The “business case” for information governance often focuses solely on quantifying specific costs for data management and exposures for data security and ediscovery. Number crunching is of course important, but it misses something bigger, more strategic, and ultimately more crucial to the organization – its brand. Companies, regardless of industry, are fundamentally in the information business. It follows that how an organization manages its information assets reveals how the organization manages itself. And that matters, a lot, because companies that align themselves with their brand, achieving brand discipline, are more successful.
In their seminal 1993 Harvard Business Review article, Customer Intimacy and Other Value Disciplines, Michael Treacy and Fred Wiersema made the case for how highly successful companies (1) understand and redefine value for their customers, (2) build “powerful, cohesive business systems” to deliver more of that value than their competitors, and (3) raise their customers’ expectations beyond what the competition can deliver. The most successful companies do this work within at least one of three disciplines: operational excellence, product leadership, or customer intimacy.
Treacy and Wiersema based their insights on an intensive study of 40 companies that achieved breakout success in their markets. They followed the article with their quintessential business strategy book The Discipline of Market Leaders. Twenty years later, this book is likely still on your CEO’s bookshelf.
What’s the point for information governance? It’s this – a successful company brand cannot be lipstick on a pig. It must be organic, a discipline that pervades the organization from the bottom to the top, inward and outward, in its core processes, business structure, management systems, and culture. And how your organization manages information value, cost, compliance, and risk is no exception. Simply put, stronger information governance yields a stronger brand for your business. And this is true for each of the three disciplines of highly successful companies:
Continue Reading Why govern our information? Reason #8: It can build – or bust – your brand
Having too much data causes problems beyond needless storage costs, workplace inefficiencies, and uncontrolled litigation expenses. Keeping data without a legal or business reason also exacerbates data security exposures. To put it bluntly, businesses that tolerate troves of unnecessary data are playing cybersecurity roulette … with even larger caliber ammunition.
Being a CISO is a tough gig. The perpetual deluge of news items on hack after hack, breach after breach, has finally conveyed that data security is an imperative for all companies, large and small. But the perception still lingers that the Chief Information Security Officer (or her InfoSec team) will single-handedly prevent breaches at “our” company – and if one should occur, will take care of the response. For some CISOs, it may feel like 
Dr. Stephen Covey reminded us that “important” is not the same thing as “urgent.” Records retention reminds us that important is not the same thing as exciting. I get it – records retention schedules are boring. But the fact remains that literally thousands of records retention requirements apply to your organization’s information. I know, because my firm finds and tracks these laws as part of our decades of retention schedule work for clients across industries. And your regulators expect you to know them too.
“If your clients don’t have a records management system, they may as well take their money out into the parking lot and set it on fire.”
Would you take a deposition by solely following a template of standard questions, without assessing the unique issues and circumstances of the case? Or conduct transaction due diligence by simply marching though a generic punch list, without assessing the unique aspects of the company, the deal, and the industry? Of course not. Your law firm’s data security posture is no different – you need a security risk assessment to understand your firm’s unique vulnerabilities to security threats, and to identify which security controls are already adequate for your firm and which other safeguards are needed.
As explored in last week’s posts, the 
Law firms face significant 
It all seemed so routine, so straightforward. The case was settled, with a $500,000 payment to be made to the approved settlement administrator. The law firm received an email from the administrator with wire transfer directions, and the settlement funds were sent per the instructions. Just one problem – the email didn’t come from the administrator, the receiving bank was not the right bank, and the half million dollars evaporated. Poof – gone in an instant.
Sometimes one needs to zoom in to understand the big picture. This year we’ll continue to explore Information Governance, but through the lens of a particular industry segment – law firms – and a particular focus – data security.