ECM as a Service in Government
- 1. ECM AS A SERVICE IN GOVERNMENT A Practical Guide to Establishing a Shared Services Model for ECM in Government ABSTRACT Government CIOs need to add enterprise content management (ECM) to the IT service portfolio they offer their departments. This whitepaper identifies key strategies that foster successful ECM as a service initiatives and describes the challenges that can derail these efforts. November 20, 2013 EMC WHITE PAPER
- 2. TABLE OF CONTENTS ABSTRACT............................................................................................................ 1 TABLE OF CONTENTS................................................................................................2 EXECUTIVE SUMMARY.............................................................................................3 Audience............................................................................................................. 3 MANAGING CONTENT IN GOVERNMENT....................................................................3 Content, Process, And Service Delivery......................................................... 3 BUILDING THE BUSINESS CASE FOR SHARED SERVICES............................................4 A SHARED SERVICES DEPLOYMENT MODEL..............................................................4 Information Governance................................................................................. 5 Retention management...................................................................................5 Formal records management...........................................................................6 ADVANCED CAPABILITIES.........................................................................................6 Case and Process Management....................................................................... 6 Virtual case files centrally manage case content...............................................6 Business process management streamlines and automates processes..............7 Cloud Services.................................................................................................. 7 State adoption of public cloud services............................................................8 Mobile Computing............................................................................................. 9 SharePoint....................................................................................................... 10 The public sector challenge: capitalizing on the value of information..............10 Accommodating SharePoint within ECM as a service deployments..................10 FIVE DEPLOYMENT PITFALLS..................................................................................11 GETTING STARTED..................................................................................................11 Assess the Current Environment................................................................. 11 Build the Business Case................................................................................. 12 Set Standards................................................................................................. 12 Deploy the Initial System............................................................................... 12 Plan the Larger Rollout................................................................................ 12 CONTACT US..........................................................................................................12 2
- 3. EXECUTIVE SUMMARY Audience This white paper is intended for government CIOs and IT managers at the federal/ national, state/regional, and local levels. MANAGING CONTENT IN GOVERNMENT Government agencies generate an enormous volume of diverse content as a product of their work and their interactions with the public. The range of content includes traditional documents such as contracts, forms, permits, and case files, as well as CAD drawings, web content, still images, audio and video, and rich media. All of this content is vital to conducting government business. And managing it presents a number of challenges, not the least of which is that a lot of government content is considered public record and is subject to Freedom of Information Act (FOIA) requests that must be honored. Moreover, every year a growing percentage of government business is conducted electronically — between agencies and with the public. So electronic records simply add to the content management challenge and will increase at a much faster pace than paper, which shows no signs of disappearing. Government agencies need the enterprise content management (ECM) tools to efficiently manage both. “Mobile devices and apps, smart sensors, cloud computing solutions, and citizen-facing portals will create a 48% increase in digital information, creating new records management access and retrieval issues.” © IDC Government Insights — 2013 Content, Process, And Service Delivery In addition to content volume and diversity, government agencies are under pressure to leverage the internet and mobile devices to provide citizen services more rapidly. Many government forms are now available online, but the speed and efficiency of the online channel requires more than just creating digital equivalents of paper forms. It demands processes that have been optimized to streamline form submission and automate workflows for delivery of rapid, error-free citizen service. Understandably, government departments often turn to a