 to today's Mark Holokwium Records Management in the Cloud. The speaker is Mary Beth Herkert. She's State Archivist for the Oregon State Archives. Mary Beth has had roles as Archivist as well as Records Manager and Manager of Information in Records Management Unit. I met Mary Beth working on an ARMA Task Force, and I know she's been active presenting in SAA as well, specifically at last summer's conference. I was very aware of that. Mary Beth is both a CRM and a CA, so she is very well versed in both the records and the archival aspect of the issue that she's going to speak with you tonight about, which is Records Management in the Cloud. So I'm going to turn the mic over to Mary Beth right now. This is a, I've been doing Archives and Records Management now for almost 30 years, and if you had told me 30 years ago that I would be spending my time on nothing but IT or computer issues related to records, I would have thought you were nuts. But anyway, it's something that's new, something that's kind of innovative for most people to think of even doing business in the Cloud, although we're really kind of being forced into it. The whole, just there's a major portion of this presentation is going to be kind of how we have embraced the Cloud to actually do Records Management. We've actually put our electronic records management system in the Cloud and have made it a statewide system for all state and local government agencies to use. So with that, what is really the Cloud? It's a very general term. Some people narrowly define it as virtual servers over the Internet. Others are more broadly defined as anything you consume outside your firewall. But really, it involves delivering hosted services over the Internet, and they're divided into kind of like three types of services, infrastructure as a service, platform as a service, and software as a service. I am most familiar with software as a service is that is what we are providing. But the infrastructure as a service is where you pay for what you use. It's also kind of commonly known as utility computing because it's like your utilities, what you use, you pay for. So a lot of it has to deal with storage, different things that you may do on the Internet, like something like Amazon Web Services. Platform as a service is more like development tools that are hosted on the provider's infrastructure, like Google Apps. The one problem with that is there are no standards for these services related to interoperability or portability, so you have some limitations. And some of these platform as a service providers will not allow you to move anything that you develop off of their platform. So you're kind of stuck there if you're doing something internally on that. And then software as a service is where your vendor is supplying the hardware, the software, the infrastructure, and then you access it through a web portal so that you can use the service. Basically, it really represents what you're doing on a day-to-day basis. If you didn't know it was in a cloud, you would never realize that. And most of your web email providers are going into the cloud now. For example, the state of Oregon has just entered into an agreement with USA.net to provide Microsoft Outlook over in the cloud. And we just switched over to that in June. And really, you can't tell the difference as if it was on your computer as it was, you know, an internally hosted app as opposed to being a virtual hosted app. So all of them have their place and all of them are in a wide variety of development and use. The Synergy's Data Center that I have listed there is that's our host for our electronic records management system. And we'll continue to go and talk about that in a little bit here. But really, the three things that differentiate the cloud from traditional hosting is it's sold on demand. You only pay for what you use. So if you're not going to use it, you don't pay for it. It's elastic. So you can grow at whatever rate you want to go. Of course, if you want to grow, you're going to pay more for what you're getting. So it's not free. And that's the one thing that people need to understand is there are costs and vows with it, but you basically are only paying for what you use. And the nice thing about it, and there are a lot of people who find good about this, is that it's fully managed by the provider. So it really frees up your IT staff to do stuff that internally needs to be developed and used. So you don't have to worry about anything. So a software upgrade comes along. The vendor's going to upgrade it for you. So you don't have to expand your IT staff to do the job for you. The reasons really for cloud development are kind of three-fold, I guess, if you want to say. I think the last is the biggest reason, especially when you look at government is innovations and virtualization and distributed computing. I mean, the industry has grown so much over the last couple of years that it really makes it more of an option for most people. Again, improved access to high-speed internet. As more and more people have access to it, they can do things in the cloud. However, when you get into some states, and I mean, it's not just the wild, wild, the west if you want to say, but there are a lot of states where the rural areas still only have dial-up access to the internet. So cloud computing is not going to work for them because you have to have the advantage of the high-speed internet. And like I said, the last reason, which I think is the biggest reason, especially when you look at government, it's a weak economy. And, you know, when