10 Steps to Establishing an Effective Retention Policy

Transcription

1 WHITE PAPER: 10 STEPS TO EFFECTIVE RETENTION 10 Steps to Establishing an Effective Retention Policy JANUARY 2009 Eric Lundgren INFORMATION GOVERNANCE

2 Table of Contents Executive Summary SECTION 1: CHALLENGE 2 The Need to Better Manage Retention Policies Litigation Readiness Regulatory Compliance Knowledge Management Balancing Retention with Costs and Performance SECTION 2: OPPORTUNITY 4 Developing and Implementing an Retention Policy Define an Policy Eliminate the Variables Hindering Centralization Educate Employees About the Retention Policy Incorporate Relevant Regulations into the Retention Policy Identify Roles With Unique Retention Requirements Balance Retention Guidelines and Related IT Costs Provide Employees With Access to Archived Messages Ensure That Retention Policies Can Accommodate Legal Holds Validate That all Messages Are Archived Use Technology to Enforce Retention Policies SECTION 3: BENEFITS 8 Improving Management Policies Through Technology Reduce ediscovery Costs Improve Regulatory Compliance Reduce the Risk of Sanctions Improve IT Performance without Increasing Costs Enhance Data Acces SECTION 4: CONCLUSIONS 9 SECTION 5: REFERENCES 9 SECTION 6: ABOUT THE AUTHOR 9 Copyright 2009 CA. All rights reserved. All trademarks, trade names, service marks and logos referenced herein belong to their respective companies. THIS DOCUMENT IS FOR YOUR INFORMATIONAL PURPOSES ONLY. TO THE EXTENT PERMITTED BY APPLICABLE LAW, CA PROVIDES THIS DOCUMENT AS IS WITHOUT WARRANTY OF ANY KIND, INCLUDING, WITHOUT LIMITATION, ANY IMPLIED WARRANTIES OF MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE, OR NONINFRINGEMENT. IN NO EVENT WILL CA BE LIABLE FOR ANY LOSS OR DAMAGE, DIRECT OR INDIRECT, FROM THE USE OF THIS DOCUMENT, INCLUDING, WITHOUT LIMITATION, LOST PROFITS, LOST INVESTMENT, BUSINESS INTERRUPTION, GOODWILL OR LOST DATA, EVEN IF CA IS EXPRESSLY ADVISED OF THE POSSIBILITY OF SUCH DAMAGES. CA does not provide legal advice. Neither this document nor any software product referenced herein shall serve as a substitute for the reader s compliance with any laws (including but not limited to any act, statue, regulation, rule, directive, standard, policy, administrative order, executive order, etc. (collectively, Laws )) referenced herein. The reader should consult with competent legal counsel regarding any such Laws.

3 Executive Summary Challenge In order to address growing ediscovery, compliance and knowledge management requirements, organizations must retain a greater number of s than ever before. Yet with such a large percentage of internal and external business communications performed via , this is becoming an increasingly difficult task one with which many struggle to keep pace. What s more, as the volumes of messages requiring retention grow, so too, do the related storage, retrieval and administrative costs. To address these challenges and prepare for litigation and compliance reviews enterprises need a standardized, policybased retention system that ensures all relevant messages are stored safely and in accordance with any pertinent industry laws and governing bodies. Opportunity Building a well-planned, enterprise-wide retention policy helps establish uniform and consistent rules for all and electronic records. Such a policy outlines content, sets retention and deletion criteria and provides the flexibility to accommodate litigation holds and enable role-based user access. Leveraging a robust Information Governance solution also helps simplify the management of this process. The ideal solution should automate retention policy enforcement and task documentation, while providing an archiving and retrieval engine that streamlines an organization s ability to locate messages for audits, litigation and ediscovery in a timely and cost-effective manner. Benefits Using an automated Information Governance solution as the authority to manage an retention policy enables organizations to meet ediscovery, compliance and knowledge management requirements, while improving system performance and reducing costs. Specifically, organizations can: Reduce ediscovery costs Improve regulatory compliance Reduce the risk of sanctions Improve IT performance without increasing costs Enhance data access WHITE PAPER: 10 STEPS TO EFFECTIVE RETENTION 1

