Information lifecycle management

Information Lifecycle Management (ILM) refers to a series of strategies aimed at managing storage systems on computing devices.

ILM is the practice of applying certain policies in an effort to accomplish effective information management.^[1] This practice originated from managing information in physical forms such as paper, microfilm, negatives, photographs, audio and video recordings^{[2][citation needed]}. It refers to the information management of any product or process from start to end, or until its execution.^[3][4][5]

ILM encompasses every stage of a "record" from creation to disposal. While it is commonly associated to information that meets the formal definition of a record (and thus related to records management), it applies to all informational assets. During its existence, information may be designated as a record if it documents a business transaction or fulfills a specific business requirement. In this sense, ILM is a part of the broader framework of enterprise content management.

The term "business" is used in a broad sense, encompassing more than just commercial and enterprise activities. While many records pertain to business operations, others document historical events or significant moments unrelated to business endeavors. Examples including birth, death, medical/health, and educational records. e-Science, for example, is an area where ILM has become relevant.

In 2004, the Storage Networking Industry Association, on behalf of the information technology (IT) and information storage industries, attempted to assign a new and broader definition to Information Lifecycle Management (ILM). A definition published on October at the Storage Networking World conference in Orlando, Florida, stated that "ILM consists of the policies, processes, practices, and tools used to align the business value of information with the most appropriate and cost-effective IT infrastructure from the time information is conceived through its final disposition."^[6] In this view, information is aligned with business processes, through management policies and service levels associated with applications, metadata, information, and data.

Policy

The ILM policy encompasses storage and information policies that guide management processes. Policies are dictated by business goals and drivers, tying into a framework of overall IT governance and management; change control processes; requirements for system availability and recovery times; and service level agreements (SLAs).^[7]

Operational

Operational aspects of ILM include backup and data protection; disaster recovery, restore and restart; archiving and long-term retention; data replication; and day-to-day processes and procedures necessary to manage a storage architecture.

Infrastructure

Infrastructure facets of ILM include the logical and physical architectures, applications dependent upon the storage platforms; security of storage; and data center constraints. Within the application realm, the relationship between applications and the production, test and development requirements are generally most relevant for ILM.

Functionality

In business records management, five phases are identified^[8] as part of the records life cycle continuum, along with certain exceptions. The phases are as follows:

• Creation and Receipt
• Distribution / Access
• Use / Consumption
• Maintenance
• Disposition

Creation and Receipt refer to records at their point of origin, which can be the creation of records within an organization or the receipt of information from external sources. These records include correspondence, forms, reports, drawings, and computer input/output.^[9]

Distribution / Access refers to the management of information after it has been created or received, including internal and external distribution, as records that leave the organization document transactions with outside parties.^{[clarification needed][10]}

Use or Consumption occurs after internal distribution and involves applying information to support business decisions, document actions, or serve other organizational purposes.

Maintenance includes records management, which involves filing, retrieval, and transfer of information. Filing entails organizing data in a structured sequence and establishing a system to manage it throughout its useful life within the organization. Effective filing is crucial for efficient retrieval and usage, while poor filing practices can hinder access to information. The transfer process encompasses responding to requests, retrieving data from records, and granting access to authorized users.

Disposition is the process of handling information that is accessed infrequently or has reached the end of its retention period.^[11] Records used infrequently may be moved to an “inactive records facility” until they meet their retention limit. Although some information retains long-term value, most records lose relevance over time, with their highest value occurring shortly after creation. Records then transition from active to semi-active and eventually to inactive.^[12] Retention periods are set by an organization-specific retention schedule based on regulatory, statutory, and legal requirements, business needs, and historical or intrinsic value. Information should be appropriately disposed when it is no longer valuable to protect privacy and confidentiality.

Long-term records are those with ongoing value to an organization. Retention periods may extend to 25 years or longer, with some records designated as “indefinite” or “permanent.” However, due to the impracticality of such retention, “permanent” is a rare designation outside of federal agencies.^[8] Long-term records must be managed to ensure persistent accessibility, which is relatively straightforward with paper or microfilm but more challenging for electronic records. Electronic records require policies for format viability and media accessibility, as media can degrade or become obsolete. Regular conversion and migration of electronic records help maintain accessibility for required retention periods.

Exceptions to the typical life cycle occur with non-recurring issues outside routine operations. For example, when a legal hold, litigation hold, or legal freeze is required, a records manager places a legal hold within the records management system, preventing the affected files from being scheduled for disposition.^[13]

Secure Data and Digital Information Deletion

Information technology systems typically contain large volumes of confidential data.^[14] Social security numbers, credit card details, bank account information, medical histories, and classified information are often stored on computer hard drives or servers. They may accidentally or intentionally be transferred to other media such as printers, USB drives, flash drives, Zip drives, Jaz drives, and REV drives. The increasing volumes of stored confidential data, combined with rapid technological changes and shortened IT asset lifecycles, have created the need for irreversible data deletion from electronic devices when they are decommissioned or refurbished. Moreover, data breaches increasingly occur due to network hacks, theft, and loss of laptops and other portable storage devices.^[15][16]

If data is not deleted when a disk is retired or lost, an organization or user faces the risk of data theft and compromise, leading to identity theft, loss of corporate reputation, regulatory non-compliance threats, and financial consequences. Companies spend vast sums of money to ensure complete data removal when disposing of disks. Strict industry standards and government regulations require organizations to minimize the risk of unauthorized disclosure of confidential corporate and government data.^[17][18]

Data deletion (sometimes called secure deletion, data cleansing, data wiping, or data destruction) is a software method of data cleansing aimed at completely destroying all electronic data stored on a hard drive or other digital media by irreversible overwriting of all sectors of the device. Overwriting data on storage devices renders it unrecoverable.

Irreversible data wiping goes beyond basic file deletion commands, which only remove direct pointers to disk sectors containing data and allow data recovery using common software tools. Unlike demagnetization and physical destruction, which render the media unusable, data wiping removes all information while leaving the disk operational. New flash memory-based media implementations, such as solid-state drives or USB flash drives, may cause failures in data wiping methods, enabling recovery of residual data.

Standards NIST SP 800-88 Rev.1 and IEEE 2883-2022 define how to cleanse disks: overwriting on hard drives, sanitize commands, or crypto-erasure on solid-state drives.^[19]

When encryption is used, data deletion acts as a complement to crypto-erasure or the practice of “deleting” data solely by removing or overwriting encryption keys.

Data deletion offers an alternative to physical destruction and demagnetization for the secure removal of all data from a disk. Physical destruction and demagnetization destroy digital media, necessitate disposal, increase the amount of electronic waste, and negatively affect the carbon footprint of individuals and companies.^[20] Hard drives are almost 100% recyclable and can be collected free of charge at various hard drive recycling points after being sanitized.

See also

• Application retirement
• ARMA International
• Automated tiered storage
• Computer data storage
• Data classification (disambiguation)
• Data proliferation
• Digital asset management
• Digital continuity
• Digital preservation
• Document management
• Enterprise content management
• Hierarchical storage management
• Information governance
• Information repository
• Records management