Cyber security and the importance of usability

There is nothing new or unusual about the need to design usable systems. A whole industry has grown up around the business of making sure that commercial websites and apps are easy to use and deliver the behaviour, such as spending money, that the owners of those websites and apps want to see.

Usable systems generally require three things: the system has to be useful, or at least perceived as useful, by the end user; the system has to be easy to use by the end user; and the system has to be persuasive so that the user to take the actions that the owner desires.

Is cyber security any different?

These three requirements of utility, usability and persuasiveness are seen in cyber security systems. However there are some differences compared with the consumer-facing world. Making sure a cyber security system succeeds is in some ways more important than making a commercial system succeed.

One issue is that the cyber security system has to work for everyone: potentially if just one person fails to use the system properly then the organisation will be put at risk.

In addition cyber security systems are like stable doors – they need to be shut when you want them to be as there is no use locking them after a breach has happened. If an online shop doesn’t work for some reason then the user can go back and try again, but with a cyber security system, if it doesn’t work first time then the damage may be done.

These are stringent requirements. Unfortunately the nature of cyber security means that these requirements are hard to meet:

  • Users have little motivation to comply with security requirements as keeping secure is not their main purpose; indeed security systems are part of a technical infrastructure that may have no real meaning or relevance to the end users
  • Security systems can “get in the way” of tasks and so can be thought of as a nuisance rather than a benefit
  • Security systems are often based on arbitrary and little understood rules set by other people, such as those found in security policies, rather than on the desires of the end user
  • Users may find complying with the requirements of security systems socially difficult as they may force the user to display distrust towards colleagues

These are all challenging issues and any security systems you design need to ask the very minimum of effort from the user if it is to overcome them.

Unfortunately many cyber security systems demand a degree of technical knowledge. For instance they may use jargon: “Do you want to encrypt this document?” will have an obvious meaning to anyone working in IT but may mean nothing to some users.

Furthermore some security requirements may of necessity require a degree of “cognitive overload”: the requirement to remember a strong password (perhaps 12 random characters) is an example. Again this will cause additional difficulty.

Users are not naturally motivated towards cyber security systems. And they may find them hard to use. So how can success – universal and efficient use of systems – be achieved?

Delivering success

Start with the end user. Ensure, through the use of a combination of interviews (including the standard “speak aloud” protocol used by many UX practitioners), observation and expert evaluation identify where the obstacles to successful use of the system are placed. Obviously the usual rules of good usability will apply: consistency, reduced cognitive overload, feedback, and help when mistakes are made.

Learnability is also important. Accept that some form of help may be needed by the user and ensure that this is available, ideally within the system. Help files shouldn’t just tell people how to achieve something but also why it is important.

But for cyber security systems there is also a lot of work to be done around persuasion. This will involve educating the end user about the importance of the system – how it protects their organisation, and how it protects them as individuals.

It will also involve ensuring that the system is credible – that end users realise that the system does what it is supposed to do and isn’t just a tick box exercise or something dreamed up by the geeks in IT to make everyone’s live that little bit harder.

And it will involve demonstrating to the end user that all their colleagues are using the system – and if they don’t use it then they will be out of line with the majority.

“Usability is not enough” is a common theme in retail website design. It is even more important in the design of cyber security systems.

 

 

 

 

 

 

 

Business processes and cyber risk

Cyber risk doesn’t just involve malicious techies hacking into corporate accounts. It can also involve risk to every day business processes: “process cyber risk”. Unfortunately, because the IT Department are kept busy defending the corporate network from the hackers, these process risks are often left to themselves.

What do I mean by process cyber risk? Quite simply, a risk of loss or damage to an organisation caused by a weak business process combined with the use of computer technology. These weak processes are often found within finance departments, but you will also find them in HR, in marketing and across organisations.

Process risk and identity

Many business processes rely on a particular document being signed off by an authorised individual. As many processes migrate online, the assumption is that the sign-off process can also be undertaken online. Sign on as an individual and perhaps you have authorisation to access a particular document or process.

As most people have to log in to company systems with a password and a name, then this shouldn’t be a problem. Except that passwords get shared. Busy people often share log-in details with juniors, allowing unauthorised people to access systems and documents that they are not authorised to access.

