Future Proof – Protecting our digital future

At State Records we have been thinking more about issues to consider when moving to the cloud.

In this post we explore:

• why use of cloud-based email is growing in government
• information management issues arising from use of cloud-based email applications, and
• possible risk mitigation strategies that can be put in place to manage these issues.

The aim of this post is to continue the discussion about important information management issues that need to be considered when email is being moved to the cloud, and to help formulate strategies that could support government organisations that are adopting cloud-based email.

Why use of cloud-based email is growing in government

There are many compelling reasons driving government CIOs to adopt cloud email offerings. The examples below are from several years ago and primarily from the United States, but comparable drivers and scenarios exist today in many NSW government (and likely all other government) environments.

Being aware of these drivers helps to understand while email is increasingly being moved to the cloud.

Email is seen as a quick win

Email is seen as an easy and effective first step into cloud environments for organisations looking to leverage the cost, process and technological efficiencies of the cloud.

According to the Beacon Report, Cloud First Consumer Guide email represents ‘the low hanging fruit that agencies could easily move from their servers without mission risk.’

The fact that email systems are one of the most complex and poorly managed systems from an information perspective is not factored into these assessments.

Moving email to the cloud can be seen as reducing recurring IT costs

At the US Bureau of Alcohol, Tobacco, Firearms and Explosives, moving email to the cloud resulted in savings of approx $1 million annually.

By taking its 122 existing email servers out of service and moving state email to a single cloud service, the State of Colorado estimated it would make annual savings of $8 million and avoid additional expenses of up to $20 million over the next 3 years.

Klamath County, Oregon, by migrating to the Microsoft Business Productivity Suite, found that the personnel required to manage the email solution decreased by 1.5 full-time equivalents, an 86% reduction.

(Source: US CIO Council,  State of Public SectorCloud Computing, May 2010)

Moving to the cloud can simplify email administration

Adoption of cloud email can simplify and standardise complex and different email systems.

In the United States, some government departments which (through organisational change) have become complex amalgamations of previous standalone departments with more than a dozen different email systems, are moving to a single email infrastructure based in the cloud.

The cost savings in this model are compelling, with the Department of the Interior, for instance, predicting that it will be able to provide an improved email service for its users at 1/3 of the cost of its current email services. (Source: US CIO Council,  State of Public SectorCloud Computing, May 2010)

You can store a lot in the cloud

Cloud email offers large amounts of email storage.

By transitioning to Google Apps, the City of Los Angeles could offer each of its employees 25 times more storage space than was available in their existing in-house option.

After moving to the cloud, the City of Orlando was able to increase mail storage from 100MB to 25GB per user and offer enhanced support for mobile devices.

(Source: US CIO Council,  State of Public SectorCloud Computing, May 2010)

The cloud can be very reliable

Cloud email offers impressive availability and service reliability. Many cloud offerings guarantee 99.9% service reliability.

Cloud email offers have lots of extra functionality

Cloud email systems come with more than just email and this becomes a significant inducement for adoption.

Common offerings via cloud that are bundled with email are:

• better support for accessibility via mobile devices
• group calendars
• shared documents and spreadsheets and collaborative editing
• instant messaging
• web collaboration for meetings
• video conferencing
• email archiving

Each of the offerings poses additional information management issues to consider in cloud environments.

Information management issues arising from use of cloud-based email applications

Any information management strategies proposed for the management of cloud-based email need to take account of and/or help to resolve the following (and possibly other) issues.

Email is already poorly managed, even before it moves to the cloud

Information in email systems is generally not well managed.

Moving email to the cloud therefore often involves moving a high risk, multi transactional, multi-agent, poorly managed and massive dataset to a cloud environment where there is a requirement to pay for its ongoing storage.

Moving email to the cloud consequently simply relocates any existing information management problems without actually resolving them.

Costs associated with transferring data out of cloud environments

Under cloud service contracts, charges are usually levied for bandwidth in and out, making the transfer of data out of a cloud environment potentially an expensive process.

The costs associated can make the migration of long term information into or out of cloud environments difficult or hard to justify.

The nature of information can change with the cloud

Adoption of new cloud systems can remove existing email-based communication channels and the information management strategies that may be supporting these communications.

For example, the cloud-based CRM tool Salesforce.com is widely used across the public and private sectors for many purposes, including case management.

Salesforce.com centralises the management of processes or cases, consolidating information that would previously have been spread through email, webforms, contact databases and paper files. In Salesforce.com, responsibilities for actions are allocated from the system and a consolidated record of contacts, communications, actions and outcomes is provided by the system.

When using Salesforce.com, traditional email channels would no longer be used for case related communications. Any corporate processes in the email environment designed to manage this information would be lost and they are unlikely to have been configured within the salesforce.com system.

More storage can mean more issues to deal with

Greater storage capacity leads potentially to larger email volume and legacy management issues.

