GRC
HR
SCM
CRM
BI


Article

 

From Data Management to Information Lifecycle Management: Why (and What) You Need to Fill the Gap

by Dr. Bernhard Brinkmöller | SAPinsider

July 1, 2007

A sound data management strategy used to be sufficient to control data volumes in businesses focused on cutting costs. But now that it’s increasingly important to balance cost with legal compliance and risk mitigation, data management is no longer enough; it must be complemented by a comprehensive information lifecycle management (ILM) strategy. Discover the key differences between data and information that make ILM so vital, and learn about Information Retention Manager, the tool that will help you close the gap between data management and ILM.
 

Data management has long been a best-practice strategy to control data volumes by applying different methods, such as data prevention, aggregation, deletion, or archiving. Companies' data management strategies to date have primarily focused on reducing total cost of ownership (TCO).

Now, however, a data management strategy alone is no longer sufficient. In addition to cost considerations, companies must also effectively address legal compliance requirements and risk mitigation issues. You must ensure, for example, that you know and understand retention requirements and that you apply them correctly to your data. Building an effective information lifecycle management (ILM) strategy has emerged as a key approach to balancing and dealing with these broader challenges of cost, compliance, and risk.

ILM takes a more holistic approach to dealing with data and information (see first sidebar); it is vital that companies who do not yet have an ILM strategy begin to build one (see second sidebar). Key to building a comprehensive ILM strategy is finding the right tools to help users manage and follow that approach more effectively.1

What Does ILM Have That Data Management Doesn't?

The key to distinguishing ILM from data management lies in understanding the difference between data and information in an IT environment. Data is the physical representation of information in any form. Data could be a piece of paper containing information or it could be a data object in a computer system. While data is a technical concept, information is more of an abstract notion. For example, consider a sales order that has been created for US $50, with a corresponding invoice for the same amount. The order and the invoice are data. The dollar amount each of them carries is information.

The importance of distinguishing between the two in the context of ILM becomes apparent when you consider that:

  • Information can be stored redundantly as different data

  • Deleting data does not necessarily mean that you have lost or destroyed information; that same information may, after all, exist in another data object

When we talk about the deletion of data, we mean the physical deletion of a technical unit in the system. When we talk about the destruction of data, we mean the physical deletion of data records and references to ensure that certain information and its existence can never be traced again. Whether the information is completely lost depends on whether all the data carrying that information is destroyed.

When data is archived, for example, it is written to the file system and then deleted from the database. But it can still be accessed and viewed in its archived state. The destruction of this data would mean deleting the archive file, all references to it, and all copies of it in the system. Destruction of information may include deleting change documents, related messages, and data in the business information warehouse.

What Does an ILM Strategy Look Like in Practice?

The implementation of an ILM strategy can be divided into four distinct phases (see Figure 1):

Phase #1: Analyze and Categorize — Get to know your data and how it behaves. Analyze data growth, determine what kinds of data you have in your system, and group or categorize that data according to different criteria and goals.

Phase #2: Define Policy — Write out guidelines and rules for your data categories. These rules should be based on external and internal requirements for your data and should include retention schedules, archiving guidelines, destruction schedules, etc.

Phase #3: Apply Policy — Map the policies you defined in the previous step to your data categories and prepare the system for implementation. This phase can include such tasks as customizing settings, setting up your storage system, and choosing the correct archiving objects.

Phase #4: Realize — Turn your strategy into action. This is the phase in which you actually archive or delete data.

Build ILM on a Solid Foundation

If you currently have a good data management strategy, you already have a solid basis for ILM. Effective data management helps reduce costs by reducing data volumes and avoiding data redundancies — both key factors for more efficient information management. With this cost-focused foundation, building a comprehensive ILM strategy becomes more about finding a constant balance among TCO, risk, and legal compliance (see Figure 1) and taking steps to define, document, and strategize ways to better manage the information that exists across your company.

