Have a well defined and detailed calculated business case.
Organizations are facing various challenges to take back control and unlock the business value of content, especially in emails. Four challenges drive the business case for email management:
In your business case, you should state the cost savings for annual storage increases, maintenance, licenses, and data center costs. Maybe you save license costs due to decommissioning. For the case of compliance, you should state the costs of eDiscovery minimum for the last two years and the savings. Input factors for calculation, for example, the number of discoverable custodian mailboxes, the number of eDiscovery events per year, the cost of IT including administrator work, the cost of tape restoration, and the cost of attorney services.
Besides these quantifiable benefits, there are also qualitative benefits, including improved search facilities. These benefits should not be underestimated.
Have the right stakeholders on board.
A project for message archiving affects the entire organization. The solution needs consensus and corporation of at least three departments: IT, legal/compliance, and business. Unfortunately, they often fail to communicate effectively with each other and within the department. Historical communications barriers must be broken down. A new understanding of the roles and responsibilities of all stakeholders must be set up to gain senior management support. At most, they discuss topics of budget, retention, and disposition or policies/procedures.
Stakeholders should be aware of their requirements.
Stakeholders should structure their requirements in functional, legal, and technical requirements. The requirements must be weighed between “must-have” and “nice-to-have.” Typical primary categories for functional requirements are capture, attachment handling, indexing, search/retrieval, and offline support. Support of legal hold and supervision are examples for requirements of the Legal/Compliance department. Questions of architecture, integration, security, and confidentiality are raised by the IT department during the evaluation process of a vendor solution.
Have a policy in place.
In 2008, BearingPoint conducted a survey on email management among 500 companies in Germany, Austria, and Switzerland. One key finding was that email management is more than saving storage costs! The most important aspects are
Only 22% of the participating companies responded that they had companywide policies. Existing policies covered the use of private emails (67%), mailbox size (62%), and offensive content (53%). Monitoring is centrally organized (50%). The Chief Information Officer (CIO) is responsible for preparing and monitoring the compliance of rules (37%).
The policy for email archiving should be developed by all stakeholders. It should contain goals, aspects of usage and allowance, legal issues, ownership and security, retention, and disposition.
Think about retention and disposition.
Companies that start email archiving projects can be divided into five categories. On the one extreme, some companies allow their employees to keep all emails forever. On the other extreme, there are companies that force the deletion of every message. Between these two extremes, there are companies that try to manage their emails. The most common method for this is “restricted retention.” With this approach, companies limit the number of messages a user can store. Another approach is “risk-based retention.” Based on the risk that an email will have to be restored due to legal obligations, different categories are set up. The last method is “context-based retention,” where emails are classified based on their context. Emails within that category are archived with the document of the same type attached, e.g., an email containing contract information is stored with the contract.
The leading industry practice approach is something between the risk and context-based approaches.
Perform a Proof of Concept and Reference Calls.
For evaluation of the proposed solution, it is helpful to perform a Proof of Concept (PoC) with at least two vendors. The objective of a PoC is to ensure that the technology will work in the client´s environment and to test certain features and functions, which have been proposed. Therefore it is absolutely necessary to describe scenarios based on the functional, legal, and technical requirements. For example, how is the archive process done manually and what do the user search process and interfaces look like. The legal department will be interested in legal hold and export functionality, for example. The IT department might discuss security and architecture issues in a workshop. The IT department will suggest a bulk archiving test with tons of messages in order to get an indication for sizing, performance, and scalability.
The PoC could be accompanied by references, visits, or at least reference calls with customers having the same challenges. It is helpful to develop a clear and structured questionnaire with your heaviest concerns. The results are part of the evaluation.
The PoC should be limited to a fixed duration of days with a presentation in front of all stakeholders and/or the senior management team.
Consider hosted SaaS model as an option.
Remotely-hosted or outsourced Software as a Service (SaaS) solutions for email archiving can help lower an email archive’s financial need and complexity. However, you may face some lack of functionality, and companies still have concerns about a compliance-driven deployment for an on-premise email archiving and eDisovery solution.
Include other content types for archiving.
Under the amendments of the US Federal Rules of Civil Procedure, not only email is relevant to litigation and eDiscovery. Other content types like files on shares, structured data in databases or business applications will become important for eDiscovery. So your former email archiving strategy must be broader, and your solution must cover these aspects.