make documents matter

8/4/2019 Make Documents Matter

1/72

makedocuments

matterhow to work smart

with your documents


2/72

table of contents

5 strategies to get buy-in for document management

8 smart ways to manage documents1

11

19

68

26

51

34

43

57

37

Work smart: managing documents in the cloud

author bios

working smart in a mobile world

get efficient with smart insights into documents

business insights

8 steps to manage success

8 Ways to look at content management systems

the cloud, not a crock

security & Data protection for online document

management software

technical insights

This work is licensed under the Creative Commons Attribution-NoDerivs 3.0 Unported License. To view a copy of this license, visit http://creativecommons.org/licenses/by-nd/3.0/

or send a letter to Creative Commons, 171 Second Street, Suite 300, San Francisco, CA 94105, USA
http://creativecommons.org/licenses/byhttp://creativecommons.org/licenses/by


3/72

v v

smart waysto manage

documentsHow many documents, spreadsheets, and

presentations do you handle in a day?

Two? Five? A dozen? Now multiply that

across your entire organization. Thousands

of proposals, invoices, contracts, and other

documents are created, edited, and shared

by your teams every 24 hours.

With so many documents generated each

day, how can you effectively work with

colleagues to co-author a document? How

can you be sure that a proposal has been

validated? And how can you store, locate,

and share the right document with your

team?

by: knowledgetree 1


4/72

v v

introductionDocument management solutions have arisen as away to address the challenge. Typically these tools are

used to overcome the document chaos that many legal,

nance, HR, and operations professionals feel when

confronted with tens of thousands of les.

But how do you choose and implement the right

document management solution for your organization?Lets walk through 8 steps that will help you select the

tool that is right for you.

2


5/72

v v

define objectives1 Before managing documents, you should know what a successmeans. Some common goals for document management are:> Increasing productivity by streamlining document led business

processes.

> Increasing efciency by helping users to quickly locate and sharedocuments.

> Reducing paper consumption by connecting document

management tools with fax servers and scanners, keeping all

documents electronic.

> Promoting collaboration by allowing teams to work together to co-

author documents. This can radically increase quality as colleaguesinsights can be included and managed.

> Ensuring compliance with regulatory regimes by securely storing and

monitoring access to documents.

Regardless of your goal, by beginning the process here you can better

understand your criteria for selecting a tool.

3


6/72

v v

identify business processes2 The next stage is to determine which business processes would benetfrom tooling. This helps to boost adoption and demonstrate value in your

organization. Smart processes for documents management:

> Require reviews and approvals before a document can be nalized.

> Have periodic re-evaluations of documents, for instance for contracts that

are renewed annually.

> Involve a high-degree of collaboration across teams, with multiple team

members contributing or editing content.

Typically, youll nd processes like contract management, employee on-

boarding, sales proposal generation, and invoice payments are strongcandidates for document management.

4


7/72

v v

determine your delivery model

3Document management has evolved signicantly since it was

rst envisioned. Now, you can choose behind the rewall

software that is installed on hardware you purchase, or cloud

models that reside on secure servers off-premise. Which

model you choose will be a factor of your organizations

structure and how it will use the technology.

On premise technology gives you control over the physical

infrastructure. It does not require an internet connection, andyou generally are free to customize these installations heavily.

There are drawbacks. The capital outlay and ongoing

upgrade and maintenance costs drain IT resources that could

have been deployed toward innovation. Also, to access the

repository generally requires access to a VPN, which can

complicate usage.

Cloud-based software has the advantage of a

predictable, generally lower cost. These tools tend to be

easy to use, quick to deploy, accessible from any internet

connection, and intuitive for users. And since cloud

infrastructure is managed by a specialized team, there is

a strong regimentation of security and up-time protocols.

However, there may be a loss of customizability in

some tools. And cloud-based tools that lack desktop

synchronization or mobile tools will be inaccessible when

there is no internet connection.

Document alerts are a key attribute for many decision-makers.

cloud-based software has the

advantage of a predictable, generally

lower, monthly cost.

5


8/72

v v

identify requirements

4Now, we can move into the evaluation of which document managementsolution makes sense for your organization. There are many functional

attributes beyond deployment models that you should consider:

> If your team is a heavy user of Microsoft Ofce,

integration into that suite makes sense. This

typically allows you to download the latest version

of a document, edit or co-author it, and check it

back in without version conicts.

> Documents that must be periodically reviewed

can be better managed with alerts. Alerts can be

set at specic times or for lengths of time to notify

you or a team that a document must be reviewed.

> Managing the lifecycle of a document so that the

correct people review, contribute, and authorize adocument before it is completed is a key attribute

for many users.

> Finding a document among tens of thousands

is not easy. You need to be able to assign rich

descriptions that help users locate what they need.

> Your search capability should allow you to search

within a document and within metadata to allow

you to quickly nd what you and your colleagues

have stored.

> Collaboration among team members has been

identied as one of the most critical elements of a

document management tool. With activity feeds

and the ability to share ideas, your documents are

enriched.

> You want to ensure that you have access to your

documents on a global basis, wherever you need

them. Internet-powered tools allow you to easily

access documents from any connected device.

> Security is always important. Are there tools for

ensuring user authentication? Are there ofine

backups and other disaster recovery protocols?

With the right requirements identied you can better

choose the right system.

6


9/72

v v

demonstratecandidate systems5 Now that you have dened the criteria that will lead to adecision, the next step is to evaluate which tool makes sense.A good step is to narrow the selection by trialing software.Some tools do offer the ability to try before you buy. Then,

once you have identied and weighted your criteria, you can

contrast the various solutions and select your winner.

7


10/72

v v

prepare the groundwork

6You want to ensure that your document management tool is well used and wellstructured. Your aim is to overcome document chaos, and that starts at this

stage. You should look into criteria like:

> What kind of documents do you plan to store? Will there be contracts?

Invoices? Understanding the types of documents will affect how you group,

name, and secure your documents.

> What is the taxonomy of your documents? You can generally organizedocuments into folders; by setting a base model up front, youll get a leg-up on

organization.

> You can also organize documents using descriptors and metadata. By

determining which metadata is required, you can enforce policies and ensure

that documents are easy to group and locate.

> Different users and groups will need access to certain documents, and some

need to be restricted. You should assess which groups will use the tool and

what they should be permitted to access.

Because many users will access the document

management tool via Microsoft Office, its

important to integrate with the suite.

8


11/72

v v

get started with the system

7Now were ready to start rolling out the system to users. A thought-through plan

will make rollout simple to complete.

> Analytics help identify content that matters to users.

> Tools often have an email notication system that allows you to invite users and provide them with a sign-up process.

> The more relevant documents that are present in the document management tool, the more incentive users have touse it. Some tools offer bulk upload functions that make it easy to add thousands of documents at once, increasing

momentum.

> Many of your documents will be created via scanning existing paper documents, or via a fax server. Integration with

these technologies can further simplify the addition of large numbers of documents.

> You should make sure that business processes are tuned with your document management tooling. This could mean

setting up workows for approving or processing documents that match your preferred lifecycle. It could also mean

creating pre-congured folder templates for standard activities, like all content needed for a new client.

> Social tools like feeds surface relevant content.