Figure 1
ILM involves finding the right balance between TCO, risk, and legal compliance

Up until now, however, customers were largely left to their own devices in the areas of risk and legal compliance. Policies governing data retention and the destruction of data had to be written down manually and applied separately to the different data types in the system. With these rules and policies stored in different places, and with no way to make sure that people were adhering to them, it was impossible to ensure that all users managed their documents and data with the same sets of rules.

Even just trying to understand legal data retention requirements can be quite overwhelming, especially when your company operates in several different countries. Laws governing digital data often do not distinguish clearly between data and information, for example (refer to sidebar). When a privacy protection law requires that data about former employees be destroyed after a certain number of years, what is really meant is that all the information about that person must be destroyed. It would be of no use to destroy the employee data if the information about that person was still available in other data objects.

Information Retention Manager: A Result of Meaningful Collaboration Between SAP and Its Customers

The compelling need for comprehensive ILM has led more and more SAP customers to begin creating their own strategies. Accordingly, the Americas' SAP Users' Group (ASUG) ILM Influence Council recognized a need for software tools to shape and manage such a strategy. As part of the Influence Council, SAP and customers worked together to identify common ILM pain points and compile a list of customer requirements — for retention policy management and other legal compliance issues, for example — to share with SAP development.

In turn, SAP began to develop the ILM tools its customers needed. The Information Retention Manager (IRM) is one such tool to evolve from this collaboration. SAP is continuing to work with its customers to develop more ILM tools and applications that will allow customers to centrally manage their data retention polices and perform ILM tasks, such as data destruction and legal holds.

In this case, compliance can only be achieved if all data records containing information about that employee are destroyed. To avoid the risk of not complying with this kind of privacy protection law — or any legal data retention requirement, particularly in the areas of tax and product liability — you have to be aware of the location and format of any relevant information throughout its entire life cycle.

Note!
Remember that information can be contained in many different data types; here we differentiate between structured data, meaning business or transaction data, and unstructured data, such as scanned invoices, print lists, or even media and sound files.

A New SAP Tool to Ease Your ILM Efforts

Just as companies use business software to assist in data management,2 certain tools can fill the missing links on the path toward a comprehensive ILM strategy by providing considerable support and automation.

SAP recently introduced a new policy engine called the Information Retention Manager (IRM). This tool, which will be made available in late 2007 as part of an upcoming enhancement package for SAP ERP 6.0, will allow users to centrally manage all internal and external policies governing data retention — within and outside of their SAP systems — for both structured and unstructured data.

IRM also allows users to enter their retention rules for paper documents. This means that the rules governing the life cycle of all data and documents are kept in one central location, allowing users to more efficiently and consistently manage their information. Having such a central management tool as part of your business software — close to the origin of the data — is key because the integration and relationships of the business data is embedded within the applications (see sidebar below).

An In-Depth Look at the Data Retention Technology Behind the Information Retention Manager

IRM is a very flexible function that allows users to enter retention rules for different object types — such as sales orders, invoices, or financial documents — in their system.

This flexibility also allows users to enter different retention rules for each object type, with rule categories that best fit those object types and reflect the various requirements of different departments that will come in contact with the information being managed.

To cover both internal and external requirements, for example, you can have different kinds of rules, such as "tax law" or "product liability." These retention rules can outline requirements for minimum and maximum retention periods, criteria for the beginning of the retention period, or guidelines for which storage system to use in case data needs be archived during that retention period. Users can also enter the residence time, which will determine how long data has to remain in the database before it can be archived (see figure at right).

The rules you enter in IRM describe when objects should be archived, where they should be stored, and when they must be destroyed. During archiving, the system first checks whether the object is considered unchangeable and whether the residence time requirement has been fulfilled. If the retention rules are being met, the object can be passed on to the storage system. Additionally, if the object is to be destroyed without being archived, IRM will first check that the minimum retention period has been completed.

If an object is archived, the storage system must ensure that the user-specified retention rules are not violated in terms of access authorization. In addition, data can only be destroyed if it is free of any legal holds. If data is (or may be) involved in any kind of legal proceedings, authorities can place a hold on it, meaning that the data cannot be destroyed until that hold is lifted.

