← Back to results

menu Main menu move to sidebar hide Navigation Main page Contents Current events Random article About Wikipedia Contact us Contribute Help Learn to edit Community portal Recent changes Upload file Special pages Search Search Appearance Donate Create account Log in Personal tools Donate Create account Log in Contents move to sidebar hide (Top) 1 History Toggle History subsection 1.1 Records management 1.2 Organizational structure 2 Chief information governance officer Toggle Chief information governance officer subsection 2.1 Multi-jurisdictional governance 2.2 Evolution 2.3 Responsibilities 3 Tools 4 Laws and regulations Toggle Laws and regulations subsection 4.1 United States 4.2 European Union 4.3 United Kingdom 4.4 ISO Regulation 5 Guidelines 6 Events 7 See also 8 References 9 External links Toggle the table of contents Information governance 2 languages Azərbaycanca Français Edit links Article Talk English Read Edit View history Tools Tools move to sidebar hide Actions Read Edit View history General What links here Related changes Upload file Permanent link Page information Cite this page Get shortened URL Print/export Download as PDF Printable version In other projects Wikidata item Appearance move to sidebar hide From Wikipedia, the free encyclopedia Information management system The examples and perspective in this article deal primarily with Western governance and do not represent a worldwide view of the subject . You may improve this article , discuss the issue on the talk page , or create a new article , as appropriate. ( July 2024 ) ( Learn how and when to remove this message ) Part of a series on Governance Models Algorithmic Collaborative Electronic Good Multistakeholder Open-source Private Public opinion By level Local Global Multi-level By field Climate Clinical Corporate Cultural Data Ecclesiastical Environmental Higher education Information Network Ocean Political party Security sector Self Simulation Soil Technology Transnational Measures Fiscal sustainability Government effectiveness index World Governance Index Sustainable Governance Indicators Bertelsmann Transformation Index Policy uncertainty Related topics Chief governance officer Governance, risk management and compliance Environmental, social, and governance Market governance mechanism v t e Information governance , or IG , is the overall strategy for information at an organization. Information governance balances the risk that information presents with the value that information provides. Information governance helps with legal compliance, operational transparency, and reducing expenditures associated with legal discovery . An organization can establish a consistent and logical framework for employees to handle data through their information governance policies and procedures. These policies guide proper behavior regarding how organizations and their employees handle information whether it is physically or electronically . [ 1 ] [ 2 ] [ 3 ] Information governance encompasses more than traditional records management . It incorporates information security and protection, compliance, data quality, data governance , electronic discovery , risk management , privacy, data storage and archiving, knowledge management , business operations and management, audit, analytics, IT management, master data management , enterprise architecture , business intelligence , big data , data science , and finance. [ 4 ] History [ edit ] Records management [ edit ] Records management deals with the creation, retention and storage and disposition of records. A record can either be a physical, tangible object, or digital information such as a database, application data, and e-mail. The lifecycle was historically viewed as the point of creation to the eventual disposal of a record. As data generation exploded in recent decades, and regulations and compliance issues increased, traditional records management failed to keep pace. A more comprehensive platform for managing records and information became necessary to address all phases of the lifecycle, which led to the advent of information governance. [ 5 ] In 2003 the Department of Health in England introduced the concept of broad-based information governance into the National Health Service, publishing version 1 of an online performance assessment tool with supporting guidance. The NHS IG Toolkit [ 6 ] is now used by over 30,000 NHS and partner organisations, supported by an e-learning platform with some 650,000 users. In 2010 Logan and Lomas took up the theme of IG more holistically, publishing on how different disciplines needed to come together to better manage information. Lomas produced teaching in this domain, with Smallwood later providing a key textbook in this domain. Professionally, in this context 2008, ARMA International introduced the Generally Accepted Recordkeeping Principles®, or "The Principles" and in 2015 the subsequent "The Principles" Information Governance Maturity Model. [ 7 ] "The Principles" identify the critical hallmarks of information governance. As such, they