tt.email-archiving ch1 final

1

• 05 Getting started

• 09 Gathering requirements

• 10 Selecting a vendor and a product

• 13 Implemen- tation and deployment

Email-archiving

INSIDE

Don’t get stuck when planning an email-archiving project. Follow these four phases for success.

CHAPTER 1

project roadmap

EmAil ARCHiving Planning, policies and product selection

Revised 06/2009

2

getting started

gathering requirements

Selecting a vendor and a product

implementing and deploying the product

mail continues to grow at an unprecedented rate. As server and storage resourc-es are taxed to their limits, the traditional practice of saving everything has been replaced with mandated quotas on storage. This

places users in email jail—where new email cannot be received until older email is removed from their inboxes. At the same time, a growing focus on email as a key element in litigation discovery compliance is forcing businesses to consider the negative conse-quences of deleting messages.

iT shops often complain about the time and effort (i.e., cost) re-quired to manage expanding email

systems. But the question remains: Why is the amount of email grow-ing so quickly?

• Users typically rely on email in their inboxes as a historical knowledge base or to support past decisions or actions they’ve taken.

• Users haven’t been given any guidance on what to keep, so the default is to save everything.

• Duplicate records are kept as a result of CCs and email blasts.

• Users receive and save email messages with large attach-ments.

Email-archiving project roadmap

Eby Kathryn Hilton With the

amount of email growing, enterprises must know where to archive relevant data and be able to produce that data in the event of litigation— or be prepared to pay the consequences.

chapter 1

chapter 1 Email-archiving project roadmap

3

getting started




struggling iT departments have responded with inflex-ible approaches in an attempt to contain storage costs, such as inbox quotas that limit the amount of email a user can store on an email server. inbox quotas often force users to go underground—moving messag-es offline into files like Micro-soft Outlook .PsT files or into other removable media. Once

users take email out of their in-boxes, messages are no longer part of a managed environment. The process of searching for, retrieving and deleting email messages also becomes much more involved and expensive.

email archiving continues to be the preferred method of addressing these growing chal-lenges. iT managers can store messages in a secure location that provides easy search and retrieval in response to litiga-tion or investigations. The risk of deleting email is minimized and employees generally are freed from quota limits.

Third-party tools help ad-ministrators retrieve archived messages. But before installing and using any email-archiving product, companies must un-derstand the consequences of using this kind of technology. When they understand the product capabilities, then prac-tical email-archiving policies

can be developed. email archiving, like any other

iT project, requires a fully de-veloped plan. This chapter will review the four-phased ap-proach to planning and deploy-ing a successful email-archiving project:

phase 1Getting started

phase 2Gathering requirements

phase 3 Selecting a vendor and a product

phase 4 Implementing and deploying the product

Inbox quotas often force users to go underground—moving messages offline into .PST files or into other removable media.


5

getting started




PhaSE 1: Getting started

All too often with iT proj-ects, technology solutions are selected without first receiving a buy-in from corporate users. it’s best to start by asking the right people the right questions so you can get a buy-in early in the process.

in addition, when starting out you must recognize several drivers for implementing an email-archiving project:

• storage costs• Litigation • internal or external

investigations • Compliance • Audit requirements All drivers are closely con-

nected, yet each appeals to a different segment of the busi-ness. Therefore, you need to include representatives from each segment of the organiza-

tion in every step of the email-archiving implementation.

The first step of the project is to form a Core Team, which should contain high-level stakeholders—iT department heads, records managers and legal/compliance experts. Make sure everyone has enough time to dedicate to the project and keep this team active and fo-cused.

This Core Team gives iT an opportunity to establish a posi-tive working relationship with legal. The legal group will be instrumental in providing guid-ance around functional require-

ments and policy management. More legal cases highlight email as the “smoking gun” that is costing companies millions of dollars in sanctions and judg-ments. Legal departments have become willing allies and driv-ers of the archive process.

Call on other contributors as specific issues arise. The HR department may have some input on issues like data pri-

vacy. Other departments, such as finance or product develop-ment, may have unique require-ments that must be addressed. if necessary, meet with these additional departments to get a

The Core Team gives IT an opportunity to establish a positive working relationship with legal.


6

getting started




full understanding of all require-ments. This might be the first time these people have met, so begin with a comprehensive explanation of project goals.

The first meeting should also include a general discus-sion on email archiving. Try to help everyone understand the scope and goals of the project, the challenges the organization is addressing and the need for getting the process right. Use this opportunity to

• Introduce key concepts, such as the definition of busi-ness records.

