Outside of certain highly regulated industries, the majority of companies today are not email-compliance-ready and do not necessarily see the benefit of being so. Unless regulations or previous litigation episodes force action to be taken, the need and associated dollars to act are driven by a new and, most likely, unanticipated event. Response to this event is, inevitably, a reactive and chaotic approach.

Email Archiving Is Not the End Game

Further, many of those organizations that are today focusing on email archiving see it as a panacea of protection. But archiving can only ever be a defensive position and is really only the tip of the iceberg. By the time an incident gets you to the point of needing to undertake a legal discovery request for which you are implementing an email archiving solution, in many respects you have already lost the battle—in cost, in time, in use of resources.

Whether discovery responses are a routine activity or an unplanned, chaotic episode is entirely up to you. What can you do proactively to mitigate this chaos? In addition to implementing an email archiving solution, consider taking the following steps:

• Define consistent, defendable acceptable-use policies to prevent future infractions.
• Implement a measurable process for distribution and user understanding of acceptable-use policies.
• Implement an email classification process to allow users to determine what does and doesn't get kept.
• Legal discovery is inevitable. Plan for it by setting achievable service-level goals for retrieval and analysis of respondent email.

Building a Workable System

With these thoughts in mind, you can now focus on the areas to consider when implementing a broader solution to protect the organization. Whereas we cannot define the rules that are specific to you, we can provide a checklist of the areas that other companies have considered in implementing a workable solution.

Define Acceptable-Use Behavior

One of the biggest challenges is in implementing a policy that is understandable and that will work within your corporate culture. The goal is to educate the user as to what is acceptable behavior and what the implications are of poor behavior

Of course, there is always some risk of malicious intent by an employee, and neither your solution nor your policy can help you there. An employee who wants to will always find a way to get around any existing recording mechanism you have—via a phone call, a USB drive, an FTP upload, etc.

Implement a Process to Distribute Acceptable-Use Policies

Company policies that are outdated, misunderstood, or simply ignored can cause expensive compliance liabilities. An auditable distribution process for the acceptable-use policy will assist you in demonstrating due diligence. Here are some questions to consider:

• How often will you distribute your email acceptable-use policy?
• What commitment do you require from your users that they have read the policy and that they understand the consequences for infraction?
• What level of confidence do you have that your now-educated employees will fulfill their obligations of the acceptable-use policy?
• How will you deal with infractions?
• How will you demonstrate that you are monitoring and measuring compliance, understanding, and possible policy infractions?

Implement a Document Classification Process

With an email archiving system, determining what to keep and what not to keep can be a big challenge. In the first implementations of email archiving, many organizations elect to retain all email, regardless of context or business-relevance. This approach, unfortunately, will increase the size of the archive files significantly, adding to issues of data storage, speed of retrieval, and quality of retrieval. To help overcome this problem, many archiving solutions have the ability to programmatically filter where and whether email should be captured. There is some advantage in being able to collect only email that is relevant to business records and discard the remainder. However, this method is prone to missing important email or capturing irrelevant email that appears to be pertinent because of the presence of a particular word. An emerging technology in the area of email classification helps to address this shortfall. It allows the user at the time of sending the message to determine whether and where email should be stored for future reference purposes.

A solid classification system, placed in the hands of knowledgeable users, develops an effective check on email usage. The email authors are the subject-matter experts with the most useful insights into the context of the material they are writing. Enforced classification at the desktop serves to ensure that users consider the implications of sending sensitive information through the email system and double-checks that recipients are authorized to receive this content. It also helps to ensure that emails archived for regulatory or business intelligence purposes are categorized in an effective knowledge management and retrieval schema.

Set Achievable Retrieval Service-Level Goals

Email capture is only the start. The real challenge is in retrieving and then analyzing the relevance of the respondent emails in a timely manner to meet an e-discovery request. Consider these questions when defining a service level for retrieval:

• Who will be able to access the captured messages? The email administrator?
  The legal or HR departments? The users?
• What types of search criteria will be used to query the archive?
• What information will you require regarding discussion threads and communication flows between users as part of the search?
• How will you determine relevance of targeted emails?
• What is your target turnaround time to retrieve messages after the request has been made?
• What is your target turnaround time to analyze the respondent messages for compliance?

Will Your Company Be Ready?

With proper planning, your company can be email-compliance-ready when it needs to be. The steps outlined here, will help to prevent your first legal discovery request from resulting in panic and chaos.

Clive Horton is CEO of ReSoft International LLC (www.re-soft.com), based in New Canaan, Connecticut. ReSoft has, for over 11 years, acted as a trusted advisor to hundreds of organizations, applying the relevant technologies and techniques from its broad set of email and IM security tools to reduce liability risks and save time. ReSoft has gained significant experience in providing professional services and solutions that have helped many organizations define and implement policy-based archiving and discovery systems across industries and organizations of all sizes.

Also Read

Data Privacy Rules Around the World

Data Security: 8 Privacy Principles Every IT Pro Should Know

Why the IBM i Community Needs to Pay Attention to GDPR