apply to all sizes of organizations, in all types of industries, and in both the private and public sectors. Multi-national organizations can also use "The Principles" to establish consistent practices across a variety of business units. ARMA International recognized that a clear statement of "Generally Accepted Recordkeeping Principles®" ("The Principles") would guide: CEOs in determining how to protect their organizations in the use of information assets; Legislators in crafting legislation meant to hold organizations accountable; and Records management professionals in designing comprehensive and effective records management programs. Information governance goes beyond retention and disposition to include privacy, access controls, and other compliance issues. In electronic discovery, or e-discovery, relevant data in the form of electronically stored information is searched for by attorneys and placed on legal hold . IG includes consideration of how this data is held and controlled for e-discovery, and also provides a platform for defensible disposition and compliance. Additionally, metadata often accompanies electronically stored data and can be of great value to the enterprise if stored and managed correctly. With all of these additional considerations that go beyond traditional records management, IG emerged as a platform for organizations to define policies at the enterprise level, across multiple jurisdictions. IG then also provides for the enforcement of these policies into the various repositories of information, data, and records. A coalition of organizations known as Electronic Discovery Reference Model (EDRM), which was founded in 2005 to address issues related to electronic discovery and information governance, subsequently developed, as one of its projects, a resource called the Information Governance Reference Model (IGRM). [ 8 ] In 2011, EDRM, in collaboration with ARMA International, published a white paper that describes How the Information Governance Reference Model (IGRM) Complements ARMA International’s Generally Accepted Recordkeeping Principles ("The Principles") [ 9 ] The IGRM illustrates the relationship between key stakeholders and the Information Lifecycle and highlights the transparency required to enable effective governance IGRM v3.0 Update: Privacy & Security Officers As Stakeholders. [ 10 ] In 2012, Compliance, Governance and Oversight Council (CGOC) developed the Information Governance Process Maturity Model, or (IGPMM). [ 11 ] The model outlines 13 key processes in electronic discovery (e-discovery) and information management . Each process is described in terms of a maturity level from one to four – completely manual and ad hoc to greater degrees of process integration across functions and automation. [ 12 ] In 2017, it was updated to include an emphasis on legal, privacy, information security, cloud security issues [ 13 ] and evolving data privacy concerns, including the impact of The General Data Protection Regulation (GDPR)(EU) . [ 11 ] Organizational structure [ edit ] In the past, records managers owned records management, perhaps within a compliance department at an enterprise. In order to address the broader issues surrounding records management, several other key stakeholders must be involved. Legal, IT, and Compliance tend to be the departments that touch information governance the most, though certainly other departments might seek representation. Many enterprises create information governance committees to ensure that all necessary constituents are represented and that all relevant issues are addressed. [ 14 ] Chief information governance officer [ edit ] A chief information governance officer (CIGO) is a senior executive of a business, organization or government entity who oversees the management and coordination of all information on an enterprise-wide scale. Unlike a chief marketing officer or chief technology officer , whose roles focus on narrower areas, the CIGO is in charge of implementing, facilitating, and improving information governance strategies across all facets of an organization. The CIGO helps other executives make decisions based on the values, costs, and risks associated with information. Multi-jurisdictional governance [ edit ] In regions outside traditional Western governance frameworks, information governance obligations have been shaped by distinct regulatory instruments. In South Africa, for example, the Protection of Personal Information Act (POPIA) of 2013 introduced data governance requirements that intersect with international standards such as ISO/IEC 27001 and the General Data Protection Regulation (GDPR), requiring organisations to navigate multiple simultaneous compliance obligations across different jurisdictions. [ 15 ] This multi-jurisdictional governance challenge reflects a broader structural characteristic of contemporary information governance, in which organisations increasingly operate under overlapping regulatory regimes that require coordinated rather than parallel compliance approaches. [ 16 ] Evolution [ edit ] In past