we talk about our situation, you will see how much less expensive it is for us to do this in the cloud as it would have been for us to host it internally. And with government, with budgets being cut, especially in this area of archives and records management, it's something that you always need to find new and innovative ways that are more efficient and cost-effective to do your business. And so I can speak to the government perspective on this. A lot of people in the private industry, you know, the reasons might not be the same, but speaking from the government point of view, that's where we're at. There's two types of cloud. There's a public cloud, which self-services to anyone on the internet. You know, so USA.net is a public cloud, Amazon is a public cloud, Yahoo, Gmail, they're all public clouds, anybody can join, anybody can access them. A private cloud is more where you're controlling who your users are. And it's usually limited to a certain group of people. And there's been a lot of talk about a government cloud. That would be a private cloud in that only government entities would be allowed to access and use the services that are in the cloud. We have set up a private cloud. It was the only way that we could comply with the laws in the state of Oregon to do what we are doing. So we set up a private cloud. Public clouds pose lots of problems for government entities, and we'll get into that too. And where we get into that is in the advantages and disadvantages. And really when you look at the advantages, the potential savings are really key. And like I said earlier, especially in these economic times. But I mean, you can save hundreds of thousands of dollars in infrastructure costs, software costs, hardware costs, and staff time, IT costs. So that's really why people look to the clouds is because they think, well, we're going to save all this money and get the same package, so we're going to go ahead and do it. But there are always, all of these advantages have their disadvantages too. Potential speed, it can be faster than your internal setups because the people who own the clouds have the latest and greatest technology. They're ensuring that people are only getting the best equipment, that everything is configured to reach the maximum potential of the software or the service that they're providing. So really you're getting a situation where you get the best. And a lot of times when you're posting it internally, you're dealing with maybe servers that are three or four years old or, you know, you've configured it one way, so you have to kind of adapt the piece of software you're trying to add so it meets your internal configuration and that kind of thing. And so you really do have an advantage there, but it can also be a disadvantage. And it frees up your IT staff. And for like our agency, we, the agency I work for, I work for the Secretary of State, we have about 200 employees and our IT staff is constantly developing new applications for the very distinct program areas that are part of the Secretary of State's agency. But you really need to weigh the advantages and disadvantages and you need to do that, that business or case study that's not even, not only a cost-benefit analysis, but really a good business case to see if the application you're looking at should be in the cloud because you do have some real distinct disadvantages. Like a ownership and control, you do not control your information. Once you have it in the cloud, basically the vendor is controlling it for you. So to say that that is a huge give-up, especially in government, that really violates almost every statute in all 50 states when it comes to ownership of public records. They belong to the state, they belong to the citizens of the state. So when you send them out to the cloud and you're letting somebody else own them, you can get into some really big legal issues. Security is another thing. On a daily, I think on the records management list there, we see issues about something being hacked, the cloud's not secure, they lost this information, they lost that information. And those are all problems that you can face when you are playing in the cloud, especially if you're in a public cloud, how do you secure your information so it's not getting hacked, how do you deal with things like that? So, again, your advantages have to weigh your disadvantages. And then finally for me and for records managers everywhere, how do you apply retention and disposition? If you don't own and control the information, it's highly unlikely that somebody like Yahoo is going to say, oh yeah, the state of Oregon, the archivist there wants you to keep that information for six years. I'm going to retain it for six years for them. Uh-uh, they're going to keep it for as long as they want it and that's as long as it's going to be there. And so you can't really apply your retention and disposition unless you make provisions for that ahead of time. And so for us, we immediately had to eliminate playing in the public cloud for what we were doing is because we had to maintain ownership and we had to be able to apply retention and disposition. So, those are really, you know, what you're looking at. But if you don't, I mean, we're, what we put in the cloud is electronic records management system. So, we're going to control it retention and disposition. But if you don't have an electronic records management system, how are you going to apply retention and disposition in the cloud? For example, if we didn't have our electronic records management system, all of our e-mail, we