Safeguarding Metadata within Enterprise Content Management Systems

ECM systems such as EMC Documentum, IBM FileNet and Open Text Livelink are intended to help companies more easily handle vast amounts of complex data types. An ECM system dynamically creates and manages the entire content lifecycle along with its associated metadata, which tracks the audit trail, approvals, revisions, alternate formats and custom attributes, among other properties. ECM is uniquely architected to house a content repository with folders and documents, while the related metadata resides separately in a database. The application architecture itself monitors and maintains the relationships between content and its metadata to ensure overall data integrity, but only as long as the application itself remains intact.

What is the importance of metadata?

Metadata is defined as “data about the data.” One of the core values of an ECM System is its ability to maintain extensive amounts of complex metadata about the various documents it manages - data that can be just as crucial as the documents themselves. This is especially true as companies strive to comply simultaneously with multiple regulations that are specific to the preservation and recoverability of authentic metadata, including but not exclusive to the Sarbanes-Oxley Act of 2002, Food and Drug Administration (FDA) rules for pharmaceuticals such as 21 CFR Part 11, the Security and Exchange Committee Section 17 for the financial services industry, and the Health Insurance Portability and Accountability Act (HIPAA) for health care companies.

Additionally, within eDiscovery, the ability to authenticate and recover metadata is just as important—if not more so—than the ability to recover business applications and documents. For example, consider the Discovery Rules Amendment of the Federal Rules of Civil Procedure which went into effect in December, 2006. This amendment specified that companies involved with litigation by default must not only produce all relevant information in its original electronic state, but also the accompanying unaltered electronic audit trail.

Beyond the legal and regulatory issues are efficiency requirements for ECM systems. Organizations primarily implement ECM systems to gain efficiencies related to document management and business processes. System failures and user mishandling that result in lost metadata put that efficiency goal in jeopardy. If a company has to roll back its ECM system to the last known good state, it can lose all the work that employees generated after that point in time, and halts worker productivity while the ECM system is unavailable. Ensuring application availability is critical to realizing the promised efficiencies within ECM.

The New Recovery Paradigm: Metadata

A traditional enterprise backup and recovery solution is essential to capture and recover complete applications within the enterprise, and protect against natural disasters and full system failures. However, compliance and regulatory mandates now require the recovery process to deliver authentic metadata as well as its parent content on a document-by-document basis. With a traditional backup approach, the separate content and metadata servers are susceptible to inconsistencies and corruptions in cases of isolated application disruptions, outside of disasters and full-system failures. While the metadata database may be recoverable, the recovered data is essentially unacceptable as the paths or connections between the metadata and the working documents may be lost or corrupted. Recreating those connections becomes an overwhelming time and resource commitment or, more likely, is impossible.

Effectively safeguarding the metadata and content within an ECM system requires a validation and recovery solution that understands the nature of metadata, and that can maintain the physical relationships between metadata and its related documents. Combining enterprise backup solutions such as Symantec NetBackup, IBM Tivoli Storage Manager, or EMC NetWorker with CYA® Technologies’ SmartRecovery™ discrete recovery solution achieves the most stringent service level agreements associated with Recovery Time Objectives (RTO) and Recovery Point Objectives (RPO) for enterprise content management systems.

The Causes and Impact of Partial Data Loss

Despite the universal commitment to enterprise-wide protection against system failures, the majority of corporate data loss is actually caused by administrative errors, user mishandling and accidental deletions, malfeasance, application corruptions, and viruses. This loss within ECM is most often related to the loss of repository metadata such as workflow states, electronic approvals and audit trails.

The ability to recover individual documents and metadata managed within ECM, to a specific point in time, is the core value of the CYA SmartRecovery solution. Enterprise backup is a necessary component to protect against system failures or natural disasters, after which customers need to recover entire servers and databases, from the operating system on up. However, according to several sources - Strategic Research Corp. and AIIM International, among others - the majority of information loss is caused by incidents other than system failures or natural disasters.

Historically, once a record or records had been lost or corrupted within ECM, the individual record recovery process likely involves pulling one or more backup tapes, combing through the tapes to find the relevant documents, and then recovering the documents without metadata outside of the application. If possible, users attempt to manually rebuild rudimentary audit trails, but only as an afterthought, and with great time and effort. In today’s regulatory environment, it is no longer an option to not include metadata within a backup and recovery practice. With CYA SmartRecovery, an administrator can conduct a simple query, identify and recover the document with its audit trail back to the live repository, and validate the transaction with a log file.

