Through intelligent workflows and automated processes, Genome enables IT departments and legal teams to quickly visualize and analyze data source information to proactively scope case parameters. Over the next couple of weeks, I will be reviewing the solutions that are currently available along with some recommendations for which platforms will provide the best return on your investment (ROI).

The full text of Ganesh Vednere’s overview is as follows:

A key aspect of ediscovery is the creation of a data map to determine precisely what information is available within an organization and where it resides. This is a process that should begin long before a company ever finds itself in court.

The phone rings. It is the general counsel. The organization may be sued over patent infringement. Counsel knows that this could be “The Big One.” All sorts of data, documents, metadata, emails, and other forms of information may be required. Counsel asks IT: Do you have, or can you get together, a list of all systems and the data they contain?” There is a long, silent pause on the phone. Then the IT manager says “Well, we do have a list of systems. Let me send it your way.” Counsel gets the list. It is nothing close to the data map it needs. Instead it is a list of servers, their IP addresses, platform configuration, and their physical rack location in the data center. Good information for disaster recovery purposes, but not particularly helpful in court.

“Well, this is the best I’ve got,” comes the retort from IT. “We do not have a data map nor would we know how to create one – and, by the way, do you really think we have the bandwidth to work on this now?”

Why You? The Challenge of Data Mapping So who gets stuck with the job? You do. You might argue that “IT manages all the infrastructure and stuff, why couldn’t they just run an inventory on their systems?” And IT will reply that “Well, we do manage the infrastructure, but we know very little about the inputs, outputs, documents, records, and other information on these applications. Go talk to the business side.” And you go to business, and business will tell you that “I just use the system and click these buttons on the screen. The system is a black box to me. I have no idea about all of the underlying data, metadata, and data structures. I suggest you talk to the operational folks.” And you talk to the operational folks, and they say, “What are you talking about? We just execute business processes. Don’t ask us about data and metadata. Go talk to the analyst who worked on the system design.” And you look for the analyst, and you eventually learn that …“Oh, she was a consultant and she left the project three years ago.”
The challenges are many but the data map must be created. And the job is yours. So where do you start? By going back to the beginning … the very beginning.

How Did We Get in Such a Mess? Let’s take a look at a typical mid-size organization. It has several thousand employees and contractors with offices in the U.S. and E.U. The sheer volume of information that resides in just one division is mind-boggling. New information sources keep popping up, employees keep creating new SharePoint sites on their own, and there is use (or misuse) of social collaboration tools, to say nothing of several hundred IT systems in play at any point in time. Data is moved and migrated from one place to another without proper documentation or communication, more and more tape backups are being created, and some employees are making copies of data on thumb drives or worse, emailing them to their personal email addresses.

How did things ever become such a mess? There are manifold reasons: IT is traditionally kept at arm’s length on compliance and uninvolved with information management and governance during systems design and development. Records management departments, on the other hand, often institute sound policies and retention schedules but have a tough time putting these into practice and getting people to adhere to them. On the legal side, general counsels often work against themselves: becoming increasingly exasperated over the large amount of money spent on searching, processing, and producing electronically stored information (ESI), they often push hard to cut costs, thereby shortcircuiting the process.

Must an Organization Have a Data Map?
It may seem surprising that even today, many successful organizations do not have a data map, or at best, a superficial one. It is not that organizations are lacking in will, however, but that the process seems too daunting. Consider the “typical organization” above. If there are several hundred IT systems and other home-grown business applications, one must not only know what these systems are, and where they are located, but also the types of information (documents, records, other content) that are produced from these systems and additional information such as data format, data location, whether the data is updated by other systems, or transformed into other formats, etc.

To add to the complexity, a determination also needs to be made as to whether a piece of ESI can be extracted and presented using reasonable and customary means. For example, if an IT system was retired and the data backed-up on tape, it is reasonable to assume that extracting the tape, processing the information, and presenting it in a readable format may not be easy since the underlying version of the software no longer exists. Counsel, however, must be able to assess whether this is indeed the case. Having a data map eases some of these tasks and makes it easier for counsel to relate the information as needed.