The Information Retention Manager allows companies to define their own data retention rules

SAP ILM Goes Beyond Data Storage

Unlike ILM solutions that focus solely on the storage aspect of information management, SAP's ILM tools focus on the entire life cycle of information — from its creation in the database, to its archiving in a storage system, to its final destruction.

It's important to point out that this life cycle begins with the actual creation of a data record in an ERP system, not with the storage of that data. Moreover, on a storage system level, the business references and relationships of documents cannot be determined without additional metadata. As a result, a real classification of the documents is quite difficult.

Therefore, it is crucial to view ILM as a comprehensive approach. Technologically, this means that the storage side of a system must be able to speak to the application and support the same ILM functions — such as the destruction of data.

It is crucial to view ILM as a comprehensive, holistic approach.

Designed for Comprehensive Compliance Support

To ensure that IRM provides the most comprehensive ILM support possible, SAP closely followed its customers' lead (see sidebar on next page), as well as official guidelines dealing with data and information, when designing the tool. Two of the most important of these guidelines are the Design Criteria Standard for Electronic Records Management (DoD 5015.2-STD) in the US, and the German Grundsätze zum Datenzugriff und zur Prüfbarkeit digitaler Unterlagen (GDPdU). Although IRM does not claim to automatically meet all legal requirements, it does support DoD-compliant management of electronic information by offering the option of maintaining different rules for different interpretations of the same data record.

Conclusion

ILM allows companies to better juggle TCO, risk, and legal compliance as they manage their enterprise information. This can only be achieved through a holistic and comprehensive approach to information lifecycle management, made possible through new technological innovations that now allow ILM processes to become increasingly automated. Data management is still one of the main pillars of ILM, but new technologies, such as IRM, are filling the remaining gaps to make a comprehensive ILM strategy possible.



1 See Dr. Ulrich Marquard's article "The Time Is Ripe to Implement ILM" in the April-June 2007 issue of SAP Insider (www.SAPinsideronline.com) for more information on the ILM tools currently available from SAP.

2 See the "Data Archiving and Document Management" special feature in the April-June 2007 issue of SAP Insider (www.SAPinsideronline.com).


Additional Resources

The SAP Insider Archiving your SAP Data seminar, coming to Chicago, Amsterdam, Las Vegas, and Orlando in 2007 (www.saparchivingseminar.com)

The Global SAP Environments 2007 conference in Miami, October 22-24, 2007, offering an entire track of sessions devoted to global governance and data management (www.globalsap2007.com)

"The Time Is Ripe to Implement ILM: Information Lifecycle Management Features
Are Available Now" by Dr. Ulrich Marquard (SAP Insider, April-June 2007, www.SAPinsideronline.com)

"Advanced Information Lifecycle Management: What it is, and how you can leverage it to facilitate data management in ERP facilities" by Deepak Sood (SAP Administration and Infrastructure 2007 conference presentation available on take-home CD, www.sapadmin2007.com)

Dr. Bernhard Brinkmöller has been the development manager for data archiving at SAP AG since 2000. He studied physics at the University of Münster and the University of Bonn. He then worked for the University of Minnesota and the University of Karlsruhe, with research placements at the Los Alamos National Lab and the Paul Scherrer Institute. He joined SAP AG in 1994 as a performance specialist. He can be reached at bernhard.brinkmoeller@sap.com.

Georg Fischer has been responsible for data archiving product management at SAP AG since 1998. In 2003, he became product manager for Performance, Data Management, and Scalability. After studying IT at the Darmstadt University of Technology, he worked at Digital Equipment Corporation (DEC) as project manager in the areas of document management, optical archiving, and data archiving. He can be reached at ge.fischer@sap.com.

An email has been sent to:






More from SAPinsider



COMMENTS

Please log in to post a comment.

No comments have been submitted on this article. Be the first to comment!


SAPinsider
FAQ