ILM and ECM: The confluence of technology, business

Enterprise content management and storage management come together in information life-cycle management.

By Phil Goodwin

Over the next few years, IT organizations will increasingly connect the technical elements of storage management with the business requirements of content management. Enterprise content management (ECM) is emerging as a critical infrastructure requirement, and storage continues to become increasingly important as it grows in capacity, functionality, and management capabilities. ECM and storage management come together in the nascent yet compelling vision of information life-cycle management (ILM). This article is designed to help IT managers understand the elements and value of ILM, to see where content management fits into the equation, and to communicate the value of integration to senior managers.

Three recent phenomena have combined to create the "perfect storm" for information management:

  • Ubiquitous and nearly impossible-to-control growth and access to enterprise and worldwide Web information;
  • Security, compliance, and data integrity driven by requirements for financial transparency and new regulatory mandates such as Sarbanes-Oxley, HIPAA, and other compliance regulations agencies; and
  • Information and disaster recovery heightened by terrorist attacks and power-grid blackouts.

Taken together, these matters that were once the sole domain of IT are now of direct and immediate importance to the lines of business and the entire organization.

Defining ILM

Information (or data) life-cycle management is the process by which information is moved through a continuum of storage media in order to ensure business-required ser-vice-level delivery at the lowest unit cost, based on the content of the data elements. ILM also includes progressively maturing and automating storage management processes that result in personnel efficiency improvement, all without sacrificing rapid response to changing business requirements.

The key element of this definition is process. Certainly, information can be managed throughout its entire life cycle manually as was done before the advent of computer technology. For an ILM project to be effective, it must automate the process of managing information. Automation should yield lower risk by minimizing the opportunity for human error or interference (e.g., more accountability), as well as higher personnel efficiency both within and outside the IT group. Automation should also optimize the storage tier and manage the data movement, replication, and other aspects of the storage infrastructure.

To implement ILM effectively, the storage infrastructure must have knowledge of the informational content and vice versa. To illustrate, consider that before computer automation the document owner determined whether the document should be placed in a desk-side file (perhaps with the security of lock and key), in a publicly accessible file, in long-term storage, or destroyed. These determinations were made based on the document content and its importance to the business.

From the storage perspective, we move information from disk to tape to an off-site vault based almost exclusively on a single criterion—the age of the information—without regard to the value of that information to the business. However, current business and regulatory environments require more-sophisticated treatment of the information, and new technologies are evolving to meet this need.

Content, not age, is a more valid determining factor of data/item importance. For example, IT organizations cannot simply purge e-mail files after a certain period of time. "Junk" e-mails, of course, can be deleted, but those pertaining to business transactions, human resources, finance, etc., may need to be retained, cataloged, stored, accessed, and protected for extended (often specific) periods of time. Moreover, it is not as simple as moving the data to off-site storage, because the records must be accessible within a reasonable period of time and cost. The result is the integration of specialized storage systems with content management and e-mail archiving systems (e.g., EMC EmailXtender, IXOS-eCONserver, etc.).

Essentially, storage has been managed on a two-tier model: disk and tape. With rapidly improving storage management technology, however, IT organizations have a much broader range of infrastructure deployment options that allow them to better match business requirements (e.g., data access, retention, security) with infrastructure choices (e.g., enterprise storage, midrange storage, ATA/SATA, tape). Currently, the industry is on the cusp of robust heterogeneous storage management capabilities that will enable IT organizations to select best-of-breed storage systems and management platforms.

ILM is not a silver bullet for managing either data or storage, but rather a holistic program that begins with process refinement and rules definitions and then drives toward automating those processes using repeatable methodologies. Properly implemented, ILM can yield not only intangible benefits, such as greater organizational efficiency and agility, but also hard money savings.

The information management problem

There are two basic aspects to ILM benefits: a positive improvement of the organization, and avoidance of negative consequences from continuing current practices; the latter is generally the more urgent course of action.

Determining how much an organization may benefit from an ILM project can be assessed initially by reviewing risk categories and deciding if the organization has significant exposure. These risk categories include

Regulated industries—Heavily regulated industries include financial, healthcare, and insurance.

Special regulatory oversight—Although an organization may not fall into a "heavily regulated industry," it may have heavily regulated elements. These elements may include business activities that are overseen by agencies that require specific record keeping, such as the EPA and OSHA.

Regulated activities—All companies have regulated activities to some degree, although some have more than others. Basically, these activities include "anything to do with people, personnel, and money." This can include customer records such as identity/credit cards, product purchase histories, personnel records, etc.

