WHITEPAPER - Important Versus Business Critical Information: The Magic 5% You Can’t Live Without
By Cloud Direct • 29 May 2014
While it numbers just five percent of an organisation’s total record population, business critical information and how you care for it, can have a big impact on your business.
This information requires special preservation measures – ones that aren’t found in ordinary on and off site storage facilities. Whether a legal document, photograph, customer record, x-ray, blue print, patent, corporate article or one of a kind object, when it comes to business critical information storage is the single most important factor in determining it’s useful life.
How do you identify what information is critical to your organisation? What measures should you take to ensure it’s long term protection? How does the material of which a record is made influence its longevity – and guide your choice of storage solution? The question remains, have you done enough to preserve your organisation’s business critical information, and irreplaceable, five percent? This white paper will help you define what your business critical information is, understand the risks associated with inadequate preservation, evaluate storage options and implement an effective business critical information program for your organisation.
Protection of business critical information may be the least well understood – or the least appreciated – area of records management. If you’re reading this paper, chances are you already know a great deal about managing records. Certainly this discipline has never been more critical, particularly in light of legislative and compliance requirements, such as the Freedom of Information Act (2000 and Scotland 2002), the Data Protection Act (1998), the Sarbanes Oxley Act (SOX) of 2002 and the growing body of European legislation designed to protect information. In addition, new laws have increased the cost and risk associated with legal discovery processes – a particularly worrisome area in today’s litigious world.
And, chances are you have devoted significant resources and effort to improving your records management strategy and procedures. But have you done enough?
One area of vulnerability for many organisations is ensuring the accessibility and usability of records. Comprising just five percent of an organisation’s total record population, these are vital to enterprise operations. They may contain information needed to ensure business continuity during or shortly after a crisis, for example. Or, they may document legal or financial status and preserve the rights of an organisation’s stakeholders. If critical information is managed properly, your organisation is protected. If it isn’t you’re exposed to risks, such as noncompliance, loss of asset value and high costs associated with restoration and duplication.
Longevity is the fundamental differentiator between business critical information and all other records. This information has enduring value that must be preserved for years or even centuries. Storing them in a box on a shelf somewhere is simply not enough. The preservation process must ensure that business critical information remains secure, accessible and usable over these extreme time frames. Business critical information includes information organisations need to continue operations during or shortly after a crisis. Some document legal and financial status, such as contracts, patents, deeds, x-rays, laboratory notebooks and blueprints. Others preserve the rights of stakeholders. Still others are one of a kind items with historical significance. Vital records are often physical records, such as paper or film. And, as detailed in the following section, every organisation has a uniquely defined set of business critical information.
YOUR BUSINESS CRITICAL INFORMATION
Identifying records that are truly business critical is the first step in the preservation process – and that determination will differ from organisation to organisation.
When approaching the process of defining business critical information, it’s best to start with your organisation’s mission and use that as a guide. After all, you cannot afford to collect, label and treat everything as critical – you must place your limited preservation resources where they are most needed. So, it’s incredibly important to think about the elements that define and embody that mission – and therefore require long term reservation.
Ask yourself the following:
- What’s important to carry forward for the historical record? What do you want the future to know about your organisation?
- What legal or regulatory requirements govern your organisation and what records must be retained to comply?
- Will your organisation be able to re-use or repurpose items in the future? (Think about the remastering of movies and sound records using DVD and CD media as an example. Is there potential for something similar in your business?)
- What records must be preserved to protect the rights of employees, customers and shareholders?
- What needs to be preserved to ensure the continuity of business operations?
- What would the consequences be if certain classes of records were lost?
- What would your organisation be unable to do without them? Could normal functions take place?
- Can the records be replaced or reconstructed? At what cost? Experience shows that if you don’t take this top down approach beginning with examining the mission, you’re at a distinct disadvantage – with little basis upon which to determine what’s important and create a plan.
HOW BUSINESS CRITICAL INFORMATION PRESERVATION IMPACTS ORGANISATIONAL RISK
Once you’ve done the difficult work of thinking through your organisation’s mission and using that to define which records are critical, tactical decisions about how to protect them are much more straightforward. Your focus should be on minimising and avoiding the risks associated with inadequate protection of business critical information. And, the key here is preserving access to, and usability of these records.
Without proper preservation, records degrade over time and may be lost forever. The impact on your organisation can be severe. Consider the following risks:
- Loss of use, including the inability to produce business critical information during litigation or reuse/repurpose the record to bring additional revenues into the organisation.
- Costs associated with the outright loss or recovery/repair of improperly stored records. Paper may turn brittle and yellow, photographic images may fade, and film based dyes can fade, become distorted and shrink from “vinegar syndrome.” There’s no time to waste – materials are degrading while you are putting a plan in place.
- Costs associated with these types of loss will depend on the seriousness (or extent) of damage.
- Damage to corporate reputation, particularly in cases where shareholders have a reasonable expectation that records should have received the highest levels of protection and security.
- Negative impact on business continuance where inadequate analysis has been done to identify the probability of damage or loss of information and its impact on the business.
- Inability to comply with European, central and local government regulations and mandates, including the Freedom of Information Act (2000 and Scotland 2002), the Data Protection Act (1998), and the increased corporate and personal liability associated with such failures.
- Increased exposure during litigation due to the inability to produce requested documentation throughout the discovery process.
BUSINESS CRITICAL INFORMATION STORAGE
Once you’ve identified your business critical information and know what materials must be preserved, the next step is determining the best way to care for them. Storage is the single most important factor determining the useful life of modern information media. Many organisations use off-site storage for records management. These sites are secure, accessible and offer the required redundancy. And, they are perfectly adequate for standard record retention. However, when it comes to business critical information – records of which long term survival must be ensured – traditional storage approaches are inadequate. Room temperature storage with unregulated humidity levels does not afford the special protection needed for business critical information. As noted earlier, in uncontrolled environments with variable room temperatures and relative humidity levels, paper turns brittle, ink fades and plastics may degrade quickly. In addition, standard storage does not afford maximum protection from catastrophic loss due to natural or man made disasters, including fire, floods and earthquakes. And, in many cases, it does not offer the highest levels of security needed for irreplaceable originals, such as works of art or special documents.
Proper preservation of business critical information calls for a storage solution that provides the following highly specialised features:
- Controlled environments tailored to meet the special requirements of the materials to be preserved, most importantly highly stable temperatures and relative humidity
- Temperature options should range from 18 to 24 degrees Celsius
- Relative humidity options should range from 20 to 50 percent
- Advanced gaseous fire suppression systems to eliminate the risk of water damage
- Multiple levels of security, including 24/7 access control
- Computerised transaction control systems that provide flexible access and chain of custody control to ensure security
- Optional low particulate and contaminant environments via High Efficiency Particulate Air (HEPA) and gas filtration
TRADITIONAL STORAGE SOLUTIONS
- Improve business continuity with secure, off site records storage
- Reduce the costs associated with storing and administering records on site
- Provide 24/7 access to records
- May include:
- Records indexing and retrieval capabilities at the box, file or document level
- Highly secure transportation and destruction services
- Inadequate environmental controls – temperature and humidity levels - don’t offer the protection needed for long term record preservation and/or protection against the risk of mould and mildew in certain climates
- More susceptible to disasters, such as fire, floods and earthquakes
BUSINESS CRITICAL INFORMATION STORAGE SOLUTIONS
- All of the advantages of traditional storage solutions, plus:
- Improve long term preservation via controlled temperatures and humidity levels and “bulletproof” facilities
- Provide additional levels of security to guard against theft of sensitive or one of a kind objects
- More costly than traditional storage – but that cost must be weighed against the risks associated with the loss of improperly stored business critical information
IMPLEMENTING YOUR BUSINESS CRITICAL INFORMATION PROGRAM
When it comes to business critical information, every organisation has three options:
- Do nothing. Business critical information is treated the same as standard information. The information is accessible – for now… maybe. This is the least expensive and highest risk alternative
- Create a partial plan. Some information is protected with various solutions, such as duplication, dispersal and controlled storage. This hit or miss approach may actually incur more risk, because some people and areas of the organisation are afforded more protection than others.
- Develop a clear business critical information programme. Business critical information is identified, assessed and protected using the approaches identified in this paper. This option takes a strong corporate and financial commitment, yet reduces risk and maximises protection for the organisation in the long term.
To develop a successful business critical information programme – and protect that magic five percent of records your organisation cannot function without – take the following steps:
- Identify. Using your organisation’s mission as a guide, determine which information is business critical.
- Assess. Evaluate the materials this information comprised of and their current condition.
- Research. Given the materials and their condition, investigate the best approaches and optimal conditions for long term preservation. The Image Permanence Institute offers many helpful resources for doing so—at little to no cost, including:
- IPI Media Storage Quick Reference
- IPI Storage Guide for Acetate Film
- A Consumer Guide to Traditional and Digital Print Stability
- The Storage Guide for Colour Photographic Materials
- Document. Identify the processes, develop the associated business case and obtain organisational buy-in to ensure support for long term business critical information preservation.
- Protect. Implement your business critical information programme, including:
- Protective storage using the most secure, environmentally safe and economical means
- Duplication and/or dispersal with geographic separation
- Reassess. Continually monitor programme effectiveness and periodically revisit your mission to ensure that business critical information is identified in light of ongoing changes.
The lack of a sound business critical information preservation programme can be a real Achilles heel for an organisation – exposing it to considerable financial, compliance and business continuity risks, as well as potential damage to its reputation. There’s also a huge potential to miss out on long term business opportunities that cannot yet be envisioned. Consider the current demand for older movies remastered on new formats, such as DVDs. At the beginning of the motion picture industry, companies failed to see the value of preserving original film masters. As a result, many of those originals have turned to dust – and untold millions of dollars in revenue have been lost.
No one can predict the future, but there’s a strong case to be made for preserving the untapped potential in your business critical information. What’s needed is a careful comparison of the business impact and risks from doing nothing to the mitigation costs associated with a well designed and properly executed records management and storage programme. By taking a proactive approach to business critical information identification and protection, forward thinking organisations are making a sound investment in the future that can pay off in the decades, and even centuries, to come. Be a visionary – preserve your business critical information.
Share this post