Document Management Systems

Invitation for Disaster

We sent our EDU RFI to more than 15 DM vendors (see complete RFI and responses). We required support for XML to customize and facilitate Web publishing and tight integration with an RM (records management) component. We also looked for a system that could treat e-mail and attachments as documents and records. For ease of use, we required an interface for standard PC clients as well as Web browsers.

We received completed RFIs from five vendors: Entopia, Hummingbird, Liberty Information Management Solutions, Stellent and Tower Software. Among other vendors in this arena, Optika never got the chance to respond: Its records-management and imaging products were acquired by Stellent shortly after the RFI was sent out--just one development in a DM market shake-up (see "Market Maneuvers,"). IBM said it was too busy integrating the acquisition of Green Pasture Software into its content-management business to participate, while iManage and Interwoven could not be distracted from their merger. The same was true for OpenText, which recently merged with IXOS to become a stronger ECM (enterprise content management) player.

FileNet's new release of P8 was not ready in time for our tests. Mobius Management Systems declined to participate, saying its ViewDirect Total Content Management is a full-blown ECM system that includes Web content management and business-process management in addition to DM. Docucorp, Documentum (now part of EMC), MDY Advanced Technologies and Saperion didn't respond to our invitation.

We judged products based on vendors' answers to our RFI. Key points included feature sets available to manage a document's life cycle and the quality of RM components. RM criteria included the ability to map and enforce an enterprise record-retention policy, identify documents as records and apply discrete rules for access and control. We assessed each product's ability to help EDU comply with SOX by maintaining control structures that facilitate audit verifications and guard against the destruction of records. It's hard to guess what sound an RFI response makes when it hits a table, because we received all our submissions over e-mail. But if our vendor responses did make a sound, it would be the crack of a bat hitting a home run. Each had solutions for managing electronic documents to enable faster underwriting and reduce the cost of doing business in hard copies. All the participants had answers for SOX compliance, and all but Entopia and Liberty IMS checked in with Department of Defense 5015.2 compliance (see "Bellwether for RM: DoD 5015.2,").Each participant submitted an architecture that could scale to meet EDU's needs and work with its existing setup. The vendors use application or content servers that can scale or multiply, depending on the number of concurrent users. These systems can distribute processing load and provide failover support. For example, Hummingbird's DM servers work as a unit with failover capabilities. They also can be load balanced using round-robin or CPU-utilization strategies. In addition, each system supports a relational database, such as IBM DB2, MS SQL, Oracle or Sybase, as content repositories. These databases provide replication, caching and transaction monitoring to speed response time, reduce network traffic and provide audits.

All the vendors leverage Active Directory or an LDAP directory to set up secure authentication on the desktop or on the Web using SSL. And all use open APIs so that their setups work with other apps. Entopia's stood out with a J2EE architecture that makes it easy to fit into an IBM WebSphere or BEA WebLogic shop. It also came with a plethora of connectors to meet up with file systems, Web servers and more. Stellent gets kudos for supporting WebDAV (Web-based Distributed Authoring and Versioning) and API integration with Web services, J2EE and EJB (Enterprise Java Beans).

Vendor solutions to include DM as part of an overall SOX-compliance strategy were consistent across the board. For the most part, financial reports (Sec. 302), documents detailing internal controls (Sec. 404) and reports on material changes in financial conditions (Sec. 409) can be stored, secured and managed in a DM system. Once in the system, collaboration tools let you edit documents and set up workflows for publication approval. Audit trails show the actions taken. Finally, DM security features ensure that only users with the proper authentication can access and take actions to modify or delete a document or record (Sec. 802).

In the end, Hummingbird's Enterprise was our Editor's Choice, thanks to its mature RM component. It can include Outlook messages and attachments as records. It can manage physical documents and objects that aren't in the document repository, and it includes a strong publishing component via its partner, RedDot Solutions.

Our pricing includes the cost of the system per user per year for 5,000 EDU employees and/or management of about 25 million documents plus basic support. Most vendors offer upgrades as well as optional training.Enterprise comes with a rich set of collaboration and image-capturing tools. With RedDot, it includes an integrated component to publish Web content. Hummingbird came up short of LibertyNet's output management and security, but Enterprise edged out opponents with strong features to manage e-mail as records and handle both digital and nondigital assets, all at a moderate price.Like the other DM systems we evaluated, Enterprise manages and secures documents and folders contained in a repository. Once in the repository, documents are indexed and metadata is generated automatically or through manual intervention so they can be easily categorized, searched and retrieved.