Any authorisation process that simply relies on someone logging in with name and password is weak because it is easily subverted. Issuing “dongles” as a second factor authentication device isn’t much better as these can get shared (unless they are integral to a company identity card). Robust processes where sensitive data or decisions are concerned should assume that a password has been shared (or stolen) and require additional security such as a second pair of eyes.

Process risks and finance departments

One big risk for finance departments is invoice fraud. This can happen in several ways. A common way is for thieves to gather information about a company, perhaps the news that it is investing in new technology. They will then use this information plus other easily obtainable assets such as company logos and the names of senior people in an organisation to put together a scam.

This might involve an email “from” a director of the organisation to a mid ranking person in the finance department asking for an invoice to be paid promptly; the invoice, which is of course a fake, is attached to the email.

In other cases the invoice is genuine. For instance thieves may pose as a supplier and ask for details of any unpaid invoices. They then resubmit a genuine invoice – but with the bank payment details changed.

All too often the unwitting finance executive passes the invoice for payment. Once the money has reached the thief’s bank account it is quickly transferred to another account making it unrecoverable.

This type of fraud is big business. Earlier this year Ubiquiti Networks disclosed that thieves stole $46.7 million in this way. While in the UK, the police’s Action Fraud service received reports of around 750 in the first half of 2015. And of course many similar frauds go unreported – or undetected.

What can you do to protect against this? Well start by educating staff about the nature of the threat – all staff not just in the finance department. Ensure that the details of all invoices are scrutinised carefully: Is the logo up-to-date? Is the email address correct (perhaps it is a .org instead of a .com)? Are the bank payment details the same as usual (if they have changed then telephone someone you know at the supplier to ask for confirmation)? And take extra care with larger invoices, for instance requiring them to be check by two separate people.

There are other cyber risks within finance processes – and often these are internal risks, initiated by employees. Examples include purchase fraud when personal items are bought using company money or when required items are bought at inflated prices, with the purchaser then getting a kick back at a later date. Again fake emails can be used to support these purchases. And again simple processes can disarm the threat.

Process risks within HR

Within HR there are numerous process risks. Let’s start with recruitment. The risks here can involve social media profiles designed to misinform, perhaps with fake endorsements or untrue job details. Looking at a LinkedIn profile is an easy way to identify potential candidates – but it is important to realise that the profile you see may well be substantially embroidered.

Another short cut, especially when looking for “knowledge leaders”, is to see what sort of “rating” candidates have on sites like Klout.com. Superficially this is fine. However, it is essential to be aware of how people are rated by the site (for instance what data is used) before making a judgement using this type of data as you may well be given an untrue perspective.

Another risk of using social media to identify candidates is that you open yourself to accusations of discrimination. An attractive cv may not have information on social media about age, ethnicity or sexual preference. Social media will. You really don’t want to know this sort of information but once you know something you can’t “unknown it”: and this can open you up to accusations of bias. It isn’t unknown for companies to commission an edited summary of a candidate’s social media profiles with anything that could lead to accusations of discrimination taken out in order to de-risk the profile before it is given to the recruiter.

In fact HR is full of cyber risk, especially where social media is concerned. There may be problems with the posts employees make on social media. There may be issues around bullying or discrimination at work. And maintaining a positive “employer brand” can be very difficult if an ex-employee starts to deride their old employer on line in sites such as Glassdoor.

Process risk and marketing

Process risk is also very at home in marketing. Again social media is one of the culprits. Not everyone, even in marketing, is a social media addict. Senior marketers frequently hand over their brands’ social media profiles to junior marketers, or even interns, because “they have a Facebook page”.

It’s a mistake. Not only is it likely that the output will be poor, the junior marketer may well (they frequently do) break advertising regulations (for instance by glamorising alcohol, or even fair trading laws (e.g. by including “spontaneous” endorsements from paid celebrities).

This shouldn’t be difficult: there is no reason that the processes that govern advertising in general can’t be applied to social media.

Procurement and cyber risk

Finally there is procurement – and the process of ensuring that third party suppliers don’t represent a cyber risk. This is a huge area of risk and one that is not always well appreciated.

The issue is not just that the third party may be insecure (for instance the massive hack to US retailer Target came about via an insecure supplier) and it is hard to know whether they are secure or not. It is also that people working for a supplier who have been given access may then leave the supplier without you being told: and as a result they retain access to your information, perhaps after they have joined a competitor. In additions suppliers may well have their own reasons for being a risk – they are in dispute with you, they are in financial difficulty, they have been taken over by a competitor…

Business processes frequently have the potential to be undermined by online technologies. It takes imagination to identify where the threats lie. However once they have been identified, actions to reduce the effect of the threat are often very simple.

