4 Steps to Defensibility: Using an Email Archive

eDiscovery and general litigation readiness were the third major drivers to the Email Archiving industry.  The first two were Exchange/mailbox management and regulatory compliance for SEC/NASD compliance.

The archive held much promise because it proffered a way to minimize the pain that organizations were feeling around the preservation, collection and production of email.  If deployed and configured correctly, it would provide several benefits, most notable the ability to search ONE location for email.

Ancillary benefits would be that the email in that ONE location would be indexed for speedy searching, stored on spinning disk for speedy retrieval and that a UI (user interface – a tool) would be given to Legal to enable to do these things themselves, without having to rely on IT.

There is a key dependency here, though.  In order to search for email from ONE location only, the organization must show that all the available email is there.  This does not mean that there cannot be cached copies available for offline access, it just means that anything available on laptops/desktops or on file servers must also be available in the archive.

What is the best way to do this?  First, make sure that all email is captured by the archive.  Some people do this through Exchange journaling; others have preferred ways to capture the mail.  (Disclosure: Mimecast has a way to capture email that it prefers to journaling.)

Second, turn off the ability to create local PST or NSF stores of email.  This means that anything that exists will exist in the archive.  This would cause a user revolt in many organizations as people have been using PST files to get around mailbox quotas for years, but the archive can grant back to the user the ability to keep a seemingly boundless mailbox, without creating added burden on the mail server.

Third, make sure historic PST/NSF files are migrated into the archive for continued access by both the end user and Legal.

Fourth, make sure the archive has an ability to suspend routine purges when the organization comes under a preservation obligation (legal hold).

There are a couple added benefits to this sort of use of the archive.  One, the organization’s document retention policy can now be applied to email in a more automated fashion.  And, two, the legal hold can now be run in more of a granular fashion than the sledgehammer approach that had been used in the past.

We hear anecdotes of companies that aspire to this level of usage in their archive, but are having trouble getting signoff from all the concerned stakeholders, including outside counsel in many cases.  Chime in with your experiences.