central IT function or the office of the CIO to cope with these challenges. But, just as often, there is no government entity-wide ECM solution, which leaves them on their own to choose and deploy a departmental solution. Even when IT defines a set of technology standards, recommends vendors, and offers assistance in deployment and configuration, each department ends up with a discrete system for which it is responsible. Departments must administer and maintain their systems, budget for license fees and upgrades, and develop disaster recovery plans. The aggregate cost to the government entity is much higher than if all departments could leverage a central ECM as a service infrastructure. In general, CIOs recognize that almost all departments they serve need ECM as well as records management. They see the value in providing these services centrally, but lack the experience, and often the staff resources, to plan, deploy, and administer centralized ECM application services. The remainder of this white paper addresses the issues that make the difference between a successful shared services deployment and one that fails to attain the desired results. 3
- 4. BUILDING THE BUSINESS CASE FOR SHARED SERVICES Very few government CIOs have the funding to provide ECM as a service across a large government entity as part of their standard service delivery model and operating budget. Nevertheless, this is the most favorable scenario. Government agencies that can justify funding a centralized ECM infrastructure and enterprise licensing model without the need to rely on departmental contributions or a chargeback model find shared services deployments faster, easier, and more effective. A compelling case for centralized ECM as a service can be made by comparing the cost of each department buying, implementing, and maintaining its own ECM system versus an ECM service that all departments can use. The overall cost savings should be substantial enough to justify a funding request to a governing board. Often little centralized IT funding is available and, despite a common need, departments show little interest in jointly funding a centrally managed service. In this case, centralized IT can only manage standards, establish preferred vendors, and streamline procurement through vendor agreements. But the result is still a series of departmental implementations, which not only increases costs but makes it much more difficult to define enterprise taxonomies that support effective content and process sharing between departments. A reasonable compromise blends these funding models. In a blended model, IT provides enough funding to establish, administer, and support the central ECM infrastructure. Departments that elect to participate fund their own licenses and software maintenance fees, which can be purchased based on a discounted model and master contracts with an ECM vendor. The cost and work process benefits from centralization and economies of scale make a centrally managed system attractive, especially over the long term. Offering the service via a private or public cloud increases those benefits. By partnering with a vendor that offers ECM as a service in a hosted or cloud model, governments can rapidly deliver the promise of a centralized ECM as a service across all departments without the need for extensive investment in staff, software licenses, and infrastructure. As the number of departments and users of the system grows, a cloud model allows the hosted system to scale to meet growing demands without the need for the government organization to add more infrastructure and staff. A SHARED SERVICES DEPLOYMENT MODEL A successful ECM as a service initiative requires a viable, field-tested deployment model that standardizes information taxonomies, metadata, object types, a security model, and information governance policies. These five components form an enterprise foundation for ECM as a service that supports collaboration and interoperability between departments. Contracts, which are common documents in virtually any agency, provide a simple illustration of how this enterprise foundation works. A contract can be defined an as object type that requires a certain set of metadata: department, primary contact, contract number, contract date, and contract vendor, for example. By predefining common content objects before rolling out a centralized ECM service, agencies avoid the problem of highly customized and siloed departmental solutions that make information sharing very difficult. An enterprise foundation should be part of a CIO’s go-to-market plan. The plan might also include the specific applications that will be offered or supported during initial deployment. To simply announce the ECM service as “open for business” without any standards or constraints invites chaos and poor outcomes. Of the five components, information governance, arguably the most important, is often overlooked. The following sections examine this topic in greater detail. 4
