Creativa - Fotolia


ECM platforms' false tradeoff: User access vs. IT control

Users see a false tradeoff between ease of access for users and IT governance and control in content management. Can identity management break the stalemate?

As the workforce gets more mobile and dispersed, enterprise software has to satisfy an increasingly difficult balance between accessibility and control.

While workers need software that is centralized and makes files easy to access, enterprises need to be able to lock down that information, protect it and prevent it from being leaked, hacked or left on a tablet in an airport. That's a tall order for software: to make files easily accessible without lots of logins and firewalls, while at the same time ensuring that enterprise data is secure and protected.

Add to this management challenge the fact that enterprise content management (ECM) options have proliferated during the past several years. Enterprises have a dizzying array of ECM platforms to choose from, which is exacerbated by the often diverse needs presented by different portions of any given organization. It then begs the question: Can today's enterprise get the value from ECM technologies with the largely cloud-based, mobile-enabled population?

ECM platforms: Disruptive force or here to stay?

It's no secret that there are numerous services that allow organizations to address various capabilities of ECM. In particular, simple file sharing, through services like Box, Google and Dropbox, has changed the way many companies exchange information and collaborate among workers. Easy-to-use, Web-based and mobile-enabled file-sharing services provide ways for employees across geographies and computing environments -- mobile versus PC versus Web. These services greatly improved the accessibility of content for workers -- regardless of device, location or company affinity. But, among other issues, they have also created fragmentation in the document lifecycle management process. In making it simple to drop files in a highly accessible location, the content is often orphaned from governance, access security and automated management policies.

The goal is to rally around a single technology.

Legacy ECM platforms severely restricted access to content, largely based on access control lists or even simple licensing restrictions. By contrast, cloud-based ECM tools, with few ties to corporate identity software, created the opportunity to expose content to virtually anyone in the world. Account owners could dynamically create a repository, add content and enable individual access with little trouble -- even incorporating federated identity solutions such as Yahoo IDs, OpenID, Facebook accounts and Microsoft (Live) accounts.

What should be clear to most technology and business leaders is that these cloud-based ECM technologies are here to stay. Organizational efforts to control their use have yielded little success. All further efforts should instead focus on incorporating these tools into the enterprise as part of the digital workplace. The first step should be identity management.

Creating a unified, controllable, secure and integrated identity management system should be paramount. One of the key factors in cloud ECM tool adoption is ease of use; users have turned to services like Box because the barriers to entry are low, with no virtual private network access or extensive login required.

The top draw is the ability to easily gain access to these technologies, regardless of location and device. Organizations like Google, Microsoft and Amazon have begun to offer scalable services for creating unified identity management that ties external and internal identities, including the ability to use those identities for accessing commercial, cloud-based ECM services. This means organizations can create secure access without burdening users with arcane, difficult login processes.

Once a company establishes a manageable and universal identity management approach, it needs to create a findability solution. Often, organizations use search tools to enable findability. While that's a good start, numerous findability approaches need to be implemented together, where the content repository and content search are intertwined. Enabling findability enables a variety of other efforts as well, such as content personalization, content discovery and the effective application of metadata to content objects. Once a findability technology and methods are in place, companies give employees an easy way to find content -- a common complaint -- and create mechanisms to allow regulated firms to adhere to regulatory and policy-driven compliance requirements -- e.g. e-discovery and Sarbanes-Oxley Act requirements, for example.

Finally, apply real and integrated content rights management to ECM tools. Security applied at the repository level, regardless of the repository, is neutered when the content leaves the store. Organizations that need to provide uninterrupted content governance and security must implement a rights management approach that can be attached to individual content items. Information rights management technologies prescribe what each recipient or content consumer can do with the content -- from no access, to full edit rights, to view only without printing or saving capabilities.

Extracting value from ECM platforms

There will be organizations that may not be able to take advantage of cloud-based ECM tools; however, they represent the minority. Many organizations have opportunities that go unrealized. There are ways to ensure the benefits of cloud and mobile enterprise content management are captured.

. More often than not, migrating to newer technologies is simply a matter of change management -- getting organizational standards to accommodate the change and encouraging the right sort of behavior from individual employees. Enterprises should focus on small but effective shifts in work to highlight advantages and minimize business disruption. An easy one is simply making repositories and content interaction truly mobile -- create a compelling mobile experience.

Once you have a change plan in place, identify commodity workloads -- e.g., file sharing -- that can yield perceived value without creating undue risk. While many firms already use a variety of file-sharing tools, the goal is to rally around a single technology, with the corresponding change management mechanisms to produce a standard within the organization. Employees should think about file sharing as synonymous with this tool.     

Finally, address regulatory or policy challenges head on. It can often be easier to simply revert to "we're regulated" or "legal won't approve this" as excuses for not adopting ECM platforms. As mentioned earlier, there are real and necessary restrictions in a few circumstances. However, most cloud vendors and the associated ECM tools have addressed these regulatory hurdles. It's time to put the benefits of cloud environments into action.

Next Steps

Is the future of content management in the cloud?

The challenge of system integration and ECM software

Cloud, mobile upending the traditional ECM software market

Dig Deeper on Cloud-SaaS online collaboration tools