Documents enter Enterprise repositories in two ways: Existing documents can be captured and imported, while new documents can be created using integrated applications, such as Microsoft Word and Adobe Acrobat. Captured documents include scanned images, facsimiles and e-mail. You can include physical assets that cannot be added to the repository, such as a file box, microfiche or physical piece of evidence used for litigation. These assets are represented in the repository using an electronic record and tracked using bar codes and scanners.

To get an ROI for content creation, EDU needs to make documents easily accessible to users, and this is where Enterprise shines: Once documents are in its repository, the system can publish them automatically on the Web through its partnership with RedDot. RedDot provides built-in controls for navigation and design that transform documents in the repository to the Web. This would let EDU create and edit documents in the repository and quickly make fresh content available online for employees, clients and partners.

Enterprise, along with LibertyNet and Tower Software's Trim Context, gave EDU a variety of options for interacting with the document repository. Web browsers and fat-client software for Windows and Citrix MetaFrame clients let users import documents into the repository and check them in and out for editing. When a document is checked out, it is marked as read-only for other users; when it is checked in, version control is applied to preserve earlier drafts. In addition, Enterprise has a collaboration module that supplies a set of macros for Word, Excel and PowerPoint.

Hummingbird's collaboration module supplies a secure Web environment where teams or groups can edit documents. These workspaces are comparable to those from Entopia, Stellent and Tower Software. Enterprise will let EDU organize teams of users or groups from an Active Directory or an LDAP directory and provide secure authentication via SSL. The workspaces offer discussion threads and shared task lists and calendars, and they provide document- and folder-level security. Moreover, Enterprise features "Ethical Walls," which allow anonymous or blind collaboration on projects that require discretion as to the individuals or organizations involved.Hummingbird's leadership in the RM arena was apparent. The company introduced an integrated RM component in 1999 to identify a document as a record and file it according to a predefined "file plan" for disposition and retention. The file plan is a controlled set of terms used to index and retrieve documents as business records. It includes the business logic that determines a record's life cycle and disposition. At any point in a document's existence, an authorized user can identify it as a record and assign it to the file plan. Hummingbird also makes it easy to enlist the help users in identifying and categorizing records. This RM module became our champion in identifying e-mail and their attachments as records for retention purposes.

Users can capture e-mail messages and attachments from the user interface and save them as records according to the file plan. Enterprise also can "silently" save messages sent and received by users as records. Once messages are saved in the repository, they may be removed from the mail server automatically to minimize storage overhead.

Enterprise repositories can be displayed from the Outlook user interface, and messages can be dragged to folders in the repository. Hummingbird also includes a server-based message capture for Exchange. A wizard utility on an Exchange Server establishes criteria to determine which e-mail messages and attachments should be stored, indexed and categorized as records. In the event of litigation or an investigation, retention policies for messages can be suspended to comply with official investigations or discovery requests.

Hummingbird brings a strong suite of applications for SOX compliance. Enterprise's DM and RM workflow and collaboration features would let EDU track, audit, manage and retain documents pertinent to the audit process. And with RedDot, EDU can make material changes in its financial situation immediately apparent to regulatory bodies and investors.

Standard support is 18 percent of the license cost and includes unlimited Web access support and any bug releases or upgrades during the contract, bringing our baseline cost to $330 per user. Advanced options for hands-on support range from bronze to platinum contracts. Bronze gives you the basics: standard support during business hours; unrestricted Web access support, 10 incidents and after-hours service for a fee of $250 per hour. Platinum support gives you 24/7 support, unlimited incidents and no-fee after-hours support. For training, documentation is supplied. Advanced training is available from Hummingbird Education Services at cost.Hummingbird Enterprise System 5.1, $330 per user with basic support. Hummingbird, (877) 359-4866, (416) 496-2200. www.hummingbird.com

Stellent's UCM answered our RFI with applications for Web content management, DM and collaboration. But it does not incorporate and manage e-mail messages and attachments as records automatically like Hummingbird Enterprise does. And it has a higher price.

Still, UCM lives up to its name. Although it doesn't come with a Windows client, UCM lets you import documents into the Stellent Content Server using a standard Web browser from any platform. In addition, you can submit or import documents with WebDAV applications like Explorer; ODMA (Open Document Management Application) applications, such as Word and Outlook; or using a batch loader. When documents are checked in, you can select metadata manually or it can be assigned for automatic categorization.