- 5. Information Governance As transactions with citizens and businesses go from “in line” to “online” and data collection becomes automated, agencies have an opportunity to capture records based on predefined business rules. These rules can govern what is captured, how long it is retained, and what constitutes appropriate use. These concerns are the province of information governance and they must be top of mind in any shared services initiative. Information governance requires a proactive, policy-driven information management strategy. Such a strategy integrates agency objectives with information management policies that address security, data privacy, retention, appropriate use, eDiscovery, and regulatory compliance throughout the information Iifecycle. An information governance strategy should simplify the demands and lessen the inherent difficulties of managing information by standardizing and automating processes and policies across government systems and IT infrastructure. The basis of any information governance strategy is the appropriate retention and disposition of electronic and physical information. A well-designed retention management solution provides a cost-effective means to better cope with large volumes of content; adhere to rapidly changing compliance standards; and effectively respond to operational, corporate, and regulatory demands. For many government entities, retention management alone adequately meets information governance requirements. Nevertheless, some organizations operate in a compliance environment that demands formal records management. Ideally, ECM as a service deployments should offer both — user friendly but comprehensive retention management and formal records management where needed for compliance. Retention management Ideally, retention capabilities should operate automatically, without user intervention, to consistently manage the retention and disposition of all agency information across a broad set of regulatory, compliance, and investigative mandates. They should be robust enough to satisfy the requirements of formal records management, yet be adaptable to small deployments where those requirements are unnecessary. • Automate retention according to document type and event-based triggers in workflows and business processes via robust policies. Apply policies automatically and transparently to minimize end-user involvement and maximize policy compliance. • Configure automatic disposition in the policy or define mandatory conditions that enforce administrative review and approval prior to disposal. • Apply litigation holds. Litigation hold capabilities suspend disposition based on ongoing investigations and provide an interface with audit trails for the legal team. Holds can be managed by legal case matter with support for multiple overlapping holds. • Set expiration dates to ensure the systematic disposal of non-records content when no retention policy or litigation hold has been applied. 5
- 6. Formal records management Formal records management encompasses retention management while providing the ability to meet stringent government records standards such as DOD 5015.2 v3. With formal records management, administrators have access to: • Management interfaces that define the contents of a record along with its security model, content permissions, retention duration, and disposition criteria • User and role-based content controls that can manage access down to the individual record level • Certifiable audit trails that detail record possession, condition, transfer, and/or immutability • Notifications that alert records owners when records are eligible for disposition, track record progress, and produce confirmation reports on records’ ultimate destruction • Federated services that extend in-place records management to information located in multiple repositories • A virtual master repository with a single set of behaviors that ensure data integrity while content remains in its source repository • The ability to link physical records with electronic records under the same standards ADVANCED CAPABILITIES Beyond basic content management services such as tiered repository access controls, check-in/check-out, document versioning, and search, ECM as a service can offer agencies more advanced capabilities. Case and Process Management For government agencies at all levels, case management is the way in which many vital services are delivered. But in organizations where casework is still mainly paper-based, the paper case file remains a procedural bottleneck. It obscures visibility into or across cases, increases the risk of errors, omissions, and lost documents, and slows decision making. That’s why today more and more agencies at all levels of government employ collaborative case management (CCM), which leverages the core components of enterprise content management. Using a combination of ECM capabilities (including content, business process, and repository services; federated search; and comprehensive reporting), CCM can accommodate any type of case using secure collaborative workspaces to manage the case management lifecycle and accelerate the resolution of case files. Many government agencies have implemented case tracking databases and applications. What these case management systems often lack is an online link to case documents for rapid retrieval and review. Virtual case files centrally manage case content Instead of paper case files and folders, virtual case file (VCF) technology allows any piece of case content to be managed as an information object, which can be part of multiple VCFs and compound documents simultaneously. Alterations to an object simply create another version, without altering the original object — and all changes become part of the VCF audit history. 6
