Digital Landfill

8 Information Management Security Predictions for 2010

Arthur Hedge is the President of Castle Ventures LLC, an Information Security consulting firm.  Arthur is active on several AIIM standards committees and is on the board of the AIIM Garden State Chapter. 

Arthur is a member of OWASP, ISSA, and a Certified Information Systems Security Professional.

8 Information Management Security Predictions for 2010

1 -- Someone will develop an alternative to the PDF file.

With all of the security issues that have plagued the Adobe PDF format due to its use of JavaScript, someone will come up with a new, safer, long-lasting document format.

2 -- To improve security companies will increase the use of cloud-based document storage.

For many small and mid-size organizations the promise of a more secure facility offered by cloud service providers will drive them to increase the use of third party solutions for document storage.  This will be driven the by the economies of scale that the cloud providers can generate.

3 -- To improve security some companies will avoid cloud storage.

Yes, this seems like a contradiction to the previous prediction, but larger organizations will react differently to cloud computing. There are two key drivers. First, as the clouds grow in importance they will become more of a target. Researchers at UC, San Diego and MIT have already demonstrated a theoretical attack on the Amazon infrastructure. Secondly, litigation fears will increase. For example, Google is repeatedly subpoenaed for information. A cloud provider is far less likely to go to the mat to defend the privacy of documents than the organization that owns them. Some organizations, especially large multinationals, will be afraid to keep documents in an environment where a government can get access to that information via the simple threat of a subpoena.

4 -- Hacked email scandals will increase.

Hackers tend to be copycats. In light of all of the publicity generated by the theft and release of the emails in “Climategate” scandal involving the Climate Research Unit at the University of East Anglia, the hacker community will increase its efforts to breach other politically sensitive organizations. As that makes news a vicious cycle of attacks will begin.

5 -- The cyber security czar will not directly affect the enterprise content management (ECM) market.

In December of 2009, President Obama named Howard Schmidt as the White House cyber security coordinator. My guess is that his focus will be on big-picture threats to the United States that will not drive any changes in the short run to the ECM market.

6 -- State privacy regulations will drive security efforts in the ECM space.

The Commonwealth of Massachusetts’s regulations on personal information go into effect on March 1, 2010. This will lead to other states following suit and the requirements for businesses to better protect personal information will continue to increase.

7 -- A celebrity will have their Electronic Medical Records hacked.

With the drive to move more and more medical records into an electronic format, the temptations for rogue computer users to access patient information illegally will grow, leading to a high profile release of a celebrity’s medical history.

8 -- Document integrity will grow in importance.

With the increasing publicity shed on breaches, someone in 2010 will release documents that are forged.

-----

Some other posts worth considering...

• 8 things you need to know about information risk 
• 8 things you need to know to build an ECM strategy 
• 8 things you need to know about developing an ECM information architecture 
• 8 things that changed the history of document management 
• 8 things you need to know to manage the explosion of information  
• 8 things you need to know about workflow and business process engineering   
• 8 things small businesses need to know about document management 
• 8 things you need to know about using ECM for regulatory compliance

  

8 Reasons to Consider a Document Management Service Company as Part of Your Information Strategy

Document Management Service Companies are the Rodney Dangerfield of the ECM industry -- they just don't get no respect. Or maybe a better way of saying this is that they are the great hidden treasure of the document management industry.

We've done some 8 things postings by guest bloggers on many topics, but none have adequately covered the case for working with a service bureau.  Last year, Mitch Taube from Digiscribe talked about the 8 things you should look for in a document management service provider. The piece was very insightful in helping end users sort through how to choose among service providers. 

But that begs the question of why an organization would think about working with a document management service company or service provider in the first place. 

So I thought I would post my opinions on the role that Service Companies play, with a little help from some of the experts in the space (listed at the bottom of the post).

Any resemblance between me and Rodney Dangerfield is purely accidental.

8 Reasons to Consider a Document Management Service Company as Part of Your Information Strategy

1 -- The modern service company ain't your father's service bureau.

Because service companies have been a part of the document industry for so long, sometimes there is a preconception that they are not skilled in the latest technologies. Nothing could be further from the truth. The modern service company offers a wide portfolio of services -- outsourced scanning, software sales, and the professional services to tie everything together. There are many organizations for whom document management is not a core competency -- nor should it be. A service company can fill this gap, and do so with a guarantee that the parts will fit together.

A professional service company has probably seen every size and type of document known to organizations today.  They have a wealth of experience is solving problems in all industries and can often suggest a better solution than what a company may develop internally.  The service provider is constantly in touch with business partners that have new solutions that can be applied to old problems.

2 -- On the other hand, it very likely COULD be your father's service bureau -- and that's not a bad thing.

