20
Thu, Jun
3 New Articles

The Dilemma of Email Retention Policies

Compliance / Privacy
Typography
  • Smaller Small Medium Big Bigger
  • Default Helvetica Segoe Georgia Times

Outside of certain highly regulated industries, the majority of companies today are not email-compliance-ready and do not necessarily see the benefit of being so. Unless regulations or previous litigation episodes force action to be taken, the need and associated dollars to act are driven by a new and, most likely, unanticipated event. Response to this event is, inevitably, a reactive and chaotic approach.

Email Archiving Is Not the End Game

Further, many of those organizations that are today focusing on email archiving see it as a panacea of protection. But archiving can only ever be a defensive position and is really only the tip of the iceberg. By the time an incident gets you to the point of needing to undertake a legal discovery request for which you are implementing an email archiving solution, in many respects you have already lost the battle—in cost, in time, in use of resources.

Whether discovery responses are a routine activity or an unplanned, chaotic episode is entirely up to you. What can you do proactively to mitigate this chaos? In addition to implementing an email archiving solution, consider taking the following steps:

  • Define consistent, defendable acceptable-use policies to prevent future infractions.
  • Implement a measurable process for distribution and user understanding of acceptable-use policies.
  • Implement an email classification process to allow users to determine what does and doesn't get kept.
  • Legal discovery is inevitable. Plan for it by setting achievable service-level goals for retrieval and analysis of respondent email.

Building a Workable System

With these thoughts in mind, you can now focus on the areas to consider when implementing a broader solution to protect the organization. Whereas we cannot define the rules that are specific to you, we can provide a checklist of the areas that other companies have considered in implementing a workable solution.

Define Acceptable-Use Behavior

One of the biggest challenges is in implementing a policy that is understandable and that will work within your corporate culture. The goal is to educate the user as to what is acceptable behavior and what the implications are of poor behavior

Of course, there is always some risk of malicious intent by an employee, and neither your solution nor your policy can help you there. An employee who wants to will always find a way to get around any existing recording mechanism you have—via a phone call, a USB drive, an FTP upload, etc.

Implement a Process to Distribute Acceptable-Use Policies

Company policies that are outdated, misunderstood, or simply ignored can cause expensive compliance liabilities. An auditable distribution process for the acceptable-use policy will assist you in demonstrating due diligence. Here are some questions to consider:

  • How often will you distribute your email acceptable-use policy?
  • What commitment do you require from your users that they have read the policy and that they understand the consequences for infraction?
  • What level of confidence do you have that your now-educated employees will fulfill their obligations of the acceptable-use policy?
  • How will you deal with infractions?
  • How will you demonstrate that you are monitoring and measuring compliance, understanding, and possible policy infractions?

Implement a Document Classification Process

With an email archiving system, determining what to keep and what not to keep can be a big challenge. In the first implementations of email archiving, many organizations elect to retain all email, regardless of context or business-relevance. This approach, unfortunately, will increase the size of the archive files significantly, adding to issues of data storage, speed of retrieval, and quality of retrieval. To help overcome this problem, many archiving solutions have the ability to programmatically filter where and whether email should be captured. There is some advantage in being able to collect only email that is relevant to business records and discard the remainder. However, this method is prone to missing important email or capturing irrelevant email that appears to be pertinent because of the presence of a particular word. An emerging technology in the area of email classification helps to address this shortfall. It allows the user at the time of sending the message to determine whether and where email should be stored for future reference purposes.

A solid classification system, placed in the hands of knowledgeable users, develops an effective check on email usage. The email authors are the subject-matter experts with the most useful insights into the context of the material they are writing. Enforced classification at the desktop serves to ensure that users consider the implications of sending sensitive information through the email system and double-checks that recipients are authorized to receive this content. It also helps to ensure that emails archived for regulatory or business intelligence purposes are categorized in an effective knowledge management and retrieval schema.

Set Achievable Retrieval Service-Level Goals

Email capture is only the start. The real challenge is in retrieving and then analyzing the relevance of the respondent emails in a timely manner to meet an e-discovery request. Consider these questions when defining a service level for retrieval:

  • Who will be able to access the captured messages? The email administrator?
    The legal or HR departments? The users?
  • What types of search criteria will be used to query the archive?
  • What information will you require regarding discussion threads and communication flows between users as part of the search?
  • How will you determine relevance of targeted emails?
  • What is your target turnaround time to retrieve messages after the request has been made?
  • What is your target turnaround time to analyze the respondent messages for compliance?

Will Your Company Be Ready?

With proper planning, your company can be email-compliance-ready when it needs to be. The steps outlined here, will help to prevent your first legal discovery request from resulting in panic and chaos.

Clive Horton is CEO of ReSoft International LLC (www.re-soft.com), based in New Canaan, Connecticut. ReSoft has, for over 11 years, acted as a trusted advisor to hundreds of organizations, applying the relevant technologies and techniques from its broad set of email and IM security tools to reduce liability risks and save time. ReSoft has gained significant experience in providing professional services and solutions that have helped many organizations define and implement policy-based archiving and discovery systems across industries and organizations of all sizes.


BLOG COMMENTS POWERED BY DISQUS

LATEST COMMENTS

Support MC Press Online

$0.00 Raised:
$

Book Reviews

Resource Center

  • SB Profound WC 5536 Have you been wondering about Node.js? Our free Node.js Webinar Series takes you from total beginner to creating a fully-functional IBM i Node.js business application. You can find Part 1 here. In Part 2 of our free Node.js Webinar Series, Brian May teaches you the different tooling options available for writing code, debugging, and using Git for version control. Brian will briefly discuss the different tools available, and demonstrate his preferred setup for Node development on IBM i or any platform. Attend this webinar to learn:

  • SB Profound WP 5539More than ever, there is a demand for IT to deliver innovation. Your IBM i has been an essential part of your business operations for years. However, your organization may struggle to maintain the current system and implement new projects. The thousands of customers we've worked with and surveyed state that expectations regarding the digital footprint and vision of the company are not aligned with the current IT environment.