pay for storage of all of our e-mail messages. They don't manage them for us. And so we would be paying very long-term storage costs because we wouldn't know how to otherwise apply retention and disposition in USA.net. So, the only reason we went into a public cloud for e-mail is because we had a private cloud that was going to manage our information. And we require everybody to put e-mail messages that have, that are considered public records into the electronic records management system. So, those are some of the things that you need to kind of take a look at when you're going into the cloud. And it's fairly new. And a lot of people don't understand the ownership piece of it. I mean, it's like Facebook. Anybody who has a Facebook page knows that you don't get to pull stuff off when you want to or retain it for as long as you want to. Facebook's basically doing that for you. Twitter, the thing with Twitter is the Library of Congress is saving all of the tweets. So, you definitely don't have any control over that. I mean, you can remove them. But Library of Congress is keeping them forever. So, every Twitter message that you've sent, just remember, it says the Library of Congress forever right now. So, it's not my favorite thing to do. But, so, pretty much, I'll get into why did we go into the clouds with knowing everything that we knew? Well, part of the problem is for the past 10 years, I have been trying to get the state to have a unified way of managing electronic records. We at the State Archives have always kind of been proactive. My predecessor and I in 1995 tried to get email, an email policy written for the state that would have said that email messages could only be for routine communications and anything that had substance with it would have had to have been sent as an attachment so that we could manage the attachments outside of the email and not have to worry about internal communications. We were basically left out of the room. Nobody thought that it was a problem in 1995. You know, what's this email thing? It's not going to be an issue and we don't want to be bothered with it. Fast forward 10 years, 11 years, and then we have all these CIOs coming up to us and saying, you know, we wish we had listened to you. Because now they're having to manage all these messages that vary in retention and content. So it became real apparent to us that something had to be done to manage information in a routine and systematic manner within the state. We had a state agency and a city have major lawsuits placed against them for the misuse or mishandling of public records. The first case was our state accident insurance fund and they were fined. Basically it came out to about $2.5 million was their fine for, well, circumventing the public records laws. And so, you know, you can buy an electronic records management system for significantly less than $2.5 million depending on your agency size. So why are we spending all this money in lawsuits instead of managing our information? The city of Beaverton was probably more noted because they faced Nike and guess who won? It wasn't the city of Beaverton, it was Nike and they're, you know, had all the money to throw at it. So their fine was over a million dollars for not being able to produce all their electronic records. So we had beginnings that really started with these really big lawsuits and no way of managing information. Anybody who's tried to manage electronic records manually finds it's really difficult to do. I mean, how do you go through all your terabytes of information on your file servers and apply retention to it? It is a really onerous task. Some of the other issues are is how to comply with the law. And the problems with the laws are is most of the more written way before the, even the personal computer was developed or in entire use. How do you apply retention? And then we really wanted to build off of what we did here as the Secretary of State's agency with our electronic records management system. We were able to get funding for a system in 2007. We bought our system which was at the time tower trim. It's now HP trim and the reason we selected our system was because it was extremely user-friendly and it was truly an off-the-shelf product. So it made life really easy for us once we implemented. And so how could we let others take advantage of what we've already done? Because it doesn't make sense. It never made sense to me that every state agency, every city, every county in Oregon, every special district, all which I have jurisdiction over, we're spending going to spend upwards of a million dollars to implement an electronic records management system. Why couldn't we have a statewide system that people could take advantage of? So then it became is how are we going to do that? Well, the first thing we have to do and we're moving along with out is happening quite yet. But if you look at the public records law and our public records law and that's the top part right here, our public records law is like every other state's public records law except ours is divided into two parts. So we have one for retention and disposition and we have one for access. They're basically the exact same. This current law was written in 1961 really at that time computers occupied entire rooms. Nobody had a personal computer, nobody had a Facebook page, nobody was tweeting. So really the law assumed that a record was something that was tangible. And in 1989 they amended it to add in the part for machine readable records and that was all well and good. But again, it always assumed that the