> Because many users will access the document management tool via Microsoft Ofce, its important to integrate

with the suite. Generally, these tools are add-ons that can be simply downloaded and installed as a supplement to a

document management tool.

9


12/72

v v

ensure adoption

8The proof is in the execution. You need to make

sure that your teams are effectively using your

document management solution. Typically, a

network effect occurs with document management:

as more people use the technology, more people are

attracted to it. To ensure adoption:

> Make training available through online training and

discussion boards. That lets people get comfortable

with using a tool. Of course, the more intuitive a tool

is, the simpler this step becomes.

> Communicate policies to co-workers so they

understand the taxonomy and policies for your

document management tool. That will ensure that

organization gets off to a good start.

> Start collaborating and sharing. The network effect

will get going when you start including colleagues in

your process. So, share your documents. Include

them in the editing and content creation process.

Make sure that the right people are incorporated into

document lifecycles.

When your organization depends ondocuments to be well-controlled,

you need to implement a document

management solution. Following

these 8 steps and best practices, youcan successfully choose and launch

tooling and rein in document chaos.

10


13/72

v v

work

smart

managing documents in the cloud

Each day your company creates hundreds

or even thousands of documents. These

contracts, agreements, presentations, and

proposals are generated, stored, and shareden masse by your team. But with each new

document comes a management challenge.

How do you ensure that the right content is

created? How do you help teams to work

together to create content? How can you

securely store your documents so they are

easy to locate? And how can you quicklyaccess your documents when you need

them? This section explores an approach.

by: knowledgetree 11


14/72

v v

document management as a solution

Document management tools have emerged to address the

challenge. These technologies help teams to create, manage, and

share documents in a secure vault. They have had a signicant

impact on productivity, letting users efciently share information. And,

by helping to organize les, they overcome document chaos.

However, traditional tools are often hamstrung by their complexity.

They tend to emphasize new functionality without recognizing userneeds for efcient processes. As a result, professionals struggle

to get documents added and shared, and the efciency gains from

document management evaporate.

12


15/72

v v

cloud as an approach

Cloud-based solutions have emerged as

alternatives in recent years. Their economies of

scale and anywhere availability have made the

cloud mainstream for business use. The scale

of the cloud means that mid-sized companiesand teams within larger organizations can get

enterprise-class functions at a lower cost. And

they can get started much faster, without the

hurdle of hardware and other capital expenses.

Document management as a process has also

capitalized on this trend, with cloud-based

technologies now available. As with any tool,

it is important to evaluate how it ts into yourorganizations processes. This section steps

through how a cloud-based approach can help

you regain control over your document led

business processes.

create and

collaborate

manage

documents

organize

and share

securely

access

13


16/72

v v

The lifecycle of a document often begins with a group effort. Teams may submit

different threads of content, edit it, and add renements and comments. These

teams are often spread across multiple ofces, and may even be in other

geographies.

As a result, the exibility of cloud-deployed tools becomes a valuable asset for

creating documents. Simply emailing copies of documents between parties leadsonly to version chaos. Similarly, relying on shared drives in the cloud or on your

network is an unmanaged approach and only leads to more complexity.

An alternative is to co-author documents online. Frequently used technology lets

users access a browser-based document editing tool to add and modify content as

they would in a standard word processor. This is especially useful for users that

are highly mobile and when teams are widely spread, as cloud-enablement avoids

VPN issues and makes distance irrelevant.

creating documents

14


17/72

v v

Similarly, some cloud-based document management tools offer

integration into Microsoft Ofce. This permits users to create

content and share it via the cloud without leaving the tools theyare used to. Document management tools without this integration,

cloud-based or otherwise, are less likely to be adopted by users.

After all, changing processes is difcult and it is important that a

good solution not get in the way of use.

Many documents are created not by a single user or team of

users, but en masse. For instance, you may have large volumes

of invoices that are automatically generated. Or, you may need

to scan and store paper-based les. Or, documents may arrivefrom a fax server. An effective cloud tool will integrate with fax and

scanning servers to automate the import of les into the document

management solution.

15


18/72

v v

Because documents are often generated by multiple people, it is important to control

their lifecycle. That means establishing workows that documents can follow from

creation to completion. With some cloud-based document management tools you

can establish workows and automatically enter documents into a controlled approval

process. The cloud assists this process by allowing even remote approvers to review

and OK documents via the Internet.

Documents are living entities that change over time. So, users need to stay on top ofchange. As new content is added to a proposal you need to know whats changed, and

revert if necessary. You should be able to subscribe to documents of interest so you can

stay on top of their evolution. Again, accessibility of your documents via the internet lets

you quickly spot unwanted changes, or access the latest version as needed.

Also, documents often have specic timeframes attached to them. For instance, a

budget may need to be reviewed at a set date. Or, a contract may need to be renewed

on a certain day. Document alerts should be available so you or your team can beprompted when a review is needed.

Because documents evolve over time, you should look to share insights from team

members in order to help enhance document quality. So, you should have commenting

capabilities and usage tracking to monitor what colleagues think about a document and

how it can be improved. The cloud again provides an ideal collaborative platform, as

users can connect and comment from anywhere and ensures that you have analytics to

spot new content and stalled processes.

manage processes

16


19/72

v v

Documents are created to be used. That requires that they can be easily found by

your colleagues. To do so, your documents should be well organized. Typically, this

involves creating a structure based on folders. So, you may have a nance folder

and accounting, audit, and so forth as sub-folders. The structure will of course

depend on how your organization consumes information.

But some documents apply to multiple folders, defying a strictly hierarchical approach.That is where web-like approaches to organizing documents can be valuable. For

instance, tagging documents with descriptions allows documents to be grouped based

on several topics. So, a new hire document could be grouped under HR, Company

Policies, and Employee Tools, all at the same time. Tools should be smart so tags can

be customized to your wn model.

This approach to organizing documents lets users browse for what they are interested

in, or using a search function to locate what they need. Good tools have advancedsearching capabilities that search in document names, descriptions, or even in the

document content itself. For instance, within the text of a PDF document.

organize documents

17


20/72

v v

The highest quality document is useless if it cant be easily

accessed. Here, cloud-based tools are particularly useful.

The global nature of the cloud means that authorized users

can simply login to their vault and view, modify, or download

documents.

On-premise document management tools often suffer from

an inability to access documents when on the road. This can

be especially crippling for auditors, accountants, lawyers, and

other business users that frequently travel or work offsite.

Sharing documents with colleagues is an important element

here. Tools that allow you to share links or send les asattachments are relatively standard. But it is important again

that access is available. A link is irrelevant if the recipient is

on the road and cant access it. Cloud-based tools offer that

accessibility. At the same time, when dealing with sensitive

documents it is important to monitor how a document is

shared. Auditing the accessing and sharing of a document

helps avoid compliance issues. Analytics can help here too by

surfacing relevant content to the right users.

access documents

Document management is a necessity for nance, accounting,

HR, legal, and other document intensive professions. It helps

users to efciently organize and structure the knowledge

within their organization. The cloud enhances this capability

by boosting collaboration, sharing, and access to documents

across even global teams.

