Email Retention

Just about all organizations archive emails, but how many of us retain email? With archiving, you might keep emails forever. With an email retention policy, however, you are setting up specific times that various types of emails are kept before being automatically deleted. And the decision on how long to retain these documents can be impacted by laws or regulations. If you don't have an email retention policy, this week's articles may be of help in getting started on one.

Learn about email retention policies and how to determine which policy is right for you. (Item #1)   A retention policy for electronic information defines how long the information should be stored until it's deleted. (Item #2)   One of the thorniest issues of records and information management is how to address e-mail. (Item #3)  

Does your organization require an email retention policy? (Item #4)   As email's storage role grows, so too does its evidentiary value, making the need to formally retain, effectively archive, and quickly search and produce email business records essential business functions. (Item #5)   Here's a sample email retention policy you can use or modify. (Item #6)  

As always, we look forward to hearing about your concerns with regard to business continuity. Thanks to John Rodrigues, Vice President of Information Technology, National Association of Independent Schools, for suggesting this week's topic. If you have a topic you'd like us to cover, email me at [email protected].

Bob Mellinger, President
Attainium Corp

1. Email Retention Policies: What You Need to Know

So, what's the difference between email archiving and email retention? After all, if you're archiving, aren't you also "retaining" your email? True--in a way. Archiving is more of a practice; retention is more of a policy. PC Magazine defines email archiving as "retaining email messages for historical purposes or to be in compliance with industry regulations." The publication defines email retention as "a policy that helps companies comply with industry and government regulations by allowing their administrators to determine how long an email should remain in the system before being automatically deleted."
http://www.optimalnetworks.com/email-retention-policies-what-you-need-to-know-2/

2. Setting Retention Policy for Electronic Information: A Practical Guide

Legal and regulatory pressure is gradually driving organizations to define and implement proper retention policies and procedures for electronic information. Large, highly regulated organizations are in the lead. But even in such organizations, the situation is a mess, with arbitrary retention periods applied to many types of information. This white paper presents practical recommendations for organizations wishing to define and implement retention policy for electronic information. It also describes the current state of retention policies, so an organization can compare its status with that of its peers.
http://www.ironmountain.com/~/media/Files/Iron%20Mountain/Knowledge%20Center
/Reference%20Library/White%20Paper/S/Setting%20Retention%20Policy
%20for%20Electronic%20Information%20US.pdf

3. Seven Factors to Consider Before Creating an Email Retention Policy

A number of years ago I was asked to advise a client what factors it should consider regarding e-mail retention. The considerations are the same today as they were when I first advised this client. They are: business needs, legal requirements, organizational culture, approaches to retention policies, litigation holds, automation, and implementation.
http://www.d4discovery.com/2013/06/7-factors-to-consider-before-creating-an-email-retention-policy/#sthash.lyDxfdFG.dpuf

4. Email retention policy in the workplace

Whether it is to meet operational needs for litigation readiness and eDiscovery, for compliance reasons or end-user liability, to save costs, or to solve other issues that come with corporate email communication, an email retention policy is always a great asset to help manage, store and archive corporate email messages. Even more so when research estimates that up to 75% of email content is considered critical to the successful operation of an organization.
https://www.gfi.com/pages/email-retention-policy

5. Email retention and archiving

Many employers find themselves drowning in email-related risks as they struggle to manage the use--and curtail the abuse--of what was originally conceived as a time-saving, productivity-enhancing technology tool. An increasingly litigious business environment and heightened regulatory oversight bring new and potentially costly challenges to corporate email systems. In spite of the risks, however, many employers have yet to adopt best practices, policies, and procedures to ensure the successful management of corporate email and electronic business records.
http://www.symantec.com/content/en/us/enterprise/white_papers/b-email-retention-and-archiving-WP-21169199.en-us.pdf

6. Email retention policy

The SANS Institute has created a sample email retention policy that anyone can use or modify. If you don't have a policy, this could be a good starting place for you to create your own.
http://www.sans.org/security-resources/policies/email_retention.pdf