WIXLIB

INSIDESearchExchange.comemail archivingPlanning, policies and product selectionCHAPTER 2Defining anemail-archivingImplement andenforce howusers manageand retaintheir electronicmessages witha comprehensivepolicy onemail archivingpolicy 03 What is thepurpose of anemail-archivingpolicy? 04 What qualifiesas acceptableuse? 07 Emailmanagementand retention 09 Staff roles andresponsibilities

chapter 2 Defining an email-archiving policychapter 2Defining an email-archiving policyQby Kathryn Hiltonuestionable email deletions continue to grab headlines as well as the attention of courts and litigators.Because of the uncertainty that still surrounds the useof email, it’s absolutely necessary in today’s businessenvironment to define, implement and enforce an emailarchiving policy.Forty-three percent of corporations have an emailretention policy in place, but only 12% use an archiving tool tomanage retention and policy compliance, according to OstermanResearch Inc., a market research firm based in Black Diamond,Wash. Many businesses still operate under the misconceptionthat backing up their data constitutes an archive. Many alsorely on the risky assumption that users correctly manage andsave their own business records. Without set policies andprocedures for archiving email, businesses face risks and penaltiesthat can be severe.Defining andarchiving emailbusiness recordsis one of themost importantpolicy concernsfor any companythat is subjectto regulatorycompliancerequirementsand e-discovery. Page 1 ContentsWhat is the purpose ofan email-archiving policy?What qualifies asacceptable use?Email managementand retentionStaff roles andresponsibilities

chapter 2 Defining an email-archiving policyWhat is the purpose of an email-archiving policy?The vast majority of information created today is sentand received in electronic format. The estimated number ofnon-spam email messages sentworldwide on a daily basis is 25billion, according to Ferris Research, a San Francisco-basedresearch firm that specializesin messaging and collaborativetechnologies.The typical number of emailmessages sent and receivedby the average business user is600 per week, said Ferris Research. An email-archiving policy can help control and managethe unending flow of information by addressing regulatorycompliance, litigation readiness,productivity issues as well asgeneral business needs.As mentioned in Chapter 1,developing an email-archivingpolicy and a successful emailPage 1 Contentsarchiving project require asteering committee to represent all the interests of a company. The email-archiving policy should be a component ofan overall records managementprogram with its own record-retention policies and proceduresthat dictate which emails andattachments to save, how longto save them and when to delete them.In addition, an email-archiving policy should referenceand reinforce other corporatepolicies such as IT policies onacceptable use and security,HR policies relating to code ofconduct, and legal policies andprocedures regarding litigationhold or e-discovery.When evaluating the scopeof an email-archiving policy,companies should considerall users who create, send orWhat is the purpose ofan email-archiving policy?What qualifies asacceptable use?receive email messages and attachments in all regions of theworld where the company doesbusiness. The policy should alsoinclude other personnel, suchas contractors and consultants.It should also address transactional information, such asemail headers, summaries andaddresses.Companies should establishemail policies and proceduresfor users that contain guidelines covering acceptable andunacceptable use of email, dataprivacy, email managementand retention, and penalties fornoncompliance.sThe email-archiving policy shouldbe a component of an overallrecords management programwith its own record-retentionpolicies and procedures.Email managementand retentionStaff roles andresponsibilities

chapter 2 Defining an email-archiving policyWhat qualifies as acceptable use?All companies shouldhave an official ITacceptable-use policy toprovide guidelines forthe usage of computerequipment, networkresources, applications,Internet systems andemail. The emailarchiving policy shouldrefer to the acceptableuse policy and expandupon the areasspecifically related toemail use.Defining the terms of acceptable use offers guidelines andrequirements for personal use, security concerns and confidentialinformation: Personal Use Remind users to exercise good judgment for reasonable personal use of email. Incidental or occasional personal useof email for non-business purposes is generally acceptable. Usersshould know, however, that personal information -- such as personalfinancial transactions -- could be inadvertently captured in the emailarchive. Users must understand the implications of this when usingemail for personal purposes.Users must also be advised about business communications thatare sent over personal email. A 2006 survey by Osterman Researchfound that more than 16% of employees regularly communicate aboutbusiness issues using their personal email accounts. Outside of acomplete ban on personal email, an acceptable-use policy must encourage users to carbon-copy to their corporate account any personalemail containing business information. Security Concerns Caution users about security issues. Attachments, for example, may contain viruses or other potentiallymalicious programs. Confidential Information Provide rules for sending confidential information using tools such as encryption software.The unacceptable-use policy should give users guidelines and re-Page 1 ContentsWhat is the purpose ofan email-archiving policy?What qualifies asacceptable use?Email managementand retentionStaff roles andresponsibilities

