Texas A&M University Employee Standard Administrative Procedure provides the following guidance on this topic:

Transcription

1 Texas AgriLife Extension Service, Texas AgriLife Research and College of Agriculture and Life Sciences Retention Policy and Operations Management Policy Draft January 18, 2010 Version 1.3 Overview In May of 2010, Texas AgriLife Research, Texas AgriLife Extension Service, and the College of Agriculture and Life Sciences jointly approved and funded a centralized enterprise platform that will host and maintain communications on a single, redundantly configured platform. Along with this effort comes the need for fiscal and operational policies that will enhance operational stability, reduce liability contained within transactions, and manage operating costs. Retention & Classification Recommendations Classification of the data or content within the AgriLife system is a very important decision point and defines how long data within the system must be retained. The critical question is whether an is a state record based upon its content. If so, the must be retained in accordance with applicable state and A&M System records retention requirements. If not, the can be deleted when its purpose has been fulfilled. Texas A&M University Employee Standard Administrative Procedure provides the following guidance on this topic: The content and function of an message determines whether it is a state record. Only messages that meet the criteria for being state records are subject to A&M System, University and Agency records retention requirements. An message is not a state record unless the message uniquely documents official business and is NOT merely a convenience copy. For example, an message that constitutes the University or Agency s significant correspondence on a contract would be a state record if the is the official version of the record (and not a copy). If an message is NOT a state record, it should be deleted as soon as its purpose is fulfilled, unless the University or Agency has required that it be retained to enable the University or Agency to comply with its obligations under the Act, an audit, investigation, or official proceeding. Most messages are transitory information, which is defined as records of temporary usefulness that are not part of a records series, are not filed within a recordkeeping system, and are required for a limited period of time for the completion of an action. Transitory information should be deleted from the system as soon as the purpose of the record has been served and does not require the approval of the University or Agency Records Officer. 1 P age

2 messages constituting state records should be retained in an electronic storage system for the period of time specified by the A&M System Records Retention Schedule. The electronic storage system should retain the message and all metadata associated with that message: name of the sender, names of all recipients, date and time of the message, and any attachments. Policy Recommendation: 1. The records retention policy for each agency will be adapted to include the methods and procedures for data migration to an official state record retention repository, if an or attachment qualifies as a state record. Additionally the records retention policy will explicitly state what the upper bound retention timeframes will be for all transitory transactions and those which are not state records. o Automated retention rules will be established within the system to automate specific retention rules (e.g. 30 Day Purge on all Deleted , 180 Day Retention on all other managed folders (Sent, Junk folders, etc.). Note, however, these automatic retention rules will be disabled as necessary to ensure preservation of messages in an official proceeding, request for information, or investigation, such as an audit, Public Information Act request, lawsuit, subpoena, or administrative complaint. o meeting state record classification parameters must be copied/moved to the proper place within the Laserfische system for retention schedule adherence and later disposal requirements. 2. The College of Agriculture and Life Sciences and both AgriLife agencies will jointly adopt these procedures to obtain operational consistency and management procedures within the system. 2 P age

3 Operations Management Recommendations Beyond the classification and management of the data within the system there exist a variety of operational parameters that must be agreed upon to provide for operational consistency and to regulate operating costs. The following provides a listing of these operational parameters and the best practice based recommendation for each. 1. Mailbox 2GB Limitation Quota The current AgriLife Exchange 2010 mail platform operational budget was based upon a 5 year plan that accommodated 2GB mailbox accounts for up to 5000 users and resource accounts (e.g. Conference Rooms, Vehicles, etc.). This budget also provided for a 25% increase in operational capacity during the 5 year term. Due to various degrees of replication and redundancy with the mail platform database and the number of user mailboxes support, storage costs are the single most costly element of the mail system. Based upon the scale and consistency of architecture, increases in storage capacity must be handled in large increments versus smaller, less expensive increments. Based upon the architecture model and currently approved fiscal budget, it is imperative to maintain a degree of control and persistence to the 2GB mailbox limitation. As noted above, retention timeframes should be established to reduce liabilities and regulate operational costs. Ultimately, if retention rules are applied, 2GB mailboxes should provide for a more than sufficient allocation of space to store transactions within retention timeframes. Policy Recommendation: 1. The 2GB mailbox quota will be enforced throughout the organization if automated retention rules are enacted within the system and an archiving solution is enabled. 2. Automated quota warnings will be provided by the system at 90% and 100% capacity. Upon reaching 100% quota the mailbox will be unable to send or receive Once employees reach the 2GB quota, they would have the following options: a.) Remove any unwanted from personal folders to reduce the overall number of s, and/or, b.) Turn on archiving and begin the transfer of to the online archive box (see Item 3 below). 3 P age

