Should you Outsource your Email Archive? Speaker: Dan Keldsen Director, Market Intelligence at AIIM.org www.BizTechTalk.com (blog) Twitter.com/dankeldsen (backchannel)

Why Call Out E-mail for Archiving? Uncontrolled nature of business e-mail invites problems It seems personal, but it's BUSINESS Continued e-mail volume, despite alternatives Costs: Cost of highly available storage Cost to manage the storage Cost to back up – and restore! Messaging system performance Personal productivity

Uncontrolled nature of business e-mail invites problems

It seems personal, but it's BUSINESS

Continued e-mail volume, despite alternatives

Costs:

Cost of highly available storage

Cost to manage the storage

Cost to back up – and restore!

Messaging system performance

Personal productivity

What are you Targeting for Content Security? 44% Stated E-mail was top concern Source: AIIM Market IQ on Content Security, Q4 2007

44% Stated E-mail was top concern

The Growing Elephant eDiscovery is a clear driver of investment in e-mail archiving Without proactive processes and systems, every discovery request risks being chaotic and risk-laden Mitigate risk with a solid foundation, and plan for future improvement

eDiscovery is a clear driver of investment in e-mail archiving

Without proactive processes and systems, every discovery request risks being chaotic and risk-laden

Mitigate risk with a solid foundation, and plan for future improvement

Archiving as Foundation Easy to overcomplicate, but… Don't let the drive to solve E-mail Archiving blind you to larger problems Prioritize and Expand Electronic Records Management E-mail Management E-mail Archiving

Easy to overcomplicate, but…

Don't let the drive to solve E-mail Archiving blind you to larger problems

Prioritize and Expand

EDRM START

Balancing Needs with Solutions Needs: Control Governance Visibility Findability Solution decisions: Architecture Trust Cost

Needs:

Control

Governance

Visibility

Findability

Solution decisions:

Architecture

Trust

Cost

Balancing Enabling vs. Disabling Risk vs. Benefit

Control At the heart of e-mail archiving Getting relevant e-mail into archive Manual Automatic Hybrid If this part of the process is broken, all downstream benefits FAIL!

At the heart of e-mail archiving

Getting relevant e-mail into archive

Manual

Automatic

Hybrid

If this part of the process is broken, all downstream benefits FAIL!

Governance It's not enough to state that e-mail that meet criteria x, y, z "shall be placed into the archive" Compliance is verification of stated policies of procedures Without verification of compliance, you do not have Governance (Train and) Trust… but verify

It's not enough to state that e-mail that meet criteria x, y, z "shall be placed into the archive"

Compliance is verification of stated policies of procedures

Without verification of compliance, you do not have Governance

(Train and) Trust… but verify

Visibility What makes e-mail management of any kind troubling? Lack of visibility into the actual contents of e-mail Smoking guns Outdated versions of content being passed via e-mail, when current versions exist in another repository A measure of what % of e-mail is useful vs. filler/garbage/CYA

What makes e-mail management of any kind troubling?

Lack of visibility into the actual contents of e-mail

Smoking guns

Outdated versions of content being passed via e-mail, when current versions exist in another repository

A measure of what % of e-mail is useful vs. filler/garbage/CYA

Findability You don't want to search, you want to FIND, or verify that there is nothing TO find If you can't find it, it doesn't exist… Until opposing counsel turns up a copy YOU couldn't find

You don't want to search, you want to FIND, or verify that there is nothing TO find

If you can't find it, it doesn't exist…

Until opposing counsel turns up a copy YOU couldn't find

Architecture - Where to Filter? Hosted Solution - outside Gateway - edge E-mail Server - just past the edge Client-side - all the way in

Hosted Solution - outside

Gateway - edge

E-mail Server - just past the edge

Client-side - all the way in

Capturing E-mail Source: AIIM Training on E-mail Management - www.aiim.org/training Hosted SMTP relay Messaging application Client application SMTP Archive application Journaling - Log shipping - Personal archive file MAPI -

Complexity of Control From a scalability and management point of view Less is More Apply solutions where you can affect the most inputs/outputs at once Manual processes should be avoided as much as possible Perimeter Core Content

From a scalability and management point of view

Less is More

Apply solutions where you can affect the most inputs/outputs at once

Manual processes should be avoided as much as possible

Key Example - Litigation Hold Which would you rather have? Broadcast e-mail: "Please do not delete any e-mail relating to Client X. Retain copies until further notice." Apply a rule to thousands of local inboxes. Apple a rule to clusters of the core e-mail servers. Apply a rule to a centralized repository.

Which would you rather have?

Broadcast e-mail:

"Please do not delete any e-mail relating to Client X. Retain copies until further notice."

Apply a rule to thousands of local inboxes.

Apple a rule to clusters of the core e-mail servers.

Apply a rule to a centralized repository.

Who do you Trust, Technically? As a former CTO and (reformed) paranoid security guy, let me ask… who holds the keys to your e-mail kingdom? The Sysadmin? When your e-mail archiving system is being accessed, do you know by whom, and why? When messages have been manipulated, deleted, obscured, overwritten?

As a former CTO and (reformed) paranoid security guy, let me ask… who holds the keys to your e-mail kingdom? The Sysadmin?

When your e-mail archiving system is being accessed, do you know by whom, and why? When messages have been manipulated, deleted, obscured, overwritten?

Who Watches the Watchers? Who should have rights, and what should the rights be? With e-mail being one of the most ripe areas for the discovery of evidence, e-mail must be untampered if you wish to survive lawsuits IT may "run" the infrastructure and even "own" the solution, but the business owns the content and is liable for abuses and misuses

Who should have rights, and what should the rights be?

With e-mail being one of the most ripe areas for the discovery of evidence, e-mail must be untampered if you wish to survive lawsuits

IT may "run" the infrastructure and even "own" the solution, but the business owns the content and is liable for abuses and misuses

Costs Cannot compare costs of outsourcing with "insourcing" if you're not currently measuring existing costs Staffing Storage Bandwidth Software Hardware Power Legal fees

Cannot compare costs of outsourcing with "insourcing" if you're not currently measuring existing costs

Staffing

Storage

Bandwidth

Software

Hardware

Power

Legal fees

ROI Calculator For Professional Members of AIIM Download the newly released E-mail Management ROI calculator… www.aiim.org/emailroicalculator (non-members, $125 professional membership fee will provide access)

For Professional Members of AIIM

Download the newly released E-mail Management ROI calculator…

www.aiim.org/emailroicalculator

(non-members, $125 professional membership fee will provide access)

Rent or Own? What is your organizational policy on buying versus renting/subscription-based solutions? It's 2008 - what are your options? Outright bans on specific types of solutions (appliance, SaaS, etc. are simply bad business. Options abound.)

What is your organizational policy on buying versus renting/subscription-based solutions?

It's 2008 - what are your options?

Outright bans on specific types of solutions (appliance, SaaS, etc. are simply bad business. Options abound.)

Consider Your Options… In the meantime…