Information governance

Records management deals with the creation, retention and storage and disposition of records. A record can either be a physical, tangible object, or digital information such as a database, application data, and e-mail. The lifecycle was historically viewed as the point of creation to the eventual disposal of a record. As data generation exploded in recent decades, and regulations and compliance issues increased, traditional records management failed to keep pace. A more comprehensive platform for managing records and information became necessary to address all phases of the lifecycle, which led to the advent of information governance.[5]

In 2003 the Department of Health in England introduced the concept of broad-based information governance into the National Health Service, publishing version 1 of an online performance assessment tool with supporting guidance. The NHS IG Toolkit[6] is now used by over 30,000 NHS and partner organisations, supported by an e-learning platform with some 650,000 users. In 2010 Logan and Lomas took up the theme of IG more holistically, publishing on how different disciplines needed to come together to better manage information. Lomas produced teaching in this domain, with Smallwood later providing a key textbook in this domain.

Professionally, in this context 2008, ARMA International introduced the Generally Accepted Recordkeeping Principles®, or "The Principles" and in 2015 the subsequent "The Principles" Information Governance Maturity Model.[7] "The Principles" identify the critical hallmarks of information governance. As such, they apply to all sizes of organizations, in all types of industries, and in both the private and public sectors. Multi-national organizations can also use "The Principles" to establish consistent practices across a variety of business units. ARMA International recognized that a clear statement of "Generally Accepted Recordkeeping Principles®" ("The Principles") would guide:

• CEOs in determining how to protect their organizations in the use of information assets;
• Legislators in crafting legislation meant to hold organizations accountable; and
• Records management professionals in designing comprehensive and effective records management programs.

Information governance goes beyond retention and disposition to include privacy, access controls, and other compliance issues. In electronic discovery, or e-discovery, relevant data in the form of electronically stored information is searched for by attorneys and placed on legal hold. IG includes consideration of how this data is held and controlled for e-discovery, and also provides a platform for defensible disposition and compliance. Additionally, metadata often accompanies electronically stored data and can be of great value to the enterprise if stored and managed correctly.

With all of these additional considerations that go beyond traditional records management, IG emerged as a platform for organizations to define policies at the enterprise level, across multiple jurisdictions. IG then also provides for the enforcement of these policies into the various repositories of information, data, and records.

A coalition of organizations known as Electronic Discovery Reference Model (EDRM), which was founded in 2005 to address issues related to electronic discovery and information governance, subsequently developed, as one of its projects, a resource called the Information Governance Reference Model (IGRM).[8] In 2011, EDRM, in collaboration with ARMA International, published a white paper that describes How the Information Governance Reference Model (IGRM) Complements ARMA International’s Generally Accepted Recordkeeping Principles ("The Principles")[9] The IGRM illustrates the relationship between key stakeholders and the Information Lifecycle and highlights the transparency required to enable effective governance IGRM v3.0 Update: Privacy & Security Officers As Stakeholders.[10]

In 2012, Compliance, Governance and Oversight Council (CGOC) developed the Information Governance Process Maturity Model, or (IGPMM).[11] The model outlines 13 key processes in electronic discovery (e-discovery) and information management. Each process is described in terms of a maturity level from one to four – completely manual and ad hoc to greater degrees of process integration across functions and automation.[12] In 2017, it was updated to include an emphasis on legal, privacy, information security, cloud security issues[13] and evolving data privacy concerns, including the impact of The General Data Protection Regulation (GDPR)(EU).[11]

In the past, records managers owned records management, perhaps within a compliance department at an enterprise. In order to address the broader issues surrounding records management, several other key stakeholders must be involved. Legal, IT, and Compliance tend to be the departments that touch information governance the most, though certainly other departments might seek representation. Many enterprises create information governance committees to ensure that all necessary constituents are represented and that all relevant issues are addressed.[14]

In past decades, information governance responsibilities might have fallen under the purview of the chief information officer (CIO). But somewhere along the line, the CIO job description changed to focus solely on the information systems and associated technology that power a company—not the information itself.

In today's age of big data, organizations have more information under their control than ever before.[15] To extract the maximum value from that data while simultaneously protecting an organization from its associated risks, business leaders have turned toward the CIGO because of the role's independence from other departments. CIGOs are tasked with neutrally balancing the needs of all departments with respect to an entire organization's top priorities.[16]

Though the position is an emerging one, support for the CIGO continues to rise as business leaders increasingly understand the implications of information governance (and more importantly, the lack thereof). While many organizations have information governance projects in place, such initiatives are much more likely to succeed with top-down management.[17]

Since the CIGO is a relatively new position, the role's responsibilities are not set in stone and continue to evolve. For the most part, today's CIGOs:

• Manage all of an organization's information, tapping into as much value from it as possible (e.g., better-targeted marketing) while reducing exposure to its associated risks (e.g., lawsuits)
• Coordinate information governance efforts across all stakeholders within an organization
• Prioritize the information-related needs of all departments
• Advocate for those needs on behalf of relevant stakeholders
• Collaborate with the various information governance facets to continually improve processes
• Identify and execute information-related synergies
• Expunge non-critical data

• The Foreign Account Tax Compliance Act, or FATCA[23]
• Payment Card Industry Data Security Standard, or PCI Compliance[24]
• Health Insurance Portability and Accountability Act, or HIPAA[25]
• Financial Services Modernization Act of 1999, or Gramm–Leach–Bliley Act (GLBA)[26]
• Sarbanes–Oxley Act of 2002, or Sarbox or SOX[27]
• Federal Rules of Civil Procedure
• California Consumer Privacy Act, or CCPA[28]

• General Data Protection Regulation
• NIS Directive

• Data Protection Act 2018
• General Data Protection Regulation - GDPR will be incorporated directly into domestic law immediately after the UK exits the European Union
• NIS Regulations - The EU NIS Directive was transposed into UK law by DCMS, in May 2018 via the NIS regulations.[29]

• New Information Governance ISO regulation - ISO 24143