The 2009 Email Archiving
B
B
e
e
s
s
t
t
P
P
r
r
a
a
c
c
t
t
i
i
c
c
e
e
s
s
G
G
u
u
i
i
d
d
e
e
12 Ways to Improve Your Business
with Email Intelligence
Topics Covered:
Executive Summary
The Problem: Unmanaged email usage, un-enforced policies, as well as the inability to easily and effectively retrieve email records on demand, are the major email related problems that get organizations into trouble and can cost thousands, if not millions, of dollars.
These are the top business issues in this area: • Email Storage
• Legal Discovery, Research and Investigations • Regulatory Compliance
• Email Security and Policies
• Productivity, Monitoring and Policy Enforcement
The Solution: This paper will provide executives and IT management with a better understanding of exactly how to make better use of your email assets in order to help reduce costs and risks, while improving business decisions, processes, customer service, productivity and even increasing revenue. Regardless of the software vendor you choose to address these issues, this paper will present the 12 Best Practices that you should be able to implement with any reputable email archiving vendor on the market today. The Best Practices that we have developed are based on feedback from working closely with email archiving customers over the last 5 years. The majority of these best practices revolve around the main roles within a company that can leverage an email archiving system:
• CEO
• Mail Administrator • Corporate Legal counsel • Compliance Officer • HR Director
• Department Managers
We also will provide definitions for various terms related to this technology so that you can better understand the key benefits when evaluating various software products. In addition to the definitions, and Best Practices, we also will provide some Key Questions for executives to ask their management regarding email compliance, storage, retrieval and security.
After reading this white paper you will recognize that Email Archiving is not simply about email, but that it is more about leveraging an untapped wealth of Email Business Intelligence to improve your business.
Introduction:
We have chosen to present the Best Practices organized by role within the company. This will provide the executive with a good overall picture of how email archiving impacts his company operations in many areas, while also providing specific chapters to several key managers who can take advantage of email archiving solutions themselves.
Best Practices for the
CEO
#1 – Establish a Culture of Compliance:
As CEO, part of your responsibility is setting the tone for company integrity, forthrightness, professionalism, transparency and inspection. This is no more important than when regulatory auditors come to inspect operations and records management practices. However, even in private, non-regulated companies this is important to accomplish as well.
• Improved Reputation: When regulatory auditors, the board of directors, investors, suppliers or even customers arrive to inspect your operations for whatever reason, it will make a major difference if you are a company trying hard to hide flaws, inefficiencies and
questionable behaviors, or if you are a company that is up front, open and inviting to inspection. Regulators tend to not examine so
rigorously the latter type companies, if they get the feeling that
everything is in order from top to bottom. Yet this is only accomplished if the leadership is committed to that as a goal. This type of culture has to start at the very top of the organization, and be enforced and rewarded from the top as well.
• Improved Integrity and Security: As a company strives for compliance and continuously optimizes their policies, they are much more likely to have a higher level of information security and employee productivity.
#2 – Use Email Intelligence to Grow the Top Line:
The best executives have a way of being “plugged in” to their company. Whether they walk the halls and spend time talking with employees at every level, or invest in massive data warehousing technologies, they seem to have extra insight and intelligence about their company in order to have the best possible perspective when it comes time to making decisions and leading their
Email is the rich documented history of the company. The archive intelligence reports turn this data into actionable knowledge for
and market data. But the latest source of data for customer and business intelligence is in the daily mass of email communications between your
employees and your customers, partners, and suppliers. Being able to tap into this source, pull reports from it and make inquiries into it instantly is
accomplished through implementing a robust email archiving and reporting solution.
• Improve Customer Intelligence: Without having to wait for the weekly or monthly sales reports, managers can search for and find all the emails to and from specific customers for any time frame, or containing any key words. The search result would be a detailed chronology of communications and negotiations that could be studied for insights and opportunities to improve service or create new deals. • Improve Project Intelligence: In the same manner of search by
project name, case number or key word, a projects detailed chronology would be available to analyze or share with authorized users. A common need to share project papers when a team member is unavailable can mean the difference between winning or losing a contract.
