„Introduction

Information is a critical asset that is indispensable to support business processes and therefore, a foundation for the success of any business activities. Due to numerous existing and emerging forms and uses of information and information-related risks, organizations often struggle with implementing consistent and comprehensive systems to store, retrieve, share and analyse information. The current global digital transformation and the changes in societal expectations increasingly demand greater transparency, accountability, data protection, security, interoperability and information sharing within and between organisations. This trend requires a solid vision and strategy for Information Governance that supports the business process at a strategic level including digital transformation initiatives. Many governmental and non-governmental organisations worldwide already perceive the necessity and understand the benefits of coordinating at a strategic level the efforts of multiple information-, data- and knowledge-related disciplines.

This document defines concepts and principles for Information Governance.

This document provides guiding principles for members of governing bodies of organisations (which can comprise owners, directors, partners, executive managers, or similar) on the effective, efficient, compliant, secure, transparent and accountable creation, use, maintenance, preservation and disposition of information within their organisations.

Information Governance is an integral part of the overall governance of the organisation. It identifies common high-level principles and provides a framework enabling effective and efficient cooperation of all the information-related professionals, in support of the mission of an organisation and achievement of its strategic goals. Stakeholders which are engaged in the collaboration include but are not limited to:

• Data Management
• Information Management
• Records Management
• Knowledge Management
• Regulatory Compliance
• Digital Preservation
• Information Security
• Enterprise Architecture
• Data Protection
• Open Data
• Big Data
• Artificial Intelligence (AI)
• Blockchain
• Business Processes
• Quality Management.

Information Governance requires coherence and integration with relevant Management System Standards (MSS), such as ISO 9000, ISO/IEC 27000 and the ISO 30300 series.

Information Governance is a strategic framework for managing information assets across an entire organisation to support its business outcomes and obtain assurance that the risks to its information, and thereby the operational capabilities and integrity of the organisation, are adequately identified and managed. Information Governance includes but is not limited to policies, processes, procedures, roles and controls put in place to meet regulatory, legal, risk and operational requirements. Information Governance provides an overarching high-level framework that:

• aligns all information-related activities with the mission and goals of an organisation, and its business, legal and societal obligations,
• ensures a comprehensive and systematic approach to information by integrating processes relevant to directing and controlling information,
• supports cooperation between stakeholders, and
• creates a high-level basis for managing information regardless its form, type and format, informs education, professional development of the workforce and awareness about information-related obligations, risks and possibilities.

1   Scope

This document establishes concepts and principles for Information Governance.

This document applies to the governance of the organisation’s past, current and future information assets. It applies to organisations of all sizes in all sectors, including public and private companies, government entities, and not-for-profit organisations.„

Principles

Der Hauptteil des ISO-Standards ist das Kapitel 5 „Principles of Information Governance“. Dort werden 15 Prinzipien der Information Governance ausgeführt.

Principles of Information Governance

1 Recognising information as a corporate, strategic asset

2 Designing Information Governance as a key element of corporate strategy

3 Integrating Information Governance into the organisation’s governance frameworks

4 Securing senior management’s leadership and commitment

5 Building Information Governance in a collaborative way

6 Ensuring Information Governance supports legal compliance and any mandatory requirements

7 Aligning Information Governance to business objectives

8 Ensuring Information Governance supports information security and privacy

9 Ensuring Information Governance supports information quality and integrity

10 Fostering a collaboration and knowledge sharing culture

11 Adopting a risk-based approach

12 Ensuring the availability and accessibility of information to authorised stakeholder

13 Governing information throughout its information lifecycle

14 Supporting corporate culture

15 Supporting sustainability

Zu erwartende Wirkung der ISO 24143

Diese 15 Prinzipien gehen über bisherige Ansätze der Information Governance hinaus. Besonderes neues Merkmal ist der Risiko-basierte Ansatz. Auch das Thema „Nachhaltigkeit“ fand Eingang in die ISO 24143. Der allgemein gefasste Standard kann gut als Grundlage zur Planung von Information-Governance-Maßnahmen und zum Erstellen von Information Governance Policies verwendet werden.

Nach Meinung von Robert Smallwood (5 Key Ways the New ISO Information Governance Standard Can Have an Impact | LinkedIn) eröffnet der Standard fünf weitere, neue Anwendungsgebiete:

1. Standardisierung von Information-Governance-Programmen
   Unternehmen haben es jetzt einfacher, Projekte aufzusetzen und Policies zu entwickeln, die den Wert der Information, die Reduzierung von Kosten, die Definition von Risiko-Faktoren und rechtliche Anforderungen zu formulieren und die Verantwortlichen für Information Management und Information Governance einzubeziehen.
2. Maßstab für Private Equity Investoren
   Hier kann die Umsetzung und Erfüllung der Norm als Nachweis für Geschäftspläne dienen.
3. Erweiterung des Marktes
   Mehr Firmen werden Produkte und Dienstleistungen entsprechend den Leitlinien der ISO 24143 entwickeln und anbieten. Hierzu werden auch branchenspezifische Templates für die Information Governance gehören. Allerdings sollten die Anbieter dann auch selbst den Prinzipien der Norm verpflichtet sein 😉
4. Ausbildung an Universitäten und Hochschulen
   Die Norm und daraus abgeleitete Anleitungen können als Grundlage für Vorlesungen und Seminare dienen, so dass mehr geschulzes Personal auch für die Umsetzung in Behörden, Unternehmen und Organisationen verfügbar wird.
5. Ausweitung in Nachhaltigkeits- und Corporate-Governance-Themen
   Die Norm kann auch bei der Schaffung von Qualitätsstandards und -nachweisen sowie in anderen aktuellen Governance-Gebieten wie Ressourcenschonung, Umweltschutz, Datenschutz, Corporate-Governance-Vorgaben hilfreich sein. Sie kann als Maßstab für die Umsetzung von Regelwerken und deren Nachhaltung dienen.

In jedem Fall wird das Verständnis, die Wichtigkeit und die Verbreitung von Information Governance & Information Management durch diesen internationalen Standard gefördert.