4 2. Folder Retention Application Certain retention rules should be applied to assist users in managing and appropriately meet System rules regarding the disposal of transitory . To that end the following retention rules have been designed to assist users. Policy Recommendation: The following retention rules will be applied per stated folder: DELETED ITEMS: JUNK E MAIL: SYNC ISSUES: SENT ITEMS DRAFTS: CONVERSATION HISTORY: RSS FEEDS: 30 Days Retention 30 Days Retention 30 Days Retention 180 Days Retention 180 Days Retention 180 Days Retention 180 Days Retention For all other folders (inclusive of the INBOX folder) no automated retention rules will be applied. These folders will be limited by the overall 2GB Mailbox Quota. 3. Archiving archiving is currently performed within the organization by users creating local archives on their workstations. This model brings with it considerable overhead when the need arises to review for legal or open records requests. Employees that do not backup this data run the risk of the information being lost when a local hard drive fails. Additionally, local archives are not accessible by the user unless they are using the machine where the archives are located, thus access to local archives is inefficient. The current primary issue with local archiving is that the user is not required to manage the archive; consequently, where archiving has been enabled, flows into the local archive creating large scale and ever growing repositories of dating back many years. This imposes certain risks to the organization along with the operational overhead for backup and maintenance of these data files. To remediate these issues, on line archiving has been introduced in the latest version of Microsoft Exchange. This offering facilitates the ability for the user to access archives through the on line web interface from any remote location. Ultimately the goal of initiating a regular interval of assessment by each user of their overall repository (live mail and archive) is recommended with the result of limiting risk and decreasing overall data management costs. 4 P age

5 Policy Recommendation: a.) Each employee will be provided with an on line Archive box limited to 1GB. This 1GB archive box coupled with the 2GB live mail box provides for a total of 3GB of on line storage. This storage space coupled with the active retention polices noted previously would provide an average user with considerable capacity for that must be retained for certain business purposes. Additionally, both an employee s live box and archive box could be centrally scanned as requested in legal and open records requests; greatly reducing the level of effort by IT and employees to provide required responses. b.) Automated quota warnings would be issued at 90% and 100% capacity levels within the 1GB online archive box. (Note: These warnings are separate and unique to the primary mailbox) c.) By default, archiving will not be turned on. The employee should turn on archiving for the specific personal folder they wish to archive. Default archiving policy tags will be provided by the system to archive at 7 and 12 month intervals. The user can determine at which rate they wish archiving to be performed per application of one of these default archiving policy tags. Archive policy tags can only be applied when using Outlook 2010 or the web interface ( d.) On line archive boxes are only accessible via Outlook 2010, Outlook 2007 (with SP2) and the online Web Access interface ( e.) Once an employee reaches their 1GB archive box quota they would have the following options: a.) Remove any unwanted within the archive to reduce the overall number of s, and/or, b.) Perform an EXPORT of the archive folder to a local file on their workstation. It is recommended that this exported (PST file) be stored upon the employee s personal enterprise storage folder for safekeeping and backup. AgriLife IT Helpdesk (FirstCall) will provide a support guide for performing the 3 step export function. Note: When on line archiving is enabled for an account the employee s Outlook client will no longer present a local archiving function. 5 P age