- 7. This ability to manage sophisticated information relationships across case files enables patterns to be detected that might otherwise be missed. With information linked across agency boundaries, agencies can more quickly recognize Social Security claim fraud and identity theft, provide leads on missing persons, detect instances of the same citizen contacting the government through multiple departments, and more. More and more case information arrives in digital form and frequently consists of voice, video files and pictures. This trend increases the need for ECM systems that can accommodate these file types as well as digital equivalents of the standard paper documents that make up the traditional case file. Business process management streamlines and automates processes Process improvement continues to be a top priority for government agencies. Sustained funding — and avoiding failure-to-comply law suits — often depends on meeting mandated response times. Plus, process inefficiency is especially critical when agencies face budget constraints and limited staff. Agencies also face increased pressure to provide rapid services delivery through online portals and websites. Business process management (BPM) can streamline and automate processes, moving tasks to the person best qualified to do the work. At the same time, BPM provides the foundation for a comprehensive view of agency requests across programs. Process modeling and simulation tools help identify potential bottlenecks before processes are designed and deployed. Business process management can be used to: • Orchestrate a collection of manual and automated processes that enforce policies and procedures such as intake protocols or benefit termination actions • Standardize processes through the application of business rules to activities such as enrollment, benefit increases and reductions, and mandatory program reviews • Integrate with standalone systems • Enforce records management and retention policies that support state and federal regulations • Track key performance indicators • Maintain performance as operating conditions and requirements change • Provide an audit trail to monitor record keeping practices and measure policy compliance Cloud Services ECM as a service can also be part of broader efforts to transition from physical IT to the simpler, more cost-effective, and agile IT world of cloud computing. Cloud computing can deliver IT as an efficient, reliable, and secure service — similar to utilities. With this new model, line-of-business applications within an agency can all draw from the same pool of computing power and realize the scalability, reliability, performance, and security associated with a utility. Even as budget pressures ease somewhat on governments, the trend toward cloud computing continues to gather momentum. Lower operating costs make good sense in any economic environment and cloud computing extends the value IT investments. 7
- 8. Provisioning, for example, looks very different in a cloud environment. Typically, IT provisions bandwidth, servers, and storage capacity to meet near-worst-case levels — wasting a lot of resources on average, since near-worst-case seldom occurs. In a cloud deployment, resources are provisioned to the average, rather than near-worst-case. If a spike in usage requires extra resources, they come from a shared pool. This IT-as-a-utility approach helps optimize agency work processes and applications. While public cloud deployments still raise security concerns among government IT professionals, hybrid or public-private clouds (single tenant deployment in an off-premise data center) give direct access to a scalable IT environment, with greater management and security controls. With ECM as a service in a vendor hosted environment, government organizations can avoid the cost and complexity of implementing and maintaining an enterprise ECM system. A robust, hosted ECM solution includes the application, operating system, database, and servers, as well virtualization, security, storage, and management infrastructures. Upgrades and maintenance are automatic. Disaster planning is the responsibility of the hosted data center. And ECM domain experts configure the solution to meet business and operating requirements. In a hosted scenario, an ECM system can: • Lower total cost of ownership by 30‐60 percent year over year • Fully address information security and control • Provide optimization, pre‐configuration, and management by experts • Offer rapid provisioning for new projects • Deliver significant improvements in support • Boost availability and disaster recovery preparedness A brief look at the legal and regulatory environment at the state level underscores the importance of the hybrid model, which is equally relevant for federal and local government entities. State adoption of public cloud services In the 2013 survey of the National Association of State Chief Information Officers (NASCIO), CIOs expressed concern that state laws, regulations, and policies restricted their ability to adopt cloud services.¹ Of particular concern were laws governing data privacy.² Many state CIOs (18 percent) expressed uncertainty about the barrier laws, regulations, and policies may or may not impose to cloud service adoption.³ Thirty-one percent were working to reform those laws.4 Not surprisingly, many issues in this area don’t surface until a cloud services project is underway.5 “Local governments often move to cloud services ahead of larger government entities because they’re often the most budget constrained and frequently face significant IT staffing challenges. But, we’re starting to see more county and state governments putting their applications in hosted environments as long as they can enforce security. A hybrid or public-private model can offer that.” —Rob Silverberg, Industry Director, Public Sector, EMC 1 NASCIO, TechAmerica, and Grant Thornton. The 2013 State CIO Survey. Alexandria, VA: Grant Thornton, 2013. 20. Print. 2 Ibid. 3 Ibid. 4 Ibid. 5 Ibid. 8
