As the information tide relentlessly rises, many organizations simply see an IT problem, to be fixed with a purely IT solution – more storage capacity, more tools, or both. But merely adding more storage is a reaction, not a strategy. And adding technology tools without the right governance rules invariably makes things worse, not better.
This is not a criticism of your IT team. Instead, the problem lies in a misunderstanding of the fundamental challenge. Just as you shouldn’t bring a knife to a gun fight, you shouldn’t merely bring more storage capacity and IT tools-without-rules to your fight to regain control over your organization’s information. What’s needed is governance.
I put off writing this post for months, because I found the April news item so profoundly disturbing. But as I reflect on the past year, now that 2016 has finally come to a close, it strikes me that one detail of this news story metaphorically captures a deep and troubling problem in our technology-fueled, dysfunctional relationship with information.
The “business case” for information governance often focuses solely on quantifying specific costs for data management and exposures for 
Having too much data causes problems beyond needless storage costs, workplace inefficiencies, and uncontrolled litigation expenses. Keeping data without a legal or business reason also exacerbates data security exposures. To put it bluntly, businesses that tolerate troves of unnecessary data are playing cybersecurity roulette … with even larger caliber ammunition.
Most enterprise information governance initiatives are event-driven: an expensive lawsuit, a system migration, a board or regulatory inquiry, a corporate move, and so on. Though there’s nothing wrong with being opportunistic in making IG progress, it can sometimes be too little, too late when a cybersecurity breach or some catastrophic event shines the light on decades of inattention. How then do we become more proactive in improving how we manage information—arguably any company’s most valuable asset?
At least, that is, unless overheard, written, or recorded. Just ask anyone following the presidential campaigns. Absent concrete evidence, spoken words evaporate and any discussion of them quickly devolves into the type of “he said, she said” game usually seen in low-budget television courtroom dramas and on playgrounds. A few weeks ago, my colleague Peter Sloan posted 
Being a CISO is a tough gig. The perpetual deluge of news items on