Unlike many companies that have only been in the information management business for years -- or months -- many service companies in the document industry have been around for decades. Many got their start in the microfilm business. One of the best events AIIM does is an annual Executive Forum for owners and senior executives of service providers. This event has been in existence for more than 30 years, and is more successful than ever. 

In an industry with many fleeting connections, this longevity and commitment -- within the industry and within local communities -- is a valuable asset. It provides a guarantee to end users that they will have a stable and committed partner so that they can focus on their core business.

3 – The information management landscape is changing rapidly.

Partnering with a progressive and quality document management company will provide you the peace of mind that comes with knowing where the land mines are also allow you to concentrate your efforts on your core business development. The nature of the conversion business dictates that you must continually update software and hardware offerings to stay current with the latest technology.  Corporations attempting to do their own scanning and information processing are not going to update software and hardware anywhere near the regularity of a full-service conversion partner.

4 -- This document stuff just ain’t what you wanna do for a living.

What are the questions that should be asked by any business to determine if a function is a core competency? If the answer to any of these three questions is “no." you should seek to outsource the function. 

• If my organization was started today, would we do it ourselves or contract it out?
• Could we do it so well that others would hire us to do it for them?
• Will future leaders of my organization come from this skill set?

For most companies looking at either large backfile capture projects or ongoing scanning, the answers to ALL of these questions is “no." If the job ain’t one you wanna do and DO RIGHT, you should look for a company for which this IS their core competency!

5 – Service companies do way more than just scanning.

These days most service bureaus offer much more than just scanning. They actually offer solutions to client business problems, and in this day and age that is what clients should be looking for in a service bureau. This might come with consulting with the client on how to index the scanned documents for easy retrieval, offering a document management system, offering a capture solution or e-forms package. All of these are offered to the client to make their job more efficient, and in the end be more productive and drive down the cost of doing business. 

6 -- It’s the security stupid!

We are continually reminded of the importance of protecting confidential information and personal identification that is often found on the documents being converted.  A professional document conversion company will be SAS 70 Type II Certified and PCI DSS Certified, and will often be in compliance with new data privacy laws being enacted at the state level.  These requirements mandate items like background checks on all employees, CORI investigations, 24X7 building security from an outside agency, multiple building entrance requirements and detailed procedures for chain of custody when customer documents are in their possession.

7 -- Your staffing requirements fluctuate. 

Dealing with multiple clients and a variety of application solutions allows the professional service company to maintain a qualified staff and distribute the workload appropriately.  Companies that try to maintain an in-house scanning operation must deal with personnel issues, promotions, absent staff, etc. that will disrupt the orderly conversion of documents and data because this is not their core business.

8 -- What's worse than no document management system? A document management system with nothing in it!

We frequently find end users who spend an enormous amount of effort to select a document or ECM system, but next to no thought or planning on actually getting information into that system. The last thing you want to do with your brand spanking new document management system is spend precious staff time doing backfile conversion. Leave that to the professional and focus on your business.

-----

If you are an executive at a Service Company or Systems Integrator, you need to get AIIM's Document Management Service Provider Executive Forum on your calendar. The event will be November 4-6 in Nashville, and I can personally guarantee that you won't go to a better event this year. Check it out.

Thanks to AIIM immediate past chair Bob Zagami and to the following members of our Executive Forum planning committee who helped with this post:

• Chris Kelley, DataChambers Records Management
• Paul Engle, VeBridge Document Management Services
• Bob Zagami, DataBank
• Rich Seery, Seery Systems Group
• Also check out Bob Zagami's article, Managing Outsourced Conversion Services from Infonomics

Have you downloaded our free e-books yet?

SharePoint survey slides -- feel free to use them -- more where these came from

 From the land of snow, came across a few Powerpoint slides from our surveys by my colleague Doug Miles. These particular ones focus on SharePoint. But they are just the tip of the iceberg. Or in the case of our current weather, the tip of the icicle.

Here is where you can download the slides. Use 'em in your presentations. No charge.

AIIM does a regular series of user surveys. They aren't market sizing surveys or magic quadrants or Waves. Intentionally. They focus on how users perceive content technologies, how they make decisions about these technologies, implementation obstacles they encounter, and ROI received. 

This previous post -- 51 Fast Facts -- will give you an idea of what is available.

We have lots more. Here's how to get the information. Use it in anything you want. All we ask is attribution.

First, you can download the reports directly from the AIIM web site. You will need to register if you haven't already done so, but that's it.

Alternatively, ping Doug Miles directly. He can get you what you need in terms of slides/graphics for presentations or for press stories on the content and records industry.

    

Checklists for effective content and records projects -- Chime in!

Greetings from the Nation's Snowbelt. About 40-45 inches on the ground.

I put together this rough list of lists for a lecture I did for some college students.

What's missing? What's redundant? Chime in via comments -- I'd love to hear your thoughts.

