|E-mail archiving applications|
There are more than 30 software tools on the market that enable organizations to manage archived e-mail messages. Finding a product is less of an issue than choosing the right one for your company. High on any e-mail features checklist should be ease of use, comprehensiveness, TCO, scalability, and indexing and search functions.
|What regulators look for|
The next step is to identify the product features your company needs. Key product features include the ability to:
- Set policies and rules to manage the archival and retrieval of e-mail messages.
- Search and classify the content of e-mail messages, including attachments.
- Minimize the e-mail archiving tool's impact on the e-mail server's performance.
- Manage disparate e-mail archive stores, such as on PCs or laptops.
- Produce reports that track capacity growth and satisfy auditors' requests.
Policies that comply
Critical to any e-mail archiving package is its ability to set policies and procedures that meet business and government requirements. Products such as Veritas Software Corp.'s Enterprise Vault (acquired from KVS Inc.) and iLumin Software Services' Assentor Enterprise Suite have wizards to get them up and running quickly.
Mary Kay Roberto, senior vice president and general manager, North America KVS, a business unit of Veritas, notes that Enterprise Vault doesn't offer its users the option to choose a wizard that, if selected, would allow the organization to declare itself compliant with a specific regulation. Rather, users are urged to interpret how specific regulations apply to them and then set policies accordingly. She suggests organizations set up an internal compliance committee to determine what policies should be put into place. She further recommends companies work with an outside counsel specifically trained to set up e-mail rules for their industry. Navigating the regulatory shoals is complicated and expensive because courts interpret and apply existing laws and rules differently. Users may also need to use a specialized appliance to satisfy their e-mail archiving requirements (see E-mail archiving accessories).
For more mature regulations, it's easier to apply specific retention policies to archived e-mail messages. For example, HIPAA regulations are reasonably well defined, but other regulations are not so clear-cut. One e-mail archiving company spokesman has even called Sarbanes-Oxley "a slippery devil" (see "What regulators look for", this page).
It may be tempting to set a policy to delete all e-mail messages after 60 or 90 days, believing the problem solved. Michael Casey, vice president of data policy and ILM services at Contoural, advises clients not to bet on that option. Casey says courts care little about the difficulty and cost of discovery. And if the company policy is to delete all e-mails after a certain time, users will stash the e-mails they want to keep on CDs, local disk drives, USB flash drives, floppy diskettes and even print copies tucked away in file drawers.
The legal murkiness surrounding what to archive, coupled with the potentially unpleasant consequences of deleting everything, push many storage admins toward keeping it all. That's the approach John Hegner, vice president of technology services at Liberty Medical Supply, Port St. Lucie, FL, took. While the firm has content filters to block e-mails, Liberty's Exchange server with its 1,000 mailboxes still processes approximately 50,000 e-mails a day that must be archived.
Michael Sherwood, CIO for the City of Oceanside, CA, archives every e-mail message in a central location, but had a different problem. Oceanside, like many state, city and county government agencies, falls under the Freedom of Information Act. A component of this law allows citizens to request a copy of any sent or received e-mail for the past two years, so all e-mails must be available to be searched and retrieved.
Keeping all of these e-mails creates its own set of problems. While Sherwood has filters to catch spam containing pornography or vulgar language, he finds spammers getting more innovative in their e-mail text and subject lines. As a result, more objectionable spam bypasses his filters and ends up getting archived.
This was first published in February 2005