• Improve Workforce Intelligence: When management understands the details, motivations, and the outcome of decisions at every level there is an exponential increase in understanding how and why your organization is moving in the wrong direction. Being able to see these patterns and influences can give an executive great perspective on exactly what to change to make improvements. This is real power that has never been drawn from email data sources before.
#3 – Ask Key Email Risk Questions Quarterly:
In addition to these risk based questions, CEOs should also be asking
opportunity questions to every senior manager, such as “How can we become a smarter business by utilizing email intelligence in your area?”
CIO:
• Who are our top email users? • Who are our top email abusers?
• How do we ensure information security via email? • How can we better enforce and tune policies?
• How much money do we spend on spam solutions compared to email risk management?
• How often has intellectual property been sent to unauthorized people? How can we better protect it?
• How are we educating our employees about email policies? How do we ensure they understand the policies?
• Do we quantify risks from employee use of email? Corporate Attorney:
• How many legal cases have requested email records this year? • How long did it take to find all relevant emails?
• How do we protect Intellectual Property from being emailed to unauthorized users?
• How many emails have been sent externally that contain the word “sex” or “confidential”?
• Has email content ever contributed to the cause of a lawsuit? • Have we ever had to settle a case because the time and expense of
producing email discovery was higher than the settlement? • What is our email retention period for email and why? • What is the cost of finding emails today?
Compliance Officer:
• How many compliance audits have we had? How many have requested email records to be produced within a week? How fast can we find and produce emails for audits?
• What controls are documented for email usage and policies? • Which regulations is our company subject to?
• How many company transactions, contracts and approvals are done using email only?
• How is the code of ethics monitored in email? Director of Human Resources:
• How many investigations have you performed this year? • How many required find and producing email to prove or disprove
something?
• Were you able to find emails yourself or did IT have to gather them for you?
• What is the process when a policy breach is found? • How long did it take to find all relevant emails? • What is the cost of finding emails today?
• What would happen to our stock price if a confidential internal email was leaked?
• Who has sent the financial reports “Revenue Forecast” outside the company during a blackout period?
• What is the overall cost of storing and retrieving emails without an email archiving system?
• How much did we spend on legal discovery costs in the past year?
• Did we settle litigation because the discovery costs for us were too expensive?
Board of Directors:
• How important is having a company that proactively monitors email activity for policy breaches, non-work related emails, or inappropriate materials?
• How valuable is having a competitive advantage that leverages the collective knowledge within company email?
Best Practices for Your
Mail Administrator
#4 – Deploy Email Archiving software:
The best way to reduce your mail store size is by archiving older email and/or attachments and removing it from the active mail store. Email archiving solutions perform this function in various ways depending on the vendor’s technology. Emails can be copied, moved, or “stubbed”. On a regular basis the email store is swept looking for candidates to archive. With compliance solutions, every new email that is sent or received will also be copied to the archive. The main benefits of email archiving for the Mail Administrator are:
• No more PST or NSF files: .PST or .NSF files are a short term fix that are created by users when they hit their allotted quotas. However, they cause many problems when it comes to trying to find historical emails, or be in compliance with regulations and retention policies, especially if employees have left the company and destroyed or taken their files with them and they can easily be corrupted. The
organization has no control over where they are stored, what is in them, who owns them or if they are retained at all. All .PST and .NSF files can be collected and imported into the archive so they can be indexed and easily searched when needed.
• No more quotas: Quotas are usually implemented because of the limited amount of storage space a mail server can hold or be licensed for. Once the vast majority of the live emails are archived onto a separate location, it will free up the active mail server to hold much more email, thus eliminating the need for storage quotas. This will discourage users from creating .PST or .NSF files, (or you can disable their ability to create them) and will allow the organization to better control and manage their email business records.
• Improved mail server performance: Additionally, when the mail server is running close to the limit of storage space, it begins to affect performance. After archiving emails, depending on the parameters decided upon for what to keep live on the mail server, the storage should make it significantly below the server capacity, improving performance overall.