8 Factors to Consider in Creating an Information Management Strategy

1. Don't underestimate the importance of your platform choices: The choices you make have a long tail.
2. A good starting point: Focus on paper.
3. Collaboration without structure is a waste of time.
4. The need for control is not going away.
5. In a tight economy, nothing flies unless it can deliver process efficiency and automation.
6. In making choices, think knowledge workers, not document specialists.
7. You need a plan.
8. Failure to address change management can make everything else moot.

Platform selection checklist

• What business objectives are you really trying to accomplish (both short and long term)? How will you measure them?
• How does your organization value the various types of ECM functionality?
• How well does your platform perform MOST important functions?
• How much is out of the box and how much is through custom integration?
• What IT competencies exist in your organization?
• What needs to integrate with what?
• Are you willing to consider open source and SaaS solutions?
• How comfortable are you with reliance on a particular vendor "stack?”

Scanning and capture checklist

• What types of documents do you need to scan?
• How many documents do you need to scan?
• Do you need color? B&W? Grayscale? How much resolution? Both have storage implications
• Are you doing backfile conversion (how far?) or day forward?
• What are you going to do with the paper when you’re done?
• How much scanning (or which parts) do you really want to do yourself?
• Are you trying to create an archive or drive a process? Or both?
• Have you thought through the training issues for distributed capture?

Collaboration checklist

• Create a policy document that defines how your organization will approach networking/collaboration.
• Cover both inside and outside the firewall.
• Define roles and responsibilities in business and HR terms, not technology.
• Be minimalist – don’t try to cover every single situation.
• Define retention requirements. What do you want to save? What MUST you save?
• Train people as to what is expected and in what situation.
• Integrate tools into everyday workflow. Don’t just bolt this on.
• Encourage spread of collaborative tools organically, not by mandates.

Risk management checklist

• Is all critical information being captured?
• Are the right disaster and data recovery processes in place?
• Can you locate and produce records and prove they are unaltered?
• Do you have a strategy for metadata?
• Can you control who can access what?
• Is there redundancy in your system?
• Can you easily find information?
• Have you considered ALL aspects of long-term preservation? – People, hardware, software

Process improvement checklist

•  Start with something important, but manageable. Document-intensive processes are everywhere.
•  Identify the BUSINESS problem you are trying to solve.
•  Identify and engage the BUSINESS stakeholders.
•  Don’t simply try to automate a poor process -- a bad idea.
•  Document the current process and verify.
•  Define the new document-enabled process and verify.
•  Market your successes. Document your benefits.
•  Be iterative. Don’t try to solve everything all at once.

Knowledge worker productivity checklist

• Can your people organize and share information in ways that help them work smarter and faster?
• Is it easy to find whomever or whatever is needed to work smarter and faster?
• Is the right information available, in the right way, in the right amount?
• Is corporate-built stuff (like IT, training, and support) easy to use?
• Does the corporate-built stuff provide what is needed, as fast as it is needed?
• Are staff resources used wisely and effectively?
• Is the system separate from or integrated with “normal” work?
• Only control what MUST be controlled.

Planning checklist

• Have you built a business strategy and blueprint?
• Has the strategy been embraced by senior management?
• Has the blueprint (including both capital and people requirements) been embraced by senior management?
• Have you assessed your current technology state and built a roadmap for the future?
• Have you created a governance structure and approach?
• Have you defined a specific initial project and built a plan?
• Assuming initial success, how will you communicate and build upon that success?
• Do you have a change management plan?

Change management checklist

• Do you have top level support?
• Are you planning to start small and build?
• Do you have an internal PR and communication plan?
• Have you created user personas?
• Are you focused on technology or process?
• Have you systematically involved users and business owners?
• Are you using the tools themselves (i.e., collaboration) to overcome resistance?
• Do you have a training plan – and also a plan for what happens after the formal training is done?

What's missing? What's redundant? Chime in via comments -- I'd love to hear your thoughts.

8 Ways IT Politics Can Wreck a SharePoint Project

 This is another in my 8 things series. And another anonymous posting to protect the innocent (and the guilty). I can vouch for the credibility of the author, but am sworn to protect his identity. This article focuses on the obstacles encountered by external consultants as they work to implement a SharePoint project -- and how they can avoid these pitfalls.

The posting was inspired by a previous popular one by an anonymous end user (Mona Lisa), 8 Ways to Kill Your ECM Project. 

Before consulting on any SharePoint project, a little detective work on the IT department can really pay off. One reason for this is that SharePoint has the reputation for being a "disruptive" technology. Let's deconstruct what this term means with respect to IT office politics before getting to the wrecking strategy detailed below.