Why Human Resources need to engage with cyber security

You may think that cyber security is something for your IT department to manage. If you work in Human Resources, you need to think again. Because cyber security is very much your responsibility.

No, I am not saying you need to go around seeing if your organisation has installed the latest firewall or if all your Internet of Things ports have been secured.

What you do need to do though, is to check whether your colleagues across the organisation are cyber safe.

That’s because only around one third of data breaches are caused by malicious outsiders. The rest are caused by insiders, your colleagues: acting foolishly, carelessly, and yes sometimes maliciously.

What can go wrong? A lot of things. Personal information about customers is leaked because a laptop gets left in a taxi.  An email leads to an unintentional contract variation. A social media posts leads to a libel suits. An unwary worker shares their log-in details, leading to data theft.

So what should you be doing?

Start with strategy

A good place to start is strategy. Most organisations have some understanding of cyber risk. But often they focus on protecting corporate networks from external risks such as hackers. What is your organisation’s cyber security strategy? Does it include sufficient analysis of internal “human” risks? If it doesn’t then you need to work with the Information Security team to identify and manage these human risks.

Develop practical policies

Developing appropriate policies to help manage cyber security and spell out the “rules” is important. You are likely to need policies in several areas: web and computer use, data privacy, social media use at work, a “Bring your own device” policy to manage personal phones and tablets, and even policies about the software and cloud services that people are allowed to use.

Writing these policies should not be a “tick box” exercise. They need to make sense: they should be easy to understand by everyone in the organisation; and they need to benefit your organisation. They shouldn’t simply be designed to make the IT department’s life easier. Sure, pouring digital super-glue into all the USB ports would stop people uploading corporate data to insecure USB sticks, but it might not improve business efficiency. HR executives, with a feel for wider business needs, as well as an understanding of what will motivate or demotivate employees, are an essential part of any cyber policy development process.

Training: tell people how they should behave

The next step is training. Training is essential because without it most people won’t know how to act in a cyber safe manner.

You might as well accept that almost no one is going to read your policies. So you will have to tell everybody about them, face to face. And it won’t be enough to read out a list of rules and corresponding sanctions for disobedience. Apart from putting everyone’s backs up, people will generally ignore rules if they don’t know why they are in place. You will need to explain what the rules mean, why keeping to them is important, and quite possibly when they can be ignored (and when they can’t).

You will need to train the way people think too. This isn’t just about describing dangers: it’s about how people interact safely with colleagues, with suppliers and customers, and with people outside the organisation. It’s not about following rigid processes: it’s about understanding how to avoid risk in the first place. For instance you can’t tell people the precise information to avoid sharing on social media. But you can help them understand what types of information they shouldn’t share and how competitors can draw conclusions from seemingly innocent pieces of data.

Build continued awareness

Don’t think a one-off (or even annual) training session will cut it though. You need to keep awareness of cyber safe behaviour at the front of people’s minds. This means developing assets designed to deliver continued awareness of cyber risks – posters (that change design and location regularly), screen savers, sign in messages, even mouse mats and mugs.

Develop a cyber secure culture

An even more important issue for HR to address is culture. An organisation that doesn’t take cyber security seriously is unlikely to be changed by training and awareness. HR may need to address underlying cultural assumptions.

Start by auditing the security culture. Do this from the perspective of employees: what cyber risks do they know of; what do they think of existing security processes; to what extent do they feel security is their responsibility? And do it from the perspective of the organisation: how are employees expected to behave; what sort of resources are provided for security; is dangerous behaviour stopped, tolerated – or not even noticed.

Once you know what needs to change, you can start thinking about how to do that. Build persuasion tools, such as leader boards of cyber-safe behaviour; incentivise safe behaviour with praise or other rewards – and make sure it is not disincentivised accidentally; ensure that leaders walk the cyber security walk; develop an intolerance to unsafe behaviour. (“Why are you putting my job at risk by doing that?”)

But don’t develop a blame culture. That way you will just drive unsafe behaviour underground.