• Discuss what type of infor-mation is being stored in email and why controlling and classi-fying this information is impor-tant to the organization.

• Identify any special re-quirements. Find out if there are any data privacy issues around international deploy-ments vs. U.S. deployments. Are there any specialized regu-

figure 1: Typical batch-processing solution to email archiving

(Source: Contoural Inc.)

email archive server

Policy engine

Lower performance storage

exchange server exchange server

incoming email


7

getting started




latory requirements that must be addressed, such as the inter-national Traffic in Arms Regula-tions (iTAR) or the sarbanes-Oxley Act (sOX)?

• Discuss problems, such as the risk of deleting information and the risk of storing email messages in .pst files, with the current system.

• Tell the team where records reside and explain the need to produce relevant data quickly in the event of litigation.

For most organizations, semi-structured data and unstruc-tured data represent the biggest challenges in terms of meet-ing e-discovery requirements. e-discovery is the process of searching, collecting, reviewing and producing all relevant elec-tronic documents for litigation. Many archives now include so-phisticated tools for legal hold and discovery that make ar-chives more useful to the legal

team and help build support for the project.

Managing unstructured data has also historically been viewed as a huge storage prob-lem in terms of cost. However, addressing files has become an increasingly important driver in litigation readiness. Because of this, many archive product vendors have introduced capa-bilities to archive other record types from non-email systems, including file shares, instant messages and sharePoint docu-ments.

Archiving from these sources provides centralized search and retrieval and makes it easier to initiate a legal hold and en-force a records retention policy. Archiving email messages in a secure, centralized location gives legal the ability to manage the e-discovery process without having to involve employees or iT.

Most archive solutions pro-vide discovery tools that allow

legal to search for potentially responsive messages and at-tachments, place the messages on hold and then export the files for production. Without the archive, legal must rely on the employee to manually search for this information or have iT restore information from backup tapes. This inter-rupts normal business process-es and dramatically increases the risk of missing responsive information.

Archiving email in a secure, centralizedlocation gives legalthe ability to managee-discovery withoutinvolving employeesor IT.


9

getting started




PhaSE 2: Gathering requirements

For companies that are considering dedicated email archiving, there are two alterna-tives: in-house email archiving or a hosted solution. The in-house alternative for email ar-chiving uses internal resources and iT infrastructure to process and store archived email mes-sages. Most email-archiving providers fall into this category.

Hosted email-archiving prod-ucts are an option for compa-nies with limited iT budgets and personnel. Hosted solutions are also suitable for companies that don’t want to invest a lot of up-front money in a system.

in Phase 2, the Core Team must agree on these technical and functional archive require-ments:

• What email systems will it support?

• What is the volume of mes-

Functional requirements: High Med. LowCapture

Architecture

Classification

Retention management/disposition

Hold management & litigation support

index

search/retrieval

Reporting/audit/supervision

User interface

Administration

storage management

security

Information requirements

Performance requirements

sages that will pass through it daily?

• How are archive records

categorized? • How are legal holds en-

forced?

(Source: Contoural Inc.)

table 1: Developing email-archiving requirements.


10

getting started




Answers to these questions will help set the criteria for product selection. How com-plete this discussion is within the Core Team can determine the success or failure of the project.

Table 1 on page 9 lists key functional areas to consider when developing a full require-ments document. Rank each requirement according to its overall importance using this scale:

• High — a must-have func-tion

• Medium — a function it would be nice to have

• Low — a function that is not important overall

The Core Team should collect any additional company- specific technical requirements as well as information require-ments.

PhaSE 3: Vendor and product selection process

Once the requirements for the email-archiving project are well defined, product selection can begin. This part of the project can be intimidating, with ven-dors showing their wares and putting the best spin on them. it’s critically impor-tant to stick to the agreed-upon product requirements and not to allow vendor spin to redirect the process.

The first task in selecting an email-archiving product is to research available op-tions and to make a short list of potential choices. start with research reports from analysts, media outlets and industry conferences or events. These reports can narrow the list and bring to light new options.

Look at vendor websites and pay particular atten-tion to product feature lists. some sites allow you to access installation and configuration documenta-tion. Make sure that prod-uct support requirements outline all of the technical components of your com-pany’s infrastructure. don’t waste time looking at prod-ucts that can’t be installed in your environment.

sThe first task in selecting an email-archiving product is to research available op tions and to make a short list of potential choices.


