Increased Reliance on Outside Providers.

Many of the companies that are now operating with reduced and remote work forces have turned to outside providers to handle functions ranging anywhere from printing, courier, and delivery services to eDiscovery mobile data collection, video-based translation services, and more. Outsourcing is an easy way to expand an organization’s capacity, reduce delays in legal proceedings, and minimize disruptions in overall company workflow. All of these are incredibly positive outcomes, but what questions should be considered, and what expectations should be set? First and foremost, ensure that there is a contract in place for each service provider as opposed to just relying on work orders or emailed requests. This is especially important if providers are handling important company or customer information. Pay careful attention to the terms and conditions in outsourcing agreements. Are there provisions for:

• The service provider’s treatment of confidential records or information? How are the records transferred, stored, and disposed? Is there a specified timeline for returning or disposing of company information?
• What about non-disclosure agreements and confidentiality requirements for the employees of the service provider?
• Are there notification provisions if any company information is impacted by a cybersecurity breach or a data loss? What protections are in place for your company or your customers?
• What happens if the provider is in possession of your company’s records at a time when a litigation hold is triggered? Will the provider help your company comply?
• Don’t forget to establish appropriate service level expectations for communications, work hours, and response times.

What Happens at Reopening?

As many regions begin phased reopening plans, it is time to look towards the future of work and how some of the changes made during “Coronapocalypse” may impact information governance for the long haul. It is possible that we have redefined what “normal” is and that this dispersed work-force, or some hybrid of stay-at-home and rotational in-office work, may be here to stay. Now is the time to consider:

• What policies, procedures, and education need to be modified or created to help employees make sound decisions about handling company information and business records in the office and at home?
• What types of routine audits should be scheduled by your Information Technology departments to determine what devices, what technology or tools, and what information or data sources are in use by all employees? (The goal of these audits should be to dive down into what’s REALLY happening at the employee level, rather than relying on a policy alone.)
• Should employees be asked to provide periodic reports about company information and business records in their possession, on their devices, or on their desks at home? What would that reporting look like, and who should initiate, receive, review, and enforce this kind of reporting?
• What changes are needed for long-term infrastructure and systems for information governance and business records? Is now the time to invest in a document management system, a secure cloud-based storage solution, a litigation hold system, or other technology to help track, manage, secure, and retrieve your company’s business records?

The overarching goal of all of these questions is to ensure that your company is prepared – prepared for the future of work, prepared for other possible global disruptions, and prepared with information governance plans that will keep your company healthy for the future. As companies contemplate reopening and begin making decisions about what type of work structure is healthiest for employees and best for the company’s bottom line, it will be important to address all of the issues presented in this series of posts.