18


21/72

v v

working smartin a mobile worldYou are always on the move. One day you build a presentationat your home ofce. The next, youre running through a

contract at a client site. No day is the same, but one thing is

consistent: the need for you and your group to collaborate on

documents.

The documents that are most essential to your team are

often built and used by globally distributed and mobile teams.

These teams need instant, anywhere access to view, edit,approve, and share their documents across large numbers of

professionals.

This chapter looks at best practices as we follow a project team

that is building a proposal for their board.



22/72

v v

A project team led by Patrick needs to develop a presentation

for the board. They hope to get approval for a new initiative

called Project Galaxy.

Patricks team includes numerous professionals that mustcontribute to the document. Marketing adds information

about market sizing from the satellite ofce in the UK. The

legal team, based in New York, is including information about

contracts. And the project team must add timelines and

resource requirements.

Because of the large numbers of participants it is critical

that the contributions are well managed. It can becomeimpossible to control if team members are simply emailing

differing versions of the presentation to each other. Plus, it

is not always convenient for team members to download a

le, modify it, and re-upload it.

jointly create a proposal

chicago, 8:00 AM

20


23/72

v v

A good practice here is to use tools that plug-into

Microsoft Ofce. Some document management

tools provide you with the latest version of adocument directly from your vault via Microsoft Excel,

PowerPoint, Word, and Outlook.

integration into microsoft

office tools simplifies the

co-authoring of documents

across global teams.

In advanced tools, users can even review prior

document iterations and see user comments on

those versions without leaving Microsoft Ofce.

Critically, the tooling must control content asmultiple people work on a document. It must detect

version collisions and notify users when others

have modied a document. This allows users to

resolve and merge their contributions with ease.

The globally distributed Project Galaxy team

has now successfully created the draft proposal

document. Its time to start sharing it with other

colleagues.

Some document management tools allow you to

share les as attachments or links back to your

vault. Business users should be careful to look for

solutions that allow users to share with groups of

co-workers, like all members of the Project Galaxy

team and related executives.

21


24/72

v v

Now that the document is in draft form, it can be

reviewed. Patrick wants to ensure that all relevant

parties have given the document their OK. Some

business-centric document management tools allow

you to create workows that govern the approval ofa document. Patrick denes one, includes his boss

Stephen in the cycle, and adds the presentation to

the process.

Meanwhile, Stephen is at the airport preparing to

leave for New York. He receives a notication on

his mobile device that the presentation is pending

his approval.

On-premise technologies struggle with this use

case as Stephen would need to login to a VPN

on his laptop in order to access the document.

Instead, some document management tools allow

Stephen to connect to the document vault, search

for, and preview documents to avoid opening the

wrong items.

Once opened, Stephen reviews the document

and decides he wants to take another look

while on the plane. You should look atdocument management tools that permit use

even when disconnected, for instance by

saving your document to a secure vault locally

on your device.

Even while sitting in the lounge Stephen

has some ideas about how to improve the

presentation. He must be able to, for example,

modify metadata that describes the document.

He may want to re-categorize the document to

make it more searchable. Stephen must also

be able to easily share the presentation, even

when on the road. So, once satised with

his review, Stephen shares the le with the

executive team with a few simple clicks on his

mobile device.

departure lounge, 11:30 AM

review the proposal

smart tools like group sharing,

workflow management, and alerts

are critical to help keep remote

teams informed.

22


25/72

v v

new york hq, 12:45 pm

stay connected

Stephens email arrives in the inbox of the companys

CFO. She connects to the document via her browser

and notices that the project folder is missing the

Project Galaxy budget. Thats a key element of theproject proposal.

So, she simply drags and drops the le from her

desktop into the Project Galaxy folder. Drag and drop

functionality makes document uploading simple, and is

a must have for your document management tool.

The project team had set up notications for theProject Galaxy folder. That means that when new

content is added or modied, members receive

an update. Now that our CFO has added the

spreadsheet, all Project Galaxy team members are

instantly aware.

23


26/72

v v

chicago, 1:00 PM

entering the glide path

Patrick receives the notication about the new

spreadsheet. Hes about to head to the airport and

wants to make sure that he has the latest les before

he leaves.

Some document management tools offer hot folders

that make that task easy. The concept allows Patrick

to select which folders in the vault that he wants

to stay on top of. These folders are automatically

synchronized with the desktop.

That means that Patrick can head to the airport

knowing that his laptop already has the CFOsspreadsheet synchronized for ofine access.

That allows Patrick to review and edit the

document with his own computer on the plane.

And when hes reconnected, his changes can be

synchronized back to the cloud vault. This kind

of synchronization is important for your document

management tool.

24


27/72

v v

chicago and new york HQ, 1:30 PM

including final comments

The project team has been notied automatically about the

changes to the presentation and the addition of the spreadsheet.

In some tools they can comment and share opinions about their

documents through social functionality.

Patrick goes to the document page, reviews the comments, and

includes several suggested changes in the nal version of the

presentation.

He now moves the document to the nal stage in its process, and

is ready to go to the board. He shares the email securely with the

administrator for the board, who saves the le so its ready to bepresented.

Todays highly mobile business world means that team members

must have access to their documents at all times on the road or

at the ofce. And just as important, they need to be able to work

together to create and improve their documents from wherever

they are.

users must be able

to access, view,manage, and share

their documents from

wherever they are.

25


28/72

v v

5strategies

t

og

et

buy-indocument managementfor

Its no secret that todays businessesgenerate a massive amount of information

in a variety of formats. Even small and

medium sized businesses or corporate

departments deal with an unprecedented

quantity of documents that must be stored,

managed, and shared across teams or

across the enterprise.



29/72

v v

introductionIndividual and team productivity are not

the only things that suffer when documents

cant be located, versioned and guided

through a dened business process.

Government regulations in many industriesand privacy laws in many countries set

strict mandates on the treatment of records.

Companies risk nes and penalties if they

are not in compliance with a wide range of

laws and regulations surrounding document

storage and retrieval.

document management software is one sure way to

bring order to document-led business processes.

Anyone who has ever worked in an ofce knows the frustration

of sharing documents with colleagues. Without a centralized

repository, documents are usually stored on individual

computers and emailed around on request.

When an individual leaves the company, his or her store of

knowledge and documents often leaves too. Documents are

also subject to loss from hard drive failure if regular backups

are not performed.

Approaching document management from a business

context will ultimately yield the results that business

managers and end users really want - improved access

to information to support business activities and improved

productivity.

27


30/72

v v

tangible benefits intangible benefits> Improved productivity and more efciant business

process.

> Reduced cost through adherence to optimized

document workow processes

> Reduced risk of non-compliance to government

regulations due to established document retention and

management guidelines

> Rapid return to productivity following a disaster or data

loss due to centralized document storage

> Reduction in costs associated with maintaining paper

ling and storage systems

> Elimination of the cost of re-creating lost documents

> Secure, controlled, remote access to documents via

the Internet no matter where an employee is located

> Reuse of existing content saves time, promotesconsistent branding and eliminates errors

> Higher document quality and integrity result from

improved review and sign-off processes, versioning and

check-in / check-out

> Improved employee satisfaction and morale through

access to the right content at the right time

> Lower email churn and bloat as employees stop using

their inboxes as mini-document repositories

> Retention of knowledge assets and overall improved

access to corporate knowledge

> Improved customer service through faster access to

accurate information

> Higher levels of security through password protection

and document encryption

Now that you understand the benets of document management software and what it can do for your organization, you will

now need to persuade key decision makers to purchase a solution. These strategies will help you approach those decision

makers in the right way and with the relevant information required to guide their decision in your favor.