Like other systems we evaluated, UCM ensures that only one user at a time can check out a document for editing. When that document is checked back in, it doesn't overwrite a pre-existing document. Rather, it is assigned a new version so that changes are tracked and an audit trail can be followed. The audit trail links activities, such as create, delete, modify and circulation (check-in/out) to end users, and includes date and time stamps and identification of the user who took action. The trail can be queried by multiple criteria, such as date range, activity and user.

Like its rivals, UCM offers Web "digital workspaces" for collaboration. This gives users an environment to create, import, access and search documents by project, regardless of content type. Although it doesn't enable Ethical Walls, UCM does let authorized users create a secure workspace without an administrator. Automatic notifications can be sent by e-mail to project teams based on workspace events, such as the addition of a document or a message to a discussion forum.

Stellent's Outlook integration module would let EDU import e-mail and attachments. But unlike our Editor's Choice winner, it doesn't capture them automatically at the client or the server. Users must perform a Save As function from the Outlook menu to save the message into the repository. For EDU to retrieve e-mail and attachments from the Stellent Content Server, we'd have to use Outlook's File Open feature.Stellent supports XML to create, import and transform documents for viewing. As an alternative to submitting content in its native form, EDU would use an XML template. The content is stored in XML to populate external databases or publish to the Web. And like Hummingbird Enterprise, Stellent integrates with an XML authoring tool, Corel's XMetal, with which EDU could create XML documents and submit them directly into the system.

Stellent also makes the most of its XML integration with extensive use of XSL (Extensible Stylesheet Language). XSL can be applied to XML content, where it can be validated and made available to other XML-enabled applications or published to the Web. If the content fails the validation process, UCM generates a workflow process automatically to engage root-cause analysis. Workflow and security are facilitated by Stellent's integration with an LDAP directory.

Stellent required EDU to provide the hardware configurations of our servers. We gave EDU the standard Intel servers found in our Syracuse University Real-World Labs--Intel Pentium III, 1400-MHz with 1,024 MB of RAM--to estimate the price. Given those specs, Stellent's document management for EDU's 5,000 users would be $150 per user per year, with a 36-month commitment. At $30 per user for 12/5 support and $37.50 per user for 24/7 coverage with 36-month commitments, the monthly support options were steep, but buy software without support is asking for trouble. We took the 12/5 support for document management to come to $410 per user per year.

Stellent Universal Content Management 7.0, $410 per user, per year. Stellent, (800) 989-8774, (952) 903-2000. www.stellent.comTrim Context checked in with the largest feature set of our round-up at a modest price, but that assumes integration with Microsoft SharePoint Portal, which EDU doesn't support. Tower's integration with Outlook isn't as tight as that of Hummingbird's Enterprise, and it lags behind the vendors in its use of XML. But it displayed a strong plan to manage EDU's documents and records and, like our Editor's Choice winner, it supports both DoD 5015.2 and UK-PRO industry standards.

Like its rivals, Trim Context can manage and secure documents in any format, And like most, it can manage both electronic and physical assets not included in the document repository. Trim Context works with Active Directory and EDU's desktop applications. Although it doesn't provide extensive tools to manage document input, as LibertyNet does, it incorporates scanned images and incoming facsimiles using a drag-and-drop feature. Or you can place input in document queues or folders for automatic processing into the document repository. The same drag-and-drop functionality works to import e-mail and attachments from Outlook into the repository, but Trim Context doesn't offer automatic message import, as Hummingbird's Enterprise does.Trim Context includes workflow features to route documents for edit and approval, but it combines this with "action tracking." This feature would let EDU integrate business logic with workflow. Where most vendors supply a notification feature with their workflow, Trim Context goes beyond to link tasks and business procedures. With action tracking and workflow, Trim Context comes close to providing a project-management tool within document management.

A nifty Send To feature in the user interface would let EDU users publish and share documents easily. It will publish documents via e-mail, send document metadata to a report generator and export content to ASCII text or a tab-delimited text file.

Like Hummingbird Enterprise, Trim Context satisfies the requirements of DoD 5015.2 and UK-PRO. It creates a classification or file plan to organize documents and links retention schedules. Trim Context's unique document hold feature would allow EDU to react immediately to stop the destruction of documents and records relevant to civil litigation or a regulatory investigation.

Collaboration in Trim Context requires SharePoint 2003. Trim uses PARS (Portal Access to Records Systems) to interact with Microsoft's portal and share documents and records. From SharePoint, users can identify documents or records in the repository and check them out to Microsoft's collaborative workspaces (TeamSite), where users may schedule online meetings and discussions and collaborate on document editing. When the document is ready to be checked back into Trim Context, it receives a new version number, but while in SharePoint, users must develop their own rules for document editing and versioning (see "Microsoft Office SharePoint Portal Server 2003: Open to Improvement,").

