PDAs increase revenues, regulatory compliance risks

PDAs increase revenues, regulatory compliance risks

Every technology conference, no matter how valuable, has its dull moments. But one of those dull spots led me to an epiphany about unified communications (UC) and regulatory compliance last week. Here's what happened: I glanced at the woman sitting next to me as she worked her personal digital assistant

    Requires Free Membership to View

    Login

    When you become a member, my editorial team will provide you with expert insight for creating and maintaining a manageable compliance infrastructure.  From targeted tips to webcasts and discussion forums, we have you covered.

    Scot Petersen, Editorial Director, SearchCIO-Midmarket.com

    By submitting your registration information to SearchCompliance.com you agree to receive email communications from TechTarget and TechTarget partners. We encourage you to read our Privacy Policy which contains important disclosures about how we collect and use your registration and other information. If you reside outside of the United States, by submitting this registration information you consent to having your personal data transferred to and processed in the United States. Your use of SearchCompliance.com is governed by our Terms of Use. You may contact us at webmaster@TechTarget.com.

to "keep in touch" with her office.

Jeffrey Ritter
First, she "read" a voicemail, and then she used her instant messaging function to give a price approval and edit a contract. Last, she took a call from her stockbroker that was routed through her office line. (And no, I did not use the opportunity to get any stock tips. It's hard to believe there are any valuable stock tips these days.)

What hit me like a cartoon anvil was the fact that her activities jeopardized the confidentiality, privacy and integrity of all the business data and business rules she touched.

No one doubts that unified communications solutions improve information availability; enable convergence among different networks, systems and devices; and substantially enrich the returns on investments in mobile technologies and remote computing. After all, you want your employees out visiting customers and attending conferences while also keeping on top of everyday activities like contract approvals and pricing issues.

But what you don't want is what I most likely witnessed -- usage of mobile technologies putting your company at risk.

So what can you do?

Design UC rules with compliance in mind

First, recognize that UC cannot avoid any of the usual regulatory compliance obligations. Most legal and regulatory requirements apply, regardless of the technologies employed by a company or other regulated entity.

More UC information
Thinking about the value of unified communications

Unified communications opportunity can be lost by bad management

Unified communications definition

Unified communications: Keeping lines secured
These requirements typically establish rules for retaining certain kinds of communications, and for controlling and protecting certain information categories such as personal information or health records. The legal rules are both domestic (within the U.S.) and international. For example, the U.K. has published various regulations that clarify that recordings of telephone conversations, instant messages, chats and similar communications must be retained under the Markets in Financial Instruments Directive.

The trouble is that companies often craft their corporate policies and procedures to focus on specific technologies. That means that whenever they implement a new technology like UC, they need to revise or integrate their policies -- but might overlook this step. At a high level, they need to create a unified policy management system. This would involve an examination of all policies and then revisions until the policies work across all communications applications and solutions. The company would then need to create a system to centrally manage the policies. All of this is no small task, and trying to undertake such an initiative on the fly could easily sink the UC project at hand.

Evaluate each UC solution for compliance

In that case, what the CIO needs to do is focus on the UC project. Evaluate the solution for its impact on the compliance duties of the company. You have to ask yourself (and your design and implementation team): "How could these solutions create compliance risks? How can we make sure those risks are controlled?" Include the answers to these questions in your business case. Make sure you consider all compliance-related procedures and map any required changes into your implementation plans. Policies and procedures in the following areas should be included:

  • Records and information management (especially for stored communication records).
  • Electronic discovery ("e-discovery") practices.
  • Security controls on personal information
  • Security controls on access to communications
  • Corporate policies on confidentiality
  • Corporate policies on appropriate business use.

You have to ask yourself (and your design and implementation team): "How could these solutions create compliance risks? How can we make sure those risks are controlled?
,
Thinking back to my conference neighbor, what would have happened in that case if her company had figured unified communications into its design?

First, the company would keep a copy of either the voice recording or the text translation -- not both. Second, the price approval would have been handled through a secure Web portal that would separately preserve the contractually significant record. Third, the contract edits would be used to update the control record of the contract, eliminating any previous drafts. And, finally, the personal phone call would have been blocked as an inappropriate inbound personal communication. The end result -- keeping up to date with personal and company business -- would have been the same.

Taking these first design steps will help protect the ROI you are most likely already reaping from empowering your mobile employees with UC solutions. They will keep the rewards of your employees' messaging efficiency but jettison any compliance, security or privacy risks that your UC solutions may be innocently enabling. And then you can focus on building a unified policy management system, so you'll be ready the next time you have a new technology to deploy.

Jeffrey Ritter, Esq., is CEO of Waters Edge Consulting LLC in Reston, Va. Waters Edge offers strategic consulting services to develop improved information governance. Write to him at editor@searchcio-midmarket.com or Jeffrey@wec-llc.com.


This was first published in October 2008

Disclaimer: Our Tips Exchange is a forum for you to share technical advice and expertise with your peers and to learn from other enterprise IT professionals. TechTarget provides the infrastructure to facilitate this sharing of information. However, we cannot guarantee the accuracy or validity of the material submitted. You agree that your use of the Ask The Expert services and your reliance on any questions, answers, information or other materials received through this Web site is at your own risk.

Back to top