The ability to quickly perform such a discrete recovery provides value to enterprises on multiple fronts:

• Enables compliance with regulatory mandates such as SEC 17a, the Federal Rules of Civil Procedures for eDiscovery, Sarbanes-Oxley Section 802, among many others related to the preservation and production of electronically stored complex information.
• Provides immediate, easy data accessibility through rapid identification and recovery of individual records with metadata for business continuity, with no application downtime.
• Reduces IT administrative burdens surrounding recovery and eDiscovery by limiting recovery to only a few minutes for a single administrator.
• Minimizes costs related to penalties associated with non-compliance during audits, inspections and exorbitant third party eDiscovery expenses, and mitigates financial risks associated with lost revenue from application downtime.

Although most organizations have already invested in protection against system failures and natural disasters, they are now looking to CYA SmartRecovery to augment enterprise backup and make it possible to recover individual, authentic documents, or sets of documents with original metadata, in minutes without having to perform a full-system restore.

CYA SmartRecovery also provides proof that organizations are capable of maintaining and recovering an original audit trail and that it has not been tampered with, which can reduce an eDiscovery scope. Failure to be able to produce documents and surrounding metadata can leave companies looking like they have something to hide should they become embroiled in litigation.

Finally, to help grapple with new records retention mandates, many companies are implementing record management tools such as records retention services or expiry dates that enable them to dictate the retention periods for various kinds of data based on established criteria, sometimes within the audit trail itself. CYA SmartRecovery is an integrated extension of an organization’s records management systems that ensures data are only preserved up to the established retention period.

The Well Project. Protecting Website Integrity and Availability.

The Well Project, Inc a Not-For-Profit corporation, is an initiative conceived, developed, and administered by HIV+ women and others who are affected by HIV. The Well Project’s mission is to change the course of the HIV/AIDS pandemic through a unique and comprehensive focus on women. Their editorial team consists of several of the most prominent writers and editors on HIV disease and women, and is reviewed for medical accuracy and integrity by nationally recognized HIV researchers and infectious disease practitioners. The TWP National Advisory Board reflects the population served with more than 60 percent women of color and more than 25 percent HIV+ women.

The Well Project had planned for months and invested valuable, limited resources in the unveiling of their website by gathering the country’s leading researchers, treatment centers, and experts to achieve the greatest awareness possible during the website launch. They were just days from the launch when a virus penetrated an incorrectly configured firewall at the host and the entire site was lost.

The Well Project anticipated that it would have taken several months to rebuild the site without a discrete recovery solution. Fortunately they had implemented CYA SmartRecovery and within 50 hours, The Well Project was able to recover and relaunch the entire site in time for the scheduled unveiling. The costs associated with the delay would be months of lost productivity, the promotional expenses already invested, and more importantly, the financial impact of lost resources and the potential funding not obtained during the launch. Even more unbearable would have been the inability to connect the approximately 500,000 women in the US and over 21 million women worldwide with the critical information available through The Well Project website.

With the implementation of CYA SmartRecovery, The Well Project had taken a proactive approach to enable the continuous availability of the website while protecting the integrity of the research provided by the community. With CYA SmartRecovery, all original content and metadata generated by the user community is checked for inconsistencies and corruptions to maintain the integrity of the entire information lifecycle. The authentic information is then preserved and recoverable within minutes in response to future data loss or corruptions, with no website downtime.

Posing the Tough Questions

To comprehend the added value to your enterprise backup practice and ensure that your company is compliant with the variety of regulatory mandates, how do you respond to the questions below?

• What is the shortest data loss window I can achieve to meet our corporate service level agreements and comply with regulatory mandates?
  CYA SmartRecovery provides incremental captures of all changes within the repository as frequently as every 15 minutes to ensure the integrity of the relationships and the recoverability of every individual record.
• Do I have repository checks in place to eliminate inconsistencies between content and metadata databases?
  CYA SmartRecovery runs more than 350 integrity checks to identify corruption or inconsistencies between content and its metadata as soon as it’s changed within the repository. It flags corruptions such as missing records, missing content and invalid relationships between records.
• Can I provide recovery of content and metadata on a document-by-document basis?
  Only CYA SmartRecovery can recover discrete metadata for ECM. With IntelliCapture™, CYA’s proprietary application aware solution, CYA SmartRecovery captures all aspects of new or updated records within the online repositories in a single-pass with full-text indexing, then rapidly identifies and recovers information back in to the hot repository

Summary

ECM systems such as EMC Documentum, IBM FileNet P8 and Open Text Livelink help companies more effectively deal with ever-growing amounts of data. But safeguarding such systems and their complex data requires a thorough solution that protects the full system against failures and disasters, as well as the discrete content and metadata in cases of partial data loss. Whether in response to a regulatory or litigation-related request, or just to meet the everyday needs of employees, companies must recover aged, lost or corrupted data. The combination of enterprise backup and CYA SmartRecovery provides the ultimate recovery solution for ECM users, ensuring that they will be able to recover discrete documents, with associated metadata, in mere minutes and without costly ECM system downtime.