First, we must acknowledge that SharePoint doesn't really fit any of the standard categories used to manage IT applications. It's not an ECM system in the sense of being exclusively focused on that function alone, though it can be used to manage content. It's not a search engine, though it can search across many types of content. It manages web content, but it manages lots of other content too. And finally, the straw that we always grasp at, it's a "collaboration" platform which is fuzziness itself when bean counters try to measure its ROI.

The ability of SharePoint to break IT boundaries is often at the root of the fear and loathing it inspires. For many, SharePoint challenges the inherent constraints that give IT processes whatever security and predictability they currently have. SharePoint lays bare these constraints, or, more diplomatically, standardized controls, in a way that often causes IT pros to deploy passive-aggressive strategies that sabotage their own ship. These strategies resemble those carried out by those disgruntled French railway workers who brought the whole train system to its knees simply by following a few neglected bureaucratic rules, like carrying out thorough bridge inspections before any bridge could be crossed.

It's a form of organizational jui-jitsu designed to stall projects that threaten the IT comfort zone. So, what are the key practices that foster such disasters? First, couple of definitions. The "infrastructure team" means the permanent enterprise operations staff. The support team signifies the permanently staffed technical personnel that supported and maintained enterprise applications, as well as developed new functionality during on-going projects as assigned by management.

So what are the most likely mistakes that are made in dealing with internal IT staff?

8 Ways IT Politics Can Wreck a SharePoint Project

1 -- Use a non-technical term to describe your server when conversing with the system administrator.

It takes only one mistake like this to land you in the same bin as project managers and sales people -- those who have to be heard but never listened to. If you find that your emails no longer get responses, even when you request specific operations, this may be the reason. Once you are marked in this way, it will take much more effort than is available in a high-pressure SharePoint project to get you out of the bin.

2 -- Imply that network issues may be the root of SharePoint performance problems.

Performance and stability issues always move the project team into the bulls-eye of suspicion. 

Who knows what can happen once untested code leaks out. And aren't you the same goof-ball that already confirmed your lack of systems knowledge? What an interesting idea you have. We'll discuss it among ourselves at the next Change Board meeting and get back with you.

The solution to this dead-end is to find a procedure that allows you to identify the network bottleneck. Unfortunately, this means troubleshooting a network that you played no part in setting up and whose documentation is safe from your prying eyes. Fortunately, the system administrators will usually realize at some point that the network really is the issue and come up with a fix, usually right after you have lost 5 days of project time searching for nonexistent object disposal errors.

3 -- Explain to IT that SharePoint is a single application rather than a collection of separately maintained applications.

Because of the way application boundaries are drawn, it is often impossible for IT to comprehend that SharePoint sites are not separate applications. They are polite, but they plainly don't believe you when you say that separate sites all share the same database, security, components, and configuration files and really don't require completely separate sets of architectural documentation. 

Such documentation, you say, would merely repeat the same descriptions over and over again for each separate "application." They nod their heads, smiling that smile that says, "We understand how lazy you developers are, and we sympathize, but we can't make an exception for you just because this will result in a monumental waste of time and eat into the functionality you are required to create for your customer."

4 -- Involve the support team in the detailed design of your SharePoint solution.

Though infrastructure and support people may have no SharePoint experience, they often insist on being included in the detailed design of your solution. During these discussions, they will ask penetrating questions such as "Have you thought about what will happen if documents are added to the system?" or "What will happen if users don't use the system the way you trained them to?" This latter question is always asked with a menacing glare that suggests that you have failed to devise a sufficiently severe method for punishing disobedient users.

5 -- Form a governance committee by getting your developers to convince end users to join.

Professional .NET developers tend to have the social skills of Vlad the Impaler. However, if the project managers don't accept the responsibility to form a governance committee and the business owner doesn't have time to do it and it's not the IT department's responsibility to help (in any way), then it's up to Vlad or Vladessa to add this vital ingredient for any successful SharePoint project. Vlad's RESTful web services are likely to be much more effective than the results of this assignment.

6 -- Make sure that high-level team managers never communicate with each other.

If managers don't communicate about what their teams are doing, then everyone feels less threatened and can carry out their jobs with lots more "Cheers" at the ends of their emails. So be sure to identify the most-overworked developer on your team, the one who does most of the actual work of creating solutions, and assign him or her lots of extra communication tasks. Use any means necessary to keep his or her attention off improving the quality of the code so that they are not such narrow and dull bar companions. By pushing communication duties down the chain, you ensure that those with the least overall sense of company dynamics have the most influence. And in a double win, you ensure that no synergies between teams can be leveraged.

7 -- Make sure no one on the support team has time to read project documentation.

The less they know about your project, the easier it will be to criticize. Therefore, since the goal of the support team is duplicate as much existing functionality as possible, keep them so busy on competing projects that they can never learn the project's applications. That way, when they're asked to support it, they'll have the ironclad excuse that they are too busy on another project that meets the same requirements already implemented by the SharePoint project team. Customers love to hear that the expensive project they just paid for needs to be redone correctly.