Hitting email
storage limits
#5 - Delegate Archive Access:
The mail server interface is not built for ease of use in searching and retrieving emails, so it is not efficient or practical to allow access to managers. However, with email archiving software, the interface is built for ease of use in searching emails, even across multiple accounts at the same time. The benefits of allowing authorized line of business managers to search and retrieve emails from the archive are:
• Reduce IT workload: Some companies request that their IT
department locate emails a couple times per month; other companies request it several times per week. Many times these requests are because one member of a Project Team or a sales executive is out of office and their colleague or manager needs an email to close a sale or resolve a priority issue. These requests are not usually built in to the time most IT departments allocate for their staff. These requests take away time from other projects, and are not a core competency of an IT staff. It is more valuable to have the appropriate line of business manager perform the search themselves, because they know better what to look for, they can browse and just look for things that look interesting or odd. Also, they will be able to become familiar with what kind of information is in the archive and what is not, further improving efficiency of searches in the future.
• Enhanced Privacy and Confidentiality: When IT staff performs the searches, they will be reading not only just the emails that are being requested, but also many other emails that are on the way to finding the right ones. This has implications for privacy violations, especially because IT staff is usually not management level yet will have access to their peer’s information. By allowing access to the line of business managers, they can maintain the privacy and confidentiality of the people being investigated.
• Improved management visibility: Legal counsel or HR were very often the main requestors of past email records for legal proceedings or investigations. However, by allowing departmental managers access to the company email archive, this opens up a new opportunity for managers to have more inputs to the supervisory function. In the same way that managers often look at call reports or listen in on customer service phone calls, they will now be able to assess job performance on a whole new set of metrics. There are many reports that can be created to show email frequency, timing, how quickly email is read or processed, as well as qualitative reports on personal emails, and policy violations.
It is not the role of Mail Administrators to retrieve emails on request or to interpret email actions. It is their role to put a system into place that
allows
Best Practices for Your
Legal Counsel
#6 – Utilize an Archive to Retrieve Emails Faster:
Some attorneys do not even realize they can have access to historical emails for evidence, discovery or investigations. For most of them, the request for discovery of emails from a subpoena or from internal investigation is so painful a proposition that their IT staff do not even consider it as a viable option. The time it takes to perform these requests are measured in weeks and months and the cost is measured in tens or hundreds of thousands of dollars. (Some companies reported that manual searches cost approximately $4,000 per located email). When a company implements an email archive the time suddenly goes to minutes, and the cost is negligible. The benefits of having immediate access to an organization’s email archive are numerous:
• Avoid Court Penalties and Government Fines: Now that courts are aware of the technology that allows the production of email records, more judges are granting requests to produce emails related to a case. When these requests are ignored, or not complied with, there can be severe consequences. It will not matter to the court that the emails are difficult to find, or that it will cost a lot of money to produce them. • Save time and money: Hiring outside contractors or firms to find
email files is very expensive, averaging $500 per hour or $12,000 per gigabyte.
• Improve Case: IT staff that does the tedious searching often returns with “everything we could find”. However, IT staff may not know when they run across something important that they weren’t looking for. These kinds of discoveries could make a big difference in the outcome of every case. With the ease and speed that legal staff can search email archives, they can stop spending so much time hunting down emails, reviewing them and refining searches, and instead spend much more of their limited time preparing for their case. They will have more time for analyzing the emails, the context and patterns of behavior that is more valuable to their case.
• Avoid Settlement Costs: Many cases are settled because of simple economics. Attorneys know how painful and costly it has traditionally been to produce discovery materials. If their calculation of costs to find the materials is higher than the cost of a settlement, then they will
Legal
professionals now have a tool to help them be more efficient and focus more on the higher
level analysis
settle, even if they had done nothing wrong. Having easy access to email archives can improve ability to produce discovery and reduce settlement costs and burdens.