Encourage people to be less trusting

Sadly, one element of culture you will need to work on is trust. People are often very trusting and this can be a problem for cyber security. They need to be taught to question: emails don’t always come from the people they appear to, friendly people on the phone aren’t always who they say they are, confident people striding round the office without a visitor’s badge don’t necessarily have the right to be there. Defending against people who take advantage of trust doesn’t need complex software: it needs awareness, sometimes combined with robust processes.

Make sure cyber security is usable

HR teams also need to work on the usability of any security processes.

By their nature most IT people are very logical. In addition they understand the purpose of systems they are developing. And of course they are focussed on their responsibility to protect IT systems.

In HR you are also focussed on cyber security. But you may have a wider view of the organisation. Almost certainly you understand what motivates people. You understand how people perform their tasks. And you probably provide a receptive ear to frustrated colleagues. In fact you are probably going to be one of the first people to hear about cyber security initiatives that are counter productive – because they cause blocks in efficiency. And you may even hear how people would like to alter them.

All this means that you are in pole position to identify usability problems, to construct the analysis that proves (to sceptical colleagues in IT) problems exist and to make the case for change.

Monitor “off network” activities

Not everything that should concern your organisation will be happening within your corporate network. You colleagues, almost inevitably, will be using social media. And many will be commenting on colleagues, clients, your organisation and your industry. In addition they may be using cloud computing services such as Drop Box and Google Docs to store, edit and share corporate information. This type of activity needs to be managed, to preserve information security and to protect reputation.

Recruit sensibly

When recruiting, watch out for people who may not be cyber secure. Anyone who comes from a competitor boasting they can bring a list of clients on a disk may well be less than trustworthy. You might also need to think twice about people whose social media posts are irresponsible – perhaps complaining about their current employers or giving information away about new initiatives.

Keep an eye on risky people

Some people will be higher risks than others. Sometimes this will be a result of personality. For instance sales people are likely to me more open, and possibly more trusting, than finance people. But that’s not where the real risk lies. The people you will need to monitor most closely are those who feel disengaged from your organisation. These may include temporary staff, new recruits during a probation period, people on low pay or in boring jobs, people who have handed their notice in, and people who are having difficulties at work, perhaps experiencing disciplinary procedures.

Yes, cyber security really is an issue for HR

Human Resources managers may not be particularly focussed on technology. But they have a responsibility to learn about cyber security because the role that HR can play in preserving security is an enormous one. In other words, if your HR and IT departments are not working closely together on cyber security you are opening your organisation up to some major and unnecessary risks.

Selling cyber security to the Board

Fact 1. Almost all businesses rely on computer technology and this reliance is increasing.

Fact 2. Last year around two thirds of British SMEs experienced a cyber attack.

Fact 3. Two thirds of SMEs don’t regard themselves at risk from cyber attacks

Why is there this big disconnect between the risks that SMEs (and in fact all organisations) face, and the way that risk is perceived? Perhaps it is something to do with the way the whole concept of cyber risk is “sold in”. So here are a few do’s and dont’s when trying to persuade senior colleagues (or clients) of the importance of cyber security.

Don’t use FUD (Fear, Uncertainty, and Doubt). Telling people that their world is about to end is likely to have one of two results: they may be so frightened that they avoid thinking about the problem at all; or they will get angry with the threat and turn that anger on you as the bearer of bad news. Either way you won’t get anywhere with them.

Do describe some of the some of the things that can go wrong, but explain that these risks can largely be managed and that there is no need to panic if they take the appropriate actions (which you can help them with). Emphasise that there are practical solutions within reach and that, while 100% security can never be attained, there is a lot that can be done to reduce risk to acceptable levels.

Don’t use the cost of cyber attacks as a motivator. For many companies the cost of the average attack is really quite small. The average cost of a major security breach at a large organisation is £1.4 million. Sounds a lot if you are a one-man plumbing band, and it might be a lot compared with your salary or your budget; but it’s nothing if you are a Board Director of a major retailer. (Note the FUD in the headline – what about the cost of minor security breaches, what about small organisations?)

Do talk about business problems and emphasise that  the real damage is likely to be to reputation, staff motivation, compliance failure, and the leakage of strategic information. Oh, and it can cost you quite a bit too.

Don’t make it all sound difficult. If you start using jargon and describing complicated technology then all you will do is convince your colleagues that you should be talking to the IT department and not them.