8 -- As soon as the support team sees that SharePoint is gaining acceptance, set up as many competing projects as possible.

Nothing succeeds like success. If users like the functionality SharePoint provides, then they'll like it even more if it's provided on an obscure, unfriendly platform that only the support team can maintain. Therefore, do development the right way by dividing up the previously delivered SharePoint functionality into parts that fit neatly into your pre-determined IT application types and make each new application into a six month's project. That way you'll prove to those cowboys on the project team the value of proper controls.

So what are the lessons derived from this disaster?

1. Get buy-in early from the infrastructure team by anticipating their questions and concerns and making sure that they hear your questions in their language.
2. Clearly communicate the infrastructure requirements, expectations for operational support, and other project issues. Get the necessary feedback about key project enablers such as network support. The time to identify network issues is at the beginning of the project, not the morning after the first release to production.
3. Demonstrate how SharePoint works by giving the support team a virtual image that they can study to attain the necessary comfort level with what your team is producing. Once they begin to buy into to the SharePoint model, whole categories of bureaucratic meddling can be eliminated.
4. No matter how busy you might be on project work, communicate and over-communicate with the support team, but do it in a way that maximizes both of your strengths. Your strength is your detailed knowledge of the team product. Their strength is their knowledge of the organization and the history of previous projects and what it takes to support them.
5. Governance is not only crucial to a successful SharePoint implementation, but it can be a major enabler of user commitment to the platform. Having said that, the politics involved in gathering together a worthwhile working committee are often beyond the influence of anyone on the project team. The lack of commitment of organizations to governance best practices is one of those issues inherent to the way modern corporations are structured. In most cases, the best hope is that one of your team is persuasive enough to make someone at the C-level support the initiative. Governance is something they understand and service on the governance committee can be rewarded in many ways.
6. Lack of communication between team leaders is very difficult to remedy at the lower levels. Someone needs to coordinate across teams to ensure that they are not competing with each other in a destructive way.
7. Rather than creating voluminous documentation, find ways to demonstrate the product through demonstrations. In the modern IT environment, the chances of anyone reading project documentation other than in an emergency are close to nil.
8. Make sure that the support team understands that your project will add to existing applications - not replace them. Your team's very existence may be interpreted as a sign of inadequacy. A persuasive case must be made that your team has been brought in to add new functionality that can best be provided by the SharePoint platform - and that the support team can use this as an opportunity to expand their skill set. Any planner worth his or her salt will make sure they thoroughly appreciate this.

Some other posts that may be of interest...

• 8 things you need to know about SharePoint governance 
• 8 things SharePoint 2010 needs to be a true ECM system  
• 8 more things you need to know about SharePoint 
• 8 things to consider when implementing SharePoint with another ECM engine 
• 8 ways to use SharePoint for social computing 
• 8 things you need to know about automatic classification and metadata tagging in SharePoint 
• 8 things to do to make content more findable in SharePoint 
• 8 ways SharePoint help in Enterprise Governance, Risk and Compliance 
• 8 things to consider when selecting an application to scan or capture into SharePoint 
• 8 Ways SharePoint 2010 Moves Toward "ECM for the Masses" 
  
• 8 Things You Should Know About Transactional Processing in SharePoint 
  
• 8 Ways To Benchmark Your Collaboration Strategy

Underappreciated social networking tools

Underappreciated social networking tools

Our survey of 332 business and organization document, records, and information management social activists indicates -- not surprisingly -- that the public social tools most useful to achieving organizational objectives are LinkedIn (54.2% of those using describing it as "very useful" or "critical"), Twitter (39.8%), and LinkedIn groups (36.9%).

In the underappreciated but effective category are InformationZen (http://www.informationzen.org) and Slideshare (http://www.Slideshare.com/jmancini77). 29.0% of Zen users describe it as "very useful" or "critical" and 28.6% of Slideshare users do similarly. The problem is that these tools are only used by about 30% of the participants in the survey.

The Zen result highlights a particular challenge for many "specialist" social sites. Once someone is there, they tend to value the experience. But getting a critical mass of participation in niche groups is a challenge. 

On the other hand, there is a large critical mass on LinkedIn groups (like our AIIM Network with 8,000 members), but the content on many LinkedIn groups is increasingly marketing centric, at times bordering on spam. The natural potential organizers of LinkedIn groups (e.g., associations!) often give it minimal support because there is no way to integrate LinkedIn to the vast content that exists on their "regular" sites.

As I've said before, making the activity feed for LinkedIn groups and subgroups to the owners of the groups would be a really smart strategic move for LinkedIn. It would combine the benefits of niche expertise with critical mass.

Other posts on this survey that may be of interest.