• Better Case Management: Email archiving systems will allow legal professionals to perform many grouping, labeling, and output
functions. After preliminary searching, the difficult work of reviewing, sorting, and prioritizing the discovery document begins. Being able to perform searches by groups of users, labeling saved searches, labeling specific emails with custom tags, and being able to save onto various media or to print sets of documents will save time and improve the quality of the results.
#7 – Mine the Email Data:
Very few companies would think to have their legal staff spend time browsing through their email archive when not related to an active case. Yet that is exactly what legal professionals should be doing on a regular basis.
• Improve Risk Intelligence: Legal and HR professionals would be wise to browse the email archive periodically to spot suspicious activities that could be indicators of weak policy, inappropriate
employee behavior, or in some other way puts the company at risk. If there are illegal activities, inappropriate materials, uncontrolled intellectual property, trade secrets mishandling, or proprietary
Best Practices for Your
Compliance Officer
#8 – Establish Process for Email Capture, Retrieval
and Monitoring:
One of the main reasons for regulations in the first place is to provide visibility into operations, including outside auditors. This is the reason why it is critical to be able to keep records of how decisions were made. Since email has become such an integral part of the business decision-making process, it is necessary to capture every email that may have impacted business decisions. At any point in time, a company needs to be able to reconstruct the decision basis from the records of the company, so it is imperative to be able to find email records from any person, and to be able to search for specific words.
• Beyond Compliance: Having the process that keeps a separate, easily accessible archive of all emails for regulatory and auditing requirements, and allows for instant retrieval, will allow companies to more easily be in compliance with most regulations. And maybe more importantly, the reporting aspects of archive solutions allows easy analysis of email traffic and behaviors to monitor email use.
• Business Improvement: With the ability to review and analyze email records, management can easily spot trends or suspicious patterns of behavior. This can be an early indicator of activities that may harm the company or its customers. Good compliance programs will enable the company to go beyond just archiving emails; you should be able to leverage the data for business intelligence, better decision making and risk reduction.
#9 - Maintain Audit Trails:
Improving internal controls, enabling better processes, and being able to enforce corporate policies will make your company much more likely to be in compliance. Being able to identify audit trails of who accessed which email records, when and for what reason, should be tracked by your email archiving software. You should be able to produce detailed and summary reports for audit trials, especially for patient or financial records. This provides your company with assurance that there have been no unauthorized changes to the data, and that privacy and security measures are in place, which is especially critical when dealing with HIPAA regulations.
Best Practices for Your
HR Director
#10 - Enforce Email Usage Policies:
Typically, HR is the department thought to be in charge of creating and enforcing email policies. But without the right tools to manage this process, the task is essentially ignored. By relying on an email archiving and reporting system, HR managers can get true visibility into how polices are being broken, and by whom.
• Better Employee Management: Combining an advanced reporting engine with an email archiving system is the best of both worlds. There is a wealth of information that can be learned from information contained within the emails. Companies can see who is sending large attachments to too many people, who is sending too many emails to their friend’s hotmail accounts, even who is sending confidential information to unauthorized users. HR can really begin to see patterns of behavior or suspicious trends that need to be investigated. Once problems are made visible, it is easy to prevent email abuse or re-educate users and overall improve the ability to manage a new aspect of employee performance.
• Better Security and Policies: After reviewing email for some time, HR managers will also learn that some policies are being broken, but also that new policies will need to be written. This cycle of creating, adding and changing policies to reflect the needs of the business and realities of employee behavior is a continuous optimization process that will continue over time. Make sure that new policies are appropriate for your industry and your company culture. Make sure that your policies are well distributed and that employees know what they are and what the consequences of breaking a policy are.
#11 - Perform Investigations Directly:
It is often the HR department that will spearhead investigations of employees suspected of questionable email usage or wrongdoing. It is very common for HR to take the lead in researching inappropriate behavior complaints or whether a policy has been broken. However, a balance must be achieved to not violate that suspected employee’s right to privacy and fairness, while resolving the matter as quickly as possible.