record was something tangible and something that was able to be captured. And it always was owned by the state or the public entity that was creating the record. So not a big deal. Well, fast forward to, you know, to now and we have a definition that really does not work in today's day and age. So what I decided to do is that we needed to get a new definition and the definition, the proposed new definition is at the bottom. And it basically makes the law technology independent and focuses on the fact that it is the content of the information that carries the retention and not the media that transmits or is used to communicate the record. So currently it has been through the House, because we're in a legislative section right now, it's passed the House, it was then sent to the Senate, it was amended in the Senate, but passed the Senate. So now I have to go back to House for concurrence. Right now my bill is being held hostage for another bill like any good public records or I guess good and peaceful legislation is always gets held hostage or something else. Rumor has it that it may have its concurrence about tomorrow. We're really hopeful because this will make my life a lot easier when I'm trying to work managing information, especially in the cloud. I originally wanted to change for social media, but it really even becomes more important when you're trying to manage information in the cloud. Are there any questions or anybody have anything right now that they have a question on? So we came up with this idea of having a statewide electronic records management system and it's now known affectionately yet known as Oregon records management solution or the Oregon records management solution. We looked at doing it in-house, hosting it in-house and allowing people to just buy off of it. It was far too costly. We couldn't get the price under probably $150 per user per month and there was nobody who would buy into the system for that. The state of Michigan is currently pursuing this option in-house and their fee is somewhere between $125 per user per month to use the system. And it'll be interesting to see how well it's received and how well theirs is going to be used. We have, so then we decided actually it's really good because my CIO of my agency is probably as crazy as I am when it gets to creative, new and innovative ideas. And so she's the one who came up with the SaaS solution or the software as a service solution. But what were we going to be the logistics of it? How are we going to do it? How could we bring it so it actually was going to make sense and be affordable? First of all, we had, the way the state of Oregon is set up is we had to get delegated authority from the Department of Administrative Services to even offer contracts to certain state agencies because they're required to buy things from the Department of Administrative Services. And not from us. So we had to leave that hurdle and we had to leave the Department of Justice's hurdles over how to actually put this out for bid, you know, go through the whole RFP process, go as, you know, how narrow to make it, how wide to make it, everything else. So we finally got through all of that and that took almost a year of the logistics piece to get it set up. We put the request for proposal out to bid and the only thing we did designate was that whatever the solution was, it had to use HP Trim as its electronic records management software and that's because that's what we know. That's what we're, we know how to use, that's what we're using internally. We vetted the whole looking at other ERMS systems. When we went out for request for proposal in 2007, this was the solution we chose as being the best for what we wanted it to do. And that was, it's truly a records management tool. It was designed as a records management tool and therefore that's its strong point and it was very, very user and user friendly and those were all the reasons we chose this tool. So we did state in our RFP that whoever the vendor was, they had to use HP Trim. We did get some responses back and the winning vendor came from Bigger City, Oregon, which is clear on the other side of the state. It's almost 400 miles from Salem. It's closer to Idaho, the Idaho border than it is to the valley and the synergy data center. And they're not necessarily a new company, but they have a fairly new data center and they were looking for applications to host. And they're highly dedicated to this process because of a number of reasons is A, they truly believe that the data center that they're offering is superior to anything the rest of the state has. And B, for every hundred jobs they create in Bigger City, it's like creating 50,000 jobs in Portland, Oregon. So they see this as a huge boom for their economy over there and they have really good IT people surrounding them. What they did in turn was partner with, they bought and brokered all the licenses through HP Trim, HP Trim licenses through Hewlett Packard. So we didn't even negotiate with them. We only negotiate with the folks at CHAS Consulting and the Synergy Data Center. So our partnership is with them. They can have a multitude of partners out there. A couple of things that we insisted upon was that A just had to be a private cloud that we would control all our information. They could never remove our information from it because we are setting this up based on retention and disposition. We're not setting it up for them to, you know, we don't care about what their storage is. So if they can't expand their storage, then that wasn't going to be a feasible