Clearly, all organizations have some information management risks and exposures. Subsequent sections of this article will describe practical ways to get started with an ILM project that can not only reduce organizational risk, but also permanently improve operations.

The role of ECM in ILM

Although time is an element of any document management system, a system based solely or primarily on time has many deficiencies. First, a time-based system alone will usually result in some information being retained far longer than its useful life, thereby exposing the organization to the risk of court-directed discovery.

Second, a time-based system does not consider the access requirements of the information. For example, some information that is infrequently accessed (e.g., individual medical records) may need to be accessed instantly upon request.

Enterprise content management systems are integrated solutions primarily designed to capture, store, retrieve, and disseminate information. Decisions regarding purchasing and deploying ECM systems have been tactical decisions until recently—that is, designed for a specific business unit purpose (e.g., drug submissions, managing technical manuals, collateral for product releases).

Increasingly, ECM is becoming a core component of conducting business. What was once a discretionary application is now a fundamental infrastructure component for many organizations. This dynamic is partly due to the broadening coverage of ECM to areas such as e-mail and records management, which pervade the entire organization rather than a single department. Infrastructure decisions and content management decisions will increasingly be made together, rather than separately as in the past.

The rapid nexus of e-mail archiving applications (a subset of ECM) and storage is one of the earliest examples of integration of ECM and infrastructure. A broader confluence between the ECM infrastructure and the storage infrastructure will evolve through 2006, whereby ECM applications provide the content knowledge (metadata) to enable more intelligent and automated ILM.

Practical steps to getting started with ILM

Step 1: Process maturity assessment
META Group research indicates a high degree of correlation between processes that can be automated and the maturity of those processes. Therefore, we recommend that organizations begin by assessing their existing process maturity.

Step 2: Establish priorities
META Group believes that any given process must reach at least the third ("Defined") level of maturity before it can effectively be automated. The IT organization should select the most critical applications and begin there.

Step 3: Define processes
As organizations begin defining processes, the description should contain at least the following elements:

  • Data element category (e.g., regulated content, internal, unprotected);
  • Data element ownership (e.g., business unit or position title);
  • Trigger events that stimulate a given action;
  • Description of actions required to manage content;
  • Retention requirements;
  • Access requirements;
  • Security requirements; and
  • Disposal requirements.

It is critically important that these elements be defined by the business owner of the data element.

Information disposition should not become the IT organization's responsibility just because it is stored in a computer system. The document owner is still the most qualified individual to make a determination regarding the disposition of the document.

Moreover, regulatory-driven determinations such as data retention and protection should be made with the assistance of legal counsel and the corporate governance. This is all the more reason to connect ECM and its records management capabilities to the storage infrastructure.

The last four items (retention, access, security, and disposal requirements) create the basis for the service levels necessary to support the business in its use of the data. It is this connection to business requirements that becomes the most important component of ILM and the reason why content management and storage management are two of the main tenets of ILM.

Benefits of ILM

Fully implementing ILM is an extensive project, one that may take a year or more to fully exploit. Yet, despite the effort, a properly implemented ILM project has a number of significant benefits, including greater organizational agility, reduced risk, and an optimized storage cost structure. ILM need not be a daunting "big-bang" project, however, and can be implemented incrementally and expanded across the enterprise as you realize benefits. Some of those benefits include

Organizational agility—ILM facilitates organizational agility primarily by establishing a set of documented and repeatable processes that are routinely re-examined and refined. These processes become as much a part of the infrastructure as any hardware or software components. Linking these process refinements to the business unit reduces the chance of a "blindside" event. Blindside events are costly because emergency purchases are made at high cost, existing investments are sidelined, and current projects are shelved mid-process.

Reduced risk—An automated, procedural solution to compliance ensures that an organization will not revert to old habits as the sense of urgency fades. Furthermore, an automated solution ensures continuity and compliance even as personnel inevitably turn over. Finally, an automated solution has checks and balances and can be tam-per-proofed from both internal and external attacks while improving the organization's legal credibility.

Lower storage costs—ILM can optimize the deployment of assets, resulting in better asset utilization, improved access to information, and lower cost per unit stored. ILM allows IT organizations to deploy storage tiers (e.g., premium storage for critical applications, entry-level for routine applications). The different tiers available to an organization carry distinct and relative cost differences that will have varying net financial impact (due to the differing degrees that a group will leverage each tier), and moving from a "one-size-fits-all" approach will bring tangible, measurable financial benefits.

Phil Goodwin is a senior program director, infrastructure strategies, at the META Group consulting firm (www.meta group.com) in Stamford, CT.

This article was originally published on July 01, 2004