Best Practices for Records Retention and E-Mailing

1. Best Practices for Records Retention and E-Mailing French Caldwell

2. What Should Your E-Mail Retention Policy Be? Save Everything Save Nothing Get it wrong and it could cost you $$$$$$

3. Key Issues • What are the trends influencing e-mail and content retention policies? • What technologies can be deployed to support e-mail and content retention? • What are the best practices for e-mail retention and content archiving?

4. Industry and Government Regulations Business Continuity Paper Digital Content Communications(E-Mail, IM) Risk Mitigation Legal Discovery What's Driving Document Retention? Records Management Focus

5. Storage Continues to Outgrow Every Other Data Center Hardware Expenditure • Deduplication • Single-Instance Store • Compression • Cost per GB is just the tip of the iceberg. • Cost per usable GB • Optimal disk size • Cost to protect • Cost to expand • Media/spares Tiering and Archiving Power and Real Estate Static data offers special opportunities for savings. Think Green!

6. Operations and Performance • Increasing storage demand • Time to backup and recovery increases • Slower system performance Compliance and Legal Discovery • Increasing government regulations • Increasing litigation costs • Faster response required Managing the Exponential E-Mail Growth Typical E-Mail Situation 30+% annual growth (in traffic, not necessarily storage) Average 75 e-mails per day 7MB data per day

7. Spiraling Costs and Litigation Risk Affects All Companies • Litigation affects all organizations • Public and private; any size • Particularly vulnerable industries — securities, insurance, healthcare, financial services, consumer products, construction materials, food, transportation, pharmaceutical • The focus of litigation is increasingly dependent on the discovery and authenticity of electronic evidence • A study indicates that 90% of all corporate information created today is digital (USC) • In litigation, 75% of electronic evidence is e-mail • "Average" costs for e-discovery are running at $1.5 million per matter (Fulbright & Jaworski)

8. Requires meetings to discuss e-discovery Provides for reasonable access to potential evidence Defines "electronically stored information" Deals with inadvertent waivers of privilege Specified potential production formats Sets up possible "safe harbor" for lost data Planning Needed for Changes in Federal Rules of Civil Procedure IT needs to be prepared to accurately disclose what information is available, in what format, and what it would take to review and produce it.

9. Records management enforces the policies and rules for the retention and disposition of content required for documenting business transactions. Physical Documents Electronic Content Digital Communications Strategic Planning Assumption: By 2010, 40% of all Global 2000 companies will implement an enterprisewide records management system, up from 25% in 2005. Managing the Retention of Business Content

10. Tape Optical Selecting the Right Storage for Content Starts With Data Requirements Rich Media Financials Document Repositories NAS Web Pages Disk FC, ATA,SAS Unified CAS Application Support Reports E-mail VTL Imaging Clustered Storage

11. Leveraging Deduplication Technologies to Store More in Less Space Providers Full Backup 1 Incr .1 Incr. 2 Full Backup 2 • COPAN • Data Domain • Diligent • ExaGrid • FalconStor • NEC • NetApp • Quantum • SEPATON B C D E F G A H I J A B C D E F G H I J Backup Repository Unique Data Redundant Data De-duplicated Data Deduplication System 5PB Capacity Assumes a 20-to-1 deduplication ratio. May be more cost-effective than tape if there is lots of duplicate data.

12. Retention Management Extending Beyond Records Information Life Cycle Management: Optimizes the cost of storing, protecting and recoveringinformation by migrating data to the appropriate storage technology based onavailability, performance and retention requirements. Content Management, Retention Management, Archiving, Data Access Invoices E-mail High Performance High Availability Lower Performance Lower Availability Lowest Availability Deletion Content Files Reports Online Near-Line Offline Cost per GB Expensive Moderate Inexpensive

13. E-Mail Archiving Report (Print Stream)Archives ERP Systems Rich Media ContentArchiving Files Imaging Sharepoint Archiving Static Content Active Content Consolidate Your Content and Platforms as Archiving Gains Importance

14. Now Everyone Is Jumping In Early Solutions Outsourced Options Increase as More E-Mail Archiving Service Providers Emerge

15. challengers leaders ability to execute niche players visionaries completeness of vision Magic Quadrant for E-Mail Active Archiving, 2007 — Discovery is Now Key • Vendors Delivering Discovery Add-on Product Options: • Symantec • Zantaz • AXS-One • C2C (new) • CA • CommVault (new) • IBM (new) • Mimosa (new) • Waterford (new) Symantec EMC Zantaz ZL Technologies IBM HP Quest Software Mimosa Systems Open Text CA AXS-One C2C Systems Messaging Architects Waterford Technologies CommVault As of May 2007 (From "Magic Quadrant for E-Mail Active Archiving, 2007," 16 May 2007)

16. 7 Establish continuous audit and review processes. 6 Communicate and train staff. Publish policies, retention schedule and procedures. 5 Select and deploy a records management solution. 4 Determine functional and technical requirements. 3 Build a file plan and retention schedule with access rights and document types. 2 Draft policies to detail enterprise needs for record keeping to satisfy business, regulatory, legal and fiscal requirements. 1 Build a program oversight team consisting of legal, finance, IT and business managers. Seven-Step Implementation Plan for Records Management

17. The legal and regulatory environment Distributed or centralized data within an organization Business practices and procedures that have evolved The nature of the business The culture of the organization History of legal, regulatory and administrative proceedings Developing a Document Retention Policy

18. Which Approach to Message Retention? Delete E-Mails After XX Days • Easiest strategy to implement but requires good IT plan and employee training • Requires well-documented disposition rules and adequate "sanitization" of storage media Save All E-Mails • Safest strategy for compliance in the absence of robust automatic categorization tools • Increasing demands on storage infrastructure Save Only Select Messages • Most challenging strategy requiring integration to records retention policies • Requires good classification and metadata management

19. PST PST PST PST PST PST PST PST PST E-Mail Retention: The Reality • Mailboxes are capped at 200 MB, but PSTs (or local archives) are everywhere • PSTs • Consume over 50% of network file shares storage • Are corruptible • Represent the biggest challenge for organizations since they are uncontrolled and hard to discover The biggest challenge for companies today is how to deal with runaway PSTs

20. PST PST PST PST PST PST PST PST PST E-Mail Retention: The Future • The most likely outcome of the current e-mail retention agony is: • Larger mailboxes, up to 1 GB, to meet user needs • Selective archival services based on user role and/or managed folders • Revocation of the right to create local archives • Selective destruction of established PSTs based on time X X X X X X Users will need to be trained on what messages warrant longer-term preservation, and how to do it

21. Recommendations • Assess your records management program and determine if it provides you with the ability to recover critical records for conducting business. • Determine your compliance needs and the litigation risk that your enterprise faces. • Companies must distinguish between what is mandated and required by government, by corporate policy, and for business efficiency. • Don't underestimate the challenges and efforts in developing a records management program. • Organizations must proactively determine the balance between legal, compliance and user needs.

22. What to Keep — Why to Keep it? • Corporate policy records • Correspondence about HR disputes • Real estate portfolio communications • Financial transaction records • Government mandated records • Broker dealer communications • Hazardous materials handling • Etc. • Employee-retained for business efficiency • Project history • Reference material • Etc. Optional preservation Mandatory preservation Companies must distinguish between what is mandated by the government, versus what is mandated by corporate policy, versus what is required for business efficiency

23. Companies Take Different Approaches to E-Mail Retention