Data profusion issues can become very costly in a cloud environment, so proactive identification and management of volume issues is necessary.

More functionality can mean more issues to deal with

As mentioned above, cloud email systems come with more than just email.

Common offerings frequently bundled with cloud email are:

• better support for and accessibility via mobile devices
• group calendars
• shared documents and spreadsheets and collaborative editing
• instant messaging
• web collaboration for meetings
• video conferencing

These additional offerings are significant drivers for cloud email adoption and each poses additional but related information management challenges.

Cloud offerings can come with email archiving

Many cloud email systems offer email archiving solutions.

Cloud services offer email archiving as an add-on to facilitate e-discovery and email access to authorised users.

This again can raise a variety of information management issues because email archives are not intuitive information management tools, but their adoption can make it difficult to justify proposals for alternate email management solutions.

Costs of legacy email migration can be large

It can be costly and time consuming to migrate legacy email to a cloud environment. These factors limit organisational appetite and capacity for migrating existing email system contents.

The potential costs of migrating legacy email are shown by the following example: ‘You’re moving a total of 12 TB of data to the cloud, for 8,000 users, on an internal network – either a LAN or WAN. Your limiting factor is how fast you can process the data. Typical speeds are around 20 GB per hour. So, with a migration window of 12 hours, that’s 600 hours, or 50 days – which is acceptable for a migration project. If you’re moving to a cloud platform, you could be looking at a throughput rate of 2 GB an hour which turns your migration time frame into 500 days…’ (Source: Dimension Data, Best Practice Guide: Moving Exchange to the Cloud: 5 Really Practical Best Practices)

These costs and complexities could lead to purging or sidelining of a lot of legacy content, which can be problematic if this information has never been adequately managed.

Traditional recordkeeping solutions may not be an option

Proposals to integrate cloud email with on premise EDRMS are often costly, laborious, not well supported by ICT staff and may not be very successful when executed. They also do not resolve common existing issues associated with limited staff EDRMS use.

Traditional advice to capture relevant email messages into an on premise EDRMS may therefore not translate to cloud environments.

Possible risk mitigation strategies that can be put in place to manage these issues

Make sure information management is considered front and centre

Ensure information management requirements are built into project planning and budgeting arrangements.

Information management issues should be proactively considered as part of cloud email planning, assessment, budgeting and implementation.

For example, understanding that some emails have to be kept long term will help ensure that portability planning and estimated costs for maintaining and possibly migrating these email collections back into corporate or alternate cloud environments are understood at project commencement and built into planning and budget processes.

Promote awareness of information impacts of system transition

Because traditional email channels may be disappearing for certain business processes, it may be important to ensure that any governance models previously applied to email systems can be applied to the new forms of process-specific applications that are replacing them.

At current levels of system maturity, it is not common for these evolving applications to support information management needs beyond immediate business purposes. They can have limitations that do not broadly enable full information export and exchange, or the full migration of all metadata supporting business information and processes.

Awareness of this business and system transition and then recommendations for actions to ensure that information management requirements are built into project planning, system assessment processes, portability planning, contractual assessments and budgeting arrangements for new systems can therefore be very important.

Develop risk-based strategies for legacy email management

In many organisations it is not possible or feasible to conduct a granular analysis of the information contained in all legacy mailboxes before they are transitioned to the cloud or even to new on premise email environments.

Therefore, in poorly managed legacy environments, it may be necessary to promote risk based assessments for legacy email management.

An approach for making decisions about legacy email management may be to identify the mailboxes that are likely to contain information of long term business value, based on the business role performed by the business owner. This could include senior executive staff mailboxes, support staff for senior executives and the mailboxes of key decision making staff in high risk business areas, or mailboxes likely to contain information which warrants permanent or long term retention in an authorised retention and disposal authority.

For example, in the university environment, it could be recommended that staff mailboxes that are likely to contain material around high value research data, or issues around the intellectual property management and commercialisation of University research be subject to long term management. Although aspects of these parts of University business will be held elsewhere, the email system will hold fundamental contextual information about the early stages of research or commercialisation or negotiations around these which could be necessary to support copyright or ongoing intellectual property arrangements.

State Records’ preliminary email research has also shown that many management staff have email records around aspects of personnel management in their mailboxes. This is a high risk area for business and so identifying, assessing and potentially managing mailboxes for staff with a lot of engagement or correspondence in this area could also be an important risk management strategy.

In addition, it will also be important to assess any existing or potential litigation and proactively preserve mailboxes based on this analysis.

In general, with any global strategy of this type, organisations must ensure that their mailbox analysis is sufficiently detailed so that an appropriate officer is able to accept any residual risk of destroying this information. Appropriate strategies then need to be in place to keep and make appropriately accessible the high value mailboxes the analysis identifies. To mitigate many short to medium term risks, it is often the case that a standard retention period would be applied across all legacy email – often 5 or 7 years – after which just the identified high value mailboxes would continue to be managed.

