Information Governance guidance

Adapted from a client-specific set of deliverables to be somewhat generally applicable:

In order to meet the information management needs of the organization, all staff are requested to familiarize themselves with the following concepts and how they have been implemented within the Corporation:

1. Metadata – Can be thought of very simply as the “aboutness” of the data. For instance, “Street Address” would be the metadata for the data “123 Anywhere Avenue”. The Corporation has defined a set of company-wide metadata under which all information is to be categorized (the Corporate Metadata Elements). Additionally, an overall categorization model has been created to increase the “Finadability” of information across the application and repositories landscape that comprises the Corporate IT environment (the Corporate Metadata Schema). This model has sections that have been defined for most common applicability by your assigned Job Family from the People Department of the Corporation. It is necessary that you know the categories applicable to your Job Family, what they mean, and how to apply them within the system(s) and repository(ies) you have access and permissions for. The model is hierarchical (has levels similar to an Organization Chart) in design that decompose from the most general categorizations (the Corporate Metadata Elements) to the most specific. An example of this would be “Maintenance and Engineering > Maintenance Planning > Reliability > Procedures > Inspection > Galleys > {Model & Type}”. Through having this metadata, and the hierarchical structure, associated to the data, we are able to provide high quality search and browse experience to all of the Corporation’s stakeholders. In order for this to remain effective and efficient, this capability requires that all personnel (staff, contractors, and Prime Partners personnel) be diligent in the assignment of metadata to information assets. To facilitate this, the Corporation has created 2 reference wikis and a Registry database:

   • Corporate Metadata Standard wiki: Accessible with a single click from the [intranet site name] home page, this is where you will find descriptions of the types of metadata that exist, the purpose of each type, the Source (ex. {Standards body}, {Professional Association body}, Corporate Capability & Functions Model, etc.), and structure of metadata for the Corporation.

   • Corporate Metadata Guideline wiki: Accessible with a single click from the [intranet site name] home page, this is where you will find description of how metadata is requested, created, and maintained as well as how to apply metadata to data in both structured software systems and Content Repositories. Here you can also access a web form to request new metadata, or change or delete existing metadata. Note: this web form has an approval workflow associated.

   • Corporate Metadata Guideline: A database of approved metadata elements and the approved Schema that is managed by the ECMO (Enterprise Content Management Office), that systems and repositories connect to programmatically to provide this master data management capability. Note: Systems and repositories will be connected to the Registry over time based upon priority determined by the ELT.

2. Sensitivity – The Corporation is applying categorization to information that defines levels of confidentiality. Note: this is not the same as security/permissions. Sensitivity indicates the type of audience that information may be accessed by. For instance, “PHI (Personal Health Information)” is accessible only by Corporate Health & Wellness personnel that have properly executed confidentiality agreements and current membership in good standing with appropriate licensing bodies that impose acceptable restrictions on the access and sharing of health and medical information of Corporation personnel. A different example would be “Internal”, indicating that the information may be made accessible to Corporation staff and contract/interim personnel (that have current NDA and Non-Compete Agreements), but may not be accessed by any part external to the Corporation. Please refer to the Corporate Sensitivity Classification Policy and Guideline.

3. Security & Permissions – Defines and controls who can access what data in what system(s) and under what conditions. This is managed through the Corporate Identity and Access Management platform in conjunction with the various system(s) individual permissions model and includes a Network Locations aspect such as Corporate Network which would be any Network (wired or wireless) that is wholly under the control and administration of the Corporate IT division, versus VPN Network where personnel are connecting to the Corporate Network through an authenticated connection, but using an untrusted network (ex. network at your home, airport wired/wireless network, public WiFi at a restaurant/coffee shop, etc.) which will have more restricted access to information resources. Please refer to the Corporate Identity and Access Policy as well as the permissions policy and structure for the various system(s) as they may exist.

4. Email Management – All personnel are required to complete the online Email Management training to help guide the safekeeping of email communications internally and externally.