28


31/72

v v

1gain an executive sponsorExecutive support is crucial for any project that supports

business processes. In the initial stages, an executive sponsor

will understand and articulate the broad objectives of the initiative

to other senior managers.

He or she may lead a cross-functional committee that gathers

requirements from departments, formulates a request for

proposals and conducts vendor evaluations.

The executive champion should encourage communication and

listening among teams who may have different ideas about what

is needed and how document management software can fulll

those needs.

A high-level executive presence is also required to facilitate the culture

changes needed to transition to a knowledge-sharing environment.

If there are unspoken incentives in place to hoard or limit access todocuments, then they must be acknowledged and addressed.

An executive champion will have the authority to put a new incentive

structure in place that rewards knowledge sharing and builds a culture

that supports the widespread use of document management software.

This is true whether the document management application is for a

department or an entire enterprise. Without a strong and committed

champion, the project will falter or may never get off the ground. Social

gaming elements in your document management tool can support this.

theexecutiv

echampion

shouldenco

urage

communicat

ionand

listeningamongte

amswho

mayhavedi

fferentideas.

29


32/72

v v

2 Tie the tangible benets of document management with measurable results to justify the cost;and determine the indirect measures that can be used to track progress against achievementof non-quantiable benets.Before undertaking a project, it is important to identify which benets you expect to achieve.

If all your expected benets are intangible, you may have a tougher sell than if you have a

combination.

Think about current ways that your organization measures cost, productivity and risk andhow you might be able to use quantiable data to demonstrate results. You may be able

to show intangible benets through more subjective assessments, such as the outcome of

an employee survey that rates satisfaction with current processes, versus those processes

implemented via the document management software.

build a tight business case

Take the time to do some benchmarking at the outset

and it will also pay off when youre called on to justify

the system later on.

Benchmarks are a valuable tool for convincing

doubters that a system is warranted. If you can

visibly demonstrate that the time taken by a current

process can be reduced using document management

technology, youll have an easier time swaying the

doubters and nay-sayers.

A strong business case is helpful for management

sign-off in even the best of times.

Edit and co-author documents online

or via Microsoft Ofce

30


33/72

v v

find quick wins

If you want to be sure of showing demonstrable ROI for a document

management technology investment, you may want to start with a small pilot

project that has clear objectives and can demonstrate quick wins.

Start by identifying one or two pain points. For example, an easy win would

involve identifying and eliminating an obvious source of duplication of effort.

Others could be streamlining a lengthy review and approval process to a

couple of quick steps, or reducing the time to productivity of new employeesthrough improved access to policies, procedures and information.

This kind of internal, anecdotal evidence is powerful for demonstrating the

value of a larger-scale rollout of document management software.

3

#1

31


34/72

v v

show similar examples of success

Rarely is anything more convincing than the successes

and testimonials of third-parties in similar situations. Spend

some time researching published case studies on the

installation of document management technology in other

organizations. Speak with people in similar industries who

have implemented document management solutions. Learning

how other companies with comparable business challenges

have beneted may help you further convey the value of the

initiative to your decision makers.

Case studies can be obtained on many vendor web sites as

well as from objective sources including industry publications,

analysts and professional associations. Visiting with other

companies that have implemented the solution youre

considering can also provide you with real-world referencecases you can share with executive leadership.

4

32


35/72

v v

5Learn about best practices

Many organizations have had bad experiences with

system implementations that have dragged on too

long, cost too much and then didnt deliver results. In

todays economic environment, technology buyers are

understandably wary of making an investment that could

cost them their jobs if it goes sour.

A careful study of best practices helps avoid known pitfalls.

Take the time to learn from the mistakes of others rather thanrepeating them.

You can often nd best practices during your review of case

studies, or from professional societies for document and

information managers. Conferences and seminars will give

you access to people willing to share their expertise and their

mistakes. Keep in mind that studying best practices requires

analytical skill along with the ability to accurately document theprocesses or activities in question, recommend renements and

incorporate them.

For best practices to become a way of life in the organization,

a team effort is required since entrenched practices and culture

may need to change. Following these strategies will help ensure

the success of your document management software initiative,

but you also need a product that supports your objectives

without straining your budget.

acarefulstudyofbestpracticeshelpsavoid

knownpitfalls.Take

timetolearnfromthe

mistakesofothers.

33

by knowledgetree


36/72

v v

8 steps to manage success

analytics



37/72

v v

selection & Preparation

35


38/72

v v

implementation

36

by knowledgetree


39/72

v v

get efficientsmart insights

into documents

with

Your business depends on documents to

get work done. Sales builds proposals and

contracts. Marketing creates new collateral

and templates. Finance approves invoices and

agreements. And each process depends ondocuments, spreadsheets, and presentations.



40/72

v v

the insight challenge

lost documents means

lost productivity

The challenge is that your teams work with hundreds, eventhousands, of documents. That means it is extremely

difcult to nd the material you need when you need it.

Which version of the contract is the most recent? Does

this presentation include new content?

Some companies use a shared folder to address the issue.

But as your organization grows, it become time-consuming

to lter through hundreds of documents to locate what you

need.

Other organizations look to costly enterprise content

management solutions to manage their documents. But

the challenge of working with complex systems leads to

frustrated users, and documents that still cant be found.

Your documents shouldnt be stored only to be forgotten.

They need to keep adding value.

?

38

39


41/72

v v

where is that great

document you wrote?

no control leads to

productivity drains

Your team creates a lot of terric content.

Sales might have made a highly effective

proposal. Or, nance might have made

a new template that simplies expense

management. But if the great templates are

buried among thousands of documents, then

theres no way to know they are there.

You want a way to not only nd what you

need. But also to nd documents that you

didnt even know you needed.

A similar problem occurs when managing

your document lifecycles. Your documents

are part of a business process. For instance,

contracts may go through sales, legal, and

nance approval before being nalized.

But if you cant tell where a document is

in the approval process, then it is likely to

get stuck. Delays in approving documents

cause lost productivity and resource drains.

?

39

40


42/72

v v

smart insights help uncover value

So, how do you get in control again? A best practice is to use analytics and group insights to

control your thousands, or tens of thousands, of documents. Lets take a look at the kinds of

analytics and insights that make sense to use.

finding useful documentsHow do you look for a document that you need? It might be based on a project that you

are working on. It could be by type of document, say, a PowerPoint presentation. Maybe

it is by a particular author, or for a special client. There are many different dimensions you

might use to search.

In this case analytics plays a subtle role. By organizing content based on tags like projectID, expiry date, document type, for example, you can tailor queries to locate what you

need. Rather than relying on a keyword search to nd what you need, you need an

analytics-driven search.

Modern tools for managing documents help. Their algorithms weigh the various tags

against each other. They return content that is most relevant for your query, rather than

simply providing content that matches keyword terms.