solution for us. So we set that up in the contract so that it is a government cloud. It is a state of, you know, a state of Oregon cloud. However, we are looking to maybe partner with Washington and Idaho, but that's another story for another day. So we, you know, we're sitting there, they're in a completely different geographic area than we are. They are in a geographic, basically safe zone, whereas in the valley, we're subjected to earthquakes and volcanic activity. Baker City is basically in a geographically neutral area. Unlike the coast, we couldn't go to the coast because of the tsunami hazard over there. So really it was nice having it in the different part of the state and from a part of our security and disaster recovery era. So that's why, and they are a tier three data center. We asked for a minimum of a tier two data center. They actually are a tier three data center, so that means they exceed even the state data center for security and the ability to upgrade and grow. So that's why we asked the state data center to host it. They had absolutely zero interest in it because they were having a hard enough time just managing the day-to-day stuff that they currently have. So we have got a really good partnership with them. And to date, we have nine pilot agencies and they're all centered in the Salem, Portland area. We have three state agencies and one park and recreation district and the rest are cities. It was interesting because when we went before the legislature this session, the first comment I had on one of the legislators' mouth were, well, this will probably be way too expensive for any small entity to enter into. And when I told her that one of the first signers on was a park and recreation district, I think she almost chose. But it is an application that really lends itself to small, medium, and large agencies because you only pay for the number of people who are using the system. And there's direct lines, high-speed lines to the data center. So the folks here will be putting their data in. It will go into the data center over here. And the trim application resides on the servers over in the data center with the application being technically virtually mirrored on their computers at their workstation. So it's no different than how you use Word. You just use the trim product and put your records in. And when you want to recall them, you do it the same way. We feel really confident that this is, I mean, we're still in a piloting mode. So, but we're really confident there's nothing that lends us to think that it's not going to work on this. I mean, from a technology standpoint, there's nothing there for it to fail. From a records management standpoint, there's really not much to fail. So I guess it's a capacity standpoint we're looking at now. Is this, are we going to have problems with, when we have thousands of users on it, will we have a problem? We don't anticipate it, but it is something that we are looking at as a pilot. We currently have nine agencies in the pilot program. The system was configured on June 10th, and data starts going in this week. And the first agency to put it in will be the Department of Energy, who is one of our first signer honors. The Secretary of State will be moving all of their information over, but it'll be after July 1, just because of scheduling issues with our IT staff. Because we're on a standalone system right now, but we're going to move over to the Software as a Service application. One of the big reasons that we're going to move over is cost. And I hope you can all see this slide. When we implemented TRIM, our total cost was just under a million dollars. It was $915,000. We pay on a monthly basis, a little over $78.56 per month per user. That's our maintenance fee as a standalone system that we're paying to HP every month based on our users. As you can see in the far corner over here on the far right-hand side, the statewide service, the monthly fee is $37.02. So we're going to be saving over $38 a month per user just by going into the cloud and using the Software as a Service model. That equates for us of over $100,000. The agency as a whole of over $100,000 worth of savings for the agency. So it didn't make sense for us to stay in a standalone system. Plus, after five years, we would have to refresh our hardware and that's an added cost. We asked HP to give us some ballpark numbers for 500 and 1,000 users. And that's what these next two columns look at. And as you can see, 500 users is roughly the 1.15 million. A thousand users are about 1.77 million. And the monthly fees would be $57.83 or $47.50. So it's pretty expensive to stay standalone. Next was prohibiting a lot of agencies. They want to do this. They want to manage their information because they don't want to take the risk anymore of not having it managed in the manner that's systematic and routine. To go standalone was way too cost prohibitive. And so now they're looking at, well, how can we do this? And so when we came up with this option, we had a number of folks jump on. And thankfully, one of the first, well, the very first city to sign on was the city of Beaverton because they had that major lawsuit and they're being sued almost every day for poor management of their records. And so now they're putting their information into a records management system. They were originally just going to go with an e-discovery solution. But it still didn't manage their records. It just told them where they were. It would do fine searches, but it didn't really solve the problem of managing records and managing