4 SECTION 1: CHALLENGE The Need to Better Manage Retention Policies Faced with increasing regulatory scrutiny and tougher laws surrounding electronic content, organizations of all sizes in every type of industry must pay closer attention than ever before to the way they manage, store and archive messages. As rich sources of businesscritical intellectual property, electronic records must be protected by strong retention policies that identify which s need preserving and for what duration. Moreover, such a policy must also include guidelines that enable the safe, timely removal of messages from production systems and assist organizations in deleting them upon the expiration of the retention lifecycle. However, in an age dominated by electronic business communication, developing robust, effective retention guidelines for volumes that proliferate at an exponential rate often results in increased storage costs, poor system performance and difficulties locating specific archived messages. Despite these considerable challenges, retention policies comprise a key piece of an enterprise-wide Information Governance framework, and as such, must be implemented in order for organizations to achieve the three important capabilities of: Litigation readiness Regulatory compliance Knowledge management Litigation Readiness Today, litigation readiness is the biggest force driving the development of comprehensive retention policies. With the passage of the December 2006 amendments to the Federal Rules of Civil Procedure (FRCP) which list s, instant messages, text messages, Microsoft Word documents, spreadsheets and other electronic assets among the business records that can be used as evidence organizations are now legally obliged to possess formal ediscovery processes that make all relevant electronic documents available for assessment and analysis early in the litigation process. With this new regulation, enterprises need to know all of their sources of electronic information in advance of litigation, including servers and backup tapes, deleted or retired records and data stored at remote locations. Gaining visibility into the sources of data is crucial, as it helps organizations quickly institute litigation holds that mitigate the potential for intentional or negligent alteration or destruction of any electronic records known as spoliation in legal proceedings which can result in significant penalties and jeopardize the outcome of the case. Attempting to comply with these FRCP amendments and drive litigation readiness without an effective Information Governance system often results in high operating costs and an increased risk of penalties. In fact, according to a study by Cohasset Associates, American businesses annually spend between $2.5 million and $4 million on ediscovery for every billion dollars in sales, making it a large uncontrolled expense that is exceeded only by the costs of healthcare 1. Moreover, organizations that fail to meet FRCP rules can face sanctions for the illegal destruction or alteration of evidence, or even risk losing cases they would have otherwise won or favorably settled. 2 WHITE PAPER: 10 STEPS TO EFFECTIVE RETENTION

5 Regulatory Compliance Meanwhile, the Sarbanes-Oxley Act (SOX), the Financial Industry Regulatory Authority (FINRA), the Health Insurance Portability and Accountability Act (HIPAA) and other regulatory mandates include strict guidelines about the preservation of electronic assets. In other words, these exacting criteria make retention a key factor in achieving compliance. While the specific data subject to retention varies by authority, most require that all records directly pertaining to an organization s business activity, including s and other messages, be held for a predetermined amount of time. Exceptions to these regulations include spam and personal s, though the latter can be requested during an investigation under certain circumstances. Knowledge Management An organization s records often contain valuable, proprietary information that is vital to the success and ongoing competitiveness of the business. Thus, retaining these messages and providing users with quick access to the information contained within can help to drive productivity and business innovation. Balancing Retention With Costs and Performance With stores growing at an annual rate of 35 percent, keeping s in online archives means that businesses must invest in additional physical storage space and hardware capable of maintaining performance under increased processing loads 2. To combat the rising costs associated with retention while continuing to meet performance demands in production systems and comply with all legal and regulatory requirements organizations need a way to identify non-essential messages that can be sent to offline storage or deleted. Managing Retention Through Policies and Automation However, because they lack the formalized policies that dictate which s must be saved, which are not immediately essential to business needs and which can be deleted, many organizations struggle to make retention a cost-effective core competency. In fact, in a study by the Osterman group, 53 percent of respondents said they lack such a policy 3. What s more, many of the world s largest corporate messaging applications provide few resources to support compliance and retention operations. And without the right tools, organizations must manually search through individual inboxes and scour backup tapes to locate a specific or attachment. At the same time, many outsourced backup companies charge a fee every time they are asked to locate and deliver archived messages a process that can get quite costly as greater numbers of s are requested. To achieve this crucial balance between costs and retention, organizations need to develop a carefully planned retention policy and support it with a robust, comprehensive Information Governance solution. Leveraging technology to enable such a policy will ensure that all retention methodologies, responsibilities, procedures and timeframes are applied to each message and enforced on a consistent and uniform basis. In doing so, organizations improve their ability to demonstrate conformance to legal and regulatory initiatives, become well prepared for litigation and ediscovery and increase cost efficiencies across the board. 1 Information Governance: A Core Requirement for the Global Enterprise, Cohasset Associates, October Reducing the Load on Servers, Osterman Research, September Archiving Practices Survey of IT professionals, Osterman Research, December WHITE PAPER: 10 STEPS TO EFFECTIVE RETENTION 3

