Information governance framework: What to include before scaling your digital workplace

Maybe you’ve grown your headcount by 50%. Maybe you’ve planned a huge initiative that’ll involve new policies, new content, and new cross-department collaboration. Maybe you’ve grown your tool stack and are about to generate a ton of data across more tools.

When you scale, information governance problems scale with you. Important documents go missing, customer data is accidentally exposed to third parties, and your drives become cluttered with data that should have been deleted years ago.

That’s why you need an information governance framework before you scale. Here’s a guide to building and implementing it.

What is an information governance framework?

An information governance framework is a set of policies that covers how data is created, organized, secured, retained, and audited across an organization’s systems. That includes customer data, documents, reports, policies, and more. This framework clarifies and standardizes practices that are often left too vague or developed ad-hoc by individual teams.

Why governance precedes scaling

When your organization scales, the data it needs to manage scales with it. Any data management problems you’re currently dealing with will scale, too. Not sure how to find specific documents across all of your tools? Constantly finding out-of-date templates and contracts that should have been deleted years ago? Unclear as to when you can share certain documents with third parties? These issues only get worse as you add tools and headcount.

That’s why if you’re about to hit a period of serious growth, you need to have an information governance framework in place.

VAULT: Information governance framework for organizations ready to scale

VAULT is a five-pillar information governance framework built for organizations that are about to scale their tool stack, head count, or workflows. The five pillars of VAULT are:

• V for visibility: Knowing what information exists where.
• A for access control: Controlling access to information.
• U for usage policies: Having clear policies for using information and sharing it with third parties.
• L for lifecycle management: Defining retention and deletion schedules.
• T for traceability: Having an information management system that can be audited and monitored.

Here’s each pillar in more detail.
 

V: Visibility

The first information governance problem you need to solve: knowing what you have and where it is. In marketing alone, 60% of content goes unused. Not because it’s low quality, but because no one knows it exists. A similar problem exists across all business functions. HR has multiple versions of the same policies that can’t be tracked down. Software developers have useful troubleshooting guides buried in years-old documentation. The list goes on.

You need a single source of truth that can record and manage the information your organization creates and relies on. That often means integrating multiple platforms with a single database to keep data flowing effectively.

Knowing what you have is just the first step, however. You also need to know where information originates from and how sensitive it is.

A: Access control

Too many organizations either give too much access by default or too little. Each extreme causes its own problems. Too much access means documents and data are potentially unsafe. Too little access slows workflows down as teams constantly have to request access to data they need in their day-to-day tasks.

Role-based access control allows you to solve most access control needs without doling out access person by person (which doesn’t scale). Tie access levels to job function and reassess them as roles change. Additionally, adopt a “least-privilege” approach, where you grant less access by default, reevaluating from there as needed.

U: Usage policies

One of the advantages of a digital workplace is that anyone can create something new, work on it with their team, and publish it wherever it needs to be. But that advantage can also create issues, from potential security breaches to massive clutter in your shared drives.

Have clear guidelines for how documents and data should be created, shared, and collaborated on. This doesn’t need to be done for every bit of data or every document, but you should have categories that can cover anything your organization might create and share. For example, you don’t need unique usage policies for every type of contract you’d send to clients or vendors, but you should have guidelines that cover these contracts broadly.

L: Lifecycle management

Many organizations keep dated data and documents around by default. Shared drives and databases get cluttered with years-old information that makes it difficult to find what you need—not to mention driving up the cost of cloud hosting and similar services.

Additionally, data retention and deletion are typically covered by laws, regulations, and business requirements, and not having a clear framework for handling this risks creating non-compliance. That could lead to everything from losing customers to paying heavy fines.

T: Traceability

When you don’t have a system for knowing what data your organization creates and manages, you likely don’t have a system for auditing changes and other activity. Access, substantive edits, and other changes go completely unnoticed.

Audit logging and monitoring makes all of that activity visible. This isn’t only essential for the access control and usage policy pillars of this framework, but it also supports security investigations and compliance reporting.

How to implement your information governance framework

Now that you have a framework, here’s how you can actually apply it to your organization.

Audit your current situation

You need to know where you’re at before you can decide what you need to do. Use each VAULT pillar as your guide. How easy is it to search for the data or document you need when you know very little about it? How would you ask for access to a specific document you need for a project you wouldn’t usually take on? If given access to a new batch of data, do you know what you can and can’t do with it?

Ask these questions at an organizational level. Ask them across teams and departments. Audit the systems you’re using and find their weaknesses so they can be made compliant.

Close high-risk gaps first

VAULT isn’t a step-by-step guide; it’s a foundation built on five equally important pillars. That means you shouldn’t worry about setting up visibility before traceability; you should first start with high-risk items.

Say, for instance, that you work in an industry with serious data security compliance regulations. You risk being found non-compliant if you don’t have a system for auditing data activity, so you should fix that first. Similarly, if you work extensively with external vendors and contractors but give too much access by default, that’s the gap you should close first.

You need to build up every pillar in your framework, but prioritize them according to your needs.

Pilot your framework before going organization-wide

Some elements of your information governance framework will require significant training and iteration. Don’t deploy it organization-wide until you know how it performs in real-world circumstances. Choose a team that goes through a significant amount (and range) of data in its day-to-day work. Implement the framework, asking that they stick to it as closely as possible.

After a few months, meet with the team to get their feedback. What issues did they run into? What improvements did they see? Do they have ideas for improving the framework as a whole? Then, when you’ve iterated on your framework, pilot it with a different team and see if the results match up.

FAQ

What is an information governance framework?

An information governance framework is a set of policies that govern the creation, management, sharing, retention, and deletion of data. It helps clarify issues like:

• Who should have access to what data.
• When you can share data externally.
• How data can be made more visible to the teams that need it.
• When data should be deleted.
   

Why does information governance matter before scaling a digital workplace?

When you scale your digital workplace, the information governance problems you’re dealing with will scale as well. Having an information governance framework in place before you scale ensures that you can solve these problems and prepare for new issues that will come as you grow.

Who should own information governance in an enterprise?

Information governance is typically a shared responsibility between the Chief Information Security Officer, the Chief Information Officer, as well as other data or compliance stakeholders, such as data governance managers, data protection officers, and compliance officers.

Keep data clean as you scale

Scaling your digital workspace both creates new problems and increases the impact of existing ones. With a clear information governance framework, you can at least prevent data security, visibility, and auditability issues from growing with you. 

Zoho’s VAULT framework ensures that you hit the most important pillars of information governance: visibility, access control, usage policies, lifecycle management, and traceability. Building this framework in your organization requires time spent auditing your current systems, prioritizing pillars based on your organization’s unique risks, and piloting the framework throughout a few teams before deploying it more broadly. But the investment will pay off significantly as you scale. So build it now.