Information and Records Management SocietyPublic Sector Group 13th November 2014

Digital Continuity

1 Welcome to this meeting of the Public Sector Group which is the last one of the year. As you will see we are doing things a little differently this time and once I’ve finished some of the housekeeping notices then we will launch straight into the work shop. There are no planned fire drills today so if you hear the fire alarm go off it will be the real thing. [Normal fire drill instructions]. Please make sure that you have ticked yourself off on the fire sheet at the back of the room. Please make sure that you have collected your badge and the email circulation form. You will see that there is a coloured dot on your badge, this is your small group when we break out. However, if you would rather be in a different group, please do not hesitate to change over groups. We are aiming at groups of about 8 people if at all possible so that everyone can be a part of the group. If you are happy for your email address to be circulated to the other delegates please indicate this on the form that you received with your badge and return it to me. Tea and coffee won’t be served again until after lunch although people are welcome to help themselves to what is left when we have a comfort break. Please could you make sure that all the cups are back in the refreshment area by 12 noon so that they can be washed up in preparation for coffee after lunch. As today is a workshop we are not having an update from the Exec, I have created a little newsletter which is on your chair. This includes the dates of the 2015 meetings. We have enough themes for 3 meetings but we are struggling to find a theme for the fourth meeting, if you have any suggestions please add them to the sheet of paper on the flip chart or let me know in the next couple of weeks. We do have our Groups Director here with us, so if there is anything that you would like to raise with her please feel free to do so. [Get Emily to wave paw or something similar].

Agenda

• Digital Continuity v Digital Preservation• Why is digital continuity important?• What are the risks of not taking digital continuity into account?

• Roles and responsibilities• Defining your digital continuity requirements

2 Moving on, these are the topics we are going to cover in the first part of the meeting before we hand over to Alan Shipman who is going to talk about standard file formats. As you may be aware we were intending that this workshop would be run by Mark Merifield and his team at the National Archives. Mark has now moved on, so Jenny, Jane and I will be facilitating the presentations during the day, but we are fortunate to have Fiona Kearney from the National Archives with us. Fiona will be moving the digital continuity work forward at the National Archives and she will be updating us about that during the day. I’m going to kick the day off. So, how did I get involved in Digital Continuity for KCC. Well, back in 2011 when Records Management was pulled into a corporate team, I was tasked with completing the section 46 self assessment toolkit and we identified from that toolkit that we needed to create a digital preservation policy. As part of our overall programme I developed and created the policy, in the mean time doing a lot of research which is where I came across the TNA material. I was also invited at about the same time to speak at a Capita Conference on Digital Preservation. Everything that I am going to talk to you about now fed into the Digital Continuity Policy. If anyone would like to see a copy of the policy, I have brought a few along. I would say that this is still awaiting final approval as ICT have been slow to comment on the policy.

Digital Continuity v Digital Preservation

Digital Continuity

Digital continuity is the ability to use digital information in the way that you need, for as long as you need. (The National Archives)

Digital Preservation

Digital preservation is a vital issue for almost all archives and there is an increasing demand for storage of, and access to, digital information in a discoverable format. (The National Archives)

3 First of all, let’s get the terminology straight. Up until the creation of the TNA material we always used to call this Digital Preservation and the very use of the word “preservation” tended to put this in the archive arena, generally we would find that it was archivists dealing with the digital preservation agenda (and in my case when I still had an archives function to my role, digital preservation was in my remit). Mark Merifield and his team developed the use of the term Digital Continuity as part of the programme for central government to ensure that all aspects of ensuring that all aspects of making digital records accessible during their lifetime was covered. The use of the word “continuity” brought it back within the remit of records managers (hence why it is still my responsibility although I haven’t done any archive work for years). Let’s look at the definitions which TNA provide to distinguish between the use of the two terms.

Digital Continuity: Digital continuity is the ability to use digital information in the way that you need, for as long as you need. (The National Archives) Digital Preservation: Digital preservation is a vital issue for almost all archives and there is an increasing demand for storage of, and access to, digital information in a discoverable format. (The National Archives)

You may find that you are the person introducing the term digital continuity into your organisation. I found that the relevant managers were much more responsive to the use of the term digital continuity, because they were familiar with business continuity and it gave them something to hang the term on. Business continuity (of which digital continuity is a sub set) is everyone’s responsibility, instead of the view that preservation is solely the responsibility of the archivist.

