Despite the way things might appear, I am not completely in love with SharePoint. It is far from perfect, particularly when it comes to records management. I do admit to liking it, though. Certainly more than the other ECRM solutions I’ve worked with. (And I’ve worked with – and sometimes, for – them all.)
But in my heart I’m a records manager. Sad though it may be to the uninitiated, I am passionate about efficiently managing information through its lifecycle. And I’m always looking for innovative, next-generation solutions to meet the seemingly endless parade of records management challenges brought on by the ever quickening march of information technology. Regardless of whether the solution involves SharePoint or not.
That’s why I was so intrigued when I heard that Box – a content management and file sharing service, created and maintained entirely in the cloud – announced the forthcoming release of their first set of records management features. And it is also why I jumped at the opportunity to speak recently with Annie Pearl, Senior Product Manager at Box, about what we can expect to see when these new features become available.
Here’s what Annie had to say:
SPRM: Thank you for talking with us today, Annie.
Annie Pearl: My pleasure, Don.
SPRM: Where are you calling in from, California?
Pearl: Yep, I’m here at Box headquarters in Los Altos.
SPRM: Lucky you. Tell us about your role at Box?
Pearl: I’m the Senior Product Manager on the Box Enterprise Team, so a lot of the features I work on are in the world of governance, security, workflow – many of tools we have in our Administrative Console. And so, one of those areas, especially around governance, is the notion of retention management, records management.
SPRM: Right, so is that the category you put these new features into, records management? Or do they fall into information governance? Or is it something else altogether?
Pearl: I would have to say information governance. Mainly because, as you know, records management means a lot of things that are probably a lot more complex than we are doing now. All we are really trying to do is meet the regulatory needs and mandates of our customers. I wouldn’t go as far as to call it records management. I would call the specific features retention management. But I think it all flows into a bucket around information governance, where we have a number of other features like Policy Manager, which gives you control over the types of content that can be uploaded. We have e-discovery features to allow you to support a defensible discovery solution, and so I put retention management into that same bucket, which, sort of rolls up into information governance.
SPRM: What will these new features include?
Pearl: It is essentially being able to apply retention and disposition policies to certain objects inside of Box.
SPRM: How will those policies be applied?
Pearl: It will be folder based, with the ability to set a blanket default retention policy across your entire enterprise for any folder. So you can say, for instance, ‘The default retention across all my content is three years, on the regular course of business content’. And then have specific folders that we will want to retain longer.
SPRM: When the content has met its retention period and is destroyed pursuant to the applied policy, would that be forensic-level destruction where the content is no longer recoverable? Or is it closer to the notion of simply hitting the delete key and releasing the space on the drive where the content resides?
Pearl: No, it is truly forensic deletion. It’s gone from the system completely.
SPRM: Terrific. That level of destruction is critical.
So it sounds like you’ve created a location-based model for records management, which I’m very happy to hear. It’s always been our argument that that’s the only realistic way to manage the lifecycle of all your content across the entire organization.
Pearl: Yes, exactly.
SPRM: Great. So what date do the retention policies use to trigger the retention period?
Pearl: Retention will be are triggered off of upload date.
SPRM: Got it. Are event based retention triggers something you are considering?
Pearl: Yes. One way to do event-based retention with our current product is use the ability to extend retention, so if the retention period is complete and the record is up for disposition, and the end user or the administrator wants to, they can extend the retention period on an object. So one way you could do event-based retention would be to basically retain until the end of the retention period and if the event still hasn’t taken place – let’s say it’s account documentation for a financial services customer and they’re still a customer – so we have to retain it for another period of time. And once they became a customer even longer, you would be able to extend the retention policy based on however much time you would need after the event has taken place.
So it’s kind of a manual event-based retention trigger today, but we are looking into the future at the potential of having it automated.
SPRM: Are you doing this from a centralized location? Are you managing these retention and disposition policies in a centralized way or will the end user be required to navigate out to the individual folders and set the policy there?
Pearl: No, that’s not necessary. In the Box Administrative Console we have an area where we can manage different policies around your content and one of those policies will be for setting the retention. So centralized in that location is where you essentially setup the policies. If it’s a default policy you can set it to apply to all folders today and going forward and any new content created will automatically inherit that policy.
Alternatively, if you wanted to specify specific folders you could still use the centralized Administrative Console to create another policy. There’s a folder picker that will allow you to find whatever folder or multiple folders you want to apply that policy to. And it’s all centrally managed in our Admin Console.
SPRM: So what are your plans for maintaining these records long-term? How would you expect to maintain a record for 25 years, for instance?
Pearl: There are a couple of different answers to that. We have unlimited storage, so the notion of needing to manage long term storage from a cost perspective is not an issue for our customers. So if you wanted to assign a 25 year retention to a piece of content, you could.
It’s more of an issue if the end user didn’t want to interact with that content anymore they could move it to trash, which is essentially an area that is not in the ‘all-files, all-folders’ view, but it would still be retained by the system for however long the retention policy is.
In addition to that, in this same area I’ve been talking about – the centralized Administrative Console – we have what we call the Content Manager, which essentially allows you to have a view into all the content in your enterprise and you can do different filtering on that view to find retained content or content that’s subject to a legal hold or really whatever you want.
You can use this view into all content inside your enterprise to manage records as in ‘show me all records that are currently under retention’ or ‘show me all records that are coming up for disposition within a certain time period’. You can already manage all that in our Administrative Console.
SPRM: Can you also apply a legal hold from there?
Pearl: Today, we have the ability to apply a hold at the enterprise level and the user level and we have tools today to be able to manage legal holds. In which case, of course, a legal hold will always trump a disposition action that was the result of a retention policy expiring.
SPRM: Would you be able to manage e-discovery from the Administrative Console or is that a different process?
Pearl: Yes, absolutely. We have all the tools for our e-discovery support in the Administrative Console, so that’s where you can audit all the events that take place on any piece of content or any user or any folder…you can do queries to find relevant content to a lawsuit. You can then preserve that content inside of Box. And we have tools to essentially collect it and pull it out of Box and put it into whatever e-discovery tool you might be using, along with all the other content sources in your enterprise.
We really approach e-discovery with the thought that we need to provide the tools that support a defensible discovery process, but we are not an e-discovery vendor. And so we partner with all the leading e-discovery vendors and we feel that our responsibility is to provide the ability to identify content, to preserve it and collect it out of Box.
So there are really the three main areas where you get the ability to do advanced queries on the content, you can then hold that content and preserve it and you can collect it out of our APIs or export it out of our Administrative Console, as well.
SPRM: This has been really enlightening, Annie. It’s exciting to hear about these new features Box is implementing. We really believe there are a lot of records managers out there who are ready to embrace the cloud and all its potential. And they’re looking for simple and efficient solutions that allow them to effectively manage the information lifecycle without all the bloated functionality that weighs down so many on-premises legacy solutions.
Pearl: Yeah, and I think that’s the goal. Every time you start to include these types of features there’s a whole universe of functionality you could go after, but the challenge is to distill that down to the most common denominator that still provides enough value for it to be a viable option for whatever you are trying to get done.
SPRM: Well, you certainly seem to be going at it the right way. Please come back and let us know how the initial roll out goes.
Pearl: I’ll be sure to do that, Don. Thanks.