Tower sells Trim Context through a reseller channel but supports the product directly from helpdesks in the United States, United Kingdom and Australia. Trim Context's pricing is on a per-user basis, with options for dedicated users, concurrent users or specific types of users--for example, system administrators, information workers and inquiry clients. Tower estimated that software fees would be $774,075 with an annual maintenance fee of $154,815, making its price second only to the lowest bidder, Entopia. But remember, the $154.82 per user for software and $30.96 per user for maintenance doesn't include SharePoint.Trim Context 5.2, $185.17 per user, per year, plus SharePoint cost. Tower Software Corp., (800) 255-9914, (703) 476-4203. www.towersoft.com

K-Suite (for Knowledge Suite) incorporates a panoply of DM features, leading off with strong enterprise search. Entopia was the only participant to offer a built-in expertise locator, but it came up short on conventional RM functions and couldn't track physical documents or pieces of evidence without third-party help. We did like Entopia's low price and straightforward business model.

K-Suite's knowledge- and document-management tools are supported by J2EE. This makes it easy to integrate with existing enterprise applications, such as IBM WebSphere and BEA WebLogic Server. Like other architectures, K-Suite works with an LDAP directory or Active Directory to bring users into the system quickly and set their privileges.

Entopia Quantum, a subset of K-Suite, provides DM functionality. Quantum offered EDU many ways to create documents within the system. Users can contribute documents from a fat client on a Windows PC for example, where all the usual suspects would be available, including Word, Excel and PowerPoint. Other devices, such as an OCR scanner, can capture and save physical documents in digital format so they can be imported into the document repository. Users also may access DM functions from a browser and import documents over the Web. Once in the Quantum repository, the document becomes a Q-File that can be checked in and out for editing, tracking and auditing.

Quantum's Collaborate module provides a secure space for users to share work. It enables shared folders, threaded discussion lists and tight integration with Microsoft's MSN Instant Messenger and NetMeeting. Users access shared workspaces over HTTP or SSL, where they can add text or voice notes with attachments. Workspace members receive e-mail updates when information is added to the workspace.

Like our Editor's Choice winner, K-Suite automates the capture of Outlook e-mail messages and attachments. It uses a rules-based collection procedure similar to Outlook's "create rules" feature. Users designate certain Outlook folders to receive mail automatically, according to sender, words and phrases in the subject line or body of the message.Entopia's Knowledge Builder automatically classifies documents once they are added to the repository. No training or complex rule configuration is necessary. Users can also build custom taxonomies, which, once generated, can be maintained with a "smart classification" feature. This feature suggests new classifications and identifies duplicate categories for removal. Entopia's Knowledge Locator includes a dynamic profiling system that identifies and finds experts in documents and other materials in the repository.

Entopia sells direct and through distributors. It would sell and support EDU directly with an enterprise license cost of $495,000 for 5,000 users. With an annual maintenance fee of 20 percent of the license for technical support and product upgrades ($99,000), $118.80 per user adds up to the best deal in town.

Entopia K-Suite, $118.80 per user, per year. Entopia, (866) ENTOPIA, (650) 632-0101. www.entopia.comLibertyNet 7.5 LibertyNet came up short on the collaboration functions supplied by other vendors. EDU also would have to use IBM's E-Records Manager to fully comply with DoD 5015.2 and UK-PRO. But LibertyNet offers viable options for document input and output management.

LibertyNet's input management includes image scanning and OCR/ICR engines, and Liberty was the only vendor to directly support COLD/ERM (Computer Output to Laser Disc/Electronic Report Management). LibertyNet includes a merge feature to aggregate content into the system from external clients and partners. This feature lets you collect multiple documents; select pages from within those documents; replicate an item in the system from its original location; or remove the source documents upon import. When the information is imported, you have the option to include it as a new document or append it to an existing document.

Although LibertyNet didn't natively support collaborative workspaces, it does come with a free TaskFlow module that routes documents and tasks to targeted users. The sequence of the route is controlled by a task manager that works with Windows clients and Web browsers. Users can annotate documents and keep comments confidential. With LibertyNet's rule-based processing, a manager can set notification parameters as the document moves along its route. Notifications include content, metadata and links to the document.Links to documents accessed from a Web browser can be encrypted using LibertyNet's proprietary encryption scheme. The URL is concealed from a Web client to prevent "fishing" attacks on the document store. This is true even if the system allows anonymous logins--the URL is obfuscated so you can't use the same URL and change the file name to look for another file in the same directory structure.