6 SECTION 2: OPPORTUNITY Developing and Implementing an Retention Policy To make management procedures a cost-effective business asset, enterprises need to develop, actively enforce and audit comprehensive retention guidelines. These rules should specify consistent, enterprise-wide data archive windows and define permissions for who can access, change or delete messages, attachments and other records. To this end, organizations should guide themselves through the process of developing, implementing, monitoring and auditing a comprehensive retention policy using the following 10 steps: 1. Define an retention policy 2. Eliminate the variables hindering centralization 3. Educate employees about the retention policy 4. Incorporate relevant regulations into the retention policy 5. Identify roles with unique retention requirements 6. Balance retention guidelines and related IT costs 7. Provide employees with access to archived messages 8. Ensure that retention policies can accommodate legal holds 9. Validate that all messages are archived 10. Use technology to enforce retention policies Define an Policy In order to fully understand its retention obligations, an organization must first have a clear understanding of the types of content it transmits electronically. To provide this insight, the retention policy should specify: DOCUMENT TYPES employees can send via , as well as the specific files, such as sensitive business contracts, that must be transmitted using a different method. CONTENT GUIDELINES defining what should or should not go into s, including policies around what constitutes sexual harassment or other unacceptable language. ENFORCEMENT MEASURES and best practices that automatically scan for policy violations and designate an internal authority to periodically review content. 4 WHITE PAPER: 10 STEPS TO EFFECTIVE RETENTION

7 Eliminate the Variables Hindering Centralization Without formal archiving guidelines and an automated system to manage the process, employees often save old messages and attachments on local storage systems, such as a PC hard drive. This lack of standardization makes tracking and protecting archived messages problematic. For example, a judge can request messages saved on personal archives during litigation and ediscovery. But if an employee saves these on a hard drive, which then fails, the information is lost and the enterprise becomes vulnerable to legal and regulatory penalties around the spoliation of data. Moreover, locating the necessary data on all local hard drives throughout a large organization is a difficult, time-consuming and expensive process that often fails to discover every message saved on a non-standardized source. To avoid the possibility that a missing message results in legal sanctions, retention policies should include specific, centralized archiving methods that prohibit employees from saving messages in personal folders. Educate Employees About the Retention Policy Even though a formal retention policy may be defined and in place, many employees may remain unaware that such guidelines exist. To ensure that archiving rules are followed across the enterprise, all employees must be trained on the policy and able to demonstrate that they understand content and storage procedures, as well as any rules restricting the use of personal folders. Moreover, education should: Detail the reasons why these rules are in place, Offer instructions for using any supporting archiving technology Outline the consequences of non compliance at both a business and personal level Incorporate Relevant Regulations Into the Retention Policy It is critical that all retention policies incorporate the requirements of the mandates governing the industry in which an organization operates. There are many common regulations to consider. SOX SOX regulations apply to public companies across all industries and impose severe penalties on any business that deliberately alters or deletes documents in order to defraud customers or other third parties. To comply with SOX guidelines, companies must retain auditable s for a minimum of five years from the end of their last fiscal years. FINRA FINRA rules demand that financial services firms establish formal, written policies and procedures that detail their retention policies. After outlining these policies, a business must then demonstrate that all retention processes are in full compliance with FINRA guidelines. HIPAA HIPAA regulations apply to any message or other electronic records that contain sensitive information about an individual s medical history. The preservation period for a medical record is a minimum of five years, though some related statutes dictate that certain information be retained for the life of the patient. WHITE PAPER: 10 STEPS TO EFFECTIVE RETENTION 5