Digital Continuity

The National Archives – Embedding Digital Continuity in Information Management p4 

• FIND YOUR INFORMATION • not only knowing what to look for but where, and to have the tools and 

skills to facilitate this • OPEN IT

• have the correct permissions and technology to make the information available 

• WORK WITH IT• understand what it is we need to do with our information – share it, edit 

it, run reports against it, update it – and have the technology in place to enable this 

4 We are now going to run through the basics of what you need to do to start collecting the information that you need to develop your digital continuity policy. You need to be a position to be driving this rather than your ICT department (although we’ll look at roles and responsibilities a little later on). ICT departments tend to see digital continuity shortfalls as the process of natural selection which ultimately allows them to dispose of documents which no one can read any longer. In order to achieve this you will need to work in cooperation with the ICT department. I have taken this from p4 of the National Archives guidance “Embedding Digital Continuity in Information Management”. I forgot to attach this to the email so I have brought copies with me. find your information – not only knowing what to look for but where, and to have the tools and skills to facilitate this

ICT may have systems diagrams or a database listing all the available systems. – show APM diagrams.

open it – have the correct permissions and technology to make the information available

You may need to ask the system users to demonstrate what the system does to you as you may not be permitted to have the necessary permissions to use the system – for example, Children’s systems

work with it – understand what it is we need to do with our information – share it, edit it, run reports against it, update it – and have the technology in place to enable this

What do you need to ensure that there is continuity of access to – if the team has a well developed business continuity plan then these things may already have been documented

Digital Continuity

The National Archives – Embedding Digital Continuity in Information Management p4 

• UNDERSTAND IT• so that you know what it is about, including who created it and what 

relationships it may have to other information • TRUST IT 

• know that the information is what it says it is, and have the confidence that it has not been altered. 

THESE ARE THE STANDARD RM PRINCIPLES WE ARE ALL USED TO DEALING WITH. THEY JUST NEED TO BE APPLIED TO THE DIGITAL TECHNOLOGY.

5 understand it – so that you know what it is about, including who created it and what relationships it may have to other information

This will include understanding the workflow and the purpose of the system

This is harder in a shared drive environment and very easy in an EDRMS environment

trust it – know that the information is what it says it is, and have the confidence that it has not been altered.

This is all about audit trails and any legal admissibility issues which might arise from use of the documents.

THESE ARE THE STANDARD RM PRINCIPLES WE ARE ALL USED TO DEALING WITH. THEY JUST NEED TO BE APPLIED TO THE DIGITAL TECHNOLOGY.

Why is digital continuity important?

Interactive Discussion

Tell us what you think

6 Interactive Discussion When you put together your digital continuity policy or a business case to create one, you will need to be able to convince others about why digital continuity is important. We’re just going to spend a few minutes thinking about that now. Please call out what you think and Jane will record this on the screen/flip chart.

What are the risks of not doing digital continuity?

Interactive Discussion

Tell us what you think

7 Interactive Discussion You will also need to know about the risks of not getting digital continuity right. We’re just going to spend a few minutes thinking about that now. Please call out what you think and Jane will record this on the screen/flip chart.

Roles and Responsibilities

Senior Information Risk Owner (SIRO) Chief Information

Officer

Risk ManagersInformation Managers

Information Asset Owners

Procurement Managers

IT Service Managers

The National Archives – Managing Digital Continuity Section 3 pp21‐22

8 I am now going to hand over to Jane who is going to look at roles and responsibilities: Information Risk Owner (SIRO)

Ensures that risk to digital continuity is adequately identified and mitigated, as an integral part of the departmental information assurance and risk management strategy.

Chief Information Officer (CIO)

Owns and champions the business outcomes and benefits of ensuring the continuity of information assets.

Risk Managers Ensure that any risks to digital continuity identified by digital continuity risk assessment processes are properly managed through their organisation's risk management framework.

Information Managers (IM professionals and Department Records Officers)

Work with head of KIM to identify risks to digital continuity and issues for the organisation.

Information Asset Owners Understand what information assets they are responsible for, the usability needed from those assets and the risks to the continuity of the assets. Maintain information about those assets in an IAR and ensure that processes are in place to support the digital continuity of the assets.

Chief Technology Officers (CTOs)

Ensure the organisation’s technical environment enables the continuity of information assets in line with the business requirement, over time and through change.

IT service managers Ensure technology is delivered and maintained to enable continuity of information assets in line with the business requirement. Ensure that IT service change management processes take account of the impact on the digital continuity of information assets.

Procurement managers, Commercial/contract managers

Ensure that appropriate responsibility for identifying and managing continuity issues is clearly defined in supplier contracts, including referring to an IAR, with defined service outcomes describing the usability required for each information asset.

Defining your Digital Continuity Requirements

9 Jenny is now going to move on to look at defining your digital continuity requirements.

The diagram can be found on p10.

Defining Your Digital Continuity Requirements

Defining your digital continuity requirements means establishing what digital information you have, what you need to keep and how you will need to use it, over time and through change. 

Once you understand how your business needs to use information, you can ensure that your technical environment and the way you manage your information continue to support this use in the most efficient way. It should also highlight where savings can be made by eliminating unnecessary information or technology.

10 Defining your digital continuity requirements means establishing what digital information you have, what you need to keep and how you will need to use it, over time and through change. Once you understand how your business needs to use information, you can ensure that your technical environment and the way you manage your information continue to support this use in the most efficient way. It should also highlight where savings can be made by eliminating unnecessary information or technology.