information. So they jumped on early. And their city council, although we had some pushback from their IT folks, their city council was like gung ho because they saw this as a way to get some credibility back with their records. They were not their citizens. The next slide just kind of shows the cost of per user, yeah, over five years and the total cost for ownership. And as you can see, the bottom client is the state service and these other lines are standalone systems based on how many users you have. Our goals, we have, we do have goals. For our first year, at the end of the one year, we want to be able to have 2,000 users in the system right now with the agencies that we have committed, we have closer to 3,000 or 4,000 users right now. And so these are, you know, by the end of five years, we hope to have 20,000 users. However, with the amount of inquiries and the amount of interest that I've had in this, I think it will be much sooner than five years that we'll hit our 20,000 users. And as you can see, the cost that you're in a standalone system, they stay the same. It doesn't matter how many, how many users that you have, you know, you're going to pay the same and standalone system because you're not adding anybody. Really, there's no economies of scale. But as you see in the statewide system, you know, when we hit 3,000 users, we go down to $26, then we go down to 17 and 13 and then finally $10 and 54 cents. And once we hit 20,000 users, we'll negotiate a new price scale. So there's always cost savings because you're always adding more users on the system. So it really does make sense to share something like this because it's not something that everybody can afford. But if you make it so that you can take advantage of, you know, the state of Oregon, you know, has I don't know how many millions of people in it. And, you know, how many of those actually are affiliated with a government entity or work for a government entity, you know, we can have a million users and have a really cheap cost, you know, that we would never see if we all were having our own systems. So really, it's good government. And then from a purely selfish point of view, it's not only is it cost effective, but as a state archivist, I'm responsible for all of these records. And really, if I have them in one system, it's a heck of a lot easier for me to deal with than I have if I have to have, you know, five different ERMS that I'm dealing with, or, you know, they're all in a variety of systems. So for me, it's cost effective, it's efficient, and then, like I said, from a selfish point of view, it's easy. So really, is it worth it? I would say yes. And I guess I won't have a definitive answer until we're done with our pilot agencies. I just think this is very good government. We need to manage our electronic information. It's not being managed now. Even those with the best intentions have files and on file servers that are in software that are is no longer able to be accessed or read. We are spending millions of dollars in storage per year. I kind of equate. I was asked to do a presentation before the folks who use the state data center, which is projecting a 500% growth over the next year. With the agencies that are already there, and basically, that equates really, we've become a society of virtual hoarders, so any of you who have seen that show awarding Buried Alive, that's what we are when it comes to information on our servers. We don't manage it. We just push it away. It's out of sight, out of mind. And if we were in the paper world still and we had that much information, we would all be fired because nobody would have bought us all those extra filing cabinets and warehouses to store this information in. It's out of sight, out of mind. We don't manage it until we get an e-discovery request, a public records request, or it comes to the point where we have all this obsolete information and we have no clue as to what it is. So can we throw it away? We don't know because we don't really know what it is. We don't know what a free attention to apply to it. And we really have no way of accessing it. So electronic records management system is something that is really, I think, is key to any archives and records management program down the road. Having it in the cloud, I think, is a way to make it affordable for the largest agencies as well as the smallest agencies. And it just makes us more cost effective and more efficient. And I know those are the buzzwords of the day for most state agencies. But I think that, you know, whether it's in the cloud or whether it's standalone, you know, you can make the case for both. But I think this is an application that in the right situation, in the right cloud, because of all the steps that we took ahead of time to make sure that we could manage, we could control and actually manage information in the cloud, this is really a good solution for us. And we have put in a grant to see if we can't get the state of Washington to look at using our cloud for their records management solution and then taking the permanent records and also storing them at the Washington State Digital Archives in Cheney, Washington. So working kind of a cooperative venture, two clouds, one that's storing permanent records, one that's managing the day to day information. And I really hope that we get the opportunity to do that and get the grant to do it. So I guess it's been a lot of work, it's not something that was created overnight. But I think that using the cloud in the right situation is a really viable alternative to managing stuff