Managing Organizational E-mail
One of the major issues facing every organization today is the constantly increasing volume of e-mail. Until recently, ad hoc approaches have been taken, but with growing compliance requirements (e.g. Sarbanes-Oxley Act, HIPAA, SEC, U.S. Patriot Act, ISO, FDA) and the importance of e-mail discovery, organizations are focusing their attention on implementing enterprisewide, comprehensive solutions.
These solutions must be based on the organizations' retention plans and must manage e-mail in accordance with its content ... NOT based on the fact that it is an e-mail.
E-mail Records Management Requirements
Virtually every organization must be able to perform the following functions in order to correctly manage "e-mail documents of record":
- Uneditable originals. Certain documents must be provably locked down as un-editable originals.
- Disposition hold. When litigation or regulatory review occurs, an organization must place the retention of all related electronic and physical records on hold.
- Centralized retention rules. The organization must be able to set up centralized retention rules which:
• define when and under what circumstances documents can be archived or destroyed;
• match all of the organization's retention rules; and
• integrate with numerous systems (e.g. human resources, accounting etc.) in order to correctly determine when retention is applicable.
- Audit trails. Some form of audit trail must exist.
- Search. The organization must be able to search for and find these e-mail documents of record.
E-mail is a "document of record," no different from a signed paper document on company letterhead. Therefore it must be managed in accordance with the organization's records policies and procedures and the organization's retention plan.
Varying e-mail management requirements of different departments within an organization make this issue quite complex. The three major categories are:
1. All of a group of users' e-mails are managed as records;
2. All e-mail relating to a specific business process or from specific external users are managed as records; and/or
3. Selected e-mail are managed as records.
It is important to note that since most organizations contain at least two if not all three of these categories, an e-mail management approach based on a single method of capturing e-mail will not meet all the requirements.
E-mail Management Solutions
The three classes of e-mail have their own e-mail management challenges requiring different approaches:
Class 1: All e-mail is captured. The best solution is to automatically capture all the e-mail without user intervention. Many organizations believe that since all e-mails need to be retained, they need to be retained forever (or for a certain period of time), irrespective of their content. This assumption is incorrect and can lead an organization into legal or regulatory problems and most certainly to discovery problems.
Retention must be driven by the organization's retention schedule, which is often subject-matter dependent. Furthermore, as discussed earlier, the e-mail relating to a specific subject matter must be retained for the same period of time as physical records (e.g. letters, signed documents or correspondence) or other electronic materials related to the same subject matter.
Class 2: Manage all e-mail for specific business requirements. The e-mail needs to be captured based on key information contained within the e-mail header, including address information (To, From, CC, BCC) and subject-related information or other markers. It is important to note that attempts have been made to auto-classify e-mail based on words or phrases in the content, but this is not yet possible due to the complexity of the English language and may lead to potential misfiling of e-mail.
Class 3: Selected e-mails are managed as records. Employees need an easy-to-use method of "dragging and dropping" e-mail into the correct records folders.
The only way an organization is going to meet its e-mail management requirements is to implement a system that can capture e-mail correctly for each of these three classes. At a minimum, the solution should:
- capture all e-mail for selected users and store it according to the organization's records plan based on key information in the e-mail. This is best done by a server-side rules engine;
- capture all e-mail for specific business requirements by searching for key information and storing the e-mail into the organization's records plan. This can be done either by a server-side or a user-based rules engine; and
- allow users to—with as few mouse clicks as possible—place selected e-mail into the organization's records plan. This should be done within the e-mail desktop based on the native look and feel (i.e, dragging and dropping e-mail into folders within Outlook or Lotus Notes).
The three different classes have differing requirements for how the e-mail is captured, but on the back-end all the e-mail must be managed consistently. Furthermore, the same records functionality must be applied to these e-mail records as is applied to all of the organization's other documents of records.
For more information about this topic, please contact MDY Advanced Technologies, Inc., inform@mdy.com or visit MDY's website.
MDY Advanced Technologies, Inc. is a leading provider of both records management and systems integrations solutions. FileSurf®, MDY's signature software, integrates all physical and electronic files—including e-mails—regardless of media type, source of origin or storage location, into a single, scalable and extensible enterprisewide system, and manages the documents and files according to government regulations and organizational policies. FileSurf is certified by the U.S. Department of Defense (DoD) 5015.2 (Chapters 2/4) Standard for records management software. MDY's unique mix of software plus services gives organizations a single point of accountability in gaining complete control over their information management needs.