In 2003 I created a presentation on trends in the records and information management (RIM) industry for a records management conference. Before writing this article, I revisited those trends to determine if the industry was still heading in that direction or if it has taken a new path.
I predicted in 2003 that CEOs and CFOs would seek more security in the field of information management and more protection from harsh legislation. I referred to cartoons that mocked CEOs’ failures to protect business records. Clearly, executive management has been charged with protecting organizational information assets in all formats, thanks to regulations such as Sarbanes-Oxley (SOX), the Health Insurance Portability and Accountability Act (HIPAA) and Graham-Leach-Bliley (GLB) and to fines levied by the Food and Drug Administration (FDA).
Obviously, shredding has evolved from something done illegally by corporations seeking to hide the truth to a vital information security measure to be performed in strict adherence to information life-cycle protocols. It has become an integral part of records management planning as clients realized the danger in failing to protect records and to plan for their secure destruction at the end of the life cycle.
AN EVOLVING SERVICE
I predicted that shredding companies would evolve into the field of media protection as another segment of their records protection job description. This also has come to pass, as many National Association for Information Destruction (NAID) members now list media vaulting and media destruction in their service models.
Many records centers have begun providing media vaulting as a standard service in their facilities as well. These vaults have drawn new interest from a market segment that seeks to protect its vital information assets rather than to simply store them off site. This interest is often driven by regulatory requirements.
One simple example is responding to legal requirements to protect media from spoliation, as dictated by SOX. In 1990 few media vaults were equipped with environmental control options. Today, manufacturers and operators, as well as their clients, realize the necessity of such a feature. Media decays more quickly when stored outside of the proper temperature and humidity range. Also, in the past, magnetic shielding of vault storage chambers was rare. However, various ISO standards stipulate the proper storage environment for electronic media, as does National Fire Protection Association 232: Standard for the Protection of Records.
Even media handling has evolved. Now standard are special containers used in transport, slotted racking environments and lockable cases in response to HIPAA requirements. Insulated transport cases or refrigerated vans have become the norm. Barcode tracking software allows service providers and their clients to see exactly where each tape is at any time.
In the past, the role of the off-site media storage facility was simply to hand off the stored media in a business-resumption situation. Such a recovery without the use of contractors such as Sunguard or other specialized recovery sites was unthinkable, as tape storage was the only model. Today there are many business resumption models, and an off-site media vaulting company is often a key player in disaster recovery.
Off-site media vaulting companies often house a co-location capability or offer e-vaulting to help clients recover at alternate locations. While disk-to-disk backup has allowed clients to move away from the old protocol, off-site media storage has continued to increase in volume. This growth also has occurred despite the predicted demise of tapes in favor of virtual servers that would reduce the need for media. However, corporations have found that maintaining all of their business information online, all of the time, is extremely expensive. Utility costs as well as the number of servers required and requisite staffing ballooned their expenses. As a result, non-active archive data was maintained in tape format.
Maintaining staff at a redundant disk-to-disk storage location that requires little interaction makes no sense. Many companies in the off-site storage industry have taken advantage of this by offering sites for backup storage in an electronic format. Working with local clients, a specific and tailored solution can be provided that meets their needs while creating revenue for the off-site storage company.
This continued linkage between the client and the vendor enhances their business relationship, as the vendor willingly supports specific clients’ needs for information continuity and protection. Client surveys continue to reflect a need for protection of information assets, not just racking space, especially if these efforts reduce their staffing and in-house expenses.
In addition, off-site storage protects information assets from potential sabotage by disgruntled employees (which may be on the rise in the economic downturn) as well as from competitive intelligence gathering. Encryption has attempted to address these vulnerabilities, but criminals have begun stealing encryption keys. Off-site storage in a vaulted environment removes the information from a “hackable” platform, and key information can be stored offline and in a secure and anonymous location.
Vaulting electronic information in NFPA Class 125 vaults, which have a four-hour fire rating for magnetic media, has evolved to dominate in the off-site storage model, evolving from a four-hour paper document rating (NFPA Class 350).
Vaults in the past offered water sprinkler protection, while today’s vaults offer clean fire suppression agents to avoid damaging media.
As we seek to determine future trends, we see the IT community moving its computers into server vaults (www.servervaulting.com). We are also witnessing the development of the “Data Center in a Box,” wherein IBM, SUN, Dell, HP and other similar companies seek to expand the digital world and to strengthen their position in the world of disaster recovery as well as to provide a modular data center that expands with the clients’ needs.
These hardware computer manufacturers see a need for greater protection and explosive growth in data center development. Modular expansion follows the same model as a modular vault—“Grow with the client.” The use of a secure modular environment has evolved to include high-density environments that can be transported to alternate locations for faster start up of data centers (www.servervaulting.com/save.asp).
EVOLUTION PROVIDES OPPORTUNITY
The computer hardware manufacturers solved everything but the site location and real estate solution. It makes sense that these modular units could be stored at the off-site media vaulting contractor’s site, where the necessary infrastructure is available, the security mindset already exists and staff exists to perform certain ongoing service requirements, such as removing disks or inserting new media. Hosting these centers adjacent to the media storage environment provides clients a ready-made recovery site.
It appears the only limit to the RIM contractor who has evolved from shredding and document management into media storage and then on to becoming a solution within the client’s business continuity program is the vendor’s own imagination.
How will the RIM service provider evolve? Taking that premise along its logical path, then securing data media, e-vaulting, co-location and business resumption services are the linear direction of the industry.
If paper is being shredded, will some documents need to be preserved for long-term or permanent storage? If so, then developing a relationship with an imaging vendor makes sense.
No two vendors will develop in the same way. Some will add co-location for temporary recovery, and this might lead to a relationship with an air transport company to handle the high-speed movement of tapes to a company’s recovery center.
Developing relationships with co-location companies can be a great connection. Co-location firms serve the same IT personnel you seek. You can provide a service for the co-location entity and its clients and in return can create revenue for both companies. It merely requires strategic development.
Each market has distinct needs, and your evolution as a service provider makes this an exciting time.
RIM companies must evolve not only into new products but into new relationships with other companies and with their own clients.