Do  explain that cyber security is a people problem not a technology problem. It can impact anywhere in an organisation and needs to be managed by the whole organisation and not just the IT department. After all most problems are caused by insiders – accidentally, because people trust too much, because security systems are not usable (and so don’t get used), or simply because people don’t understand the risks.

And finally make it personal. Explain how cyber unsafe behaviour can put their own possessions, and more importantly their own reputations at risks. If they appreciate that they need to act in a cyber safe manner, the chances are that they will accept that their organisation also needs to be cyber secure.

Uncovering waste in digital service delivery

Services need to be delivered efficiently if an organisation is to thrive. And digitisation can deliver many efficiencies. But it is important to ensure that as much waste as possible is stripped out of  services as they are digitised. Otherwise digitisation can simply be an excuse for avoiding hard decisions about existing wasteful processes.

“Muda” in service delivery

Ideas of “lean” production were developed in post-war Japan by companies like Toyota and helped lead to that country’s reinvention as a commercial dynamo.

Lean production involves stripping waste (muda in Japanese) out of the production process to maximise profitability. How can this powerful idea be used when considering digital transformation?

According to Shoichiro Toyoda (President of Toyota until 1999) waste is “anything other than the minimum amount of equipment, materials, parts, space, and workers’ time which are absolutely essential to add value to the product”.

Toyota identified eight “wastes” in their production process. With a little imagination these can be matched with potential wastes in service processes.

The eight wastes

1. Defective processes

Accuracy is fundamental to manufacturing and so it is to services. Defects in processes can include clerical errors in data entry (for example the wrong data being recorded) or a lack of the data necessary for a complete record.

Alternatively, defects might involve the wrong data being used to service an individual: a call centre employee might pull up records for the wrong person or when the records available to a retailer might not match the promises being delivered elsewhere in the organisation – for instance when an advert promises something but the retailer can’t offer this to someone who requests it.

2. Over-production

The most important form of over-production in service delivery is the failure to retain existing customers; this results in an expensive search for new customers. Waste here could be caused by a failure to service customers properly but is just as likely to be caused by a failure to generate loyalty through communications (for instance when offers are targeted only at new customers) or a recognition of a customer’s status as an existing customer.

Within the service itself, over-production could involve the creation of records that are not required e.g. keeping records of people who are not customers may be a waste if they are not (legitimately and ethically) used for other things. Alternatively requiring unnecessary data fields to be completed is a waste e.g. in a sales form a requirement for a telephone number in addition to an email address may be unnecessary (as well as being off-putting to the customer). This seems to be a fairly common issue in e-commerce forms where data is gathered unnecessarily “just in case” it might be useful. If unnecessary data is collected and stored then there is a data compliance issue in Europe as data rules state that data should only be held when necessary.

3. Damage during production

When you are building a car it is easy to see how damage to delicate components can happen. It is not immediately obvious how waste can be caused during the process of providing the service.

But it could be generated by someone accessing and changing customer data used in a service. For instance if someone access your file and makes changes to, adds to or deletes the data, then if this is done without any appropriate record being made the record could be damaged as it would no longer be complete.

4. The use of unnecessary physical resources or inventory

Using too much steel in a motor car is an obvious waste of resource. Keying data in twice is an example of an unnecessary use of resource in a service process. For instance if a salesperson takes down the details of a prospect on a paper form and then those details need to be transposed to an online system there is an obvious waste, as well as an increased risk of inaccuracy when transposition errors occur.

Waste is a big problem in any service where the service provider isn’t using their own money to provide the service. The bloated management seen in many public service organisations is a manifestation of this.

Examples include the use of unnecessary equipment such as expensive tablet computers bought for reasons of fashion rather than function, or decisions made about unnecessary software, or software upgrades, that cause unnecessary expenditure. Note that the use of unnecessary software could also act as a cyber risk by expanding the “risk surface” of the organisation while the use of non-standard computing equipment could have a similar effect: another reason for rooting out this type of waste.

Another important resource is information. Making it unnecessarily hard to find information could be very wasteful: knowledge workers have been estimated to spend up to 20% of their time looking for information. Thinking of ways to reduce this – better file structures, efficient desktop search engines, more effective knowledge management, even a library of books – could reduce this waste considerably as well as making employees feel better about their jobs.