- 9. Mobile Computing Any ECM as a service initiative must take into account the growing demand for mobile services among government workers and citizens accessing government services. As Deloitte’s Gov on the Go report points out, the public sector lags the private sector when it comes to increasing productivity.6 The report cites a number of factors for this — not the least of which is the private sector’s ability to harness “the disruptive power of technology and to use it to invent better and more efficient processes.”7 Over the past 25 years, while private sector productivity grew 50 percent, public sector productivity declined.8 Now, mobile technology presents government with a chance to radically improve citizen service delivery and boost the productivity of agency staff. “Our analysis shows that if mobile adoption rates in government were to double to 70 percent, additional value generated (in terms of government output) could exceed $50 billion annually.” —Deloitte, Gov on the Go9 By and large, mobile apps for citizens seem more prevalent than those for government workers, with some noteworthy exceptions. “In Florida, more than 2,300 foster care caseworkers use cameraenabled smartphones and laptops to remotely capture time- andlocation-stamped images, notes, and observations that immediately upload to the state’s online database. According to our analysis, mobile adoption could result in a 45 percent increase in caseworkers’ productive time.” —Deloitte, Gov on the Go10 6 Eggers, William, D., and Jafe, Joshua. Gov on the Go: Boosting Public Sector Productivity by Going Mobile. Vol. 2. Deloitte University Press, 2013. p 2-3. Print. 7 Ibid. 8 Ibid. 9 Ibid. 10 Ibid. 9
- 10. When combined with the power of information via ECM as a service, mobile computing offers government at all levels the opportunity to operate much more efficiently while delivering better, faster citizen service. SharePoint As a collaboration tool and basic content management solution, SharePoint has a lot to recommend it. Users love SharePoint; time to proficiency is short. Nevertheless, government CIOs and information infrastructure architects — the “big picture” thinkers in the IT ecosystem — have to consider more than ease of use as they accept and reject IT building blocks and try to create an infrastructure that meets a variety of objectives. They must take into account security, compliance, business process integrity, collaboration, line-of-business system integration, archiving, cloud and mobile technologies, and more. In a shared services environment, these concerns assume even greater importance. The public sector challenge: capitalizing on the value of information The demands agencies face to deliver better, faster, more transparent citizen service puts enormous demands on their IT organizations. The need to optimize infrastructure and to effectively align existing and new technologies has increased exponentially. In fact, the line between business optimization and infrastructure optimization has blurred. The lack of either can compromise service delivery. Smaller budgets and shorter ROI requirements leave very little margin for error. Microsoft SharePoint has become a fixture for many organizations trying to cope in such a challenging environment. It’s easy to deploy and use, nicely supports ad-hoc collaboration, and is well integrated with Microsoft Office. But easy to deploy does not necessarily mean easy to manage. For example, SharePoint tends to fall short when applied to large volumes of content and many users. Scaling SharePoint means adding more sites, which in large organizations can lead to hundreds or thousands of discrete SharePoint instances with no central control, governance, or even visibility. SharePoint does not create a long-term strategic path that enables agencies to capitalize on the value of their information while meeting increasingly strict information governance and compliance requirements. It is well suited to departmental collaboration but cannot function well as a system of record across many departments in a larger government entity. • SharePoint = freedom to collaborate • True ECM = structured information governance, security, and control Accommodating SharePoint within ECM as a service deployments To keep up with the citizen service expectations confronting today’s government agencies, ECM as a service requires an intelligent information management platform. The platform must be high performance, adaptable, scalable, open yet secure, and compliant. Its horizon must stretch beyond any particular content generating technology. An information management platform that enables ECM as a service should: • Support client or device heterogeneity • Provide structure for knowledge worker tasks • Deliver unified information governance and visibility • Lower operational cost and complexity 10