independently and on their own. And I think really, with such a weak economy, people had to look at ways, better ways to do things that we're going to save them money. And that's why the cloud has really come to the forefront. We have issues that we need to deal with, security is a huge one. But again, if we can kind of all look at, you're the user of the cloud and the users can have a large voice. And if your vendor doesn't want to make the cloud secure, the vendor doesn't want to do different things. If the users band together and work with that vendor, they're going to leave the vendor and go to somebody who will. So I think we, as more and more people enter into the cloud, I think you're going to see a lot of changes as far as security and portability and availability and that sort of thing with what's going on there. But I guess only time will tell, but I don't think the cloud is going away unless something new comes up down the road that's better and bigger and which I'm sure it will. The one thing I've learned in 30 years of doing this is there's something always new around the corner and that'll be bigger, better and faster. And so it'll be something else that I need to use and learn. So if you guys have more information, you have questions, you can have questions now. Do you feel that one software can meet the needs of all state agencies? For electronic records management, yes. I think it will. I think you need to find the right product. I know we have a couple of agencies that are playing around with a couple of other products and they haven't been able to fully implement. We were able to implement a lot quicker. I think it depends on who's offering it and who's controlling it, managing it. I think the real advantage for us is we're the ones who are providing all the training and information for these guys. So they get an advantage because for their $37, they're getting undivided archives attention and records managers attention. But I think that there are other things that people can put into the cloud and I think that's what's going to end up happening is that you'll see that states will start putting more applications in the cloud. And once you get a secure government cloud, I wouldn't be surprised if we find other things to have synergy host for us as an application. I really do think that that's one of the the second question is how do you move permanent records from the cloud to a digital preservation repository? That's good question. That's what we hope to find out from that grant is how hard or how difficult or easy or difficult is that going to be and is it even feasible? And it's going to depend a lot on Washington's IT folks and then our IT folks and contractors. Does they feature and follow DOD 5015? Yes, it does. And that is a statewide requirement that any electronic records management system that any agency purchases has to be DOD 5015.2 certified. It can't just be compliant. It has to be certified. That was one of the keys to it to make it give me the latitude that I need as a state archivist to ensure that these systems are going to be around for a while and that I can move information around. Hi Marybeth, what a wonderful summary and presentation. Thank you very much. I would you use the word social media once in your presentation. Do you intend to use software as a service or the trim HP technology to manage social media in the future? Yes, we're trying to figure out to do that. The problem is really right now is trying to capture something that was never intended to be captured. What we're hoping to do is with the change in the law is basically say that I don't care if you put it on Facebook. You can send it to me in a Word document or whatever you've posted. You can send it to me in another format because the content is what we care about, not the medium that it's on. In that case, those documents would be put into HP Tram. There are a couple of things that are out there that you can capture social media in. It basically exports the content into an Excel spreadsheet or a tab delineated text file. Those things could go into Tram too. But I think as social media develops along the way and more government agencies are using it, we'll see products developed and maybe that are better at capturing. And then yes, we would be putting that information into the Tram database. Okay, we have a second and other question is, let's see, do I have any idea how many state archives are using the cloud and who are some of the others? I know of nobody using it for this particular application. In fact, it just become a vendor frenzy out here, I think, because I can't copyright our idea or our solution. So I know for a fact that HP is trying to put together their own application. I know Michigan is doing something, but it's more internal. They really haven't gone out to the cloud because they're hosting it internally. So I really don't, I think there's a lot of states who are using the cloud for email, because that's an easy savings to justify, but there's nobody who's using it to manage their records that I know of. Let's see, how did I get around the legal requirements pertaining to government security on the cloud without directly owning the data stored? Well, the next thing about the cloud that we're in, it is the private cloud and we do control the information and we do own the information and that's clearly stated in our contract and our attorneys make sure that was clearly stated in the contract. And then every entity that enters into the service level agreement with the contractor or the vendor, it clearly