Data Mapping Considerations
In the current economic environment, companies are bracing themselves for an uptick in the number of lawsuits. Whether the matter is related to regulators, customers, consumers, employees, or business partners, companies are often required to provide ESI in court. While this should be sine qua non for most organizations, many are simply too overwhelmed to be able to react fast enough and are thus placing themselves at a much greater risk. If that’s the case in your enterprise, here are some initial steps that will help you move forward.

1. Understand the prevailing legal environment. Organizations are not created equally, and not all have the same set of applicable legal requirements. It is therefore important to analyze the type of environment that the organization operates in, the jurisdiction it is under, and the various federal and state laws, regulations, and common industry standards that apply to it, with regard to ESI. While the contents of a data map by itself do not directly correlate to a particular law or regulation, it is useful to know what checks and controls need to be established during the datamapping process and ensure that there are no “show-stopper” questions in court around how the data map was created or what the process was.
2. Use a partnership model and obtain buy-in from senior management. It is important that each entity within an organization have a vested stake in the success of any data-mapping project. This means that management in each of these organizational fiefdoms must understand what a data map is, how it will be used, and what the process of creating one is. Getting buy-in from these senior managers is a crucial first step and must be completed prior to the start of the process. Additionally, it is important that people of the appropriate rank are selected to work on the project. Folks who are deep in the weeds will generally have a lot more information about data flows and how processes and people work together versus the senior executive who operates in more of a decision-making capacity.
3. There is little point in pursuing a “big-bang” approach for the data map. Instead, work towards a phased approach. Prioritize which divisions or lines of business to focus on first and then address the remaining ones later. Work with line managers to determine what, if any, information has been collected on systems and processes within their particular areas. Standard industry lists may be employed as a starting point, e.g. HR, Accounting, Communications and Marketing, etc. Begin the first phase of the process here and then iteratively build upon what’s already available.
4. Use the right technology. As more capital is allocated towards automating ediscovery, vendors will naturally gravitate towards building specialized software for this mission. Time, cost, and relevancy of results will drive the success of vendor products. While some organizations have attempted to build custom tools, more and more prefer choosing established products or service offerings to guide them through the rediscovery and data-mapping process. Already many vendors have begun mapping their offerings to the electronic discovery reference model (EDRM) and other industry standards. This market is still maturing and organizations should not go out and immediately purchase a top-rated vendor’s software without due consideration of the organization’s unique circumstances.

Creating the Data Map
Once you’ve worked your way through each of considerations above and taken action as needed, you’re ready to start the actual data-mapping process. It is lengthy but well-defined and can be broken down into each of the following steps:

The Data Mapping Process

1. Get a list of all systems – and be prepared for a few surprises. Begin the process by creating a list of all systems that exist in the company. This is easier said than done, as in many cases, IT does not even have a full list of all systems. Sure, they usually have a list of systems, but don’t take that as the final list! Due diligence involves talking to business process owners, employees, and contractors, which often brings to light hidden systems, utilities, and home-grown applications that were unbeknownst to IT. Ensure that all types of systems are covered, e.g. physical servers, virtual servers, networks, externally hosted systems, backups (including tapes), archival systems, and desktops, etc. Pay special attention to emails, instant messaging, core business systems, collaboration software, and file shares, etc.
2. Document system information. After the list of all systems is known, gather as much information about each as possible. This exercise can be performed with the help of system infrastructure teams, application support teams, development teams, and business teams. Here are some types of information that can be gathered: system name, description, owner, platform type, location; is it a home grown-package, and does it store both structured and unstructured data; system dependencies (i.e., what systems are dependent on it and what systems does it depend on); business processes supported, business criticality of the system, security and access controls, format of data stored, format of data produced, reporting capabilities, how/ where the system is hosted; backup process and schedule, archival process and schedule, whether data is purged or not; if purged, how often and what data gets purged; how many users, is there external access allowed (outside of the company firewall), are retention policies applied, what are the audit-trail capabilities, what is the nature of data stored, e.g. confidential data, nonpublic personal information, or still others.
3. Get a list of business processes. Inventory the list of business processes and map it to the system list obtained in the step above to ensure that all the various types of ESI are documented. The list of business processes is also useful during the discovery process, when one can leverage the list to hone in on a particular type of ESI and obtain information about how it was generated, who owned the data, how the data was processed, how it was stored, and so on. A list of business processes can also be useful when assessing information flows.
4. Develop a list of roles, groups, and users (custodians). Obtain the organizational chart and determine the roles and groups across the business and the business processes. Document the process custodians and map out who had privileges to do what. Understand the human actors in the information lifecycle flow.
5. Document the information flow across the entire organization. Determine where critical pieces of information got initiated, how the information was/is manipulated, what systems touch the information, who processes the information, what systems depend on the information, and so on. Understanding the flow of information is key to the data mapping/discovery process.
6. Determine how email is stored, processed, and consumed. Given the large percentage of business information and business records that reside in email, special attention needs to be placed on email ESI. Typically email is the first thing that opposing counsel go after, so determining whether email retention and disposition policies are consistently enforced will be key to proving good faith. There are a number of automated tools that will enable you to create email maps, link threads of conversation, heuristically perform relevancy search, extract underlying metadata, and so on. Before deciding to buy the best-of-breed solution, however, perform due diligence on existing email processes. Understand how employees are using email. Are they creating local archives (.PST files), are they storing emails on a network or a repository, are they disposing of them at the end of retention periods, are they using personal emails to conduct official business, and so on. Identify deficiencies and violations in email policies before the opposing counsel does.
7. Identify use of collaboration tools. SharePoint will have the lion’s share of the collaboration space in many organizations, but even then you must ensure that all other tools – whether they are social networking tools, Web-based tools, or home-grown tools – are included in the data-mapping process. You need to carefully document the types of information being stored on each of these tools. Sometimes company information has a nasty habit of being found in the most unlikely of places. Wherever possible work with compliance, information management, or records management groups to establish usage policies to prevent runaway viral growth of these tools. If the organization already has thousands of unmanaged SharePoint sites, work with IT and business to institute governance controls to prevent further runaway growth.
8. Don’t forget offsite storage. After inventorying and mapping all systems, one would think the job is done. Alas, there is more work ahead. Offsite storage is an often under-appreciated aspect of the discovery process. It is quite reasonable to assume that there might be substantial evidence stored offsite which might become incriminating at a later date. Offsite storage may contain boxes or tapes full of records whose existence was somehow never properly documented, with the result that they cannot be located unless someone opens the box or attempts to recover the tape data. These records continue to live well past their onsite cousins. This means the organization continues to have the record in backup tapes (or paper) and other formats that it purportedly claimed to have destroyed. The search for records in offsite storage is made more complicated if the offsite storage process did not create detailed indices about the contents. If there are tapes labeled “2007 Backup Y: Drive,” then it may become quite an arduous task to determine what information is really contained in those tapes. Nevertheless the journey must be started. It could involve anything from a full-scale review of all tapes, followed by reclassifying and re-filing the tapes, to perhaps a review of just the offsite storage manifests. It could also involve a search for critical information or a clean-up of the last three years’ worth of tapes, and so on.

Conclusion
In today’s highly litigious world, creating a data map is one of the primary steps in responding to litigation requests. It is vital that organizations get a solid foundation by focusing time, energy and resources in doing it right – and creating it long before it’s needed.

Labels: Compliance, Data Management, Data Map, Discovery, eDiscovery, Electronically Stored Information, ESI, Exterro, Federal Rules of Civil Procedure, FRCP, Legal Holds, Litigation Readiness

posted by Charles Skamser @ 8:00 AM 0 Comments

How is Outside Counsel Doing wtih eDiscovery?