decades, information governance responsibilities might have fallen under the purview of the chief information officer (CIO). But somewhere along the line, the CIO job description changed to focus solely on the information systems and associated technology that power a company—not the information itself. In today's age of big data , organizations have more information under their control than ever before. [ 17 ] To extract the maximum value from that data while simultaneously protecting an organization from its associated risks, business leaders have turned toward the CIGO because of the role's independence from other departments. CIGOs are tasked with neutrally balancing the needs of all departments with respect to an entire organization's top priorities. [ 18 ] Though the position is an emerging one, support for the CIGO continues to rise as business leaders increasingly understand the implications of information governance (and more importantly, the lack thereof). While many organizations have information governance projects in place, such initiatives are much more likely to succeed with top-down management. [ 19 ] Responsibilities [ edit ] Since the CIGO is a relatively new position, the role's responsibilities are not set in stone and continue to evolve. For the most part, today's CIGOs: Manage all of an organization's information, tapping into as much value from it as possible (e.g., better-targeted marketing) while reducing exposure to its associated risks (e.g., lawsuits) Coordinate information governance efforts across all stakeholders within an organization Prioritize the information-related needs of all departments Advocate for those needs on behalf of relevant stakeholders Collaborate with the various information governance facets to continually improve processes Identify and execute information-related synergies Expunge non-critical data Tools [ edit ] To address retention and disposition, Records Management and Enterprise Content Management applications were developed. Sometimes detached search engines or homegrown policy definition tools were created. These were often employed at a departmental or divisional level; rarely were tools used across the enterprise. While these tools were used to define policies, they lacked the ability to enforce those policies. Monitoring for compliance with policies was increasingly challenging. Since information governance addresses so much more than traditional records management, several software solutions have emerged to include the vast array of issues facing records managers. Other available tools include: ARMA International Information Governance Implementation Model [ 20 ] ARMA Generally Accepted Recordkeeping Principles [ 21 ] CGOC Information Governance Process Maturity Model [ 22 ] EDRM Information Governance Reference Model (IGRM) [ 23 ] NHS Information Governance Toolkit [ 24 ] Laws and regulations [ edit ] Key to IG are the regulations and laws that help to define corporate policies. Some of these regulations include: United States [ edit ] The Foreign Account Tax Compliance Act , or FATCA [ 25 ] Payment Card Industry Data Security Standard , or PCI Compliance [ 26 ] Health Insurance Portability and Accountability Act , or HIPAA [ 27 ] Financial Services Modernization Act of 1999, or Gramm–Leach–Bliley Act (GLBA) [ 28 ] Sarbanes–Oxley Act of 2002, or Sarbox or SOX [ 29 ] Federal Rules of Civil Procedure California Consumer Privacy Act , or CCPA [ 30 ] Children’s Online Privacy Protection Rule (COPPA) [ 31 ] European Union [ edit ] General Data Protection Regulation NIS Directive United Kingdom [ edit ] Data Protection Act 2018 General Data Protection Regulation - GDPR will be incorporated directly into domestic law immediately after the UK exits the European Union NIS Regulations - The EU NIS Directive was transposed into UK law by DCMS, in May 2018 via the NIS regulations. [ 32 ] ISO Regulation [ edit ] New Information Governance ISO regulation - ISO 24143 Guidelines [ edit ] MoReq2 [ 33 ] MoReq2010 [ 34 ] ISO 15489 Information and Documentation - Records Management [ 35 ] DoD 5015.2, or Design Criteria Standard for Electronic Records Management Software Applications [ 36 ] Events [ edit ] Information Governance Initiative On May 20–21, 2015, the hosted the first annual CIGO Summit in Chicago , Illinois . Compliance Governance Oversight Council (CGOC) Regional Meetings Regional meetings are held twice a year throughout USA and in Europe for legal, IT, records and CIGO professionals. [ 37 ] See also [ edit ] Business portal Data defined storage Data governance Data science Electronic discovery Enterprise content management Information management Information technology governance Knowledge management National archives Records management References [ edit ] ^ "What is Information Governance? And Why is it So Hard? - Debra Logan" . 