• 30% use Twitter for BUSINESS networking at least once per day
• LinkedIn could be the ultimate business social platform winner. COULD be.

BTW, it's snowing a ton once again in DC on top of the 30 inches from last weekend. Our apologies for any AIIM gaps in service along the way. DC was not made for snow!

[Note: The survey was targeted at current LinkedIn, Facebook, and InformationZen participants, as well as readers of the Digital Landfill blog.  The intent was to focus on business use of social media tools outside the firewall by users, suppliers, and consultants in the information management space.  The survey was conducted in February 2010 and had 332 respondents. Feel free to reuse any statistics with the attribution "AIIM, http://www.aiim.org"]

Another 8 Things That Make SharePoint 2010 a True ECM System

 Boyd Collins is a senior consultant with the Enterprise Content Management practice for SAIC. He has over 15 years of Web development experience for a wide variety of corporations, including super major oil and gas companies, Continental Airlines, and Reliant Energy, and many others. Currently, he is implementing a company-wide content management system for a major pipeline company.  His current area of practice is content management systems using a variety of platforms, Web site usability and information architecture. He obtained a master's degree in library and information science from the University of Texas at Austin.

Believe it our not, I had two submissions with this same title! For those that missed the first, Greg Clark's excellent submission is located HERE. 

 [Editors note: I'll soon be publishing an e-book compiling all of the SharePoint blog submissions. I have enough content now on all of the aspects of SharePoint 2010 that make it different from MOSS. If there are any END USERS who would like to share their implementation experiences and lessons learned and "things that I know now that I wish I knew then" I'd love to hear from you and include in the e-book. Keep in mind that if you can't comment publicly, I can publish you anonymously. See the very creative 8 Ways to Kill Your ECM Project for an idea of how to go about it. And I'll never tell. Promise.]

Before SharePoint 2010, Microsoft provided an attractive entrance to its Enterprise Content Management (ECM) edifice, but much of the foundation was missing. During its organic growth over the past eight years, it remained unclear if the SharePoint product architects had really thought through the underpinnings necessary to support a true ECM platform. To many SharePoint pros, it appeared that Microsoft was simply adding new features to the product without tying them together into a unified ECM infrastructure.

With SharePoint 2010, that infrastructure has risen to the surface. In Microsoft Office SharePoint Server (MOSS) 2007, the fundamental unit of content management was the site collection. But even average implementations could have hundreds of site collections. Content types offered an apparatus that might lead to effective metadata management, but the inability to cross site collection boundaries meant that we were still stuck on islands of metadata lost in the oceans of content. Fundamental questions concerning metadata consistency seemed not merely unanswered, but unasked.

With SharePoint 2010, Microsoft appears to be asking the right questions and providing answers that often exceed expectations.

Another 8 Things That Make SharePoint 2010 a True ECM System

1 -- Managed Metadata

Companies often require the use of approved terms from a centrally controlled taxonomy. The SharePoint 2010 response is managed metadata, which is the ability to create, manage, and publish term sets across the enterprise from a single point of reference. Term sets are hierarchical trees, internally connected structures that display parent-child relationships. Term sets and content type galleries are available to any site collection that can securely access the url for the managed metadata service. With the new service structure, we have finally connected the metadata islands into a coordinated lattice of consistent terminology.

2 -- Document Sets

Individual documents often belong to a larger construct that is what the organization really needs to manage. Consider the typical proposal. A proposal is actually an ecology of documentation, containing PowerPoint presentations, Microsoft Word documents, qualifications, case studies and so on. What matters at the end of the process is the complete portfolio of documents. The Document Set allows multiple items to be treated as one in terms of workflow, compliance, and versioning. Versioning is applied to the Document Set as a whole, allowing us to capture snapshots of the version of each document at a point in time in case we need to roll back. Workflows can operate against the entire Document Set to automate the process of integrating component documents into a master deliverable. Each document can be routed to different approvers. As each part passes through the review process, the master deliverable can be assembled from subsidiary workflows spawned during the approvals.

3 -- Document IDs

When a major piece of ECM infrastructure turns up missing, many of the guests in the SharePoint house start staring anxiously at the ceiling, wondering what else might have been forgotten. In MOSS 2007, moving or renaming documents changed their urls because documents were unbreakably tied to the library they inhabited. With SharePoint 2010, documents are free to roam across site collections, secure in their identity, which is now stamped with a unique ID. This is an enabling technology behind Document Sets, since all the component parts must have persistent links. Rather than scattering copies of business records across the site, record content can now represent a single source of truth.

4 -- Content Organizer

In MOSS 2007, content organization was largely a matter of individual upload decisions. Administrators could help guide those decisions, but ultimately, it was up to the contributors to decide where the content ended up. The new Content Organizer allows routing decisions to be centrally organized. It takes these decisions out of the hands of users and ensures that items are well organized. Users are guided to enter appropriate metadata rather than being allowed to dump documents wherever they like.