LibertyNet converts folders and individual documents into XML. Its XML/XSL Web server then matches the XML data with an XSL style-sheet template. The templates provide data interchange to external formats, like HMTL, to meet client-specific preferences for customization and personalization.

LibertyNet's Token Security Model provides granular security. Tokens are used to secure any object in the system, such as a document, folder, form or business rule. Specify one or more token names in a security object, such as read-only, write or delete, and assign it to the resource to be protected. No action can then be taken on the object without the respective token. In addition, LibertyNet supplies a partial SOX solution by calling on a partner, IBM's E-Records Manager, which provides LibertyNet with support for both DoD 5015.2 and UK-PRO.

VARs sell LibertyNet. There is no option for direct sales, but technical support comes directly from Liberty IMS by phone and e-mail. EDU's subscription would range from $500,000 to $550,000 for 1,000 concurrent users. With support costs estimated at 18 percent of software list, the price comes to $590 per user. That includes COLD support and 25 OCR licenses, but not the cost for the complete IBM E-Records solution.

LibertyNet 7.5, $590 per user, per year, plus E-Records. Liberty Information Management Solutions, (800) 344-0842, (714) 751-6900. www.libertyims.comA Department of Defense standard may not mean much to a vendor that doesn't sell to the government. But because Defense's 5015.2 standard requires baseline functionality for records-management software used by the department in its records-management programs, defines required system interfaces and search criteria, and specifies the minimum functionality necessary to meet National Archives and Records Administration (NARA) regulations, it can be a good barometer for basic records management your enterprise might need to satisfy laws and regulations like HIPAA and SOX.Some of the requirements of DoD 5015.2 are easily satisfied. For example, RM software should manage records, including e-mail, regardless of the storage media. It should let users define metadata fields and modify existing fields. And it must be backward-compatible with previous versions and include viewing features for the disabled. Detailed requirements for DoD 5015.2 go beyond the basics to implement a file plan, defined as a document or schema that stipulates the required metadata for all records. The plan includes ID numbers, titles and descriptions, along with the disposition and retention periods for record categories.

For the most part, file plans are implemented on folders that contain records. But in some cases they can apply to individual records. Under DoD 5015.2, only authorized individuals can create, edit or remove file-plan components and their identifiers. Only these individuals can define the retention period and apply rules or business logic to take actions on records based on time or an event. For example, some records may need read-only protection at creation, while others can be marked read/write until they are published.

Access and audit controls also are required in the DoD spec. From a high-level view, administrators set up the RM system infrastructure, while records managers are responsible for administration. The system should be able to distinguish between privileged users and others. Privileged users would have permissions, for example, to add new metadata fields as opposed to simply adding data to pre-existing fields. Audit controls should add the capability to log actions taken on accounts, records, metadata and file-plan components, with date and time stamps.

Another vital component is search capabilities. The system must be able to sort, view, save and print record folders and record lists, as well as search the full text of record repositories. The search function must access folders and records by user-access permissions and any combination of metadata. This feature is necessary for quick and efficient responses to a mandatory request from the SEC for documents pertaining to an investigation or an opponent's discovery request in litigation.Enterprise Disaster Underwriters insures clients against natural disasters, such as fires, hurricanes and floods. Formed in 1975 to cover Kansas corporations damaged in tornadoes, EDU today is listed on the New York Stock Exchange, boasts more than $10 billion in market capitalization and operates in all 50 states and the European Union. EDU maintains disaster-recovery policies for almost half of U.S. and EU Fortune 500 companies. It has branch offices in Dallas, Los Angeles, New York, San Francisco and London, with central offices in Liberty, Kan.

With Enron in their thoughts and SOX looming in the foreground, EDU's directors mandated a change in operations. To improve customer service and cover the company's assets, EDU's IT department has been tasked with helping employees manage documents and records more efficiently. The company presented this challenge in an RFI to document-management providers.EDU wants its DM system to include XML support for document generation, personalization and transformation. It also demands an integrated RM component that can identify e-mail and attachments as records and retain them in accordance with EDU's retention policy. Finally, Web browser access to both documents and records management is a must because EDU's 5,000 employees handle approximately 20,000 documents daily, using couriers, fax machines and snail mail.

To add to this complexity, all roads lead to the Liberty main office, where policies are approved and underwritten, premiums are processed and claims are paid. Moreover, physical evidence of disaster and litigation--from a broken kitchen sink to a contaminated barrel of oil--must be tracked.

Our vendors had their work cut out for them, and they came through with flying colors. See our complete RFI and vendor responses.