11 January 2010. ^ [ Elizabeth Lomas, (2010) "Information governance: information security and access within a UK context", Records Management Journal, Vol. 20 Issue: 2, pp.182-198, https://doi.org/10.1108/09565691011064322 . Available to download at http://discovery.ucl.ac.uk/1543932/ ] ^ [Kooper, M., Maes, R., and Roos Lindgreen, E. (2011). On the governance of information: Introducing a new concept of governance to support the management of information. International Journal of Information Management, 31(3), 195-200] ^ "IGI PUBLISHES 2014 ANNUAL REPORT - Information Governance Initiative" . 11 August 2014. Archived from the original on 26 May 2022 . Retrieved 27 October 2015 . ^ "Archived copy" (PDF) . Archived from the original (PDF) on 2009-11-19 . Retrieved 2011-12-28 . {{ cite web }} : CS1 maint: archived copy as title ( link ) ^ "Home" . Archived from the original on 2014-06-02 . Retrieved 2014-06-03 . ^ "The Principles" . ARMA International . Retrieved 25 March 2023 . ^ EDRM. "About EDRM" . Archived from the original on 2015-02-12 . Retrieved 2015-01-21 . ^ White Paper (2011). Ledergerber, Marcus (ed.). How the Information Governance Reference Model (IGRM)Complements ARMA International's Generally Accepted Recordkeeping Principles (PDF) . EDRM and ARMA International. p. 15. ^ "IGRM v3.0 Update: Privacy & Security Officers As Stakeholders" (PDF) . Archived from the original (PDF) on 2013-09-21 . Retrieved 2013-09-20 . ^ a b "New IGPMM Essential in Confronting Data Challenges - Corporate Compliance Insights" . Corporate Compliance Insights . 2017-03-03 . Retrieved 2018-07-12 . ^ "Using the IGRM Model" . www.edrm.net . Retrieved 2018-07-12 . ^ "Hospitals, Health Plans Should Treat Information as a Prime Asset | HFMA" . www.hfma.org . Archived from the original on 2018-07-12 . Retrieved 2018-07-12 . ^ "From the Experts: Information Governance and Its Impact on Litigation" . Corporate Counsel . ^ Republic of South Africa. Protection of Personal Information Act 4 of 2013 . Government Gazette No. 37067, 26 November 2013. Available at: https://www.gov.za/documents/protection-personal-information-act ^ Taherdoost, Hamed. "Understanding Cybersecurity Frameworks and Information Security Standards - A Review and Comprehensive Overview." Electronics , vol. 11, no. 14, 2022, p. 2181. https://doi.org/10.3390/electronics11142181 ^ Peterson, Andrea (2015-01-07). "Companies have more data than ever. That's risky" . Washington Post . ISSN   0190-8286 . Retrieved 2022-04-29 . ^ "Commentary on Information Governance" . The Sedona Conference . Retrieved 2022-04-29 . ^ "Why information governance needs top-down leadership" . May 2015. ^ ARMA International, Information Governance Implementation Model , ARMA International ^ ARMA International, "The Principles" Archived 2013-07-31 at the Wayback Machine , ARMA International ^ "CGOC: Information Governance Process Maturity Model" . CGOC - Compliance, Governance and Oversight Council . Archived from the original on 2017-08-09 . Retrieved 2017-08-08 . ^ EDRM, "Information Governance Reference Model" , EDRM ^ NHS, "NHS Information Governance Toolkit" Archived 2014-06-02 at the Wayback Machine , NHS ^ "Foreign Account Tax Compliance Act" . ^ "Official PCI Security Standards Council Site" . PCI Security Standards Council . ^ "Health Information Privacy" . 26 August 2015. Archived from the original on September 7, 2015. ^ "S.900 - Gramm-Leach-Bliley Act" . 12 November 1999. ^ "The Laws That Govern the Securities Industry | Investor.gov" . www.investor.gov . ^ "How to Prepare for the CCPA – Here Are the Resources You Need" . CGOC . 2019-10-01. Archived from the original on 2019-10-09 . Retrieved 2019-11-21 . ^ "FTC" . Federal Trade Commission . 20 July 2020. ^ "NIS introduction" . ^ "Moreq2.eu" . www.moreq2.eu . ^ "Account Suspended" . Archived from the original on 2012-02-23. ^ "ISO 15489-1:2001" . ISO . ^ "DoD Standard 5015.2" . 15 August 2016. Archived from the original on 16 May 2021 . Retrieved 1 September 2017 . ^ "CGOC Regional Meetings" . CGOC The Council . 2019-09-26. Archived from the original on 2019-08-16 . Retrieved 2019-09-26 . External links [ edit ] EPA 10 Reasons for RM CIGO Summit Archived 2015-08-08 at the Wayback Machine Information Governance Advisory Firm Retrieved from " https://en.wikipedia.org/w/index.php?title=Information_governance&oldid=1344852860 " Categories : Information governance Content management systems Public records Data management Hidden categories: CS1 maint: archived copy as title Webarchive template wayback links Articles with short description Short description is different from Wikidata Articles with limited geographic scope from July 2024 Pages in non-existent country centric categories This page was last edited on 22 March 2026, at 23:07  (UTC) . Text is available under the Creative Commons Attribution-ShareAlike 4.0 License ; additional terms may apply. By using this site, you agree to the Terms of Use and Privacy Policy . Wikipedia® is a registered trademark of the Wikimedia Foundation, Inc. , a non-profit organization. Privacy policy About Wikipedia Disclaimers Contact Wikipedia Legal & safety contacts Code of Conduct Developers Statistics Cookie statement Mobile view Search Search Toggle the table of contents Information governance 2 languages Add topic