HR can put teeth behind policies with access to email reports. Visibility into email patterns can yield better management
• Better Confidentiality: By allowing HR managers to have access and an easy search interface to the corporate email archive, they bypass handing off the request for email research to the IT department. This saves the IT department from using technical resources to accomplish an employee relations function, and it allows the company to protect the privacy of the individual from non-HR management. It also eliminates the need to “browse” through employee’s potentially personal emails.
Best Practices for
Departmental Managers
#12 – Review and Monitor Employee Email:
Most companies do not think about giving direct access of email archives to department managers because of privacy issues, or because it would involve too much training on how to use the archive software. Honestly, email archiving software should not be that difficult to use; it should be as easy to use as Google. Legally, in the US, there are no laws preventing employers from reviewing business emails as long as they reside on corporate computers and networks. It is a major underutilization of business assets to not analyze employee communications and trends. There are many benefits when access to the archive is given to departmental management.
• Control Communications: Every employee in your department sends and receives dozens of emails each day, some to and from other employees and managers, some to and from partners and some to and from customers. Ever wonder what is being said, how your company is being represented, how customers are talking to your company? With direct access, managers can browse through email communications or search by keyword and read the email strings about a major project or customer implementation and get first hand understanding of the issues, how your employee is being perceived and more importantly how your company is being represented to customers, suppliers, partners and possibly the press.
• Improve Employee Productivity: One of the first benefits of email monitoring is the positive impact it has on controlling non-work related emails. Once emails are captured, stored and reported on,
departmental managers have instant access to how their own
employees are using email. Those users who have a high frequency of email volume get noticed because they rise to the top of the reports. Right away you can spot the users who are typically wasting time on personal chatting over email. Once the first few people are given notice, they usually shape up and word soon spreads that emails are being managed. Inappropriate content is a major concern at many companies, because it is so easy for images to be sent around, and is a cause for many complaints, such as sexual harassment claims and lawsuits. Non-work related email volumes will reduce, as will digital photos, MP3s, and movie files sent as attachments.
Managers should
monitor email
conversations
the same way they listen in on customer phone calls for training and customer service
Summary
Email is not just a communication medium anymore. The future of email is that it will become a knowledge repository, rich with facts, opinions, judgments, brand reinforcements, customer relationship indicators,
transactions, forecasts and reports. It is content that can be associated with movements and timing. All of this data can be mined for better visibility into what exactly goes on in the organization, what opportunities there are to improve relations, expand sales opportunities, retain valuable customers, improve partnerships, and make better decisions based on this intelligence gathered over time.
A smart organization should know how to take advantage of a new data source, especially one that grows daily. The first step is to implement a technology that captures email content, easily search through it, reports on trends and patterns, and performs detailed research for audits and
investigations. The second step is to actively use the archive by management to gain visibility into never-before-seen data and analysis. The final step is to apply this new intelligence to making better decisions at every level of the organization.
Email archiving solutions and business intelligence solutions deliver added value to organizations that deploy them.
What To Do Next
Now that you are aware of some of the Best Practices involving Email Archiving, you should make sure that every executive in your company becomes more aware of the risks that email poses on a daily basis. The next thing to do is research the archiving and reporting solutions you think are most applicable to your organization, and make a purchase decision based on which vendor will provide the best functionality for your needs and the most value for the investment.
For More Information
For additional information on Email Intelligence, Archiving, Compliance, Discovery or Storage solutions, please visit the MailMeter website at
http://www.mailmeter.com
Email: [email protected]
Waterford Technologies is the leader in Intelligent Email Archiving solutions. The MailMeter product family provides solutions for several sets of common business problems. All solutions are based on our high-performance archiving architecture, our robust and flexible reporting platform, and our customer focused, easy-to-use interface. MailMeter securely stores all incoming, outgoing, and intra-company emails, header information, subject lines, domains sent to/from, file size, folder names, attachments and even body text, in an archive for easy and fast search and retrieval.