I grew up in the world of Global 5000 Business Process Automation (BPA), Business Process Improvement (BPI), Business Process Management (BPM) and Balanced Score Cards. Therefore, I can sling information and business consulting acronyms with the best of them. However, now that I live in the world of eDiscovery and Governance, Risk and Compliance (GRC), I am faced with an industry that, for the most part (there are some exceptions), is just not familiar with the practice of BPM or its benefits. And, in many cases it is literally a matter of "not even knowing what you don't know." Therefore, I believe that the next big market for BPM and all of its associated glory is the GRC and eDiscovery markets. After all, I can't help by wonder if there are any General Counsel in the Global 2000 that would like to know how their outside counsel would score on an independent eDiscovery and GRC Assessment. And, there may even be some CEOs or Board of Director members that would like know how their legal departments would score on an independent internal eDiscovery and GRC Assessment.

As a place to start, I wanted to comment on some of the finding by Elise Olding in the Gartner RAS Core Research Note G00165528 from March 12, 2009 titled, "It's a Matter of Survival: Use BPM to Drive Out Costs".

Ms. Olding put forth the proposition that, "In a troubled economy, struggling companies often cut costs broadly and blindly without understanding whether those cuts further compromise their survival." This statement should ring very true today for both the legal departments of the Global 5000 and certainly law firms as they have both dramatically cut costs across the board without understanding the effect it may have on their ability to effectively handle eDiscovery. She went on to state that, "For struggling companies, business process management is a lifeline that helps them survive by reducing and avoiding costs in this volatile and turbulent economy." I contend that the same holds true for law firms and legal departments as they struggle to compete and survive. However, I am also going to contend that due to the fact that very little is truly understood and very little has been documented about the processes involved in GRC and eDiscovery, even without the pressures of the current economic situation, BPM would be an excellent approach for law firms and legal departments to employ to ensure that they are carrying their duties in regards to the serious issues of governance, compliance, risk management and eDiscovery in a manner that will enable the best possible outcomes.

Whether its Sarbanes-Oxley compliance or ensuring that you are following the rules of handling Electronically Stored Information (ESI) as stated in the amended Federal Rules of Civil Procedure (FRCP), leaders from Global 5000 legal departments and partners at the major law firms need to seriously consider beginning to employ the Business Process Management (BPM) methodologies and technologies that have been successfully used throughout the rest of the Global 5000 enterprises for many years.

Labels: Assessments, BPM, Business Process Automation, Compliance, FRCP, Global 5000, Governance, GRC, In re: Fannie Mae Securities Litigation, Law Firms, Sarbanes-Oxley

posted by Charles Skamser @ 3:47 PM 0 Comments

Are Changes to the FRCP Increasing the Cost of Litigation?

Over the past year, in pursuit of everyone trying to figure out the best way to address all of the issues created by the changes to the Federal Rules of Civil Procedure and all of the resulting changes to state and local rules, I have worked with litigators from over 75 different law firm, litigation services professionals from 50 different service providers, technologies from 50 different litigation technology vendors and the General Counsels, Associate General Counsels and related IT professionals for over 25 Fortune 1000 companies. In addition to an incredible education of the current state of the litigation market and all of the associated technologies and new service practices, what I have taken away from this journey is a sense that we are still in the middle of a paradigm shift that is rocking the industry to its very core.

As such, I believe that the answer to the question about whether or not the changes to the Federal Rules of Civil Procedure and all of the resulting changes to state and local rules, is going to be different depending upon who you are asking.

Following are the results of the answers that I have gotten from the various groups that I meet with:

Litigators
Litigators are reporting that the changes to the FRCP and all of the resulting changes to state and local rules have required them to "go back to school" and learn a more about the technology and science of litigation and Electronically Stored Information (ESI) then many of them ever cared to know. I can tell you that the CLE classes on the effects of the changes to the FRCP that I teach have been full with a lot of very attentive attorneys.

In addition, litigators are now learning that litigation has gotten much more complicated and much more expensive. And, they are realizing that they are now required to solicit the assistance of technology and process experts are the very beginning of case to participate in pre meet and confer strategy sessions.

Further, whether they have been caught off guard or not, many litigators are finding that it is making more financial sense to settle their cases out of court due to the extreme cost of just getting prepared for trial.

Finally, although I am not a liberty to discuss the details of any of the cases that I have been involved in, I believe that there are an alarming number of new suits being filed against corporations by savvy litigators in which the "end game" is to force a settlement out of court due to the high cost of preparation and initial response.

Litigation Service Providers
As with Litigators, Ligitation Service Providers are reporting that the changes to the FRCP and all of the resulting changes to state and local rules have required them to "go back to school" and learn a more about the technology and science of litigation and Electronically Stored Information (ESI) then many of them ever cared to know. Having started in the legal services business providing copying services, the current surviving providers had to successfully make the transition to the world of imaging, coding, translatoin and hosting over the past several years. They are now faced with the even more daunting task of making the next leap to the world of Electronic Data Discovery and Computer Forensics. For a variety of reason, many of them will not be successful unless they embrace the eDiscovery Paradigm Shift, form new partnerships with technology vendors and consultants that can help them with the new paradigm and change their clients perceptions of what they can bring to the new ESI table. It is my opinion that based upon this classic paradgim shift, there is a tremendous opportunity for the Litigation Service Providers that successfully make the transition and a blunt reality of failure waiting for those that do not.

Litigation Technology Providers
As alluded to in my overview of how the changes to the FRCP have effected the Litigation Services Providers, we are in the midst of a classic market paradigm shift which casuse fear, uncertainty and doubt on the buyer side. As such, and is the case in any market where this occurs, it is an open season for technology providers to step in and fill the requirements gaps with new solutions. Since many of the posts on my Blog deal with my my opinions of all of the wonderful new technologies, I am not going to go into any detail in this post. However, I would like to mention that I believe that the biggest technology winner that will emerge from this opportunity will be the Software-as-as-Service (SaaS) deliver model. Its lesss expensive to develop and deliver, less expensive to use and enables very rapid and incremental updates.

The Fortune 1000
The changes to the FRCP and all of the resulting changes to state and local rules have had the most profound effect on the way in which the Fortune 1000 now have to manage with all things related to litigation. Frist and foremost, they can no longer ignore the whole area of what I am going to refer to as ESI Management including the development and implementaiton of a proper rentention policy and the asssociated infrastructure without taking on the liability of severe financial consequences for no compliance.

In addition, ESI no longer includes just information on servers, desktops and lapstops. It now includes information stored on corporate issued thumb drives and other external storage devices, Blackberries and other PDA, cell phones and even information stored with third party email providers and a list of information that may be stored with applications delivered via a Software-as-as-Service (SaaS) model. And, since collection is no longer an option, IT departments may no longer have the expertise or experience to keep up.

Further, courts are becomming less and less tolerant of ignorance and/or inaction and therefore management of preservation notices and actual preservation have also become an area riddeled with the rick of sanction and servere financial consequences.

In summary, with the changes to the FRCP and all of the resulting changes to state and local rules, the Fortune 1000 can longer afford its IT departments to like its fathers corporate IT departments. The externally mandated compliance and litigation preparedness requirements are much greater and the consequences of non-compliance are server.

So, my conclusion is that the changes to the FRCP and all of the resulting changes to state and local rules probably seems like it has had a net result of making litigation more complex and much more expensive for everyone involved. And, with our country heading into a ression or a least a downturn, conducting successful litigation under the new requirements being impossed by the changes to the FRCP may seem like it has become out of reach financially for many. And, it may be for some time.

However, in the long these changes will enable our legal system as a whole and the individual participants more accurate and equal access to justice. Only time will tell.

Labels: Compliance, Discovery, Document Rentention Policy, eDiscovery, ESI, FRCP, Litigation, Litigation Service Providers, Paradigm Shifts, Preservation, Records Rentention, Saas, Software-as-a-Service

posted by Charles Skamser @ 10:17 AM 0 Comments

Corporations are Evidence Machines

In my never ending quest to find the best technologies in the industry, I have recently discovered Humanizing Technology (HT), a emerging player in the sophisticated search technology market.