Another strategy that could be used in combination with the above approach is to give staff a grace period in which they have a window to go back through their mailbox and capture appropriate messages that need ongoing management.

These issues show how important proactive information management strategies are and how they do need to be put in place to ensure these types of poor management issues do not reoccur and present ongoing problems in the future.

Understand the issues associated with moving email to cloud environments

The issue with moving email to the cloud is that you are moving a high risk, multi transactional, multi-agent, poorly managed and massive dataset to a cloud environment where you need to pay for its ongoing storage.

Cloud solutions in and of themselves are therefore not a solution for email. They are a means of moving an existing problem off site.

Many cloud email systems can also deploy a rolling deletion policy which will, for example, auto delete all emails after 5 years. The risk here is that standard retention rules will be applied that give equal weighting to emails about morning tea and emails about $10 trillion contacts. Strategies need to be put in place to ensure relevant high value business records are kept and the rest routinely deleted.

Support corporate change management to improve information management practices applied in email systems, including cloud email

Email is one of the most poorly managed forms of business records. Poor email management generally is not rectified in advance of moves to the cloud, resulting in ongoing management issues in a new and complex operating environment that potentially poses more risks.

In government and business however, email systems continue to be used as key business systems generating information, a proportion of which needs to be kept in the medium to long term.

To support these requirements, organisations need business appropriate, risk appropriate and staff appropriate change management solutions to transition information management to new business environments.

Given the large, cost-based and potentially volatile cloud environment, these strategies need to be more global, scalable, risk and business based than traditional information management practice to date. These strategies should also reflect the collaborative business environments generating these records.

Be aware of the issues associated with a default retention period

To facilitate their implementation, some cloud email systems are being rolled out with a uniform retention period of 5 or 10 years applied to all messages within them.

Given the breadth of issues that any one email account can cover and the range of diverse requirements that can apply to them, there are genuine business risks that can come through the application of default retention rules.

State Records’ preliminary email research is showing that once standard default retention periods have expired, there is little appetite in organisations to destroy large collections of email that have reached a standard default retention period. This suggests that default retention periods are likely to create information management problems in the future and other proactive management strategies are required. It is important then to identify ways in which information can be categorised, or aggregated according to business use and value and managed in different ways in cloud email environments.

Some organisations are also applying standard retention rules to legacy email and retaining legacy systems on premise for a specified period. There are risks and costs in this approach which should not be encouraged. From a technology perspective, ‘If you keep old data on the on-premise Exchange, you’re not realising the benefits of moving to the cloud,’ he says. ‘You’re still maintaining hardware just to get access to old information. And you’re wasting valuable skills on maintaining an unreliable, degrading platform.’ (Source: Dimension Data, Best Practice Guide: Moving Exchange to the Cloud: 5 Really Practical Best Practices)

From an information management perspective, there are significant costs and risks of the poor management of these data stores and the unauthorised disposal rules that would be applied in these legacy management scenarios.

Plan exit strategies from cloud services even before you move in

Some long term value information (and likely a lot of the supporting metadata around it) will need to live through various cloud transitions and will therefore need to be flagged in exit strategies from cloud arrangements. Planning for this as soon as possible will build the requirement in as a foundation requirement in cloud arrangements.

Understand the limitations and possibilities of email archives

Rather than passively deploy email archives for their catch-all capacity, organisations should actively use them as management tools. Many email archives can deploy business rules or link to workflows or positions or tags or classifications to aggregate related information and facilitate its management. Taking the time to investigate, configure and deploy this functionality can pay significant dividends in the medium to long term.

A number of organisations are switching off their email archives because these archives have become unsustainable data stores and expensive to run when new servers have to be brought to support the ever-expanding volumes of data. These organisations are now in the difficult position of having massive volumes of amalgamated high risk and low risk legacy email going back 6+ years which they are now paying staff to sift through, separate and manage.

These data profusion issues will become very costly in a cloud environment, so proactive configuration and management of the archive is fundamentally necessary.

Develop strategies for the management of information commonly bundled together with cloud email

Through their cloud environments many organisation are now using:

• group calendars
• shared documents and spreadsheets and collaborative editing
• instant messaging
• web collaboration for meetings
• video conferencing
• email archiving

and driving the use of mobile devices.

Organisations utilising these additional tools should develop strategies to assist with strategic information management for high value business information generated in these collaborative online environments.

In summary

This post touches on a number of issues and risks associated with cloud email management, and provides some food for thought on different information management issues and strategies.

If some of these issues resonate with you, or if you have developed advice around them, or if you have a great example of a cloud email deployment that you would like to show us, or if you would like more advice about the things discussed in this post, please do let us know.