Defining Your Digital Continuity Requirements

To do this, you must first understand what information assets you have.

An information asset is a body of information, defined and managed as a single unit so it can be understood, shared, protected and exploited effectively.

11 To do this, you must first understand what information assets you have. An information asset is a body of information, defined and managed as a single unit so it can be understood, shared, protected and exploited effectively.

Defining Your Digital Continuity Requirements 

Once you have identified your information assets, you must determine how you need to use each of them – these are your business needs. This covers everything from how you find it, through how you access it to what you do with it. 

The digital continuity of your information is maintained when your business requirements, technical environment and information assets support one another, so to ensure continuity you will need to map the relationships between these elements, identifying shortfalls in support, or unrequired capability. 

12 Once you have identified your information assets, you must determine how you need to use each of them – these are your business needs. This covers everything from how you find it, through how you access it to what you do with it. The digital continuity of your information is maintained when your business requirements, technical environment and information assets support one another, so to ensure continuity you will need to map the relationships between these elements, identifying shortfalls in support, or unrequired capability.

Defining Your Digital Continuity Requirements

These elements can easily change and fall out of sync with one another if these changes are not effectively managed. You could be left with information assets you can’t use, or technology supporting information in a way that doesn’t meet your needs. 

13 These elements can easily change and fall out of sync with one another if these changes are not effectively managed. You could be left with information assets you can’t use, or technology supporting information in a way that doesn’t meet your needs.

14

The diagram sums up what we have been talking about

Identify your Information Assets Identify what information assets you 

have – categorise your information from the perspective of its content and business use, not in terms of the IT system that holds it.

When you identify your assets, you should consider the level of granularity that is required to meet your objectives. An information asset is defined at a level of detail that allows its constituent parts to be managed usefully as a single unit.

Be sure to address all forms of information generated by your organisation, including that which exists primarily on web platforms, and not only personal/sensitive data but all the information a business needs.

15

Identify what information assets you have – categorise your information from the perspective of its content and business use, not in terms of the IT system that holds it.

When you identify your assets, you should consider the level of

granularity that is required to meet your objectives. An information asset is defined at a level of detail that allows its constituent parts to be managed usefully as a single unit.

Be sure to address all forms of information generated by your

organisation, including that which exists primarily on web platforms, and not only personal/sensitive data but all the information a business needs.

Define the usability requirements of your assets 

Identify • how will you find your information, • who can access the information and how, • what you need to be able to do with the information, • what you need to be able to understand about your 

information, • to what extent you need to trust that your information is 

what it claims to be. 

Consider your future usability requirements. 

16

Identify • how will you find your information, • who can access the information and how, • what you need to be able to do with the information, • what you need to be able to understand about your

information, • to what extent you need to trust that your information is

what it claims to be. •

Consider your future usability requirements.

Understand how to deliver your usability requirements 

You need to understand how to deliver these usability requirements – the level of completeness and availability required from your assets. The process of mapping your information assets and business requirements to their technical environment and information management policies and processes will help you to do this. 

17

You need to understand how to deliver these usability requirements – the level of completeness and availability required from your assets. The process of mapping your information assets and business requirements to their technical environment and information management policies and processes will help you to do this.

Map your information assets and business requirements to your technical environment. 

You will need to undertake a technical mapping exercise to establish your technical dependencies. This will tell you the technology components you rely upon to help ensure your information is complete and available for you to use as needed. Outputs from enterprise architecture tools, a configuration management system or other technology management tools you already have in place may be able to help you with this. 

18

You will need to undertake a technical mapping exercise to establish your technical dependencies. This will tell you the technology components you rely upon to help ensure your information is complete and available for you to use as needed. Outputs from enterprise architecture tools, a configuration management system or other technology management tools you already have in place may be able to help you with this.

You will need to understand:

• the software applications you use (both desktop and enterprise applications)

• the hardware platforms and infrastructure• the skills and expertise you rely on to manage the 

technology • planned changes to the technical environment and its 

expected end of life.

19

You will need to understand: • the software applications you use (both desktop and enterprise

applications) • the hardware platforms and infrastructure • the skills and expertise you rely on to manage the technology • planned changes to the technical environment and its expected

end of life.

Maintain a record of your findings

You need to compile a comprehensive mechanism for mapping your information assets, usability requirements and technical and information environment dependencies. You may have existing systems which can be exploited, for example an Information Asset Register (IAR), hardware or software asset registers, or configuration management databases (CMDBs). You need to ensure you can cross‐reference various sources of information in the way you need to. You must ensure you keep this record up to date to retain digital continuity. 

20

You need to compile a comprehensive mechanism for mapping your information assets, usability requirements and technical and information environment dependencies. You may have existing systems which can be exploited, for example an Information Asset Register (IAR), hardware or software asset registers, or configuration management databases (CMDBs). You need to ensure you can cross-reference various sources of information in the way you need to. You must ensure you keep this record up to date to retain digital continuity.

We are now going to hand over to Alan Shipman to talk about standard file formats.