MailMeter Archive
MailMeter Archive is our solution for many business problems that require email archiving, such as regulatory compliance, email investigations and research, and email storage problems. Once email content is archived, there is so much more business value that can be leveraged from this resource that using your archive only for compliance is an incredible underutilization of your assets. Email is a strategic business asset that should be understood,
managed, analyzed and used as a business intelligence advantage. An organization that understands what is going on with email communication trends and patterns can make better corporate decisions, better manage employee performance, and better enforce policies. There is a high strategic value in implementing this product in today's world, as well as an immediate tactical value of simply being "in compliance".
MailMeter Compliance Review
MailMeter Compliance Review is an advanced Email Archiving and Management solution that captures all email from your corporate mail server, ensuring all inbound, outbound and internal message content and attachments are fully captured. This secure and complete email archive can be used for many purposes, including complying with regulations such as Sarbanes-Oxley, GLBA, SEC-17, HIPAA, Freedom of Information requests, self audits, records
retention or investigative needs. We believe customers should not have to pay enterprise level prices for an enterprise level solution. We are allowing our customers to avoid spending tens of thousands of dollars, while getting in compliance in a much faster time period.
MailMeter Investigate
MailMeter Investigate is our high-end investigative and reporting solution for companies that need to perform in-depth searching and analysis for
email with original formatting. Legal and HR departments will be surprised at what they can learn using MailMeter Investigate and reports. This can be used for performance reviews and to find email abuse and the liabilities that are created within the company.
MailMeter Insight
MailMeter Insight is our powerful reporting platform that provides
management with never-before-seen intelligence into corporate email activity, usage patterns and trends. Managers can view high-level reports with drill-down capability to become better aware of how email is used by their staff, where it poses a risk to the organization, and what action to take to avoid liabilities. This product is perfect for managing compliance, enforcing policies, and can be used to monitor employee non-business emails to improve productivity. You will be surprised at how much exposure there is floating in your email system right now. With MailMeter Insight, you can see exactly who needs to clean up their act.
MailMeter Storage Manager
MailMeter Storage Manager is a space saving tool for IT managers to reduce the size of the email server message storage. Through innovative rules, MailMeter removes attachments from messages and replaces them with links to the attachments in the archive. This reduces message size by nearly 90%. As a result people’s mailboxes are smaller, user quotas hold more messages, backups go faster, less expensive storage is needed, and recovery from a disaster is quicker.
MailMeter MBA (Mailbox Analysis)
Appendix A: Definitions
Archiving: The process of permanently storing files in a repository for future reference.
Discovery/E-Discovery: The process of finding pertinent facts or documents within electronic data, especially email, for compulsory disclosure to the opposing party in a criminal or civil action before a trial.
Disposition: The process of destroying documents or files after a retention period has been met.
EAUP (Email Acceptable Usage Policy): A written policy regarding the proper usage of the corporate email resource by which every employee must abide. Email Archiving: The process of storing email files, attachments and meta data in a repository for reference, and ease of retrieval.
Email Compliance: The ability to ensure all email data is stored, managed and retained in a specified manner and for certain time periods according to applicable regulation legislation.
Email Filters: A program or routine that blocks email data from passing through the mail server if it meets particular criterion. (Using filters is a blunt instrument that can result in annoying false positives and false negatives, severely interrupting the normal flow of business)
Email Management: The general market term for vendors that provide software to capture, archive, analyze and report on corporate email activity. Exchange (Microsoft): The name of the server software that many
companies use to process email.
ILM (Information Lifecycle Management): ILM products automate the processes of managing the flow, usage, storage and disposal, typically organizing data into separate tiers according to specified policies, and automating data migration from one tier to another based on those criteria. Monitoring: The practice of supervising company email for significant trends or suspicious activity to proactively manage email risks.
.PST: An email archive file format in the Microsoft Exchange environment that contains compressed email and attachments files.
Quota: The practice of limiting the amount of email storage each email user can retain on the server in order to conserve space on the mail server.
Retention Policies: The guidelines that specify what time period each type of business document is retained in storage, after which the documents are destroyed.
Stubbing: The functionality in email archiving software to leave a “pointer” that partially replaces the actual message and/or attachment in order to save space in the mail live server. The actual attachment and message body are stored in a separate location and recalled when the user clicks on a link in the stub.