6 4. Relaying (External Contact, Rule Based) relaying is defined as the process of accepting inbound for a specific address and then redirecting the externally to a third party system. This process can be setup by a system administrator by establishing an external contact account, establishing an external federation with another mail system, or can be manifested by individual users setting up forwarding rules within their own mailboxes. Operationally, mail relaying creates an unnecessary and redundant load upon the mail system. that is relayed manifests twice the processing load for the system than an internally hosted mailbox. Additionally, the system performing the relay process becomes operationally accountable for any troubleshooting or incident remediation for the party the mail relay is being provided for. Recommendation: 1. External contact mail relaying or any other method of mail relaying will not be provided as a service option. Employees wishing to use the domains serviced by the AgriLife Exchange 2010 system will be required to host their mailbox account within the system and not externally. 2. Employees will not be allowed to set up automated forwarding rules to external mailboxes. Note: Per Texas A&M University SAP Private accounts should not be used for conducting University business. In order to satisfy its obligations under the Act, an audit, investigation, or official proceeding, the System may require an employee to disclose any messages residing in an employee s private account(s) relating to University business. An employee failing to comply with such a request from the University will be subject to disciplinary action, up to and including dismissal. 5. External Mail Contacts handling in Global Address Listing External mail contacts are listings in the Global Address listing (GAL) that provide addresses to external users on other systems. These listings only provide for an external user s name and address. Listing external contacts in the global address listing can provide convenience to internal system users communicating to external contacts. However, providing this feature without limitations or controls can create the opposite result by enlarging and diluting the organizational efficiency when utilizing the global address listing. 6 P age

7 Recommendation: 1. External contacts will be maintained in employee personal address books only. 2. The addition of any external contact listings must be approved by agency and administrative leadership along with business justification. 6. Accountability / Ownership for Generic Mailbox accounts Generic mailbox accounts are generally used for the purpose of receiving for a specific position or functional need within units. Typically these accounts are accessed by several individuals and are also used to respond to received in these generic accounts. While this model provides some convenience, it does not provide for accountability tracking as to which individual has sent or viewed s from the account. There is also a growing trend where generic mailbox accounts are used as either message and file repositories or as a project management / tracking mechanism. This use model perpetuates the long term storage of data within accounts thus potentially increasing the amount of data subject to preservation or disclosure in an official proceeding, request for information, or investigation. Such use also improperly positions the platform to provide services beyond that of transitory communication services. Recommendation: 1. Generic mailboxes will only be authorized by default when they will be utilized in lieu of an individual s personally named account (e.g. County Extension office account). 2. Alternative models include: a.) The use of externally accessible distribution lists that can be created to facilitate message distribution to multiple users or; b.) The assignment of an alias to an individual s personal account. 3. For functional models that require a physical generic mailbox to be shared between multiple users, a designated single accountable user must be designated. A form will be generated to track the account ownership to this user with all stated accountabilities. 4. All generic mailboxes will be limited to 250MB storage quota with all stated retention polices applied. No archiving functionality will be provided for these mailboxes. 7 P age

8 7. Users Eligible for Service The following entities have default access to an AgriLife Exchange account: Employed faculty and staff Employed (paid) student workers Graduate Students The following entities DO NOT have access or perpetual access to an AgriLife Exchange account: Retirees: Texas AgriLife Extension Service and Texas AgriLife Research have both deprecated continued service for their retirees. Emeritus faculty from within the College of Agriculture and Life Sciences Any exemptions should be routed through Agency or College Administrative offices for approval. Emeritus faculty can contact the following to procure services via TAMU Computing and Information Services (awaiting info from TAMU CIS on process for emeritus faculty signup) 8. Size Limitation The total size of any individual and its associated attachments are limited to 48MB. All s exceeding this limit will generate a notification to the sender stating that the was not transmitted due to this size limitation. This limitation has been established to stay in functional compliance with Texas A&M University standards and general standards throughout the Internet. 9. Attachment Restrictions The following file types will be blocked from transmission for the purposes of blocking various computer virus and system penetration attacks. These items are also detected and blocked within.zip or other compressed formats. Windows Executable files (.EXE)) MS DOS Executable files (.COM) Apple Executable files Executable and Linkable Format files (ELF) s containing files of these types will be blocked by the Sophos PureMessage agent. The sender will be automatically notified by that their message was not delivered. 8 P age