chapter 2 Defining an email-archiving policyquirements prohibiting the following uses of email: Sending unsolicited junk mail, advertising or mass mailings Using email for any form of harassment, including those that containany indecent or obscene materials Creating or forwarding chain letters or other pyramid schemes Sending email with inappropriate content, including content that isdiscriminatory, defamatory or threatening. Discriminatory contentincludes references to sex, race, age, disability or religious beliefs PST Files The acceptable-use policy should also state whetherusers can create PST files to store email messages. Some email-archiving products impose quota restrictions to limit mailbox size.These restrictions often force users to create offline PST files to manage and reduce their mailbox size. On the other hand, allowing PSTfiles could create difficulties for e-discovery search-and-collectionefforts and may ultimately increase e-discovery costs if the officialarchive does not include all email.Any businessrecord, includingemail, maybe subjectto discoveryproceedings andlegal actions.s Data Privacy Companies must monitor the data-privacy lawswithin all countries in which they conduct business.Employers have wide-ranging latitude to monitor and access employee email that is sent or received with or without employee knowledge or consent. The email-archiving policy should clearly tell employees that: They should not expect privacy when using company resources for email. Any business record, including email, may be subject to discoveryproceedings and legal actions. Deleted email usually can be recovered and then used in a legal action.Page 1 ContentsWhat is the purpose ofan email-archiving policy?What qualifies asacceptable use?Email managementand retentionAllowing PSTfiles could createdifficulties for ediscovery searchand-collection effortsand may ultimatelyincrease e-discoverycosts if the officialarchive does notinclude all email. Staff roles andresponsibilities

All content and no discovery?Lost in a maze of unmanageable content? Find your way out with Enterprise Vault. It’s a flexible archiving framework thatenables the discovery of content within email, file system and collaborative environments. Reduce costs. Simplify management.Put your discovery fears behind you at www.symantec.com/complianceBE FEARLESS.Copyright 2005 Symantec Corporation. All rights reserved. Symantec, the Symantec Logo and Enterprise Vault are trademarksor registered trademarks of Symantec Corporation or its affiliates in the U.S. and other countries.

chapter 2 Defining an email-archiving policyEmail management and retentionCompanies should decidehow to implement and enforceemail management and retention. The email-archivingpolicy must clearly state howand where email records willbe managed, protected andretained according to the corporate retention policy andschedule. The options generallyinclude automated email-archiving systems, manual procedures or some mix of manualand electronic systems andprocesses. Each option has itsadvantages and disadvantages.Understanding a company’scorporate culture helps determine the correct options as wellas the necessary amount ofsupervision and support.For manual procedures, include step-by-step email-retention instructions for users.These instructions cover organizing, storing, maintaining,accessing and deleting email.Include user training to ensurepolicy enforcement. Companies must remember, however,that even with education andtraining, relying on users toRelying on users to properly identify,manage and retain their own email candrain corporate productivity.Page 1 ContentsWhat is the purpose ofan email-archiving policy?What qualifies asacceptable use?properly identify, manage andretain their own email can draincorporate productivity. If usersdo not follow directions, thecompany can face considerablelegal risk.Because of this risk factor,more and more companies areadopting automated productsfor a consistent, documentedand enforceable means ofmanaging email. For an automated email-archiving solution, provide an overview of thehardware and software environment, the location of the emailservers, the determination ofwhether or not a journaling orbatch process is being used,and the backup or data-recovery processes that are in placefor the archive.The email-archiving tool candefine record-retention periodsfor email. The amount of flex-Email managementand retentionStaff roles andresponsibilities

chapter 2 Defining an email-archiving policyibility and number of optionsvary by vendor and product.The tool should document howit assigns retention periods,such as by department, keywords or individual names.Available features and optionscan include:Automatically classifyingand archiving email based oncontent and metadataImplementing retentionpolicies based on attachment,message, folder, age, size andkeywordAvoiding the archiving of junkmail or irrelevant contentWarning users about flaggeditems of concernApplying transparent end-usermanagement by company,department or userAn email-archiving policyshould explain how it handlesexceptions to retention settings. For example, a user mayreceive an email that shouldbe retained for a long time — alegal contract, for example. Anemail-archiving policy mustprovide instructions on how tohandle information so it is notautomatically deleted duringor after the standard retention period. Exceptions canbe handled by electronic ormanual processes. Email thatqualifies as an exception can beelectronically moved or savedin a folder on a shared server aslong as the data on the server ismanaged according to a corporate record-retention schedule.Users may also print out emailsand file the paper copies.Enabling granular retentionLogically combining criteria toinclude or exclude informationApplying different retentionstandards for different users orfoldersAn email-archiving policy must provideinstructions on how to handle information soit is not automatically deleted during or afterthe standard retention period. Page 1 ContentsWhat is the purpose ofan email-archiving policy?What qualifies asacceptable use?Email managementand retentionStaff roles andresponsibilities