40

41


43/72

v v

finding documents that matterBut how do you nd out about documents that youre not aware of in the rst place? Here is where document

insights get very interesting. Through simple to use but powerful tools, you can collect data about documents

that matter to you. Lets take a look at some best practice metrics that your document management tool shouldhighlight.

> New Documents: As new documents are created, say a new sales presentation, the team should be aware of it.

Lists of Whats New documents should be front and center.

> Popular Documents: Which documents are being downloaded the most? Which are most frequently viewed?

Those types of documents that your colleagues are using are probably useful to you, so they should be highlighted.

> Great Documents: As you and your colleagues are working with documents, they are bound to nd pieces that

are especially useful. By liking a document, as you would in Facebook or LinkedIn, you can help colleagues nd

content that you suggest.

> Top Authors: The best documents often come from a select number of people. You can keep on top of whos

creating new content by listing who is creating the most new documents.

> Team Involvement: Are team members using the content? Do they need to be informed about new content?

You can spot this by looking at how often users comment, view, or like documents.

> Latest Activity: When team members add or change documents, or when they view or comment on a document,

it is helpful to know. That allows you to nd documents that your colleagues are working on or value.

These kinds of analytics are driven from multiple sources. But youll notice the impact of social elements. That is,

using the responses of team members to guide which documents make sense for you. If many of your colleagues

like, view, or comment on a document, it likely should be of interest to you. Social elements apply just as well in a

business context as they do in the consumer world.

41

v v42


44/72

v v

staying in control of processes

You need to make sure that document-led processes

are efcient. So, if a document is being held up in its

approval process, you need to know. Analytics should

identify when approvals are getting delayed so you can

remind colleagues and keep the process moving.

Insights also help to set benchmarks for how long

approvals should take. If you spot that processesare taking longer to complete over time, perhaps your

process needs to be adjusted.

Your documents are critical to your business. To stay

in control, you need insights that help you spot value.

That means smart analytics that identify content that

matters. Dont waste time ltering through thousands

of documents. And dont let useful documents gethidden away. Find documents that are useful to you and

your team by using analytics that are tailored to your

organization.

42

v vby: lee dallas 43


45/72

v v

waysto look at

by: lee dallas

content management systemsSo you have decided that a content management system is the solution to your problems. Now

what? How do you choose the right one for your organization? Sadly we often begin the search by

looking to vendor-generated material, which sounds reasonable but it is a bit like the old adage of

the fox watching the hen.

There is no shortage of experts who will evaluate your situation (for a fee) and conclude theirfavorite is the best for the job. The best of this lot however will educate you on meaningful criteria

for making a decision and help you map that to your situation. There is however no escaping a

learning curve if you want to be successful. Someone in your organization, perhaps even you,

needs to develop a workable understanding of content management principles and technology so

that you can make an informed decision on which mix of features and business models will make

your business more efcient.

As you begin your education consider the following eight categories for a technical evaluation ofcontent management software. These categories are more than simple groupings of requirements.

They are referred to as dimensions because the needs of a given business expand and contract

requirements within them, changing the weight of one over the other.

Today these dimensions have to be evaluated in two distinct contexts. In the Cloud or On the

ground. OTG is a term used here to refer to more traditional, on-premise delivery models. In many

respects, your decision about which context is best for you is a funding question. The ability to

deliver technical capabilities on an as needed basis and paid for as it is consumed is very attractive

when you have limited capital, short time to deploy or limited internal capability.

43

v v

44


46/72

v v

dimension1dimension 2

api&Toolingcomponentization

Vendors take decidedlydifferent approaches

towhat APIs they expose and documentation

quality varies greatly across themarket. The

level ofcustomization requiredfora giveninitiative however maylessen the needfor

concern in this arena and suggest that ITC may

be appropriate. Cloud implementations often

focus more on branding and integrationto core

serviceswith less attention paidto manipulating

applicationbehavior.

Excessive and complex APIs may serve agilityinimplementationbutsupport maysuffer

having to know and account for redundant

or deprecated technical pathways. Seek

tounderstand the gap between thenative

behaviorofa product and yourrequirements

and evaluatethe API and tooling to ensurethat

it is a good t with yourcompanies ability to

support it once the companies leave.

ForOTG solutions thereis a school ofthought thatassumesa desire to scale horizontally, driving discreetcapabilities to separatemodules. Over-componetizingaproduct however increases complexityandimplementationrisk. T

here is a point ofdiminishingreturnwhen it comes to breaking a package intodeployable units. Buyers are often unaware ofhowmany pieces the puzzle is actuallysliced into. Theotherside ofthe issueisjustas problematic when onerealizes that there is a choke point in a data fow longafterthe license agreement is signed. You have tounderstand thecomponent architecture ofthe productsand ensure that thelevel is appropriateto both the

problem at hand andyourability to support it.

ITC content management tends to avoid componentcomplexity forcore services. Some address extensionsby adopting the app store strategypioneered intheconsumer market. Leveraging thirdparty applicationextensions tocloudservices however introduces adifferent set ofrisks including but not limitedto security

and long-term provider viability.

44

v v

45


47/72

v v

All content is not created equal. The same is true for requirements and

the software you select to meet them. On premise content management

systems offer a variety of techniques to store the actual les. But how

a product reconciles content management to storage management has

signicant implications in performance, scalability, cost and data integrity.

From BLOBS to optical to NAS to SAN, the options for combination and

restrictions are endless but make sure that the mechanics for I/O areappropriate for your business problem. There are some products that

simply can not handle extremely high volume ingestion and retrieval.

Extremely large les and rich media types (video, audio, etc) also factor

into making an appropriate selection. There are certainly products that

attempt the one stop shop approach but there are installations and

requirements that may lead you to conclude specialization for a given

requirement is preferred. Beware of pseudo CMS systems that do notaddress this as a concern and dont distinguish between storage and

content management. Simply writing to a le system may be appropriate

but can quickly become compliance and performance nightmares if you

dont understand the true nature of the content being stored. This is one

category where the lines between ITC and OTG can begin to blur as on

premise applications can leverage cloud services for the storage of the

les themselves.

content storagedimension 3

45

v v46


48/72

v v

dimension 4

data management & integrationAll content management systems, without exception, deal with two classes of data.

Unstructured and structured. You can make the argument that XML repositories

bring the two together but in the nal analysis there is a point at which you stop

breaking the data down to elds, attributes or properties and store large segmentsof contiguous data that require an application to interpret. The handling of the

metadata that information that surrounds and describes the content itself is most

often handled in traditional RDBMS patterns and is unremarkable.

The differentiators for this dimension are in how open and extensible the model is

and how many techniques are available for integrating with the data subsystem.

In general it is a bad idea to get overly concerned with the management of the

data as that should be left to the application but there are cases where the designand implementation can make or break a solution. This dimension must be a

high priority when designing enormous systems. You should not assume that just

because it is a cloud deployment that it efciently addresses your large metadata

requirements as many of these implementations intentionally limit the extension of

their data models to better manage the environment overall.