states in there too that it's their information, they own it and they're controlling it through the use of HP Trim. One of the things that we are doing is we're still going to state archives that is, it's still going to control the destruction. We will send out quarterly destruction requests to the agencies and they will be less permission to delete. We toyed with the idea of giving each agency that option and then realized that we would quickly, because I know from working with government agencies, you get most people who never destroy a thing or those who are going to try to manipulate it a little bit. So we're controlling that part until such time as I have the confidence to maybe switch that over to them. But for as long as the very near future and the future out there for a while, we will continue to do the destruction of the actual information in the system. So we were able, everything we did was with regards to providing the statutes for ownership of public information. And then the nice thing is too is this piece of software allows us to have a web portal so the public can directly access that the immediate, the record, because we're also classifying our information as to whether it's readily available. It has to be available through the agency is secured or is critical. So we have a classification of one through four. The ones are all readily available. All that information immediately goes out to a public web portal so that the public can directly access it. So we're actually making the information more accessible than it currently is right now. So the public is still the owners of the information. Okay, the next question is, the teams that an open source, the RMS software would have great benefit long term. I understand that Elfresco is the only one that claims to be open source. Do you think there is a need for such development in the RMS profession? I've been waiting almost 15 years for the National Archives to come up with their solution and haven't gotten it yet, couldn't wait any longer. So I think it is a natural. I don't know why it hasn't. We haven't had something that was out there. I think part of the reason is that from a purely vendor standpoint is why should they develop something that everybody's going to be able to use when you can sell it and make money off of it as opposed to being open sourced and not maybe so profitable. I don't know. I mean, I'm also one that I like simple, I like easy, I don't like reinventing the wheel. So I think it's a great thing. How long it's going to be before we get there? I don't know. It'd be nice. Let's see. I'm new in this area, but I'm wondering how the records are organized in the cloud. Does every agency have control over how their records are organized? Yes. Every agency has a sector of the cloud or their information. Well, I as the system administrator can see everybody's information, but let's say I as the Secretary of State cannot go in and look at and control, do anything to the city of Beaverton's records. The city of Beaverton can't play with the city of Milwaukee's records and on and on. So everybody has their own control and that's set up by doing, there's a lot of things in the background that have to happen. For every agency that we work with, we develop a file classification system based on their records, retention schedule, and their business processes. And we set up roles and responsibilities for every single user within the city or within the agency that's in the system. So we can control things like that, but all of Beaverton's employees have one part of it. So they're sectored off in the system. Let's see. Although you own the data, are you hosting within your own infrastructure or is it in an external site using virtual VMs? In which case, writing your SLA, did you negotiate for notification in case of hacking or other security breaches? We are going, currently we're internal. We have our own infrastructure, but after July 1, we will be moving to the external site. And yes, in our SLAs, we did negotiate all of this stuff for notification and hacking or other security breaches. We insisted upon certain levels of security before we would even enter it. Like I said, we insisted they had to be a tier two data center, which means they have a certain level of infrastructure built in for security purposes and redundancies built in and that sort of thing. We also have contingencies within, I don't know what the legal term is in the contract, but if this happens or if something happens, who's responsible and what steps need to be taken. So we were very careful in putting, step by step, having that process clearly stated because we did not want, I mean, if you're, it's one thing, if we were doing it ourselves, the Secretary of State was the only one who's doing it. But when you start adding in cities and counties and other state agencies, and some of the state agencies, one of the state agencies that's on board and the pilot is Department of Human Services, their child welfare section, the last thing I need is a data breach with child records, children's records. And so we had to make sure that we had all this clearly outlined in the contract. And as I said earlier, the data center we're in is actually a tier three. So they even achieve higher levels in a tier two. So they assure us and we have it all in contract that we're pretty secure on this. Thank you very much, Mary Beth. I enjoyed your presentation and the participants had excellent questions. So we really appreciate your being with us this evening. And thank you, everyone, for attending.