5 -- Location-based metadata defaults

In MOSS 2007, folders had no function other than to act as dumb containers. "Dumb" here means that they couldn't pass values to their contents or add any help to browsing and searching other than their names. Folders are now first-class objects. Documents and subfolders can inherit metadata from their parent folder. How much easier it is to find documents when metadata is automatically added, instead of forcing users to add the same value over and over to the hundred documents they just uploaded.

6 -- In-place Records Management

MOSS 2007 records management was more a rough draft than a real product. The most noticeable oversight was the lack of support for a usable file plan. Records could not inherit metadata or information policies. You could not route documents to a specific folder in a records library, but only to the records library itself. With SharePoint 2010, folder-based inheritance enables hierarchical file plans to be created in the Records Center (or anywhere else for that matter). We can now create policies that propagate across the inheritance hierarchy for a set of nested folders. In addition, record management can now take place anywhere that the feature is activated and compliance details for any item are only a click away.

7 -- Search

The new search system keeps track of how often search results are clicked on and feeds these metrics into relevance ranking. The more popular the link, the higher it rises in the results list. The new Refinement Panel sorts results into facets such as Author, File-type or Location. Even better, it also organizes the results by metadata attribute such as Proposal, RFP, or Update Notification. It may not be the holy grail of automatic classification, but it makes the benefits of tagging immediately obvious to the user.

8 -- Auditing

In SharePoint 2010, full-featured auditing is as close as the Compliance Details screen, a new menu item added to every document. It brings many useful details to the surface, such as who opened, edited, checked out, moved, deleted or even searched for the document in question.

-----

Though this is only a sampling of the new ECM features, it is enough to respond to the frequently-identified gaps of SharePoint as an ECM platform. Whether SharePoint 2010 will start to eat into the market share of the ECM goliaths is another question. My sense as a long-time SharePoint implementor is that many large organizations are now evaluating SharePoint 2010 as a possible replacement for more high-end platforms, but the decision hangs in the balance at the moment. In the small and mid-size market, despite many worthy competitors, SharePoint has been the default choice of many because its Microsoft Office integration capabilities give Microsoft an obvious advantage. While Microsoft's ship may not sail to the front of this flotilla, it may soon be accepted, grudgingly perhaps, among the major ECM carriers.

Some other SharePoint related posts that may be of interest:

• 8 things you need to know about SharePoint governance 
• 8 things SharePoint 2010 needs to be a true ECM system  
• 8 more things you need to know about SharePoint 
• 8 things to consider when implementing SharePoint with another ECM engine 
• 8 ways to use SharePoint for social computing 
• 8 things you need to know about automatic classification and metadata tagging in SharePoint 
• 8 things to do to make content more findable in SharePoint 
• 8 ways SharePoint help in Enterprise Governance, Risk and Compliance 
• 8 things to consider when selecting an application to scan or capture into SharePoint 
• 8 Ways SharePoint 2010 Moves Toward "ECM for the Masses" 
  
• 8 Things You Should Know About Transactional Processing in SharePoint 
  
• 8 Ways To Benchmark Your Collaboration Strategy

Information governance demonstrates continued merger of unstructured/data worlds

The problem of managing the structured/unstructured convergence will become increasing complex as the volume of information grows. Think about this... The average car will have 100 million lines of code by 2011. The Airbus A380 contains over 1 billion lines of code. 

A recent study from the IBM Institute for Business Value found having superior data governance is critical to success for top performing companies. By a factor of three to one, the study found that top performers were much more sophisticated in their approach to governing organizational information relative to lower performing companies (42 percent versus 14 percent).

On Wednesday, IBM unveiled its information governance strategy and announced new software and services to help companies better govern and drive cost savings from their information. Products announced include InfoSphere Business Monitor, which tracks the quality and flow of an organization’s information and provides real-time alerts of potential flaws, and Optim Data Redaction, which protects an organization’s information by automatically recognizing and removing sensitive content from documents and forms. They also announced an expanded set of services related to information governance.

All of which caught my eye for three reasons.

One is my continued thinking about the world of "ECM" (see previous post on Would an ECM Rose by Any Other Name be this Confusing?) and the increasing fuzziness of where the lines (if they exist) for "ECM" begin and end. The convergence of unstructured and structured information is a key part of this increasing confusion.

Secondly, this whole question of information governance drives toward a key underlying issue associated with content management -- the question of "trusted" information. It seems our traditional definitions of records management increasingly come up short when trying to deal with the torrent of information flowing through our organizations. There is so much information in our organizations that isn't a formal record in the traditional sense of the word, but yet still must be evaluated against some yardstick of trust. And that yardstick is likely a variable yardstick depending on who is relying on the information and the stakes of that reliance.

