Simple Steps to Compliance: Archiving Electronic Messages for Competitive Advantage

Jul 20
07:15

2010

kieron dowling

kieron dowling

  • Share this article on Facebook
  • Share this article on Twitter
  • Share this article on Linkedin

The way people communicate with each other in both personal and business contexts has changed dramatically in a few short decades. In today’s virtual, paperless world, massive quantities of information can be transmitted in seconds from one location to another, anywhere in the world.

mediaimage
The way people communicate with each other in both personal and business contexts has changed dramatically in a few short decades. In today’s virtual,Simple Steps to Compliance: Archiving Electronic Messages for Competitive Advantage Articles paperless world, massive quantities of information can be transmitted in seconds from one location to another, anywhere in the world.As companies adopt and benefit from messaging technologies, they also struggle to define the parameters for their appropriate use. Forcing the issue are governing bodies and regulators in all industries, who have imposed strict requirements on the storage and management of messaging data in response to groundbreaking lawsuits in recent years.Organizations of all sizes are now realizing that a corporate email archive is no longer a luxury, but a necessity in today’s regulatory environment. What may seem an overwhelming prospect, however, should also be viewed as a key tool in creating a company’s strategic advantage. More, email archiving need not be daunting. Incredible growth in this market has led to easy and affordable archiving options for companies of all sizes.The Exploding MarketBy 2011, the market for email archiving solutions will increase nearly 10-fold to almost $6.1 billion, up from $796 million in 2006, according to independent market research firm The Radicati Group. North America and Europe will be the largest markets, accounting for 60 percent and 32 percent of global sales, respectively. What’s driving this demand? The three trends below.Worldwide explosion in email and instant messaging (IM) usage.  The average corporate email user sends and receives a total of 133 messages per day, one-quarter of which are sent with attachments. Enterprise IM adoption is also heating up. As demand grows, major platforms including IBM Lotus Sametime and Microsoft LCS/OCS are making IM a key component of their unified communications strategies.The increasing storage requirements of corporate email users. As more graphics-rich forms and documents are sent as email attachments, average email message sizes are rapidly rising. In 2006, the average corporate email user sent and received roughly 16.4 MB of data per day. By 2010, that figure is expected to exceed 21.4 MB.Regulatory compliance requirements. An increasingly litigious environment surrounding the use and storage of email and other messaging data has affected companies in virtually all industries. Federal rules obligate companies to produce electronic evidence. Companies that can not save, find, and share their emails risk losing their credibility in court. Analyst firm AMR Research estimates that by 2010, compliance spending in North America will exceed $80 billion, which may be characterized as a hidden tax on profits.Challenges Facing OrganizationsCompanies large and small face a number of common challenges when it comes to their messaging systems, including:The need to comply. Government and industry regulations are very specific about their compliance requirements. In addition to industry requirements, some companies implement their own messaging retention policies. Others don’t. A survey by the American Management Association and The E-Policy Institute reveals that 66 percent of companies lack policies for saving, purging and managing email. The need for all users to quickly access and manage corporate information. The sheer volume of electronic messaging is overwhelming users, rapidly turning email into a productivity issue for many companies. In fact, an Osterman Research survey found that 46 percent of email users spend more than two hours each day doing something in their email inbox. The need to store increasing quantities of data without affecting system performance. As the size of the average user’s email box continues to rapidly swell, organizations spend more time restoring crashed servers and managing mailboxes (often deleting useful information) to meet required quotas.Why Archive Electronic Messages?An email archive, in a nutshell, is a system that automatically obtains messages, attachments, and information about the messages from email servers. It then indexes and automatically stores that information in read-only format for a specified length of time, based on the company’s or industry’s retention policy. Email and IM content stored in the archive remains accessible to the user without placing an unnecessary load on the email server. An archive also enables companies to define policies, search for messages, and maintain an audit trail of who accessed a message and when. A company creates an archive of its email and IM data for four key reasons.Compliance. Organizations in virtually all industries – from financial services to health care, government and beyond – are now subject to some level of regulation concerning the storage and management of their electronic data. The Federal Rules of Civil Procedure, Sarbanes-Oxley, the U.S. Patriot Act, HIPAA, SEC rules, state laws, and corporate policies are all part of this dynamic regulatory environment. Email storage capacity and management. Companies frequently limit the size of each user’s mailbox to optimize email server performance. This forces users to spend time cleaning out their mailboxes, which reduces their productivity. Allowing larger mailboxes, however, can severely affect the efficiency of the email server. E-discovery. A nightly backup of a company’s computer data is not the same as an archive. One of the main differences is that to comply with most regulations, email messages, their attachments and IMs must be stored in their original formats, and no one should have the ability to alter their content or delete them altogether. Unlike a backup, which is usually made at the end of each day and designed to restore email servers after a problem, the archive is created at the front end, before a message reaches the end user’s computer, and stored in a non-rewriteable format.An archive is also fully searchable, greatly simplifying the e-discovery process. For example, if Company X sues Company Y, lawyers typically review all emails related to the case. With no email archive, discovery can take months of billable hours by a team of lawyers and IT professionals. In contrast, the