46

v v

47


49/72

v v

dimension 5 transport layerHTTP is not particularly efcient when moving exceptionally large data

les. Technologies to support streaming audio and video are everywhere

but surprisingly few content management systems efciently deal with

large contiguous les efciently. CMSs that grew up never having to

deal with multi-gigabyte content transfer issues on a global scale will

immediately dismiss this as not being an issue, hoping that everyones

comfort with the internet will lull them into a false sense of security. You

have to understand the dynamics and metrics around the content that

you will be managing and understand how the infrastructure of the CMS

will support it. There again, if all you are doing is posting tiny text based

wiki entries then HTTP is all you will ever need.

For cloud implementations this is an especially important topic. While you

may save on internally managed systems, the complexity and expenseof upgrading a network to accommodate routine movement of extreme

data sets outside of your organization can be equally challenging.

47

v v

48


50/72

v v

dimension 6

scalabilityI recently evaluated a product and was surprised to discover it did not support

horizontal scalability. They only supported an active/passive single instance model.

What surprised me most was that it had not affected their sales. The product was

for a very specic set of users and so long as the application server was properly

congured performance was not an issue. Despite the scalability concerns I had toadmit that it was a right-sized architecture for the problem at hand.

Having worked for one of the largest retailers in the world I had experienced rst

hand how scale can crush an otherwise promising product. It is overly simpleminded

and expensive to force galactic scalability requirements on every product and

solution. Dont assume you need innite scalability in both the horizontal and

vertical dimensions, especially for on premise solutions. Understand the right-size

for both your hardware and software architecture.

ITC solutions might appear to be preferred in all large scale deployments but it is

not that simple. Evaluation of scalability represents an intersection of requirements

from other areas and it is useful to think of the needs of a project as a whole before

considering how it is manifested in the underlying categories (database, transport,

storage, etc.). In short, scalability should not be the only or even the primary driver

for favoring an ITC product.

48

v v

49


51/72

v v

dimension 7 security

There is no way to avoid understanding at least the basics of application security

when evaluating a software product. It is not enough that the product has a

sophisticated security model with the ability to integrate with directory servers

and create multi-dimensional optimistic and pessimistic access control. Two

aspects to product security should be considered regardless of deployment

model. Application implementation and coding practices.

You must take responsibility for understanding the risks and the costs for

securing the data that your system manages and how the product you select will

mitigate those risks. Like the right-size argument noted above, pragmatism must

be applied. Not all content is important. Be reasonable and beware the simple-minded approach of over-engineering that can often accompany large initiatives,

especially when they suggest a rewrite of the core product.

49

v v

50


52/72

v v

dimension 8

user experienceClearly this list is not in order of importance. Many of CMSs failures

are blamed on this dimension not being sufciently considered. User

elation may help ROI but you will never cost justify a project based on

it. Producing and managing the content in a compliant and efcient

way has to be rst. No user will be happy if the system does not work.

It is undeniable that bad user experience will kill adoption. One could

argue that is the same as not working but you must balance the politics

and human inertia effectively. Implementation of a successful CMS will

change the way people work. User satisfaction cannot be measured by

how little a given users routine changes.

Regardless of the approach, ITC or OTG, there is never change withoutresistance. The products you select should mitigate the resistance,

accelerate adoption and serve the business needs that justied the

project in the rst place. Taking ownership and preparing for the

technical evaluation as well as the business evaluation of a product will

improve your odds at being successful.

50

v vby: jon marks 51


53/72

cloud,

crock

the

not a

It was just over a year ago when a younger, more naive Jon declared the

The Cloud is a Crock. Well, Im a little wiser now and Im overjoyed to

report that, in fact, it isnt. Cloud Computing is very real, and something

you need to know about. I HEART clouds.

In my defense, when I wrote my blog post a year ago, 98% of the time

the phrase The Cloud was used it was by people that didnt have a

clue what it meant. This has now dropped to 44% which means that,

more often than not, you should listen to people that say it. Sadly, the

number is still about 85% for people with the word Sales or Business

on their business cards, so continue to ignore them. And the Wikipedia

entry, while improved, is still is desperate need of an update.

by: jon marks 51

v v52


54/72

public clouds

cloud computing grid/utility computing

infrastructureservices-offers

a wide variety of

platform services

multi-tenancy-

resources shared by

a vast set of users

usage based pricing-

very fine grained

scalability-ramped up

(with no cap) or down

in near real time

programmability-

provisioning can be

accessed via software

virtualisation-

machines are virtual,

not physical

hosted *aas your server room

So what is Cloud Computing? There are lots of denitions out there. But lets distill the essence of Cloud

Computing by listing things that Cloud Computing is that good old Hosted Services (*aas) and Grid/Utility

Computing are NOT. They are:

yes yes

yes

yes

yes

yes

maybe maybe maybe maybe

no no

no

nono

no no

nonono

sometimes sometimes

sometimes

sometimes

5

v v53


55/72

An App Server provides a Java Application ways to access resources like storage,

memory, caching, queuing, messaging and more all with a standard API. A Cloud

Computing API offers access to all of this, and more. Plus an API to allow the

programmer to provision more resources. However, unlike the JEE example, the

APIs to different cloud providers isnt yet standard. But this is what people like The

Open Cloud Consortium and Unied Cloud Interface Project are working on.

But I talked about this last time. Back then, however, I didnt have a clue what kindof APIs they were trying to standardize. Now Im no expert in this area, after all I

was one of the Great Cloud Unwashed a meager year ago. So the next table that

Ive thrown together to illustrate Cloud Capability no doubt has plenty of errors and

omissions. So please correct me and Ill update it. If something like this already

exists somewhere in the interwebitutes, I couldnt nd it.

v v54


56/72

capability

infrastructure

provisioning

nosql database

Relational

database

blob/doc

storage

caching

queuing

messaging/

notifications

data processing

payment

cdn

public datasets

Microsoft azure amazon web services (AWS) Google App Engine (GAE)

Windows Azure

Azure Table Services

SQL Azure

Azure Blob Storage

Azure Cache

Azure Queue Services

Amazon Simple Storage

Service (Amazon S3)

Amazon Simple Queue

Service (Amazon SQS)

Amazon Simple

Notication Service

(Amazon SNS)

Amazon Flexible

Payments Service

(Amazon FPS)

Amazon CloudFront

Amazon Public DataSets

Codename Dallas

Amazon Elastic

MapReduce (Hadoop)

App Engine Mail

Google MapReduce

n/a

n/a

n/a

n/a

n/a n/a

n/a

memcached

Task Queues

App Engine Data Storage

(Google File System)

Amazon Relational

Database Service

(Amazon RDS) - MySQL

Amazon SimpleDB App Engine Data Store

(Big Table + GFS)

n/a

Amazon Elastic

Compute Cloud

(Amazon EC2)

n/a- You just get the App Engine

v v55


57/72

Very random aside if you dont know what memcached does, read the best ever overview of a technology ever

written An Adventure In Learning memcached.

Once you grok the Cloud Computing model, it becomes clear that this model introduces many questions around

security and privacy. Im getting rather weary of people saying they dont like the idea of putting data on cloudservices (and *aaS services like Google Docs and others). Theyre statistically far more secure than internal

networks. There are also interesting commercial models and legal questions but, seeing my blog isnt Jon On

Commerce or Jon On The Law, Ill leave those alone for now.

virtual private cloudsSo we know what a Public Cloud is. And it all makes sense, right? But what about Virtual Private Clouds. That was

the question, from Ian Truscott, that made me write this post.

Well, Amazon offer their own Virtual Private Cloud service. In essence, this gives you a VPN between your local

network and a dedicated resources on the Amazon Web Services. You can then treat your Amazon instances as if

they were part of your local network. In addition to the standard AWS fees, you also pay for each hour that your VPN

is in place, and for the data transferred.

My colleague @justincormack got me looking into Eucalyptus - a product which allows you to create your own

physical Private Cloud entirely hosted by you. This works in almost the opposite way to the Amazon VPC Service.

You use your own hardware, and install their software over the top. However, they also support the Amazon EC2

APIs, which allows you to administer your cloud as you would an Amazon Cloud and, even better, move resources

between your cloud and Amazons. So you see, Ian, Private Clouds and Virtual Private Clouds are real and more

than just hosting.

v v56


58/72

But enough of my blabbering. To keep

abreast of all things cloud, follow

these peeps on Twitter. They keep me

in the know:

Christofer Hoff (@Beaker)

James Urquhart (@jamesurquhart)

steve clayton (@stevecla)

Joe Drumgoole (@jdrumgoole)

what does that mean for you?

It means that the Cloud really is here. And Software as a

Service is more mature than ever. It is probably at the stage

where you now need an excuse not to use hosted or SaaSsolutions, rather than an excuse to use them as was the

case a year ago. I havent had a single server on a project

Ive worked on in the last 18 months. My current suggestion,

when looking for a service, is to try to nd a SaaS provider

rst. If one doesnt exist and you need to install and manage

the software yourself, at least get yourself a server in the

cloud. Dont let the recent Amazon EC2 outtage scare you -

despite this I still believe hosted solutions are normally more

reliable, scalable and secure than on-premise services.

v vby: knowledgetree 57


59/72

securitya

nd

data protectionfor

online document

managementsoftware

As organizations transition documents and

company information to Software as a Service

(SaaS) applications that are no longer inside their

own rewalls, inevitable questions about securityand data privacy arise.

Every company that trusts a third-party with data

storage should fully understand the security

and data privacy measures in place to protect

sensitive information.

v v58


60/72

introduction

Security refers to both physical infrastructure such as the data

center where the documents are stored and the application

features that provide passwords, encryption and secure data transfer.

Security features ensure that the system is not compromised, either

via direct physical tampering or via malicious external attacks. Thereare also security features that protect data within the organization by

keeping it on a need-to-know basis only.

Data privacy is the concept that the personal and sensitive

information pertaining to an individual should be treated in a certain

fashion to prevent its misuse. There are guiding principles as to how

personal and sensitive data should be treated, and these principles

are codied in the data protection and privacy laws of many

countries. For example, the language of the EuropeanCommission (EC) Data Protection Directive (95/46/EC) has been

incorporated into the laws of European countries.

v v59


61/72

physical security

Some vendors use infrastructure provided by Amazon Web Services (AWS) for

application hosting and data storage. So, their online offering often uses the Amazon

Elastic Compute Cloud (EC2) for application processing, and the Amazon Simple

Storage Service (S3) for document storage.

Amazon provides a regularly-updated paper on its security features that is available

here: http://aws.amazon.com/security

v v60
http://aws.amazon.com/securityhttp://aws.amazon.com/security


62/72

SAS70 Type II Compliance data Centers

Key highlights of Amazons security measures include:

In todays global economy, service organizations or

service providers must demonstrate that they have

adequate controls and safeguards when they host

or process data belonging to their customers.

Statement on Auditing Standards (SAS) No. 70,Service Organizations, is a widely recognized

auditing standard developed by the American

Institute of Certied Public Accountants (AICPA).

SAS70 certies that a service organization has had

an in-depth audit of its controls (including control

objectives and control activities), which in the case

of AWS relates to operational performance and

security to safeguard customer data.

AWS has successfully completed a SAS70 Type II

Audit, and has obtained a favorable opinion from its

independent auditors.

AWS has many years of experience in designing,

constructing, and operating large-scale

datacenters which are housed in nondescript,

hardened facilities. Physical access is strictly

controlled both at the perimeter and at building

ingress points by professional security staffutilizing video surveillance, state of the art

intrusion detection systems, and other electronic

means. Authorized staff must pass two-factor

authentication a minimum of two times to access

datacenter oors. All visitors and contractors are

required to present identication and are signed in

and continually escorted by authorized staff.

All physical access to datacenters by AWS

employees is logged and audited routinely.

AWS requires that staff with potential access to

customer data undergo an extensive background

check (as permitted by law) commensurate with

their position and level of access to data.

v v61


63/72

application security

1. passwords

Application security refers to the features and measures that are built into the cloud

application to guard against threats, attacks and vulnerabilities. Many involve user

name and password requirements, encryption, limitation on sign-in attempts and the

use of roles and permissions to restrict access to certain data and documents.

Some tools allow full integration with Microsoft

Active Directory (AD) via LDAP. This allows those

organizations using AD to ensure that established

password complexity and reset rules also apply

to their document management tool. It also allows

system administrators to manage authentication

and authorization for both the tool and the rest of

their enterprise network in one place.

Even without Active Directory integration, some tools

have the following measures in place for passwords:

> Require users to possess a uniqueuserID, company name, and password to

ensure that those who access the system

are authorized to do so.

> Inform users of an error when they fail to

enter valid credentials (company name,

user name, or password); a generic

message prevents an unauthorized userfrom gaining information from sign-in

errors.

> Show password characters as dots on the login

screen so they cant be viewed by anyone

nearby.

v v62


64/72

2. encryptions 3. roles and permissions

An important attribute for a tool is to provide

encryption of documents in transit via SSL. The

protocol allows applications to communicate

across a network in a way designed to prevent

eavesdropping and tampering. It also provides

endpoint authentication and communications

condentiality over the Internet, so that

documents sent from a client workstation to thedocument management service are secure.

Some tools employ the use of roles, groups

and permissions to allow or restrict access to

documents. An innite number of roles and

groups can be created, and permissions can be

assigned on a per folder or per document basis.

With a combination of carefully crafted roles,

access to documents can be limited based on

a users function within the organization or aspecic business process. You can also structure

access based on geography, division, department

or any number of variations.

This exibility ensures that documents are

accessible only to the users who need to see

them. Using roles to present users with the most

relevant information and tools makes their jobs

easier and more streamlined.

v v63


65/72

4. backup & disaster recovery

Data stored in Amazon S3 is redundantly stored in multiple

physical locations as part of normal operation of those services.

Amazon S3 ensures object durability by storing objects multiple

times across multiple datacenters on the initial write and

then actively doing further replication in the event of device

unavailability or detected bit-rot.

Customer databases that contain metadata and congurationsare kept in EC2 and backed up into S3. Amazons use of massive

redundancy ensures that immediate failover can occur from

one server to another, if needed. This means that you dont lose

valuable time in the event of a natural disaster or server failure.

