What’s your e-mail policy?

We have just wrapped a major North American survey of messaging decision-makers in which we asked questions about e-mail and instant messaging policies. Here’s a bit of what we found.

Only one in five organizations currently has a detailed and thorough e-mail policy. Most of the remaining organizations have only a basic policy that covers general use of e-mail, but the policy doesn’t contain many details or direction for employees. Further, only one in 13 organizations told us there is ‘extensive understanding and compliance’ with the corporate e-mail policy among employees.

IM policies didn’t fare any better in our research: we found that 59% of organizations do not even have a corporate IM policy, despite the fact that our research has found that IM (much of it consumer-oriented) is found in more than 90% of organizations in North America.

There are really two takeaways from this research. First, organizations need to focus more on policy creation and management as a best practice. These policies, particularly with regard to e-mail, need to focus on acceptable use policies so that employers discourage or prevent employees from sending inappropriate jokes and other content through the corporate e-mail system or via their own Webmail accounts while at work. These policies need to focus on appropriate e-mail retention and deletion policies for corporate records sent through and housed in e-mail.

The second key takeaway is that organizations need to establish policies with regard to use of IM. IM represents a major vector for threats to enter the corporate network, and it represents an avenue for the loss of intellectual property and other sensitive content. Because a significant portion of IM use consists of consumer clients, organizations need to get a handle on IM use in the context of namespace control, encryption and archiving.

I’d like to get your thoughts on the need to develop better e-mail and IM policies. Please send me your thoughts.