process can literally take minutes via keyword search of an email archive.Corporate intelligence. As much as 75 percent of a company’s intellectual property is housed within its messaging system. More, users often refer to old email when composing new email. An archive offers a company access to a rich repository of corporate knowledge through an easy-to-use search interface.In-house Archive AdvantagesTo create an email archive, companies have two basic options. With an in-house email archive, the company buys and manages the solution on its own. With an outsourced solution, the company’s email is stored and managed offsite by a third-party vendor.The exploding email archiving market has been flooded with vendors and archiving solutions. Choosing an archiving solution can be overwhelming, particularly for companies with no email usage policy in place yet feeling pressured by growing industry regulations and the threat of litigation. That said, there are a number of compelling reasons to establish an in-house archiving solution: Simplicity. Depending on the chosen solution, an in-house archiving appliance can take up no more space than an average router and can be up and running in a matter of hours. Even in IT departments with a team of one, managing the appliance is relatively simple, and requires little or no IT experience. Initial setup is typically completed with the appliance vendor or integration partner. Security. Given the highly confidential nature of many email communications and file attachments, company leaders are often uncomfortable having their data housed off-site by a third party – especially as email archiving is currently an unregulated industry.The concern is shared by regulators, including the National Association of Securities Dealers (NASD), which has said in a Member Notice, “outsourcing an activity or function to a third party does not relieve members of their ultimate responsibility for compliance...” In other words, the buck stops with the end-user organization. Reliability. With an outsourced solution, server performance can be compromised during high-volume periods as messages must share the same bandwidth, whether they’re being sent, received, or archived. In contrast, an in-house archive captures copies of all incoming and outgoing messages after or before they make contact with the outside world, with no impact on a company’s bandwidth or server performance. Cost-effectiveness. For smaller companies, the appeal of an outsourced solution may be its apparent cheaper price tag. Over time, however, the cost analysis favors in-house solutions. For example, a 100-person company might pay $10,000 for an in-house archiving appliance. The company handles ongoing management of the archive, so it pays no recurring costs. The same company might pay $3,500 per month for an outsourced solution (100 seats x $35 per seat – the current mid-range cost of an outsourced archive), and those costs would recur each month the company chooses to archive its email. In-house Archiving in ActionAn in-house archiving appliance can be set up in a matter of hours, and completely integrated into a company’s existing email interface. Here’s how the archiving appliance works with the company’s email solution: 1. Once an incoming message/file has passed through the company’s firewall and spam filters, it moves to the router.2. If the email system is managed in-house (e.g., Microsoft Exchange, Lotus Notes or another networked system), the archiving appliance captures every message and its attachments (a process called “journaling”).3. If the email platform is hosted by a third-party provider or is a less-common, proprietary email system, the archiving appliance captures a copy of all messaging traffic as it passes through the switch or router (a process called “sniffing”).4. Users can then access their email archives and perform basic or advanced searches through their email program.The company’s compliance officer – often the IT person in smaller companies – also needs little IT training to define the rules by which messaging traffic will be monitored and captured. Those rules can be dictated by the compliance requirements governing the company’s industry, by the company’s own email policy, or both. Changes can be made at any time via drop-down menus.Overcoming Archiving InertiaThe threat of non-compliance lawsuits or system crashes due to storage capacity shortfalls motivate many companies to archive their email. However, smart companies also understand that email is a growing repository of organizational intelligence, one that can be mined for a better understanding of the company, its customers, and its opportunities for growth and improvement. Even in the absence of a formal email management and retention policy, a company should begin archiving today. A good in-house archive can be easily adapted as a corporate policy develops. The worst thing to do is nothing – and with a few simple steps, companies can not only ensure their future compliance, but also gain significant strategic advantage.Sidebar: Email/ IM Policy PointersYours may be one of the many companies that has yet to establish its policy for email and IM use and retention. The tips below offer guidance toward that end. * DON’T make it an IT project. Your policy for how email and IM will be used and retained by your company should be developed with input from across the organization. Give IT, legal, HR, compliance, customer relations, and administrative departments a seat at the policy planning table – and make sure international divisions of the company have a voice, too.* DO create two policies: One for retention of emails and IMs, and another for company-wide usage of email and IM. These will be separate policies, but it’s important that they’re developed side by side. Both should be reviewed and updated annually.* DO communicate your usage policy with all employees, not just through email, but through face-to-face training and discussion in department meetings. Be specific and detailed. It’s important that everyone in the company understand both appropriate and inappropriate use of email and IM, and that violating usage guidelines is a punishable offence. Employees should also know that copies of everything they send are being archived. This knowledge alone often results in fewer instances of inappropriate messaging.* DON’T delay archiving in the absence of a retention policy. Ideally, the policy comes first and dictates the parameters of the archive setup. But for many companies, a policy can take months to develop and gain consensus – and most aren’t willing to risk a damaging noncompliance situation or costly e-discovery process in the meantime. A flexible in-house archiving solution can easily be adapted as policy takes shape.