Lastly, I am conscious of this whole question of information governance and privacy because I got a note yesterday from our former payroll provider, Ceridian, saying that "some of my personal information may have been illegally accessed by an unauthorized hacker." But I guess I should rest assured that only information that was hacked was my "first name, last name, social security number, and in some cases, birth date and/or the bank account that is used for direct deposit of your pay." Yikes. 

30% use Twitter for BUSINESS networking at least once per day...

A new AIIM survey of social media activists in the industry reveals 1 expected and 2 unexpected findings.

 First the expected one. In terms of social networking for business purposes, LinkedIn is the platform of choice at the moment. 30.2% of those from organizations that use information management technologies use Linked in at least once per day for business purposes. Among those from supplier and consulting organizations, the percentage is even higher -- 48.0% and 53.8%, respectively. 

Now the two unexpected data points.

Although Facebook use for BUSINESS purposes is much less, it is still significant. Overall, 11.9% of survey participants use Facebook at least once per day for business purposes.

Perhaps more surprising is that Facebook is not #2 after LinkedIn. It's Twitter. Despite all the jokes about Twitter, there is clearly something at work here on the business side. Overall, almost 30% of the sample use Twitter at least once per day for business purposes. [Note: you can follow me on Twitter at http://www.twitter.com/jmancini77.]

Other posts related to this survey:

LinkedIn COULD be the ultimate business social networking platform winner. COULD be. 

------

[Note: The survey was targeted at current LinkedIn, Facebook, and InformationZen participants, as well as readers of the Digital Landfill blog.  The intent was to focus on business use of social media tools outside the firewall by users, suppliers, and consultants in the information management space.  The survey was conducted in February 2010 and had 332 respondents. Feel free to reuse any statistics with the attribution "AIIM, http://www.aiim.org"]

8 Ways to Kill Your ECM Project

 I am pleased to welcome my first mystery 8 things blogger!

This blogger is from an end user organization and would prefer to remain anonymous.  Which is cool. It's also a shame because this is a good and honest article -- would love more like this from end users! (I can also give you a fake picture.)

8 Ways to Kill Your ECM Project

1 -- Make sure to include only high-level managers in the planning stages.  

Don’t let anyone who actually does the work anywhere near the process.  They are “too busy” to be bothered.  Senior managers know all of the step-by-step processes, of course, and they have lots of opinions on how these can be made more efficient.   (Plus, one of them probably has a brother-in-law who sells ECM software.)

2 -- Do not appoint a project leader.  

Or, appoint several and let them fight it out.  You can also appoint one, and make sure they don’t have any actual authority.  These are all good.  The point is to avoid leadership and accountability at any level.

3 -- Write up detailed project plans and timelines, and then ignore them. 

Make sure there are no consequences for missed deadlines, lack of input, or refusing to engage with the project. Failure to complete critical tasks, which stall the other phases of the project, can produce blame, frustration and resentment that will keep your project team entertained for months.

4 -- Fight about who is going to pay for what.  

Stall the process indefinitely while refusing to pay for necessities like scanner maintenance.  It’s best if there is no clear budget to start with, so everyone can dodge responsibility. Remember, no expense is too small to become an issue!

5 -- Let the users who whine the most have the most influence.  

After all, your employees are busier than anyone else, anywhere in the world. It is an enormous imposition to expect them to learn anything new, or to endure the smallest bit of discomfort while adapting to a new system.  Constantly change the project requirements to cater to their complaints.  

6 -- Get lots of advice about best practices for implementation, and then do the opposite.  

Don’t listen to anyone who has ever implemented a project of this type before – after all, your organization is “special.”  Processes that work for other people obviously won’t work for you, so feel free to just make it up as you go along.

7 -- Refuse to change anything about your current business process.  

Don’t even think about analyzing your procedures and seeing if they still make sense. Instead, insist that the software be endlessly customized to fit your quirky, inefficient “business process.”  Bonus points for how many times you can insist “We’ve always done it this way!”  

8 -- Complain to anyone who will listen how awful the new software is, and how your paper-based processes were so much better.  

Don’t encourage your staff to work with the new system and give it a fair chance.  There should be no learning curve – if they don’t see instant results, obviously the system is a complete failure.  Take every opportunity to criticize the project, and say “I told you it would never work here.”  Be amazed that these ECM vendors can stay in business, when they can’t even make this stuff work when they have such reasonable and brilliant customers like you!

Some other posts that may be of interest

8 things you need to know about automating document indexing 

8 things to consider when decommissioning legacy data to your ECM Suite  

8 Tips for Selecting a Digital Signature Solution 

8 Things That You Should Know About Open Source ECM 

8 steps to going green with ECM

8 reasons why CMIS will transform the ECM industry

LinkedIn vs. Facebook

iPAD and some technology musings