  • SB HelpSystems ROBOT Generic IBM announced the E1080 servers using the latest Power10 processor in September 2021. The most powerful processor from IBM to date, Power10 is designed to handle the demands of doing business in today’s high-tech atmosphere, including running cloud applications, supporting big data, and managing AI workloads. But what does Power10 mean for your data center? In this recorded webinar, IBMers Dan Sundt and Dylan Boday join IBM Power Champion Tom Huntington for a discussion on why Power10 technology is the right strategic investment if you run IBM i, AIX, or Linux. In this action-packed hour, Tom will share trends from the IBM i and AIX user communities while Dan and Dylan dive into the tech specs for key hardware, including:

  • Magic MarkTRY the one package that solves all your document design and printing challenges on all your platforms. Produce bar code labels, electronic forms, ad hoc reports, and RFID tags – without programming! MarkMagic is the only document design and print solution that combines report writing, WYSIWYG label and forms design, and conditional printing in one integrated product. Make sure your data survives when catastrophe hits. Request your trial now!  Request Now.

  • SB HelpSystems ROBOT GenericForms of ransomware has been around for over 30 years, and with more and more organizations suffering attacks each year, it continues to endure. What has made ransomware such a durable threat and what is the best way to combat it? In order to prevent ransomware, organizations must first understand how it works.

  • SB HelpSystems ROBOT GenericIT security is a top priority for businesses around the world, but most IBM i pros don’t know where to begin—and most cybersecurity experts don’t know IBM i. In this session, Robin Tatam explores the business impact of lax IBM i security, the top vulnerabilities putting IBM i at risk, and the steps you can take to protect your organization. If you’re looking to avoid unexpected downtime or corrupted data, you don’t want to miss this session.

  • SB HelpSystems ROBOT GenericCan you trust all of your users all of the time? A typical end user receives 16 malicious emails each month, but only 17 percent of these phishing campaigns are reported to IT. Once an attack is underway, most organizations won’t discover the breach until six months later. A staggering amount of damage can occur in that time. Despite these risks, 93 percent of organizations are leaving their IBM i systems vulnerable to cybercrime. In this on-demand webinar, IBM i security experts Robin Tatam and Sandi Moore will reveal:

  • FORTRA Disaster protection is vital to every business. Yet, it often consists of patched together procedures that are prone to error. From automatic backups to data encryption to media management, Robot automates the routine (yet often complex) tasks of iSeries backup and recovery, saving you time and money and making the process safer and more reliable. Automate your backups with the Robot Backup and Recovery Solution. Key features include:

  • FORTRAManaging messages on your IBM i can be more than a full-time job if you have to do it manually. Messages need a response and resources must be monitored—often over multiple systems and across platforms. How can you be sure you won’t miss important system events? Automate your message center with the Robot Message Management Solution. Key features include:

  • FORTRAThe thought of printing, distributing, and storing iSeries reports manually may reduce you to tears. Paper and labor costs associated with report generation can spiral out of control. Mountains of paper threaten to swamp your files. Robot automates report bursting, distribution, bundling, and archiving, and offers secure, selective online report viewing. Manage your reports with the Robot Report Management Solution. Key features include:

  • FORTRAFor over 30 years, Robot has been a leader in systems management for IBM i. With batch job creation and scheduling at its core, the Robot Job Scheduling Solution reduces the opportunity for human error and helps you maintain service levels, automating even the biggest, most complex runbooks. Manage your job schedule with the Robot Job Scheduling Solution. Key features include:

  • LANSA Business users want new applications now. Market and regulatory pressures require faster application updates and delivery into production. Your IBM i developers may be approaching retirement, and you see no sure way to fill their positions with experienced developers. In addition, you may be caught between maintaining your existing applications and the uncertainty of moving to something new.

  • LANSAWhen it comes to creating your business applications, there are hundreds of coding platforms and programming languages to choose from. These options range from very complex traditional programming languages to Low-Code platforms where sometimes no traditional coding experience is needed. Download our whitepaper, The Power of Writing Code in a Low-Code Solution, and:

  • LANSASupply Chain is becoming increasingly complex and unpredictable. From raw materials for manufacturing to food supply chains, the journey from source to production to delivery to consumers is marred with inefficiencies, manual processes, shortages, recalls, counterfeits, and scandals. In this webinar, we discuss how:

  • The MC Resource Centers bring you the widest selection of white papers, trial software, and on-demand webcasts for you to choose from. >> Review the list of White Papers, Trial Software or On-Demand Webcast at the MC Press Resource Center. >> Add the items to yru Cart and complet he checkout process and submit

  • Profound Logic Have you been wondering about Node.js? Our free Node.js Webinar Series takes you from total beginner to creating a fully-functional IBM i Node.js business application.

  • SB Profound WC 5536Join us for this hour-long webcast that will explore:

  • Fortra IT managers hoping to find new IBM i talent are discovering that the pool of experienced RPG programmers and operators or administrators with intimate knowledge of the operating system and the applications that run on it is small. This begs the question: How will you manage the platform that supports such a big part of your business? This guide offers strategies and software suggestions to help you plan IT staffing and resources and smooth the transition after your AS/400 talent retires. Read on to learn: