Records management in the cloud: a multidimensional issue

Multichannel cloud records

Often, e-mail and mailbox repositories are the first type of content to move to the cloud and have the associated records management function take place in the cloud. “From a total cost perspective, e-mail does not need to be stored on premise anymore,” says Scott Whitney, VP of product management at Actiance. “The information started out in the cloud and can stay there, but needs to be in compliance with recordkeeping policies, and it needs to have an index and a single user interface for managing the records.”

Actiance offers an archiving product called Alcatraz, along with Vantage and Socialite, which are policy executors that manage communications. Vantage and Socialite provide a record of unified communications and public social media communications respectively. “Any business-critical content can constitute a record,” says Whitney. “People are having conversations across multiple channels and are making decisions about the business, whether it is to give a customer a discount or change the architecture of its computer system. Along the way, they may jump communication channels. Because these decisions may be documented in a variety of ways, including via an e-mail, an instant message or a telephone conversation, enterprises need a single view of these events to declare and manage their records.”

Because it is not realistic to expect people to categorize and proactively save their social media messages, such as IMs, Alcatraz automatically captures and classifies those messages in context. “A key point is that the records management system should be able to keep track of content in all channels,” Whitney says, “because all channels can be used to create business records. If you only capture e-mail, you might be missing half of the conversation.”

Challenges with retrieval

Some of the concerns about use of the cloud for storing records center around retrieval. “It is easy to put information up in the cloud,” says Jason R. Baron, a lawyer in the information governance and e-discovery group at Drinker, Biddle & Reath and former director of litigation for the National Archives and Records Administration. “However, it is not always so easy to get the data back when you need it in a hurry or in a certain form. There can be some serious issues with extraction.”

Companies in regulated industries tend to use a private cloud or go to a hybrid model. “Marketing and sales data are often put in the cloud, but sensitive, regulated information is usually kept on premise,” says McVeigh. That approach helps address the issue of retrieval. “In some cases,” he continues, “it is not only a security issue but also a service level issue. Companies might be concerned about how long it would take to get e-discovery results. A smaller company that is competing with a larger one for time from the cloud provider still has to meet its e-discovery burdens.”

The problem becomes more extreme in cases of very large quantities of data. In those cases, retrieving the information for e-discovery or analytics may become very cumbersome. “When moderate amounts of data are involved, cloud is the clear winner, as it is for small- to medium-sized businesses,” says Kon Leong, CEO of ZL Technologies. “However, when cloud storage goes to extremely high volumes, it may actually be more cost-effective to return the records to on-premise storage, especially if there are expectations of frequent e-discovery or high-volume analytics.”

Beyond compliance

Many companies find they can use their records for purposes that go beyond compliance, including using the records for analytics. Having extensive storage capacity in the cloud offers the opportunity to keep larger volumes of data for longer than is required, which makes it available for other purposes. That decision comes with several downsides, including having to produce it for e-discovery and having to manage more data, but the results may still prove worthwhile.

“We see companies using records management for strategic and operational purposes every day,” says McVeigh. “RM is the mortar between big data, analytics, legal and IT. Life sciences can use information from lab notebooks and SharePoint team sites to unlock opportunities for new drug development.” Once information is organized, insurance companies, for example, can more easily mine their actuarial data. “The more companies mine their records, the better they know their own business,” McVeigh says.

Planning ahead

The key to success lies in planning ahead. “With the advent of Cloud First as a federal mandate, agencies are obligated to consider cloud storage as an option,” says Baron. “Many agencies have jumped to cloud deployment, but few agencies have jumped to it thinking of how to meet their ongoing records management obligations.” Retrofitting records management into a cloud environment is difficult; therefore, anticipating potential issues and designing a system that addresses them is critical. Having a point solution that allows selective retrieval is one ingredient for success.

“Frequently, companies miss the part about gathering requirements and thinking through whether the cloud is a better way to work,” McVeigh says. “At first it sounds good to get the cost-savings and flexibility offered by the cloud, but later, RM managers start asking how they manage retention in the cloud, how they can respond for e-discovery in the cloud and how to ensure privacy.”

A decision to use a cloud environment involves a complex mix of factors. “For a successful records management initiative in the cloud, the business first needs to understand its own objectives,” says Leong. “Cost shouldn’t be the only concern. Data security, intended time horizon of management and future leverage of data are all critical considerations that need to be evaluated before deciding to go with a cloud-based environment.”

Many of the earlier concerns with cloud technology have abated, in particular, those related to security. Organizations are in large part convinced that cloud providers will do at least as good a job with security as they can do themselves, if not better. The high-profile breaches in the last year or two did not originate in the cloud. Some concerns remain in terms of the geographic location of cloud storage, because of data sovereignty. However, the cloud is a viable option for data storage, so it will need to become viable for records management as well.