- 11. FIVE DEPLOYMENT PITFALLS A Google search of “failed software projects in government” returns millions of results. Of course, software projects fail in the private sector as well — but often not with the attendant news-worthy ridicule reserved for public sector failures. Our experience with ECM as a service deployments in government has revealed five pitfalls that increase the potential for failure dramatically. • Undefined information taxonomy, object types, and metadata Not setting standards in this area before rollout simply invites chaos. And it is much harder to implement and enforce standards after rollout. • Heavily customized departmental solutions Highly customized solutions do not support interoperability and are expensive to upgrade and maintain. They are also much more likely to occur in an environment without clear standards. • Ignoring records management and retention policies Records management should be invisible and automatic. Therefore it should already be in place from day one. Users cannot be expected to understand records policy, let alone enforce it. • Over ambitious initial deployment This is Software Deployment 101, yet bears repeating. Choose an initial deployment goal that will show early success. Don’t pick the most the thorniest, most complex problem to solve first. Selecting an initial project that shows value and generates positive results will encourage other departments to seek similar benefits. • Neglecting to leverage consulting expertise A little consulting goes a long way. Will you have to pay for it? Yes. Will it be worth it? Yes. Do you have to choose your consultant wisely? Of course. ECM as a service in the public sector is a practice for many consulting groups. All the mistakes you can make, they’ve already seen and know how to avoid. Consulting services are especially valuable in determining and developing enterprise deployment standards, governance policies, and providing t taxonomy templates based on experience with similar deployments. GETTING STARTED If you’re considering a shared ECM initiative, we recommend the following steps. Although we address consulting specifically in section three, an experienced consultant engaged early on can save a lot of headaches down the line, including the pitfalls described above. Assess the Current Environment There are most likely some ECM tools and systems already in place. A lot can be learned by identifying them and how they’re used. If certain departments are ECM leaders, they can provide valuable information and offer insights that will help shape a centralized deployment model. Likewise, there may be departments that have ECM needs but no tools. Understanding these needs and evaluating common requirements will be critical to developing standardized offerings that can be rapidly deployed. Once you have a good understanding of the current environment, you’ll be in a better position to gauge the desire of individual departments to leverage a central ECM service. 11
- 12. Build the Business Case Determining the most viable way to fund a centralized ECM system will lead to discussions about cost savings. Would there be greater potential cost savings by going with a private, public, or blended cloud model rather than an on-premise solution? Building the business case goes hand-in-hand with socializing the shared ECM concept with departmental IT leaders. This is the time to set a common vision and generate support. Set Standards If you haven’t already, choose a consulting partner with experience in shared ECM deployments. Your consulting partner can be very helpful in standardizing ECM solution functional requirements for vendors and tools through RFPs. Also, this is the time to define the deployment model’s common entities such taxonomies and information governance, including retention and records management policies, security, and user access. Again, leverage consulting expertise for this step. Finally, even if mobile access will not be part of the initial deployment, the deployment model should include plans for mobile device support. Deploy the Initial System Choose an inefficient, paper-based process for initial deployment, but not one that is overly complex. You want an early success that you can promote throughout the organization. Rely on the expertise of your consultant or systems integrator. This is not the time to DIY. Plan the Larger Rollout With experience from the initial deployment, you can add functionality to the system that leverages the standards and scope of the deployment model. To ensure cross departmental interoperability, avoid heavily customized applications. CONTACT US To learn more about how EMC products, services, and solutions can help solve your business and IT challenges, contact your local representative or authorized reseller — or visit us at www.EMC.com. Copyright © 2013 EMC Corporation. All Rights Reserved. EMC believes the information in this publication is accurate as of its publication date. The information is subject to change without notice. The information in this publication is provided “as is.” EMC Corporation makes no representations or warranties of any kind with respect to the information in this publication, and specifically disclaims implied warranties of merchantability or fitness for a particular purpose. Use, copying, and distribution of any EMC software described in this publication requires an applicable software license. For the most up-to-date listing of EMC product names, see EMC Corporation Trademarks on EMC.com. www.EMC.com 12 EMC2, EMC, the EMC logo, and the RSA logo are registered trademarks or trademarks of EMC Corporation in the United States and other countries. VMware is a registered trademark of VMware, Inc. in the United States and/or other jurisdictions. All other trademarks used herein are the property of their respective owners. Published in the USA. 12/13 White Paper H12586