9 10. Quarantine Upon Virus Infection The AgriLife Exchange system actively scans for viruses within content and attachments. Any that triggers a virus alert will be quarantined. The Sender and the Recipient (both internally and externally to the organization) will receive an notice that the was not sent due to infection. Employees should contact AgriLife IT or their local IT resource to remediate Blocking due to Foul Language. Per Texas A&M University Rule M2 Section 2: Forms of expression that are not protected by the First Amendment, and therefore may be subject to censorship include obscene material, child pornography, or other violations of the law. The AgriLife Exchange system will block that contains extreme foul language transmitted to both internal and external recipients. The primary purpose of this approach is to block external s from sources soliciting or promoting obscene materials and content. Additionally this approach protects the image and standards of the AgriLife Agencies and the College of Agriculture and Life Sciences by blocking the transmission of with extreme foul language to third party entities. The following notifications would be provided per any that triggers foul language detection: In the case of being transacted between employees on the AgriLife mail system both sender and recipients will be notified that the message was not delivered due to foul language detection. In the case of being sent to an external (off system) recipient the sender will be the only party notified that the was not delivered. In the case of being received from an external (off system) sender the sender and recipient will be notified that the was not delivered. s that trigger the foul language detection will not be quarantined (or stored in any other manner) nor can they be re transmitted. Users should contact the message sender for retransmission. For the rare case where phrases triggering the foul language detection process are germane to the transaction of business or research communications exemptions can be made within the system for both external and internal addresses to allow the communication to take place. Exemptions will be facilitated through an on line exemption request form to be provided on the FirstCall helpdesk web site and will require employee supervisor authorization. 9 P age

10 12. GroupWise Archived Migration Policy The current deployment model with respect to GroupWise archives has been highly nonstandard across the organization. Typically users enabled archiving some years in the past and have not performed any active management of these an archives. Consequently large datasets of (an average of 400,000 s or more per employee) are retained in existing GroupWise archives throughout the organization. This existing environment has created an average of 4 to 8 hours of migration effort for each individual employee s archived throughout the organization. As suitable resources and fiscal reserves do not exist to migrate this level of archives the following policy has been developed to create a more efficient and logical approach to remediate the overall situation. The following recommendations do not apply to employees currently using a Microsoft Exchange based systems as their archive files require no migration effort. Additionally the following recommendations do not apply to units with local internal IT resources that may elect to take a different approach relative to internal faculty GroupWise archive files. However it is strongly recommended that all entities within the organization follow these recommendations to expedite their unit migration to the AgriLife Exchange environment. Recommendation: 1. No migration will be performed for GroupWise archived INBOX, SENT, TRASH, CALENDAR, CONTACTS folders. If exists in these folders that an employee wishes to retain they should copy s that reside in these folders to other folders within the Archive. Employees DO NOT need to delete any in their archive. If the employee does not have an archive or wish to retain any that may be contained in an archive they need not perform any action. 2. For all other folders in the GroupWise archive only mail within the last two years will be migrated. beyond two years from the date of migration by default will not be migrated from the archive. If an employee has legitimate need to keep beyond two years they will need to request authorization from their supervisor and provide to AIT prior to migration. 10 P age

11 If Approved: o o o The employee s archived will not be processed on the day of migration. The archive files and other data will be copied from the employee s system and taken to a central processing queue. The turnaround time could take from several days up to several months depending on the number of requests in the queue at any given time or the scale of retained within that individual employee s archive. Once processed, the migrated archive files will be provided to the user in the form of an Outlook.PST formatted files. 11 P age