MARKET UPDATE: MOREQ2010 TESTING ANNOUNCED DLM FORUM ANNOUNCES MOREQ2010 TESTING AND ACCREDITATION INITIATIVES Updated Archiving and Records Management Specification will be delivered in Q4 2011. Event: The DLM Forum announced on 12th December 2011 that it will publish a MoReq2010 Testing Framework and accredit the first MoReq2010 Testing Provider by the end of December 2011, which will reflect Government, regulators, users and vendors requests for robust information control mechanisms to meet European compliance and governance guidelines. Analysis: During 2012, MoReq2010 will become a key part of information compliance architectures that are driven by increased regulatory demands in the finance, government and environment sectors. This will be encouraged by National Archives and regulators and kick-start the process to define new vendor- agnostic information management strategies. It will create the demand to encourage content, and records management software and services vendors to produce MoReq2010-certified offers by the end of 2012. What is MoReq2010 and Why does it Matter and to Whom? In the old days, chief executives used to worry about profits for shareholders and a competitive product. Eventually they realised that their duty to employees, but the Perfect Storm of the recession, global warming and the impending regulations across the financial sector mean that they must add a fourth Key Performance Indicator: Licence to Operate. Regulators are increasingly requiring them to submit frequent and detailed reports of their performance and outcomes, thus creating demand for a new generation of information systems that can deliver these at the lowest cost and smallest disruption to business. Technically this is not the challenge it once was. New technologies including Internet and cloud computing offer mechanisms to make it easier and pervasive, but some of the old problems of information control remain: how can CEOs control what their staff do with regulatory information? The paradox is that most CIOs can answer the question: “What network protocol do you use?”, but few can answer the most embarrassing IT questions: S What procedures does everyone use in your company to secure your important documents? S How do you decide what information you must keep, what can you throw away, and when? S What happens when you lose some critical information? At the same time CIOs are being asked to do more with less, and yet ensure their entire workforce does not breach numerous regulations. These include various Freedom of Information Acts, human resources legislation, health and safety and numerous vertical industry requirements, not forgetting new environmental regulations such as the Aarhus Convention, and whatever comes after Basel II and MiFID. An Individual’s Personal Irresponsibility Must Not Become a Corporate Liability What most CEOs want is a set of policies and procedures that are built into implemented everyday services that provide compliance, without pain. They need to take years of experience of managing paper records and extend them to control electronic information. They must satisfy users who demand simpler, reliable and lower cost (preferably “free”) tools for storing, searching and retrieving the information they need to do their jobs. However, there is widespread acceptance that merely adopting approaches based on paper, like first generation electronic records management systems, is not going to work, as indicated by the collapse of the European markets for EDRMS software in the last five years. Worryingly, the problem has become bigger with the arrival of ubiquitous and uncontrolled deployment of laptops, NetBooks, mobile phones and internet-based consumer-oriented services including GoogleApps, Facebook and Twitter. These are the challenges and practices that MoReq2010 addresses, that Microsoft Office, Facebook and others avoid. The Key Value is CONTROL MoReq2010 contains a model of how fileplans, files and records relate to each other within the context of a classification scheme, and, very importantly, how they can be applied across all electronic (digital), and physical (paper) files. The MoReq2010 specification embraces ISO15489, supersedes MoReq2 and previous fragmented approaches to sorting, storing and recording information across different countries in Europe, describes requirements for the management of records and defines specifications for purchasing. MoReq2010 is designed to be a very practical specification. It does not specify a particular technology. Instead it outlines the essential elements that information systems should possess to ensure that important documents, emails, faxes, webpages etc are valued, properly managed, accessed at all times, retained for as long as they are needed and are properly disposed of once the obligatory retention and disposition period has expired. MoReq2010 extends this in a modular, simple framework. It enables interoperability between systems, and users can define records independent of proprietary products. © 2011 Strategy Partners International Limited. Email [email protected] Call +44 8450941570 or see www.strategy-partners.com. 1 MARKET UPDATE: MOREQ2010 TESTING ANNOUNCED What is the Process and Roadmap for MoReq2010? The key stages of this Specification’s development include: S 2009: Jon Garde of JournalIT was awarded a contract to develop a new version of MoReq, called MoReq2010, including three stages of consultation (over 500 responses) with users and vendors. S 2010/2011 The DLM Forum published MoReq2010 in modular form on it website ( www.dlmforum.eu) where it is available for free download, and started to persuade users and regulators across all sectors to consider incorporating MoReq2010 into their requirements to ensure that information provided within regulatory submissions can be trusted. S 2011/2012 Testing and certification of MoReq2010 starts for committed vendors and early adopters. S 2012. Most National Archives across Europe will review MoReq2010 and provide recommendations to Government concerning its deployment as a purchasing specification. This will change the rules for software providers and outsourcers. It will impact all Government and commercial provider of services to Governments when they review future Government contracts. In the UK the National Archive has indicated that it will evaluate MoReq2010 as a replacement for the old PRO2 standard, and initiated work on interoperability between records management systems based on MoReq2010. S During 2012 governmental commercial users across Europe will review the value of retaining country specific approaches (eg DOMEA in Germany, Z42 in France, NOARK in Norway to name but a few…) with a view to superceding them with MoReq2010 or establishing a clear relationship. S By the end of 2012, we expect that all major CM vendors will have gained MoReq2010 certification for their middleware bundles, because no vendor can afford to fail to be shortlisted for a government contract in specific countries because it lacks such certification. S By 2013, we expect that vertical market extensions to MoReq2010 will emerge, together with frameworks that define standards for records interoperability, non-repudiation, email procedures, mobile security, and extended specifications in regulated industries. What Users Need to Do Next: PCs Have become non-PC As various European National Archives support or adopt it, MoReq2010 will effectively make the de facto Windows-based personal computer approach of “c” drives, My Documents and shared “k” drives obsolete and untenable for collaborative and corporate computing. It will also set the parameters for private and public cloud-based archiving. It will provide a mechanism for Compliance Officers to insist that all users adopt explicit fileplans that vendors do not control. No administration can afford to be seen to be creating information that it cannot control, so the days are over for PC Windows Explorer; email backup that pretend to be email archiving, limitless uncontrolled storage and social computing “free-for-all”. Regulators and their political masters allow no excuses for lost laptops, pen drives, blogs and twitters that reveal political embarrassment, commercial secrets and personal information. You cannot outsource Compliance. To the generation of CIOs that were primarily concerned with technology, new definitions of security, privacy and return on investment will come as a shock. They face either being downgraded to plumbers (and risk being outsourced), or moving up to become information services providers that must meet sophisticated Service Level Agreements that control intellectual property assets as well as costs. The recession is hastening the demise of single supplier IT purchasing. This applies equally to SAP for ERP and at the desktop where Microsoft is facing real competition for the first time in twenty years. Not only has Microsoft been forced to provide online versions of its core Office suite, but also it is facing a losing battle for mindshare against Apple, Google and Facebook. All require MoReq2010-based control. Where is the Money? How will MoReq2010 impact Software and Services Vendors Just as Kodak just struggled to gain market leadership in cameras once silver chemistry was replaced with digital CCD chips, the impact of new business-led regulations on current CM vendors will be profound. MoReq2010 is one piece of the new information management architectural jigsaw that includes pdf/a, W3C and OASIS standards like CMIS and