Related to this is the waste associated with unnecessary work – such as emails where people are “copied in” for no reason and unnecessary “meetings about meetings”, or meetings where everyone is given a chance to speak even if they have nothing to say! (Holding meetings standing up is a good way of speeding them up.) The creation of long meeting minutes rather than brief outlines of decisions made is often wasteful. Compulsory training can also be wasteful – where it is provided to people who don’t need it, perhaps because training plans are not granular enough and fail to distinguish between different types of worker.

Office costs may also be very wasteful – heating and lighting left on in empty rooms,unnecessary use of printer ink and paper etc; these can add substantially to the cost of delivering services. Comfortable working conditions are of course important for maintaining staff morale and staff efficiency but where some parts of an organisation are seen as getting special treatment this can cause resentment.

5. Unnecessary transportation costs

Generally services are not “transported”, unlike motor cars. However the people who deliver them are: wasteful costs here therefore could involve unnecessary offices that are physically near to consumers when the service could as well be delivered remotely. This can be part of the case for digitising processes: for instance a customer consultation or an internal meeting held over Skype might be far more time efficient than a face to face meeting.

There could also be “transportation” wastes caused by the inability for people to access records remotely once they are created,  requiring people to visit a separate location to access the information they require or download data to a  system. I have seen this caused by inefficient (i.e. over secure) security protocols that allow people to log on to a system from one work location but not from another.

6. Unnecessary time taken

If parts of a service takes an unnecessarily long time to deliver it can mean other people involved in the service wasting their time as they wait. It can also mean the customer waiting for something to be ready for them – and waiting will reduce their loyalty.

Time waste can be caused by inefficient “critical paths” where actions dependent on other actions are not ordered as well as they could be. In addition unnecessary processes such as the duplication of data entry can cause delays in the delivery of services. A large numbers of versions of a “version controlled” document could indicate inefficiency in the way that document is handled.

One technique to uncover unnecessarily complex processes is “process mining” where the relationships between different parts of a process are mapped out and any loops or repeated steps can be identified.

7. Unnecessarily high quality of components

We want our motor cars to contain components of the appropriate quality. For instance some European motor manufacturers experienced quality problems when they decided to save money on components during the economic downturn.

In service processes, of course consumers want an appropriate quality of customer service. But if the delivery of customer service elements don’t actually generate extra sales or loyalty then they are wasteful. For instance interactions with call centres by customers who have queries about a product they have bought may be seriously wasteful compared with creating a good FAQ online.

Timing is also important here: asking a customer at a restaurant “is everything satisfactory” may well show appropriate customer care when it happens just after they have been served; but asking the same on the way out after they have paid (rather than just saying “goodbye”) could be considered wasteful and indeed unnecessarily risky.

8. Failure to use staff skills

Where the wrong people are doing the wrong jobs, e.g. where professionals are doing admin jobs, there is a clear waste of talent and resource. This can happen if tasks are not allocated properly or if weak management allows people who should be undertaking routine tasks for more qualified colleagues to “delegate upwards”.

Even if professionally qualified people are employed at a cheaper rate because they have been employed to perform a routine task, you can argue that this may be wasteful for an organisation because they are likely to be bored and less efficient – unless they know they are being trained up to do a harder job in the future.

Finding the bottlenecks

Waste can occur anywhere in a service process. However some waste is worse than other waste. In particular, when the waste is happening in a part of the process that is already struggling to perform effectively then this waste needs to be prioritised.

Most processes are as strong – or as efficient as their weakest (or most inefficient) part. Therefore it is sensible to locate any bottlenecks that are reducing service efficiency or extending delivery times and start identifying waste there.

Let’s take a process that is required to deliver a service in a particular time – say the delivery of groceries in a particular time slot. There may be waste in several areas – receiving the order, picking and packing, loading the van, getting to the customer. But if there is a resource problem around loading the van that is effecting the ability to meet promised delivery times, solving a resource issue in the picking and packing area won’t solve the problem of late delivery.

Waste and the digitising of processes

Digitisation does not in itself guarantee efficiency. Any project to digitise a business process needs to identify waste in the process and then consider ways that digitising the process could reduce that waste. It is important to avoid digitisation that merely makes processes more complex – for instance paper is an excellent interface and in some circumstances (e.g. where data doesn’t need to be shared or stored for any length of time)  can be an excellent part of a process.

In addition it is important to consider any risks  (especially around security and data compliance) that might arise as a result of digitising a process. If these risks outweigh the advantages of the digitisation, and are not capable of being reduced, then the case for digitisation is also reduced.