E-mail management: compliance, control, consolidation.

E-mail is mission-critical. It is more important than many other IT applications and systems, taking a leading role in both internal and external business communications. It is used more frequently than telephone, fax, or physical correspondence. According to industry analysts, 60% of business-critical information is in e-mail.

With e-mail's predominance in the enterprise, the onslaught of regulations and security requirements, and the growth of e-mail as a primary source for legal discovery, organizations are seeking tools to help them gain custody of and better organize e-mail. The baseline requirement is to retain e-mail in its original state, without alteration. Yet a recent survey by Cohasset Associates indicates that 59% of organizations do not have any formal e-mail retention policy in place.

Storing e-mail on the corporate messaging system and backup tapes is no longer sufficient. Some organizations have spent millions of dollars to recover individual e-mails for legal discovery from backup tapes and production e-mail servers. To protect the organization and ensure compliance, a robust solution is needed that treats e-mails as corporate records and controls and manages them according to an organization's policies and procedures for record retention, access and disposition.

[FIGURE 1 OMITTED]

This demand is reflected in a recent study by IT market research and advisory firm IDC that states that the demand for e-mail management applications was expected to generate revenue topping $180 million worldwide in 2004, up from just $33 million two years ago, and to continue to grow at a compound annual growth rate of over 50% through 2008.

Regulatory Compliance and Records Management

Corporate scandals and legal cases that involve electronic information (and e-mail in particular) are now a staple in daily news reports. With governments and regulatory bodies working to establish laws and regulations that enforce or guide the proper use, storage, access, and disposition of information, records and e-mail management have become crucial to corporate governance and risk management.

Regulations such as the Sarbanes-Oxley Act, SEC 17a-4 & NASD Rules 3010/3110, FRA, HIPAA, FDA Rule 11 define different aspects of managing records, including e-mail and other electronic or physical content.

The Sarbanes-Oxley Act imposes hefty penalties (up to 20 years in prison) on anyone tampering or destroying records with the intent to impede government investigations, and requires CEOs and CFOs to take personal responsibility for their accuracy and completeness. The need to capture, organize, and preserve corporate records, including e-mail records, is a fundamental requirement of compliance.

SEC 17a-4 states that financial organizations must store all records for three, and in some cases six years, with the first two years in an easily accessible space. The SEC can require organizations to promptly produce copies of those records whenever they are required for investigation purposes.

For example, in December 2002, the SEC levied a $1.65 million penalty on Deutsche Bank Securities, Goldman Sachs, Morgan Stanley, Salomon Smith Barney and U.S. Bancorp Piper Jaffray for not storing e-mail properly and failing to produce e-mail requested during the course of the investigation. Five Wall Street brokers were fined $8.25 million by the SEC; the firms included Morgan Stanley, Goldman Sachs & Co. and Salomon Smith Barney Inc. The SEC, the New York Stock Exchange and the National Association of Securities Dealers all require brokerages to retain e-mail traffic. The brokerages that were fined failed to preserve the e-mails for three years and/or to preserve them in an accessible place for two years.

However, keeping everything forever is not the answer. Regulations and policies usually establish the minimum time to retain or keep records (e.g. six years). After that period of time, organizations are permitted to destroy or dispose of those records to avoid additional storage expenses and also to minimize legal exposure beyond the legally defined periods. Clearly defining and adhering to retention policies are the key factors to avoid fines, sanctions, and legal exposure.

Classifying E-Mail for Retention as a Corporate Record

E-mail backups are complex and it is time-consuming and expensive to find e-mails on certain topics or belonging to certain users. Some IT departments create a second e-mail environment that replicates the production system just to be able to restore backup tapes to the replicated environment without disrupting or affecting the production system. Further, thousands of man-hours may be required to traverse all the "restored" mailboxes to recover only the e-mails that are required by the court or legal department. At times, this is done manually by opening every single mailbox, analyzing and reading individual e-mails, and copying or exporting them.

The solution is to treat e-mails as corporate records and make them classified, searchable, available for fast retrieval, and subject to lifecycle and retention management. Collecting backup tapes or e-mails from user mailboxes is not enough to satisfy regulations or guarantee that captured e-mails are authentic, original, complete and unalterable. Users at any time can edit or delete e-mails from their mailboxes even before the first backup or mail-box-archived copy is taken. E-mail records must be captured before the user has a chance to tamper with them.

Classifying e-mail helps in applying appropriate retention to different e-mails and also helps in organizing e-mail in hierarchical folder structures for easy navigation, searching, and retrieval. Searching for the appropriate e-mails is mandatory to comply and produce them upon request of regulatory bodies, or for legal discovery. Internal legal and compliance departments also benefit from advanced search capabilities such as Boolean operators, proximity, and other conditions applied to e-mail metadata, body, or even attachments.

In addition to the normal lifecycle and retention policies, organizations involved in legal cases must manage legal holds. Once involved in a legal case, holds are applied to avoid destruction of e-mail required during the case and that could be subject to destruction based on the normal retention policy. Destruction of the e-mails subject to the hold must be suspended for as long as the case is active.

New Solutions for E-mail Archiving 

In most organizations today, e-mail management is either non-existent or is done using in-place technologies that fall short of what is needed to protect the organizations and ensure compliance. The new generation of e-mail management solutions goes beyond earlier, more limited products that provided simple backup or offloading of e-mail stores and products that left it to each user's discretion to decide which messages to retain.

Today's e-mail management solutions are designed to address the following primary requirements:

* Retain messages in compliance with regulations and corporate policies

* Facilitate searching as required for legal discovery

* Improve system performance and reliability

* Integrate with other corporate content

These tools automatically capture, classify, and index e-mail messages, create a searchable archive and manage the information lifecycle according to corporate retention and disposition rules. Offloaded to secondary storage to improve the efficiency of the e-mail system, the archive remains accessible to users, auditors, and compliance officers. The Figure represents an overview of an e-mail management solution that enables the capture, organization, access, retention and disposition of e-mails.

To meet today's requirements, a solution should allow you to:

* Capture everything you need--but only what you need. That means taking the decision on which messages to retain out of the users' hands and automating it according to rules you establish. You should be able to screen on subject, sender, recipient, message content and date. Ensure you can store attachments with messages and avoid duplicating messages that are sent to multiple recipients.

* Establish flexible, automatic classification based on business rules and content analysis. This is a logical structure that can be organized by user, by chronology, by organizational function or by some combination. The classification system can also assign codes that determine length of retention and disposition.

* Maintain accessibility for users, compliance officers, and corporate managers via the e-mail client and a specialized user interface. Retrieval should be based on categorization and/or full-text search of messages and attachments.

* Implement an e-mail management software infrastructure that supports multiple storage options, including emerging network-attached storage.

* Seamlessly integrate with your plans for implementing a sound ILM strategy that will allow you to manage all types of information from creation to disposition.

A solution that addresses these criteria will improve performance of e-mail systems and, more important, will support regulatory compliance, facilitate legal discovery, and integrate e-mail with other enterprise content to maximize the business value of the critical information contained in e-mails.

David Winkler is vice president, product marketing, for Mobius Management Systems, Inc. (Rye, NY)

www.mobius.com