8 BEYOND REGULATIONS Although many regulations exist beyond the three listed above, all regulatory bodies regardless of industry specificity make meeting the following requirements a key aspect of compliance. DATA PERMANENCE, where data must be in its original state without being altered or deleted. DATA SECURITY, where all retained information must be protected against security threats, including access by unauthorized persons and any outside forces that could physically damage or endanger the availability of archived messages. AVAILABILITY, where organizations must prove that all s subject to the retention policy can be easily accessed by authorized personnel in a timely manner. Identify Roles With Unique Retention Requirements Specific organizational roles have unique archiving requirements, which must be captured in the larger retention policy. For example, brokers at financial services firms are obligated to keep all of their electronic correspondence for up to six years. Likewise, in pharmaceutical companies, scientists or physicians who perform drug tests must keep test-related s on hand for even longer, as these may contain highly sensitive information that can be requested as evidence in ediscovery. Finally, it is common practice in most enterprises to save the s of CEOs indefinitely, even after their tenures have ended. Balance Retention Guidelines and Related IT Costs Though there are many specific legal and regulatory guidelines around retention, no court or compliance authority demands the archiving of every ever sent or received. As a result, organizations should implement a retention policy that reduces the storage burden by ensuring that the s essential to meeting compliance and litigation guidelines are saved, while those that are not needed are deleted. By reducing storage through retention and deletion policies in line with legal and compliance mandates, IT can limit storage-related expenditures and streamline administration tasks, which often comprise more than 40 percent of total IT support costs. In addition, this approach limits the amount of content requiring evaluation during the legal review phase of ediscovery, further reducing costs. Provide Employees With Access to Archived Messages As enterprises establish overarching policies for archiving and deleting messages, they must also verify that all employees have access to the electronic assets they need to carry out their business responsibilities. To support productivity, policies should establish rules that enable certain messages to be saved for personal communication, while allowing all other messages to be managed by the default retention strategy. These rules should also allow users to search for all archived in both production and off-line storage systems, and in some cases, enable employees in similar roles to access messages owned by their coworkers. 6 WHITE PAPER: 10 STEPS TO EFFECTIVE RETENTION

9 Ensure That Retention Policies Can Accommodate Legal Holds retention policies must be flexible enough to be suspended if a legal hold is necessary. For example, if an organization is anticipating legal action, it might choose to retain all s in order to preserve the information that may be used as evidence during litigation. It is critical that policies accommodate legal holds, because courts can impose sanctions for the spoliation of any messaging content or electronic records that are relevant to a legal proceeding. Validate That all Messages Are Archived In order to comply with ediscovery and litigation mandates, businesses must confirm and demonstrate that all s are captured and subject to the retention policy. To support this critical goal and eliminate the possibility that information escapes retention organizations should leverage an Information Governance solution with functionality that provides the live, real-time capture of every message that falls under the rules of the retention policy. Use Technology to Enforce Retention Policies To achieve the goals outlined in its retention policy, an organization should implement a robust, automated Information Governance solution capable of enforcing policy guidelines across the business in an efficient, effective manner. Such a solution is the key to improving legal hold management, speeding retention processes and maintaining an archive that preserves necessary messages and purges non-essential s as necessary. Information Governance solutions should help simplify access to archived messages through rules to grant permission by business classification, protect messages as corporate assets and make them available to employees within similar roles. Specifically, the optimal Information Governance solution should include: Granular retention capabilities that allow organizations to keep individual s according to specific criteria Automatic archiving that enables end users to access messages in a saved state Folders that streamline the storage and retrieval of important messages The ability to secure sensitive private information, such as social security numbers and medical records, to support HIPAA compliance Capabilities for ediscovery, including the classification and search of s and other electronic records Legal hold support that earmarks the specific s that have been identified as evidence in litigation procedures WHITE PAPER: 10 STEPS TO EFFECTIVE RETENTION 7