The Problem
As I have been "preaching"on this Blog, after Enron and the changes to Federal Rules of Civil Procedure (FRCP), it has become increasingly risky for companies to rely solely upon reactive or remedial measures with regard to electronic compliance. Through (FRCP) directives, courts continue to impose more stringent eDiscovery requirements, increasingly mandating that companies better understand and manage electronic communications and records. These mandates, combined with the sheer volume of electronic communications and the proliferation of communications technologies, pose a serious risk to companies.

An October 1, 2007 Forbes magazine article titled, The Data Explosion, noted: "Corporations are evidence machines, generating terabytes of electronic documents, e-mails and digitally recorded phone calls each year." Non-compliance problems, many of which are perpetrated in electronic communications, can be and frequently are image-damaging publicity events for companies as well as a basis for significant financial and legal risk. Managing e-compliance in the midst of the data explosion, as opposed to having it manage you, is a key challenge to company boards, executives, and managers as well as their professional advisors.

HT History
HT began as a technology development company in early 2000 and soon began focusing upon applications that required the mining and extraction of hard-to-find information as a core competency. As such, HT developed a unique concept search technology and deployed it as a utility within its news search applications and patent search product. In these products, the technology proved its ability to deliver unique concept search capabilities and so HT embarked upon efforts to leverage its concept search technology by applying it to other markets.
In mid-2007, HT de-coupled its concept search technology from the news and patent search products to deploy it within various text-search applications. In just a few short months, HT proved the technology’s uniqueness within the following applications:

1. A significant mid-size manufacturing business searching various data stores that, when complete, will involve up to 2 tera-bytes of data searched.
2. Two leading Universities for searching intellectual property, research expertise, knowledge base information, and library archives.
3. A law firm searching its database of legal documents.
4. A medical information application searching various data stores for relevant patents, patient record data, and clinical trial results.
5. An Indiana law enforcement agency searching data stores of evidence.

Based on the success of the technology, HT sought to identify various business and/or legal problems that were complex and costly to organizations but could be solved by deploying superior technology that searches, finds, and retrieves critical information. Initially, HT was advised to deploy its technology toward electronic discovery. While this is an attractive market and involves complex business and legal issues, HT believes that it makes more sense to help companies avoid trouble (i.e., be proactive) rather than simply helping them get out of trouble (i.e., be reactive). Thus, the emerging area of electronic compliance became the focus of HT’s concept search. HT is bringing together expertise and state-of-the-art tools for the implementation of Best Practices in electronic compliance for its customers.

The HT Solution
HT’s Audit Quality Search (AQS) technology seeks to assist corporations in risk management by carrying out various aspects of a compliance audit program including routine internal monitoring, more thorough periodic internal audits, and very thorough external text audits. HT has the ability to assist executives, officers, board members, high level managers, audit committee members, and professional advisors in assessing regulatory compliance gaps, identifying and managing risk and, in general, carrying out a broad set of corporate governance and oversight responsibilities. HT AQS can be used in the following ways:

1. As an investigative tool to research specific suspected wrong-doing.
2. As a gap analysis tool to carry out proactive but general compliance assessments.
3. As a compliance audit tool to provide a basis for sampling and summarizing a company’s overall state of compliance (similar to the function of financial audits).
4. As a records management tool to analyze electronic record data stores and provide a basis for making retention/deletion decisions.
5. As a due diligence tool to analyze electronic record data stores for completed and/or prospective acquisitions.

By utilizing AQS technology as part of a comprehensive compliance audit program, company executives, managers, board member, audit committee members and professional advisors can reduce financial risk and legal exposure by implementing Best Practices and "reasonable state-of-the-art methods" for assuring compliance.

I would encourage anyone who reads this Blog to contact Michael Mulcahy, the VP of Business Development at HT to get more information about this interesting and very promsing new search solution.

Labels: AQS, Audit Quality Search, Compliance, Conceptual Search, Forbes, FRCP, Humanizing Technology, Proactive Discovery, Records Rentention, Seach Technology

posted by Charles Skamser @ 3:35 PM 0 Comments