How to evaluate messaging-archiving requirements

Osterman Research and Contoural have just published a user guide on how to select messaging-archiving products. Here is some information from that guide on what to consider when creating an archiving policy for your organization.

* There is a tendency when approaching message archiving to start by looking at the available technologies and products. However, it is usually more important to start with a good policy first. Once there is a clear understanding of what needs to be saved, it will be easier to figure out the best way to save it. In short, a good policy will drive the right technical requirements.

* Some companies include their messaging-archiving policy as part of their overall document-retention policies, while other organizations develop separate e-mail archiving policies. Either way, message archiving policies should be consistent with policies for archiving other types of information.

* Perhaps the greatest challenge in creating a message archiving policy is determining what messages should be saved when so many of the requirements are either unclear or uncertain. Similarly, there is a level of uncertainty surrounding litigation discovery for most companies. A company could go many years without facing such a suit, or it could be served with a large lawsuit tomorrow. Typically, no single regulation or single case can provide enough justification to deploy an archiving system. However, if all the business drivers are taken as a whole – compliance, litigation discovery and productivity – they create a strong business case for taking action.

* In the view of litigators, perhaps worse than an outdated document-retention policy – or even the lack of a policy – is a policy that is inconsistent or not followed. A typical example of this is a policy that calls for the deletion of all documents, although some users still save or print documents. When an opponent during litigation can show that the policy was not followed, this can be used as justification for significantly expanding discovery or to imply that the inconsistent implementation of the policy was due to the company having information to hide.

* Even if you want to establish a policy of deleting e-mail, you should not do so. As a practical matter, you simply can’t be sure of deleting all of the copies of a potentially damaging e-mail message. Further, if someone still has a copy, then it is unwise to delete your copy and related e-mail that would place the unwanted message in its appropriate context.

In short, archiving policies for e-mail, instant messages and other document types should be established; applicable statutes and the risks of litigation should be understood and interpreted for your company; and appropriate technology should be implemented to satisfy these policies and regulations and to mitigate risks for the organization. At present, too few companies do this.