11

getting started




Next, ask vendors to par-ticipate in a formal request for proposal (RFP) process. Out-line the requirements you’ve gathered and include details of the technical environment as well as projected growth. select three to five potential products, and send the RFP through ap-propriate channels—either vendors or their resellers. Make sure all vendors receive the same information. Give vendors a four- to six-week deadline to respond.

invite vendors that respond to give an on-site presentation outlining their proposals. The selection team—a group tasked with choosing the best tool—can then examine the proposal and ask questions about how the product will fit in its in-tended environment. expect presentations to last a couple of hours, and reserve a couple more hours for questions. Ask each vendor to provide a sam-

ple of its product for lab test-ing. eliminate any incompatible products.

By this time, you may have narrowed it down to only a few vendors. Let them know that your selection is imminent, and invite each vendor to install its product in a test environment to prove that it really works. Call each vendor’s technical support personnel to see how well they respond to your ques-tions. Be sure to test manage-ment applications and recovery procedures. Just because a sys-tem can save messages does not guarantee it is easy to use.

Ask potential vendors for customer references from both the customer’s iT and legal

departments. A good reference call can be more informative than any product demonstra-tion or pilot program. You have an opportunity to get real-world experiences from actual users of the product. Be sure to ask for the good and the bad. it’s also important to seek refer-ences that are customers of similar-sized enterprises and in similar industries or regulatory environments.

Notify all vendors of their status and invite the selected vendor onsite to kick off the implementation phase.

Ask potential vendors for customer references from both the customer’s IT and legal departments.


13

getting started




PhaSE 4: Implementing and deploying the product

The implementation and deployment phase will echo the structured process used throughout product selection. start with a pilot installation so that you can focus on a small subset of the environment. This should go smoothly, assum-ing that the product-selection process was thorough. Let the system run for a while to ensure it provides the required func-tionality.

divide the environment into logical segments for a phased deployment. Most likely, it won’t be practical to turn on the archiving system for the entire enterprise. This is not the time for product-configuration test-ing. instead, phased deploy-ment reduces the workload on the implementation team, which cannot be expected to turn everything on at once. it

also allows the team to repair any bugs found in the initial phases.

Create or update a corporate records management (RM) pol-icy for email retention. You can develop the policy in advance or in parallel with the product-selection process. Address the following questions:

• When should a message be moved from the inbox to longer-term and more struc-tured storage?

• When, if ever, should the company delete email messages from its system?

• How should the archive manage content according to established policies?

• How will records be classified? Records can be assigned categories and reten-tion periods can be managed based on multiple criteria.

• Should email be catego-rized in the archive manually through the use of managed folders that have specific reten-tion periods associated with them?

• Will you use auto classifi-cation, where email messages are automatically assigned categories based on content or metadata?

sCreate or update a corporate records management (RM) pol icy for email retention. Develop the policy in advance or in parallel with the product-selection process.


14

getting started




Kathryn Hilton has worked in technology for more than 20 years as an industry analyst for Gartner Inc. and for several large storage companies. Hilton received a bachelor of arts degree in business economics from the University of California, Santa Barbara, and a master’s degree in business administration from the University of Colorado Leeds School of Business. She is currently the consulting manager at Contoural Inc., a provider of business and technology consulting services that focuses on litigation readiness, compliance, information and records management as well as data storage strategy.

About the authorAs deployment proceeds, educate employees on the new system. They must understand the company’s policies for email archiving, including any new or updat-ed policies and procedures associated with the new email-archiving system. in many cases, email-archiving systems remain transparent to users and eliminate email quotas. Train users on avail-able features.

Once the system is run-ning, audit its performance through a series of tests. Create a plan that tests the system thoroughly, includ-

ing recovery of message sets. ensure that the number of messages entering the system is the number that’s expected. Be sure that de-leted messages are removed from the system.

When planning an email-archiving project, consider all potential business drivers The product that is even-tually chosen should help ensure policy compliance, reduce the time it takes to archive messages and lower the cost of the litigation discovery process, enhance productivity and decrease storage costs.

SearchExchange.comCathleen Gagne, Editorial Director, [email protected] Semilof, Executive Editor, [email protected] Boisvert, Features Editor, [email protected] Moore, Copy Editor, [email protected] Koury, Art Director of Digital Content, [email protected] Brown, Publisher, [email protected] Larkin, Senior Director of Sales, [email protected], 117 Kendrick Street, Needham, MA 02494; www.techtarget.com

tt.email-archiving ch1 final

Documents