Some tools take daily snapshots of your working data every two

hours and retain them for the previous 24 hours. KnowledgeTree

keeps a rolling 7 days worth of daily snapshots, a rolling weekly

snapshot for a minimum of 4 weeks and monthly backups for a

year. All backups are replicated to a second database server.

v v64


66/72

data protection

and safe harbor

data protection principles according to

european commission directive (95/46/EC)

The European Union (EU) has developed

eight principles for data protection, and

each nation within the EU was required

to incorporate these principles into their

own data protection acts.

Personal data shall be processed fairly and lawfully and, in particular, shall not

be processed unless at least one of the conditions (schedule 2 and 3) is met

and the Data Subject has given his or her consent to the processing

> Personal data shall be obtained only for one or more specied and lawful

purposes, and shall not be further processed in any manner incompatible with

that purpose or those purposes

> Personal data shall be adequate, relevant and not excessive in relation to the

purpose or purposes for which they are processed

> Personal data shall be accurate and, where necessary, kept up-to-date

> Personal data processed for any purpose or purposes shall not be kept for

longer than is necessary for that purpose or those purposes

> Personal data shall be processed in accordance with the rights of Data

Subjects under this Act

> Appropriate technical and organizational measures shall be taken againstunauthorized or unlawful processing of personal data and against accidental

loss or destruction of, or damage to, personal data

> Personal data shall not be transferred to a country or territory outside the

European Economic Area, unless that country or territory ensures an adequate

level of protection of the rights and freedoms of Data Subjects in relation to the

processing of personal data

v v65


67/72

For example, the Data Protection Act of 1998 codies the

EU principles into law in the United Kingdom (UK). Although

not a member of the EU, the Personal Information Protectionand Electronic Documents Act (PIPEDA) brings Canada

into compliance with the requirements of the European

Commissions directive on data privacy.

The United States sees privacy differently than the EU, and

in fact, there is no single or overarching right to privacy in

US law. Rather, different types of privacy rights have been

established on a case-by-case basis by the US Supreme Court

through interpretation of various constitutional amendments.

Many individual states also protect privacy and data to varying

degrees.

Because of these differences, the US has not incorporated the

EU principles into federal law, which initially put the US at a

disadvantage when dealing with European nations and citizens.

One particular provision of the EU regulations states that datamay not leave the EU unless the receiving or hosting country

ensures adequate protection for the data, equivalent to that

of the EU. To help US entities ensure this adequate level of

protection, the US Department of Commerce, in consultation

with the EU, created what is known as the Safe Harbor

framework.

v v66


68/72

Organizations have the ability to self-certify and publicly state that

they comply with the Safe Harbor framework. Self-certication

must be renewed annually, in writing, with the US Department of

Commerce. All organizations that have completed self-certicationare listed on a public website at https://www.export.gov/safeharbor.

Amazon has already obtained a safe harbor certicate for their

infrastructure and services. Because some vendors serve global

customers, and their online document management system may

contain personal and sensitive information, KnowledgeTree must,

and does comply with the EU principles via the Safe Harbor

provisions. Compliance is typically specied in privacy policy and

supported by organizational practices.

In addition to self-certication, some vendors have received third-

party verication of privacy practices through TRUSTe, a leading

Internet privacy services provider (www.truste.com). The TRUSTe

badge on a website lends extra assurance that the vendor takes

privacy issues seriously and has earned safe harbor status. It

also provides customers with an unbiased mediator if there is a

complaint regarding privacy practices.

v v67
https://www.export.gov/safeharborhttp://www.truste.com/http://www.truste.com/https://www.export.gov/safeharbor


69/72

conclusion

Moving data offsite to a third-party provider is not a trivial decision.

Some vendors understand their customers security concerns and

actively address them in the ways discussed in this paper:

> Use of Amazon as a cloud service provider because of its

commitment to maintaining military-grade security of its facilities

> Integration with Active Directory to enable individual organizationsto extend their own password and security structure to their

implementation

> Use of SSL for encrypted transmission of documents

> Roles and permissions that provide granular access at the le and

folder levels

> Regular backups of customer data and the massive redundancy

inherent in the Amazon cloud

> Adherence to the principles of data protection via the Safe Harbor

v v68


70/72

KnowledgeTree authors:

Daniel is an entrepreneur, technologist and part-time guerrilla marketer whose career has included senior

management, business analysis and engineering positions at software, Internet and telecommunications

companies. As the CEO of KnowledgeTree, Daniel has led the company to its position as a recognized innovator

in cloud-based document management solutions. Daniel brings passion and enthusiasm to the KnowledgeTree

team and is an avid commentator on document management and industry trends.

Previously as CTO at Jam Warehouse, and earlier in his career Daniel headed up enterprise contentmanagement and workow software implementation projects for premiere global retailers and consumer goods

companies including Tesco PLC, Britvic PLC, and Foschini Group.

Daniel is a graduate of the University of Cape Town, with an honors degree in business science and information

systems. Follow Daniels regular blog posts on content management and open source software. Follow Daniel on

Twitter: @danielchalef

daniel chalef, ceo

peter mollins, sr. director of product marketingPeter brings 15 years of experience marketing technology companies in an international setting. At Micro Focus

he was responsible for product marketing across the Application Management and Quality division, which was

created from the acquisition of Borland and Compuwares ASQ division. Previously, he ran marketing for Relativity

Technologies, where he led product and corporate marketing. He has held a variety of marketing roles in Europe

and the US with Netscape, iMediation, and TogetherSoft. He holds a Masters of International Management from

Thunderbird.

author bios

v v69


71/72

- twitter: @McBoof

- blog:jonontech.com

- skype: McBoof

- twitter: @ldallasBMOC

- blog: bigmenoncontent.com

Jon has spent the last two years deeply involved with tablets. In

2010, he led all architecture and development work for NewsCorps

multi-channel publishing initiative, Project Alesia. Jon has recently

co-founded a new company, Kaldor Group, which specialises in tablet

publishing and advertising.

jon marks

Lee dallas

Author of The Cloud, is Not a Crock:

Author of 8 Ways to Look at Content Management:

During his eighteen years in technology Lee has worked with a broad

range of corporate business problems including technical publishing,product and records management. Currently a solution architect with

EMCs Alliance Partner team, he was formerly an architect and for

Imaging and Content services at Delta Air Lines, Senior Architect for

Content Management and Collaboration at The Home Depot, and a

principal consultant with Armedia,LLC.
http://jonontech.com/http://jonontech.com/


72/72

what is knowledgetree?

KnowledgeTree makes documents matter. Orbitz, Miramax,

Alcatel / Genesys, Fuji Chemical, and hundreds of other

companies use KnowledgeTree to drive productivity by working

smarter with documents. KnowledgeTree helps legal, nance,

HR, and sales teams easily develop and execute business

processes around documents, and drive productivity andactionable insight.

> Visit our website:

www.knowledgetree.com> Follow us on twitter:

@knowledgetreesw

This work is licensed under the Creative Commons Attribution-NoDerivs 3.0 Unported

License. To view a copy of this license, visit http://creativecommons.org/licenses/by -nd/3.0/
http://www.knowledgetree.com/http://creativecommons.org/licenses/byhttp://creativecommons.org/licenses/byhttp://www.knowledgetree.com/