10 SECTION 3: BENEFITS Improving Management Policies Through Technology Enterprises that utilize an automated Information Governance solution to implement and manage a comprehensive retention policy are better prepared to meet ediscovery, compliance and knowledge management requirements and promote more cost-effective system performance and administrative activities. Specifically, Information Governance technology helps organizations develop and maintain retention policies that: Reduce ediscovery Costs By helping to establish a granular retention policy, an Information Governance solution gives organizations instant access to the messages needed to meet specific regulatory, legal and ediscovery requirements and decreases the time and costs associated with manually searching archives, as well as the time spent in review, the most expensive phase of ediscovery. Improve Regulatory Compliance Information Governance solutions help organizations verify that their retention policies address the requirements of industry regulations, greatly improving opportunities to comply with such initiatives as SOX, FINRA and HIPAA. Reduce the Risk of Sanctions By implementing and documenting uniform, consistent retention policies, Information Governance solutions help organizations preserve records that may be used in court proceedings and reduce the risk of sanctions for the illegal destruction or alteration of evidence. Improve IT Performance Without Increasing Costs An Information Governance solution provides organizations with the ability to develop a streamlined, cost-effective message archive that automates retention and disposition and leverages existing IT assets reducing the need to add new servers, storage systems and maintenance personnel. Enhance Data Access With policy-based functionality that verifies that data is retained according to business classification, protected as a corporate asset and made available to employees with common roles and user profiles, an Information Governance solution helps to improve data access across the organization. 8 WHITE PAPER: 10 STEPS TO EFFECTIVE RETENTION

11 SECTION 4 Conclusions Given the heightened emphasis placed on the preservation and security of electronic assets, organizations across all industries are under increasing pressure to develop and implement a robust, comprehensive retention policy that complies with various legal and regulatory bodies. Bolstering such a policy with an automated Information Governance solution enables enterprises to more efficiently and cost-effectively store and locate s for ediscovery, litigation, compliance and knowledge management purposes. In doing so, they are able to optimize their message archival and deletion processes, while simultaneously: Improving system performance Strengthening data availability Reducing maintenance costs Minimizing the risk of legal penalties or sanctions SECTION 5 References Information Governance: A Core Requirement for the Global Enterprise, Cohasset Associates, October Reducing the Load on Servers, Osterman Research, September Archiving Practices Survey of IT Professionals, Osterman Research, December SECTION 6 Eric Lundgren INFORMATION GOVERNANCE About the Author Eric Lundgren is Vice President of Technical Sales for the Information Governance Business Unit at CA. He has a deep background in management, ediscovery and records management. Currently, Eric is responsible for helping customers understand how they can better address the legal, regulatory and operational challenges posed by diverse sources of information, including and electronic and physical records. Prior to working for CA, Eric was Vice President of Product Strategy and Technical Sales for ilumin Software, a leading management, supervision and discovery software vendor. WHITE PAPER: 10 STEPS TO EFFECTIVE RETENTION 9

12 CA (NSD: CA), one of the world s leading independent, enterprise management software companies, unifies and simplifies complex information technology (IT) management across the enterprise for greater business results. With our Enterprise IT Management vision, solutions and expertise, we help customers effectively govern, manage and secure IT